[webkit-changes] [WebKit/WebKit] 906929: Versioning.

Tue Nov 29 09:12:16 PST 2022

  Branch: refs/heads/safari-7613.3.9.0-branch
  Home:   https://github.com/WebKit/WebKit
  Commit: 906929f11e55200ae29b7d5de82156d91d086e49
      https://github.com/WebKit/WebKit/commit/906929f11e55200ae29b7d5de82156d91d086e49
  Author: Alan Coon <alancoon at apple.com>
  Date:   2022-08-03 (Wed, 03 Aug 2022)

  Changed paths:
    M Source/JavaScriptCore/Configurations/Version.xcconfig
    M Source/ThirdParty/ANGLE/Configurations/Version.xcconfig
    M Source/ThirdParty/libwebrtc/Configurations/Version.xcconfig
    M Source/WebCore/Configurations/Version.xcconfig
    M Source/WebCore/PAL/Configurations/Version.xcconfig
    M Source/WebGPU/Configurations/Version.xcconfig
    M Source/WebInspectorUI/Configurations/Version.xcconfig
    M Source/WebKit/Configurations/Version.xcconfig
    M Source/WebKitLegacy/mac/Configurations/Version.xcconfig

  Log Message:
  -----------
  Versioning.

WebKit-7613.4.1.0.1

Canonical link: https://commits.webkit.org/245886.806@safari-7613.3.9.0-branch

  Commit: 5a8de3f50180a061d1140261ef82c825f7730952
      https://github.com/WebKit/WebKit/commit/5a8de3f50180a061d1140261ef82c825f7730952
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2022-08-03 (Wed, 03 Aug 2022)

  Changed paths:
    A JSTests/stress/bigint-array-byte-offset.js
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

  Log Message:
  -----------
  Cherry-pick 1f3e8b70b999. rdar://problem/97264358

    [AArch32][Aarch64] ASSERTION FAILED variant.intrinsic() == NoIntrinsic in void JSC::DFG::ByteCodeParser::handleGetById
    https://bugs.webkit.org/show_bug.cgi?id=242599
    <rdar://96836847>

    Reviewed by Mark Lam.

    Previously all intrinsic getters are handled. So at this point, it should be NoIntrinsic.
    But after introducing 4GB TypedArray and BigInt64Array, this handling can fail.

    However, in this case, we should just continue using this generic path: invoking a getter.
    Thus, the current code is correct, and this assertion is stale.

    This patch removes this stale assertion.

    * JSTests/stress/bigint-array-byte-offset.js: Added.
    (__f_2):
    * Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
    (JSC::DFG::ByteCodeParser::handleGetById):

    Canonical link: https://commits.webkit.org/252391@main

Canonical link: https://commits.webkit.org/245886.807@safari-7613.3.9.0-branch

  Commit: d5b48dbd85a070d0b0a1f27395f84755087b73bb
      https://github.com/WebKit/WebKit/commit/d5b48dbd85a070d0b0a1f27395f84755087b73bb
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2022-08-03 (Wed, 03 Aug 2022)

  Changed paths:
    M Source/WebCore/bindings/js/DOMPromiseProxy.h

  Log Message:
  -----------
  Cherry-pick 4ac005fe82bb. rdar://problem/97276126

    Do hardening in DOMPromiseProxy
    https://bugs.webkit.org/show_bug.cgi?id=242528
    <rdar://96204017>

    Reviewed by Darin Adler.

    Make sure we make a copy of the deferred promises before iterating over them, in
    case the code inside the loop modifies the Vector. Similarly, do a copy of the
    return value or exception the deferred promises are settled with, in case |this|
    goes away.

    * Source/WebCore/bindings/js/DOMPromiseProxy.h:
    (WebCore::DOMPromiseProxy<IDLType>::resolve):
    (WebCore::DOMPromiseProxy<IDLAny>::resolve):
    (WebCore::DOMPromiseProxy<IDLType>::resolveWithNewlyCreated):
    (WebCore::DOMPromiseProxy<IDLType>::reject):
    (WebCore::DOMPromiseProxy<IDLUndefined>::resolve):
    (WebCore::DOMPromiseProxy<IDLUndefined>::reject):
    (WebCore::DOMPromiseProxyWithResolveCallback<IDLType>::resolve):
    (WebCore::DOMPromiseProxyWithResolveCallback<IDLType>::resolveWithNewlyCreated):
    (WebCore::DOMPromiseProxyWithResolveCallback<IDLType>::reject):

