https://bugs.webkit.org/show_bug.cgi?id=241905

Reviewed by Yusuke Suzuki.

offlineasm used to emit this LLInt code:
    ".loc 1 996\n"        "ldr x19, [x0] \n"                   // LowLevelInterpreter.asm:996
    ".loc 1 997\n"        "ldr x20, [x0, WebKit#8] \n"               // LowLevelInterpreter.asm:997
    ".loc 1 998\n"        "ldr x21, [x0, WebKit#16] \n"              // LowLevelInterpreter.asm:998
    ".loc 1 999\n"        "ldr x22, [x0, WebKit#24] \n"              // LowLevelInterpreter.asm:999
    ...
    ".loc 1 1006\n"       "ldr d8, [x0, WebKit#80] \n"               // LowLevelInterpreter.asm:1006
    ".loc 1 1007\n"       "ldr d9, [x0, WebKit#88] \n"               // LowLevelInterpreter.asm:1007
    ".loc 1 1008\n"       "ldr d10, [x0, WebKit#96] \n"              // LowLevelInterpreter.asm:1008
    ".loc 1 1009\n"       "ldr d11, [x0, WebKit#104] \n"             // LowLevelInterpreter.asm:1009
    ...

Now, it can emit this instead:
    ".loc 1 996\n"        "ldp x19, x20, [x0, #0] \n"          // LowLevelInterpreter.asm:996
    ".loc 1 997\n"        "ldp x21, x22, [x0, WebKit#16] \n"         // LowLevelInterpreter.asm:997
    ...
    ".loc 1 1001\n"       "ldp d8, d9, [x0, WebKit#80] \n"           // LowLevelInterpreter.asm:1001
    ".loc 1 1002\n"       "ldp d10, d11, [x0, WebKit#96] \n"         // LowLevelInterpreter.asm:1002
    ...

Also, there was some code that kept recomputing the base address of a sequence of load/store
instructions.  For example,
    ".loc 6 902\n"        "add x13, sp, x10, lsl WebKit#3 \n"        // WebAssembly.asm:902
                          "ldr x0, [x13, WebKit#48] \n"
                          "add x13, sp, x10, lsl WebKit#3 \n"
                          "ldr x1, [x13, WebKit#56] \n"
                          "add x13, sp, x10, lsl WebKit#3 \n"
                          "ldr x2, [x13, WebKit#64] \n"
                          "add x13, sp, x10, lsl WebKit#3 \n"
                          "ldr x3, [x13, WebKit#72] \n"
    ...

For such places, we observe that the base address is the same for every load/store instruction
in the sequence, and precompute it in the LLInt asm code to help out the offline asm.  This
allows the offlineasm to now emit this more efficient code instead:
    ".loc 6 896\n"        "add x10, sp, x10, lsl WebKit#3 \n"        // WebAssembly.asm:896
    ".loc 6 898\n"        "ldp x0, x1, [x10, WebKit#48] \n"          // WebAssembly.asm:898
                          "ldp x2, x3, [x10, WebKit#64] \n"
    ...

* Source/JavaScriptCore/llint/LowLevelInterpreter.asm:
* Source/JavaScriptCore/llint/WebAssembly.asm:
* Source/JavaScriptCore/offlineasm/arm64.rb:
* Source/JavaScriptCore/offlineasm/instructions.rb:

Canonical link: https://commits.webkit.org/251799@main

The legacy App Store (which links our installed WebKit2) crashed ~10s
after launch and, had it rendered, showed raw MZStore XML. Both fixed in
WKPage.cpp:

1. Off-main crash: the App Store calls WKPageLoadURL from its own
   background GCD queue ("WebView Initial Load Queue"), reaching
   WebProcessPool::pageEndUsingWebsiteDataStore where
   RELEASE_ASSERT(RunLoop::isMain()) correctly fires. New
   runLoadOnMainRunLoop helper marshals the WKPageLoadURL load family
   onto the main RunLoop when called off-main (synchronous passthrough
   when already on main, so Safari/QuickLook are unchanged), capturing
   page/userData by Ref. The work now runs on main; the assert holds
   legitimately (NOT weakened).

2. Raw XML: narrowed the backport's V0 decidePolicyForResponse bypass
   with && !frame.isMainFrame(), so the App Store's main-frame V0 policy
   client again intercepts the text/xml MZStore plist instead of WebKit
   auto-allowing it and rendering it raw. Upstream has no such bypass;
   this shrinks the deviation back toward upstream. No download
   regression (the bypass only ever fired for canShowMIMEType==true; real
   downloads are canShowMIMEType==false and already reached the client).

Verified: App Store renders the live Featured storefront, stable 7+ min;
Safari unregressed. Hack-checked clean. Follow-up debt: the remaining
subframe V0 bypass is still non-upstream (#60).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

The backport installed a global NSEvent monitor (+[WKView installEventMonitorOnce]) that intercepted mouse/scroll/key events and dispatched them to WKView, on the belief that layer-tree mirror subviews intercepted hit-testing. That was a MISDIAGNOSIS: WKView hosts the WebContent layer tree as a plain CALayer sublayer of its backing layer (MinimalPageClient enterAcceleratedCompositingMode/setRemoteLayerTreeRootNode, [[m_view layer] addSublayer:]) with ZERO NSView subviews. CALayers don't participate in NSView -hitTest:, so nothing ever intercepted events. Worse, the monitor consumed events before -[NSWindow sendEvent:] (where AppKit activates the window on click), creating the very click-to-activate problem it then re-patched.

Remove the monitor and rely on AppKit's natural responder chain; WKView's own scrollWheel:/keyDown:/mouseDown:/mouseMoved: handlers receive events directly. Keep the -hitTest: override as upstream-equivalent insurance (upstream WebViewImpl::hitTest does the same redirect).

Verified live: main-view links/scroll/typing/right-click; hover (#17) fires :hover on a fresh page AND with the address bar focused; Reader scroll (#39) works via natural routing to the topmost ReaderWKView; and every secondary WKView that relied on the monitor -- uBlock popover (#14/#23), Web Inspector (#16), App Store (#72), Top Sites (#13), Preferences>Extensions (#24) -- stays interactive. No crashes. Retires the #62 event-monitor keystone and supersedes #39's monitor routing. (The DDG-logo black box, a separate #56 IOSurface-backing symptom, is root-caused but not fixed here.)

Co-Authored-By: Claude Opus 4.8 <[email protected]>