<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[281402] branches/safari-611.3.10.0-branch</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/281402">281402</a></dd>
<dt>Author</dt> <dd>kocsen_chung@apple.com</dd>
<dt>Date</dt> <dd>2021-08-22 10:08:45 -0700 (Sun, 22 Aug 2021)</dd>
</dl>

<h3>Log Message</h3>
<pre>Revert to original content from 611.3.10.0.1</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#branchessafari6113100branchJSTestsChangeLog">branches/safari-611.3.10.0-branch/JSTests/ChangeLog</a></li>
<li><a href="#branchessafari6113100branchSourceJavaScriptCoreChangeLog">branches/safari-611.3.10.0-branch/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#branchessafari6113100branchSourceJavaScriptCoreConfigurationsVersionxcconfig">branches/safari-611.3.10.0-branch/Source/JavaScriptCore/Configurations/Version.xcconfig</a></li>
<li><a href="#branchessafari6113100branchSourceJavaScriptCoreassemblerAssemblerBufferh">branches/safari-611.3.10.0-branch/Source/JavaScriptCore/assembler/AssemblerBuffer.h</a></li>
<li><a href="#branchessafari6113100branchSourceJavaScriptCoreassemblerLinkBuffercpp">branches/safari-611.3.10.0-branch/Source/JavaScriptCore/assembler/LinkBuffer.cpp</a></li>
<li><a href="#branchessafari6113100branchSourceJavaScriptCoreb3B3Validatecpp">branches/safari-611.3.10.0-branch/Source/JavaScriptCore/b3/B3Validate.cpp</a></li>
<li><a href="#branchessafari6113100branchSourceJavaScriptCoredfgDFGByteCodeParsercpp">branches/safari-611.3.10.0-branch/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp</a></li>
<li><a href="#branchessafari6113100branchSourceJavaScriptCorewasmWasmAirIRGeneratorcpp">branches/safari-611.3.10.0-branch/Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp</a></li>
<li><a href="#branchessafari6113100branchSourceJavaScriptCorewasmWasmB3IRGeneratorcpp">branches/safari-611.3.10.0-branch/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp</a></li>
<li><a href="#branchessafari6113100branchSourceJavaScriptCorewasmWasmLLIntGeneratorcpp">branches/safari-611.3.10.0-branch/Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp</a></li>
<li><a href="#branchessafari6113100branchSourceThirdPartyANGLEConfigurationsVersionxcconfig">branches/safari-611.3.10.0-branch/Source/ThirdParty/ANGLE/Configurations/Version.xcconfig</a></li>
<li><a href="#branchessafari6113100branchSourceThirdPartylibwebrtcConfigurationsVersionxcconfig">branches/safari-611.3.10.0-branch/Source/ThirdParty/libwebrtc/Configurations/Version.xcconfig</a></li>
<li><a href="#branchessafari6113100branchSourceWTFChangeLog">branches/safari-611.3.10.0-branch/Source/WTF/ChangeLog</a></li>
<li><a href="#branchessafari6113100branchSourceWTFwtfCrossThreadTaskh">branches/safari-611.3.10.0-branch/Source/WTF/wtf/CrossThreadTask.h</a></li>
<li><a href="#branchessafari6113100branchSourceWebCoreChangeLog">branches/safari-611.3.10.0-branch/Source/WebCore/ChangeLog</a></li>
<li><a href="#branchessafari6113100branchSourceWebCoreConfigurationsVersionxcconfig">branches/safari-611.3.10.0-branch/Source/WebCore/Configurations/Version.xcconfig</a></li>
<li><a href="#branchessafari6113100branchSourceWebCoreModulesindexeddbIDBRequestcpp">branches/safari-611.3.10.0-branch/Source/WebCore/Modules/indexeddb/IDBRequest.cpp</a></li>
<li><a href="#branchessafari6113100branchSourceWebCoreModuleswebaudioAudioNodecpp">branches/safari-611.3.10.0-branch/Source/WebCore/Modules/webaudio/AudioNode.cpp</a></li>
<li><a href="#branchessafari6113100branchSourceWebCorePALConfigurationsVersionxcconfig">branches/safari-611.3.10.0-branch/Source/WebCore/PAL/Configurations/Version.xcconfig</a></li>
<li><a href="#branchessafari6113100branchSourceWebCorepageEventHandlercpp">branches/safari-611.3.10.0-branch/Source/WebCore/page/EventHandler.cpp</a></li>
<li><a href="#branchessafari6113100branchSourceWebCorepagePointerCaptureControllercpp">branches/safari-611.3.10.0-branch/Source/WebCore/page/PointerCaptureController.cpp</a></li>
<li><a href="#branchessafari6113100branchSourceWebCorepagePointerCaptureControllerh">branches/safari-611.3.10.0-branch/Source/WebCore/page/PointerCaptureController.h</a></li>
<li><a href="#branchessafari6113100branchSourceWebCorereplayUserInputBridgecpp">branches/safari-611.3.10.0-branch/Source/WebCore/replay/UserInputBridge.cpp</a></li>
<li><a href="#branchessafari6113100branchSourceWebInspectorUIConfigurationsVersionxcconfig">branches/safari-611.3.10.0-branch/Source/WebInspectorUI/Configurations/Version.xcconfig</a></li>
<li><a href="#branchessafari6113100branchSourceWebKitChangeLog">branches/safari-611.3.10.0-branch/Source/WebKit/ChangeLog</a></li>
<li><a href="#branchessafari6113100branchSourceWebKitConfigurationsVersionxcconfig">branches/safari-611.3.10.0-branch/Source/WebKit/Configurations/Version.xcconfig</a></li>
<li><a href="#branchessafari6113100branchSourceWebKitNetworkProcesscocoaNetworkSessionCocoamm">branches/safari-611.3.10.0-branch/Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm</a></li>
<li><a href="#branchessafari6113100branchSourceWebKitUIProcessiosfullscreenWKFullScreenViewControllerh">branches/safari-611.3.10.0-branch/Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenViewController.h</a></li>
<li><a href="#branchessafari6113100branchSourceWebKitUIProcessiosfullscreenWKFullScreenViewControllermm">branches/safari-611.3.10.0-branch/Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenViewController.mm</a></li>
<li><a href="#branchessafari6113100branchSourceWebKitUIProcessiosfullscreenWKFullScreenWindowControllerIOSmm">branches/safari-611.3.10.0-branch/Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm</a></li>
<li><a href="#branchessafari6113100branchSourceWebKitWebProcessWebCoreSupportWebFrameLoaderClientcpp">branches/safari-611.3.10.0-branch/Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp</a></li>
<li><a href="#branchessafari6113100branchSourceWebKitWebProcessWebPageWebPagecpp">branches/safari-611.3.10.0-branch/Source/WebKit/WebProcess/WebPage/WebPage.cpp</a></li>
<li><a href="#branchessafari6113100branchSourceWebKitLegacymacConfigurationsVersionxcconfig">branches/safari-611.3.10.0-branch/Source/WebKitLegacy/mac/Configurations/Version.xcconfig</a></li>
</ul>

<h3>Removed Paths</h3>
<ul>
<li><a href="#branchessafari6113100branchJSTestsstressdfgarityfixupusescallersexitoriginjs">branches/safari-611.3.10.0-branch/JSTests/stress/dfg-arity-fixup-uses-callers-exit-origin.js</a></li>
<li><a href="#branchessafari6113100branchJSTestswasmstressosrentrywithloopargumentsjs">branches/safari-611.3.10.0-branch/JSTests/wasm/stress/osr-entry-with-loop-arguments.js</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="branchessafari6113100branchJSTestsChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/JSTests/ChangeLog (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/JSTests/ChangeLog      2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/JSTests/ChangeLog 2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -1,121 +1,3 @@
</span><del>-2021-08-10  Russell Epstein  <repstein@apple.com>
-
-        Cherry-pick r280507. rdar://problem/79730568
-
-    Improve OSR entry into Wasm loops with arguments
-    https://bugs.webkit.org/show_bug.cgi?id=228595
-    
-    Reviewed by Yusuke Suzuki.
-    
-    JSTests:
-    
-    Just a straightforward test that counts to 1M in a loop, to exercise both OSR entry and a loop with an argument at the same time.
-    100k iterations was not enough to reliably complete an OSR entry.
-    
-    * wasm/stress/osr-entry-with-loop-arguments.js: Added.
-    (async test):
-    
-    Source/JavaScriptCore:
-    
-    This patch has two parts:
-    - improve the Wasm OSR code to fully support loop arguments (just some plumbing to make sure that the right values are propagated)
-    - improve the B3 validator to fix a hole I noticed while writing the first part: we were not detecting code that introduce Upsilons in the wrong blocks.
-      Naturally, this caused hard to debug issues, as B3 has no well-defined semantics for a Phi that is reached before the corresponding Upsilon(s).
-    
-    * b3/B3Validate.cpp:
-    * wasm/WasmAirIRGenerator.cpp:
-    (JSC::Wasm::AirIRGenerator::emitLoopTierUpCheck):
-    (JSC::Wasm::AirIRGenerator::addLoop):
-    * wasm/WasmB3IRGenerator.cpp:
-    (JSC::Wasm::B3IRGenerator::emitLoopTierUpCheck):
-    (JSC::Wasm::B3IRGenerator::addLoop):
-    * wasm/WasmLLIntGenerator.cpp:
-    (JSC::Wasm::LLIntGenerator::addLoop):
-    
-    
-    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@280507 268f45cc-cd09-0410-ab3c-d52691b4dbfc
-
-    2021-07-30  Robin Morisset  <rmorisset@apple.com>
-
-            Improve OSR entry into Wasm loops with arguments
-            https://bugs.webkit.org/show_bug.cgi?id=228595
-
-            Reviewed by Yusuke Suzuki.
-
-            Just a straightforward test that counts to 1M in a loop, to exercise both OSR entry and a loop with an argument at the same time.
-            100k iterations was not enough to reliably complete an OSR entry.
-
-            * wasm/stress/osr-entry-with-loop-arguments.js: Added.
-            (async test):
-
-2021-08-10  Russell Epstein  <repstein@apple.com>
-
-        Cherry-pick r275472. rdar://problem/81710596
-
-    DFG arity fixup nodes should exit to the caller's call opcode
-    https://bugs.webkit.org/show_bug.cgi?id=223278
-    
-    Reviewed by Saam Barati.
-    
-    JSTests:
-    
-    * stress/dfg-arity-fixup-uses-callers-exit-origin.js: Added.
-    (main.v22):
-    (main.v30):
-    (main.try.v40):
-    (main.try.v47):
-    (main.try.v56):
-    (main.):
-    (main):
-    
-    Source/JavaScriptCore:
-    
-    Right now when we do arity fixup in the DFG we model it in the
-    same way that it executes, which means all the nodes are part of
-    the callee. Unfortunately, this causes PhantomInsertionPhase to
-    think those nodes could be replacing previously defined
-    VirtualRegisters as they are part of the callee's header (always
-    alive). When PhantomInsertionPhase then inserts a Phantom it will
-    put that node in the caller's frame as that's the first ExitOK
-    node. The caller however may have no knowledge of that
-    VirtualRegister though. For example:
-    
-    --> foo: loc10 is a local in foo.
-        ...
-        1: MovHint(loc10)
-        2: SetLocal(loc10)
-    <-- foo // loc10 ten is now out of scope for the InlineCallFrame of the caller.
-    ...
-    // Phantom will be inserted here refering to loc10, which doesn't make sense.
-    --> bar // loc10 is an argument to bar and needs arity fixup.
-        ... // All of these nodes are ExitInvalid
-        3: MovHint(loc10, ExitInvalid)
-        4: SetLocal(loc10, ExitInvalid)
-        ...
-    
-    * dfg/DFGByteCodeParser.cpp:
-    (JSC::DFG::ByteCodeParser::currentNodeOrigin):
-    (JSC::DFG::ByteCodeParser::inlineCall):
-    
-    
-    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@275472 268f45cc-cd09-0410-ab3c-d52691b4dbfc
-
-    2021-04-05  Keith Miller  <keith_miller@apple.com>
-
-            DFG arity fixup nodes should exit to the caller's call opcode
-            https://bugs.webkit.org/show_bug.cgi?id=223278
-
-            Reviewed by Saam Barati.
-
-            * stress/dfg-arity-fixup-uses-callers-exit-origin.js: Added.
-            (main.v22):
-            (main.v30):
-            (main.try.v40):
-            (main.try.v47):
-            (main.try.v56):
-            (main.):
-            (main):
-
</del><span class="cx"> 2021-06-15  Alan Coon  <alancoon@apple.com>
</span><span class="cx"> 
</span><span class="cx">         Cherry-pick r278819. rdar://problem/79355258
</span></span></pre></div>
<a id="branchessafari6113100branchJSTestsstressdfgarityfixupusescallersexitoriginjs"></a>
<div class="delfile"><h4>Deleted: branches/safari-611.3.10.0-branch/JSTests/stress/dfg-arity-fixup-uses-callers-exit-origin.js (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/JSTests/stress/dfg-arity-fixup-uses-callers-exit-origin.js     2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/JSTests/stress/dfg-arity-fixup-uses-callers-exit-origin.js        2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -1,54 +0,0 @@
</span><del>-function main() {
-const v12 = [1337,1337];
-const v13 = [1337,v12,v12,0];
-for (let v14 = 0; v14 < 1000; v14++) {
-    function v15(v16,v17) {
-        const v18 = v14 + 127;
-        const v19 = String();
-        const v20 = String.fromCharCode();
-        const v21 = v13.shift();
-        function v22() {
-            const v23 = arguments;
-        }
-        const v24 = Object();
-        const v25 = {};
-        const v26 = v22(v25);
-        const v27 = [-903931.176976766,v20,null,null,-903931.176976766];
-        function v30() {
-        }
-        const v31 = {ownKeys:v30};
-        const v32 = {};
-        const v33 = new Proxy(v32,v31);
-        Function.__proto__ = v33;
-        const v34 = v27.join();
-        try {
-            const v35 = Function();
-            const v36 = v35();
-            for (let v37 = 0; v37 < 127; v37++) {
-                const v38 = isFinite();
-                const v39 = isFinite;
-                function v40(v41,v42,v43) {
-                }
-                const v44 = 1337;
-                const v45 = undefined;
-                const v46 = "function(){}";
-                function* v47(v48,v49,v50,v51,v52) {
-                }
-                const v53 = charAt;
-                function v56(v57,v58,v59,v60,v61) {
-                    const v62 = v36(v35,v37);
-                }
-                for (let v64 = 0; v64 >= 100000; v64++) {
-                }
-                const v65 = 10000;
-                const v66 = v38[4];
-            }
-        } catch(v67) {
-        }
-    }
-    const v68 = v15();
-}
-}
-noDFG(main);
-noFTL(main);
-main();
</del></span></pre></div>
<a id="branchessafari6113100branchJSTestswasmstressosrentrywithloopargumentsjs"></a>
<div class="delfile"><h4>Deleted: branches/safari-611.3.10.0-branch/JSTests/wasm/stress/osr-entry-with-loop-arguments.js (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/JSTests/wasm/stress/osr-entry-with-loop-arguments.js   2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/JSTests/wasm/stress/osr-entry-with-loop-arguments.js      2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -1,29 +0,0 @@
</span><del>-import * as assert from '../assert.js';
-import { instantiate } from "../wabt-wrapper.js";
-
-let wat = `
-(module
-  (func (export "test") (param $countArg i32) (result i32) (local $result i32)
-    i32.const 0
-    (loop (param i32) (result i32)
-      i32.const 1
-      i32.add
-      local.tee $result
-      local.get $result
-      local.get $countArg
-      i32.lt_u
-      br_if 0
-    )
-  )
-)
-`;
-
-async function test() {
-    let instance = await instantiate(wat);
-
-    let result = instance.exports.test(1000000);
-    if (result !== 1000000)
-        throw new Error("Expected 100000, but got: " + result);
-}
-
-assert.asyncTest(test());
</del></span></pre></div>
<a id="branchessafari6113100branchSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/JavaScriptCore/ChangeLog (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/JavaScriptCore/ChangeLog        2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/JavaScriptCore/ChangeLog   2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -1,247 +1,3 @@
</span><del>-2021-08-12  Russell Epstein  <repstein@apple.com>
-
-        Cherry-pick r280996. rdar://problem/81752592
-
-    Refactor some ARM64EHash code.
-    https://bugs.webkit.org/show_bug.cgi?id=229054
-    
-    Reviewed by Keith Miller and Robin Morisset.
-    
-    This patch only refactors ARM64EHash code by moving some methods into the private
-    section, and removing some unneeded static_casts.
-    
-    Verified with a diff of `otool -tv` dumps of the built JavaScriptCore binaries,
-    that there are no diffs in the generated code from this change.
-    
-    * assembler/AssemblerBuffer.h:
-    (JSC::ARM64EHash::ARM64EHash):
-    (JSC::ARM64EHash::update):
-    (JSC::ARM64EHash::makeDiversifier):
-    (JSC::ARM64EHash::nextValue):
-    (JSC::ARM64EHash::bitsForDiversifier):
-    (JSC::ARM64EHash::currentHash):
-    
-    
-    
-    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@280996 268f45cc-cd09-0410-ab3c-d52691b4dbfc
-
-    2021-08-12  Mark Lam  <mark.lam@apple.com>
-
-            Refactor some ARM64EHash code.
-            https://bugs.webkit.org/show_bug.cgi?id=229054
-
-            Reviewed by Keith Miller and Robin Morisset.
-
-            This patch only refactors ARM64EHash code by moving some methods into the private
-            section, and removing some unneeded static_casts.
-
-            Verified with a diff of `otool -tv` dumps of the built JavaScriptCore binaries,
-            that there are no diffs in the generated code from this change.
-
-            * assembler/AssemblerBuffer.h:
-            (JSC::ARM64EHash::ARM64EHash):
-            (JSC::ARM64EHash::update):
-            (JSC::ARM64EHash::makeDiversifier):
-            (JSC::ARM64EHash::nextValue):
-            (JSC::ARM64EHash::bitsForDiversifier):
-            (JSC::ARM64EHash::currentHash):
-
-2021-08-12  Russell Epstein  <repstein@apple.com>
-
-        Cherry-pick r280984. rdar://problem/81752592
-
-    Update ARM64EHash
-    https://bugs.webkit.org/show_bug.cgi?id=228962
-    <rdar://79883337>
-    
-    Reviewed by Mark Lam.
-    
-    * assembler/AssemblerBuffer.h:
-    (JSC::ARM64EHash::makeDiversifier):
-    (JSC::ARM64EHash::nextValue):
-    (JSC::ARM64EHash::bitsForDiversifier):
-    (JSC::ARM64EHash::currentHash):
-    (JSC::ARM64EHash::setUpdatedHash):
-    (JSC::ARM64EHash::ARM64EHash):
-    (JSC::ARM64EHash::update):
-    (JSC::ARM64EHash::finalize):
-    (JSC::AssemblerBuffer::AssemblerBuffer):
-    (JSC::AssemblerBuffer::putIntegralUnchecked):
-    (JSC::AssemblerBuffer::hash const):
-    * assembler/LinkBuffer.cpp:
-    (JSC::LinkBuffer::copyCompactAndLinkCode):
-    
-    
-    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@280984 268f45cc-cd09-0410-ab3c-d52691b4dbfc
-
-    2021-08-12  Saam Barati  <sbarati@apple.com>
-
-            Update ARM64EHash
-            https://bugs.webkit.org/show_bug.cgi?id=228962
-            <rdar://79883337>
-
-            Reviewed by Mark Lam.
-
-            * assembler/AssemblerBuffer.h:
-            (JSC::ARM64EHash::makeDiversifier):
-            (JSC::ARM64EHash::nextValue):
-            (JSC::ARM64EHash::bitsForDiversifier):
-            (JSC::ARM64EHash::currentHash):
-            (JSC::ARM64EHash::setUpdatedHash):
-            (JSC::ARM64EHash::ARM64EHash):
-            (JSC::ARM64EHash::update):
-            (JSC::ARM64EHash::finalize):
-            (JSC::AssemblerBuffer::AssemblerBuffer):
-            (JSC::AssemblerBuffer::putIntegralUnchecked):
-            (JSC::AssemblerBuffer::hash const):
-            * assembler/LinkBuffer.cpp:
-            (JSC::LinkBuffer::copyCompactAndLinkCode):
-
-2021-08-10  Russell Epstein  <repstein@apple.com>
-
-        Cherry-pick r280507. rdar://problem/79730568
-
-    Improve OSR entry into Wasm loops with arguments
-    https://bugs.webkit.org/show_bug.cgi?id=228595
-    
-    Reviewed by Yusuke Suzuki.
-    
-    JSTests:
-    
-    Just a straightforward test that counts to 1M in a loop, to exercise both OSR entry and a loop with an argument at the same time.
-    100k iterations was not enough to reliably complete an OSR entry.
-    
-    * wasm/stress/osr-entry-with-loop-arguments.js: Added.
-    (async test):
-    
-    Source/JavaScriptCore:
-    
-    This patch has two parts:
-    - improve the Wasm OSR code to fully support loop arguments (just some plumbing to make sure that the right values are propagated)
-    - improve the B3 validator to fix a hole I noticed while writing the first part: we were not detecting code that introduce Upsilons in the wrong blocks.
-      Naturally, this caused hard to debug issues, as B3 has no well-defined semantics for a Phi that is reached before the corresponding Upsilon(s).
-    
-    * b3/B3Validate.cpp:
-    * wasm/WasmAirIRGenerator.cpp:
-    (JSC::Wasm::AirIRGenerator::emitLoopTierUpCheck):
-    (JSC::Wasm::AirIRGenerator::addLoop):
-    * wasm/WasmB3IRGenerator.cpp:
-    (JSC::Wasm::B3IRGenerator::emitLoopTierUpCheck):
-    (JSC::Wasm::B3IRGenerator::addLoop):
-    * wasm/WasmLLIntGenerator.cpp:
-    (JSC::Wasm::LLIntGenerator::addLoop):
-    
-    
-    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@280507 268f45cc-cd09-0410-ab3c-d52691b4dbfc
-
-    2021-07-30  Robin Morisset  <rmorisset@apple.com>
-
-            Improve OSR entry into Wasm loops with arguments
-            https://bugs.webkit.org/show_bug.cgi?id=228595
-
-            Reviewed by Yusuke Suzuki.
-
-            This patch has two parts:
-            - improve the Wasm OSR code to fully support loop arguments (just some plumbing to make sure that the right values are propagated)
-            - improve the B3 validator to fix a hole I noticed while writing the first part: we were not detecting code that introduce Upsilons in the wrong blocks.
-              Naturally, this caused hard to debug issues, as B3 has no well-defined semantics for a Phi that is reached before the corresponding Upsilon(s).
