…nstead of _relevant_

https://bugs.webkit.org/show_bug.cgi?id=230941

Patch by Alexey Shvayka <[email protected]> on 2021-12-10
Reviewed by Sam Weinig.

LayoutTests/imported/w3c:

Import WPT tests from web-platform-tests/wpt#32012.

* web-platform-tests/dom/events/Event-timestamp-cross-realm-getter-expected.txt: Added.
* web-platform-tests/dom/events/Event-timestamp-cross-realm-getter.html: Added.
* web-platform-tests/html/browsers/history/the-history-interface/history_back_cross_realm_method-expected.txt: Added.
* web-platform-tests/html/browsers/history/the-history-interface/history_back_cross_realm_method.html: Added.
* web-platform-tests/html/browsers/history/the-history-interface/history_forward_cross_realm_method-expected.txt: Added.
* web-platform-tests/html/browsers/history/the-history-interface/history_forward_cross_realm_method.html: Added.
* web-platform-tests/html/browsers/history/the-history-interface/history_go_cross_realm_method-expected.txt: Added.
* web-platform-tests/html/browsers/history/the-history-interface/history_go_cross_realm_method.html: Added.
* web-platform-tests/html/webappapis/scripting/reporterror-cross-realm-method-expected.txt: Added.
* web-platform-tests/html/webappapis/scripting/reporterror-cross-realm-method.html: Added.
* web-platform-tests/html/webappapis/structured-clone/structured-clone-cross-realm-method-expected.txt: Added.
* web-platform-tests/html/webappapis/structured-clone/structured-clone-cross-realm-method.html: Added.
* web-platform-tests/requestidlecallback/callback-timeRemaining-cross-realm-method-expected.txt: Added.
* web-platform-tests/requestidlecallback/callback-timeRemaining-cross-realm-method.html: Added.

Source/WebCore:

This patch replaces _current_ global object with _relevant_, as per recommendation
for spec authors [1], for select WebIDL operations / attributes that satisfy all
the following conditions:

  1) it's an instance member: static ones and constructors can't use _relevant_;
  2) it's on standards track (not deprecated / WebKit-only / internal);
  3) the change is directly observable: global object is used for something
     beyond lifecycle / event loop / parsing CSS etc;
  4) the change either aligns WebKit with both Blink and Gecko,
     or the spec explicitly requires _relevant_ realm / settings object.

Most of the remaining [CallWith=GlobalObject] instances are correctly used for
converting JS arguments to WebIDL values; the rest, along with _current_ Document
and ScriptExecutionContext, either match the spec or replacing them with _relevant_
global object is not directly observable (see condition #3).

This change is aimed at fixing web-exposed APIs rather than performing a global cleanup.

[1] https://html.spec.whatwg.org/multipage/webappapis.html#concept-current-everything

Tests: imported/w3c/web-platform-tests/dom/events/Event-timestamp-cross-realm-getter.html
       imported/w3c/web-platform-tests/html/browsers/history/the-history-interface/history_back_cross_realm_method.html
       imported/w3c/web-platform-tests/html/browsers/history/the-history-interface/history_forward_cross_realm_method.html
       imported/w3c/web-platform-tests/html/browsers/history/the-history-interface/history_go_cross_realm_method.html
       imported/w3c/web-platform-tests/html/webappapis/scripting/reporterror-cross-realm-method.html
       imported/w3c/web-platform-tests/html/webappapis/structured-clone/structured-clone-cross-realm-method.html
       imported/w3c/web-platform-tests/requestidlecallback/callback-timeRemaining-cross-realm-method.html

* Modules/indexeddb/IDBFactory.idl:
https://www.w3.org/TR/IndexedDB/#dom-idbfactory-open (step 2)
https://www.w3.org/TR/IndexedDB/#dom-idbfactory-deletedatabase (step 1)
https://www.w3.org/TR/IndexedDB/#dom-idbfactory-databases (step 1)

* Modules/paymentrequest/PaymentRequest.idl:
https://www.w3.org/TR/payment-request/#show-method (steps 2-4)
https://www.w3.org/TR/payment-request/#can-make-payment-algorithm (before step 1)

* bindings/scripts/CodeGeneratorJS.pm:
(GenerateCallWith):
* bindings/scripts/IDLAttributes.json:
* bindings/scripts/test/JS/JSTestObj.cpp:
* bindings/scripts/test/TestObj.idl:
* dom/Event.idl:
https://dom.spec.whatwg.org/#inner-event-creation-steps (step 3)

* dom/IdleDeadline.idl:
https://w3c.github.io/requestidlecallback/#the-requestidlecallback-method (step 1)

* page/History.idl:
https://html.spec.whatwg.org/multipage/history.html#dom-history-go (step 1)
https://html.spec.whatwg.org/multipage/history.html#dom-history-back (step 1)
https://html.spec.whatwg.org/multipage/history.html#dom-history-forward (step 1)

* page/DOMWindow.cpp:
(WebCore::DOMWindow::setTimeout):
(WebCore::DOMWindow::setInterval):
* page/DOMWindow.h:
* workers/WorkerGlobalScope.cpp:
(WebCore::WorkerGlobalScope::setTimeout):
(WebCore::WorkerGlobalScope::setInterval):
* workers/WorkerGlobalScope.h:
Although condition #4 isn't satisfied for setTimeout() / setInterval() because
_current_ global object is used only for logging, replacing it with _relevant_
nicely cleans up method signatures.

* page/WindowOrWorkerGlobalScope.cpp:
(WebCore::WindowOrWorkerGlobalScope::structuredClone):
* page/WindowOrWorkerGlobalScope.h:
* page/WindowOrWorkerGlobalScope.idl:
https://html.spec.whatwg.org/multipage/webappapis.html#report-the-exception
https://html.spec.whatwg.org/multipage/structured-data.html#structured-cloning (step 2)


Canonical link: https://commits.webkit.org/245123@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@286895 268f45cc-cd09-0410-ab3c-d52691b4dbfc

https://bugs.webkit.org/show_bug.cgi?id=251063
rdar://104585575

Reviewed by Mark Lam and Justin Michaud.

This patch enhances CallFrame::dump to support wasm frames in btjs stacktrace.
The example is as follows.

    frame #0: 0x00000001035fca78 JavaScriptCore`JSC::functionBreakpoint(globalObject=0x000000012f410068, callFrame=0x000000016fdfa9d0) at JSDollarVM.cpp:2273:9 [opt]
    frame WebKit#1: 0x000000010ec44204 0x10eccc5dc
    frame WebKit#2: 0x000000010eccc5dc callback#Dwaxn6 [Baseline bc#50](Undefined)
    frame WebKit#3: 0x000000010ec4ca84 wasm-stub [WasmToJS](Wasm::Instance: 0x10d29da40)
    frame WebKit#4: 0x000000010ed0c060 <?>.wasm-function[1] [OMG](Wasm::Instance: 0x10d29da40)
    frame WebKit#5: 0x000000010ed100d0 jsToWasm#CWTx6k [FTL bc#22](Cell[JSModuleEnvironment]: 0x12f524540, Cell[WebAssemblyFunction]: 0x10d06a3a8, 1, 2, 3)
    frame WebKit#6: 0x000000010ec881b0 #D5ymZE [Baseline bc#733](Undefined, Cell[Generator]: 0x12f55c180, 1, Cell[Object]: 0x12f69dfc0, 0, Cell[JSLexicalEnvironment]: 0x12f52cee0)
    frame WebKit#7: 0x000000010ec3c008 asyncFunctionResume#A4ayYg [LLInt bc#49](Undefined, Cell[Generator]: 0x12f55c180, Cell[Object]: 0x12f69dfc0, 0)
    frame WebKit#8: 0x000000010ec3c008 promiseReactionJobWithoutPromise#D0yDF1 [LLInt bc#25](Undefined, Cell[Function]: 0x12f44f3c0, Cell[Object]: 0x12f69dfc0, Cell[Generator]: 0x12f55c180)
    frame WebKit#9: 0x000000010ec80ec0 promiseReactionJob#EdShZz [Baseline bc#74](Undefined, Undefined, Cell[Function]: 0x12f44f3c0, Cell[Object]: 0x12f69dfc0, Cell[Generator]: 0x12f55c180)
    frame WebKit#10: 0x000000010ec3c728
    frame WebKit#11: 0x0000000103137560 JavaScriptCore`JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) [inlined] JSC::JITCode::execute(this=<unavailable>, vm=<unavailable>, protoCallFrame=<unavailable>) at JITCodeInlines.h:42:38 [opt]
    frame WebKit#12: 0x0000000103137524 JavaScriptCore`JSC::Interpreter::executeCall(this=<unavailable>, lexicalGlobalObject=<unavailable>, function=<unavailable>, callData=<unavailable>, thisValue=<unavailable>, args=<unavailable>) at Interpreter.cpp:1093:27 [opt]
    frame WebKit#13: 0x000000010349d6d0 JavaScriptCore`JSC::runJSMicrotask(globalObject=0x000000012f410068, identifier=(m_identifier = 81), job=JSValue @ x22, argument0=JSValue @ x26, argument1=JSValue @ x25, argument2=<unavailable>, argument3=<unavailable>) at JSMicrotask.cpp:98:9 [opt]
    frame WebKit#14: 0x00000001039dfc54 JavaScriptCore`JSC::VM::drainMicrotasks() (.cold.1) at VM.cpp:0:9 [opt]
    frame WebKit#15: 0x00000001035e58a4 JavaScriptCore`JSC::VM::drainMicrotasks() [inlined] JSC::MicrotaskQueue::dequeue(this=<unavailable>) at VM.cpp:0:9 [opt]
    frame WebKit#16: 0x00000001035e5894 JavaScriptCore`JSC::VM::drainMicrotasks(this=0x000000012f000000) at VM.cpp:1255:46 [opt]
    ...

