https://bugs.webkit.org/show_bug.cgi?id=242402

Reviewed by Yusuke Suzuki.

* metadata/contributors.json:

Canonical link: https://commits.webkit.org/252185@main

…erflow.html

https://bugs.webkit.org/show_bug.cgi?id=114338

Reviewed by Simon Fraser.

If an element is applied overflow:hidden and transform, it should clip
positioned descendants. nested-overlap-overflow.html has transform,
but nested-overlap-overflow-expected.html. Clipping should happen only
in nested-overlap-overflow.html. They should render differently.

* LayoutTests/compositing/overlap-blending/nested-overlap-overflow-expected.html: Removed.
* LayoutTests/compositing/overlap-blending/nested-overlap-overflow.html: Removed.
* LayoutTests/platform/gtk/TestExpectations:
* LayoutTests/platform/ios/TestExpectations:
* LayoutTests/platform/mac/TestExpectations:

Canonical link: https://commits.webkit.org/252184@main

…inline painting when possible

https://bugs.webkit.org/show_bug.cgi?id=242293
rdar://96256430

Reviewed by Jer Noble.

This patch restores an altered version of the changes that were landed in 251761@main, but reverted
later in 252024@main due to increasing memory use after seeking around Netflix videos.

The original patch added a mechanism to set an `AVSampleBufferVideoOutput` on the display layer to
paint unparented MSE videos (where `-copyDisplayedPixelBuffer` would otherwise return null). In the
case where the video is later parented, the logic in the original patch would attempt to discard the
video output in favor of just using `-copyDisplayedPixelBuffer`, by calling `-setOutput:` with
`nil`.

However, AVFoundation doesn't actually support changing `AVSampleBufferVideoOutput` on the display
layer if the video output has already begun to receive samples. In the case where we go from having
a video output to having none, this causes CoreMedia to start queueing up decoded pixel buffers
without pruning them later on. This can be triggered in several ways on Netflix (such as seeking
around a video several times, or hiding and showing the Safari window); the symptoms are an increase
in memory use, as observed in rdar://96096907.

To address this, we refactor logic for adopting `-copyDisplayedPixelBuffer`, such that we either
create a display layer and use `-copyDisplayedPixelBuffer` if the media player box is not empty, and
otherwise fall back to using a decompression session. On platforms where `-copyDisplayedPixelBuffer`
is not available, we'll ensure the display layer as long as we haven't been asked to paint in a
WebGL context, and otherwise fall back to a decompression session.

* LayoutTests/platform/ios/TestExpectations:
* LayoutTests/platform/mac/TestExpectations:

Mark a layout test as failing (with a timeout), in the absence of rdar://94324932. This is because
we are no longer attempting to use `AVSampleBufferVideoOutput` on platforms without support for
`-copyDisplayedPixelBuffer`.

* Source/WTF/Scripts/Preferences/WebPreferencesExperimental.yaml:
* Source/WTF/wtf/PlatformHave.h:
* Source/WebCore/PAL/pal/cocoa/AVFoundationSoftLink.h:
* Source/WebCore/PAL/pal/cocoa/AVFoundationSoftLink.mm:
* Source/WebCore/PAL/pal/spi/cocoa/AVFoundationSPI.h:

Remove soft-linking and SPI declarations for `AVSampleBufferVideoOutput` from AVFoundation.

* Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp:
(WebCore::WebGLRenderingContextBase::texImageSourceHelper):
* Source/WebCore/platform/graphics/MediaPlayer.cpp:
* Source/WebCore/platform/graphics/MediaPlayer.h:
* Source/WebCore/platform/graphics/MediaPlayerPrivate.h:
* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:
* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
(WebCore::isCopyDisplayedPixelBufferAvailable):

Add a helper method to check whether or not `-copyDisplayedPixelBuffer` is available.

(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::updateLastPixelBuffer):
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::shouldEnsureLayer const):

On platforms where we have `-copyDisplayedPixelBuffer`, make this return true as long as the player
bounds are non-empty; otherwise, create a decompression session.

(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::playerContentBoxRectChanged):
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::acceleratedRenderingStateChanged):
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::updateDisplayLayerAndDecompressionSession):

Pull out logic for switching between using a display layer vs. a decompression session into a
separate helper method, which is invoked when either the accelerated rendering state changes, or the
bounds of the media player change from empty to non-empty, or vice versa.

(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::ensureLayer):
* Source/WebKit/GPUProcess/media/RemoteMediaPlayerProxy.cpp:
(WebKit::RemoteMediaPlayerProxy::playerContentBoxRectChanged):

Add plumbing to notify the `MediaPlayer` (and its private implementation) when the player bounds
change.

* Source/WebKit/GPUProcess/media/RemoteMediaPlayerProxy.h:
* Source/WebKit/GPUProcess/media/RemoteMediaPlayerProxy.messages.in:
* Source/WebKit/GPUProcess/media/cocoa/RemoteMediaPlayerProxyCocoa.mm:
* Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp:
* Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.h:

Canonical link: https://commits.webkit.org/252183@main

…opens the created PR

https://bugs.webkit.org/show_bug.cgi?id=242398
<rdar://problem/93440727>

Reviewed by Jonathan Bedard.

* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/pull_request.py:
(PullRequest.parser):
(PullRequest.create_pull_request):

Canonical link: https://commits.webkit.org/252182@main

https://bugs.webkit.org/show_bug.cgi?id=241357
rdar://90466280

Reviewed by Simon Fraser, Tim Horton and Wenson Hsieh.

Currently, when searching a conversation in Mail, find overlays for multiple
messages do not animate in at the same time. This issue occurs due to the fact
that each message is in its own web view, backed by its own web process, and
showing the find overlay involves communication across UI and web processes.

In order to ensure the overlays are animated in/out at the same time, give
Mail access to the find overlay layer. The overlays can then be displayed
alongside other Mail content. The overlay layer is exposed through WKWebView
SPI, and _WKFindDelegate methods to inform the client when the overlay is
added/removed.

Alternatives considered:

1. Mail owns the overlay layer and paints highlights themselves. This approach
was not chosen, as WebKit would still need to provide SPI to vend the rects, and
the complexity of implementation increases as the highlight rects could change
position relative to the web view (for example, in subscrollable regions).
In general, this approach would involve significant work in both Mail and WebKit.

2. Mail owns the overlay layer and gives it to WebKit. This approach was not
chosen, as it is incompatible with the existing remote layer tree.

* Source/WebCore/page/PageOverlay.cpp:
(WebCore::PageOverlay::create):
(WebCore::PageOverlay::PageOverlay):
* Source/WebCore/page/PageOverlay.h:
* Source/WebCore/page/PageOverlayController.cpp:
(WebCore::PageOverlayController::installPageOverlay):
* Source/WebCore/platform/graphics/GraphicsLayer.cpp:
(WebCore::GraphicsLayer::supportsLayerType):
* Source/WebCore/platform/graphics/GraphicsLayer.h:

Introduce a new layer type that ensures the layer is always tile-backed. This
is necessary for client-added overlays, since the layer type could otherwise
change, leaving the client with the incorrect layer.

(WebCore::GraphicsLayer::setOpacity):

Export this method, so that the find overlay can begin at zero opacity. The
client is responsible for changing the opacity.

* Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp:
(WebCore::GraphicsLayer::supportsLayerType):
(WebCore::GraphicsLayerCA::initialize):
(WebCore::GraphicsLayerCA::adjustCoverageRect const):
(WebCore::GraphicsLayerCA::requiresTiledLayer const):
* Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h:
(WebCore::GraphicsLayerCA::isTiledBackingLayer const):
* Source/WebKit/UIProcess/API/APIFindClient.h:
(API::FindClient::didAddLayerForFindOverlay):
(API::FindClient::didRemoveLayerForFindOverlay):
* Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView _initializeWithConfiguration:]):
* Source/WebKit/UIProcess/API/Cocoa/WKWebViewInternal.h:
* Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivate.h:
* Source/WebKit/UIProcess/API/Cocoa/_WKFindDelegate.h:
* Source/WebKit/UIProcess/API/ios/WKWebViewIOS.mm:
(-[WKWebView _processWillSwapOrDidExit]):
(-[WKWebView _didCommitLayerTree:]):

Inform the client that the find overlay is available, once it has been created
and parented. Note that the layer properties arrive in a separate transaction,
since the overlay container is created lazily. Consequently, we wait until the
layer is parented. This ensures that the opacity of the layer is actually zero
once the client is notified.

(-[WKWebView _addLayerForFindOverlay]):

Mark the find overlay as pending once we have a layer ID. At this point, the
layer is not yet in the tree.

(-[WKWebView _removeLayerForFindOverlay]):

Do not send a message to the web process if there is no overlay.

(-[WKWebView _layerForFindOverlay]):

Return the find overlay layer using the `_committedFindLayerID`.

* Source/WebKit/UIProcess/Cocoa/FindClient.h:
* Source/WebKit/UIProcess/Cocoa/FindClient.mm:
(WebKit::FindClient::setDelegate):
(WebKit::FindClient::didAddLayerForFindOverlay):
(WebKit::FindClient::didRemoveLayerForFindOverlay):
* Source/WebKit/UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::addLayerForFindOverlay):
(WebKit::WebPageProxy::removeLayerForFindOverlay):
* Source/WebKit/UIProcess/WebPageProxy.h:
* Source/WebKit/WebProcess/WebPage/WebFoundTextRangeController.cpp:
(WebKit::WebFoundTextRangeController::addLayerForFindOverlay):

Ensure the overlay is always tile-backed. Without this change, the layer ID can
change depending on the size of the web view, and could leave the client with
the incorrect layer.