-
-            * b3/B3Validate.cpp:
-            * wasm/WasmAirIRGenerator.cpp:
-            (JSC::Wasm::AirIRGenerator::emitLoopTierUpCheck):
-            (JSC::Wasm::AirIRGenerator::addLoop):
-            * wasm/WasmB3IRGenerator.cpp:
-            (JSC::Wasm::B3IRGenerator::emitLoopTierUpCheck):
-            (JSC::Wasm::B3IRGenerator::addLoop):
-            * wasm/WasmLLIntGenerator.cpp:
-            (JSC::Wasm::LLIntGenerator::addLoop):
-
-2021-08-10  Russell Epstein  <repstein@apple.com>
-
-        Cherry-pick r275472. rdar://problem/81710596
-
-    DFG arity fixup nodes should exit to the caller's call opcode
-    https://bugs.webkit.org/show_bug.cgi?id=223278
-    
-    Reviewed by Saam Barati.
-    
-    JSTests:
-    
-    * stress/dfg-arity-fixup-uses-callers-exit-origin.js: Added.
-    (main.v22):
-    (main.v30):
-    (main.try.v40):
-    (main.try.v47):
-    (main.try.v56):
-    (main.):
-    (main):
-    
-    Source/JavaScriptCore:
-    
-    Right now when we do arity fixup in the DFG we model it in the
-    same way that it executes, which means all the nodes are part of
-    the callee. Unfortunately, this causes PhantomInsertionPhase to
-    think those nodes could be replacing previously defined
-    VirtualRegisters as they are part of the callee's header (always
-    alive). When PhantomInsertionPhase then inserts a Phantom it will
-    put that node in the caller's frame as that's the first ExitOK
-    node. The caller however may have no knowledge of that
-    VirtualRegister though. For example:
-    
-    --> foo: loc10 is a local in foo.
-        ...
-        1: MovHint(loc10)
-        2: SetLocal(loc10)
-    <-- foo // loc10 ten is now out of scope for the InlineCallFrame of the caller.
-    ...
-    // Phantom will be inserted here refering to loc10, which doesn't make sense.
-    --> bar // loc10 is an argument to bar and needs arity fixup.
-        ... // All of these nodes are ExitInvalid
-        3: MovHint(loc10, ExitInvalid)
-        4: SetLocal(loc10, ExitInvalid)
-        ...
-    
-    * dfg/DFGByteCodeParser.cpp:
-    (JSC::DFG::ByteCodeParser::currentNodeOrigin):
-    (JSC::DFG::ByteCodeParser::inlineCall):
-    
-    
-    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@275472 268f45cc-cd09-0410-ab3c-d52691b4dbfc
-
-    2021-04-05  Keith Miller  <keith_miller@apple.com>
-
-            DFG arity fixup nodes should exit to the caller's call opcode
-            https://bugs.webkit.org/show_bug.cgi?id=223278
-
-            Reviewed by Saam Barati.
-
-            Right now when we do arity fixup in the DFG we model it in the
-            same way that it executes, which means all the nodes are part of
-            the callee. Unfortunately, this causes PhantomInsertionPhase to
-            think those nodes could be replacing previously defined
-            VirtualRegisters as they are part of the callee's header (always
-            alive). When PhantomInsertionPhase then inserts a Phantom it will
-            put that node in the caller's frame as that's the first ExitOK
-            node. The caller however may have no knowledge of that
-            VirtualRegister though. For example:
-
-            --> foo: loc10 is a local in foo.
-                ...
-                1: MovHint(loc10)
-                2: SetLocal(loc10)
-            <-- foo // loc10 ten is now out of scope for the InlineCallFrame of the caller.
-            ...
-            // Phantom will be inserted here refering to loc10, which doesn't make sense.
-            --> bar // loc10 is an argument to bar and needs arity fixup.
-                ... // All of these nodes are ExitInvalid
-                3: MovHint(loc10, ExitInvalid)
-                4: SetLocal(loc10, ExitInvalid)
-                ...
-
-            * dfg/DFGByteCodeParser.cpp:
-            (JSC::DFG::ByteCodeParser::currentNodeOrigin):
-            (JSC::DFG::ByteCodeParser::inlineCall):
-
</del><span class="cx"> 2021-06-15  Alan Coon  <alancoon@apple.com>
</span><span class="cx"> 
</span><span class="cx">         Cherry-pick r278819. rdar://problem/79355258
</span></span></pre></div>
<a id="branchessafari6113100branchSourceJavaScriptCoreConfigurationsVersionxcconfig"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/JavaScriptCore/Configurations/Version.xcconfig (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/JavaScriptCore/Configurations/Version.xcconfig  2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/JavaScriptCore/Configurations/Version.xcconfig     2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -22,11 +22,11 @@
</span><span class="cx"> // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
</span><span class="cx"> 
</span><span class="cx"> MAJOR_VERSION = 611;
</span><del>-MINOR_VERSION = 4;
-TINY_VERSION = 0;
-MICRO_VERSION = 2;
-NANO_VERSION = 0;
-FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION);
</del><ins>+MINOR_VERSION = 3;
+TINY_VERSION = 10;
+MICRO_VERSION = 0;
+NANO_VERSION = 1;
+FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION).$(NANO_VERSION);
</ins><span class="cx"> 
</span><span class="cx"> // The bundle version and short version string are set based on the current build configuration, see below.
</span><span class="cx"> BUNDLE_VERSION = $(BUNDLE_VERSION_$(CONFIGURATION));
</span></span></pre></div>
<a id="branchessafari6113100branchSourceJavaScriptCoreassemblerAssemblerBufferh"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/JavaScriptCore/assembler/AssemblerBuffer.h (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/JavaScriptCore/assembler/AssemblerBuffer.h      2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/JavaScriptCore/assembler/AssemblerBuffer.h 2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008-2021 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2008-2019 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -205,59 +205,22 @@
</span><span class="cx"> #if CPU(ARM64E)
</span><span class="cx">     class ARM64EHash {
</span><span class="cx">     public:
</span><del>-        ARM64EHash(void* diversifier)
</del><ins>+        ARM64EHash(uint32_t initialHash)
+            : m_hash(initialHash)
</ins><span class="cx">         {
</span><del>-            setUpdatedHash(0, 0, diversifier);
</del><span class="cx">         }
</span><span class="cx"> 
</span><del>-        ALWAYS_INLINE uint32_t update(uint32_t instruction, uint32_t index, void* diversifier)
</del><ins>+        ALWAYS_INLINE uint32_t update(uint32_t value)
</ins><span class="cx">         {
</span><del>-            uint32_t currentHash = this->currentHash(index, diversifier);
-            uint64_t nextIndex = index + 1;
-            uint32_t output = nextValue(instruction, nextIndex, currentHash);
-            setUpdatedHash(output, nextIndex, diversifier);
-            return output;
</del><ins>+            uint64_t input = value ^ m_hash;
+            uint64_t a = static_cast<uint32_t>(tagInt(input, static_cast<PtrTag>(0)) >> 39);
+            uint64_t b = tagInt(input, static_cast<PtrTag>(0xb7e151628aed2a6a)) >> 23;
+            m_hash = a ^ b;
+            return m_hash;
</ins><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">     private:
</span><del>-        static constexpr uint8_t initializationNamespace = 0x11;
-
-        static ALWAYS_INLINE PtrTag makeDiversifier(uint8_t namespaceTag, uint64_t index, uint32_t value)
-        {
-            // <namespaceTag:8><index:24><value:32>
-            return static_cast<PtrTag>((static_cast<uint64_t>(namespaceTag) << 56) + ((index & 0xFFFFFF) << 32) + value);
-        }
-
-        static ALWAYS_INLINE uint32_t nextValue(uint64_t instruction, uint64_t index, uint32_t currentValue)
-        {
-            uint64_t a = tagInt(instruction, makeDiversifier(0x12, index, currentValue));
-            uint64_t b = tagInt(instruction, makeDiversifier(0x13, index, currentValue));
-            return (a >> 39) ^ (b >> 23);
-        }
-
-        static ALWAYS_INLINE uint32_t bitsForDiversifier(void* diversifier)
-        {
-            return bitwise_cast<uintptr_t>(diversifier);
-        }
-
-        ALWAYS_INLINE uint32_t currentHash(uint32_t index, void* diversifier)
-        {
-            bool hashFieldIsTagged = index == 0;
-            if (hashFieldIsTagged)
-                return untagInt(m_hash, makeDiversifier(initializationNamespace, index, bitsForDiversifier(diversifier)));
-            return m_hash;
-        }
-
-        ALWAYS_INLINE void setUpdatedHash(uint32_t value, uint32_t index, void* diversifier)
-        {
-            bool shouldTagHashField = index == 0;
-            if (shouldTagHashField)
-                m_hash = tagInt(static_cast<uint64_t>(value), makeDiversifier(initializationNamespace, index, bitsForDiversifier(diversifier)));
-            else
-                m_hash = value;
-        }
-
-        uint64_t m_hash;
</del><ins>+        uint32_t m_hash;
</ins><span class="cx">     };
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="lines">@@ -267,7 +230,7 @@
</span><span class="cx">             : m_storage()
</span><span class="cx">             , m_index(0)
</span><span class="cx"> #if CPU(ARM64E)
</span><del>-            , m_hash(this)
</del><ins>+            , m_hash(static_cast<uint32_t>(bitwise_cast<uint64_t>(this)))
</ins><span class="cx">             , m_hashes()
</span><span class="cx"> #endif
</span><span class="cx">         {
</span><span class="lines">@@ -425,7 +388,7 @@
</span><span class="cx"> #if CPU(ARM64)
</span><span class="cx">             static_assert(sizeof(value) == 4, "");
</span><span class="cx"> #if CPU(ARM64E)
</span><del>-            uint32_t hash = m_hash.update(value, m_index / sizeof(IntegralType), this);
</del><ins>+            uint32_t hash = m_hash.update(value);
</ins><span class="cx">             WTF::unalignedStore<uint32_t>(m_hashes.buffer() + m_index, hash);
</span><span class="cx"> #endif
</span><span class="cx"> #endif
</span></span></pre></div>
<a id="branchessafari6113100branchSourceJavaScriptCoreassemblerLinkBuffercpp"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/JavaScriptCore/assembler/LinkBuffer.cpp (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/JavaScriptCore/assembler/LinkBuffer.cpp 2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/JavaScriptCore/assembler/LinkBuffer.cpp    2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -236,8 +236,7 @@
</span><span class="cx">     m_assemblerStorage = macroAssembler.m_assembler.buffer().releaseAssemblerData();
</span><span class="cx">     uint8_t* inData = bitwise_cast<uint8_t*>(m_assemblerStorage.buffer());
</span><span class="cx"> #if CPU(ARM64E)
</span><del>-    void* bufferPtr = &macroAssembler.m_assembler.buffer();
-    ARM64EHash verifyUncompactedHash { bufferPtr };
</del><ins>+    ARM64EHash verifyUncompactedHash { static_cast<uint32_t>(bitwise_cast<uint64_t>(&macroAssembler.m_assembler.buffer())) };
</ins><span class="cx">     m_assemblerHashesStorage = macroAssembler.m_assembler.buffer().releaseAssemblerHashes();
</span><span class="cx">     uint32_t* inHashes = bitwise_cast<uint32_t*>(m_assemblerHashesStorage.buffer());
</span><span class="cx"> #endif
</span><span class="lines">@@ -259,8 +258,8 @@
</span><span class="cx">     auto read = [&](const InstructionType* ptr) -> InstructionType {
</span><span class="cx">         InstructionType value = *ptr;
</span><span class="cx"> #if CPU(ARM64E)
</span><ins>+        uint32_t hash = verifyUncompactedHash.update(value);
</ins><span class="cx">         unsigned index = (bitwise_cast<uint8_t*>(ptr) - inData) / 4;
</span><del>-        uint32_t hash = verifyUncompactedHash.update(value, index, bufferPtr);
</del><span class="cx">         RELEASE_ASSERT(inHashes[index] == hash);
</span><span class="cx"> #endif
</span><span class="cx">         return value;
</span></span></pre></div>
<a id="branchessafari6113100branchSourceJavaScriptCoreb3B3Validatecpp"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/JavaScriptCore/b3/B3Validate.cpp (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/JavaScriptCore/b3/B3Validate.cpp        2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/JavaScriptCore/b3/B3Validate.cpp   2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -572,8 +572,6 @@
</span><span class="cx">                 predecessors.add(predecessor);
</span><span class="cx">             VALIDATE(block->numPredecessors() == predecessors.size(), ("At ", *block));
</span><span class="cx">         }
</span><del>-
-        validatePhisAreDominatedByUpsilons();
</del><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><span class="lines">@@ -654,51 +652,7 @@
</span><span class="cx"> 
</span><span class="cx">         VALIDATE(memory->offset() >= 0, ("At ", *value));
</span><span class="cx">     }
</span><del>-
-    // A simple backwards analysis to check that we cannot reach a Phi without going through a corresponding Upsilon
-    // We cannot use the dominator tree, since we are checking that each Phi is dominated by a the set of all of its upsilons, and not by a single node.
-    void validatePhisAreDominatedByUpsilons()
-    {
-        bool changed = true;
-        BitVector blocksToVisit;
-        IndexMap<BasicBlock*, HashSet<Value*>> undominatedPhisAtTail(m_procedure.size());
-        for (BasicBlock* block : m_procedure)
-            blocksToVisit.set(block->index());
-        while (changed) {
-            changed = false;
-            for (BasicBlock* block : m_procedure.blocksInPostOrder()) {
-                if (!blocksToVisit.quickClear(block->index()))
-                    continue;
-                HashSet<Value*> undominatedPhis = undominatedPhisAtTail[block];
-                for (unsigned index = block->size()-1; index--;) {
-                    Value* value = block->at(index);
-                    switch (value->opcode()) {
-                    case Upsilon:
-                        undominatedPhis.remove(value->as<UpsilonValue>()->phi());
-                        break;
-                    case Phi:
-                        VALIDATE(!undominatedPhis.contains(value), ("At ", *value));
-                        undominatedPhis.add(value);
-                        break;
-                    default:
-                        break;
-                    }
-                }
-                for (BasicBlock* predecessor : block->predecessors()) {
-                    bool changedSet = false;
-                    for (Value* phi : undominatedPhis)
-                        changedSet |= undominatedPhisAtTail[predecessor].add(phi).isNewEntry;
-                    if (changedSet) {
-                        blocksToVisit.quickSet(predecessor->index());
-                        changed = true;
-                    }
-                }
-                if (!block->index())
-                    VALIDATE(undominatedPhis.isEmpty(), ("Undominated phi at top of entry block: ", **undominatedPhis.begin()));
-            }
-        }
-    }
-
</del><ins>+    
</ins><span class="cx">     NO_RETURN_DUE_TO_CRASH void fail(
</span><span class="cx">         const char* filename, int lineNumber, const char* function, const char* condition,
</span><span class="cx">         CString message)
</span></span></pre></div>
<a id="branchessafari6113100branchSourceJavaScriptCoredfgDFGByteCodeParsercpp"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp        2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp   2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -746,9 +746,16 @@
</span><span class="cx"> 
</span><span class="cx">     NodeOrigin currentNodeOrigin()
</span><span class="cx">     {
</span><del>-        CodeOrigin semantic = m_currentSemanticOrigin.isSet() ? m_currentSemanticOrigin : currentCodeOrigin();
-        CodeOrigin forExit = m_currentExitOrigin.isSet() ? m_currentExitOrigin : currentCodeOrigin();
</del><ins>+        CodeOrigin semantic;
+        CodeOrigin forExit;
</ins><span class="cx"> 
</span><ins>+        if (m_currentSemanticOrigin.isSet())
+            semantic = m_currentSemanticOrigin;
+        else
+            semantic = currentCodeOrigin();
+
+        forExit = currentCodeOrigin();
+
</ins><span class="cx">         return NodeOrigin(semantic, forExit, m_exitOK);
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -1137,8 +1144,6 @@
</span><span class="cx">     BytecodeIndex m_currentIndex;
</span><span class="cx">     // The semantic origin of the current node if different from the current Index.
</span><span class="cx">     CodeOrigin m_currentSemanticOrigin;
</span><del>-    // The exit origin of the current node if different from the current Index.
-    CodeOrigin m_currentExitOrigin;
</del><span class="cx">     // True if it's OK to OSR exit right now.
</span><span class="cx">     bool m_exitOK { false };
</span><span class="cx"> 
</span><span class="lines">@@ -1706,31 +1711,6 @@
</span><span class="cx">         calleeVariable->mergeShouldNeverUnbox(true);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    // We want to claim the exit origin for the arity fixup nodes to be in the caller rather than the callee because
-    // otherwise phantom insertion phase will think the virtual registers in the callee's header have been alive from the last
-    // time they were set. For example:
-
-    // --> foo: loc10 is a local in foo.
-    //    ...
-    //    1: MovHint(loc10)
-    //    2: SetLocal(loc10)
-    // <-- foo: loc10 ten is now out of scope for the InlineCallFrame of the caller.
-    // ...
-    // --> bar: loc10 is an argument to bar and needs arity fixup.
-    //    ... // All of these nodes are ExitInvalid
-    //    3: MovHint(loc10, ExitInvalid)
-    //    4: SetLocal(loc10, ExitInvalid)
-    //    ...
-
-    // In this example phantom insertion phase will think @3 is always alive because it's in the header of bar. So,
-    // it will think we are about to kill the old value, as loc10 is in the header of bar and therefore always live, and
-    // thus need a Phantom. That Phantom, however, may be inserted  into the caller's NodeOrigin (all the nodes in bar
-    // before @3 are ExitInvalid), which doesn't know about loc10. If we move all of the arity fixup nodes into the
-    // caller's exit origin, forAllKilledOperands, which is how phantom insertion phase decides where phantoms are needed,
-    // will no longer say loc10 is always alive.
-    CodeOrigin oldExitOrigin = m_currentExitOrigin;
-    m_currentExitOrigin = currentCodeOrigin();
-
</del><span class="cx">     InlineStackEntry* callerStackTop = m_inlineStackTop;
</span><span class="cx">     InlineStackEntry inlineStackEntry(this, codeBlock, codeBlock, callee.function(), result,
</span><span class="cx">         inlineCallFrameStart.virtualRegister(), argumentCountIncludingThis, kind, continuationBlock);
</span><span class="lines">@@ -1834,8 +1814,6 @@
</span><span class="cx">         // our callee's frame. We emit an ExitOK below.
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    m_currentExitOrigin = oldExitOrigin;
-
</del><span class="cx">     // At this point, it's again OK to OSR exit.