    Canonical link: https://commits.webkit.org/252305@main

Canonical link: https://commits.webkit.org/245886.808@safari-7613.3.9.0-branch

  Commit: 0e1154a51dcc5ab61c86e5eb764cd7147a7649d3
      https://github.com/WebKit/WebKit/commit/0e1154a51dcc5ab61c86e5eb764cd7147a7649d3
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2022-08-03 (Wed, 03 Aug 2022)

  Changed paths:
    M Source/WebCore/rendering/LegacyLineLayout.cpp

  Log Message:
  -----------
  Cherry-pick 4bfe200db44b. rdar://problem/97277370

    Existing floatingObject->originatingLine() is not always an incorrect state with security implication
    https://bugs.webkit.org/show_bug.cgi?id=242493

    Reviewed by Simon Fraser.

    The float object's originating line is the line box where we see the float first. Having duplicate originating line is an incorrect state which may lead to a security issue. However re-assigning the same line should not be considered one.

    * Source/WebCore/rendering/LegacyLineLayout.cpp:
    (WebCore::LegacyLineLayout::determineStartPosition):

    Canonical link: https://commits.webkit.org/252269@main

Canonical link: https://commits.webkit.org/245886.809@safari-7613.3.9.0-branch

  Commit: 0a6cd9c47e963ee45f0dff2531add5c8c89cc44f
      https://github.com/WebKit/WebKit/commit/0a6cd9c47e963ee45f0dff2531add5c8c89cc44f
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2022-08-03 (Wed, 03 Aug 2022)

  Changed paths:
    M Source/ThirdParty/libwebrtc/Source/webrtc/pc/rtp_sender.cc

  Log Message:
  -----------
  Cherry-pick 4cfca4164256. rdar://problem/97276088

    Update rtp_sender RestoreEncodingLayers function
    https://bugs.webkit.org/show_bug.cgi?id=242506
    rdar://96590018

    Reviewed by Eric Carlson.

    * Source/ThirdParty/libwebrtc/Source/webrtc/pc/rtp_sender.cc:

    Canonical link: https://commits.webkit.org/252302@main

Canonical link: https://commits.webkit.org/245886.810@safari-7613.3.9.0-branch

  Commit: a0989c64649f4a2ed7e5956c100a1bac3d0c10ba
      https://github.com/WebKit/WebKit/commit/a0989c64649f4a2ed7e5956c100a1bac3d0c10ba
  Author: Kyle Piddington <kpiddington at apple.com>
  Date:   2022-08-03 (Wed, 03 Aug 2022)

  Changed paths:
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_render_utils.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_render_utils.mm
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/format_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/gen_indices.metal
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/mtl_default_shaders_src_autogen.inc
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/mtl_default_shaders_src_autogen.metal

  Log Message:
  -----------
  Cherry-pick 7bf231b1fd35. rdar://problem/97324250

    [ANGLE] Bounds check index buffer generation
    https://bugs.webkit.org/show_bug.cgi?id=242762

    Bounds check element buffer access during triangle fan generation.
    Out of bounds reads of the element buffer on both the CPU and GPU will result in getting back
    index zero, rather than reading garbage memory

    Reviewed by Dean Jackson.

    * Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_render_utils.h:
    * Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_render_utils.mm:
    (rx::mtl::IndexGeneratorUtils::generateTriFanBufferFromElementsArray):
    (rx::mtl::IndexGeneratorUtils::generateTriFanBufferFromElementsArrayGPU):
    (rx::mtl::IndexGeneratorUtils::generateTriFanBufferFromElementsArrayCPU):
    * Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/format_autogen.h:
    * Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/gen_indices.metal:
    * Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/mtl_default_shaders_src_autogen.inc:
    * Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/mtl_default_shaders_src_autogen.metal:

    Canonical link: https://commits.webkit.org/252526@main

Canonical link: https://commits.webkit.org/245886.811@safari-7613.3.9.0-branch

  Commit: d845f4bfcf5bd821ee06f22990e8617b039662cc
      https://github.com/WebKit/WebKit/commit/d845f4bfcf5bd821ee06f22990e8617b039662cc
  Author: Saam Barati <sbarati at apple.com>
  Date:   2022-08-03 (Wed, 03 Aug 2022)

  Changed paths:
    M Source/JavaScriptCore/dfg/DFGCPSRethreadingPhase.cpp
    M Source/JavaScriptCore/dfg/DFGGraph.cpp

  Log Message:
  -----------
  Cherry-pick 8b320548f922. rdar://problem/97274970

    Don't allow Flush/PhantomLocal to be the head variable in a block in ThreadedCPS
    https://bugs.webkit.org/show_bug.cgi?id=242096

    Reviewed by Yusuke Suzuki.