(WebKit::WebFoundTextRangeController::removeLayerForFindOverlay):
* Source/WebKit/WebProcess/WebPage/WebFoundTextRangeController.h:
* Source/WebKit/WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::addFindOverlayLayer):
(WebKit::WebPage::removeFindOverlayLayer):
* Source/WebKit/WebProcess/WebPage/WebPage.h:
* Source/WebKit/WebProcess/WebPage/WebPage.messages.in:
* Tools/TestWebKitAPI/Tests/WebKitCocoa/FindInPage.mm:
(-[TestFindDelegate setDidAddLayerForFindOverlayHandler:]):
(-[TestFindDelegate didAddLayerForFindOverlayHandler]):
(-[TestFindDelegate setDidRemoveLayerForFindOverlayHandler:]):
(-[TestFindDelegate didRemoveLayerForFindOverlayHandler]):
(-[TestFindDelegate _webView:didAddLayerForFindOverlay:]):
(-[TestFindDelegate _webViewDidRemoveLayerForFindOverlay:]):
(TEST):

Added a test to exercise the new SPI.

Canonical link: https://commits.webkit.org/252181@main

https://bugs.webkit.org/show_bug.cgi?id=242366
https://bugs.webkit.org/show_bug.cgi?id=208677

Reviewed by Myles C. Maxfield.

Breaks outlook, and needs more polishing.