</span><span class="cx">     m_exitOK = true;
</span><span class="cx">     addToGraph(ExitOK);
</span></span></pre></div>
<a id="branchessafari6113100branchSourceJavaScriptCorewasmWasmAirIRGeneratorcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp      2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp 2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -656,7 +656,7 @@
</span><span class="cx">     void emitThrowException(CCallHelpers&, ExceptionType);
</span><span class="cx"> 
</span><span class="cx">     void emitEntryTierUpCheck();
</span><del>-    void emitLoopTierUpCheck(uint32_t loopIndex, const Stack& enclosingStack, const Stack& newStack);
</del><ins>+    void emitLoopTierUpCheck(uint32_t loopIndex, const Stack& enclosingStack);
</ins><span class="cx"> 
</span><span class="cx">     void emitWriteBarrierForJSWrapper();
</span><span class="cx">     ExpressionType emitCheckAndPreparePointer(ExpressionType pointer, uint32_t offset, uint32_t sizeOfOp);
</span><span class="lines">@@ -2640,7 +2640,7 @@
</span><span class="cx">     emitPatchpoint(patch, Tmp(), countdownPtr);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void AirIRGenerator::emitLoopTierUpCheck(uint32_t loopIndex, const Stack& enclosingStack, const Stack& newStack)
</del><ins>+void AirIRGenerator::emitLoopTierUpCheck(uint32_t loopIndex, const Stack& enclosingStack)
</ins><span class="cx"> {
</span><span class="cx">     uint32_t outerLoopIndex = this->outerLoopIndex();
</span><span class="cx">     m_outerLoops.append(loopIndex);
</span><span class="lines">@@ -2680,8 +2680,6 @@
</span><span class="cx">     }
</span><span class="cx">     for (TypedExpression value : enclosingStack)
</span><span class="cx">         patchArgs.append(ConstrainedTmp(value.value(), B3::ValueRep::ColdAny));
</span><del>-    for (TypedExpression value : newStack)
-        patchArgs.append(ConstrainedTmp(value.value(), B3::ValueRep::ColdAny));
</del><span class="cx"> 
</span><span class="cx">     TierUpCount::TriggerReason* forceEntryTrigger = &(m_tierUp->osrEntryTriggers().last());
</span><span class="cx">     static_assert(!static_cast<uint8_t>(TierUpCount::TriggerReason::DontTrigger), "the JIT code assumes non-zero means 'enter'");
</span><span class="lines">@@ -2733,7 +2731,7 @@
</span><span class="cx">     m_currentBlock->setSuccessors(body);
</span><span class="cx"> 
</span><span class="cx">     m_currentBlock = body;
</span><del>-    emitLoopTierUpCheck(loopIndex, enclosingStack, newStack);
</del><ins>+    emitLoopTierUpCheck(loopIndex, enclosingStack);
</ins><span class="cx"> 
</span><span class="cx">     return { };
</span><span class="cx"> }
</span></span></pre></div>
<a id="branchessafari6113100branchSourceJavaScriptCorewasmWasmB3IRGeneratorcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp       2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp  2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -295,7 +295,7 @@
</span><span class="cx">     void emitExceptionCheck(CCallHelpers&, ExceptionType);
</span><span class="cx"> 
</span><span class="cx">     void emitEntryTierUpCheck();
</span><del>-    void emitLoopTierUpCheck(uint32_t loopIndex, const Stack& enclosingStack, const Stack& newStack);
</del><ins>+    void emitLoopTierUpCheck(uint32_t loopIndex, const Stack& enclosingStack);
</ins><span class="cx"> 
</span><span class="cx">     void emitWriteBarrierForJSWrapper();
</span><span class="cx">     ExpressionType emitCheckAndPreparePointer(ExpressionType pointer, uint32_t offset, uint32_t sizeOfOp);
</span><span class="lines">@@ -1808,7 +1808,7 @@
</span><span class="cx">     });
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void B3IRGenerator::emitLoopTierUpCheck(uint32_t loopIndex, const Stack& enclosingStack, const Stack& newStack)
</del><ins>+void B3IRGenerator::emitLoopTierUpCheck(uint32_t loopIndex, const Stack& enclosingStack)
</ins><span class="cx"> {
</span><span class="cx">     uint32_t outerLoopIndex = this->outerLoopIndex();
</span><span class="cx">     m_outerLoops.append(loopIndex);
</span><span class="lines">@@ -1835,8 +1835,6 @@
</span><span class="cx">     }
</span><span class="cx">     for (TypedExpression value : enclosingStack)
</span><span class="cx">         stackmap.append(value);
</span><del>-    for (TypedExpression value : newStack)
-        stackmap.append(value);
</del><span class="cx"> 
</span><span class="cx">     PatchpointValue* patch = m_currentBlock->appendNew<PatchpointValue>(m_proc, B3::Void, origin);
</span><span class="cx">     Effects effects = Effects::none();
</span><span class="lines">@@ -1887,14 +1885,19 @@
</span><span class="cx">     BasicBlock* continuation = m_proc.addBlock();
</span><span class="cx"> 
</span><span class="cx">     block = ControlData(m_proc, origin(), signature, BlockType::Loop, continuation, body);
</span><del>-    unsigned offset = enclosingStack.size() - signature->argumentCount();
-    for (unsigned i = 0; i < signature->argumentCount(); ++i) {
-        TypedExpression value = enclosingStack.at(offset + i);
-        auto* upsilon = m_currentBlock->appendNew<UpsilonValue>(m_proc, origin(), value);
-        Value* phi = block.phis[i];
-        body->append(phi);
-        upsilon->setPhi(phi);
-        newStack.constructAndAppend(value.type(), phi);
</del><ins>+
+    ExpressionList args;
+    {
+        unsigned offset = enclosingStack.size() - signature->argumentCount();
+        for (unsigned i = 0; i < signature->argumentCount(); ++i) {
+            TypedExpression value = enclosingStack.at(offset + i);
+            auto* upsilon = m_currentBlock->appendNew<UpsilonValue>(m_proc, origin(), value);
+            Value* phi = block.phis[i];
+            body->append(phi);
+            upsilon->setPhi(phi);
+            newStack.constructAndAppend(value.type(), phi);
+        }
+        enclosingStack.shrink(offset);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     m_currentBlock->appendNewControlValue(m_proc, Jump, origin(), body);
</span><span class="lines">@@ -1955,22 +1958,15 @@
</span><span class="cx">             auto& expressionStack = m_parser->controlStack()[controlIndex].enclosedExpressionStack;
</span><span class="cx">             connectControlEntry(data, expressionStack);
</span><span class="cx">         }
</span><del>-        for (unsigned i = 0; i < signature->argumentCount(); ++i) {
-            TypedExpression value = enclosingStack.at(offset + i);
-            Value* phi = block.phis[i];
-            m_currentBlock->appendNew<UpsilonValue>(m_proc, value->origin(), loadFromScratchBuffer(value->type()), phi);
-        }
-        enclosingStack.shrink(offset);
</del><span class="cx">         connectControlEntry(block, enclosingStack);
</span><span class="cx"> 
</span><span class="cx">         m_osrEntryScratchBufferSize = indexInBuffer;
</span><span class="cx">         m_currentBlock->appendNewControlValue(m_proc, Jump, origin(), body);
</span><span class="cx">         body->addPredecessor(m_currentBlock);
</span><del>-    } else
-        enclosingStack.shrink(offset);
</del><ins>+    }
</ins><span class="cx"> 
</span><span class="cx">     m_currentBlock = body;
</span><del>-    emitLoopTierUpCheck(loopIndex, enclosingStack, newStack);
</del><ins>+    emitLoopTierUpCheck(loopIndex, enclosingStack);
</ins><span class="cx">     return { };
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchessafari6113100branchSourceJavaScriptCorewasmWasmLLIntGeneratorcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp      2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/JavaScriptCore/wasm/WasmLLIntGenerator.cpp 2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -885,8 +885,6 @@
</span><span class="cx">     }
</span><span class="cx">     for (TypedExpression expression : enclosingStack)
</span><span class="cx">         osrEntryData.append(expression);
</span><del>-    for (TypedExpression expression : newStack)
-        osrEntryData.append(expression);
</del><span class="cx"> 
</span><span class="cx">     WasmLoopHint::emit(this);
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchessafari6113100branchSourceThirdPartyANGLEConfigurationsVersionxcconfig"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/ThirdParty/ANGLE/Configurations/Version.xcconfig (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/ThirdParty/ANGLE/Configurations/Version.xcconfig        2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/ThirdParty/ANGLE/Configurations/Version.xcconfig   2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -22,11 +22,11 @@
</span><span class="cx"> // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
</span><span class="cx"> 
</span><span class="cx"> MAJOR_VERSION = 611;
</span><del>-MINOR_VERSION = 4;
-TINY_VERSION = 0;
-MICRO_VERSION = 2;
-NANO_VERSION = 0;
-FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION);
</del><ins>+MINOR_VERSION = 3;
+TINY_VERSION = 10;
+MICRO_VERSION = 0;
+NANO_VERSION = 1;
+FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION).$(NANO_VERSION);
</ins><span class="cx"> 
</span><span class="cx"> // The bundle version and short version string are set based on the current build configuration, see below.
</span><span class="cx"> BUNDLE_VERSION = $(BUNDLE_VERSION_$(CONFIGURATION));
</span></span></pre></div>
<a id="branchessafari6113100branchSourceThirdPartylibwebrtcConfigurationsVersionxcconfig"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/ThirdParty/libwebrtc/Configurations/Version.xcconfig (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/ThirdParty/libwebrtc/Configurations/Version.xcconfig    2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/ThirdParty/libwebrtc/Configurations/Version.xcconfig       2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -22,11 +22,11 @@
</span><span class="cx"> // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
</span><span class="cx"> 
</span><span class="cx"> MAJOR_VERSION = 611;
</span><del>-MINOR_VERSION = 4;
-TINY_VERSION = 0;
-MICRO_VERSION = 2;
-NANO_VERSION = 0;
-FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION);
</del><ins>+MINOR_VERSION = 3;
+TINY_VERSION = 10;
+MICRO_VERSION = 0;
+NANO_VERSION = 1;
+FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION).$(NANO_VERSION);
</ins><span class="cx"> 
</span><span class="cx"> // The bundle version and short version string are set based on the current build configuration, see below.
</span><span class="cx"> BUNDLE_VERSION = $(BUNDLE_VERSION_$(CONFIGURATION));
</span></span></pre></div>
<a id="branchessafari6113100branchSourceWTFChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/WTF/ChangeLog (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/WTF/ChangeLog   2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/WTF/ChangeLog      2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -1,42 +1,3 @@
</span><del>-2021-08-22  Alan Coon  <alancoon@apple.com>
-
-        Cherry-pick r281384. rdar://problem/82195071
-
-    IndexedDB: crash when triggering IDBOpenRequest completion back on a worker thread
-    https://bugs.webkit.org/show_bug.cgi?id=229375
-    
-    Source/WebCore:
-    
-    Reviewed by Brady Eidson.
-    
-    Client may dispatch custom events to an IDBRequest, and we should only change request state based on events
-    created internally.
-    
-    * Modules/indexeddb/IDBRequest.cpp:
-    (WebCore::IDBRequest::dispatchEvent):
-    
-    Source/WTF:
-    
-    Protect callee in CrossThreadTask if it inherits from ThreadSafeRefCounted<T>.
-    
-    Reviewed by Brady Eidson.
-    
-    * wtf/CrossThreadTask.h:
-    
-    
-    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@281384 268f45cc-cd09-0410-ab3c-d52691b4dbfc
-
-    2021-08-21  Sihui Liu  <sihui_liu@apple.com>
-
-            IndexedDB: crash when triggering IDBOpenRequest completion back on a worker thread
-            https://bugs.webkit.org/show_bug.cgi?id=229375
-
-            Protect callee in CrossThreadTask if it inherits from ThreadSafeRefCounted<T>.
-
-            Reviewed by Brady Eidson.
-
-            * wtf/CrossThreadTask.h:
-
</del><span class="cx"> 2021-06-10  Russell Epstein  <repstein@apple.com>
</span><span class="cx"> 
</span><span class="cx">         Cherry-pick r278177. rdar://problem/79144899
</span></span></pre></div>
<a id="branchessafari6113100branchSourceWTFwtfCrossThreadTaskh"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/WTF/wtf/CrossThreadTask.h (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/WTF/wtf/CrossThreadTask.h       2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/WTF/wtf/CrossThreadTask.h  2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -85,7 +85,7 @@
</span><span class="cx">     callMemberFunctionForCrossThreadTaskImpl(object, function, std::forward<ArgsTuple>(args), ArgsIndicies());
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-template<typename T, typename std::enable_if<std::is_base_of<ThreadSafeRefCountedBase, T>::value, int>::type = 0, typename... Parameters, typename... Arguments>
</del><ins>+template<typename T, typename std::enable_if<std::is_base_of<ThreadSafeRefCounted<T>, T>::value, int>::type = 0, typename... Parameters, typename... Arguments>
</ins><span class="cx"> CrossThreadTask createCrossThreadTask(T& callee, void (T::*method)(Parameters...), const Arguments&... arguments)
</span><span class="cx"> {
</span><span class="cx">     return CrossThreadTask([callee = makeRefPtr(&callee), method, arguments = std::make_tuple(crossThreadCopy(arguments)...)]() mutable {
</span><span class="lines">@@ -93,7 +93,7 @@
</span><span class="cx">     });
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-template<typename T, typename std::enable_if<!std::is_base_of<ThreadSafeRefCountedBase, T>::value, int>::type = 0, typename... Parameters, typename... Arguments>
</del><ins>+template<typename T, typename std::enable_if<!std::is_base_of<ThreadSafeRefCounted<T>, T>::value, int>::type = 0, typename... Parameters, typename... Arguments>
</ins><span class="cx"> CrossThreadTask createCrossThreadTask(T& callee, void (T::*method)(Parameters...), const Arguments&... arguments)
</span><span class="cx"> {
</span><span class="cx">     return CrossThreadTask([callee = &callee, method, arguments = std::make_tuple(crossThreadCopy(arguments)...)]() mutable {
</span></span></pre></div>
<a id="branchessafari6113100branchSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/WebCore/ChangeLog (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/WebCore/ChangeLog       2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/WebCore/ChangeLog  2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -1,140 +1,3 @@
</span><del>-2021-08-22  Alan Coon  <alancoon@apple.com>
-
-        Cherry-pick r281384. rdar://problem/82195071
-
-    IndexedDB: crash when triggering IDBOpenRequest completion back on a worker thread
-    https://bugs.webkit.org/show_bug.cgi?id=229375
-    
-    Source/WebCore:
-    
-    Reviewed by Brady Eidson.
-    
-    Client may dispatch custom events to an IDBRequest, and we should only change request state based on events
-    created internally.
-    
-    * Modules/indexeddb/IDBRequest.cpp:
-    (WebCore::IDBRequest::dispatchEvent):
-    
-    Source/WTF:
-    
-    Protect callee in CrossThreadTask if it inherits from ThreadSafeRefCounted<T>.
-    
-    Reviewed by Brady Eidson.
-    
-    * wtf/CrossThreadTask.h:
-    
-    
-    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@281384 268f45cc-cd09-0410-ab3c-d52691b4dbfc
-
-    2021-08-21  Sihui Liu  <sihui_liu@apple.com>
-
-            IndexedDB: crash when triggering IDBOpenRequest completion back on a worker thread
-            https://bugs.webkit.org/show_bug.cgi?id=229375
-
-            Reviewed by Brady Eidson.
-
-            Client may dispatch custom events to an IDBRequest, and we should only change request state based on events
-            created internally.
-
-            * Modules/indexeddb/IDBRequest.cpp:
-            (WebCore::IDBRequest::dispatchEvent):
-
-2021-08-13  Russell Epstein  <repstein@apple.com>
-
-        Cherry-pick r278729. rdar://problem/80310242
-
-    Fix incorrect check in AudioNode.disconnect()
-    https://bugs.webkit.org/show_bug.cgi?id=226818
-    <rdar://problem/79076999>
-    
-    Reviewed by Eric Carlson.
-    
-    * Modules/webaudio/AudioNode.cpp:
-    (WebCore::AudioNode::disconnect):
-    
-    
-    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@278729 268f45cc-cd09-0410-ab3c-d52691b4dbfc
-
-    2021-06-10  Chris Dumez  <cdumez@apple.com>
-
-            Fix incorrect check in AudioNode.disconnect()
-            https://bugs.webkit.org/show_bug.cgi?id=226818
-            <rdar://problem/79076999>
-
-            Reviewed by Eric Carlson.
-
-            * Modules/webaudio/AudioNode.cpp:
-            (WebCore::AudioNode::disconnect):
-
-2021-08-10  Russell Epstein  <repstein@apple.com>
-
-        Apply patch. rdar://problem/79924198
-
-    2021-08-10  Russell Epstein  <repstein@apple.com>
-
-            Deploy smart pointers in EventHandler and UserInputBridge
-            https://bugs.webkit.org/show_bug.cgi?id=227481
-
-            Reviewed by Wenson Hsieh and Chris Dumez..
-
-            * page/EventHandler.cpp:
-            (WebCore::EventHandler::selectClosestWordFromHitTestResult):
-            (WebCore::EventHandler::selectClosestContextualWordFromMouseEvent):
-            (WebCore::EventHandler::selectClosestContextualWordOrLinkFromMouseEvent):
-            (WebCore::EventHandler::handleMousePressEventTripleClick):
-            (WebCore::EventHandler::handleMousePressEventSingleClick):
-            (WebCore::EventHandler::selectionExtentRespectingEditingBoundary):
-            (WebCore::EventHandler::handleMouseDraggedEvent):
-            (WebCore::EventHandler::eventMayStartDrag const):
-            (WebCore::EventHandler::updateSelectionForMouseDrag):
-            (WebCore::EventHandler::handleMouseReleaseEvent):
-            (WebCore::EventHandler::hitTestResultAtPoint const):
-            (WebCore::EventHandler::scrollOverflow):
-            (WebCore::EventHandler::logicalScrollOverflow):
-            (WebCore::EventHandler::scrollRecursively):
-            (WebCore::EventHandler::logicalScrollRecursively):
-            (WebCore::EventHandler::updateCursor):
-            (WebCore::EventHandler::selectCursor):
-            (WebCore::EventHandler::handleMousePressEvent):
-            (WebCore::EventHandler::handleMouseMoveEvent):
-            (WebCore::contentFrameForNode):
-            (WebCore::EventHandler::updateDragAndDrop):
-            (WebCore::EventHandler::cancelDragAndDrop):
-            (WebCore::EventHandler::performDragAndDrop):
-            (WebCore::hierarchyHasCapturingEventListeners):
-            (WebCore::EventHandler::updateMouseEventTargetNode):
-            (WebCore::EventHandler::notifyScrollableAreasOfMouseEvents):
-            (WebCore::EventHandler::dispatchMouseEvent):
-            (WebCore::EventHandler::isInsideScrollbar const):
-            (WebCore::EventHandler::handleWheelEvent):
-            (WebCore::EventHandler::handleWheelEventInternal):
-            (WebCore::EventHandler::sendContextMenuEvent):
-            (WebCore::EventHandler::sendContextMenuEventForKey):
-            (WebCore::EventHandler::fakeMouseMoveEventTimerFired):
-            (WebCore::EventHandler::hoverTimerFired):
-            (WebCore::EventHandler::handleAccessKey):
-            (WebCore::EventHandler::isKeyEventAllowedInFullScreen const):
-            (WebCore::EventHandler::keyEvent):
-            (WebCore::EventHandler::internalKeyEvent):
-            (WebCore::setInitialKeyboardSelection):
-            (WebCore::removeDraggedContentDocumentMarkersFromAllFramesInPage):
-            (WebCore::EventHandler::handleTouchEvent):
-            (WebCore::EventHandler::passWheelEventToWidget):
-            (WebCore::targetIsFrame): Deleted.
-            * replay/UserInputBridge.cpp:
-            (WebCore::UserInputBridge::handleMousePressEvent):
-            (WebCore::UserInputBridge::handleMouseReleaseEvent):
-            (WebCore::UserInputBridge::handleMouseMoveEvent):
-            (WebCore::UserInputBridge::handleMouseMoveOnScrollbarEvent):
-            (WebCore::UserInputBridge::handleMouseForceEvent):
-            (WebCore::UserInputBridge::handleKeyEvent):
-            (WebCore::UserInputBridge::handleAccessKeyEvent):
-            (WebCore::UserInputBridge::handleWheelEvent):
-            (WebCore::UserInputBridge::scrollRecursively):
-            (WebCore::UserInputBridge::logicalScrollRecursively):
-            (WebCore::UserInputBridge::loadRequest):
-            (WebCore::UserInputBridge::tryClosePage):
-
</del><span class="cx"> 2021-07-02  Ruben Turcios  <rubent_22@apple.com>
</span><span class="cx"> 
</span><span class="cx">         Cherry-pick r278964. rdar://problem/79474157
</span></span></pre></div>
<a id="branchessafari6113100branchSourceWebCoreConfigurationsVersionxcconfig"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/WebCore/Configurations/Version.xcconfig (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/WebCore/Configurations/Version.xcconfig 2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/WebCore/Configurations/Version.xcconfig    2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -22,11 +22,11 @@
</span><span class="cx"> // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
</span><span class="cx"> 
</span><span class="cx"> MAJOR_VERSION = 611;
</span><del>-MINOR_VERSION = 4;
-TINY_VERSION = 0;
-MICRO_VERSION = 2;
-NANO_VERSION = 0;
-FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION);
</del><ins>+MINOR_VERSION = 3;
+TINY_VERSION = 10;
+MICRO_VERSION = 0;
+NANO_VERSION = 1;
+FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION).$(NANO_VERSION);
</ins><span class="cx"> 
</span><span class="cx"> // The bundle version and short version string are set based on the current build configuration, see below.
</span><span class="cx"> BUNDLE_VERSION = $(BUNDLE_VERSION_$(CONFIGURATION));
</span></span></pre></div>
<a id="branchessafari6113100branchSourceWebCoreModulesindexeddbIDBRequestcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/WebCore/Modules/indexeddb/IDBRequest.cpp (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/WebCore/Modules/indexeddb/IDBRequest.cpp        2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/WebCore/Modules/indexeddb/IDBRequest.cpp   2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -310,8 +310,7 @@
</span><span class="cx">     else if (m_transaction && !m_transaction->didDispatchAbortOrCommit())
</span><span class="cx">         targets = { this, m_transaction.get(), &m_transaction->database() };
</span><span class="cx"> 
</span><del>-    if (event.isTrusted())
-        m_hasPendingActivity = false;
</del><ins>+    m_hasPendingActivity = false;
</ins><span class="cx"> 
</span><span class="cx">     {
</span><span class="cx">         TransactionActivator activator(m_transaction.get());
</span></span></pre></div>
<a id="branchessafari6113100branchSourceWebCoreModuleswebaudioAudioNodecpp"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/WebCore/Modules/webaudio/AudioNode.cpp (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/WebCore/Modules/webaudio/AudioNode.cpp  2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/WebCore/Modules/webaudio/AudioNode.cpp     2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -312,7 +312,7 @@
</span><span class="cx">     if (outputIndex >= numberOfOutputs())
</span><span class="cx">         return Exception { IndexSizeError, "output index is out of bounds"_s };
</span><span class="cx"> 
</span><del>-    if (inputIndex >= destinationNode.numberOfInputs())
</del><ins>+    if (outputIndex >= destinationNode.numberOfInputs())
</ins><span class="cx">         return Exception { IndexSizeError, "input index is out of bounds"_s };
</span><span class="cx"> 
</span><span class="cx">     auto* output = this->output(outputIndex);
</span></span></pre></div>
<a id="branchessafari6113100branchSourceWebCorePALConfigurationsVersionxcconfig"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/WebCore/PAL/Configurations/Version.xcconfig (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/WebCore/PAL/Configurations/Version.xcconfig     2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/WebCore/PAL/Configurations/Version.xcconfig        2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -22,11 +22,11 @@
</span><span class="cx"> // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
</span><span class="cx"> 
</span><span class="cx"> MAJOR_VERSION = 611;
</span><del>-MINOR_VERSION = 4;
-TINY_VERSION = 0;
-MICRO_VERSION = 2;
-NANO_VERSION = 0;
-FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION);
</del><ins>+MINOR_VERSION = 3;
+TINY_VERSION = 10;
+MICRO_VERSION = 0;
+NANO_VERSION = 1;
+FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION).$(NANO_VERSION);
</ins><span class="cx"> 
</span><span class="cx"> // The bundle version and short version string are set based on the current build configuration, see below.