    Before this patch, we would allow Flush/PhantomLocal to be the node inside the variableAtHead Operands
    in a basic block. However, this causes some issues inside of our CFG simplifcations phase.
    CFG simplification will look at the variables at the head of the basic blocks that it's going to
    remove to indicate how we should preserve liveness in its predecessor. We would then preserve
    liveness using a Flush if the variableAtHead was Flushed, otherwise, we would use a PhantomLocal.

    However, the variable at the head might be a PhantomLocal, and it might be a PhantomLocal
    over a variable that's Flushed. However, in our IsFlushed analysis, we never mark
    PhantomLocals as IsFlushed, we only mark value producing nodes, Flush, or Phis.
    We do this by traversing the Phi data flow graph to propagate IsFlushed. And a Phi
    can never transitively point to a PhantomLocal, so it will never indicate if a
    variable is flushed.

    To fix this, we just make the variableAtHead contain a Phi instead of
    a Flush/PhantomLocal in the situation where it used to be a Flush/PhantomLocal.
    This Phi is what the Flush/PhantomLocal used to point to. And the compiler is
    already prepared for variableAtHead to point to a Phi since that's
    what happens for GetLocal. GetLocal will point to a Phi that's inside
    variableAtHead. And now what's pointed to by variableAtHead will
    properly indicate if the variable is flushed since it'll be a Phi or a
    SetArgument node.

    * Source/JavaScriptCore/dfg/DFGCPSRethreadingPhase.cpp:
    (JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
    (JSC::DFG::CPSRethreadingPhase::canonicalizeLocalsInBlock):
    * Source/JavaScriptCore/dfg/DFGGraph.cpp:
    (JSC::DFG::Graph::dumpBlockHeader):

    Canonical link: https://commits.webkit.org/252192@main

Canonical link: https://commits.webkit.org/245886.812@safari-7613.3.9.0-branch

  Commit: ec2fe2a686526772b66f7a437a8e06dc71231b7c
      https://github.com/WebKit/WebKit/commit/ec2fe2a686526772b66f7a437a8e06dc71231b7c
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2022-08-03 (Wed, 03 Aug 2022)

  Changed paths:
    M Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp

  Log Message:
  -----------
  Cherry-pick a3dd7dc5f60b. rdar://problem/97278973

    [JSC] Drop wasm stale assertion
    https://bugs.webkit.org/show_bug.cgi?id=242047
    rdar://95866655

    Reviewed by Mark Lam.

    This patch drops stale assertion in addDelegateToUnreachable.

    * Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp:
    (JSC::Wasm::LLIntGenerator::addDelegateToUnreachable):

    Canonical link: https://commits.webkit.org/251902@main

Canonical link: https://commits.webkit.org/245886.813@safari-7613.3.9.0-branch

  Commit: f04744decc111e77a7c01ded55093d343d5b2b7b
      https://github.com/WebKit/WebKit/commit/f04744decc111e77a7c01ded55093d343d5b2b7b
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2022-08-03 (Wed, 03 Aug 2022)

  Changed paths:
    M Source/WebCore/rendering/RenderElement.cpp
    M Source/WebCore/rendering/RenderLayer.cpp
    M Source/WebCore/rendering/RenderLayer.h

  Log Message:
  -----------
  Cherry-pick a8bfed275263. rdar://problem/97273521

    Do not include unparented RenderLayers in RenderLayer::topLayerRenderLayers
    https://bugs.webkit.org/show_bug.cgi?id=241963
    <rdar://95098693>

    Reviewed by Simon Fraser.

    * Source/WebCore/rendering/RenderElement.cpp:
    (WebCore::findNextLayer):
    (WebCore::layerNextSiblingRespectingTopLayer):
    * Source/WebCore/rendering/RenderLayer.cpp:
    * Source/WebCore/rendering/RenderLayer.h:

    Canonical link: https://commits.webkit.org/251848@main

Canonical link: https://commits.webkit.org/245886.814@safari-7613.3.9.0-branch

  Commit: 7f676a460181db52d1b44e9b8a103f626ae90384
      https://github.com/WebKit/WebKit/commit/7f676a460181db52d1b44e9b8a103f626ae90384
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2022-08-03 (Wed, 03 Aug 2022)