* LayoutTests/editing/selection/user-select-js-property-expected.txt:
* LayoutTests/editing/selection/user-select-js-property.html:
* LayoutTests/fast/css/getComputedStyle/computed-style-expected.txt:
* LayoutTests/fast/css/getComputedStyle/computed-style-without-renderer-expected.txt:
* LayoutTests/fast/css/getComputedStyle/resources/property-names.js:
* LayoutTests/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:
* LayoutTests/imported/w3c/web-platform-tests/css/css-cascade/all-prop-revert-layer-expected.txt
* LayoutTests/imported/w3c/web-platform-tests/css/css-ui/inheritance-expected.txt:
* LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/user-select-computed-expected.txt:
* LayoutTests/imported/w3c/web-platform-tests/css/css-ui/parsing/user-select-valid-expected.txt:
* LayoutTests/imported/w3c/web-platform-tests/inert/inert-computed-style-expected.txt:
* LayoutTests/platform/gtk/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:
* LayoutTests/platform/wpe/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:
* LayoutTests/platform/mac-wk1/imported/w3c/web-platform-tests/css/css-cascade/all-prop-revert-layer-expected.txt
* LayoutTests/svg/css/getComputedStyle-basic-expected.txt:
* Source/WebCore/Modules/mediacontrols/mediaControlsApple.css:
(video::-webkit-media-controls-panel,):
(video::-webkit-media-controls-closed-captions-container .list,):
(video::-webkit-media-controls-current-time-display,):
(video::-webkit-media-controls-timeline-container,):
(video::-webkit-media-text-track-container):
(video::-webkit-media-controls-wireless-playback-text,):
* Source/WebCore/Modules/mediacontrols/mediaControlsBase.css:
(video::-webkit-media-controls-panel,):
(video::-webkit-media-controls-closed-captions-container .list,):
(video::-webkit-media-controls-current-time-display,):
(video::-webkit-media-controls-timeline-container,):
(video::-webkit-media-text-track-container):
* Source/WebCore/Modules/modern-media-controls/controls/button.css:
(button):
* Source/WebCore/Modules/modern-media-controls/controls/media-controls.css:
(.media-controls > *,):
* Source/WebCore/Modules/modern-media-controls/controls/slider-base.css:
(.ios .slider > input):
* Source/WebCore/Modules/modern-media-controls/controls/text-tracks.css:
(video::-webkit-media-text-track-container):
* Source/WebCore/animation/CSSPropertyAnimation.cpp:
(WebCore::CSSPropertyAnimationWrapperMap::CSSPropertyAnimationWrapperMap):
* Source/WebCore/css/CSSComputedStyleDeclaration.cpp:
(WebCore::ComputedStyleExtractor::valueForPropertyInStyle):
* Source/WebCore/css/CSSProperties.json:
* Source/WebCore/css/html.css:
(#if defined(WTF_PLATFORM_IOS_FAMILY) && WTF_PLATFORM_IOS_FAMILY):
(input::-webkit-inner-spin-button):
(input::-webkit-strong-password-auto-fill-button):
(input::-webkit-credentials-auto-fill-button):
(input::-webkit-contacts-auto-fill-button):
(input::-webkit-credit-card-auto-fill-button):
(input::-webkit-loading-auto-fill-button):
(input::-webkit-caps-lock-indicator):
(#if defined(ENABLE_DATALIST_ELEMENT) && ENABLE_DATALIST_ELEMENT):
(textarea):
(input:-webkit-autofill-strong-password):
* Source/WebCore/css/mediaControls.css:
(:is(audio, video)::-webkit-media-controls-panel):
(:is(audio, video)::-webkit-media-controls-timeline-container):
(video::-webkit-media-text-track-container):
* Source/WebCore/css/parser/CSSParserFastPaths.cpp:
(WebCore::CSSParserFastPaths::isValidKeywordPropertyAndValue):
(WebCore::CSSParserFastPaths::isKeywordPropertyID):
* Source/WebCore/css/plugIns.css:
(embed::-webkit-snapshotted-plugin-content > .snapshot-overlay > .snapshot-label,):
* Source/WebCore/dom/ImageOverlay.cpp:
(WebCore::ImageOverlay::updateSubtree):
(WebCore::ImageOverlay::updateWithTextRecognitionResult):
* Source/WebCore/html/HTMLElement.cpp:
(WebCore::HTMLElement::collectPresentationalHintsForAttribute):
* Source/WebCore/html/shadow/imageOverlay.css:
(div.image-overlay-data-detector-result):
* Source/WebCore/html/shadow/mac/imageControlsMac.css:
(#if defined(ENABLE_SERVICE_CONTROLS) && ENABLE_SERVICE_CONTROLS):
* Source/WebCore/xml/XMLViewer.css:
(.button):
* Source/WebInspectorUI/UserInterface/Debug/UncaughtExceptionReporter.css:
(.uncaught-exception-sheet li):
* Source/WebInspectorUI/UserInterface/Views/AuditTestCaseContentView.css:
(.content-view.audit-test-case > section table > tr > td > :not(.tree-outline)):
* Source/WebInspectorUI/UserInterface/Views/AuditTestContentView.css:
(.content-view.audit-test.manager-editing > header :is(.name, .description)[contenteditable]):
* Source/WebInspectorUI/UserInterface/Views/CPUTimelineView.css:
(.timeline-view.cpu > .content > .overview .legend):
(.timeline-view.cpu > .content > .overview > .chart > .container.stats):
* Source/WebInspectorUI/UserInterface/Views/CPUUsageCombinedView.css:
(.cpu-usage-combined-view > .details):
* Source/WebInspectorUI/UserInterface/Views/ChangesDetailsSidebarPanel.css:
(.sidebar > .panel.changes-panel .css-rule):
* Source/WebInspectorUI/UserInterface/Views/CodeMirrorOverrides.css:
(.CodeMirror-linewidget):
* Source/WebInspectorUI/UserInterface/Views/ComputedStyleSection.css:
(.computed-style-section):
* Source/WebInspectorUI/UserInterface/Views/ConsoleMessageView.css:
(.console-user-command.special-user-log > .console-message-body):
(.console-message-body > span):
(.console-message-body > span > :matches(.console-message-enclosed, .console-message-preview, .console-message-preview-divider)):
(.console-message .console-message-extra-parameters-container > li,):
(.console-user-command > .console-message-body):
* Source/WebInspectorUI/UserInterface/Views/DOMEventsBreakdownView.css:
(.waterfall-popover-content .dom-events-breakdown):
* Source/WebInspectorUI/UserInterface/Views/DOMTreeOutline.css:
(.tree-outline.dom.non-selectable):
* Source/WebInspectorUI/UserInterface/Views/DatabaseContentView.css:
(:matches(.database-user-query, .database-query-result)::before):
(.database-query-text):
(.database-query-result.error):
(.database-query-result.no-results):
* Source/WebInspectorUI/UserInterface/Views/DetailsSection.css:
(.details-section > .content > .group > .row.simple > .value):
(.details-section > .content > .group > .row.text):
* Source/WebInspectorUI/UserInterface/Views/Editing.css:
(.editing):
* Source/WebInspectorUI/UserInterface/Views/FontResourceContentView.css:
(.content-view.resource.font .preview > .line > .content):
* Source/WebInspectorUI/UserInterface/Views/FormattedValue.css:
(.formatted-node > .tree-outline.dom li):
* Source/WebInspectorUI/UserInterface/Views/ImageResourceContentView.css:
(.content-view.resource.image img):
* Source/WebInspectorUI/UserInterface/Views/IndexedDatabaseContentView.css:
(.indexed-database.content-view):
* Source/WebInspectorUI/UserInterface/Views/LocalResourceOverrideLabelView.css:
(.local-resource-override-label-view > div > .url):
* Source/WebInspectorUI/UserInterface/Views/Main.css:
(body):
(.resource-link,):
(.bouncy-highlight):
* Source/WebInspectorUI/UserInterface/Views/NetworkResourceDetailView.css:
(.content-view.resource-details):
* Source/WebInspectorUI/UserInterface/Views/NetworkTableContentView.css:
(.network-table > .statistics > .statistic > .text):
* Source/WebInspectorUI/UserInterface/Views/ObjectTreeView.css:
(.object-tree.properties-only.json-only .object-tree-property.prototype-property,):
(.tree-outline.object li):
* Source/WebInspectorUI/UserInterface/Views/ResourceCookiesContentView.css:
(.resource-cookies .table > .header):
* Source/WebInspectorUI/UserInterface/Views/ResourceHeadersContentView.css:
(.resource-headers .go-to-link):
(.resource-headers .call-stack):
* Source/WebInspectorUI/UserInterface/Views/ResourceTimingBreakdownView.css:
(.waterfall-popover-content .resource-timing-breakdown):
* Source/WebInspectorUI/UserInterface/Views/SpreadsheetCSSStyleDeclarationEditor.css:
(.spreadsheet-style-declaration-editor):
* Source/WebInspectorUI/UserInterface/Views/SpreadsheetCSSStyleDeclarationSection.css:
(.spreadsheet-css-declaration):
(.spreadsheet-css-declaration.selecting,):
(.spreadsheet-css-declaration .selector > .icon):
* Source/WebInspectorUI/UserInterface/Views/TypeTreeView.css:
(.tree-outline.type li):

