<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[230348] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/230348">230348</a></dd>
<dt>Author</dt> <dd>Ms2ger@igalia.com</dd>
<dt>Date</dt> <dd>2018-04-06 12:20:35 -0700 (Fri, 06 Apr 2018)</dd>
</dl>

<h3>Log Message</h3>
<pre>Support transferring ImageBitmap objects
https://bugs.webkit.org/show_bug.cgi?id=183131

Reviewed by Dean Jackson.

LayoutTests/imported/w3c:

* web-platform-tests/2dcontext/imagebitmap/createImageBitmap-transfer-expected.txt: Added.
* web-platform-tests/2dcontext/imagebitmap/createImageBitmap-transfer.html: Added.
* web-platform-tests/2dcontext/imagebitmap/transfer-worker.js: Added.

Source/WebCore:

Test: imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-transfer.html

* bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneSerializer::serialize): thread through ImageBitmaps.
(WebCore::CloneSerializer::CloneSerializer): thread through ImageBitmaps.
(WebCore::CloneSerializer::fillTransferMap): don't require a mutable reference.
(WebCore::CloneSerializer::dumpImageBitmap): add.
(WebCore::CloneSerializer::dumpIfTerminal): check for ImageBitmap.
(WebCore::CloneDeserializer::deserialize): thread through ImageBitmaps.
(WebCore::CloneDeserializer::CloneDeserializer): thread through ImageBitmaps.
(WebCore::CloneDeserializer::readImageBitmap): add.
(WebCore::CloneDeserializer::readTerminal): check for ImageBitmap.
(WebCore::SerializedScriptValue::SerializedScriptValue): thread through ImageBitmaps.
(WebCore::SerializedScriptValue::create): thread through ImageBitmaps.
(WebCore::containsDuplicates): add.
(WebCore::SerializedScriptValue::deserialize): handle ImageBitmap arguments.
* bindings/js/SerializedScriptValue.h: update signatures, add member.
* html/ImageBitmap.cpp:
(WebCore::ImageBitmap::create): add.
(WebCore::ImageBitmap::detachBitmaps): add.
* html/ImageBitmap.h: add signatures.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsimportedw3cChangeLog">trunk/LayoutTests/imported/w3c/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorebindingsjsSerializedScriptValuecpp">trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsjsSerializedScriptValueh">trunk/Source/WebCore/bindings/js/SerializedScriptValue.h</a></li>
<li><a href="#trunkSourceWebCorehtmlImageBitmapcpp">trunk/Source/WebCore/html/ImageBitmap.cpp</a></li>
<li><a href="#trunkSourceWebCorehtmlImageBitmaph">trunk/Source/WebCore/html/ImageBitmap.h</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsimportedw3cwebplatformtests2dcontextimagebitmapcreateImageBitmaptransferexpectedtxt">trunk/LayoutTests/imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-transfer-expected.txt</a></li>
<li><a href="#trunkLayoutTestsimportedw3cwebplatformtests2dcontextimagebitmapcreateImageBitmaptransferhtml">trunk/LayoutTests/imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-transfer.html</a></li>
<li><a href="#trunkLayoutTestsimportedw3cwebplatformtests2dcontextimagebitmaptransferworkerjs">trunk/LayoutTests/imported/w3c/web-platform-tests/2dcontext/imagebitmap/transfer-worker.js</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsimportedw3cChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/imported/w3c/ChangeLog (230347 => 230348)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/ChangeLog 2018-04-06 19:19:41 UTC (rev 230347)
+++ trunk/LayoutTests/imported/w3c/ChangeLog    2018-04-06 19:20:35 UTC (rev 230348)
</span><span class="lines">@@ -1,3 +1,14 @@
</span><ins>+2018-04-06  Ms2ger  <Ms2ger@igalia.com>
+
+        Support transferring ImageBitmap objects
+        https://bugs.webkit.org/show_bug.cgi?id=183131
+
+        Reviewed by Dean Jackson.
+
+        * web-platform-tests/2dcontext/imagebitmap/createImageBitmap-transfer-expected.txt: Added.
+        * web-platform-tests/2dcontext/imagebitmap/createImageBitmap-transfer.html: Added.
+        * web-platform-tests/2dcontext/imagebitmap/transfer-worker.js: Added.