</span><span class="cx"> BUNDLE_VERSION = $(BUNDLE_VERSION_$(CONFIGURATION));
</span></span></pre></div>
<a id="branchessafari6113100branchSourceWebCorepageEventHandlercpp"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/WebCore/page/EventHandler.cpp (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/WebCore/page/EventHandler.cpp   2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/WebCore/page/EventHandler.cpp      2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -480,7 +480,7 @@
</span><span class="cx"> 
</span><span class="cx"> void EventHandler::selectClosestWordFromHitTestResult(const HitTestResult& result, AppendTrailingWhitespace appendTrailingWhitespace)
</span><span class="cx"> {
</span><del>-    RefPtr targetNode = result.targetNode();
</del><ins>+    Node* targetNode = result.targetNode();
</ins><span class="cx">     VisibleSelection newSelection;
</span><span class="cx"> 
</span><span class="cx">     if (targetNode && targetNode->renderer()) {
</span><span class="lines">@@ -493,7 +493,7 @@
</span><span class="cx">         if (appendTrailingWhitespace == ShouldAppendTrailingWhitespace && newSelection.isRange())
</span><span class="cx">             newSelection.appendTrailingWhitespace();
</span><span class="cx"> 
</span><del>-        updateSelectionForMouseDownDispatchingSelectStart(targetNode.get(), expandSelectionToRespectSelectOnMouseDown(*targetNode, newSelection), TextGranularity::WordGranularity);
</del><ins>+        updateSelectionForMouseDownDispatchingSelectStart(targetNode, expandSelectionToRespectSelectOnMouseDown(*targetNode, newSelection), TextGranularity::WordGranularity);
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -517,7 +517,7 @@
</span><span class="cx">     
</span><span class="cx"> void EventHandler::selectClosestContextualWordFromMouseEvent(const MouseEventWithHitTestResults& mouseEvent)
</span><span class="cx"> {
</span><del>-    RefPtr targetNode = mouseEvent.targetNode();
</del><ins>+    Node* targetNode = mouseEvent.targetNode();
</ins><span class="cx">     const HitTestResult& result = mouseEvent.hitTestResult();
</span><span class="cx">     VisibleSelection newSelection;
</span><span class="cx">     bool appendTrailingWhitespace = shouldAppendTrailingWhitespace(mouseEvent, m_frame);
</span><span class="lines">@@ -535,15 +535,15 @@
</span><span class="cx">         if (appendTrailingWhitespace == ShouldAppendTrailingWhitespace && newSelection.isRange())
</span><span class="cx">             newSelection.appendTrailingWhitespace();
</span><span class="cx">         
</span><del>-        updateSelectionForMouseDownDispatchingSelectStart(targetNode.get(), expandSelectionToRespectSelectOnMouseDown(*targetNode, newSelection), TextGranularity::WordGranularity);
</del><ins>+        updateSelectionForMouseDownDispatchingSelectStart(targetNode, expandSelectionToRespectSelectOnMouseDown(*targetNode, newSelection), TextGranularity::WordGranularity);
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx">     
</span><span class="cx"> void EventHandler::selectClosestContextualWordOrLinkFromMouseEvent(const MouseEventWithHitTestResults& result)
</span><span class="cx"> {
</span><del>-    RefPtr urlElement = result.hitTestResult().URLElement();
</del><ins>+    Element* urlElement = result.hitTestResult().URLElement();
</ins><span class="cx">     if (!urlElement || !isDraggableLink(*urlElement)) {
</span><del>-        if (RefPtr targetNode = result.targetNode()) {
</del><ins>+        if (Node* targetNode = result.targetNode()) {
</ins><span class="cx">             if (isEditableNode(*targetNode))
</span><span class="cx">                 return selectClosestWordFromMouseEvent(result);
</span><span class="cx">         }
</span><span class="lines">@@ -551,15 +551,15 @@
</span><span class="cx">         return selectClosestContextualWordFromMouseEvent(result);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    RefPtr targetNode = result.targetNode();
</del><ins>+    Node* targetNode = result.targetNode();
</ins><span class="cx"> 
</span><span class="cx">     if (targetNode && targetNode->renderer() && mouseDownMayStartSelect()) {
</span><span class="cx">         VisibleSelection newSelection;
</span><span class="cx">         VisiblePosition pos(targetNode->renderer()->positionForPoint(result.localPoint(), nullptr));
</span><span class="cx">         if (pos.isNotNull() && pos.deepEquivalent().deprecatedNode()->isDescendantOf(*urlElement))
</span><del>-            newSelection = VisibleSelection::selectionFromContentsOfNode(urlElement.get());
</del><ins>+            newSelection = VisibleSelection::selectionFromContentsOfNode(urlElement);
</ins><span class="cx"> 
</span><del>-        updateSelectionForMouseDownDispatchingSelectStart(targetNode.get(), expandSelectionToRespectSelectOnMouseDown(*targetNode, newSelection), TextGranularity::WordGranularity);
</del><ins>+        updateSelectionForMouseDownDispatchingSelectStart(targetNode, expandSelectionToRespectSelectOnMouseDown(*targetNode, newSelection), TextGranularity::WordGranularity);
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -586,7 +586,7 @@
</span><span class="cx">     if (event.event().button() != LeftButton)
</span><span class="cx">         return false;
</span><span class="cx">     
</span><del>-    RefPtr targetNode = event.targetNode();
</del><ins>+    Node* targetNode = event.targetNode();
</ins><span class="cx">     if (!(targetNode && targetNode->renderer() && mouseDownMayStartSelect()))
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="lines">@@ -597,7 +597,7 @@
</span><span class="cx">         newSelection.expandUsingGranularity(TextGranularity::ParagraphGranularity);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    return updateSelectionForMouseDownDispatchingSelectStart(targetNode.get(), expandSelectionToRespectSelectOnMouseDown(*targetNode, newSelection), TextGranularity::ParagraphGranularity);
</del><ins>+    return updateSelectionForMouseDownDispatchingSelectStart(targetNode, expandSelectionToRespectSelectOnMouseDown(*targetNode, newSelection), TextGranularity::ParagraphGranularity);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static uint64_t textDistance(const Position& start, const Position& end)
</span><span class="lines">@@ -613,7 +613,7 @@
</span><span class="cx">     Ref<Frame> protectedFrame(m_frame);
</span><span class="cx"> 
</span><span class="cx">     m_frame.document()->updateLayoutIgnorePendingStylesheets();
</span><del>-    RefPtr targetNode = event.targetNode();
</del><ins>+    Node* targetNode = event.targetNode();
</ins><span class="cx">     if (!targetNode || !targetNode->renderer() || !mouseDownMayStartSelect() || m_mouseDownDelegatedFocus)
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="lines">@@ -632,7 +632,7 @@
</span><span class="cx"> 
</span><span class="cx">     VisiblePosition visiblePosition(targetNode->renderer()->positionForPoint(event.localPoint(), nullptr));
</span><span class="cx">     if (visiblePosition.isNull())
</span><del>-        visiblePosition = VisiblePosition(firstPositionInOrBeforeNode(targetNode.get()));
</del><ins>+        visiblePosition = VisiblePosition(firstPositionInOrBeforeNode(targetNode));
</ins><span class="cx">     Position pos = visiblePosition.deepEquivalent();
</span><span class="cx"> 
</span><span class="cx">     VisibleSelection newSelection = m_frame.selection().selection();
</span><span class="lines">@@ -677,7 +677,7 @@
</span><span class="cx">         newSelection = expandSelectionToRespectSelectOnMouseDown(*targetNode, visiblePosition);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    bool handled = updateSelectionForMouseDownDispatchingSelectStart(targetNode.get(), newSelection, granularity);
</del><ins>+    bool handled = updateSelectionForMouseDownDispatchingSelectStart(targetNode, newSelection, granularity);
</ins><span class="cx"> 
</span><span class="cx">     if (event.event().button() == MiddleButton) {
</span><span class="cx">         // Ignore handled, since we want to paste to where the caret was placed anyway.
</span><span class="lines">@@ -796,12 +796,11 @@
</span><span class="cx"> VisiblePosition EventHandler::selectionExtentRespectingEditingBoundary(const VisibleSelection& selection, const LayoutPoint& localPoint, Node* targetNode)
</span><span class="cx"> {
</span><span class="cx">     FloatPoint selectionEndPoint = localPoint;
</span><del>-    RefPtr editableElement = selection.rootEditableElement();
</del><ins>+    Element* editableElement = selection.rootEditableElement();
</ins><span class="cx"> 
</span><span class="cx">     if (!targetNode || !targetNode->renderer())
</span><span class="cx">         return VisiblePosition();
</span><span class="cx"> 
</span><del>-    RefPtr adjustedTarget = targetNode;
</del><span class="cx">     if (editableElement && !editableElement->contains(targetNode)) {
</span><span class="cx">         if (!editableElement->renderer())
</span><span class="cx">             return VisiblePosition();
</span><span class="lines">@@ -808,10 +807,10 @@
</span><span class="cx"> 
</span><span class="cx">         FloatPoint absolutePoint = targetNode->renderer()->localToAbsolute(FloatPoint(selectionEndPoint));
</span><span class="cx">         selectionEndPoint = editableElement->renderer()->absoluteToLocal(absolutePoint);
</span><del>-        adjustedTarget = editableElement;
</del><ins>+        targetNode = editableElement;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><del>-    return adjustedTarget->renderer()->positionForPoint(LayoutPoint(selectionEndPoint), nullptr);
</del><ins>+    return targetNode->renderer()->positionForPoint(LayoutPoint(selectionEndPoint), nullptr);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(DRAG_SUPPORT)
</span><span class="lines">@@ -840,13 +839,13 @@
</span><span class="cx">     if (handleDrag(event, checkDragHysteresis))
</span><span class="cx">         return true;
</span><span class="cx"> 
</span><del>-    RefPtr targetNode = event.targetNode();
</del><ins>+    Node* targetNode = event.targetNode();
</ins><span class="cx">     if (event.event().button() != LeftButton || !targetNode)
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     RenderObject* renderer = targetNode->renderer();
</span><span class="cx">     if (!renderer) {
</span><del>-        RefPtr parent = targetNode->parentOrShadowHostElement();
</del><ins>+        Element* parent = targetNode->parentOrShadowHostElement();
</ins><span class="cx">         if (!parent)
</span><span class="cx">             return false;
</span><span class="cx"> 
</span><span class="lines">@@ -903,8 +902,8 @@
</span><span class="cx">     HitTestResult result(view->windowToContents(event.position()));
</span><span class="cx">     document->hitTest(hitType, result);
</span><span class="cx">     DragState state;
</span><del>-    RefPtr targetElement = result.targetElement();
-    return targetElement && page->dragController().draggableElement(&m_frame, targetElement.get(), result.roundedPointInInnerNodeFrame(), state);
</del><ins>+    Element* targetElement = result.targetElement();
+    return targetElement && page->dragController().draggableElement(&m_frame, targetElement, result.roundedPointInInnerNodeFrame(), state);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void EventHandler::updateSelectionForMouseDrag()
</span><span class="lines">@@ -933,11 +932,11 @@
</span><span class="cx">     if (!mouseDownMayStartSelect())
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    RefPtr target = hitTestResult.targetNode();
</del><ins>+    Node* target = hitTestResult.targetNode();
</ins><span class="cx">     if (!target)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    VisiblePosition targetPosition = selectionExtentRespectingEditingBoundary(m_frame.selection().selection(), hitTestResult.localPoint(), target.get());
</del><ins>+    VisiblePosition targetPosition = selectionExtentRespectingEditingBoundary(m_frame.selection().selection(), hitTestResult.localPoint(), target);
</ins><span class="cx"> 
</span><span class="cx">     // Don't modify the selection if we're not on a node.
</span><span class="cx">     if (targetPosition.isNull())
</span><span class="lines">@@ -949,7 +948,7 @@
</span><span class="cx"> 
</span><span class="cx">     // Special case to limit selection to the containing block for SVG text.
</span><span class="cx">     // FIXME: Isn't there a better non-SVG-specific way to do this?
</span><del>-    if (RefPtr selectionBaseNode = newSelection.base().deprecatedNode()) {
</del><ins>+    if (Node* selectionBaseNode = newSelection.base().deprecatedNode()) {
</ins><span class="cx">         if (RenderObject* selectionBaseRenderer = selectionBaseNode->renderer()) {
</span><span class="cx">             if (selectionBaseRenderer->isSVGText()) {
</span><span class="cx">                 if (target->renderer()->containingBlock() != selectionBaseRenderer->containingBlock())
</span><span class="lines">@@ -959,7 +958,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-    if (m_selectionInitiationState == HaveNotStartedSelection && !dispatchSelectStart(target.get())) {
</del><ins>+    if (m_selectionInitiationState == HaveNotStartedSelection && !dispatchSelectStart(target)) {
</ins><span class="cx">         m_mouseDownMayStartSelect = false;
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="lines">@@ -971,20 +970,20 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(USERSELECT_ALL)
</span><del>-    RefPtr rootUserSelectAllForMousePressNode = Position::rootUserSelectAllForNode(m_mousePressNode.get());
-    if (rootUserSelectAllForMousePressNode && rootUserSelectAllForMousePressNode == Position::rootUserSelectAllForNode(target.get())) {
-        newSelection.setBase(positionBeforeNode(rootUserSelectAllForMousePressNode.get()).upstream(CanCrossEditingBoundary));
-        newSelection.setExtent(positionAfterNode(rootUserSelectAllForMousePressNode.get()).downstream(CanCrossEditingBoundary));
</del><ins>+    Node* rootUserSelectAllForMousePressNode = Position::rootUserSelectAllForNode(m_mousePressNode.get());
+    if (rootUserSelectAllForMousePressNode && rootUserSelectAllForMousePressNode == Position::rootUserSelectAllForNode(target)) {
+        newSelection.setBase(positionBeforeNode(rootUserSelectAllForMousePressNode).upstream(CanCrossEditingBoundary));
+        newSelection.setExtent(positionAfterNode(rootUserSelectAllForMousePressNode).downstream(CanCrossEditingBoundary));
</ins><span class="cx">     } else {
</span><span class="cx">         // Reset base for user select all when base is inside user-select-all area and extent < base.
</span><span class="cx">         if (rootUserSelectAllForMousePressNode && target->renderer()->positionForPoint(hitTestResult.localPoint(), nullptr) < m_mousePressNode->renderer()->positionForPoint(m_dragStartPosition, nullptr))
</span><del>-            newSelection.setBase(positionAfterNode(rootUserSelectAllForMousePressNode.get()).downstream(CanCrossEditingBoundary));
</del><ins>+            newSelection.setBase(positionAfterNode(rootUserSelectAllForMousePressNode).downstream(CanCrossEditingBoundary));
</ins><span class="cx">         
</span><del>-        RefPtr rootUserSelectAllForTarget = Position::rootUserSelectAllForNode(target.get());
</del><ins>+        Node* rootUserSelectAllForTarget = Position::rootUserSelectAllForNode(target);
</ins><span class="cx">         if (rootUserSelectAllForTarget && m_mousePressNode->renderer() && target->renderer()->positionForPoint(hitTestResult.localPoint(), nullptr) < m_mousePressNode->renderer()->positionForPoint(m_dragStartPosition, nullptr))
</span><del>-            newSelection.setExtent(positionBeforeNode(rootUserSelectAllForTarget.get()).upstream(CanCrossEditingBoundary));
</del><ins>+            newSelection.setExtent(positionBeforeNode(rootUserSelectAllForTarget).upstream(CanCrossEditingBoundary));
</ins><span class="cx">         else if (rootUserSelectAllForTarget && m_mousePressNode->renderer())
</span><del>-            newSelection.setExtent(positionAfterNode(rootUserSelectAllForTarget.get()).downstream(CanCrossEditingBoundary));
</del><ins>+            newSelection.setExtent(positionAfterNode(rootUserSelectAllForTarget).downstream(CanCrossEditingBoundary));
</ins><span class="cx">         else
</span><span class="cx">             newSelection.setExtent(targetPosition);
</span><span class="cx">     }
</span><span class="lines">@@ -1052,7 +1051,7 @@
</span><span class="cx">             && m_frame.selection().isRange()
</span><span class="cx">             && event.event().button() != RightButton) {
</span><span class="cx">         VisibleSelection newSelection;
</span><del>-        RefPtr node = event.targetNode();
</del><ins>+        Node* node = event.targetNode();
</ins><span class="cx">         bool caretBrowsing = m_frame.settings().caretBrowsingEnabled();
</span><span class="cx">         bool allowSelectionChanges = true;
</span><span class="cx">         if (node && node->renderer() && (caretBrowsing || node->hasEditableStyle())) {
</span><span class="lines">@@ -1149,10 +1148,12 @@
</span><span class="cx">     // We always send hitTestResultAtPoint to the main frame if we have one,
</span><span class="cx">     // otherwise we might hit areas that are obscured by higher frames.
</span><span class="cx">     if (!m_frame.isMainFrame()) {
</span><del>-        Ref mainFrame = m_frame.mainFrame();
-        if (RefPtr frameView = m_frame.view(), mainView = mainFrame->view(); frameView && mainView) {
</del><ins>+        Frame& mainFrame = m_frame.mainFrame();
+        FrameView* frameView = m_frame.view();
+        FrameView* mainView = mainFrame.view();
+        if (frameView && mainView) {
</ins><span class="cx">             IntPoint mainFramePoint = mainView->rootViewToContents(frameView->contentsToRootView(roundedIntPoint(point)));
</span><del>-            return mainFrame->eventHandler().hitTestResultAtPoint(mainFramePoint, hitType, padding);
</del><ins>+            return mainFrame.eventHandler().hitTestResultAtPoint(mainFramePoint, hitType, padding);
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1160,11 +1161,11 @@
</span><span class="cx">     unsigned nonNegativePaddingHeight = std::max<LayoutUnit>(0, padding.height()).toUnsigned();
</span><span class="cx"> 
</span><span class="cx">     // We should always start hit testing a clean tree.
</span><del>-    if (RefPtr frameView = m_frame.view())
</del><ins>+    if (auto* frameView = m_frame.view())
</ins><span class="cx">         frameView->updateLayoutAndStyleIfNeededRecursive();
</span><span class="cx"> 
</span><span class="cx">     HitTestResult result(point, nonNegativePaddingHeight, nonNegativePaddingWidth, nonNegativePaddingHeight, nonNegativePaddingWidth);
</span><del>-    RefPtr document = m_frame.document();
</del><ins>+    auto* document = m_frame.document();
</ins><span class="cx">     if (!document)
</span><span class="cx">         return result;
</span><span class="cx"> 
</span><span class="lines">@@ -1186,7 +1187,7 @@
</span><span class="cx"> 
</span><span class="cx"> bool EventHandler::scrollOverflow(ScrollDirection direction, ScrollGranularity granularity, Node* startingNode)
</span><span class="cx"> {
</span><del>-    RefPtr node = startingNode;
</del><ins>+    Node* node = startingNode;
</ins><span class="cx"> 
</span><span class="cx">     if (!node)
</span><span class="cx">         node = m_frame.document()->focusedElement();
</span><span class="lines">@@ -1207,7 +1208,7 @@
</span><span class="cx"> 
</span><span class="cx"> bool EventHandler::logicalScrollOverflow(ScrollLogicalDirection direction, ScrollGranularity granularity, Node* startingNode)
</span><span class="cx"> {
</span><del>-    RefPtr node = startingNode;
</del><ins>+    Node* node = startingNode;
</ins><span class="cx"> 
</span><span class="cx">     if (!node)
</span><span class="cx">         node = m_frame.document()->focusedElement();
</span><span class="lines">@@ -1235,8 +1236,8 @@
</span><span class="cx">     m_frame.document()->updateLayoutIgnorePendingStylesheets();
</span><span class="cx">     if (scrollOverflow(direction, granularity, startingNode))
</span><span class="cx">         return true;    
</span><del>-    RefPtr frame = &m_frame;
-    RefPtr view = frame->view();
</del><ins>+    Frame* frame = &m_frame;
+    FrameView* view = frame->view();
</ins><span class="cx">     if (view && view->scroll(direction, granularity))
</span><span class="cx">         return true;
</span><span class="cx">     frame = frame->tree().parent();
</span><span class="lines">@@ -1254,8 +1255,8 @@
</span><span class="cx">     m_frame.document()->updateLayoutIgnorePendingStylesheets();
</span><span class="cx">     if (logicalScrollOverflow(direction, granularity, startingNode))
</span><span class="cx">         return true;    
</span><del>-    RefPtr frame = &m_frame;
-    RefPtr view = frame->view();
</del><ins>+    Frame* frame = &m_frame;
+    FrameView* view = frame->view();
</ins><span class="cx">     
</span><span class="cx">     bool scrolled = false;
</span><span class="cx"> #if PLATFORM(COCOA)
</span><span class="lines">@@ -1364,11 +1365,11 @@
</span><span class="cx">             return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    RefPtr view = m_frame.view();
</del><ins>+    FrameView* view = m_frame.view();
</ins><span class="cx">     if (!view)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    RefPtr document = m_frame.document();
</del><ins>+    auto* document = m_frame.document();
</ins><span class="cx">     if (!document)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="lines">@@ -1419,7 +1420,7 @@
</span><span class="cx">         return pointerCursor();
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    RefPtr node = result.targetNode();
</del><ins>+    Node* node = result.targetNode();
</ins><span class="cx">     if (!node)
</span><span class="cx">         return WTF::nullopt;
</span><span class="cx"> 
</span><span class="lines">@@ -1496,7 +1497,7 @@
</span><span class="cx">     case CursorType::Auto: {
</span><span class="cx">         bool editable = node->hasEditableStyle();
</span><span class="cx"> 
</span><del>-        if (useHandCursor(node.get(), result.isOverLink(), shiftKey))
</del><ins>+        if (useHandCursor(node, result.isOverLink(), shiftKey))
</ins><span class="cx">             return handCursor();
</span><span class="cx"> 
</span><span class="cx">         bool inResizer = false;
</span><span class="lines">@@ -1726,7 +1727,7 @@
</span><span class="cx"> #if ENABLE(PAN_SCROLLING)
</span><span class="cx">     // We store whether pan scrolling is in progress before calling stopAutoscrollTimer()
</span><span class="cx">     // because it will set m_autoscrollType to NoAutoscroll on return.
</span><del>-    bool isPanScrollInProgress = Ref(m_frame.mainFrame())->eventHandler().panScrollInProgress();
</del><ins>+    bool isPanScrollInProgress = m_frame.mainFrame().eventHandler().panScrollInProgress();
</ins><span class="cx">     stopAutoscrollTimer();
</span><span class="cx">     if (isPanScrollInProgress) {
</span><span class="cx">         // We invalidate the click when exiting pan scrolling so that we don't inadvertently navigate
</span><span class="lines">@@ -1995,7 +1996,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (!newSubframe || mouseEvent.scrollbar()) {
</span><del>-        if (RefPtr view = m_frame.view())
</del><ins>+        if (auto* view = m_frame.view())
</ins><span class="cx">             updateCursor(*view, mouseEvent.hitTestResult(), platformMouseEvent.shiftKey());
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -2258,12 +2259,13 @@
</span><span class="cx">     return dragState().source.get();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static std::pair<bool, RefPtr<Frame>> contentFrameForNode(Node* target)
</del><ins>+static bool targetIsFrame(Node* target, Frame*& frame)
</ins><span class="cx"> {
</span><span class="cx">     if (!is<HTMLFrameElementBase>(target))
</span><del>-        return { false, nullptr };
</del><ins>+        return false;
</ins><span class="cx"> 
</span><del>-    return { true, downcast<HTMLFrameElementBase>(*target).contentFrame() };
</del><ins>+    frame = downcast<HTMLFrameElementBase>(*target).contentFrame();
+    return true;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static Optional<DragOperation> convertDropZoneOperationToDragOperation(const String& dragOperation)
</span><span class="lines">@@ -2349,12 +2351,12 @@
</span><span class="cx">     MouseEventWithHitTestResults mouseEvent = prepareMouseEvent(hitType, event);
</span><span class="cx"> 
</span><span class="cx">     RefPtr<Element> newTarget;
</span><del>-    if (RefPtr targetNode = mouseEvent.targetNode()) {
</del><ins>+    if (Node* targetNode = mouseEvent.targetNode()) {
</ins><span class="cx">         // Drag events should never go to non-element nodes (following IE, and proper mouseover/out dispatch)
</span><span class="cx">         if (!is<Element>(*targetNode))
</span><span class="cx">             newTarget = targetNode->parentOrShadowHostElement();
</span><span class="cx">         else
</span><del>-            newTarget = static_pointer_cast<Element>(WTFMove(targetNode));
</del><ins>+            newTarget = downcast<Element>(targetNode);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     m_autoscrollController->updateDragAndDrop(newTarget.get(), event.position(), event.timestamp());
</span><span class="lines">@@ -2366,7 +2368,8 @@
</span><span class="cx">         // LayoutTests/fast/events/drag-in-frames.html.