Canonical link: https://commits.webkit.org/252180@main

https://bugs.webkit.org/show_bug.cgi?id=242389
rdar://problem/96516944

Reviewed by Per Arne Vollan.

* Source/WebKit/GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:
Allow SYS_fileport_makefd.

Canonical link: https://commits.webkit.org/252179@main

https://bugs.webkit.org/show_bug.cgi?id=242362
<rdar://96465126>

Reviewed by Chris Dumez.

Remove sandbox telemetry in the WebContent process on iOS in order to reduce telemetry volume.

* Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in:

Canonical link: https://commits.webkit.org/252178@main

… from background

https://bugs.webkit.org/show_bug.cgi?id=242352

Reviewed by Darin Adler.

Follow-up to 252108@main to take care of more cases where we might try to reuse a
terminated WebProcess during crash recovery, because we have not received the crash
notification for the back up process yet.

252108@main took care of processes reused from a related WKWebView. This patch takes
care of processes taken from the WebProcess cache or from a suspended page in the
back/forward list.

* Source/WebKit/UIProcess/SuspendedPageProxy.cpp:
(WebKit::SuspendedPageProxy::findReusableSuspendedPageProcess):
* Source/WebKit/UIProcess/WebProcessCache.cpp:
(WebKit::WebProcessCache::takeProcess):
* Tools/TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm:
(-[PSONNavigationDelegate webViewWebContentProcessDidTerminate:]):

Canonical link: https://commits.webkit.org/252177@main

https://bugs.webkit.org/show_bug.cgi?id=242382

Reviewed by Antti Koivisto.

* Source/JavaScriptCore/runtime/InitializeThreading.cpp:
(JSC::initialize):
* Source/JavaScriptCore/runtime/OptionsList.h:

Canonical link: https://commits.webkit.org/252176@main

…tent with broken background

https://bugs.webkit.org/show_bug.cgi?id=242338

Reviewed by Devin Rousso.

Prevent the CSS documentation popover from staying visible when clicking on the CSS value field.
Avoids having multiple popovers shown at the same time as a result of clicking on inline swatches.

The original intent to keep the the documentation popover visible while editing a CSS value was
that a user could reference the syntax section. But the syntax section is not shown  because
most entries are written with specialized identifiers to aid spec implementers, not users.
We don't yet have a solution to make it user-legible so the syntax section remains hidden.

Given this constraint, it doesn't make sense to keep the CSS documentation open while clicking
or typing in the CSS value field.

An implementation side-effect makes the lingering popover background look broken.
Its background is drawn as a CSS image, `background: -webkit-canvas(popover)`, sourced from a shared canvas context:
`document.getCSSCanvasContext("2d", "popover", scaledWidth, scaledHeight)`.

When another popover is shown, it redraws the image on the canvas which is then reflected on all visible popovers.

* Source/WebInspectorUI/UserInterface/Views/SpreadsheetStyleProperty.js:
(WI.SpreadsheetStyleProperty.prototype.willDismissPopover):
(WI.SpreadsheetStyleProperty.prototype._presentCSSDocumentation):

Canonical link: https://commits.webkit.org/252175@main

…ring

https://bugs.webkit.org/show_bug.cgi?id=242368

Reviewed by Myles C. Maxfield.

TypeConversion represents type casts like "f32(...)". However, this looks like a function
call with "f32" a hypothetical function that takes in values and returns a f32. For this
reason, we would like to reuse TypeConversion for function calls as well.

To express that a TypeConversion can also represent a function call, this patch renames it to
CallableExpression, so that it represents the generic idea of calling a "callable", like a
function identifier or type, with a list of arguments surrounded by parentheses.

The actual contents of the class remains unchanged, i.e it still contains a TypeDecl as the
target, and a list of Expressions as the arguments. When CallableExpression represents
a function call, then the target is simply a NamedType of the function identifier. When
CallableExpression represents a type cast, then the target is the target type to be casted to.

The patch also refactors CallableExpression a bit. The 'typeDecl' member is renamed to 'target'
to better show it's the target in the callable expression. Also, getters now return the
references inside UniqueRefs, instead of references to UniqueRefs.