+
</ins><span class="cx"> 2018-04-06  Brendan McLoughlin  <brendan@bocoup.com>
</span><span class="cx"> 
</span><span class="cx">         Sync 2dcontext, FileAPI, IndexedDB, background-fetch, credential-management, custom-elements, dom, encoding, and fetch web-platform-tests to 94b33b573a069ae5170104ca581a354a35762536
</span></span></pre></div>
<a id="trunkLayoutTestsimportedw3cwebplatformtests2dcontextimagebitmapcreateImageBitmaptransferexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-transfer-expected.txt (0 => 230348)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-transfer-expected.txt                          (rev 0)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-transfer-expected.txt     2018-04-06 19:20:35 UTC (rev 230348)
</span><span class="lines">@@ -0,0 +1,13 @@
</span><ins>+
+PASS Transfer ImageBitmap created from an HTMLCanvasElement 
+PASS Transfer ImageBitmap created from an HTMLVideoElement 
+PASS Transfer ImageBitmap created from an HTMLVideoElement from a data URL 
+PASS Transfer ImageBitmap created from a bitmap HTMLImageElement 
+PASS Transfer ImageBitmap created from a vector HTMLImageElement 
+FAIL Transfer ImageBitmap created from a bitmap SVGImageElement promise_test: Unhandled rejection with value: object "TypeError: Type error"
+FAIL Transfer ImageBitmap created from a vector SVGImageElement promise_test: Unhandled rejection with value: object "TypeError: Type error"
+FAIL Transfer ImageBitmap created from an OffscreenCanvas promise_test: Unhandled rejection with value: object "TypeError: null is not an object (evaluating 'testCtx.fillStyle = "rgb(255, 0, 0)"')"
+FAIL Transfer ImageBitmap created from an ImageData promise_test: Unhandled rejection with value: object "TypeError: createImageBitmap with ImageData is not implemented"
+PASS Transfer ImageBitmap created from an ImageBitmap 
+FAIL Transfer ImageBitmap created from a Blob promise_test: Unhandled rejection with value: object "TypeError: createImageBitmap with ArrayBuffer or Blob is not implemented"
+
</ins></span></pre></div>
<a id="trunkLayoutTestsimportedw3cwebplatformtests2dcontextimagebitmapcreateImageBitmaptransferhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-transfer.html (0 => 230348)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-transfer.html                          (rev 0)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-transfer.html     2018-04-06 19:20:35 UTC (rev 230348)
</span><span class="lines">@@ -0,0 +1,42 @@
</span><ins>+<!DOCTYPE html>
+<meta charset=utf-8>
+<title>createImageBitmap transferring test</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/media.js"></script>
+<script src="/common/namespaces.js"></script>
+<script src="common.sub.js"></script>
+<div id=log></div>
+<script>
+let worker, tests = {};
+setup(function() {
+    worker = new Worker("transfer-worker.js");
+    worker.addEventListener("message", function(event) {
+        let { name, bitmap } = event.data;
+        tests[name](bitmap);
+    });
+});
+
+for (let { name, factory } of imageSourceTypes) {
+    promise_test(function(t) {
+        let message_handler = new Promise(function(resolve) {
+            tests[t.name] = resolve;
+        });
+        return factory().then(createImageBitmap).then(function(bitmap) {
+            assert_equals(bitmap.width, 20);
+            assert_equals(bitmap.height, 20);
+
+            worker.postMessage({ name: t.name, bitmap: bitmap }, [bitmap]);
+
+            assert_equals(bitmap.width, 0);
+            assert_equals(bitmap.height, 0);
+
+            return message_handler;
+        }).then(function(bitmap) {
+            assert_class_string(bitmap, "ImageBitmap");
+            assert_equals(bitmap.width, 20);
+            assert_equals(bitmap.height, 20);
+        });
+    }, `Transfer ImageBitmap created from ${name}`);
+}
+</script>
</ins></span></pre></div>
<a id="trunkLayoutTestsimportedw3cwebplatformtests2dcontextimagebitmaptransferworkerjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/imported/w3c/web-platform-tests/2dcontext/imagebitmap/transfer-worker.js (0 => 230348)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/web-platform-tests/2dcontext/imagebitmap/transfer-worker.js                               (rev 0)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/2dcontext/imagebitmap/transfer-worker.js  2018-04-06 19:20:35 UTC (rev 230348)
</span><span class="lines">@@ -0,0 +1,3 @@
</span><ins>+addEventListener('message', evt => {
+    postMessage(evt.data, [evt.data.bitmap]);
+});
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (230347 => 230348)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog   2018-04-06 19:19:41 UTC (rev 230347)
+++ trunk/Source/WebCore/ChangeLog      2018-04-06 19:20:35 UTC (rev 230348)
</span><span class="lines">@@ -1,3 +1,32 @@
</span><ins>+2018-04-06  Ms2ger  <Ms2ger@igalia.com>
+
+        Support transferring ImageBitmap objects
+        https://bugs.webkit.org/show_bug.cgi?id=183131
+
+        Reviewed by Dean Jackson.
+
+        Test: imported/w3c/web-platform-tests/2dcontext/imagebitmap/createImageBitmap-transfer.html
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneSerializer::serialize): thread through ImageBitmaps.
+        (WebCore::CloneSerializer::CloneSerializer): thread through ImageBitmaps.
+        (WebCore::CloneSerializer::fillTransferMap): don't require a mutable reference.
+        (WebCore::CloneSerializer::dumpImageBitmap): add.