* Source/JavaScriptCore/interpreter/CallFrame.cpp:
(JSC::CallFrame::dump const):

Canonical link: https://commits.webkit.org/259262@main

… in site-isolation

rdar://127515199
https://bugs.webkit.org/show_bug.cgi?id=273715

Unreviewed test gardening.

* LayoutTests/platform/mac-site-isolation/TestExpectations:

Canonical link: https://commits.webkit.org/278516@main

…volume scrubber on a video player

https://bugs.webkit.org/show_bug.cgi?id=275469
<rdar://129080145>

Reviewed by Antti Koivisto.

1. In EventHandler::mouseDragged we dispatch the "mouse move" event
2. JS triggers some mutation which makes the tree dirty
3. later in EventHandler::handleMouseMoveEvent() we call EventHandler::handleMouseDraggedEvent() (tree is dirty)
   which, through a few layers of functions calls VisiblePosition::canonicalPosition()
4. VisiblePosition::canonicalPosition() needs a clean tree so it calls Document::updateLayout() which is turn destroys some renderers (see #2)
5. In-between EventHandler::handleMouseDraggedEvent() and VisiblePosition::canonicalPosition(), we CheckPtr a renderer which gets destroyed at #4.

The fix (what we normally do with cases like this) is to make sure we clean the tree before entering VisiblePosition.

* Source/WebCore/page/EventHandler.cpp:
(WebCore::EventHandler::handleMouseDraggedEvent):

Canonical link: https://commits.webkit.org/280013@main

…ter follows to the same value

https://bugs.webkit.org/show_bug.cgi?id=279570
rdar://135851156

Reviewed by Keith Miller.

Let's consider the following FTL graph.

    BB#0
    @0 = NewObject()
    Jump WebKit#1

    BB#1
    PutByOffset(@0, 0, @x)
    Jump WebKit#2

    BB#2
    ...
    @z = ...
    @1 = GetByOffset(@x, 0)
    Branch(@1, WebKit#3, WebKit#4)

    BB#3
    PutByOffset(@0, 0, @z)
    Jump WebKit#5

    BB#4
    PutByOffset(@0, 0, @z)
    Jump WebKit#5

    BB#5
    Jump WebKit#2

Now, we would like to eliminate @0 object allocation. And we are
computing SSA for pointers of fields of the that object which gets
eliminated. Consider about @x's fields' SSA. PutByOffset becomes Def
and GetByOffset becomes Use. And the same field will get the same SSA
variable. So we first puts Defs and compute Phis based on that.

In ObjectAllocationSinking phase, we had a fast path when the both SSA
variable is following to the same value. Let's see BB#5. Because BB#3
and BB#4 defines Defs, dominance frontier BB#5 will need to introduce
Phi. But interestingly, both SSA variable is following to the same @z.
As a result, we were not inserting Phi for this case.

But this is wrong. Inserted Phi is a Def, and based on that, we will
further introduce Phis with that. If we omit inserting Phi in BB#5,
we will not insert Phi into BB#2 while BB#2 will merge BB#1's Def And
BB#5's Phi's Def. As a result, in BB#2, we think this variable is
following to BB#1's Def. But that's wrong and BB#5's Phi exists.

This patch removes this fast path to fix the issue.

* JSTests/stress/object-allocation-sinking-phi-insertion-for-pointers.js: Added.
(Queue):
(Queue.prototype.enqueue):
(Queue.prototype.dequeue):
(i.queue.dequeue):
* Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp:

Canonical link: https://commits.webkit.org/283558@main

    [JSC] ObjectAllocationSinking should not omit phi insertion when pointer follows to the same value
    https://bugs.webkit.org/show_bug.cgi?id=279570
    rdar://135851156

    Reviewed by Keith Miller.

    Let's consider the following FTL graph.

        BB#0
        @0 = NewObject()
        Jump #1

        BB#1
        PutByOffset(@0, 0, @x)
        Jump #2

        BB#2
        ...
        @z = ...
        @1 = GetByOffset(@x, 0)
        Branch(@1, #3, #4)

        BB#3
        PutByOffset(@0, 0, @z)
        Jump #5

        BB#4
        PutByOffset(@0, 0, @z)
        Jump #5

        BB#5
        Jump #2

    Now, we would like to eliminate @0 object allocation. And we are
    computing SSA for pointers of fields of the that object which gets
    eliminated. Consider about @x's fields' SSA. PutByOffset becomes Def
    and GetByOffset becomes Use. And the same field will get the same SSA
    variable. So we first puts Defs and compute Phis based on that.

    In ObjectAllocationSinking phase, we had a fast path when the both SSA
    variable is following to the same value. Let's see BB#5. Because BB#3
    and BB#4 defines Defs, dominance frontier BB#5 will need to introduce
    Phi. But interestingly, both SSA variable is following to the same @z.
    As a result, we were not inserting Phi for this case.

    But this is wrong. Inserted Phi is a Def, and based on that, we will
    further introduce Phis with that. If we omit inserting Phi in BB#5,
    we will not insert Phi into BB#2 while BB#2 will merge BB#1's Def And
    BB#5's Phi's Def. As a result, in BB#2, we think this variable is
    following to BB#1's Def. But that's wrong and BB#5's Phi exists.

    This patch removes this fast path to fix the issue.

    * JSTests/stress/object-allocation-sinking-phi-insertion-for-pointers.js: Added.
    (Queue):
    (Queue.prototype.enqueue):
    (Queue.prototype.dequeue):
    (i.queue.dequeue):
    * Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp:

    Canonical link: https://commits.webkit.org/283558@main

Canonical link: https://commits.webkit.org/280938.337@safari-7619-branch

Reviewed by NOBODY (OOPS!).

This was spotted by ASan, the real and imaginary AudioFloatArrays end-up using aligned_alloc() for
their storage, which expects a power-of-two size. Using fftSize / 2 + 1 makes the size
non-power-of-two, the full fftSize being power-of-two (we now have an ASSERT for this).

==1733723==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fc75c438bca bp 0x7ffed612c860 sp 0x7ffed612c028 T0)
==1733723==The signal is caused by a WRITE memory access.
==1733723==Hint: address points to the zero page.
    #0 0x7fc75c438bca in __memset_avx2_unaligned_erms (/lib64/libc.so.6+0x16dbca) (BuildId: 77c77fee058b19c6f001cf2cb0371ce3b8341211)
    WebKit#1 0x2fc4ce in __asan_memset (/var/home/phil/WebKit/local-build-gtk/WebKitBuild/GTK/Release/bin/WebKitWebProcess+0x2fc4ce) (BuildId: e2b0aff0c8fcab48026d63cf711cd70d0aeceb79)
    WebKit#2 0x7fc77047599e in WebCore::FFTFrame::FFTFrame(unsigned int) UnifiedSource-3c72abbe-20.cpp
    WebKit#3 0x7fc76d41c08b in WebCore::PeriodicWave::createBandLimitedTables(float const*, float const*, unsigned int, WebCore::ShouldDisableNormalization) UnifiedSource-f8afad56-52.cpp
    WebKit#4 0x7fc76d41f371 in WebCore::PeriodicWave::generateBasicWaveform(WebCore::PeriodicWave::Type) UnifiedSource-f8afad56-52.cpp
    WebKit#5 0x7fc76d41e633 in WebCore::PeriodicWave::createSine(float) UnifiedSource-f8afad56-52.cpp
    WebKit#6 0x7fc76d3c2352 in WebCore::BaseAudioContext::periodicWave(WebCore::OscillatorType) UnifiedSource-f8afad56-49.cpp
    WebKit#7 0x7fc76d410dbf in WebCore::OscillatorNode::setTypeForBindings(WebCore::OscillatorType) UnifiedSource-f8afad56-52.cpp
    WebKit#8 0x7fc76d4102f4 in WebCore::OscillatorNode::create(WebCore::BaseAudioContext&, WebCore::OscillatorOptions const&) UnifiedSource-f8afad56-52.cpp
    WebKit#9 0x7fc76d3bc210 in WebCore::BaseAudioContext::createOscillator() UnifiedSource-f8afad56-49.cpp
    WebKit#10 0x7fc76acbc743 in WebCore::jsBaseAudioContextPrototypeFunction_createOscillator(JSC::JSGlobalObject*, JSC::CallFrame*) UnifiedSource-3a52ce78-11.cpp
    WebKit#11 0x7fc705c10037  (<unknown module>)

* Source/WebCore/platform/audio/gstreamer/FFTFrameGStreamer.cpp:
(WebCore::FFTFrame::FFTFrame):

https://bugs.webkit.org/show_bug.cgi?id=288102
rdar://145222010

Reviewed by Yusuke Suzuki.