* Source/WebGPU/WGSL/AST/Expression.h:
(WGSL::AST::Expression::isCallableExpression const):
(WGSL::AST::Expression::isTypeConversion const): Deleted.
* Source/WebGPU/WGSL/AST/Expressions/CallableExpression.h: Renamed from Source/WebGPU/WGSL/AST/Expressions/TypeConversion.h.
* Source/WebGPU/WGSL/Parser.cpp:
(WGSL::Parser<Lexer>::parsePrimaryExpression):
* Source/WebGPU/WGSLUnitTests/WGSLParserTests.mm:
(-[WGSLParserTests testTrivialGraphicsShader]):
* Source/WebGPU/WebGPU.xcodeproj/project.pbxproj:

Canonical link: https://commits.webkit.org/252174@main

https://bugs.webkit.org/show_bug.cgi?id=83618

Reviewed by Ryosuke Niwa.

The conservative GC may not reclaim all unreachable nodes. The test
should create and remove elements repeatedly and check the number of
live nodes loosely.

* LayoutTests/fast/dom/inline-event-attributes-release-expected.txt:
* LayoutTests/fast/dom/inline-event-attributes-release.html:
* LayoutTests/platform/ios-wk2/TestExpectations:
* LayoutTests/platform/win/TestExpectations:

Canonical link: https://commits.webkit.org/252173@main

https://bugs.webkit.org/show_bug.cgi?id=242371

Reviewed by Mark Lam.

This patch adds pas_scavenger_disable_shut_down, which can disable libpas's scavenger's shutting down.
We also add Options::libpasSavengeContinuously to flip this flag.

* Source/bmalloc/libpas/src/libpas/pas_scavenger.c:
(scavenger_thread_main):
(pas_scavenger_suspend):
(pas_scavenger_resume):
(pas_scavenger_disable_shut_down):
* Source/bmalloc/libpas/src/libpas/pas_scavenger.h:
* Source/JavaScriptCore/runtime/InitializeThreading.cpp:
(JSC::initialize):
* Source/JavaScriptCore/runtime/OptionsList.h:

Canonical link: https://commits.webkit.org/252172@main

https://bugs.webkit.org/show_bug.cgi?id=242294.

Air and B3 have two different approaches to loop osr. In BBQ Air, every
loop is included as a potential entry point, so we only need to compile
once. For OMG B3, we wish to compile with only one entry point at a time,
so that we do not pessimize loops.

Previously, we would always assume that BBQ generated all loop entry points,
even when we forced the use of BBQ B3. This happens on iOS for large modules
due to a workaround introduced to prevent executable memory exhaustion, and
also when we manually run BBQ without air.

This patch adds a test case and also adds extra test suite options to
test this unusual mode regularly.

Reviewed by Yusuke Suzuki.

* JSTests/wasm/wast-tests/osr-loop-entry-force-b3.wasm: Added.
* JSTests/wasm/wast-tests/osr-loop-entry-force-b3.wast: Added.
* Tools/Scripts/run-jsc-stress-tests:

Canonical link: https://commits.webkit.org/252171@main

…observers

https://bugs.webkit.org/show_bug.cgi?id=242325
rdar://96209023

Reviewed by Myles C. Maxfield.

Similar to clearNativeImageMap, clearDecomposedGlyphsMap should
deregister the DecomposedGlyphs observers when we clear out
m_decomposedGlyphs, since we no longer need to observe them.

* LayoutTests/fast/text/glyph-display-lists/glyph-display-list-gpu-process-crash-expected.txt: Added.
* LayoutTests/fast/text/glyph-display-lists/glyph-display-list-gpu-process-crash.html: Added.
* Source/WebCore/rendering/TextPainter.cpp:
(WebCore::TextPainter::clearGlyphDisplayListCacheForTesting):
* Source/WebCore/rendering/TextPainter.h:
* Source/WebCore/testing/Internals.cpp:
(WebCore::Internals::clearGlyphDisplayListCacheForTesting):
* Source/WebCore/testing/Internals.h:
* Source/WebCore/testing/Internals.idl:
* Source/WebKit/WebProcess/GPU/graphics/RemoteResourceCacheProxy.cpp:
(WebKit::RemoteResourceCacheProxy::clearDecomposedGlyphsMap):

Canonical link: https://commits.webkit.org/252170@main

https://bugs.webkit.org/show_bug.cgi?id=242347

Reviewed by Yusuke Suzuki.

We adjust VM heap growth factor to gain 0.5% RAMification progression.

* Source/JavaScriptCore/runtime/OptionsList.h:

Canonical link: https://commits.webkit.org/252169@main

…ction.

https://bugs.webkit.org/show_bug.cgi?id=242353

Reviewed by Yusuke Suzuki.

This helps provides a hint to the compiler that a previously fetched constant
field need not be re-fetched.  Secondly, it documents for the reader that the
intention that the field will not change after construction.