+        (WebCore::CloneSerializer::dumpIfTerminal): check for ImageBitmap.
+        (WebCore::CloneDeserializer::deserialize): thread through ImageBitmaps.
+        (WebCore::CloneDeserializer::CloneDeserializer): thread through ImageBitmaps.
+        (WebCore::CloneDeserializer::readImageBitmap): add.
+        (WebCore::CloneDeserializer::readTerminal): check for ImageBitmap.
+        (WebCore::SerializedScriptValue::SerializedScriptValue): thread through ImageBitmaps.
+        (WebCore::SerializedScriptValue::create): thread through ImageBitmaps.
+        (WebCore::containsDuplicates): add.
+        (WebCore::SerializedScriptValue::deserialize): handle ImageBitmap arguments.
+        * bindings/js/SerializedScriptValue.h: update signatures, add member.
+        * html/ImageBitmap.cpp:
+        (WebCore::ImageBitmap::create): add.
+        (WebCore::ImageBitmap::detachBitmaps): add.
+        * html/ImageBitmap.h: add signatures.
+
</ins><span class="cx"> 2018-04-06  Said Abou-Hallawa  <sabouhallawa@apple.com>
</span><span class="cx"> 
</span><span class="cx">         When recording the drawing, the DisplayList should be initialized with the GraphicsContextState of the underlying GraphicsContext
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsSerializedScriptValuecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp (230347 => 230348)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp       2018-04-06 19:19:41 UTC (rev 230347)
+++ trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp  2018-04-06 19:20:35 UTC (rev 230348)
</span><span class="lines">@@ -46,6 +46,7 @@
</span><span class="cx"> #include "JSDOMRect.h"
</span><span class="cx"> #include "JSFile.h"
</span><span class="cx"> #include "JSFileList.h"
</span><ins>+#include "JSImageBitmap.h"
</ins><span class="cx"> #include "JSImageData.h"
</span><span class="cx"> #include "JSMessagePort.h"
</span><span class="cx"> #include "JSNavigator.h"
</span><span class="lines">@@ -160,6 +161,7 @@
</span><span class="cx">     DOMMatrixReadOnlyTag = 40,
</span><span class="cx">     DOMMatrixTag = 41,
</span><span class="cx">     DOMQuadTag = 42,
</span><ins>+    ImageBitmapTransferTag = 43,
</ins><span class="cx">     ErrorTag = 255
</span><span class="cx"> };
</span><span class="cx"> 
</span><span class="lines">@@ -339,6 +341,7 @@
</span><span class="cx">  *    | DOMRect
</span><span class="cx">  *    | DOMMatrix
</span><span class="cx">  *    | DOMQuad
</span><ins>+ *    | ImageBitmapTransferTag <value:uint32_t>
</ins><span class="cx">  *
</span><span class="cx">  * Inside wrapped crypto key, data is serialized in this format:
</span><span class="cx">  *
</span><span class="lines">@@ -530,13 +533,13 @@
</span><span class="cx"> 
</span><span class="cx"> class CloneSerializer : CloneBase {
</span><span class="cx"> public:
</span><del>-    static SerializationReturnCode serialize(ExecState* exec, JSValue value, Vector<RefPtr<MessagePort>>& messagePorts, Vector<RefPtr<JSC::ArrayBuffer>>& arrayBuffers,
</del><ins>+    static SerializationReturnCode serialize(ExecState* exec, JSValue value, Vector<RefPtr<MessagePort>>& messagePorts, Vector<RefPtr<JSC::ArrayBuffer>>& arrayBuffers, const Vector<RefPtr<ImageBitmap>>& imageBitmaps,
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">             WasmModuleArray& wasmModules,
</span><span class="cx"> #endif
</span><span class="cx">             Vector<String>& blobURLs, Vector<uint8_t>& out, SerializationContext context, ArrayBufferContentsArray& sharedBuffers)
</span><span class="cx">     {
</span><del>-        CloneSerializer serializer(exec, messagePorts, arrayBuffers,
</del><ins>+        CloneSerializer serializer(exec, messagePorts, arrayBuffers, imageBitmaps,
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">             wasmModules,
</span><span class="cx"> #endif
</span><span class="lines">@@ -563,7 +566,7 @@
</span><span class="cx"> private:
</span><span class="cx">     typedef HashMap<JSObject*, uint32_t> ObjectPool;
</span><span class="cx"> 
</span><del>-    CloneSerializer(ExecState* exec, Vector<RefPtr<MessagePort>>& messagePorts, Vector<RefPtr<JSC::ArrayBuffer>>& arrayBuffers,
</del><ins>+    CloneSerializer(ExecState* exec, Vector<RefPtr<MessagePort>>& messagePorts, Vector<RefPtr<JSC::ArrayBuffer>>& arrayBuffers, const Vector<RefPtr<ImageBitmap>>& imageBitmaps,
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">             WasmModuleArray& wasmModules,
</span><span class="cx"> #endif
</span><span class="lines">@@ -581,10 +584,11 @@
</span><span class="cx">         write(CurrentVersion);
</span><span class="cx">         fillTransferMap(messagePorts, m_transferredMessagePorts);
</span><span class="cx">         fillTransferMap(arrayBuffers, m_transferredArrayBuffers);
</span><ins>+        fillTransferMap(imageBitmaps, m_transferredImageBitmaps);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     template <class T>
</span><del>-    void fillTransferMap(Vector<RefPtr<T>>& input, ObjectPool& result)
</del><ins>+    void fillTransferMap(const Vector<RefPtr<T>>& input, ObjectPool& result)
</ins><span class="cx">     {
</span><span class="cx">         if (input.isEmpty())
</span><span class="cx">             return;
</span><span class="lines">@@ -872,6 +876,19 @@
</span><span class="cx">         dumpDOMPoint(quad.p4());
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    void dumpImageBitmap(JSObject* obj, SerializationReturnCode& code)
+    {
+        auto index = m_transferredImageBitmaps.find(obj);
+        if (index != m_transferredImageBitmaps.end()) {
+            write(ImageBitmapTransferTag);
+            write(index->value);
+            return;
+        }
+
+        // Copying ImageBitmaps is not yet supported.