</span><span class="cx">         //
</span><span class="cx">         // Moreover, this ordering conforms to section 7.9.4 of the HTML 5 spec. <http://dev.w3.org/html5/spec/Overview.html#drag-and-drop-processing-model>.
</span><del>-        if (auto [isFrameOwner, targetFrame] = contentFrameForNode(newTarget.get()); isFrameOwner) {
</del><ins>+        Frame* targetFrame;
+        if (targetIsFrame(newTarget.get(), targetFrame)) {
</ins><span class="cx">             if (targetFrame)
</span><span class="cx">                 response = targetFrame->eventHandler().updateDragAndDrop(event, makePasteboard, sourceOperationMask, draggingFiles);
</span><span class="cx">         } else if (newTarget) {
</span><span class="lines">@@ -2375,7 +2378,7 @@
</span><span class="cx">             response = dispatchDragEnterOrDragOverEvent(eventNames().dragenterEvent, *newTarget, event, makePasteboard(), sourceOperationMask, draggingFiles);
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        if (auto [isFrameOwner, targetFrame] = contentFrameForNode(m_dragTarget.get()); isFrameOwner) {
</del><ins>+        if (targetIsFrame(m_dragTarget.get(), targetFrame)) {
</ins><span class="cx">             // FIXME: Recursing again here doesn't make sense if the newTarget and m_dragTarget were in the same frame.
</span><span class="cx">             if (targetFrame)
</span><span class="cx">                 response = targetFrame->eventHandler().updateDragAndDrop(event, makePasteboard, sourceOperationMask, draggingFiles);
</span><span class="lines">@@ -2391,7 +2394,8 @@
</span><span class="cx">             m_shouldOnlyFireDragOverEvent = true;
</span><span class="cx">         }
</span><span class="cx">     } else {
</span><del>-        if (auto [isFrameOwner, targetFrame] = contentFrameForNode(newTarget.get()); isFrameOwner) {
</del><ins>+        Frame* targetFrame;
+        if (targetIsFrame(newTarget.get(), targetFrame)) {
</ins><span class="cx">             if (targetFrame)
</span><span class="cx">                 response = targetFrame->eventHandler().updateDragAndDrop(event, makePasteboard, sourceOperationMask, draggingFiles);
</span><span class="cx">         } else if (newTarget) {
</span><span class="lines">@@ -2410,7 +2414,8 @@
</span><span class="cx"> {
</span><span class="cx">     Ref<Frame> protectedFrame(m_frame);
</span><span class="cx"> 
</span><del>-    if (auto [isFrameOwner, targetFrame] = contentFrameForNode(m_dragTarget.get()); isFrameOwner) {
</del><ins>+    Frame* targetFrame;
+    if (targetIsFrame(m_dragTarget.get(), targetFrame)) {
</ins><span class="cx">         if (targetFrame)
</span><span class="cx">             targetFrame->eventHandler().cancelDragAndDrop(event, WTFMove(pasteboard), sourceOperationMask, draggingFiles);
</span><span class="cx">     } else if (m_dragTarget) {
</span><span class="lines">@@ -2427,8 +2432,9 @@
</span><span class="cx"> {
</span><span class="cx">     Ref<Frame> protectedFrame(m_frame);
</span><span class="cx"> 
</span><ins>+    Frame* targetFrame;
</ins><span class="cx">     bool preventedDefault = false;
</span><del>-    if (auto [isFrameOwner, targetFrame] = contentFrameForNode(m_dragTarget.get()); isFrameOwner) {
</del><ins>+    if (targetIsFrame(m_dragTarget.get(), targetFrame)) {
</ins><span class="cx">         if (targetFrame)
</span><span class="cx">             preventedDefault = targetFrame->eventHandler().performDragAndDrop(event, WTFMove(pasteboard), sourceOperationMask, draggingFiles);
</span><span class="cx">     } else if (m_dragTarget) {
</span><span class="lines">@@ -2480,7 +2486,7 @@
</span><span class="cx"> 
</span><span class="cx"> static bool hierarchyHasCapturingEventListeners(Element* element, const AtomString& pointerEventName, const AtomString& compatibilityMouseEventName)
</span><span class="cx"> {
</span><del>-    for (RefPtr<ContainerNode> curr = element; curr; curr = curr->parentInComposedTree()) {
</del><ins>+    for (ContainerNode* curr = element; curr; curr = curr->parentInComposedTree()) {
</ins><span class="cx">         if (curr->hasCapturingEventListeners(pointerEventName) || curr->hasCapturingEventListeners(compatibilityMouseEventName))
</span><span class="cx">             return true;
</span><span class="cx">     }
</span><span class="lines">@@ -2490,7 +2496,7 @@
</span><span class="cx"> void EventHandler::updateMouseEventTargetNode(const AtomString& eventType, Node* targetNode, const PlatformMouseEvent& platformMouseEvent, FireMouseOverOut fireMouseOverOut)
</span><span class="cx"> {
</span><span class="cx">     Ref<Frame> protectedFrame(m_frame);
</span><del>-    RefPtr<Element> targetElement;
</del><ins>+    Element* targetElement = nullptr;
</ins><span class="cx">     
</span><span class="cx">     // If we're capturing, we always go right to that element.
</span><span class="cx">     if (m_capturingMouseEventsElement)
</span><span class="lines">@@ -2568,8 +2574,7 @@
</span><span class="cx"> 
</span><span class="cx"> void EventHandler::notifyScrollableAreasOfMouseEvents(const AtomString& eventType, Element* lastElementUnderMouse, Element* elementUnderMouse)
</span><span class="cx"> {
</span><del>-    Ref protectedFrame = m_frame;
-    RefPtr frameView = m_frame.view();
</del><ins>+    auto* frameView = m_frame.view();
</ins><span class="cx">     if (!frameView)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="lines">@@ -2646,7 +2651,7 @@
</span><span class="cx">     m_mouseDownDelegatedFocus = false;
</span><span class="cx"> 
</span><span class="cx">     // If clicking on a frame scrollbar, do not make any change to which element is focused.
</span><del>-    RefPtr view = m_frame.view();
</del><ins>+    auto* view = m_frame.view();
</ins><span class="cx">     if (view && view->scrollbarAtPoint(platformMouseEvent.position()))
</span><span class="cx">         return true;
</span><span class="cx"> 
</span><span class="lines">@@ -2661,7 +2666,7 @@
</span><span class="cx">     // Walk up the DOM tree to search for an element to focus.
</span><span class="cx">     RefPtr<Element> element;
</span><span class="cx">     for (element = m_elementUnderMouse.get(); element; element = element->parentElementInComposedTree()) {
</span><del>-        if (RefPtr shadowRoot = element->shadowRoot()) {
</del><ins>+        if (auto* shadowRoot = element->shadowRoot()) {
</ins><span class="cx">             if (shadowRoot->delegatesFocus()) {
</span><span class="cx">                 element = findFirstMouseFocusableElementInComposedTree(*element);
</span><span class="cx">                 m_mouseDownDelegatedFocus = true;
</span><span class="lines">@@ -2700,7 +2705,7 @@
</span><span class="cx"> 
</span><span class="cx"> bool EventHandler::isInsideScrollbar(const IntPoint& windowPoint) const
</span><span class="cx"> {
</span><del>-    if (RefPtr document = m_frame.document()) {
</del><ins>+    if (auto* document = m_frame.document()) {
</ins><span class="cx">         HitTestResult result { windowPoint };
</span><span class="cx">         document->hitTest(OptionSet<HitTestRequest::RequestType> { HitTestRequest::ReadOnly, HitTestRequest::DisallowUserAgentShadowContent }, result);
</span><span class="cx">         return result.scrollbar();
</span><span class="lines">@@ -2821,7 +2826,6 @@
</span><span class="cx"> 
</span><span class="cx"> bool EventHandler::handleWheelEvent(const PlatformWheelEvent& wheelEvent, OptionSet<WheelEventProcessingSteps> processingSteps)
</span><span class="cx"> {
</span><del>-    Ref protectedFrame = m_frame;
</del><span class="cx"> #if ENABLE(KINETIC_SCROLLING)
</span><span class="cx">     if (wheelEvent.isGestureStart())
</span><span class="cx">         m_wheelScrollGestureState = WTF::nullopt;
</span><span class="lines">@@ -2836,13 +2840,14 @@
</span><span class="cx"> 
</span><span class="cx"> bool EventHandler::handleWheelEventInternal(const PlatformWheelEvent& event, OptionSet<WheelEventProcessingSteps> processingSteps, OptionSet<EventHandling>& handling)
</span><span class="cx"> {
</span><del>-    RefPtr document = m_frame.document();
</del><ins>+    auto* document = m_frame.document();
</ins><span class="cx">     if (!document)
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     Ref<Frame> protectedFrame(m_frame);
</span><ins>+    RefPtr<FrameView> protector(m_frame.view());
</ins><span class="cx"> 
</span><del>-    RefPtr view = m_frame.view();
</del><ins>+    FrameView* view = m_frame.view();
</ins><span class="cx">     if (!view)
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="lines">@@ -3101,8 +3106,8 @@
</span><span class="cx"> {
</span><span class="cx">     Ref<Frame> protectedFrame(m_frame);
</span><span class="cx"> 
</span><del>-    RefPtr doc = m_frame.document();
-    RefPtr view = m_frame.view();
</del><ins>+    Document* doc = m_frame.document();
+    FrameView* view = m_frame.view();
</ins><span class="cx">     if (!view)
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="lines">@@ -3139,11 +3144,11 @@
</span><span class="cx"> {
</span><span class="cx">     Ref<Frame> protectedFrame(m_frame);
</span><span class="cx"> 
</span><del>-    RefPtr view = m_frame.view();
</del><ins>+    FrameView* view = m_frame.view();
</ins><span class="cx">     if (!view)
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><del>-    RefPtr doc = m_frame.document();
</del><ins>+    Document* doc = m_frame.document();
</ins><span class="cx">     if (!doc)
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="lines">@@ -3159,7 +3164,7 @@
</span><span class="cx"> #endif
</span><span class="cx">     IntPoint location;
</span><span class="cx"> 
</span><del>-    RefPtr focusedElement = doc->focusedElement();
</del><ins>+    Element* focusedElement = doc->focusedElement();
</ins><span class="cx">     const VisibleSelection& selection = m_frame.selection().selection();
</span><span class="cx">     Position start = selection.start();
</span><span class="cx"> 
</span><span class="lines">@@ -3188,13 +3193,13 @@
</span><span class="cx">     IntPoint position = view->contentsToRootView(location);
</span><span class="cx">     IntPoint globalPosition = view->hostWindow()->rootViewToScreen(IntRect(position, IntSize())).location();
</span><span class="cx"> 
</span><del>-    RefPtr<Node> targetNode = doc->focusedElement();
</del><ins>+    Node* targetNode = doc->focusedElement();
</ins><span class="cx">     if (!targetNode)
</span><span class="cx">         targetNode = doc;
</span><span class="cx"> 
</span><span class="cx">     // Use the focused node as the target for hover and active.
</span><span class="cx">     HitTestResult result(position);
</span><del>-    result.setInnerNode(targetNode.get());
</del><ins>+    result.setInnerNode(targetNode);
</ins><span class="cx">     doc->updateHoverActiveState(OptionSet<HitTestRequest::RequestType> { HitTestRequest::Active, HitTestRequest::DisallowUserAgentShadowContent }, result.targetElement());
</span><span class="cx"> 
</span><span class="cx">     // The contextmenu event is a mouse event even when invoked using the keyboard.
</span><span class="lines">@@ -3284,8 +3289,8 @@
</span><span class="cx"> {
</span><span class="cx">     ASSERT(!m_mousePressed);
</span><span class="cx"> 
</span><del>-    Ref protectedFrame = m_frame;
-    if (!m_frame.view())
</del><ins>+    FrameView* view = m_frame.view();
+    if (!view)
</ins><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     if (!m_frame.page() || !m_frame.page()->isVisible() || !m_frame.page()->focusController().isActive())
</span><span class="lines">@@ -3320,8 +3325,8 @@
</span><span class="cx"> 
</span><span class="cx">     Ref<Frame> protectedFrame(m_frame);
</span><span class="cx"> 
</span><del>-    if (RefPtr document = m_frame.document()) {
-        if (RefPtr view = m_frame.view()) {
</del><ins>+    if (auto* document = m_frame.document()) {
+        if (FrameView* view = m_frame.view()) {
</ins><span class="cx">             HitTestResult result(view->windowToContents(m_lastKnownMousePosition));
</span><span class="cx">             constexpr OptionSet<HitTestRequest::RequestType> hitType { HitTestRequest::Move, HitTestRequest::DisallowUserAgentShadowContent };
</span><span class="cx">             document->hitTest(hitType, result);
</span><span class="lines">@@ -3332,7 +3337,6 @@
</span><span class="cx"> 
</span><span class="cx"> bool EventHandler::handleAccessKey(const PlatformKeyboardEvent& event)
</span><span class="cx"> {
</span><del>-    Ref protectedFrame = m_frame;
</del><span class="cx">     // FIXME: Ignoring the state of Shift key is what neither IE nor Firefox do.
</span><span class="cx">     // IE matches lower and upper case access keys regardless of Shift key state - but if both upper and
</span><span class="cx">     // lower case variants are present in a document, the correct element is matched based on Shift key state.
</span><span class="lines">@@ -3358,7 +3362,7 @@
</span><span class="cx"> #if ENABLE(FULLSCREEN_API)
</span><span class="cx"> bool EventHandler::isKeyEventAllowedInFullScreen(const PlatformKeyboardEvent& keyEvent) const
</span><span class="cx"> {
</span><del>-    RefPtr document = m_frame.document();
</del><ins>+    Document* document = m_frame.document();
</ins><span class="cx">     if (document->fullscreenManager().isFullscreenKeyboardInputAllowed())
</span><span class="cx">         return true;
</span><span class="cx"> 
</span><span class="lines">@@ -3379,8 +3383,7 @@
</span><span class="cx"> 
</span><span class="cx"> bool EventHandler::keyEvent(const PlatformKeyboardEvent& keyEvent)
</span><span class="cx"> {
</span><del>-    Ref protectedFrame = m_frame;
-    RefPtr topDocument = m_frame.document() ? &m_frame.document()->topDocument() : nullptr;
</del><ins>+    Document* topDocument = m_frame.document() ? &m_frame.document()->topDocument() : nullptr;
</ins><span class="cx">     MonotonicTime savedLastHandledUserGestureTimestamp;
</span><span class="cx">     bool savedUserDidInteractWithPage = topDocument ? topDocument->userDidInteractWithPage() : false;
</span><span class="cx"> 
</span><span class="lines">@@ -3447,7 +3450,7 @@
</span><span class="cx">         capsLockStateMayHaveChanged();
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(PAN_SCROLLING)
</span><del>-    if (Ref(m_frame.mainFrame())->eventHandler().panScrollInProgress()) {
</del><ins>+    if (m_frame.mainFrame().eventHandler().panScrollInProgress()) {
</ins><span class="cx">         // If a key is pressed while the panScroll is in progress then we want to stop
</span><span class="cx">         if (initialKeyEvent.type() == PlatformEvent::KeyDown || initialKeyEvent.type() == PlatformEvent::RawKeyDown)
</span><span class="cx">             stopAutoscrollTimer();
</span><span class="lines">@@ -3585,7 +3588,7 @@
</span><span class="cx"> 
</span><span class="cx"> static void setInitialKeyboardSelection(Frame& frame, SelectionDirection direction)
</span><span class="cx"> {
</span><del>-    RefPtr document = frame.document();
</del><ins>+    Document* document = frame.document();
</ins><span class="cx">     if (!document)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="lines">@@ -3594,7 +3597,7 @@
</span><span class="cx">     if (!selection.isNone())
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    RefPtr focusedElement = document->focusedElement();
</del><ins>+    Element* focusedElement = document->focusedElement();
</ins><span class="cx">     VisiblePosition visiblePosition;
</span><span class="cx"> 
</span><span class="cx">     switch (direction) {
</span><span class="lines">@@ -3601,16 +3604,16 @@
</span><span class="cx">     case SelectionDirection::Backward:
</span><span class="cx">     case SelectionDirection::Left:
</span><span class="cx">         if (focusedElement)
</span><del>-            visiblePosition = VisiblePosition(positionBeforeNode(focusedElement.get()));
</del><ins>+            visiblePosition = VisiblePosition(positionBeforeNode(focusedElement));
</ins><span class="cx">         else
</span><del>-            visiblePosition = endOfDocument(document.get());
</del><ins>+            visiblePosition = endOfDocument(document);
</ins><span class="cx">         break;
</span><span class="cx">     case SelectionDirection::Forward:
</span><span class="cx">     case SelectionDirection::Right:
</span><span class="cx">         if (focusedElement)
</span><del>-            visiblePosition = VisiblePosition(positionAfterNode(focusedElement.get()));
</del><ins>+            visiblePosition = VisiblePosition(positionAfterNode(focusedElement));
</ins><span class="cx">         else
</span><del>-            visiblePosition = startOfDocument(document.get());
</del><ins>+            visiblePosition = startOfDocument(document);
</ins><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -3770,8 +3773,8 @@
</span><span class="cx"> 
</span><span class="cx"> static void removeDraggedContentDocumentMarkersFromAllFramesInPage(Page& page)
</span><span class="cx"> {
</span><del>-    for (RefPtr frame = &page.mainFrame(); frame; frame = frame->tree().traverseNext()) {
-        if (RefPtr document = frame->document())
</del><ins>+    for (Frame* frame = &page.mainFrame(); frame; frame = frame->tree().traverseNext()) {
+        if (auto* document = frame->document())
</ins><span class="cx">             document->markers().removeMarkers(DocumentMarker::DraggedContent);
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -4349,16 +4352,15 @@
</span><span class="cx">             if (freshTouchEvents) {
</span><span class="cx">                 result = hitTestResultAtPoint(pagePoint, hitType | HitTestRequest::AllowChildFrameContent);
</span><span class="cx">                 m_originatingTouchPointTargetKey = touchPointTargetKey;
</span><del>-            } else if (m_originatingTouchPointDocument && m_originatingTouchPointDocument->frame()) {
-                Ref frame = *m_originatingTouchPointDocument->frame();
-                LayoutPoint pagePointInOriginatingDocument = documentPointForWindowPoint(frame.get(), point.pos());
-                result = hitTestResultInFrame(frame.ptr(), pagePointInOriginatingDocument, hitType);
</del><ins>+            } else if (m_originatingTouchPointDocument.get() && m_originatingTouchPointDocument->frame()) {
+                LayoutPoint pagePointInOriginatingDocument = documentPointForWindowPoint(*m_originatingTouchPointDocument->frame(), point.pos());
+                result = hitTestResultInFrame(m_originatingTouchPointDocument->frame(), pagePointInOriginatingDocument, hitType);
</ins><span class="cx">                 if (!result.innerNode())
</span><span class="cx">                     continue;
</span><span class="cx">             } else
</span><span class="cx">                 continue;
</span><span class="cx"> 
</span><del>-            RefPtr element = result.targetElement();
</del><ins>+            Element* element = result.targetElement();
</ins><span class="cx">             ASSERT(element);
</span><span class="cx"> 
</span><span class="cx">             if (element && InspectorInstrumentation::handleTouchEvent(m_frame, *element))
</span><span class="lines">@@ -4393,7 +4395,7 @@
</span><span class="cx">         auto& document = downcast<Node>(*touchTarget).document();
</span><span class="cx">         if (!document.hasTouchEventHandlers())
</span><span class="cx">             continue;
</span><del>-        RefPtr targetFrame = document.frame();
</del><ins>+        auto* targetFrame = document.frame();
</ins><span class="cx">         if (!targetFrame)
</span><span class="cx">             continue;
</span><span class="cx"> 
</span><span class="lines">@@ -4407,7 +4409,7 @@
</span><span class="cx">         int adjustedPageX = lroundf(pagePoint.x() / scaleFactor);
</span><span class="cx">         int adjustedPageY = lroundf(pagePoint.y() / scaleFactor);
</span><span class="cx"> 
</span><del>-        auto touch = Touch::create(targetFrame.get(), touchTarget.get(), point.id(),
</del><ins>+        auto touch = Touch::create(targetFrame, touchTarget.get(), point.id(),
</ins><span class="cx">             point.screenPos().x(), point.screenPos().y(), adjustedPageX, adjustedPageY,
</span><span class="cx">             point.radiusX(), point.radiusY(), point.rotationAngle(), point.force());
</span><span class="cx"> 
</span><span class="lines">@@ -4534,7 +4536,7 @@
</span><span class="cx">     if (!is<FrameView>(widget))
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><del>-    return Ref(downcast<FrameView>(widget).frame())->eventHandler().handleWheelEvent(event, processingSteps);
</del><ins>+    return downcast<FrameView>(widget).frame().eventHandler().handleWheelEvent(event, processingSteps);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool EventHandler::tabsToAllFormControls(KeyboardEvent*) const
</span></span></pre></div>
<a id="branchessafari6113100branchSourceWebCorepagePointerCaptureControllercpp"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/WebCore/page/PointerCaptureController.cpp (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/WebCore/page/PointerCaptureController.cpp       2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/WebCore/page/PointerCaptureController.cpp  2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -49,8 +49,9 @@
</span><span class="cx"> 
</span><span class="cx"> Element* PointerCaptureController::pointerCaptureElement(Document* document, PointerID pointerId) const
</span><span class="cx"> {
</span><del>-    if (auto capturingData = m_activePointerIdsToCapturingData.get(pointerId)) {
-        auto pointerCaptureElement = capturingData->targetOverride;
</del><ins>+    auto iterator = m_activePointerIdsToCapturingData.find(pointerId);
+    if (iterator != m_activePointerIdsToCapturingData.end()) {
+        auto pointerCaptureElement = iterator->value.targetOverride;
</ins><span class="cx">         if (pointerCaptureElement && &pointerCaptureElement->document() == document)
</span><span class="cx">             return pointerCaptureElement.get();
</span><span class="cx">     }
</span><span class="lines">@@ -62,8 +63,8 @@
</span><span class="cx">     // https://w3c.github.io/pointerevents/#setting-pointer-capture
</span><span class="cx"> 
</span><span class="cx">     // 1. If the pointerId provided as the method's argument does not match any of the active pointers, then throw a DOMException with the name NotFoundError.