  Changed paths:
    M Source/JavaScriptCore/jsc.cpp
    M Source/JavaScriptCore/runtime/InitializeThreading.cpp
    M Source/JavaScriptCore/shell/playstation/TestShell.cpp
    M Source/JavaScriptCore/wasm/WasmFaultSignalHandler.cpp
    M Source/JavaScriptCore/wasm/WasmFaultSignalHandler.h
    M Source/JavaScriptCore/wasm/WasmMemory.cpp
    M Source/WebKit/WebProcess/WebProcess.cpp

  Log Message:
  -----------
  Cherry-pick bb92169c6b02. rdar://problem/97264328

    [JSC] Activate wasm fault handler when signaling memory is used
    https://bugs.webkit.org/show_bug.cgi?id=242358
    rdar://96056675

    Reviewed by Mark Lam.

    https://github.com/WebKit/WebKit/commit/42ad6e4af024381a287ea6a587da469ef43f2819 broke JavaScriptCore.framework's wasm signal handler
    since it is no longer installed. This patch activates that handler when wasm memory is created with signaling requirement, which is
    Signaling or Shared memory. We do not activate this in JSC::initialize since LLDB has a bug that it cannot handle mach exception.
    We defer this initialization only when we use Wasm::Memory with necessary features.

    * Source/JavaScriptCore/jsc.cpp:
    (runJSC):
    * Source/JavaScriptCore/runtime/InitializeThreading.cpp:
    (JSC::initialize):
    * Source/JavaScriptCore/shell/playstation/TestShell.cpp:
    (setupTestRun):
    * Source/JavaScriptCore/wasm/WasmFaultSignalHandler.cpp:
    (JSC::Wasm::activateSignalingMemory):
    (JSC::Wasm::initializeSignalingMemory): Deleted.
    * Source/JavaScriptCore/wasm/WasmFaultSignalHandler.h:
    * Source/JavaScriptCore/wasm/WasmMemory.cpp:
    (JSC::Wasm::MemoryHandle::MemoryHandle):
    * Source/WebKit/WebProcess/WebProcess.cpp:
    (WebKit::WebProcess::initializeWebProcess):

    Canonical link: https://commits.webkit.org/252164@main

Canonical link: https://commits.webkit.org/245886.815@safari-7613.3.9.0-branch

  Commit: da4179b034adba7de371ff71e5c902b8bcc53b2c
      https://github.com/WebKit/WebKit/commit/da4179b034adba7de371ff71e5c902b8bcc53b2c
  Author: Brandon Stewart <brandonstewart at apple.com>
  Date:   2022-08-03 (Wed, 03 Aug 2022)

  Changed paths:
    M Source/WebCore/crypto/SubtleCrypto.cpp

  Log Message:
  -----------
  Cherry-pick c29e5a28c176. rdar://problem/97276107

    Ensure promise is not garbage collected
    https://bugs.webkit.org/show_bug.cgi?id=242287

    Reviewed by Tim Nguyen.

    We need to ensure that the promise always remains alive when in use.
    Adding a RefPtr guarantees that it will not be garbage collected.

    * Source/WebCore/crypto/SubtleCrypto.cpp:
    (WebCore::SubtleCrypto::unwrapKey):

    Canonical link: https://commits.webkit.org/252091@main

Canonical link: https://commits.webkit.org/245886.816@safari-7613.3.9.0-branch

  Commit: b9a715e45910d40433ce8b415102f223d7a68e7a
      https://github.com/WebKit/WebKit/commit/b9a715e45910d40433ce8b415102f223d7a68e7a
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2022-08-03 (Wed, 03 Aug 2022)

  Changed paths:
    M Source/JavaScriptCore/wasm/WasmFunctionParser.h

  Log Message:
  -----------
  Cherry-pick cb3e9788095c. rdar://problem/97276414

    [JSC] Clean up delegate's error message
    https://bugs.webkit.org/show_bug.cgi?id=242099

    Reviewed by Saam Barati.

    This patch fixes error message for delegate wasm opcode, it is not br or br_if.

    * Source/JavaScriptCore/wasm/WasmFunctionParser.h:
    (JSC::Wasm::FunctionParser<Context>::parseDelegateTarget):
    (JSC::Wasm::FunctionParser<Context>::parseExpression):
    (JSC::Wasm::FunctionParser<Context>::parseUnreachableExpression):

    Canonical link: https://commits.webkit.org/251944@main

Canonical link: https://commits.webkit.org/245886.817@safari-7613.3.9.0-branch

  Commit: 5ddcf36b601c7229c3a36940c81f8f2a27ed88a0
      https://github.com/WebKit/WebKit/commit/5ddcf36b601c7229c3a36940c81f8f2a27ed88a0
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2022-08-03 (Wed, 03 Aug 2022)

  Changed paths:
    M Source/WebCore/bindings/js/JSDOMGuardedObject.cpp

  Log Message:
  -----------
  Cherry-pick ecad671df9fc. rdar://problem/97274999

    Refine JSDOMGuardedObject
    https://bugs.webkit.org/show_bug.cgi?id=242282
    rdar://94649571

    Reviewed by Mark Lam.