+        code = SerializationReturnCode::ValidationError;
+    }
+
</ins><span class="cx">     bool dumpIfTerminal(JSValue value, SerializationReturnCode& code)
</span><span class="cx">     {
</span><span class="cx">         if (!value.isCell()) {
</span><span class="lines">@@ -1022,7 +1039,7 @@
</span><span class="cx">                 WasmModuleArray dummyModules;
</span><span class="cx"> #endif
</span><span class="cx">                 ArrayBufferContentsArray dummySharedBuffers;
</span><del>-                CloneSerializer rawKeySerializer(m_exec, dummyMessagePorts, dummyArrayBuffers,
</del><ins>+                CloneSerializer rawKeySerializer(m_exec, dummyMessagePorts, dummyArrayBuffers, { },
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">                     dummyModules,
</span><span class="cx"> #endif
</span><span class="lines">@@ -1064,6 +1081,10 @@
</span><span class="cx">                 dumpDOMQuad(obj);
</span><span class="cx">                 return true;
</span><span class="cx">             }
</span><ins>+            if (obj->inherits(vm, JSImageBitmap::info())) {
+                dumpImageBitmap(obj, code);
+                return true;
+            }
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">         // Any other types are expected to serialize as null.
</span><span class="lines">@@ -1409,6 +1430,7 @@
</span><span class="cx">     ObjectPool m_objectPool;
</span><span class="cx">     ObjectPool m_transferredMessagePorts;
</span><span class="cx">     ObjectPool m_transferredArrayBuffers;
</span><ins>+    ObjectPool m_transferredImageBitmaps;
</ins><span class="cx">     typedef HashMap<RefPtr<UniquedStringImpl>, uint32_t, IdentifierRepHash> StringConstantPool;
</span><span class="cx">     StringConstantPool m_constantPool;
</span><span class="cx">     Identifier m_emptyIdentifier;
</span><span class="lines">@@ -1688,7 +1710,7 @@
</span><span class="cx">         return str;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    static DeserializationResult deserialize(ExecState* exec, JSGlobalObject* globalObject, const Vector<RefPtr<MessagePort>>& messagePorts, ArrayBufferContentsArray* arrayBufferContentsArray, const Vector<uint8_t>& buffer, const Vector<String>& blobURLs, const Vector<String> blobFilePaths, ArrayBufferContentsArray* sharedBuffers
</del><ins>+    static DeserializationResult deserialize(ExecState* exec, JSGlobalObject* globalObject, const Vector<RefPtr<MessagePort>>& messagePorts, Vector<std::pair<std::unique_ptr<ImageBuffer>, bool>>&& imageBuffers, ArrayBufferContentsArray* arrayBufferContentsArray, const Vector<uint8_t>& buffer, const Vector<String>& blobURLs, const Vector<String> blobFilePaths, ArrayBufferContentsArray* sharedBuffers
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">         , WasmModuleArray* wasmModules
</span><span class="cx"> #endif
</span><span class="lines">@@ -1696,7 +1718,7 @@
</span><span class="cx">     {
</span><span class="cx">         if (!buffer.size())
</span><span class="cx">             return std::make_pair(jsNull(), SerializationReturnCode::UnspecifiedError);
</span><del>-        CloneDeserializer deserializer(exec, globalObject, messagePorts, arrayBufferContentsArray, buffer, blobURLs, blobFilePaths, sharedBuffers
</del><ins>+        CloneDeserializer deserializer(exec, globalObject, messagePorts, arrayBufferContentsArray, buffer, blobURLs, blobFilePaths, sharedBuffers, WTFMove(imageBuffers)
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">             , wasmModules
</span><span class="cx"> #endif
</span><span class="lines">@@ -1745,7 +1767,7 @@
</span><span class="cx">         size_t m_index;
</span><span class="cx">     };
</span><span class="cx"> 
</span><del>-    CloneDeserializer(ExecState* exec, JSGlobalObject* globalObject, const Vector<RefPtr<MessagePort>>& messagePorts, ArrayBufferContentsArray* arrayBufferContents,
</del><ins>+    CloneDeserializer(ExecState* exec, JSGlobalObject* globalObject, const Vector<RefPtr<MessagePort>>& messagePorts, ArrayBufferContentsArray* arrayBufferContents, Vector<std::pair<std::unique_ptr<ImageBuffer>, bool>>&& imageBuffers,
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">         WasmModuleArray* wasmModules,
</span><span class="cx"> #endif