</span><del>-    RefPtr capturingData = m_activePointerIdsToCapturingData.get(pointerId);
-    if (!capturingData)
</del><ins>+    auto iterator = m_activePointerIdsToCapturingData.find(pointerId);
+    if (iterator == m_activePointerIdsToCapturingData.end())
</ins><span class="cx">         return Exception { NotFoundError };
</span><span class="cx"> 
</span><span class="cx">     // 2. If the Element on which this method is invoked is not connected, throw an exception with the name InvalidStateError.
</span><span class="lines">@@ -80,8 +81,9 @@
</span><span class="cx"> 
</span><span class="cx">     // 4. If the pointer is not in the active buttons state, then terminate these steps.
</span><span class="cx">     // 5. For the specified pointerId, set the pending pointer capture target override to the Element on which this method was invoked.
</span><del>-    if (capturingData->pointerIsPressed)
-        capturingData->pendingTargetOverride = capturingTarget;
</del><ins>+    auto& capturingData = iterator->value;
+    if (capturingData.pointerIsPressed)
+        capturingData.pendingTargetOverride = capturingTarget;
</ins><span class="cx"> 
</span><span class="cx">     updateHaveAnyCapturingElement();
</span><span class="cx">     return { };
</span><span class="lines">@@ -96,8 +98,8 @@
</span><span class="cx"> 
</span><span class="cx">     // 1. If the pointerId provided as the method's argument does not match any of the active pointers and these steps are not
</span><span class="cx">     // being invoked as a result of the implicit release of pointer capture, then throw a DOMException with the name NotFoundError.
</span><del>-    RefPtr capturingData = m_activePointerIdsToCapturingData.get(pointerId);
-    if (!capturingData)
</del><ins>+    auto iterator = m_activePointerIdsToCapturingData.find(pointerId);
+    if (iterator == m_activePointerIdsToCapturingData.end())
</ins><span class="cx">         return Exception { NotFoundError };
</span><span class="cx"> 
</span><span class="cx">     // 2. If hasPointerCapture is false for the Element with the specified pointerId, then terminate these steps.
</span><span class="lines">@@ -105,7 +107,7 @@
</span><span class="cx">         return { };
</span><span class="cx"> 
</span><span class="cx">     // 3. For the specified pointerId, clear the pending pointer capture target override, if set.
</span><del>-    capturingData->pendingTargetOverride = nullptr;
</del><ins>+    iterator->value.pendingTargetOverride = nullptr;
</ins><span class="cx">     
</span><span class="cx">     // FIXME: This leaves value.targetOverride set: webkit.org/b/221342.
</span><span class="cx"> 
</span><span class="lines">@@ -124,8 +126,8 @@
</span><span class="cx">     if (!m_haveAnyCapturingElement)
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><del>-    auto capturingData = m_activePointerIdsToCapturingData.get(pointerId);
-    return capturingData && capturingData->pendingTargetOverride == capturingTarget;
</del><ins>+    auto iterator = m_activePointerIdsToCapturingData.find(pointerId);
+    return iterator != m_activePointerIdsToCapturingData.end() && iterator->value.pendingTargetOverride == capturingTarget;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void PointerCaptureController::pointerLockWasApplied()
</span><span class="lines">@@ -135,8 +137,8 @@
</span><span class="cx">     // When a pointer lock is successfully applied on an element, a user agent MUST run the steps as if the releasePointerCapture()
</span><span class="cx">     // method has been called if any element is set to be captured or pending to be captured.
</span><span class="cx">     for (auto& capturingData : m_activePointerIdsToCapturingData.values()) {
</span><del>-        capturingData->pendingTargetOverride = nullptr;
-        capturingData->targetOverride = nullptr;
</del><ins>+        capturingData.pendingTargetOverride = nullptr;
+        capturingData.targetOverride = nullptr;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     updateHaveAnyCapturingElement();
</span><span class="lines">@@ -147,14 +149,16 @@
</span><span class="cx">     if (!m_haveAnyCapturingElement)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    for (auto [pointerId, capturingData] : m_activePointerIdsToCapturingData) {
-        if (capturingData->pendingTargetOverride == &element || capturingData->targetOverride == &element) {
</del><ins>+    for (auto& keyAndValue : m_activePointerIdsToCapturingData) {
+        auto& capturingData = keyAndValue.value;
+        if (capturingData.pendingTargetOverride == &element || capturingData.targetOverride == &element) {
</ins><span class="cx">             // https://w3c.github.io/pointerevents/#implicit-release-of-pointer-capture
</span><span class="cx">             // When the pointer capture target override is no longer connected, the pending pointer capture target override and pointer capture target
</span><span class="cx">             // override nodes SHOULD be cleared and also a PointerEvent named lostpointercapture corresponding to the captured pointer SHOULD be fired
</span><span class="cx">             // at the document.
</span><del>-            ASSERT(isInBounds<PointerID>(pointerId));
-            auto pointerType = capturingData->pointerType;
</del><ins>+            ASSERT(isInBounds<PointerID>(keyAndValue.key));
+            auto pointerId = static_cast<PointerID>(keyAndValue.key);
+            auto pointerType = capturingData.pointerType;
</ins><span class="cx">             releasePointerCapture(&element, pointerId);
</span><span class="cx">             // FIXME: Spec doesn't specify which task source to use.
</span><span class="cx">             element.document().queueTaskToDispatchEvent(TaskSource::UserInteraction, PointerEvent::create(eventNames().lostpointercaptureEvent, pointerId, pointerType));
</span><span class="lines">@@ -168,13 +172,15 @@
</span><span class="cx">     m_activePointerIdsToCapturingData.clear();
</span><span class="cx">     m_haveAnyCapturingElement = false;
</span><span class="cx"> 
</span><del>-    m_activePointerIdsToCapturingData.add(mousePointerID, CapturingData::create(PointerEvent::mousePointerType()));
</del><ins>+    CapturingData capturingData;
+    capturingData.pointerType = PointerEvent::mousePointerType();
+    m_activePointerIdsToCapturingData.add(mousePointerID, capturingData);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void PointerCaptureController::updateHaveAnyCapturingElement()
</span><span class="cx"> {
</span><span class="cx">     m_haveAnyCapturingElement = WTF::anyOf(m_activePointerIdsToCapturingData.values(), [&](auto& capturingData) {
</span><del>-        return capturingData->hasAnyElement();
</del><ins>+        return capturingData.hasAnyElement();
</ins><span class="cx">     });
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -186,21 +192,21 @@
</span><span class="cx"> 
</span><span class="cx"> bool PointerCaptureController::hasCancelledPointerEventForIdentifier(PointerID pointerId) const
</span><span class="cx"> {
</span><del>-    RefPtr capturingData = m_activePointerIdsToCapturingData.get(pointerId);
-    return capturingData && capturingData->cancelled;
</del><ins>+    auto iterator = m_activePointerIdsToCapturingData.find(pointerId);
+    return iterator != m_activePointerIdsToCapturingData.end() && iterator->value.cancelled;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool PointerCaptureController::preventsCompatibilityMouseEventsForIdentifier(PointerID pointerId) const
</span><span class="cx"> {
</span><del>-    RefPtr capturingData = m_activePointerIdsToCapturingData.get(pointerId);
-    return capturingData && capturingData->preventsCompatibilityMouseEvents;
</del><ins>+    auto iterator = m_activePointerIdsToCapturingData.find(pointerId);
+    return iterator != m_activePointerIdsToCapturingData.end() && iterator->value.preventsCompatibilityMouseEvents;
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(TOUCH_EVENTS) && PLATFORM(IOS_FAMILY)
</span><span class="cx"> static bool hierarchyHasCapturingEventListeners(Element* target, const AtomString& eventName)
</span><span class="cx"> {
</span><del>-    for (RefPtr<ContainerNode> currentNode = target; currentNode; currentNode = currentNode->parentInComposedTree()) {
-        if (currentNode->hasCapturingEventListeners(eventName))
</del><ins>+    for (ContainerNode* curr = target; curr; curr = curr->parentInComposedTree()) {
+        if (curr->hasCapturingEventListeners(eventName))
</ins><span class="cx">             return true;
</span><span class="cx">     }
</span><span class="cx">     return false;
</span><span class="lines">@@ -208,16 +214,18 @@
</span><span class="cx"> 
</span><span class="cx"> void PointerCaptureController::dispatchEventForTouchAtIndex(EventTarget& target, const PlatformTouchEvent& platformTouchEvent, unsigned index, bool isPrimary, WindowProxy& view)
</span><span class="cx"> {
</span><del>-    RELEASE_ASSERT(is<Element>(target));
</del><ins>+    ASSERT(is<Element>(target));
</ins><span class="cx"> 
</span><span class="cx">     auto dispatchOverOrOutEvent = [&](const String& type, EventTarget* target) {
</span><span class="cx">         dispatchEvent(PointerEvent::create(type, platformTouchEvent, index, isPrimary, view), target);
</span><span class="cx">     };
</span><span class="cx"> 
</span><del>-    auto dispatchEnterOrLeaveEvent = [&](const String& type, Element& targetElement) {
</del><ins>+    auto dispatchEnterOrLeaveEvent = [&](const String& type) {
+        auto* targetElement = &downcast<Element>(target);
+
</ins><span class="cx">         bool hasCapturingListenerInHierarchy = false;
</span><del>-        for (RefPtr<ContainerNode> currentNode = &targetElement; currentNode; currentNode = currentNode->parentInComposedTree()) {
-            if (currentNode->hasCapturingEventListeners(type)) {
</del><ins>+        for (ContainerNode* curr = targetElement; curr; curr = curr->parentInComposedTree()) {
+            if (curr->hasCapturingEventListeners(type)) {
</ins><span class="cx">                 hasCapturingListenerInHierarchy = true;
</span><span class="cx">                 break;
</span><span class="cx">             }
</span><span class="lines">@@ -224,7 +232,7 @@
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         Vector<Ref<Element>, 32> targetChain;
</span><del>-        for (RefPtr element = &targetElement; element; element = element->parentElementInComposedTree()) {
</del><ins>+        for (Element* element = targetElement; element; element = element->parentElementInComposedTree()) {
</ins><span class="cx">             if (hasCapturingListenerInHierarchy || element->hasEventListeners(type))
</span><span class="cx">                 targetChain.append(*element);
</span><span class="cx">         }
</span><span class="lines">@@ -240,13 +248,13 @@
</span><span class="cx"> 
</span><span class="cx">     auto pointerEvent = PointerEvent::create(platformTouchEvent, index, isPrimary, view);
</span><span class="cx"> 
</span><del>-    Ref capturingData = ensureCapturingDataForPointerEvent(pointerEvent);
</del><ins>+    auto& capturingData = ensureCapturingDataForPointerEvent(pointerEvent);
</ins><span class="cx"> 
</span><span class="cx">     // Check if the target changed, which would require dispatching boundary events.
</span><del>-    RefPtr<Element> previousTarget = capturingData->previousTarget;
</del><ins>+    RefPtr<Element> previousTarget = capturingData.previousTarget;
</ins><span class="cx">     RefPtr<Element> currentTarget = downcast<Element>(&target);
</span><span class="cx"> 
</span><del>-    capturingData->previousTarget = currentTarget;
</del><ins>+    capturingData.previousTarget = currentTarget;
</ins><span class="cx"> 
</span><span class="cx">     if (pointerEvent->type() == eventNames().pointermoveEvent && previousTarget != currentTarget) {
</span><span class="cx">         // The pointerenter and pointerleave events are only dispatched if there is a capturing event listener on an ancestor
</span><span class="lines">@@ -257,10 +265,10 @@
</span><span class="cx">         bool hasCapturingPointerLeaveListener = hierarchyHasCapturingEventListeners(previousTarget.get(), eventNames().pointerleaveEvent);
</span><span class="cx"> 
</span><span class="cx">         Vector<Ref<Element>, 32> leftElementsChain;
</span><del>-        for (RefPtr element = previousTarget.get(); element; element = element->parentElementInComposedTree())
</del><ins>+        for (Element* element = previousTarget.get(); element; element = element->parentElementInComposedTree())
</ins><span class="cx">             leftElementsChain.append(*element);
</span><span class="cx">         Vector<Ref<Element>, 32> enteredElementsChain;
</span><del>-        for (RefPtr element = currentTarget.get(); element; element = element->parentElementInComposedTree())
</del><ins>+        for (Element* element = currentTarget.get(); element; element = element->parentElementInComposedTree())
</ins><span class="cx">             enteredElementsChain.append(*element);
</span><span class="cx"> 
</span><span class="cx">         if (!leftElementsChain.isEmpty() && !enteredElementsChain.isEmpty() && leftElementsChain.last().ptr() == enteredElementsChain.last().ptr()) {
</span><span class="lines">@@ -296,7 +304,7 @@
</span><span class="cx">         // For input devices that do not support hover, a user agent MUST also fire a pointer event named pointerover followed by a pointer event named
</span><span class="cx">         // pointerenter prior to dispatching the pointerdown event.
</span><span class="cx">         dispatchOverOrOutEvent(eventNames().pointeroverEvent, currentTarget.get());
</span><del>-        dispatchEnterOrLeaveEvent(eventNames().pointerenterEvent, *currentTarget);
</del><ins>+        dispatchEnterOrLeaveEvent(eventNames().pointerenterEvent);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     dispatchEvent(pointerEvent, &target);
</span><span class="lines">@@ -306,8 +314,8 @@
</span><span class="cx">         // For input devices that do not support hover, a user agent MUST also fire a pointer event named pointerout followed by a
</span><span class="cx">         // pointer event named pointerleave after dispatching the pointerup event.
</span><span class="cx">         dispatchOverOrOutEvent(eventNames().pointeroutEvent, currentTarget.get());
</span><del>-        dispatchEnterOrLeaveEvent(eventNames().pointerleaveEvent, *currentTarget);
-        capturingData->previousTarget = nullptr;
</del><ins>+        dispatchEnterOrLeaveEvent(eventNames().pointerleaveEvent);
+        capturingData.previousTarget = nullptr;
</ins><span class="cx"> 
</span><span class="cx">         touchWithIdentifierWasRemoved(pointerEvent->pointerId());
</span><span class="cx">     }
</span><span class="lines">@@ -319,7 +327,7 @@
</span><span class="cx">     // If we already have known touches then we cannot dispatch a mouse event,
</span><span class="cx">     // for instance in the case of a long press to initiate a system drag.
</span><span class="cx">     for (auto& capturingData : m_activePointerIdsToCapturingData.values()) {
</span><del>-        if (capturingData->pointerType == PointerEvent::touchPointerType() && capturingData->pointerIsPressed && !capturingData->cancelled)
</del><ins>+        if (capturingData.pointerType == PointerEvent::touchPointerType() && capturingData.pointerIsPressed && !capturingData.cancelled)
</ins><span class="cx">             return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -326,11 +334,11 @@
</span><span class="cx">     const auto& type = mouseEvent.type();
</span><span class="cx">     const auto& names = eventNames();
</span><span class="cx"> 
</span><del>-    RefPtr capturingData = m_activePointerIdsToCapturingData.get(pointerId);
-    bool pointerIsPressed = capturingData ? capturingData->pointerIsPressed : false;
</del><ins>+    auto iterator = m_activePointerIdsToCapturingData.find(pointerId);
+    bool pointerIsPressed = iterator != m_activePointerIdsToCapturingData.end() ? iterator->value.pointerIsPressed : false;
</ins><span class="cx"> 
</span><span class="cx">     short newButton = mouseEvent.button();
</span><del>-    short previousMouseButton = capturingData ? capturingData->previousMouseButton : -1;
</del><ins>+    short previousMouseButton = iterator != m_activePointerIdsToCapturingData.end() ? iterator->value.previousMouseButton : -1;
</ins><span class="cx">     short button = (type == names.mousemoveEvent && newButton == previousMouseButton) ? -1 : newButton;
</span><span class="cx"> 
</span><span class="cx">     // https://w3c.github.io/pointerevents/#chorded-button-interactions
</span><span class="lines">@@ -352,10 +360,10 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     auto pointerEvent = PointerEvent::create(button, mouseEvent, pointerId, pointerType);
</span><del>-    if (capturingData)
-        capturingData->previousMouseButton = newButton;
</del><ins>+    if (iterator != m_activePointerIdsToCapturingData.end())
+        iterator->value.previousMouseButton = newButton;
</ins><span class="cx">     else if (pointerEvent)
</span><del>-        ensureCapturingDataForPointerEvent(*pointerEvent)->previousMouseButton = newButton;
</del><ins>+        ensureCapturingDataForPointerEvent(*pointerEvent).previousMouseButton = newButton;
</ins><span class="cx"> 
</span><span class="cx">     return pointerEvent;
</span><span class="cx"> }
</span><span class="lines">@@ -389,8 +397,9 @@
</span><span class="cx">     auto pointerId = event.pointerId();
</span><span class="cx"> 
</span><span class="cx">     if (event.pointerType() != PointerEvent::touchPointerType()) {
</span><del>-        if (RefPtr capturingData = m_activePointerIdsToCapturingData.get(pointerId))
-            capturingData->pointerIsPressed = isPointerdown;
</del><ins>+        auto iterator = m_activePointerIdsToCapturingData.find(pointerId);
+        if (iterator != m_activePointerIdsToCapturingData.end())
+            iterator->value.pointerIsPressed = isPointerdown;
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -409,44 +418,46 @@
</span><span class="cx">     // releasePointerCapture is not called for the pointer before the next pointer event is fired, then a gotpointercapture event will be dispatched
</span><span class="cx">     // to the target (as normal) indicating that capture is active.
</span><span class="cx"> 
</span><del>-    auto capturingData = ensureCapturingDataForPointerEvent(event);
-    capturingData->pointerIsPressed = true;
</del><ins>+    auto& capturingData = ensureCapturingDataForPointerEvent(event);
+    capturingData.pointerIsPressed = true;
</ins><span class="cx">     setPointerCapture(downcast<Element>(target), pointerId);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-auto PointerCaptureController::ensureCapturingDataForPointerEvent(const PointerEvent& event) -> Ref<CapturingData>
</del><ins>+PointerCaptureController::CapturingData& PointerCaptureController::ensureCapturingDataForPointerEvent(const PointerEvent& event)
</ins><span class="cx"> {
</span><del>-    return m_activePointerIdsToCapturingData.ensure(event.pointerId(), [pointerType = event.pointerType()] {
-        return CapturingData::create(pointerType);
</del><ins>+    return m_activePointerIdsToCapturingData.ensure(event.pointerId(), [&event] {
+        CapturingData capturingData;
+        capturingData.pointerType = event.pointerType();
+        return capturingData;
</ins><span class="cx">     }).iterator->value;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void PointerCaptureController::pointerEventWasDispatched(const PointerEvent& event)
</span><span class="cx"> {
</span><del>-    RefPtr capturingData = m_activePointerIdsToCapturingData.get(event.pointerId());
-    if (!capturingData)
-        return;
</del><ins>+    auto iterator = m_activePointerIdsToCapturingData.find(event.pointerId());
+    if (iterator != m_activePointerIdsToCapturingData.end()) {
+        auto& capturingData = iterator->value;
+        capturingData.isPrimary = event.isPrimary();
</ins><span class="cx"> 
</span><del>-    capturingData->isPrimary = event.isPrimary();
</del><ins>+        // Immediately after firing the pointerup or pointercancel events, a user agent MUST clear the pending pointer capture target
+        // override for the pointerId of the pointerup or pointercancel event that was just dispatched, and then run Process Pending
+        // Pointer Capture steps to fire lostpointercapture if necessary.
+        // https://w3c.github.io/pointerevents/#implicit-release-of-pointer-capture
+        if (event.type() == eventNames().pointerupEvent) {
+            capturingData.pendingTargetOverride = nullptr;
+            processPendingPointerCapture(event.pointerId());
+        }
</ins><span class="cx"> 
</span><del>-    // Immediately after firing the pointerup or pointercancel events, a user agent MUST clear the pending pointer capture target
-    // override for the pointerId of the pointerup or pointercancel event that was just dispatched, and then run Process Pending
-    // Pointer Capture steps to fire lostpointercapture if necessary.
-    // https://w3c.github.io/pointerevents/#implicit-release-of-pointer-capture
-    if (event.type() == eventNames().pointerupEvent) {
-        capturingData->pendingTargetOverride = nullptr;
-        processPendingPointerCapture(event.pointerId());
</del><ins>+        // If a mouse pointer has moved while it isn't pressed, make sure we reset the preventsCompatibilityMouseEvents flag since
+        // we could otherwise prevent compatibility mouse events while those are only supposed to be prevented while the pointer is pressed.
+        if (event.type() == eventNames().pointermoveEvent && capturingData.pointerType == PointerEvent::mousePointerType() && !capturingData.pointerIsPressed)
+            capturingData.preventsCompatibilityMouseEvents = false;
+
+        // If the pointer event dispatched was pointerdown and the event was canceled, then set the PREVENT MOUSE EVENT flag for this pointerType.
+        // https://www.w3.org/TR/pointerevents/#mapping-for-devices-that-support-hover
+        if (event.type() == eventNames().pointerdownEvent)
+            capturingData.preventsCompatibilityMouseEvents = event.defaultPrevented();
</ins><span class="cx">     }
</span><del>-
-    // If a mouse pointer has moved while it isn't pressed, make sure we reset the preventsCompatibilityMouseEvents flag since
-    // we could otherwise prevent compatibility mouse events while those are only supposed to be prevented while the pointer is pressed.
-    if (event.type() == eventNames().pointermoveEvent && capturingData->pointerType == PointerEvent::mousePointerType() && !capturingData->pointerIsPressed)
-        capturingData->preventsCompatibilityMouseEvents = false;
-
-    // If the pointer event dispatched was pointerdown and the event was canceled, then set the PREVENT MOUSE EVENT flag for this pointerType.
-    // https://www.w3.org/TR/pointerevents/#mapping-for-devices-that-support-hover
-    if (event.type() == eventNames().pointerdownEvent)
-        capturingData->preventsCompatibilityMouseEvents = event.defaultPrevented();
</del><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void PointerCaptureController::cancelPointer(PointerID pointerId, const IntPoint& documentPoint)
</span><span class="lines">@@ -468,22 +479,26 @@
</span><span class="cx">     // pointer supports hover, user agent MUST also send corresponding boundary events necessary to reflect the current position of
</span><span class="cx">     // the pointer with no capture.