    This patch fixes the following issues.

    1. JSDOMGuardedObject should emit write-barrier after storing a reference to JSDOMGlobalObject.
    2. Regardless of m_guarded status, we should unregister itself from JSDOMGlobalObject if JSDOMGlobalObject
       is live since we register it in the constructor.

    * Source/WebCore/bindings/js/JSDOMGuardedObject.cpp:
    (WebCore::DOMGuardedObject::DOMGuardedObject):
    (WebCore::DOMGuardedObject::clear):
    (WebCore::DOMGuardedObject::removeFromGlobalObject):

    Canonical link: https://commits.webkit.org/252086@main

Canonical link: https://commits.webkit.org/245886.818@safari-7613.3.9.0-branch

  Commit: 4689200da72bb53cb9333f911ab6019645cb7155
      https://github.com/WebKit/WebKit/commit/4689200da72bb53cb9333f911ab6019645cb7155
  Author: Alan Coon <alancoon at apple.com>
  Date:   2022-08-04 (Thu, 04 Aug 2022)

  Changed paths:
    M Source/WebCore/bindings/js/JSDOMGuardedObject.cpp

  Log Message:
  -----------
  Revert ecad671df9fc. rdar://problem/97274999

This reverts commit 5ddcf36b601c7229c3a36940c81f8f2a27ed88a0.

Canonical link: https://commits.webkit.org/245886.819@safari-7613.3.9.0-branch

  Commit: c40feebe3ec9423c815ba97c1ddce06f2d3bcb0c
      https://github.com/WebKit/WebKit/commit/c40feebe3ec9423c815ba97c1ddce06f2d3bcb0c
  Author: Alan Coon <alancoon at apple.com>
  Date:   2022-08-04 (Thu, 04 Aug 2022)

  Changed paths:
    M Source/JavaScriptCore/wasm/WasmFunctionParser.h

  Log Message:
  -----------
  Revert cb3e9788095c. rdar://problem/97276414

This reverts commit b9a715e45910d40433ce8b415102f223d7a68e7a.

Canonical link: https://commits.webkit.org/245886.820@safari-7613.3.9.0-branch

  Commit: 4fe1d9022ac2b2825a5a973446bbd929986cc47c
      https://github.com/WebKit/WebKit/commit/4fe1d9022ac2b2825a5a973446bbd929986cc47c
  Author: Alan Coon <alancoon at apple.com>
  Date:   2022-08-04 (Thu, 04 Aug 2022)

  Changed paths:
    M Source/WebCore/crypto/SubtleCrypto.cpp

  Log Message:
  -----------
  Revert c29e5a28c176. rdar://problem/97276107

This reverts commit da4179b034adba7de371ff71e5c902b8bcc53b2c.

Canonical link: https://commits.webkit.org/245886.821@safari-7613.3.9.0-branch

  Commit: 48c7d101542e5a93e5f8e6293776503e69053277
      https://github.com/WebKit/WebKit/commit/48c7d101542e5a93e5f8e6293776503e69053277
  Author: Alan Coon <alancoon at apple.com>
  Date:   2022-08-04 (Thu, 04 Aug 2022)

  Changed paths:
    M Source/JavaScriptCore/jsc.cpp
    M Source/JavaScriptCore/runtime/InitializeThreading.cpp
    M Source/JavaScriptCore/shell/playstation/TestShell.cpp
    M Source/JavaScriptCore/wasm/WasmFaultSignalHandler.cpp
    M Source/JavaScriptCore/wasm/WasmFaultSignalHandler.h
    M Source/JavaScriptCore/wasm/WasmMemory.cpp
    M Source/WebKit/WebProcess/WebProcess.cpp

  Log Message:
  -----------
  Revert bb92169c6b02. rdar://problem/97264328

This reverts commit 7f676a460181db52d1b44e9b8a103f626ae90384.