</span><span class="lines">@@ -1759,6 +1781,8 @@
</span><span class="cx">         , m_messagePorts(messagePorts)
</span><span class="cx">         , m_arrayBufferContents(arrayBufferContents)
</span><span class="cx">         , m_arrayBuffers(arrayBufferContents ? arrayBufferContents->size() : 0)
</span><ins>+        , m_imageBuffers(WTFMove(imageBuffers))
+        , m_imageBitmaps(m_imageBuffers.size())
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">         , m_wasmModules(wasmModules)
</span><span class="cx"> #endif
</span><span class="lines">@@ -1767,7 +1791,7 @@
</span><span class="cx">             m_version = 0xFFFFFFFF;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    CloneDeserializer(ExecState* exec, JSGlobalObject* globalObject, const Vector<RefPtr<MessagePort>>& messagePorts, ArrayBufferContentsArray* arrayBufferContents, const Vector<uint8_t>& buffer, const Vector<String>& blobURLs, const Vector<String> blobFilePaths, ArrayBufferContentsArray* sharedBuffers
</del><ins>+    CloneDeserializer(ExecState* exec, JSGlobalObject* globalObject, const Vector<RefPtr<MessagePort>>& messagePorts, ArrayBufferContentsArray* arrayBufferContents, const Vector<uint8_t>& buffer, const Vector<String>& blobURLs, const Vector<String> blobFilePaths, ArrayBufferContentsArray* sharedBuffers, Vector<std::pair<std::unique_ptr<ImageBuffer>, bool>>&& imageBuffers
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">         , WasmModuleArray* wasmModules
</span><span class="cx"> #endif
</span><span class="lines">@@ -1784,6 +1808,8 @@
</span><span class="cx">         , m_blobURLs(blobURLs)
</span><span class="cx">         , m_blobFilePaths(blobFilePaths)
</span><span class="cx">         , m_sharedBuffers(sharedBuffers)
</span><ins>+        , m_imageBuffers(WTFMove(imageBuffers))
+        , m_imageBitmaps(m_imageBuffers.size())
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">         , m_wasmModules(wasmModules)
</span><span class="cx"> #endif
</span><span class="lines">@@ -2598,6 +2624,22 @@
</span><span class="cx">         return toJSNewlyCreated(m_exec, jsCast<JSDOMGlobalObject*>(m_globalObject), DOMQuad::create(p1.value(), p2.value(), p3.value(), p4.value()));
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    JSValue readImageBitmap()
+    {
+        uint32_t index;
+        bool indexSuccessfullyRead = read(index);
+        if (!indexSuccessfullyRead || index >= m_imageBuffers.size()) {
+            fail();
+            return JSValue();
+        }
+
+        if (!m_imageBitmaps[index])
+            m_imageBitmaps[index] = ImageBitmap::create(WTFMove(m_imageBuffers.at(index)));
+
+        auto bitmap = m_imageBitmaps[index].get();
+        return getJSValue(bitmap);
+    }
+
</ins><span class="cx">     JSValue readTerminal()
</span><span class="cx">     {
</span><span class="cx">         SerializationTag tag = readTag();
</span><span class="lines">@@ -2859,7 +2901,7 @@
</span><span class="cx">             }
</span><span class="cx">             JSValue cryptoKey;
</span><span class="cx">             Vector<RefPtr<MessagePort>> dummyMessagePorts;
</span><del>-            CloneDeserializer rawKeyDeserializer(m_exec, m_globalObject, dummyMessagePorts, nullptr,
</del><ins>+            CloneDeserializer rawKeyDeserializer(m_exec, m_globalObject, dummyMessagePorts, nullptr, { },
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">                 nullptr,
</span><span class="cx"> #endif
</span><span class="lines">@@ -2886,6 +2928,8 @@
</span><span class="cx">             return readDOMMatrix<DOMMatrix>();
</span><span class="cx">         case DOMQuadTag:
</span><span class="cx">             return readDOMQuad();
</span><ins>+        case ImageBitmapTransferTag:
+            return readImageBitmap();
</ins><span class="cx">         default:
</span><span class="cx">             m_ptr--; // Push the tag back
</span><span class="cx">             return JSValue();
</span><span class="lines">@@ -2913,6 +2957,8 @@
</span><span class="cx">     Vector<String> m_blobURLs;
</span><span class="cx">     Vector<String> m_blobFilePaths;
</span><span class="cx">     ArrayBufferContentsArray* m_sharedBuffers;
</span><ins>+    Vector<std::pair<std::unique_ptr<ImageBuffer>, bool>> m_imageBuffers;
+    Vector<RefPtr<ImageBitmap>> m_imageBitmaps;