</span><span class="cx"> 
</span><del>-    RefPtr capturingData = m_activePointerIdsToCapturingData.get(pointerId);
-    if (!capturingData || capturingData->cancelled)
</del><ins>+    auto iterator = m_activePointerIdsToCapturingData.find(pointerId);
+    if (iterator == m_activePointerIdsToCapturingData.end())
</ins><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    capturingData->pendingTargetOverride = nullptr;
-    capturingData->cancelled = true;
</del><ins>+    auto& capturingData = iterator->value;
+    if (capturingData.cancelled)
+        return;
</ins><span class="cx"> 
</span><ins>+    capturingData.pendingTargetOverride = nullptr;
+    capturingData.cancelled = true;
+
</ins><span class="cx"> #if ENABLE(TOUCH_EVENTS) && PLATFORM(IOS_FAMILY)
</span><del>-    capturingData->previousTarget = nullptr;
</del><ins>+    capturingData.previousTarget = nullptr;
</ins><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx">     auto target = [&]() -> RefPtr<Element> {
</span><del>-        if (capturingData->targetOverride)
-            return capturingData->targetOverride;
</del><ins>+        if (capturingData.targetOverride)
+            return capturingData.targetOverride;
</ins><span class="cx">         constexpr OptionSet<HitTestRequest::RequestType> hitType { HitTestRequest::ReadOnly, HitTestRequest::Active, HitTestRequest::DisallowUserAgentShadowContent, HitTestRequest::AllowChildFrameContent };
</span><del>-        return Ref(m_page.mainFrame())->eventHandler().hitTestResultAtPoint(documentPoint, hitType).innerNonSharedElement();
</del><ins>+        return m_page.mainFrame().eventHandler().hitTestResultAtPoint(documentPoint, hitType).innerNonSharedElement();
</ins><span class="cx">     }();
</span><span class="cx"> 
</span><span class="cx">     if (!target)
</span><span class="lines">@@ -491,18 +506,18 @@
</span><span class="cx"> 
</span><span class="cx">     // After firing the pointercancel event, a user agent MUST also fire a pointer event named pointerout
</span><span class="cx">     // followed by firing a pointer event named pointerleave.
</span><del>-    auto isPrimary = capturingData->isPrimary ? PointerEvent::IsPrimary::Yes : PointerEvent::IsPrimary::No;
-    auto cancelEvent = PointerEvent::create(eventNames().pointercancelEvent, pointerId, capturingData->pointerType, isPrimary);
</del><ins>+    auto isPrimary = capturingData.isPrimary ? PointerEvent::IsPrimary::Yes : PointerEvent::IsPrimary::No;
+    auto cancelEvent = PointerEvent::create(eventNames().pointercancelEvent, pointerId, capturingData.pointerType, isPrimary);
</ins><span class="cx">     target->dispatchEvent(cancelEvent);
</span><del>-    target->dispatchEvent(PointerEvent::create(eventNames().pointeroutEvent, pointerId, capturingData->pointerType, isPrimary));
-    target->dispatchEvent(PointerEvent::create(eventNames().pointerleaveEvent, pointerId, capturingData->pointerType, isPrimary));
</del><ins>+    target->dispatchEvent(PointerEvent::create(eventNames().pointeroutEvent, pointerId, capturingData.pointerType, isPrimary));
+    target->dispatchEvent(PointerEvent::create(eventNames().pointerleaveEvent, pointerId, capturingData.pointerType, isPrimary));
</ins><span class="cx">     processPendingPointerCapture(pointerId);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void PointerCaptureController::processPendingPointerCapture(PointerID pointerId)
</span><span class="cx"> {
</span><del>-    RefPtr capturingData = m_activePointerIdsToCapturingData.get(pointerId);
-    if (!capturingData)
</del><ins>+    auto iterator = m_activePointerIdsToCapturingData.find(pointerId);
+    if (iterator == m_activePointerIdsToCapturingData.end())
</ins><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     if (m_processingPendingPointerCapture)
</span><span class="lines">@@ -510,17 +525,19 @@
</span><span class="cx"> 
</span><span class="cx">     m_processingPendingPointerCapture = true;
</span><span class="cx"> 
</span><ins>+    auto& capturingData = iterator->value;
+
</ins><span class="cx">     // Cache the pending target override since it could be modified during the dispatch of events in this function.
</span><del>-    auto pendingTargetOverride = capturingData->pendingTargetOverride;
</del><ins>+    auto pendingTargetOverride = capturingData.pendingTargetOverride;
</ins><span class="cx"> 
</span><span class="cx">     // https://w3c.github.io/pointerevents/#process-pending-pointer-capture
</span><span class="cx">     // 1. If the pointer capture target override for this pointer is set and is not equal to the pending pointer capture target override,
</span><span class="cx">     // then fire a pointer event named lostpointercapture at the pointer capture target override node.
</span><del>-    if (capturingData->targetOverride && capturingData->targetOverride != pendingTargetOverride) {
-        if (capturingData->targetOverride->isConnected())
-            capturingData->targetOverride->dispatchEvent(PointerEvent::createForPointerCapture(eventNames().lostpointercaptureEvent, pointerId, capturingData->isPrimary, capturingData->pointerType));
-        if (capturingData->pointerType == PointerEvent::mousePointerType()) {
-            if (RefPtr frame = capturingData->targetOverride->document().frame())
</del><ins>+    if (capturingData.targetOverride && capturingData.targetOverride != pendingTargetOverride) {
+        if (capturingData.targetOverride->isConnected())
+            capturingData.targetOverride->dispatchEvent(PointerEvent::createForPointerCapture(eventNames().lostpointercaptureEvent, pointerId, capturingData.isPrimary, capturingData.pointerType));
+        if (capturingData.pointerType == PointerEvent::mousePointerType()) {
+            if (auto* frame = capturingData.targetOverride->document().frame())
</ins><span class="cx">                 frame->eventHandler().pointerCaptureElementDidChange(nullptr);
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -527,17 +544,17 @@
</span><span class="cx"> 
</span><span class="cx">     // 2. If the pending pointer capture target override for this pointer is set and is not equal to the pointer capture target override,
</span><span class="cx">     // then fire a pointer event named gotpointercapture at the pending pointer capture target override.
</span><del>-    if (capturingData->pendingTargetOverride && capturingData->targetOverride != pendingTargetOverride) {
-        if (capturingData->pointerType == PointerEvent::mousePointerType()) {
-            if (RefPtr frame = pendingTargetOverride->document().frame())
</del><ins>+    if (capturingData.pendingTargetOverride && capturingData.targetOverride != pendingTargetOverride) {
+        if (capturingData.pointerType == PointerEvent::mousePointerType()) {
+            if (auto* frame = pendingTargetOverride->document().frame())
</ins><span class="cx">                 frame->eventHandler().pointerCaptureElementDidChange(pendingTargetOverride.get());
</span><span class="cx">         }
</span><del>-        pendingTargetOverride->dispatchEvent(PointerEvent::createForPointerCapture(eventNames().gotpointercaptureEvent, pointerId, capturingData->isPrimary, capturingData->pointerType));
</del><ins>+        pendingTargetOverride->dispatchEvent(PointerEvent::createForPointerCapture(eventNames().gotpointercaptureEvent, pointerId, capturingData.isPrimary, capturingData.pointerType));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // 3. Set the pointer capture target override to the pending pointer capture target override, if set. Otherwise, clear the pointer
</span><span class="cx">     // capture target override.
</span><del>-    capturingData->targetOverride = pendingTargetOverride;
</del><ins>+    capturingData.targetOverride = pendingTargetOverride;
</ins><span class="cx"> 
</span><span class="cx">     m_processingPendingPointerCapture = false;
</span><span class="cx"> }
</span></span></pre></div>
<a id="branchessafari6113100branchSourceWebCorepagePointerCaptureControllerh"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/WebCore/page/PointerCaptureController.h (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/WebCore/page/PointerCaptureController.h 2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/WebCore/page/PointerCaptureController.h    2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -69,12 +69,7 @@
</span><span class="cx">     void processPendingPointerCapture(PointerID);
</span><span class="cx"> 
</span><span class="cx"> private:
</span><del>-    struct CapturingData : public RefCounted<CapturingData> {
-        static Ref<CapturingData> create(const String& pointerType)
-        {
-            return adoptRef(*new CapturingData(pointerType));
-        }
-
</del><ins>+    struct CapturingData {
</ins><span class="cx">         RefPtr<Element> pendingTargetOverride;
</span><span class="cx">         RefPtr<Element> targetOverride;
</span><span class="cx"> #if ENABLE(TOUCH_EVENTS) && PLATFORM(IOS_FAMILY)
</span><span class="lines">@@ -93,14 +88,9 @@
</span><span class="cx">         bool preventsCompatibilityMouseEvents { false };
</span><span class="cx">         bool pointerIsPressed { false };
</span><span class="cx">         short previousMouseButton { -1 };
</span><del>-
-    private:
-        CapturingData(const String& pointerType)
-            : pointerType(pointerType)
-        { }
</del><span class="cx">     };
</span><span class="cx"> 
</span><del>-    Ref<CapturingData> ensureCapturingDataForPointerEvent(const PointerEvent&);
</del><ins>+    CapturingData& ensureCapturingDataForPointerEvent(const PointerEvent&);
</ins><span class="cx">     void pointerEventWillBeDispatched(const PointerEvent&, EventTarget*);
</span><span class="cx">     void pointerEventWasDispatched(const PointerEvent&);
</span><span class="cx">     
</span><span class="lines">@@ -109,7 +99,7 @@
</span><span class="cx">     Page& m_page;
</span><span class="cx">     // While PointerID is defined as int32_t, we use int64_t here so that we may use a value outside of the int32_t range to have safe
</span><span class="cx">     // empty and removed values, allowing any int32_t to be provided through the API for lookup in this hashmap.
</span><del>-    using PointerIdToCapturingDataMap = HashMap<int64_t, Ref<CapturingData>, WTF::IntHash<int64_t>, WTF::SignedWithZeroKeyHashTraits<int64_t>>;
</del><ins>+    using PointerIdToCapturingDataMap = HashMap<int64_t, CapturingData, WTF::IntHash<int64_t>, WTF::SignedWithZeroKeyHashTraits<int64_t>>;
</ins><span class="cx">     PointerIdToCapturingDataMap m_activePointerIdsToCapturingData;
</span><span class="cx">     bool m_processingPendingPointerCapture { false };
</span><span class="cx">     bool m_haveAnyCapturingElement { false };
</span></span></pre></div>
<a id="branchessafari6113100branchSourceWebCorereplayUserInputBridgecpp"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/WebCore/replay/UserInputBridge.cpp (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/WebCore/replay/UserInputBridge.cpp      2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/WebCore/replay/UserInputBridge.cpp 2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -55,42 +55,42 @@
</span><span class="cx"> 
</span><span class="cx"> bool UserInputBridge::handleMousePressEvent(const PlatformMouseEvent& mouseEvent, InputSource)
</span><span class="cx"> {
</span><del>-    return Ref(m_page.mainFrame())->eventHandler().handleMousePressEvent(mouseEvent);
</del><ins>+    return m_page.mainFrame().eventHandler().handleMousePressEvent(mouseEvent);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool UserInputBridge::handleMouseReleaseEvent(const PlatformMouseEvent& mouseEvent, InputSource)
</span><span class="cx"> {
</span><del>-    return Ref(m_page.mainFrame())->eventHandler().handleMouseReleaseEvent(mouseEvent);
</del><ins>+    return m_page.mainFrame().eventHandler().handleMouseReleaseEvent(mouseEvent);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool UserInputBridge::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, InputSource)
</span><span class="cx"> {
</span><del>-    return Ref(m_page.mainFrame())->eventHandler().mouseMoved(mouseEvent);
</del><ins>+    return m_page.mainFrame().eventHandler().mouseMoved(mouseEvent);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool UserInputBridge::handleMouseMoveOnScrollbarEvent(const PlatformMouseEvent& mouseEvent, InputSource)
</span><span class="cx"> {
</span><del>-    return Ref(m_page.mainFrame())->eventHandler().passMouseMovedEventToScrollbars(mouseEvent);
</del><ins>+    return m_page.mainFrame().eventHandler().passMouseMovedEventToScrollbars(mouseEvent);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool UserInputBridge::handleMouseForceEvent(const PlatformMouseEvent& mouseEvent, InputSource)
</span><span class="cx"> {
</span><del>-    return Ref(m_page.mainFrame())->eventHandler().handleMouseForceEvent(mouseEvent);
</del><ins>+    return m_page.mainFrame().eventHandler().handleMouseForceEvent(mouseEvent);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool UserInputBridge::handleKeyEvent(const PlatformKeyboardEvent& keyEvent, InputSource)
</span><span class="cx"> {
</span><del>-    return Ref(m_page.focusController().focusedOrMainFrame())->eventHandler().keyEvent(keyEvent);
</del><ins>+    return m_page.focusController().focusedOrMainFrame().eventHandler().keyEvent(keyEvent);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool UserInputBridge::handleAccessKeyEvent(const PlatformKeyboardEvent& keyEvent, InputSource)
</span><span class="cx"> {
</span><del>-    return Ref(m_page.focusController().focusedOrMainFrame())->eventHandler().handleAccessKey(keyEvent);
</del><ins>+    return m_page.focusController().focusedOrMainFrame().eventHandler().handleAccessKey(keyEvent);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool UserInputBridge::handleWheelEvent(const PlatformWheelEvent& wheelEvent, OptionSet<WheelEventProcessingSteps> processingSteps, InputSource)
</span><span class="cx"> {
</span><del>-    return Ref(m_page.mainFrame())->eventHandler().handleWheelEvent(wheelEvent, processingSteps);
</del><ins>+    return m_page.mainFrame().eventHandler().handleWheelEvent(wheelEvent, processingSteps);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void UserInputBridge::focusSetActive(bool active, InputSource)
</span><span class="lines">@@ -105,12 +105,12 @@
</span><span class="cx"> 
</span><span class="cx"> bool UserInputBridge::scrollRecursively(ScrollDirection direction, ScrollGranularity granularity, InputSource)
</span><span class="cx"> {
</span><del>-    return Ref(m_page.focusController().focusedOrMainFrame())->eventHandler().scrollRecursively(direction, granularity, nullptr);
</del><ins>+    return m_page.focusController().focusedOrMainFrame().eventHandler().scrollRecursively(direction, granularity, nullptr);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool UserInputBridge::logicalScrollRecursively(ScrollLogicalDirection direction, ScrollGranularity granularity, InputSource)
</span><span class="cx"> {
</span><del>-    return Ref(m_page.focusController().focusedOrMainFrame())->eventHandler().logicalScrollRecursively(direction, granularity, nullptr);
</del><ins>+    return m_page.focusController().focusedOrMainFrame().eventHandler().logicalScrollRecursively(direction, granularity, nullptr);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void UserInputBridge::loadRequest(FrameLoadRequest&& request, InputSource)
</span><span class="lines">@@ -118,7 +118,7 @@
</span><span class="cx"> #if ENABLE(WEB_AUTHN)
</span><span class="cx">     m_page.authenticatorCoordinator().resetUserGestureRequirement();
</span><span class="cx"> #endif
</span><del>-    Ref(m_page.mainFrame())->loader().load(WTFMove(request));
</del><ins>+    m_page.mainFrame().loader().load(WTFMove(request));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void UserInputBridge::reloadFrame(Frame& frame, OptionSet<ReloadOption> options, InputSource)
</span><span class="lines">@@ -136,7 +136,7 @@
</span><span class="cx"> 
</span><span class="cx"> bool UserInputBridge::tryClosePage(InputSource)
</span><span class="cx"> {
</span><del>-    return Ref(m_page.mainFrame())->loader().shouldClose();
</del><ins>+    return m_page.mainFrame().loader().shouldClose();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace WebCore
</span></span></pre></div>
<a id="branchessafari6113100branchSourceWebInspectorUIConfigurationsVersionxcconfig"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/WebInspectorUI/Configurations/Version.xcconfig (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/WebInspectorUI/Configurations/Version.xcconfig  2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/WebInspectorUI/Configurations/Version.xcconfig     2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -1,9 +1,9 @@
</span><span class="cx"> MAJOR_VERSION = 611;
</span><del>-MINOR_VERSION = 4;
-TINY_VERSION = 0;
-MICRO_VERSION = 2;
-NANO_VERSION = 0;
-FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION);
</del><ins>+MINOR_VERSION = 3;
+TINY_VERSION = 10;
+MICRO_VERSION = 0;
+NANO_VERSION = 1;
+FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION).$(NANO_VERSION);
</ins><span class="cx"> 
</span><span class="cx"> // The system version prefix is based on the current system version.
</span><span class="cx"> SYSTEM_VERSION_PREFIX[sdk=iphone*] = 8;
</span></span></pre></div>
<a id="branchessafari6113100branchSourceWebKitChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/WebKit/ChangeLog (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/WebKit/ChangeLog        2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/WebKit/ChangeLog   2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -1,119 +1,3 @@
</span><del>-2021-08-10  Russell Epstein  <repstein@apple.com>
-
-        Apply patch. rdar://problem/79924198
-
-    2021-08-10  Russell Epstein  <repstein@apple.com>
-
-            Deploy smart pointers in EventHandler and UserInputBridge
-            https://bugs.webkit.org/show_bug.cgi?id=227481
-
-            Reviewed by Wenson Hsieh and Chris Dumez.
-
-            * WebProcess/WebPage/WebPage.cpp:
-            (WebKit::WebPage::contextMenuAtPointInWindow):
-            (WebKit::handleContextMenuEvent):
-
-2021-08-10  Russell Epstein  <repstein@apple.com>
-
-        Cherry-pick r279287. rdar://problem/80635807
-
-    Explicitly invalidate WKFullScreenViewController after a video exits fullscreen
-    https://bugs.webkit.org/show_bug.cgi?id=227372
-    
-    Reviewed by Eric Carlson.
-    
-    Since `WKFullScreenWindowController` owns `WKFullScreenViewController`,
-    we had better let `WKFullScreenWindowController` manage the life cycle
-    of `WKFullScreenViewController`.
-    
-    * UIProcess/ios/fullscreen/WKFullScreenViewController.h:
-    * UIProcess/ios/fullscreen/WKFullScreenViewController.mm:
-    (-[WKFullScreenViewController initWithWebView:]):
-    (-[WKFullScreenViewController invalidate]):
-    (-[WKFullScreenViewController dealloc]):
-    (-[WKFullScreenViewController showUI]):
-    (-[WKFullScreenViewController hideUI]):
-    (-[WKFullScreenViewController videoControlsManagerDidChange]):
-    (-[WKFullScreenViewController setAnimatingViewAlpha:]):
-    (-[WKFullScreenViewController setPrefersStatusBarHidden:]):
-    (-[WKFullScreenViewController setPrefersHomeIndicatorAutoHidden:]):
-    (-[WKFullScreenViewController setPlaying:]):
-    (-[WKFullScreenViewController setPictureInPictureActive:]):
-    (-[WKFullScreenViewController setAnimating:]):
-    (-[WKFullScreenViewController _manager]):
-    (-[WKFullScreenViewController _effectiveFullscreenInsets]):
-    (-[WKFullScreenViewController _cancelAction:]):
-    (-[WKFullScreenViewController _togglePiPAction:]):
-    (-[WKFullScreenViewController _touchDetected:]):
-    (-[WKFullScreenViewController _statusBarFrameDidChange:]):
-    (-[WKFullScreenViewController _updateWebViewFullscreenInsets]):
-    (-[WKFullScreenViewController _showPhishingAlert]):
-    * UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm:
-    (-[WKFullScreenWindowController _completedExitFullScreen]):
-    
-    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@279287 268f45cc-cd09-0410-ab3c-d52691b4dbfc
-
-    2021-06-25  Peng Liu  <peng.liu6@apple.com>
-
-            Explicitly invalidate WKFullScreenViewController after a video exits fullscreen
-            https://bugs.webkit.org/show_bug.cgi?id=227372
-
-            Reviewed by Eric Carlson.
-
-            Since `WKFullScreenWindowController` owns `WKFullScreenViewController`,
-            we had better let `WKFullScreenWindowController` manage the life cycle
-            of `WKFullScreenViewController`.
-
-            * UIProcess/ios/fullscreen/WKFullScreenViewController.h:
-            * UIProcess/ios/fullscreen/WKFullScreenViewController.mm:
-            (-[WKFullScreenViewController initWithWebView:]):
-            (-[WKFullScreenViewController invalidate]):
-            (-[WKFullScreenViewController dealloc]):
-            (-[WKFullScreenViewController showUI]):
-            (-[WKFullScreenViewController hideUI]):
-            (-[WKFullScreenViewController videoControlsManagerDidChange]):
-            (-[WKFullScreenViewController setAnimatingViewAlpha:]):
-            (-[WKFullScreenViewController setPrefersStatusBarHidden:]):
-            (-[WKFullScreenViewController setPrefersHomeIndicatorAutoHidden:]):
-            (-[WKFullScreenViewController setPlaying:]):
-            (-[WKFullScreenViewController setPictureInPictureActive:]):
-            (-[WKFullScreenViewController setAnimating:]):
-            (-[WKFullScreenViewController _manager]):
-            (-[WKFullScreenViewController _effectiveFullscreenInsets]):
-            (-[WKFullScreenViewController _cancelAction:]):
-            (-[WKFullScreenViewController _togglePiPAction:]):
-            (-[WKFullScreenViewController _touchDetected:]):
-            (-[WKFullScreenViewController _statusBarFrameDidChange:]):
-            (-[WKFullScreenViewController _updateWebViewFullscreenInsets]):
-            (-[WKFullScreenViewController _showPhishingAlert]):
-            * UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm:
-            (-[WKFullScreenWindowController _completedExitFullScreen]):
-
-2021-08-10  Russell Epstein  <repstein@apple.com>
-
-        Cherry-pick r279254. rdar://problem/80635931
-
-    Crash in WebFrameLoaderClient::dispatchDidStartProvisionalLoad after provisionalLoader is gone.
-    https://bugs.webkit.org/show_bug.cgi?id=226979
-    
-    Patch by Venky Dass <yaranamavenkataramana@apple.com> on 2021-06-24
-    Reviewed by Ryosuke Niwa.
-    
-    * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
-    (WebKit::WebFrameLoaderClient::dispatchDidStartProvisionalLoad):
-    
-    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@279254 268f45cc-cd09-0410-ab3c-d52691b4dbfc
-
-    2021-06-24  Venky Dass  <yaranamavenkataramana@apple.com>
-
-            Crash in WebFrameLoaderClient::dispatchDidStartProvisionalLoad after provisionalLoader is gone.
-            https://bugs.webkit.org/show_bug.cgi?id=226979
-
-            Reviewed by Ryosuke Niwa.