Added the notion of a string list to a parsed RegExp that is in the form of
  /^(?:break|case|which|do|for)/ with an optional trailing $.
Such a RegExp will not backtrack and therefore we can streamline the code we emit for such a pattern.

This change involves recognizing beginning of string anchored alternations of strings while parsing and
then treating the generation of JIT code differently for these patterns.  This includes changing how
conditional branching works, specifically that instead of the "fall through on match" for each term,
to a "jump on match" for the whole alternation.

The current code generated for the "case" elternative is:
   8:Term PatternCharacter checked-offset:(3) 'c'
               <156> 0x11381430c:    add      w1, w1, WebKit#2
               <160> 0x113814310:    cmp      w1, w2
               <164> 0x113814314:    b.hi     0x113814444 -> <468>
  10:Term PatternCharacter checked-offset:(4) 'c'
               <168> 0x113814318:    sub      x17, x0, WebKit#4
               <172> 0x11381431c:    ldr      w17, [x17, x1]
               <176> 0x113814320:    movz     w16, #0x6163
               <180> 0x113814324:    movk     w16, #0x6573, lsl WebKit#16 -> 0x65736163
               <184> 0x113814328:    cmp      w17, w16
               <188> 0x11381432c:    b.ne     0x113814444 -> <468>
  11:Term PatternCharacter checked-offset:(4) 'a' already handled
  12:Term PatternCharacter checked-offset:(4) 's' already handled
  13:Term PatternCharacter checked-offset:(4) 'e' already handled
  14:NestedAlternativeNext minimum-size:(5),checked-offset:(5)
               <192> 0x113814330:    movz     x16, #0x4444
               <196> 0x113814334:    movk     x16, #0x1381, lsl WebKit#16
               <200> 0x113814338:    movk     x16, #0x8001, lsl WebKit#32
               <204> 0x11381433c:    movk     x16, #0xc973, lsl WebKit#48 -> 0x113814444 JIT PC
               <208> 0x113814340:    stur     x16, [sp, WebKit#8]
               <212> 0x113814344:    b        0x113814404 -> <404>
With some additional backtracking code:
   9:NestedAlternativeNext minimum-size:(4),checked-offset:(4)
               <468> 0x113814444:    sub      w1, w1, WebKit#2
               <472> 0x113814448:    b        0x113814348 -> <216>

With this change, the processing of "case" becomes:
   9:StringListAlternativeNext minimum-size:(4),checked-offset:(4)
               <132> 0x12a8285c4:    sub      w1, w1, WebKit#1
               <136> 0x12a8285c8:    cmp      w1, w2
               <140> 0x12a8285cc:    b.hi     0x12a8285e8 -> <168>
  10:Term PatternCharacter checked-offset:(4) 'c'
               <144> 0x12a8285d0:    sub      x17, x0, WebKit#4
               <148> 0x12a8285d4:    ldr      w17, [x17, x1]
               <152> 0x12a8285d8:    movz     w16, #0x6163
               <156> 0x12a8285dc:    movk     w16, #0x6573, lsl WebKit#16 -> 0x65736163
               <160> 0x12a8285e0:    cmp      w17, w16
               <164> 0x12a8285e4:    b.eq     0x12a82866c -> <300>
  11:Term PatternCharacter checked-offset:(4) 'a' already handled
  12:Term PatternCharacter checked-offset:(4) 's' already handled
  13:Term PatternCharacter checked-offset:(4) 'e' already handled
  14:StringListAlternativeNext minimum-size:(5),checked-offset:(5)
With no backtracking code.

We are able to eliminate one branch and the saving of the continuation PC for backtracking.
The code size to process these string list RegExp is reduces.  For the example RegExp above,
the prior version created 1940 bytes (485 instructions) of code while the code created with this
1392 bytes (345 instructions) of code, a nearly 30% reduction in code.

This change is a ~18% progression on the new regexp-keyword-parsing microbenchmark:

                                 Baseline               YarrStringList

regexp-keyword-parsing      136.7065+-0.9807     ^    116.0161+-1.1791        ^ definitely 1.1783x faster

<geometric>                 136.7065+-0.9807     ^    116.0161+-1.1791        ^ definitely 1.1783x faster

* JSTests/microbenchmarks/regexp-keyword-parsing.js: Added.
(arrayToString):
(objectToString):
(dumpValue):
(compareArray):
(compareGroups):
(testRegExp):
(testRegExpSyntaxError):
(let.re.break.case.catch.continue.debugger.default.else.finally.if):
(let.re1.break.case.catch.continue.debugger.default.else.finally.if):
* JSTests/stress/regexp-parsing-tokens.js: Added.
(arrayToString):
(objectToString):
(dumpValue):
(compareArray):
(compareGroups):
(testRegExp):
(testRegExpSyntaxError):
* Source/JavaScriptCore/yarr/YarrJIT.cpp:
* Source/JavaScriptCore/yarr/YarrPattern.cpp:
(JSC::Yarr::YarrPatternConstructor::atomParenthesesEnd):
(JSC::Yarr::YarrPatternConstructor::checkForTerminalParentheses):
(JSC::Yarr::PatternAlternative::dump):
(JSC::Yarr::PatternTerm::dump):
* Source/JavaScriptCore/yarr/YarrPattern.h:
(JSC::Yarr::PatternTerm::PatternTerm):
(JSC::Yarr::PatternAlternative::PatternAlternative):

Canonical link: https://commits.webkit.org/290791@main

https://bugs.webkit.org/show_bug.cgi?id=288102
rdar://145222010

Reviewed by Yusuke Suzuki.

Added the notion of a string list to a parsed RegExp that is in the form of
  /^(?:break|case|which|do|for)/ with an optional trailing $.
Such a RegExp will not backtrack and therefore we can streamline the code we emit for such a pattern.

This change involves recognizing beginning of string anchored alternations of strings while parsing and
then treating the generation of JIT code differently for these patterns.  This includes changing how
conditional branching works, specifically that instead of the "fall through on match" for each term,
to a "jump on match" for the whole alternation.

Fixed a bug in the original version where we weren't properly checking the nested alternatives to see
if they only contain fixed single count PatternCharacter terms.

The current code generated for the "case" elternative is:
   8:Term PatternCharacter checked-offset:(3) 'c'
               <156> 0x11381430c:    add      w1, w1, WebKit#2
               <160> 0x113814310:    cmp      w1, w2
               <164> 0x113814314:    b.hi     0x113814444 -> <468>
  10:Term PatternCharacter checked-offset:(4) 'c'
               <168> 0x113814318:    sub      x17, x0, WebKit#4
               <172> 0x11381431c:    ldr      w17, [x17, x1]
               <176> 0x113814320:    movz     w16, #0x6163
               <180> 0x113814324:    movk     w16, #0x6573, lsl WebKit#16 -> 0x65736163
               <184> 0x113814328:    cmp      w17, w16
               <188> 0x11381432c:    b.ne     0x113814444 -> <468>
  11:Term PatternCharacter checked-offset:(4) 'a' already handled
  12:Term PatternCharacter checked-offset:(4) 's' already handled
  13:Term PatternCharacter checked-offset:(4) 'e' already handled
  14:NestedAlternativeNext minimum-size:(5),checked-offset:(5)
               <192> 0x113814330:    movz     x16, #0x4444
               <196> 0x113814334:    movk     x16, #0x1381, lsl WebKit#16
               <200> 0x113814338:    movk     x16, #0x8001, lsl WebKit#32
               <204> 0x11381433c:    movk     x16, #0xc973, lsl WebKit#48 -> 0x113814444 JIT PC
               <208> 0x113814340:    stur     x16, [sp, WebKit#8]
               <212> 0x113814344:    b        0x113814404 -> <404>
With some additional backtracking code:
   9:NestedAlternativeNext minimum-size:(4),checked-offset:(4)
               <468> 0x113814444:    sub      w1, w1, WebKit#2
               <472> 0x113814448:    b        0x113814348 -> <216>

With this change, the processing of "case" becomes:
   9:StringListAlternativeNext minimum-size:(4),checked-offset:(4)
               <132> 0x12a8285c4:    sub      w1, w1, WebKit#1
               <136> 0x12a8285c8:    cmp      w1, w2
               <140> 0x12a8285cc:    b.hi     0x12a8285e8 -> <168>
  10:Term PatternCharacter checked-offset:(4) 'c'
               <144> 0x12a8285d0:    sub      x17, x0, WebKit#4
               <148> 0x12a8285d4:    ldr      w17, [x17, x1]
               <152> 0x12a8285d8:    movz     w16, #0x6163
               <156> 0x12a8285dc:    movk     w16, #0x6573, lsl WebKit#16 -> 0x65736163
               <160> 0x12a8285e0:    cmp      w17, w16
               <164> 0x12a8285e4:    b.eq     0x12a82866c -> <300>
  11:Term PatternCharacter checked-offset:(4) 'a' already handled
  12:Term PatternCharacter checked-offset:(4) 's' already handled
  13:Term PatternCharacter checked-offset:(4) 'e' already handled
  14:StringListAlternativeNext minimum-size:(5),checked-offset:(5)
With no backtracking code.