* Source/JavaScriptCore/bindings/ScriptFunctionCall.h:
* Source/JavaScriptCore/bytecode/CodeBlock.cpp:
* Source/JavaScriptCore/bytecode/CodeBlock.h:
* Source/JavaScriptCore/bytecode/CodeBlockWithJITType.h:
* Source/JavaScriptCore/bytecode/FullCodeOrigin.h:
* Source/JavaScriptCore/bytecode/PolymorphicAccess.h:
* Source/JavaScriptCore/bytecode/StructureStubClearingWatchpoint.h:
* Source/JavaScriptCore/debugger/Debugger.cpp:
* Source/JavaScriptCore/debugger/DebuggerEvalEnabler.h:
* Source/JavaScriptCore/debugger/ScriptProfilingScope.h:
* Source/JavaScriptCore/dfg/DFGAbstractInterpreter.h:
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
* Source/JavaScriptCore/dfg/DFGGraph.h:
* Source/JavaScriptCore/heap/MarkedBlock.cpp:
(JSC::MarkedBlock::Handle::Handle):
* Source/JavaScriptCore/heap/MarkedBlock.h:
* Source/JavaScriptCore/heap/WeakSet.h:
* Source/JavaScriptCore/interpreter/VMEntryRecord.h:
* Source/JavaScriptCore/jit/AssemblyHelpers.h:
* Source/JavaScriptCore/jit/JIT.cpp:
(JSC::JIT::JIT):
* Source/JavaScriptCore/jit/JIT.h:
* Source/JavaScriptCore/jit/JITDisassembler.h:
* Source/JavaScriptCore/jit/JSInterfaceJIT.h:
* Source/JavaScriptCore/jit/PolymorphicCallStubRoutine.h:
* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:
* Source/JavaScriptCore/runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::nativeStdFunctionStructure const):
(JSC::JSGlobalObject::functionNameOffset const): Deleted.
* Source/JavaScriptCore/runtime/LiteralParser.h:
* Source/JavaScriptCore/runtime/RegExpCache.h:
* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h:
* Source/JavaScriptCore/yarr/YarrJIT.cpp:
* Source/WebCore/bindings/js/JSExecState.h:
* Source/WebCore/bindings/js/SerializedScriptValue.cpp:
* Source/WebCore/dom/CustomElementReactionQueue.h:

Canonical link: https://commits.webkit.org/252168@main

https://bugs.webkit.org/show_bug.cgi?id=242294

Reviewed by Yusuke Suzuki.

Fix a regression caused by https://bugs.webkit.org/show_bug.cgi?id=234587.

This affected only iOS, and only when the WebAssembly module was greater
than 10 MB. In that case, the option `webAssemblyBBQAirModeThreshold`
caused JavaScriptCore/wasm/WasmBBQPlan.cpp to fall back from Air to B3.
However, the change in 234587 in `loop_osr` didn't correctly handle that
fallback. Changed it to use the old code path in this case.

Test: None (to be added later by @justinmichaud)

* Source/JavaScriptCore/wasm/WasmBBQPlan.cpp:
(JSC::Wasm::BBQPlan::planGeneratesLoopOSREntrypoints): Extracted from compileFunction.
(JSC::Wasm::BBQPlan::compileFunction):
* Source/JavaScriptCore/wasm/WasmBBQPlan.h:
* Source/JavaScriptCore/wasm/WasmSlowPaths.cpp:
(JSC::LLInt::WASM_SLOW_PATH_DECL): If planGeneratesLoopOSREntrypoints, use the old code path.

Canonical link: https://commits.webkit.org/252167@main

…d with spellcheck="false"

https://bugs.webkit.org/show_bug.cgi?id=242364
rdar://96458889

Reviewed by Aditya Keerthi.

Add a missing `-respondsToSelector:` check before attempting to set `spellCheckingType`. `spellCheckingType` is an
optional property on the `UITextInputTraits` protocol, and (importantly) isn't implemented on watchOS.

This crash is already exercised by `fast/forms/watchos/enter-text-with-spellcheck-disabled.html`, which (unfortunately)
doesn't run in pre- or post-commit non-internal automation.

* Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm:
(-[WKContentView _updateTextInputTraits:]):

Canonical link: https://commits.webkit.org/252166@main

https://bugs.webkit.org/show_bug.cgi?id=242051

Reviewed by Darin Adler.

* Introduction.md:

Canonical link: https://commits.webkit.org/252165@main

https://bugs.webkit.org/show_bug.cgi?id=242358
rdar://96056675

Reviewed by Mark Lam.

42ad6e4 broke JavaScriptCore.framework's wasm signal handler
since it is no longer installed. This patch activates that handler when wasm memory is created with signaling requirement, which is
Signaling or Shared memory. We do not activate this in JSC::initialize since LLDB has a bug that it cannot handle mach exception.
We defer this initialization only when we use Wasm::Memory with necessary features.