Canonical link: https://commits.webkit.org/245886.822@safari-7613.3.9.0-branch

  Commit: 56a09fd49f6d3ab92bb59bbbbcead90e9f1511dd
      https://github.com/WebKit/WebKit/commit/56a09fd49f6d3ab92bb59bbbbcead90e9f1511dd
  Author: Alan Coon <alancoon at apple.com>
  Date:   2022-08-04 (Thu, 04 Aug 2022)

  Changed paths:
    M Source/WebCore/rendering/RenderElement.cpp
    M Source/WebCore/rendering/RenderLayer.cpp
    M Source/WebCore/rendering/RenderLayer.h

  Log Message:
  -----------
  Revert a8bfed275263. rdar://problem/97273521

This reverts commit f04744decc111e77a7c01ded55093d343d5b2b7b.

Canonical link: https://commits.webkit.org/245886.823@safari-7613.3.9.0-branch

  Commit: 8d69488c42130c281c688f4c3aae8adacff0042f
      https://github.com/WebKit/WebKit/commit/8d69488c42130c281c688f4c3aae8adacff0042f
  Author: Alan Coon <alancoon at apple.com>
  Date:   2022-08-04 (Thu, 04 Aug 2022)

  Changed paths:
    M Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp

  Log Message:
  -----------
  Revert a3dd7dc5f60b. rdar://problem/97278973

This reverts commit ec2fe2a686526772b66f7a437a8e06dc71231b7c.

Canonical link: https://commits.webkit.org/245886.824@safari-7613.3.9.0-branch

  Commit: 3173037ff62e00d679c0d0fc774cbffb4b303c4c
      https://github.com/WebKit/WebKit/commit/3173037ff62e00d679c0d0fc774cbffb4b303c4c
  Author: Alan Coon <alancoon at apple.com>
  Date:   2022-08-04 (Thu, 04 Aug 2022)

  Changed paths:
    M Source/JavaScriptCore/dfg/DFGCPSRethreadingPhase.cpp
    M Source/JavaScriptCore/dfg/DFGGraph.cpp

  Log Message:
  -----------
  Revert 8b320548f922. rdar://problem/97274970

This reverts commit d845f4bfcf5bd821ee06f22990e8617b039662cc.

Canonical link: https://commits.webkit.org/245886.825@safari-7613.3.9.0-branch

  Commit: f5a3937896b0693de73f5c87143fad4d200acf30
      https://github.com/WebKit/WebKit/commit/f5a3937896b0693de73f5c87143fad4d200acf30
  Author: Alan Coon <alancoon at apple.com>
  Date:   2022-08-04 (Thu, 04 Aug 2022)

  Changed paths:
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_render_utils.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_render_utils.mm
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/format_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/gen_indices.metal
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/mtl_default_shaders_src_autogen.inc
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/shaders/mtl_default_shaders_src_autogen.metal

  Log Message:
  -----------
  Revert 7bf231b1fd35. rdar://problem/97324250

This reverts commit a0989c64649f4a2ed7e5956c100a1bac3d0c10ba.

Canonical link: https://commits.webkit.org/245886.826@safari-7613.3.9.0-branch

  Commit: 4548b55ba462c5eef6c27eb2aaff09e6c3fa9c1e
      https://github.com/WebKit/WebKit/commit/4548b55ba462c5eef6c27eb2aaff09e6c3fa9c1e
  Author: Alan Coon <alancoon at apple.com>
  Date:   2022-08-04 (Thu, 04 Aug 2022)

  Changed paths:
    M Source/ThirdParty/libwebrtc/Source/webrtc/pc/rtp_sender.cc

  Log Message:
  -----------
  Revert 4cfca4164256. rdar://problem/97276088

This reverts commit 0a6cd9c47e963ee45f0dff2531add5c8c89cc44f.

Canonical link: https://commits.webkit.org/245886.827@safari-7613.3.9.0-branch

  Commit: aacf31fbf06793c9b40ae174fc8ef052e21c3c12
      https://github.com/WebKit/WebKit/commit/aacf31fbf06793c9b40ae174fc8ef052e21c3c12
  Author: Alan Coon <alancoon at apple.com>
  Date:   2022-08-04 (Thu, 04 Aug 2022)

  Changed paths:
    M Source/WebCore/rendering/LegacyLineLayout.cpp

  Log Message:
  -----------
  Revert 4bfe200db44b. rdar://problem/97277370

This reverts commit 0e1154a51dcc5ab61c86e5eb764cd7147a7649d3.

Canonical link: https://commits.webkit.org/245886.828@safari-7613.3.9.0-branch

  Commit: 3682b2ac1aa53d31507359fabed5006f6037d480
      https://github.com/WebKit/WebKit/commit/3682b2ac1aa53d31507359fabed5006f6037d480
  Author: Alan Coon <alancoon at apple.com>
  Date:   2022-08-04 (Thu, 04 Aug 2022)

  Changed paths:
    M Source/WebCore/bindings/js/DOMPromiseProxy.h

  Log Message:
  -----------
  Revert 4ac005fe82bb. rdar://problem/97276126

This reverts commit d5b48dbd85a070d0b0a1f27395f84755087b73bb.