We are able to eliminate one branch and the saving of the continuation PC for backtracking.
The code size to process these string list RegExp is reduces.  For the example RegExp above,
the prior version created 1940 bytes (485 instructions) of code while the code created with this
1392 bytes (345 instructions) of code, a nearly 30% reduction in code.

This change is a ~18% progression on the new regexp-keyword-parsing microbenchmark:

                                 Baseline               YarrStringList

regexp-keyword-parsing      136.7065+-0.9807     ^    116.0161+-1.1791        ^ definitely 1.1783x faster

<geometric>                 136.7065+-0.9807     ^    116.0161+-1.1791        ^ definitely 1.1783x faster

* JSTests/microbenchmarks/regexp-keyword-parsing.js: Added.
(arrayToString):
(objectToString):
(dumpValue):
(compareArray):
(compareGroups):
(testRegExp):
(testRegExpSyntaxError):
(let.re.break.case.catch.continue.debugger.default.else.finally.if):
(let.re1.break.case.catch.continue.debugger.default.else.finally.if):
* JSTests/stress/regexp-parsing-tokens.js: Added.
(arrayToString):
(objectToString):
(dumpValue):
(compareArray):
(compareGroups):
(testRegExp):
(testRegExpSyntaxError):
* Source/JavaScriptCore/yarr/YarrJIT.cpp:
* Source/JavaScriptCore/yarr/YarrPattern.cpp:
(JSC::Yarr::YarrPatternConstructor::atomParenthesesEnd):
(JSC::Yarr::YarrPatternConstructor::checkForTerminalParentheses):
(JSC::Yarr::PatternAlternative::dump):
(JSC::Yarr::PatternTerm::dump):
* Source/JavaScriptCore/yarr/YarrPattern.h:
(JSC::Yarr::PatternTerm::PatternTerm):
(JSC::Yarr::PatternAlternative::PatternAlternative):

Canonical link: https://commits.webkit.org/290982@main

https://bugs.webkit.org/show_bug.cgi?id=264576
rdar://114997939

Reviewed by BJ Burg.

(This work was done in collaboration with Razvan and was based on his
draft at WebKit@377f3e1.)

This commit enables automatically inspecting and pausing the
ServiceWorkerDebuggable. The idea is similar to the same functionalities
with the JSContext/JSGlobalObjectDebuggable. The general flow is:
1. When the debuggable is first created, we optionally mark it as
   inspectable.
2. As soon as the debuggable is marked inspectable, its main thread
   (the thread that it was created on) gets blocked.
3. When the auto-launched Web Inspector frontend finishes initializing,
   it notifies the backend.
   - It's important for the debuggable to wait for this signal because
     a genuine auto-inspection must appear attached to the debuggable
     before it begins execution, respecting any breakpoints set early on
     in its script (where auto-pausing is basically a breakpoint
     before line 1).
4. The backend unpauses the blocked debuggable. If auto-pausing was
   requested, tell the debugger agent to pause.

The service worker begins executing script unless its worker thread was
specified to start in the WorkerThreadStartMode::WaitForInspector.
During that waiting period, the worker thread can perform tasks sent
into its debugging run loop, until it's signaled to stop waiting and
continue to execute the script like normal. This commit makes use of
that interface to make the service worker pause (when justified, i.e.
developerExtrasEnabled) before running the above flow resembling
auto-inspecting a JSContext.

* Source/WebCore/workers/service/context/ServiceWorkerThread.cpp:
(WebCore::threadStartModeFromSettings):
(WebCore::ServiceWorkerThread::ServiceWorkerThread):
   - When there is potentially a remote inspector that would like to
     auto-inspect, make it so that the thread waits on start before
     executing its script.

* Source/WebCore/workers/service/context/ServiceWorkerThreadProxy.h:
* Source/WebCore/workers/service/context/ServiceWorkerThreadProxy.cpp:
(WebCore::ServiceWorkerThreadProxy::ServiceWorkerThreadProxy):
(WebCore::ServiceWorkerThreadProxy::threadStartedRunningDebuggerTasks):
   - Setting inspectability is step WebKit#1 in the above flow.
   - In step WebKit#2, calling `debuggable->setInspectable(true)` might block
     already, but we don't want that until the worker thread is setup
     and have the run loop be in debug mode, so we do that in a callback
     instead.
   - In step WebKit#4, when connection to the inspector completes or fails,
     the setInspectable call only returns then, so we unblock
     the worker thread to resume code execution.

* Source/WebCore/inspector/agents/worker/WorkerDebuggerAgent.h:
* Source/WebCore/inspector/WorkerInspectorController.h:
* Source/WebCore/inspector/WorkerInspectorController.cpp:
(WebCore::WorkerInspectorController::frontendInitialized):
(WebCore::WorkerInspectorController::connectFrontend):
(WebCore::WorkerInspectorController::disconnectFrontend):
(WebCore::WorkerInspectorController::createLazyAgents):
(WebCore::WorkerInspectorController::ensureDebuggerAgent):
* Source/WebCore/workers/service/context/ServiceWorkerDebuggable.cpp:
(WebCore::ServiceWorkerDebuggable::connect):
* Source/WebCore/workers/service/context/ServiceWorkerInspectorProxy.h:
* Source/WebCore/workers/service/context/ServiceWorkerInspectorProxy.cpp:
(WebCore::ServiceWorkerInspectorProxy::connectToWorker):
   - Mimic the logic for auto-inspecting a JSContext/JSGlobalObjectDebuggable.

* Source/JavaScriptCore/inspector/protocol/Inspector.json:
   - Step WebKit#3 in the above flow, notify the backend when frontend
     completes setting up.

* Source/WebCore/workers/service/context/ServiceWorkerDebuggable.h:
  - Allow service workers to be auto-inspected. (This is checked at https://github.com/rcaliman-apple/WebKit/blob/eng/Web-Inspector-Automatically-connect-Web-Inspector-to-ServiceWorker/Source/JavaScriptCore/inspector/remote/RemoteInspectionTarget.cpp#L95)

* Source/WTF/wtf/PlatformEnableCocoa.h:
   - Add feature flag just in case.

Canonical link: https://commits.webkit.org/291167@main

https://bugs.webkit.org/show_bug.cgi?id=302403

Reviewed by Yusuke Suzuki.

This PR includes seveal changes to improve the codegen of store/load:
* Optimized storePair to use a single move when constants are equal
* Eliminated register materialization for constant integer store
* Constant pointer folding when they are statically known

One example where these work together is I64Store, before:

    [   0x22d] I64Store
              0xf1a22bcc: ldrd r1, r2, [r10, #0x34]
              0xf1a22bd0: movw r0, #0x5d18
              0xf1a22bd4: mov r5, r0
              0xf1a22bd6: adds r5, r5, #7
              0xf1a22bd8: bhs.w #0xf1a22c44
              0xf1a22bdc: cmp r5, r2
              0xf1a22bde: bhs.w #0xf1a22c44
              0xf1a22be2: mov r5, r0
              0xf1a22be4: add r5, r1
              0xf1a22be6: movs r4, #0
              0xf1a22be8: movs r3, #0
              0xf1a22bea: str r3, [r5]
              0xf1a22bec: str r4, [r5, #4]

after:

    [   0x22d] I64Store
              0xf1b22c50: ldrd r1, r2, [r10, #0x34]
              0xf1b22c54: movw r5, #0x5d1f
              0xf1b22c58: cmp r5, r2
              0xf1b22c5a: bhs.w #0xf1b22cc0
              0xf1b22c5e: movw r12, #0x5d18
              0xf1b22c62: add.w r5, r1, r12
              0xf1b22c66: mov.w r12, #0
              0xf1b22c6a: str.w r12, [r5]
              0xf1b22c6e: str.w r12, [r5, #4]

On JetStream3's tfjs-wasm.js, we reduce the code size by -9,5KiB:

Base total code size: 433254 bytes (424KiB)
New total code size: 423578 bytes (414KiB)

Difference (new - base): -9676 bytes (-9,5KiB)
Percentage change: -2.23%

* Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h:
(JSC::MacroAssemblerARMv7::store16):
(JSC::MacroAssemblerARMv7::storePair32):
* Source/JavaScriptCore/wasm/WasmBBQJIT32_64.cpp:
(JSC::Wasm::BBQJITImpl::BBQJIT::store):
* Source/JavaScriptCore/wasm/WasmBBQJIT32_64.h:
(JSC::Wasm::BBQJITImpl::BBQJIT::emitCheckAndPrepareAndMaterializePointerApply):

Canonical link: https://commits.webkit.org/302984@main

… is also a destination

https://bugs.webkit.org/show_bug.cgi?id=302469

Reviewed by Justin Michaud.