* Source/JavaScriptCore/jsc.cpp:
(runJSC):
* Source/JavaScriptCore/runtime/InitializeThreading.cpp:
(JSC::initialize):
* Source/JavaScriptCore/shell/playstation/TestShell.cpp:
(setupTestRun):
* Source/JavaScriptCore/wasm/WasmFaultSignalHandler.cpp:
(JSC::Wasm::activateSignalingMemory):
(JSC::Wasm::initializeSignalingMemory): Deleted.
* Source/JavaScriptCore/wasm/WasmFaultSignalHandler.h:
* Source/JavaScriptCore/wasm/WasmMemory.cpp:
(JSC::Wasm::MemoryHandle::MemoryHandle):
* Source/WebKit/WebProcess/WebProcess.cpp:
(WebKit::WebProcess::initializeWebProcess):

Canonical link: https://commits.webkit.org/252164@main

…laky timeout

https://bugs.webkit.org/show_bug.cgi?id=231636

Unreviewed test gardening.

* LayoutTests/platform/ios-wk2/TestExpectations:

Canonical link: https://commits.webkit.org/252163@main

Reviewed by Jonathan Bedard.

* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/pull_request.py:
(PullRequest.add_comment_to_reverted_commit_bug_tracker):

Canonical link: https://commits.webkit.org/252162@main

…de-any.html is a flaky crash

https://bugs.webkit.org/show_bug.cgi?id=232046

Unreviewed test gardening.

* LayoutTests/platform/mac-wk1/TestExpectations:

Canonical link: https://commits.webkit.org/252161@main

https://bugs.webkit.org/show_bug.cgi?id=242363
<rdar://96319951>

Reviewed by Chris Dumez.

Fix syscall sandbox violations on iOS.

* Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb.in:
* Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb.in:

Canonical link: https://commits.webkit.org/252160@main

https://bugs.webkit.org/show_bug.cgi?id=242324

Reviewed by Jonathan Bedard.

The GitHub API incorrectly isn't able to assign assignees to an issue
through the issue PATCH endpoint for certain user accounts, however, when
making the request to the issues/{id}/assignees endpoint, the assignment
is successful.

* Tools/Scripts/libraries/webkitbugspy/webkitbugspy/github.py:

Canonical link: https://commits.webkit.org/252159@main

https://bugs.webkit.org/show_bug.cgi?id=242356
<rdar://problem/96464281>

Reviewed by Chris Dumez.

Remove sandbox telemetry in GPUP on iOS for rules that are known to be hit.

* Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb.in:

Canonical link: https://commits.webkit.org/252158@main

…lose to the top of the screen

https://bugs.webkit.org/show_bug.cgi?id=242361
<rdar://problem/92740201>

Reviewed by Tim Horton.

* Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenViewController.mm:
(-[WKFullScreenViewController loadView]):

Canonical link: https://commits.webkit.org/252157@main

https://bugs.webkit.org/show_bug.cgi?id=242350
<rdar://problem/96457831>

Reviewed by Chris Dumez.

Remove telemetry in the GPU process' sandbox for rules that are known to be hit.

* Source/WebKit/GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:

Canonical link: https://commits.webkit.org/252156@main

https://bugs.webkit.org/show_bug.cgi?id=242307

Reviewed by Eric Carlson.

* LayoutTests/webrtc/video-setDirection.html:

Canonical link: https://commits.webkit.org/252155@main

…webrtc/simulcast/basic.https.html is a flaky failure

https://bugs.webkit.org/show_bug.cgi?id=231780

Unreviewed test gardening.

* LayoutTests/platform/mac-wk2/TestExpectations:

Canonical link: https://commits.webkit.org/252154@main

…nstances.html is randomly failing

https://bugs.webkit.org/show_bug.cgi?id=242230

Reviewed by Yusuke Suzuki.

The conservative GC may not reclaim all unreachable nodes. The test
should create and remove elements repeatedly and check the number of
live nodes loosely.

* LayoutTests/platform/win/TestExpectations:
* LayoutTests/svg/animations/animation-leak-list-property-instances-expected.txt:
* LayoutTests/svg/animations/animation-leak-list-property-instances.html:

Canonical link: https://commits.webkit.org/252153@main

…no longer true

https://bugs.webkit.org/show_bug.cgi?id=241627
rdar://problem/95670031

Reviewed by Chris Dumez.

Update the assert to account for the potential race condition between fetch event messages
and messages to update the registration from activating to activated.

* Source/WebCore/workers/service/context/ServiceWorkerFetch.cpp:
(WebCore::ServiceWorkerFetch::dispatchFetchEvent):

Canonical link: https://commits.webkit.org/252152@main

…epeated-failed-preflight-crash.html is a flaky crash: exception 'NSInternalInconsistencyException', reason: 'This task has already been stopped'

https://bugs.webkit.org/show_bug.cgi?id=231831

Unreviewed test gardening.

* LayoutTests/platform/mac-wk2/TestExpectations:

Canonical link: https://commits.webkit.org/252151@main