[webkit-changes] [WebKit/WebKit] 0b1ad2: Versioning.

[Jonathan Bedard]

  Branch: refs/heads/safari-7615.3.9.13-branch
  Home:   https://github.com/WebKit/WebKit
  Commit: 0b1ad2f765cce94e8762ae76e0dfbe7d8a3e3149
      https://github.com/WebKit/WebKit/commit/0b1ad2f765cce94e8762ae76e0dfbe7d8a3e3149
  Author: Myah Cobbs <mcobbs at apple.com>
  Date:   2023-06-21 (Wed, 21 Jun 2023)

  Changed paths:
    M Configurations/Version.xcconfig

  Log Message:
  -----------
  Versioning.

WebKit-7615.3.9.13.1

Identifier: 259548.837 at safari-7615.3.9.13-branch


  Commit: ac10b7005269bf15e85193d2c2a1e83cef08b45a
      https://github.com/WebKit/WebKit/commit/ac10b7005269bf15e85193d2c2a1e83cef08b45a
  Author: Ryan Reno <rreno at apple.com>
  Date:   2023-06-21 (Wed, 21 Jun 2023)

  Changed paths:
    M Source/WebCore/loader/MixedContentChecker.cpp

  Log Message:
  -----------
  Cherry-pick 74f32c21189a. rdar://problem/110766912

    Remove unnecessary release assertion from mixed content checker.
    https://bugs.webkit.org/show_bug.cgi?id=258303
    <rdar://110766912>

    Reviewed by Brent Fulgham.

    We now check the entire frame tree for mixed content checks for all
    resources loads. An assertion that a document has a frame is no
    longer valid in general. This assertion was originally added in
    215749 at main in an attempt to cover an untestable case. This replaces
    the assert with a null check.

    * Source/WebCore/loader/MixedContentChecker.cpp:
    (WebCore::foundMixedContentInFrameTree):

    Canonical link: https://commits.webkit.org/259548.841@safari-7615-branch

Identifier: 259548.838 at safari-7615.3.9.13-branch


  Commit: 2f4388bf23269bf02b1fedfad99a226e889d80f7
      https://github.com/WebKit/WebKit/commit/2f4388bf23269bf02b1fedfad99a226e889d80f7
  Author: Russell Epstein <repstein at apple.com>
  Date:   2023-06-22 (Thu, 22 Jun 2023)

  Changed paths:
    M Configurations/Version.xcconfig

  Log Message:
  -----------
  Versioning.

WebKit-7615.3.9.13.2

Identifier: 259548.839 at safari-7615.3.9.13-branch


  Commit: d4b69ce6f08556a7445752b2bee0b2c7a6cff765
      https://github.com/WebKit/WebKit/commit/d4b69ce6f08556a7445752b2bee0b2c7a6cff765
  Author: David Degazio <d_degazio at apple.com>
  Date:   2023-06-22 (Thu, 22 Jun 2023)

  Changed paths:
    A JSTests/wasm/stress/phi-live-across-rethrow.js
    A JSTests/wasm/stress/phi-live-across-throw.js
    M Source/JavaScriptCore/b3/B3DuplicateTails.cpp
    M Source/JavaScriptCore/b3/B3Kind.cpp
    M Source/JavaScriptCore/b3/B3Kind.h
    M Source/JavaScriptCore/b3/B3PatchpointValue.cpp
    M Source/JavaScriptCore/b3/B3PatchpointValue.h
    M Source/JavaScriptCore/b3/B3ValueInlines.h
    M Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp

  Log Message:
  -----------
  Cherry-pick 2e29306082ae. rdar://problem/110634913

    Prevent duplication of WASM throw and rethrow patchpoints in B3
    https://bugs.webkit.org/show_bug.cgi?id=258408
    rdar://110634913

    Reviewed by Yusuke Suzuki.

    Adds a cloningForbidden property to B3Kind, used to prevent a B3 value
    from being cloned during optimizations, and applies it to the patchpoints
    generated for the WASM throw and rethrow opcodes in WasmB3IRGenerator.
    This prevents a problem where these patchpoints could be duplicated, still
    share a stackmap/callsite index, but have conflicting live value
    locations.

    * JSTests/wasm/stress/phi-live-across-rethrow.js: Added.
    (async test):
    * JSTests/wasm/stress/phi-live-across-throw.js: Added.
    (async test):
    * Source/JavaScriptCore/b3/B3DuplicateTails.cpp:
    * Source/JavaScriptCore/b3/B3Kind.cpp:
    (JSC::B3::Kind::dump const):
    * Source/JavaScriptCore/b3/B3Kind.h:
    (JSC::B3::Kind::hasCloningForbidden):
    (JSC::B3::Kind::hasCloningForbidden const):
    (JSC::B3::Kind::isCloningForbidden const):
    (JSC::B3::Kind::setIsCloningForbidden):
    (JSC::B3::Kind::operator== const):
    (JSC::B3::Kind::hash const):
    (JSC::B3::cloningForbidden):
    * Source/JavaScriptCore/b3/B3PatchpointValue.cpp:
    (JSC::B3::PatchpointValue::PatchpointValue):
    * Source/JavaScriptCore/b3/B3PatchpointValue.h:
    * Source/JavaScriptCore/b3/B3ValueInlines.h:
    (JSC::B3::Value::cloneImpl const):
    * Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp:
    (JSC::Wasm::B3IRGenerator::addThrow):
    (JSC::Wasm::B3IRGenerator::addRethrow):

    Canonical link: https://commits.webkit.org/259548.844@safari-7615-branch
Identifier: 259548.840 at safari-7615.3.9.13-branch


Compare: https://github.com/WebKit/WebKit/compare/0b1ad2f765cc%5E...d4b69ce6f085