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">     WasmModuleArray* m_wasmModules;
</span><span class="cx"> #endif
</span><span class="lines">@@ -3123,7 +3169,7 @@
</span><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-SerializedScriptValue::SerializedScriptValue(Vector<uint8_t>&& buffer, const Vector<String>& blobURLs, std::unique_ptr<ArrayBufferContentsArray> arrayBufferContentsArray, std::unique_ptr<ArrayBufferContentsArray> sharedBufferContentsArray
</del><ins>+SerializedScriptValue::SerializedScriptValue(Vector<uint8_t>&& buffer, const Vector<String>& blobURLs, std::unique_ptr<ArrayBufferContentsArray> arrayBufferContentsArray, std::unique_ptr<ArrayBufferContentsArray> sharedBufferContentsArray, Vector<std::pair<std::unique_ptr<ImageBuffer>, bool>>&& imageBuffers
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">         , std::unique_ptr<WasmModuleArray> wasmModulesArray
</span><span class="cx"> #endif
</span><span class="lines">@@ -3131,6 +3177,7 @@
</span><span class="cx">     : m_data(WTFMove(buffer))
</span><span class="cx">     , m_arrayBufferContentsArray(WTFMove(arrayBufferContentsArray))
</span><span class="cx">     , m_sharedBufferContentsArray(WTFMove(sharedBufferContentsArray))
</span><ins>+    , m_imageBuffers(WTFMove(imageBuffers))
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">     , m_wasmModulesArray(WTFMove(wasmModulesArray))
</span><span class="cx"> #endif
</span><span class="lines">@@ -3217,12 +3264,13 @@
</span><span class="cx">     Vector<uint8_t> buffer;
</span><span class="cx">     Vector<String> blobURLs;
</span><span class="cx">     Vector<RefPtr<MessagePort>> dummyMessagePorts;
</span><ins>+    Vector<RefPtr<ImageBitmap>> dummyImageBitmaps;
</ins><span class="cx">     Vector<RefPtr<JSC::ArrayBuffer>> dummyArrayBuffers;
</span><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">     WasmModuleArray dummyModules;
</span><span class="cx"> #endif
</span><span class="cx">     ArrayBufferContentsArray dummySharedBuffers;
</span><del>-    auto code = CloneSerializer::serialize(&exec, value, dummyMessagePorts, dummyArrayBuffers,
</del><ins>+    auto code = CloneSerializer::serialize(&exec, value, dummyMessagePorts, dummyArrayBuffers, dummyImageBitmaps,
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">         dummyModules,
</span><span class="cx"> #endif
</span><span class="lines">@@ -3238,7 +3286,7 @@
</span><span class="cx">     if (code != SerializationReturnCode::SuccessfullyCompleted)
</span><span class="cx">         return nullptr;
</span><span class="cx"> 
</span><del>-    return adoptRef(*new SerializedScriptValue(WTFMove(buffer), blobURLs, nullptr, nullptr
</del><ins>+    return adoptRef(*new SerializedScriptValue(WTFMove(buffer), blobURLs, nullptr, nullptr, { }
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">         , nullptr
</span><span class="cx"> #endif
</span><span class="lines">@@ -3245,10 +3293,21 @@
</span><span class="cx">             ));
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+static bool containsDuplicates(const Vector<RefPtr<ImageBitmap>>& imageBitmaps)
+{
+    HashSet<ImageBitmap*> visited;
+    for (auto& imageBitmap : imageBitmaps) {
+        if (!visited.add(imageBitmap.get()))
+            return true;
+    }
+    return false;
+}
+
</ins><span class="cx"> ExceptionOr<Ref<SerializedScriptValue>> SerializedScriptValue::create(ExecState& state, JSValue value, Vector<JSC::Strong<JSC::JSObject>>&& transferList, Vector<RefPtr<MessagePort>>& messagePorts, SerializationContext context)
</span><span class="cx"> {
</span><span class="cx">     VM& vm = state.vm();
</span><span class="cx">     Vector<RefPtr<JSC::ArrayBuffer>> arrayBuffers;
</span><ins>+    Vector<RefPtr<ImageBitmap>> imageBitmaps;
</ins><span class="cx">     for (auto& transferable : transferList) {
</span><span class="cx">         if (auto arrayBuffer = toPossiblySharedArrayBuffer(vm, transferable.get())) {
</span><span class="cx">             if (arrayBuffer->isNeutered())
</span><span class="lines">@@ -3267,9 +3326,20 @@
</span><span class="cx">             continue;
</span><span class="cx">         }
</span><span class="cx"> 
</span><ins>+        if (auto imageBitmap = JSImageBitmap::toWrapped(vm, transferable.get())) {
+            if (imageBitmap->isDetached())