This patch expands a ldrd into a pair of ldr if any of the destination
registers is also the register holding the memory address.

Before:

0xf1502462: ldrd r0, r1, [r0]

After:

0xf1502462: ldr r1, [r0, #4]
0xf1502464: ldr r0, [r0]

* Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h:
(JSC::MacroAssemblerARMv7::loadPair32):

Canonical link: https://commits.webkit.org/303043@main

…n to fix deadlock

https://bugs.webkit.org/show_bug.cgi?id=305674
rdar://168319182

Reviewed by Yusuke Suzuki.

The WASM debugger can deadlock when Thread WebKit#8 suspends Thread WebKit#4 via
thread_suspend() while Thread WebKit#4 is in the middle of ref counting operations.
The suspended thread may hold a WordLock (used for thread-safe ref counting),
and when the suspending thread tries to create a RefPtr copy, it blocks
waiting for the same lock.

The deadlock sequence:
1. Thread WebKit#4 acquires WordLock in strongDeref() destructor
2. Thread WebKit#8 suspends Thread WebKit#4 via thread_suspend() Mach kernel trap
3. Thread WebKit#4 is frozen mid-unlock, WordLock never released
4. Thread WebKit#8's lambda calls vm.apiLock().ownerThread(), creating RefPtr copy
5. RefPtr copy triggers strongRef() which tries to acquire same WordLock
6. Deadlock: Thread WebKit#4 suspended holding lock, Thread WebKit#8 blocked waiting

The fix adds ownerThreadUID() methods that return the thread UID directly
without creating temporary RefPtr objects, avoiding all ref counting
operations and the associated lock contention.

Canonical link: https://commits.webkit.org/305766@main

…F list updates under UseUIProcessForBackForwardItemLoading

https://bugs.webkit.org/show_bug.cgi?id=317044
rdar://179526448

Reviewed by NOBODY (OOPS!).

Under UseUIProcessForBackForwardItemLoading, the iframe client-redirect path in
HistoryController::updateForRedirectWithLockedBackForwardList's if-branch mutates the
HistoryItem in place without a deterministic mechanism for propagating the new URL to
UIProcess's WebBackForwardList — the existing notifyChanged → BackForwardUpdateItem
path is racy due to identifier-mismatch drops at the UIProcess sink.

Move the URL update to UIProcess: tag the navigation in decidePolicyForNavigationAction
(lockBackForwardList for non-main frames; clientRedirectSourceForHistory is not
populated until after the policy callback) and apply the BF list child URL update at
didCommitLoadForFrame via WebBackForwardList::updateChildURLForReplace. Wrap the in-place
mutation in HistoryItemClient::ignoreChangesForScope (now virtual so WebCore can use it)
to suppress the per-field BackForwardUpdateItem IPCs that would otherwise race.

The new method takes const String& (not const URL&) because WTF::URL::string() returns a
LIFETIME_BOUND const String&, which Swift-CXX interop cannot bridge without a
SWIFT_RETURNS_INDEPENDENT_VALUE annotation. The Swift counterpart in
WebBackForwardList.swift mirrors the C++ semantics and is marked @used so it survives
-O -wmo dead-code stripping. The FrameState mutation is encapsulated in a new
replaceFrameItemURL helper in WebBackForwardListSwiftUtilities.h so the Swift side does
not need to reach through .ptr() (which would require `unsafe` per the Safer Swift
Guidelines). The call site is gated on ENABLE(BACK_FORWARD_LIST_SWIFT) for the item
argument because the Swift bridge exposes WebBackForwardListItem as a foreign reference
pointer while the C++ method takes a reference, matching the established goToItem pattern.

Regression coverage: the third subtest of
imported/w3c/web-platform-tests/html/browsers/browsing-the-web/overlapping-navigations-and-traversals/cross-document-traversal-cross-document-traversal.html
("cross-document traversals in the same (back) direction: the result is going -2 with
only one load event") fails on origin/main with `assert_equals: first load event must be
going back expected "?1" but got ""` — the empty URL is the dropped-IPC symptom — and
passes with this fix.

The imported WPT test cannot reach the buggy path on its own because the WKTR auto-flip
of UseUIProcessForBackForwardItemLoading under SiteIsolation was reverted upstream (see
https://bugs.webkit.org/show_bug.cgi?id=316588). Rather than copying the test into
http/wpt/, this patch routes the opt-in through TestRunnerShared/TestFeatures.cpp's
hardcodedFeaturesBasedOnPathForTest: a new shouldExerciseUIProcessBackForwardItemLoading
predicate enables both flags for the affected imported path, keeping the single source
of truth in upstream WPT and centralizing the flag-pinning so future iframe-history
fixes can extend the same predicate. The forward-direction subtest still TIMEOUTs and is
tracked separately by https://bugs.webkit.org/show_bug.cgi?id=317145; once that lands,
the imported expected.txt's TIMEOUT line for the forward subtest will be flipped back to
PASS in that PR.

Also covered by existing SiteIsolation.* API tests that exercise iframe URL rewriting
under the flag (these continue to pass — they verify regression-freeness rather than
demonstrating the fix):
  - CanGoBackAfterLoadingAndNavigatingFrame
  - BackNavigationOverCrossSiteIframeWithoutBFCache
  - NavigateNestedIframeSameOriginBackForward

* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/overlapping-navigations-and-traversals/cross-document-traversal-cross-document-traversal-expected.txt:
  Updated to reflect the post-fix output: subtest WebKit#3 PASS (was FAIL), subtest WebKit#4
  TIMEOUT (was PASS — temporary, until bug 317145 lands).
* Source/WebCore/history/HistoryItem.h:
(WebCore::HistoryItemClient::ignoreChangesForScope):
* Source/WebCore/loader/HistoryController.cpp:
(WebCore::HistoryController::updateForRedirectWithLockedBackForwardList):
* Source/WebKit/UIProcess/API/APINavigation.h:
(API::Navigation::isClientRedirectReplace const):
(API::Navigation::clientRedirectReplaceFrameID const):
* Source/WebKit/UIProcess/API/APINavigation.cpp:
(API::Navigation::setClientRedirectReplace):
(API::Navigation::clearClientRedirectReplace):
* Source/WebKit/UIProcess/WebBackForwardList.h:
* Source/WebKit/UIProcess/WebBackForwardList.cpp:
(WebKit::WebBackForwardList::updateChildURLForReplace):
* Source/WebKit/UIProcess/WebBackForwardList.swift:
* Source/WebKit/UIProcess/WebBackForwardListSwiftUtilities.h:
(replaceFrameItemURL):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::didCommitLoadForFrame):
(WebKit::WebPageProxy::didFailProvisionalLoadForFrameShared):
(WebKit::WebPageProxy::decidePolicyForNavigationAction):
* Source/WebKit/WebProcess/WebPage/WebHistoryItemClient.h:
* Tools/TestRunnerShared/TestFeatures.cpp:
(WTR::shouldExerciseUIProcessBackForwardItemLoading):
(WTR::hardcodedFeaturesBasedOnPathForTest):

https://bugs.webkit.org/show_bug.cgi?id=316798

Reviewed by NOBODY (OOPS!).

To improve traceability, this commit adds RELEASE_LOG statements
covering the following areas of Source/WebDriver:

- Browser startup and lifetime (for glib ports)
- HTTP request and response
- Driver->Browser Automation.json commands and replies.

The added log statements cover mainly data like the request path, body
size, response status, and duration. The actual body with payload like
field values or JS code to be executed is omitted. For deeper
inspection, the existing LOG() statements that inspect the actual
payload are kept.

We opted for RELEASE_LOG instead of LOG due to the WebDriver-related
channels being low-volume in comparison to hotter ones internal to the
browser. On top of that, it should be easier for reporters to provide
release logs, helping get more useful bug reports.