-
-            * WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
-            (WebKit::WebFrameLoaderClient::dispatchDidStartProvisionalLoad):
-
</del><span class="cx"> 2021-06-17  Alan Coon  <alancoon@apple.com>
</span><span class="cx"> 
</span><span class="cx">         Cherry-pick r278870. rdar://problem/79473993
</span></span></pre></div>
<a id="branchessafari6113100branchSourceWebKitConfigurationsVersionxcconfig"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/WebKit/Configurations/Version.xcconfig (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/WebKit/Configurations/Version.xcconfig  2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/WebKit/Configurations/Version.xcconfig     2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -22,11 +22,11 @@
</span><span class="cx"> // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
</span><span class="cx"> 
</span><span class="cx"> MAJOR_VERSION = 611;
</span><del>-MINOR_VERSION = 4;
-TINY_VERSION = 0;
-MICRO_VERSION = 2;
-NANO_VERSION = 0;
-FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION);
</del><ins>+MINOR_VERSION = 3;
+TINY_VERSION = 10;
+MICRO_VERSION = 0;
+NANO_VERSION = 1;
+FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION).$(NANO_VERSION);
</ins><span class="cx"> 
</span><span class="cx"> // The bundle version and short version string are set based on the current build configuration, see below.
</span><span class="cx"> BUNDLE_VERSION = $(BUNDLE_VERSION_$(CONFIGURATION));
</span></span></pre></div>
<a id="branchessafari6113100branchSourceWebKitNetworkProcesscocoaNetworkSessionCocoamm"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm      2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm 2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -541,9 +541,7 @@
</span><span class="cx">         bool shouldIgnoreHSTS = false;
</span><span class="cx"> #if ENABLE(RESOURCE_LOAD_STATISTICS)
</span><span class="cx">         if (auto* sessionCocoa = networkDataTask->networkSession()) {
</span><del>-            auto* storageSession = sessionCocoa->networkProcess().storageSession(sessionCocoa->sessionID());
-            shouldIgnoreHSTS = schemeWasUpgradedDueToDynamicHSTS(request)
-                && storageSession->shouldBlockCookies(request, networkDataTask->frameID(), networkDataTask->pageID(), networkDataTask->shouldRelaxThirdPartyCookieBlocking());
</del><ins>+            shouldIgnoreHSTS = schemeWasUpgradedDueToDynamicHSTS(request) && sessionCocoa->networkProcess().storageSession(sessionCocoa->sessionID())->shouldBlockCookies(request, networkDataTask->frameID(), networkDataTask->pageID(), networkDataTask->shouldRelaxThirdPartyCookieBlocking());
</ins><span class="cx">             if (shouldIgnoreHSTS) {
</span><span class="cx">                 request = downgradeRequest(request);
</span><span class="cx">                 ASSERT([request.URL.scheme isEqualToString:@"http"]);
</span><span class="lines">@@ -579,10 +577,7 @@
</span><span class="cx">         bool shouldIgnoreHSTS = false;
</span><span class="cx"> #if ENABLE(RESOURCE_LOAD_STATISTICS)
</span><span class="cx">         if (auto* sessionCocoa = networkDataTask->networkSession()) {
</span><del>-            auto* storageSession = sessionCocoa->networkProcess().storageSession(sessionCocoa->sessionID());
-            NSURL *firstPartyForCookies = networkDataTask->isTopLevelNavigation() ? request.URL : request.mainDocumentURL;
-            shouldIgnoreHSTS = schemeWasUpgradedDueToDynamicHSTS(request)
-                && storageSession->shouldBlockCookies(firstPartyForCookies, request.URL, networkDataTask->frameID(), networkDataTask->pageID(), networkDataTask->shouldRelaxThirdPartyCookieBlocking());
</del><ins>+            shouldIgnoreHSTS = schemeWasUpgradedDueToDynamicHSTS(request) && sessionCocoa->networkProcess().storageSession(sessionCocoa->sessionID())->shouldBlockCookies(request, networkDataTask->frameID(), networkDataTask->pageID(), networkDataTask->shouldRelaxThirdPartyCookieBlocking());
</ins><span class="cx">             if (shouldIgnoreHSTS) {
</span><span class="cx">                 request = downgradeRequest(request);
</span><span class="cx">                 ASSERT([request.URL.scheme isEqualToString:@"http"]);
</span></span></pre></div>
<a id="branchessafari6113100branchSourceWebKitUIProcessiosfullscreenWKFullScreenViewControllerh"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenViewController.h (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenViewController.h    2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenViewController.h       2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -42,7 +42,6 @@
</span><span class="cx"> @property (assign, nonatomic, getter=isAnimating) BOOL animating;
</span><span class="cx"> 
</span><span class="cx"> - (id)initWithWebView:(WKWebView *)webView;
</span><del>-- (void)invalidate;
</del><span class="cx"> - (void)showUI;
</span><span class="cx"> - (void)hideUI;
</span><span class="cx"> - (void)videoControlsManagerDidChange;
</span></span></pre></div>
<a id="branchessafari6113100branchSourceWebKitUIProcessiosfullscreenWKFullScreenViewControllermm"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenViewController.mm (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenViewController.mm   2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenViewController.mm      2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -39,7 +39,6 @@
</span><span class="cx"> #import <WebCore/LocalizedStrings.h>
</span><span class="cx"> #import <pal/spi/cocoa/AVKitSPI.h>
</span><span class="cx"> #import <wtf/RetainPtr.h>
</span><del>-#import <wtf/WeakObjCPtr.h>
</del><span class="cx"> 
</span><span class="cx"> static const NSTimeInterval showHideAnimationDuration = 0.1;
</span><span class="cx"> static const NSTimeInterval pipHideAnimationDuration = 0.2;
</span><span class="lines">@@ -53,8 +52,7 @@
</span><span class="cx"> 
</span><span class="cx">     void rateChanged(bool isPlaying, float) override
</span><span class="cx">     {
</span><del>-        if (auto *controller = m_parent.getAutoreleased())
-            controller.playing = isPlaying; 
</del><ins>+        m_parent.playing = isPlaying;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     void isPictureInPictureSupportedChanged(bool) override
</span><span class="lines">@@ -63,8 +61,7 @@
</span><span class="cx"> 
</span><span class="cx">     void pictureInPictureActiveChanged(bool active) override
</span><span class="cx">     {
</span><del>-        if (auto *controller = m_parent.getAutoreleased())
-            controller.pictureInPictureActive = active;
</del><ins>+        m_parent.pictureInPictureActive = active;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     void setInterface(WebCore::PlaybackSessionInterfaceAVKit* interface)
</span><span class="lines">@@ -80,7 +77,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><del>-    WeakObjCPtr<WKFullScreenViewController> m_parent;
</del><ins>+    WKFullScreenViewController *m_parent { nullptr };
</ins><span class="cx">     RefPtr<WebCore::PlaybackSessionInterfaceAVKit> m_interface;
</span><span class="cx"> };
</span><span class="cx"> 
</span><span class="lines">@@ -112,7 +109,6 @@
</span><span class="cx"> @end
</span><span class="cx"> 
</span><span class="cx"> @implementation WKFullScreenViewController {
</span><del>-    BOOL _valid;
</del><span class="cx">     RetainPtr<UILongPressGestureRecognizer> _touchGestureRecognizer;
</span><span class="cx">     RetainPtr<UIView> _animatingView;
</span><span class="cx">     RetainPtr<WKFullscreenStackView> _stackView;
</span><span class="lines">@@ -146,28 +142,18 @@
</span><span class="cx">     self._webView = webView;
</span><span class="cx"> 
</span><span class="cx">     _playbackClient.setParent(self);
</span><del>-    _valid = YES;
</del><span class="cx"> 
</span><span class="cx">     return self;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-- (void)invalidate
</del><ins>+- (void)dealloc
</ins><span class="cx"> {
</span><del>-    if (!_valid)
-        return;
</del><ins>+    [NSObject cancelPreviousPerformRequestsWithTarget:self];
+    [[NSNotificationCenter defaultCenter] removeObserver:self];
</ins><span class="cx"> 
</span><del>-    _valid = NO;
-
-    [NSObject cancelPreviousPerformRequestsWithTarget:self selector:@selector(hideUI) object:nil];
-    [[NSNotificationCenter defaultCenter] removeObserver:self];
</del><span class="cx">     _playbackClient.setParent(nullptr);
</span><span class="cx">     _playbackClient.setInterface(nullptr);
</span><del>-}
</del><span class="cx"> 
</span><del>-- (void)dealloc
-{
-    [self invalidate];
-
</del><span class="cx">     [_target release];
</span><span class="cx">     [_location release];
</span><span class="cx"> 
</span><span class="lines">@@ -176,7 +162,6 @@
</span><span class="cx"> 
</span><span class="cx"> - (void)showUI
</span><span class="cx"> {
</span><del>-    ASSERT(_valid);
</del><span class="cx">     [NSObject cancelPreviousPerformRequestsWithTarget:self selector:@selector(hideUI) object:nil];
</span><span class="cx"> 
</span><span class="cx">     if (_playing) {
</span><span class="lines">@@ -199,7 +184,6 @@
</span><span class="cx"> 
</span><span class="cx"> - (void)hideUI
</span><span class="cx"> {
</span><del>-    ASSERT(_valid);
</del><span class="cx">     [NSObject cancelPreviousPerformRequestsWithTarget:self selector:@selector(hideUI) object:nil];
</span><span class="cx">     [UIView animateWithDuration:showHideAnimationDuration animations:^{
</span><span class="cx"> 
</span><span class="lines">@@ -222,7 +206,6 @@
</span><span class="cx"> 
</span><span class="cx"> - (void)videoControlsManagerDidChange
</span><span class="cx"> {
</span><del>-    ASSERT(_valid);
</del><span class="cx">     auto page = [self._webView _page];
</span><span class="cx">     auto* videoFullscreenManager = page ? page->videoFullscreenManager() : nullptr;
</span><span class="cx">     auto* videoFullscreenInterface = videoFullscreenManager ? videoFullscreenManager->controlsManagerInterface() : nullptr;
</span><span class="lines">@@ -241,7 +224,6 @@
</span><span class="cx"> 
</span><span class="cx"> - (void)setAnimatingViewAlpha:(CGFloat)alpha
</span><span class="cx"> {
</span><del>-    ASSERT(_valid);
</del><span class="cx">     [UIView animateWithDuration:pipHideAnimationDuration animations:^{
</span><span class="cx">         _animatingView.get().alpha = alpha;
</span><span class="cx">     }];
</span><span class="lines">@@ -249,7 +231,6 @@
</span><span class="cx"> 
</span><span class="cx"> - (void)setPrefersStatusBarHidden:(BOOL)value
</span><span class="cx"> {
</span><del>-    ASSERT(_valid);
</del><span class="cx">     _prefersStatusBarHidden = value;
</span><span class="cx">     [self setNeedsStatusBarAppearanceUpdate];
</span><span class="cx">     [self _updateWebViewFullscreenInsets];
</span><span class="lines">@@ -257,7 +238,6 @@
</span><span class="cx"> 
</span><span class="cx"> - (void)setPrefersHomeIndicatorAutoHidden:(BOOL)value
</span><span class="cx"> {
</span><del>-    ASSERT(_valid);
</del><span class="cx">     _prefersHomeIndicatorAutoHidden = value;
</span><span class="cx">     [self setNeedsUpdateOfHomeIndicatorAutoHidden];
</span><span class="cx"> }
</span><span class="lines">@@ -264,7 +244,6 @@
</span><span class="cx"> 
</span><span class="cx"> - (void)setPlaying:(BOOL)isPlaying
</span><span class="cx"> {
</span><del>-    ASSERT(_valid);
</del><span class="cx">     if (_playing == isPlaying)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="lines">@@ -284,7 +263,6 @@
</span><span class="cx"> 
</span><span class="cx"> - (void)setPictureInPictureActive:(BOOL)active
</span><span class="cx"> {
</span><del>-    ASSERT(_valid);
</del><span class="cx">     if (_pictureInPictureActive == active)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="lines">@@ -294,7 +272,6 @@
</span><span class="cx"> 
</span><span class="cx"> - (void)setAnimating:(BOOL)animating
</span><span class="cx"> {
</span><del>-    ASSERT(_valid);
</del><span class="cx">     if (_animating == animating)
</span><span class="cx">         return;
</span><span class="cx">     _animating = animating;
</span><span class="lines">@@ -437,7 +414,6 @@
</span><span class="cx"> @dynamic _manager;
</span><span class="cx"> - (WebKit::WebFullScreenManagerProxy*)_manager
</span><span class="cx"> {
</span><del>-    ASSERT(_valid);
</del><span class="cx">     if (auto page = [self._webView _page])
</span><span class="cx">         return page->fullScreenManager();
</span><span class="cx">     return nullptr;
</span><span class="lines">@@ -446,7 +422,6 @@
</span><span class="cx"> @dynamic _effectiveFullscreenInsets;
</span><span class="cx"> - (WebCore::FloatBoxExtent)_effectiveFullscreenInsets
</span><span class="cx"> {
</span><del>-    ASSERT(_valid);
</del><span class="cx">     auto safeAreaInsets = self.view.safeAreaInsets;
</span><span class="cx">     WebCore::FloatBoxExtent insets { safeAreaInsets.top, safeAreaInsets.right, safeAreaInsets.bottom, safeAreaInsets.left };
</span><span class="cx"> 
</span><span class="lines">@@ -458,13 +433,11 @@
</span><span class="cx"> 
</span><span class="cx"> - (void)_cancelAction:(id)sender
</span><span class="cx"> {
</span><del>-    ASSERT(_valid);
</del><span class="cx">     [[self target] performSelector:[self exitFullScreenAction]];
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> - (void)_togglePiPAction:(id)sender
</span><span class="cx"> {
</span><del>-    ASSERT(_valid);
</del><span class="cx">     auto page = [self._webView _page];
</span><span class="cx">     if (!page)
</span><span class="cx">         return;
</span><span class="lines">@@ -486,7 +459,6 @@
</span><span class="cx"> 
</span><span class="cx"> - (void)_touchDetected:(id)sender
</span><span class="cx"> {
</span><del>-    ASSERT(_valid);
</del><span class="cx">     if ([_touchGestureRecognizer state] == UIGestureRecognizerStateEnded) {
</span><span class="cx">         double score = _secheuristic.scoreOfNextTouch([_touchGestureRecognizer locationInView:self.view]);
</span><span class="cx">         if (score > _secheuristic.requiredScore())
</span><span class="lines">@@ -498,7 +470,6 @@
</span><span class="cx"> 
</span><span class="cx"> - (void)_statusBarFrameDidChange:(NSNotificationCenter *)notification
</span><span class="cx"> {
</span><del>-    ASSERT(_valid);
</del><span class="cx"> ALLOW_DEPRECATED_DECLARATIONS_BEGIN
</span><span class="cx">     CGFloat height = UIApplication.sharedApplication.statusBarFrame.size.height;
</span><span class="cx"> ALLOW_DEPRECATED_DECLARATIONS_END
</span><span class="lines">@@ -511,7 +482,6 @@
</span><span class="cx"> 
</span><span class="cx"> - (void)_updateWebViewFullscreenInsets
</span><span class="cx"> {
</span><del>-    ASSERT(_valid);
</del><span class="cx">     if (auto* manager = self._manager)
</span><span class="cx">         manager->setFullscreenInsets(self._effectiveFullscreenInsets);
</span><span class="cx"> }
</span><span class="lines">@@ -518,7 +488,6 @@
</span><span class="cx"> 
</span><span class="cx"> - (void)_showPhishingAlert
</span><span class="cx"> {
</span><del>-    ASSERT(_valid);
</del><span class="cx">     NSString *alertTitle = WEB_UI_STRING("It looks like you are typing while in full screen", "Full Screen Deceptive Website Warning Sheet Title");
</span><span class="cx">     NSString *alertMessage = [NSString stringWithFormat:WEB_UI_STRING("Typing is not allowed in full screen websites. “%@” may be showing a fake keyboard to trick you into disclosing personal or financial information.", "Full Screen Deceptive Website Warning Sheet Content Text"), (NSString *)self.location];
</span><span class="cx">     UIAlertController* alert = [UIAlertController alertControllerWithTitle:alertTitle message:alertMessage preferredStyle:UIAlertControllerStyleAlert];
</span></span></pre></div>
<a id="branchessafari6113100branchSourceWebKitUIProcessiosfullscreenWKFullScreenWindowControllerIOSmm"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm      2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm 2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -855,7 +855,6 @@
</span><span class="cx">         completionHandler();
</span><span class="cx"> 
</span><span class="cx">     [_fullscreenViewController setPrefersStatusBarHidden:YES];
</span><del>-    [_fullscreenViewController invalidate];
</del><span class="cx">     _fullscreenViewController = nil;
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchessafari6113100branchSourceWebKitWebProcessWebCoreSupportWebFrameLoaderClientcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp       2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp  2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -518,20 +518,17 @@
</span><span class="cx">     webPage->findController().hideFindUI();
</span><span class="cx">     webPage->sandboxExtensionTracker().didStartProvisionalLoad(m_frame.ptr());
</span><span class="cx"> 
</span><del>-
</del><ins>+    WebDocumentLoader& provisionalLoader = static_cast<WebDocumentLoader&>(*m_frame->coreFrame()->loader().provisionalDocumentLoader());
+    auto& url = provisionalLoader.url();
</ins><span class="cx">     RefPtr<API::Object> userData;
</span><span class="cx"> 
</span><span class="cx">     // Notify the bundle client.
</span><span class="cx">     webPage->injectedBundleLoaderClient().didStartProvisionalLoadForFrame(*webPage, m_frame, userData);
</span><del>-    RefPtr provisionalLoader = static_cast<WebDocumentLoader*>(m_frame->coreFrame()->loader().provisionalDocumentLoader());
</del><span class="cx"> 
</span><del>-    if (!provisionalLoader)
-        return;
-    
-    auto& url = provisionalLoader->url();
-    auto& unreachableURL = provisionalLoader->unreachableURL();
</del><ins>+    auto& unreachableURL = provisionalLoader.unreachableURL();
+
</ins><span class="cx">     // Notify the UIProcess.
</span><del>-    webPage->send(Messages::WebPageProxy::DidStartProvisionalLoadForFrame(m_frame->frameID(), m_frame->info(), provisionalLoader->request(), provisionalLoader->navigationID(), url, unreachableURL, UserData(WebProcess::singleton().transformObjectsToHandles(userData.get()).get())));
</del><ins>+    webPage->send(Messages::WebPageProxy::DidStartProvisionalLoadForFrame(m_frame->frameID(), m_frame->info(), provisionalLoader.request(), provisionalLoader.navigationID(), url, unreachableURL, UserData(WebProcess::singleton().transformObjectsToHandles(userData.get()).get())));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static constexpr unsigned maxTitleLength = 1000; // Closest power of 10 above the W3C recommendation for Title length.
</span></span></pre></div>
<a id="branchessafari6113100branchSourceWebKitWebProcessWebPageWebPagecpp"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/WebKit/WebProcess/WebPage/WebPage.cpp (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/WebKit/WebProcess/WebPage/WebPage.cpp   2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/WebKit/WebProcess/WebPage/WebPage.cpp      2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -2604,8 +2604,7 @@
</span><span class="cx">     // Simulate a mouse click to generate the correct menu.
</span><span class="cx">     PlatformMouseEvent mousePressEvent(point, point, RightButton, PlatformEvent::MousePressed, 1, false, false, false, false, WallTime::now(), WebCore::ForceAtClick, WebCore::NoTap);
</span><span class="cx">     corePage()->userInputBridge().handleMousePressEvent(mousePressEvent);
</span><del>-    Ref mainFrame = corePage()->mainFrame();
-    bool handled = corePage()->userInputBridge().handleContextMenuEvent(mousePressEvent, mainFrame);
</del><ins>+    bool handled = corePage()->userInputBridge().handleContextMenuEvent(mousePressEvent, corePage()->mainFrame());
</ins><span class="cx">     auto* menu = handled ? &contextMenu() : nullptr;
</span><span class="cx">     PlatformMouseEvent mouseReleaseEvent(point, point, RightButton, PlatformEvent::MouseReleased, 1, false, false, false, false, WallTime::now(), WebCore::ForceAtClick, WebCore::NoTap);
</span><span class="cx">     corePage()->userInputBridge().handleMouseReleaseEvent(mouseReleaseEvent);
</span><span class="lines">@@ -2757,11 +2756,11 @@
</span><span class="cx">     constexpr OptionSet<HitTestRequest::RequestType> hitType { HitTestRequest::ReadOnly, HitTestRequest::Active, HitTestRequest::DisallowUserAgentShadowContent,  HitTestRequest::AllowChildFrameContent };
</span><span class="cx">     HitTestResult result = page->corePage()->mainFrame().eventHandler().hitTestResultAtPoint(point, hitType);
</span><span class="cx"> 
</span><del>-    Ref frame = page->corePage()->mainFrame();
</del><ins>+    Frame* frame = &page->corePage()->mainFrame();
</ins><span class="cx">     if (result.innerNonSharedNode())
</span><del>-        frame = *result.innerNonSharedNode()->document().frame();
</del><ins>+        frame = result.innerNonSharedNode()->document().frame();
</ins><span class="cx"> 
</span><del>-    bool handled = page->corePage()->userInputBridge().handleContextMenuEvent(platformMouseEvent, frame);
</del><ins>+    bool handled = page->corePage()->userInputBridge().handleContextMenuEvent(platformMouseEvent, *frame);
</ins><span class="cx"> #if ENABLE(CONTEXT_MENUS)
</span><span class="cx">     if (handled)
</span><span class="cx">         page->contextMenu().show();
</span></span></pre></div>
<a id="branchessafari6113100branchSourceWebKitLegacymacConfigurationsVersionxcconfig"></a>
<div class="modfile"><h4>Modified: branches/safari-611.3.10.0-branch/Source/WebKitLegacy/mac/Configurations/Version.xcconfig (281401 => 281402)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-611.3.10.0-branch/Source/WebKitLegacy/mac/Configurations/Version.xcconfig        2021-08-22 16:38:05 UTC (rev 281401)
+++ branches/safari-611.3.10.0-branch/Source/WebKitLegacy/mac/Configurations/Version.xcconfig   2021-08-22 17:08:45 UTC (rev 281402)
</span><span class="lines">@@ -22,11 +22,11 @@
</span><span class="cx"> // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
</span><span class="cx"> 
</span><span class="cx"> MAJOR_VERSION = 611;
</span><del>-MINOR_VERSION = 4;
-TINY_VERSION = 0;
-MICRO_VERSION = 2;
-NANO_VERSION = 0;
-FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION);
</del><ins>+MINOR_VERSION = 3;
+TINY_VERSION = 10;
+MICRO_VERSION = 0;
+NANO_VERSION = 1;
+FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION).$(NANO_VERSION);
</ins><span class="cx"> 
</span><span class="cx"> // The bundle version and short version string are set based on the current build configuration, see below.
</span><span class="cx"> BUNDLE_VERSION = $(BUNDLE_VERSION_$(CONFIGURATION));
</span></span></pre>
</div>
</div>

</body>
</html>