+                return Exception { DataCloneError };
+
+            imageBitmaps.append(WTFMove(imageBitmap));
+            continue;
+        }
+
</ins><span class="cx">         return Exception { DataCloneError };
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    if (containsDuplicates(imageBitmaps))
+        return Exception { DataCloneError };
+
</ins><span class="cx">     Vector<uint8_t> buffer;
</span><span class="cx">     Vector<String> blobURLs;
</span><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="lines">@@ -3276,7 +3346,7 @@
</span><span class="cx">     WasmModuleArray wasmModules;
</span><span class="cx"> #endif
</span><span class="cx">     std::unique_ptr<ArrayBufferContentsArray> sharedBuffers = std::make_unique<ArrayBufferContentsArray>();
</span><del>-    auto code = CloneSerializer::serialize(&state, value, messagePorts, arrayBuffers, 
</del><ins>+    auto code = CloneSerializer::serialize(&state, value, messagePorts, arrayBuffers, imageBitmaps,
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">         wasmModules, 
</span><span class="cx"> #endif
</span><span class="lines">@@ -3289,7 +3359,9 @@
</span><span class="cx">     if (arrayBufferContentsArray.hasException())
</span><span class="cx">         return arrayBufferContentsArray.releaseException();
</span><span class="cx"> 
</span><del>-    return adoptRef(*new SerializedScriptValue(WTFMove(buffer), blobURLs, arrayBufferContentsArray.releaseReturnValue(), context == SerializationContext::WorkerPostMessage ? WTFMove(sharedBuffers) : nullptr
</del><ins>+    auto imageBuffers = ImageBitmap::detachBitmaps(WTFMove(imageBitmaps));
+
+    return adoptRef(*new SerializedScriptValue(WTFMove(buffer), blobURLs, arrayBufferContentsArray.releaseReturnValue(), context == SerializationContext::WorkerPostMessage ? WTFMove(sharedBuffers) : nullptr, WTFMove(imageBuffers)
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">                 , std::make_unique<WasmModuleArray>(wasmModules)
</span><span class="cx"> #endif
</span><span class="lines">@@ -3342,7 +3414,7 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue SerializedScriptValue::deserialize(ExecState& exec, JSGlobalObject* globalObject, const Vector<RefPtr<MessagePort>>& messagePorts, const Vector<String>& blobURLs, const Vector<String>& blobFilePaths, SerializationErrorMode throwExceptions)
</span><span class="cx"> {
</span><del>-    DeserializationResult result = CloneDeserializer::deserialize(&exec, globalObject, messagePorts, m_arrayBufferContentsArray.get(), m_data, blobURLs, blobFilePaths, m_sharedBufferContentsArray.get()
</del><ins>+    DeserializationResult result = CloneDeserializer::deserialize(&exec, globalObject, messagePorts, WTFMove(m_imageBuffers), m_arrayBufferContentsArray.get(), m_data, blobURLs, blobFilePaths, m_sharedBufferContentsArray.get()
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">         , m_wasmModulesArray.get()
</span><span class="cx"> #endif
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsSerializedScriptValueh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/SerializedScriptValue.h (230347 => 230348)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/SerializedScriptValue.h 2018-04-06 19:19:41 UTC (rev 230347)
+++ trunk/Source/WebCore/bindings/js/SerializedScriptValue.h    2018-04-06 19:20:35 UTC (rev 230348)
</span><span class="lines">@@ -27,6 +27,7 @@
</span><span class="cx"> #pragma once
</span><span class="cx"> 
</span><span class="cx"> #include "ExceptionOr.h"
</span><ins>+#include "ImageBuffer.h"
</ins><span class="cx"> #include <JavaScriptCore/ArrayBuffer.h>
</span><span class="cx"> #include <JavaScriptCore/JSCJSValue.h>
</span><span class="cx"> #include <JavaScriptCore/Strong.h>
</span><span class="lines">@@ -46,6 +47,7 @@
</span><span class="cx"> namespace WebCore {
</span><span class="cx"> 
</span><span class="cx"> class IDBValue;
</span><ins>+class ImageBitmap;
</ins><span class="cx"> class MessagePort;
</span><span class="cx"> class SharedBuffer;
</span><span class="cx"> enum class SerializationReturnCode;
</span><span class="lines">@@ -103,7 +105,7 @@
</span><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     WEBCORE_EXPORT SerializedScriptValue(Vector<unsigned char>&&);