Example output:

Started WebSocket BiDi server with host local and port 60782
Started HTTP server with host local and port 60781
HTTP request POST /session (body=303 bytes)
Spawning local browser: /sdk/webkit/WebKitBuild/WPE/Release/bin/MiniBrowser with 2 argument(s)
Connecting to RemoteInspector at 127.0.0.1:54821
Connected to RemoteInspector at 127.0.0.1:54821 after 1 attempt(s)
    SEND inspector WebKit#1: Automation.createBrowsingContext (52 bytes)
    RECV inspector WebKit#1: ok
HTTP response 200 in 196ms
HTTP request POST /session/fbc9c527-945d-4030-852e-50c5f1852557/url (body=43 bytes)
    SEND inspector WebKit#2: Automation.resolveBrowsingContext (149 bytes)
    RECV inspector WebKit#2: ok
    SEND inspector WebKit#3: Automation.waitForNavigationToComplete (207 bytes)
    RECV inspector WebKit#3: ok
    SEND inspector WebKit#4: Automation.isShowingJavaScriptDialog (135 bytes)
    RECV inspector WebKit#4: ok
    SEND inspector WebKit#5: Automation.navigateBrowsingContext (212 bytes)
    RECV inspector WebKit#5: ok
HTTP response 200 in 124ms

* Source/WebDriver/SessionHost.cpp:
(WebDriver::SessionHost::inspectorDisconnected):
(WebDriver::SessionHost::sendCommandToBackend):
(WebDriver::SessionHost::dispatchMessage):
* Source/WebDriver/WebDriverService.cpp:
(WebDriver::printUsageStatement):
(WebDriver::WebDriverService::run):
(WebDriver::WebDriverService::handleRequest):
* Source/WebDriver/glib/SessionHostGlib.cpp:
(WebDriver::SessionHost::launchBrowser):
(WebDriver::SessionHost::connectToBrowser):
(WebDriver::SessionHost::connectionDidClose):
(WebDriver::SessionHost::setTargetList):

https://bugs.webkit.org/show_bug.cgi?id=316798

Reviewed by BJ Burg.

To improve traceability, this commit adds RELEASE_LOG statements
covering the following areas of Source/WebDriver:

- Browser startup and lifetime (for glib ports)
- HTTP request and response
- Driver->Browser Automation.json commands and replies.

The added log statements cover mainly data like the request path, body
size, response status, and duration. The actual body with payload like
field values or JS code to be executed is omitted. For deeper
inspection, the existing LOG() statements that inspect the actual
payload are kept.

We opted for RELEASE_LOG instead of LOG due to the WebDriver-related
channels being low-volume in comparison to hotter ones internal to the
browser. On top of that, it should be easier for reporters to provide
release logs, helping get more useful bug reports.

Example output:

Started WebSocket BiDi server with host local and port 60782
Started HTTP server with host local and port 60781
HTTP request POST /session (body=303 bytes)
Spawning local browser: /sdk/webkit/WebKitBuild/WPE/Release/bin/MiniBrowser with 2 argument(s)
Connecting to RemoteInspector at 127.0.0.1:54821
Connected to RemoteInspector at 127.0.0.1:54821 after 1 attempt(s)
    SEND inspector WebKit#1: Automation.createBrowsingContext (52 bytes)
    RECV inspector WebKit#1: ok
HTTP response 200 in 196ms
HTTP request POST /session/fbc9c527-945d-4030-852e-50c5f1852557/url (body=43 bytes)
    SEND inspector WebKit#2: Automation.resolveBrowsingContext (149 bytes)
    RECV inspector WebKit#2: ok
    SEND inspector WebKit#3: Automation.waitForNavigationToComplete (207 bytes)
    RECV inspector WebKit#3: ok
    SEND inspector WebKit#4: Automation.isShowingJavaScriptDialog (135 bytes)
    RECV inspector WebKit#4: ok
    SEND inspector WebKit#5: Automation.navigateBrowsingContext (212 bytes)
    RECV inspector WebKit#5: ok
HTTP response 200 in 124ms

* Source/WebDriver/SessionHost.cpp:
(WebDriver::SessionHost::inspectorDisconnected):
(WebDriver::SessionHost::sendCommandToBackend):
(WebDriver::SessionHost::dispatchMessage):
* Source/WebDriver/WebDriverService.cpp:
(WebDriver::printUsageStatement):
(WebDriver::WebDriverService::run):
(WebDriver::WebDriverService::handleRequest):
* Source/WebDriver/glib/SessionHostGlib.cpp:
(WebDriver::SessionHost::launchBrowser):
(WebDriver::SessionHost::connectToBrowser):
(WebDriver::SessionHost::connectionDidClose):
(WebDriver::SessionHost::setTargetList):

Canonical link: https://commits.webkit.org/316784@main

https://bugs.webkit.org/show_bug.cgi?id=320024

Unreviewed Skia update.