Canonical link: https://commits.webkit.org/245886.829@safari-7613.3.9.0-branch

  Commit: aa1ca57c1ce961c141264b1c5da88749ccf13a61
      https://github.com/WebKit/WebKit/commit/aa1ca57c1ce961c141264b1c5da88749ccf13a61
  Author: Alan Coon <alancoon at apple.com>
  Date:   2022-08-04 (Thu, 04 Aug 2022)

  Changed paths:
    R JSTests/stress/bigint-array-byte-offset.js
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

  Log Message:
  -----------
  Revert 1f3e8b70b999. rdar://problem/97264358

This reverts commit 5a8de3f50180a061d1140261ef82c825f7730952.

Canonical link: https://commits.webkit.org/245886.830@safari-7613.3.9.0-branch

  Commit: d9bb630d3a1040355e2475da4c68c21dede81529
      https://github.com/WebKit/WebKit/commit/d9bb630d3a1040355e2475da4c68c21dede81529
  Author: Alan Coon <alancoon at apple.com>
  Date:   2022-08-04 (Thu, 04 Aug 2022)

  Changed paths:
    M Source/JavaScriptCore/Configurations/Version.xcconfig
    M Source/ThirdParty/ANGLE/Configurations/Version.xcconfig
    M Source/ThirdParty/libwebrtc/Configurations/Version.xcconfig
    M Source/WebCore/Configurations/Version.xcconfig
    M Source/WebCore/PAL/Configurations/Version.xcconfig
    M Source/WebGPU/Configurations/Version.xcconfig
    M Source/WebInspectorUI/Configurations/Version.xcconfig
    M Source/WebKit/Configurations/Version.xcconfig
    M Source/WebKitLegacy/mac/Configurations/Version.xcconfig

  Log Message:
  -----------
  Versioning.

WebKit-7613.3.9.0.15

Canonical link: https://commits.webkit.org/245886.831@safari-7613.3.9.0-branch

  Commit: fdaaccf6d7791cf2c329b0370a08ed9788265089
      https://github.com/WebKit/WebKit/commit/fdaaccf6d7791cf2c329b0370a08ed9788265089
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2022-08-04 (Thu, 04 Aug 2022)

  Changed paths:
    A JSTests/stress/map-clear-get.js
    A JSTests/stress/set-clear-has.js
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
    M Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp
    M Source/JavaScriptCore/runtime/HashMapImpl.h
    M Source/JavaScriptCore/runtime/HashMapImplInlines.h
    M Source/JavaScriptCore/runtime/JSMap.h
    M Source/JavaScriptCore/runtime/JSModuleLoader.cpp
    M Source/JavaScriptCore/runtime/JSSet.h
    M Source/JavaScriptCore/runtime/MapConstructor.cpp
    M Source/JavaScriptCore/runtime/MapPrototype.cpp
    M Source/JavaScriptCore/runtime/SetConstructor.cpp
    M Source/JavaScriptCore/runtime/SetPrototype.cpp
    M Source/JavaScriptCore/runtime/WeakMapImplInlines.h
    M Source/WebCore/bindings/js/JSDOMMapLike.cpp
    M Source/WebCore/bindings/js/JSDOMSetLike.cpp
    M Source/WebCore/bindings/js/SerializedScriptValue.cpp

  Log Message:
  -----------
  Cherry-pick 1ed1e4a336e1. rdar://problem/98068082

    [JSC] Make JSMap and JSSet construction more simple and efficient
    https://bugs.webkit.org/show_bug.cgi?id=243557
    rdar://98068082

    Reviewed by Mark Lam and Saam Barati.

    This patch makes the initial buffer of JSMap / JSSet nullptr so that we can make allocation of them
    simpler and efficient for non-using case. It cleans up many code in module loader etc. And it paves
    the way to allocating them from DFG and FTL efficiently. It also cleans up SerializedScriptValue
    implementation.