</span><del>-    SerializedScriptValue(Vector<unsigned char>&&, const Vector<String>& blobURLs, std::unique_ptr<ArrayBufferContentsArray>, std::unique_ptr<ArrayBufferContentsArray> sharedBuffers
</del><ins>+    SerializedScriptValue(Vector<unsigned char>&&, const Vector<String>& blobURLs, std::unique_ptr<ArrayBufferContentsArray>, std::unique_ptr<ArrayBufferContentsArray> sharedBuffers, Vector<std::pair<std::unique_ptr<ImageBuffer>, bool>>&& imageBuffers
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">         , std::unique_ptr<WasmModuleArray>
</span><span class="cx"> #endif
</span><span class="lines">@@ -112,6 +114,7 @@
</span><span class="cx">     Vector<unsigned char> m_data;
</span><span class="cx">     std::unique_ptr<ArrayBufferContentsArray> m_arrayBufferContentsArray;
</span><span class="cx">     std::unique_ptr<ArrayBufferContentsArray> m_sharedBufferContentsArray;
</span><ins>+    Vector<std::pair<std::unique_ptr<ImageBuffer>, bool>> m_imageBuffers;
</ins><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">     std::unique_ptr<WasmModuleArray> m_wasmModulesArray;
</span><span class="cx"> #endif
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlImageBitmapcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/ImageBitmap.cpp (230347 => 230348)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/ImageBitmap.cpp        2018-04-06 19:19:41 UTC (rev 230347)
+++ trunk/Source/WebCore/html/ImageBitmap.cpp   2018-04-06 19:20:35 UTC (rev 230348)
</span><span class="lines">@@ -59,6 +59,13 @@
</span><span class="cx">     return create(ImageBuffer::create(FloatSize(size.width(), size.height()), bufferRenderingMode));
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+Ref<ImageBitmap> ImageBitmap::create(std::pair<std::unique_ptr<ImageBuffer>, bool>&& buffer)
+{
+    auto imageBitmap = create(WTFMove(buffer.first));
+    imageBitmap->m_originClean = buffer.second;
+    return imageBitmap;
+}
+
</ins><span class="cx"> Ref<ImageBitmap> ImageBitmap::create(std::unique_ptr<ImageBuffer>&& buffer)
</span><span class="cx"> {
</span><span class="cx">     return adoptRef(*new ImageBitmap(WTFMove(buffer)));
</span><span class="lines">@@ -73,6 +80,15 @@
</span><span class="cx">     );
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+Vector<std::pair<std::unique_ptr<ImageBuffer>, bool>> ImageBitmap::detachBitmaps(Vector<RefPtr<ImageBitmap>>&& bitmaps)
+{
+    Vector<std::pair<std::unique_ptr<ImageBuffer>, bool>> buffers;
+    for (auto& bitmap : bitmaps)
+        buffers.append(std::make_pair(bitmap->transferOwnershipAndClose(), bitmap->originClean()));
+    return buffers;
+}
+
+
</ins><span class="cx"> void ImageBitmap::createPromise(ScriptExecutionContext& scriptExecutionContext, ImageBitmap::Source&& source, ImageBitmapOptions&& options, int sx, int sy, int sw, int sh, ImageBitmap::Promise&& promise)
</span><span class="cx"> {
</span><span class="cx">     // 1. If either the sw or sh arguments are specified but zero, return a promise
</span></span></pre></div>
<a id="trunkSourceWebCorehtmlImageBitmaph"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/html/ImageBitmap.h (230347 => 230348)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/html/ImageBitmap.h  2018-04-06 19:19:41 UTC (rev 230347)
+++ trunk/Source/WebCore/html/ImageBitmap.h     2018-04-06 19:20:35 UTC (rev 230348)
</span><span class="lines">@@ -64,6 +64,7 @@
</span><span class="cx">     static void createPromise(ScriptExecutionContext&, Source&&, ImageBitmapOptions&&, int sx, int sy, int sw, int sh, Promise&&);
</span><span class="cx"> 
</span><span class="cx">     static Ref<ImageBitmap> create(IntSize);
</span><ins>+    static Ref<ImageBitmap> create(std::pair<std::unique_ptr<ImageBuffer>, bool>&&);
</ins><span class="cx"> 
</span><span class="cx">     ~ImageBitmap();
</span><span class="cx"> 
</span><span class="lines">@@ -79,6 +80,8 @@
</span><span class="cx"> 
</span><span class="cx">     std::unique_ptr<ImageBuffer> transferOwnershipAndClose();
</span><span class="cx"> 
</span><ins>+    static Vector<std::pair<std::unique_ptr<ImageBuffer>, bool>> detachBitmaps(Vector<RefPtr<ImageBitmap>>&&);
+
</ins><span class="cx"> private:
</span><span class="cx">     friend class PendingImageBitmap;
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>