% git log --pretty='%h %s' 1717654ff51b534411f80c19c356f4aabb8d3721..741e480402db12ca9c9baf068d21991749b9964a
741e480402 [graphite] Specialize colorspace conversions more
6fc9900b00 [graphite] Set labels on MTLDepthStencilState objects
f571b44f35 [graphite] Guard call to setFailureResultForFinishedProc if Recording is null
66ff2b6da1 Roll ANGLE from 7ed31165b1c1 to 317ae3119bf1 (8 revisions)
42dccc8774 Roll Skia Infra from 7da602a3d377 to dce9b47ff97e (16 revisions)
ab3af195f0 Roll debugger-app-base from e8f6bad3ec15 to 7d52f7d9b6c7
2c943903bf Roll vulkan-deps from c7b30c06b593 to 4210d7fc52f6 (14 revisions)
8cbe9fea4e Manual roll ANGLE from d2c3236e24be to 7ed31165b1c1 (12 revisions)
b97d56c11b Fix ordering of file names
766f21ae61 Move SkEnumBitMask.h from src/core to include/private
cc90b9d472 Roll recipe dependencies (trivial).
5fbb9bbd88 Roll recipe dependencies (trivial).
1ae2466c9e Specialize sk_is_trivially_relocatable for raw_ptr and raw_ref
486a611577 Roll vulkan-deps from a1cacc287360 to c7b30c06b593 (3 revisions)
fab98382a2 Add MiraclePtr exclusion annotations for C ABI structs
ec7a1e1ff8 Support explicit "unknown" chunks in `SkPngRustCodec`
6e84902d56 Roll Dawn from cb71d4a32458 to cbf8e7390fe1 (23 revisions)
db07f74520 Roll ANGLE from 9464aca6502c to d2c3236e24be (27 revisions)
127db09779 Roll Skia Infra from c7f1fbb895a5 to 7da602a3d377 (30 revisions)
84f36b024c Roll SwiftShader from 5b0479bd2d15 to 2843cbcc714f (1 revision)
90e4619a6c Roll debugger-app-base from ecbc8d84afd7 to e8f6bad3ec15
046277850e Roll jsfiddle-base from 2b12e98d3730 to 3c8958265e84
8dd207d443 Roll vulkan-deps from 9bb7338f0e04 to a1cacc287360 (13 revisions)
b6c7a5bc83 Reland "[Ganesh] TextureOp quad illegal memory access"
f5a2921fe2 Re-enable copyright formatting in presubmit
066bfbac72 [graphite] Track resources before adding barriers to VulkanCommandBuffer
9c7d18a286 Backfill SkQP CtsEnforcement::kNextRelease bump to 202704
5d19002eb7 Add error handling and initialization to the DWFM
79f93fd5f3 Roll vulkan-deps from 8dc044c0ebf3 to 9bb7338f0e04 (4 revisions)
026f6a6be2 Roll ANGLE from 227bb03bda93 to 9464aca6502c (18 revisions)
af00e308db Roll Skia Infra from c0a69acfa708 to c7f1fbb895a5 (18 revisions)
e5b1bd57b0 Roll Dawn from c5326b9181c6 to cb71d4a32458 (3 revisions)
f4bfdaade5 Use regular ICU function names in SkBidiFactory_icu_subset.cpp
481c18d8a1 Roll recipe dependencies (trivial).
da379fdf72 Handle w<=0 conics
5e976cb2f0 Revert "[Ganesh] TextureOp quad illegal memory access"
000c7129c9 Roll recipe dependencies (trivial).
6d4b5da00e Roll recipe dependencies (trivial).
92e1602cd0 Roll vulkan-deps from e5233e15a0ea to 8dc044c0ebf3 (6 revisions)
2ffd155313 CanvasKit: Add a wrapper for SkPathBuilder::setFillType that does not clone the SkPathBuilder
30031df246 Refactor PNG gainmap support to `SkPngCodecBase`
7b3761e8e8 [infra] MacMinis on 14.7 were updated to 14.8
ce2b7315cc Manual roll Dawn from 5dad4a08d684 to c5326b9181c6 (27 revisions)
b046b341fc [graphite] Disable blending for inner fills
789ec7583e [Fonts] Add EBDT/EBLC monochrome bitmap support to Fontations backend
4b24321eb3 [Fonts] Add EBDT monochrome bitmap test font generation
ba79ddd3c8 [infra] Remove GalaxyS9, Nexus7, and Pixel10 tasks
148b2b1948 [Ganesh] TextureOp quad illegal memory access
d7196b0b49 Add missing file for opts target
9c2b837884 Roll recipe dependencies (trivial).
ef17057bb7 Roll vulkan-deps from 6fd80c6ab534 to e5233e15a0ea (10 revisions)
500025456b Roll ANGLE from 81a96a84e6e6 to 227bb03bda93 (17 revisions)
ad2d02546f Roll Skia Infra from 09ad6a8da9bf to c0a69acfa708 (11 revisions)
5ff1316f4e Roll recipe dependencies (trivial).
d2addcfb3b Roll recipe dependencies (trivial).
c1215a40c1 Roll recipe dependencies (trivial).
cb1035ff14 Roll recipe dependencies (trivial).
3b92263daf Roll vulkan-deps from 5d7fd70ddbd6 to 6fd80c6ab534 (5 revisions)
8f6c453abc Roll recipe dependencies (trivial).
70acf6a5e7 Revert "Specialize sk_is_trivially_relocatable for raw_ptr and raw_ref"
1f40c1099b Generate dawn_files.bzl dynamically instead of hardcoding the lists
53fb0da879 Add some pixel buffer sizing asserts to SkWuffsCodec
98677a483d Fix Bazel build visibility
c8d9f80f13 [Fontations] Roll Fontations
7128af6057 Roll recipe dependencies (trivial).
6b4ac3bfb3 Roll recipe dependencies (trivial).
3c88455963 Roll Skia Infra from f8dc57844d37 to 09ad6a8da9bf (14 revisions)
1a85d00c61 Roll Dawn from 9533d3296a2a to 5dad4a08d684 (1 revision)
2516121f2c Roll vulkan-deps from fdbd11044b7e to 5d7fd70ddbd6 (3 revisions)
4dd566c83d Roll debugger-app-base from fd083daaa58b to ecbc8d84afd7
6478f8ec2b Roll jsfiddle-base from ab54cf0d0a66 to 2b12e98d3730
945d11ef39 Roll shaders-base from 9f862803ee5b to 2ca02a2612d9
0a3b8549cb Roll skottie-base from a61634294908 to 870493f76166
f46928e7f5 Roll vulkan-deps from 7bfc18a5a2d4 to fdbd11044b7e (1 revision)
4e2c9b5e4d Roll SKP CIPD package from 564 to 565
c526676072 Manual roll ANGLE from 8e09325ebad4 to 81a96a84e6e6 (10 revisions)
139c8c1f65 Manual roll Dawn from 181bf8634c1d to 9533d3296a2a (11 revisions)
42355271a3 Roll vulkan-deps from 973a663c1394 to 7bfc18a5a2d4 (4 revisions)
9ef46390c2 Roll vulkan-deps from d8ab95e03469 to 973a663c1394 (10 revisions)
60bc1a3fae Fix merge issues with src/base rename
ba3ee9b265 Resolved a Data Race on fStream in SkTypeface_Mac
fc46d066b5 Move files from src/base to src/core
6a4be3addd [graphite] Use stable collection for static bindings
1bef4577a7 Roll ICU to 78.2
8c89bf2b0e Roll recipe dependencies (trivial).
ac22a35e25 Specialize sk_is_trivially_relocatable for raw_ptr and raw_ref
282e2123d0 Roll recipe dependencies (trivial).
81a3d4583c Roll vulkan-deps from d3bbae038752 to d8ab95e03469 (6 revisions)
73e00cc3ee Export SkFontMgr::Request methods across the DLL boundary
cadbde1ec4 Roll Skia Infra from 6f4bd209e70a to f8dc57844d37 (10 revisions)
e44ad36fad Roll ANGLE from 2b192e062b1d to 8e09325ebad4 (15 revisions)
e26379234c Roll fiddler-base from 51e85c2ffa70 to 0231316fe504
0a80bfee0d Roll jsfiddle-base from 7331278a3593 to ab54cf0d0a66
f3cca00771 Roll Dawn from dbeb90630035 to 181bf8634c1d (17 revisions)
48a20bbdfd Roll debugger-app-base from 0aa48372c923 to fd083daaa58b
62df060cfb Roll recipe dependencies (trivial).
cd9b570850 Roll recipe dependencies (trivial).
a8f381f1eb Roll recipe dependencies (trivial).
a2228b926c Roll recipe dependencies (trivial).
0c0df6e447 [infra] Don't push nonexistent lottie-samples asset for SkottieTracing
7326aa2867 Roll vulkan-deps from eb0415a66313 to d3bbae038752 (6 revisions)
093ecf7606 Roll recipe dependencies (trivial).
9e1db2ce88 Roll recipe dependencies (trivial).
f61acb31ed Enable dangling pointer detector in Skia
bd2c7ecd8a Reapply "[infra] Use "adb push --sync" to copy to Android devices"
398922b044 Revert "[infra] Use "adb push --sync" to copy to Android devices"
9eb91ed6e4 [infra] Use "adb push --sync" to copy to Android devices
82e4c1b1a2 Roll vulkan-deps from 1ebd280d7a28 to eb0415a66313 (6 revisions)
d963571e92 Roll ANGLE from 0c063596e689 to 2b192e062b1d (8 revisions)
d0777b67d9 Roll Skia Infra from 9aaa7e56e7b8 to 6f4bd209e70a (14 revisions)
1a4d3fe60a Roll Dawn from 926483c39198 to dbeb90630035 (20 revisions)
99c18e9172 Roll recipe dependencies (trivial).
d2b9e48baf Move `include/private/base` to `include/private`.
69bf37867c Roll vulkan-deps from f253d7659dd3 to 1ebd280d7a28 (9 revisions)
eabdf12318 Fix AGTM PCHIP slopes for duplicate points
fc2311fe73 Roll ANGLE from 7f76f214a5a4 to 0c063596e689 (17 revisions)
887ee0a584 Roll Skia Infra from 5feb27468419 to 9aaa7e56e7b8 (55 revisions)
62e5a74536 Roll debugger-app-base from d2178d1c149d to 0aa48372c923
c4c7ea815f Roll Dawn from 841e08144fb8 to 926483c39198 (40 revisions)
4c122c0a97 Roll jsfiddle-base from d568314f3014 to 7331278a3593
618ec49cff Roll vulkan-deps from e97d808085af to f253d7659dd3 (5 revisions)
5faf4562e7 Roll recipe dependencies (trivial).
9f02102df2 [skcapture] Refactor Image and Surface to track SkPixelStorage directly
3e71fda50b Make agents build Skia with less noise