    * JSTests/stress/map-clear-get.js: Added.
    (shouldBe):
    (test):
    * JSTests/stress/set-clear-has.js: Added.
    (shouldBe):
    (set clear):
    (set shouldBe):
    (set new):
    * Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
    (JSC::DFG::SpeculativeJIT::compile):
    * Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
    (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
    * Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp:
    (JSC::AbstractModuleRecord::finishCreation):
    * Source/JavaScriptCore/runtime/HashMapImpl.h:
    (JSC::HashMapBuffer::tryCreate):
    (JSC::HashMapImpl::HashMapImpl):
    (JSC::HashMapBuffer::create): Deleted.
    (JSC::HashMapImpl::shouldRehashAfterAdd const): Deleted.
    * Source/JavaScriptCore/runtime/HashMapImplInlines.h:
    (JSC::shouldShrink):
    (JSC::shouldRehash):
    (JSC::nextCapacity):
    (JSC::HashMapImpl<HashMapBucketType>::finishCreation):
    (JSC::HashMapImpl<HashMapBucketType>::add):
    (JSC::HashMapImpl<HashMapBucketType>::addNormalized):
    (JSC::HashMapImpl<HashMapBucketType>::remove):
    (JSC::HashMapImpl<HashMapBucketType>::clear):
    (JSC::HashMapImpl<HashMapBucketType>::setUpHeadAndTail):
    (JSC::HashMapImpl<HashMapBucketType>::addNormalizedNonExistingForCloning):
    (JSC::HashMapImpl<HashMapBucketType>::addNormalizedNonExistingForCloningInternal):
    (JSC::HashMapImpl<HashMapBucketType>::addNormalizedInternal):
    (JSC::HashMapImpl<HashMapBucketType>::findBucketAlreadyHashedAndNormalized):
    (JSC::HashMapImpl<HashMapBucketType>::rehash):
    (JSC::HashMapImpl<HashMapBucketType>::makeAndSetNewBuffer):
    (JSC::HashMapImpl<HashMapBucketType>::assertBufferIsEmpty):
    (JSC::shouldRehashAfterAdd): Deleted.
    (JSC::HashMapImpl<HashMapBucketType>::assertBufferIsEmpty const): Deleted.
    * Source/JavaScriptCore/runtime/JSMap.h:
    * Source/JavaScriptCore/runtime/JSModuleLoader.cpp:
    (JSC::JSModuleLoader::finishCreation):
    * Source/JavaScriptCore/runtime/JSSet.h:
    * Source/JavaScriptCore/runtime/MapConstructor.cpp:
    (JSC::JSC_DEFINE_HOST_FUNCTION):
    * Source/JavaScriptCore/runtime/MapPrototype.cpp:
    (JSC::JSC_DEFINE_HOST_FUNCTION):
    * Source/JavaScriptCore/runtime/SetConstructor.cpp:
    (JSC::JSC_DEFINE_HOST_FUNCTION):
    * Source/JavaScriptCore/runtime/SetPrototype.cpp:
    (JSC::JSC_DEFINE_HOST_FUNCTION):
    * Source/JavaScriptCore/runtime/WeakMapImplInlines.h:
    (JSC::WeakMapImpl<WeakMapBucket>::shouldRehashAfterAdd const):
    * Source/WebCore/bindings/js/JSDOMMapLike.cpp:
    (WebCore::getBackingMap):
    * Source/WebCore/bindings/js/JSDOMSetLike.cpp:
    (WebCore::getBackingSet):
    * Source/WebCore/bindings/js/SerializedScriptValue.cpp:
    (WebCore::CloneDeserializer::deserialize):

    Canonical link: https://commits.webkit.org/253133@main

Canonical link: https://commits.webkit.org/245886.832@safari-7613.3.9.0-branch

  Commit: 1052ae177e9a79520810f3017e78be36bbb175c3
      https://github.com/WebKit/WebKit/commit/1052ae177e9a79520810f3017e78be36bbb175c3
  Author: Alan Coon <alancoon at apple.com>
  Date:   2022-08-09 (Tue, 09 Aug 2022)

  Changed paths:
    M Source/JavaScriptCore/Configurations/Version.xcconfig
    M Source/ThirdParty/ANGLE/Configurations/Version.xcconfig
    M Source/ThirdParty/libwebrtc/Configurations/Version.xcconfig
    M Source/WebCore/Configurations/Version.xcconfig
    M Source/WebCore/PAL/Configurations/Version.xcconfig
    M Source/WebGPU/Configurations/Version.xcconfig
    M Source/WebInspectorUI/Configurations/Version.xcconfig
    M Source/WebKit/Configurations/Version.xcconfig
    M Source/WebKitLegacy/mac/Configurations/Version.xcconfig

  Log Message:
  -----------
  Versioning.

WebKit-7613.3.9.0.16

Canonical link: https://commits.webkit.org/245886.833@safari-7613.3.9.0-branch

Compare: https://github.com/WebKit/WebKit/compare/50f30150aef5...1052ae177e9a