a97920edbc [graphite] Support affine transform and more corner radii in rrect clip
0a2804c8c1 Roll Skia Infra from aa3b5a254aa6 to 5feb27468419 (21 revisions)
9c5ec22c5c Roll vulkan-deps from 2f96412cd516 to e97d808085af (3 revisions)
e7265e9417 [infra] Fix RecreateSKPs
d0b99494e5 Added a strided/scattered glyph advance access function
65f3587693 Roll ANGLE from dc32cd831434 to 7f76f214a5a4 (7 revisions)
7b5147b152 Roll Dawn from 58263faefe3c to 841e08144fb8 (14 revisions)
aeed11c350 Roll SwiftShader from d26a3e6606c0 to 5b0479bd2d15 (1 revision)
065b3bea39 Roll jsfiddle-base from 9e1524dc815b to d568314f3014
fcab6babf1 Roll debugger-app-base from 8e5327247e09 to d2178d1c149d
688ca258ab Roll vulkan-deps from 537ea5cb1a35 to 2f96412cd516 (9 revisions)
f6a9a592ef Created an RAII Wrapper for SkCanvas->fScratchGlyphRunBuilder
0a882a1e07 [ganesh] Fix AsyncReadPixelsContextShutdown expectation on protected contexts
eac15152bf Avoid improper mask formats for SDFT runs
c1dde7b585 Reland WebKit#4 "MiraclePtr: Add raw_ptr definitions"
560143de0a Reland "Add public API to query a serialized key for external format usage"
51992f3120 Add GM to test new Graphite rrect clip support
22c683d223 [ganesh] Track async task execution for callbacks
43f1357351 [graphite] Add DrawAtlas Indirection Types
9d94f46e7f Use an assert release on stride length
01e9da83b6 Roll partition_alloc
0ea3dae686 Roll vulkan-deps from 646f0b0196b1 to 537ea5cb1a35 (6 revisions)
d17c51db4e Roll ANGLE from 0bcdad042d68 to dc32cd831434 (6 revisions)
b415735a0e Roll Dawn from 23cf554e645f to 58263faefe3c (2 revisions)
9659a87f50 Roll skottie-base from 867c02555f37 to a61634294908
a56d5a4e11 Roll vulkan-deps from 11839f4fa73a to 646f0b0196b1 (2 revisions)
101faf7d9d Roll vulkan-deps from 940d8e3840d0 to 11839f4fa73a (1 revision)
294ac0cb2a Roll vulkan-deps from 763d7fb65f73 to 940d8e3840d0 (1 revision)
08e68cc65a Manual roll Dawn from a36d189db2e8 to 23cf554e645f (11 revisions)
91ee612cf5 Roll vulkan-deps from 8b51d6332f98 to 763d7fb65f73 (9 revisions)
a145861ad1 Reject Slugs that have creationMatrix with perspective
9eecbdc30f Manual roll ANGLE from 1184faa057e3 to 0bcdad042d68 (8 revisions)
cd4b3739bd Roll vulkan-deps from 78036a90f143 to 8b51d6332f98 (5 revisions)
a47a9a2c8a Avoid ULP issue on big rrects
6e003d7f69 Revert "Add public API to query a serialized key for external format usage"
d3e581be96 Roll ANGLE from 8240611f3d68 to 1184faa057e3 (10 revisions)
494f1bf55f Roll Dawn from 075626b4b324 to a36d189db2e8 (16 revisions)
1b96a90703 Roll vulkan-deps from 69c770f1ec4d to 78036a90f143 (7 revisions)
59556fdb8c Revert "[graphite] use textureSize intrinsic instead of uniforms"
8eb107046f Add public API to query a serialized key for external format usage
928ded2a31 Avoid chopping cubics with w=0
0df2ab117e Roll recipe dependencies (trivial).
9d4ed11e54 Revert "[graphite] hoist textureSize call out of switch statement"
fd7a0a9ea1 Add staging SkMalloc.h file to private includes
dcf3ebf072 [ganesh] Prevent overflow in StrokeTessellateOp
fec0c21c76 [infra] Remove Mac12 jobs
cecc0e0da9 Roll vulkan-deps from 090b0d3106c4 to 69c770f1ec4d (1 revision)
611e3f8ceb Roll Skia Infra from a4cbcf5ccc36 to aa3b5a254aa6 (8 revisions)
6dfa39c8eb Roll ANGLE from 1a7742a98d71 to 8240611f3d68 (10 revisions)
c4326e7c64 Roll Dawn from fac99d48e5f5 to 075626b4b324 (17 revisions)
0e73eb4da5 Roll debugger-app-base from d263d5e89fa5 to 8e5327247e09
4fdb859c8d Roll jsfiddle-base from e97ab14ddb65 to 9e1524dc815b
c42efa24f1 Roll recipe dependencies (trivial).
0020aae33f Roll vulkan-deps from 85acfedb927a to 090b0d3106c4 (4 revisions)
c21280541a Add agent skills for dealing with fuzz issues
3151df0dc0 [graphite] Consistently ignore path inversion when stroking
4d00e2b30d Revert "SkFlattenable::Register now performs a sorted insert"
5f56f9c9c7 Fix assertion in GetLoopUnrollInfo
2dfc12e0af Remove SafeStack jobs
3e4a1af226 Manual roll Dawn from 447aee490e30 to fac99d48e5f5 (6 revisions)
349f974b14 SkFlattenable::Register now performs a sorted insert
641cdb6aed Avoid underflow in modulo in loops
46a16fa03a [ganesh] Fix maxLCDOffset calculation
d114bf06df Improve agent docs for gn builds
86241e8b8e Fix bazel Dawn build
2b8cfcc5ea [graphite] Disable blending for opaque kSrcOver w/o analytic coverage
1021f2559a Fix perspective handling in SmallPathRenderer
5b8678e808 Roll recipe dependencies (trivial).
ce34ec9371 Roll vulkan-deps from df40808ccc75 to 85acfedb927a (8 revisions)
6dedf863d3 Roll recipe dependencies (trivial).
bab903e97f Roll ANGLE from 196d1b79eadb to 1a7742a98d71 (18 revisions)
40394e55de Roll Skia Infra from 1c6aa5aaba53 to a4cbcf5ccc36 (19 revisions)
b2464cbb9b Roll Dawn from 63f25feec51e to 447aee490e30 (53 revisions)
d625048c85 Roll recipe dependencies (trivial).
c1dbe08654 Roll recipe dependencies (trivial).
4be5546ed8 Roll recipe dependencies (trivial).
403ba7f67e Roll recipe dependencies (trivial).
32da743297 Roll vulkan-deps from 24496a44b9f4 to df40808ccc75 (3 revisions)
d6cd9a774c Update Linux Clang to 22.1.0 (fixing MSAN)
81f3f56901 Roll recipe dependencies (trivial).
2c50fbfb03 [graphite] Guard SDF inset with define
8ff9bdc2a4 [graphite] Share ShaderCaps init code across backends
060555fd70 Merge 2 release notes into RELEASE_NOTES.md
d30d2a1958 Update Skia milestone to 151
bf6fa29148 Roll recipe dependencies (trivial).
279b17fe9f Roll ANGLE from 8a5e64de9fd3 to 196d1b79eadb (5 revisions)
86d685c697 Roll Skia Infra from 2da962880dc7 to 1c6aa5aaba53 (8 revisions)
e60d5c8a2f Roll debugger-app-base from c74d26054770 to d263d5e89fa5
eee0a5b472 Roll vulkan-deps from d418e8ba7c95 to 24496a44b9f4 (9 revisions)
70f9d90bc8 Roll recipe dependencies (trivial).
cb57d863c4 Roll recipe dependencies (trivial).
d7fa1dcd53 Roll recipe dependencies (trivial).
7ec37cf3ae Initialize variables in SkRemoteGlyphCacheTest
95dbfa24e0 Turn off LCD in SDF slugs when downscaling too far
8c8a82b7bd [graphite] hoist textureSize call out of switch statement
5a01ce655d Roll partition_alloc
aace90ee2e Manual roll ANGLE from c01fdb7503e3 to 8a5e64de9fd3 (8 revisions)
886ce5fe90 [bzl] Update dawn_files.bzl after Dawn roll
ed03b304e1 Make Windows ASAN use dynamic ASAN libraries not static ones
e4281d5a79 Roll vulkan-deps from b57006f9536e to d418e8ba7c95 (1 revision)
8f073c306e Manual roll Dawn from ce586f1e2a62 to 63f25feec51e (61 revisions)
c97e939eb5 Roll ANGLE from 31b176246d7e to c01fdb7503e3 (12 revisions)
90b8d641b2 Roll Skia Infra from db195a05b659 to 2da962880dc7 (4 revisions)
659b67960f Roll vulkan-deps from d8c0b6852f61 to b57006f9536e (4 revisions)
32b547c81b Roll vulkan-deps from dcdce5027a08 to d8c0b6852f61 (3 revisions)
91e53285f4 Roll vulkan-deps from b766d9ede7dd to dcdce5027a08 (1 revision)
33a1c4f3e0 Roll vulkan-deps from 016cfd464461 to b766d9ede7dd (5 revisions)
c0b70b7ffb Roll recipe dependencies (trivial).
0aee4675e0 [graphite] Fix null deref in QueueManager::addRecording when !Recording
d7a4ca22a9 Use std::make_unique where we aren't
c072b212e3 Use const references in a few more places
e202cf3ef8 Address potential MSAN issue in SkScalerContext
87c0eddb36 Fix SkVx::isFinite on new MSVC
9459b2f287 Fix docs for MSAN (and address 2 minor issues)
dc01525ac4 Roll vulkan-deps from 3cececf546e2 to 016cfd464461 (4 revisions)
04b084c10b Reland "[graphite] BufferSubAllocator respects failed mapping on reset"
b854499783 Reland "Reconstruct subRun bounds from glyphs"
c329e877d1 Revert "[graphite] BufferSubAllocator respects failed mapping on reset"
c480ba2eb2 Revert "Reconstruct subRun bounds from glyphs"
d9d6b440c4 Update deps for agents repos
4715553483 Roll ANGLE from 9566f50cb827 to 31b176246d7e (7 revisions)
087c3cc37c Roll vulkan-deps from 000daaa61385 to 3cececf546e2 (6 revisions)
c5de7569a5 Roll Skia Infra from 5c22c771f011 to db195a05b659 (8 revisions)
71c38003fc Roll SwiftShader from bea72feae3cf to d26a3e6606c0 (1 revision)
f93ed13d77 Reconstruct subRun bounds from glyphs
7a5bd9b331 Roll recipe dependencies (trivial).
8f47b24d40 Add core_skills.json for skia

Canonical link: https://commits.webkit.org/317806@main