date:20160718

Title: [203350] trunk

Revision 203350
Author fpi...@apple.com
Date 2016-07-18 11:32:52 -0700 (Mon, 18 Jul 2016)

Log Message
WTF::Lock should be fair eventually
https://bugs.webkit.org/show_bug.cgi?id=159384

Reviewed by Geoffrey Garen.
Source/WTF:

In https://webkit.org/blog/6161/locking-in-webkit/ we showed how relaxing the fairness of
locks makes them fast. That post presented lock fairness as a trade-off between two
extremes:

- Barging. A barging lock, like WTF::Lock, releases the lock in unlock() even if there was a
thread on the queue. If there was a thread on the queue, the lock is released and that
thread is made runnable. That thread may then grab the lock, or some other thread may grab
the lock first (it may barge). Usually, the barging thread is the thread that released the
lock in the first place. This maximizes throughput but hurts fairness. There is no good
theoretical bound on how unfair the lock may become, but empirical data suggests that it's
fair enough for the cases we previously measured.

- FIFO. A FIFO lock, like HandoffLock in ToyLocks.h, does not release the lock in unlock()
if there is a thread waiting. If there is a thread waiting, unlock() will make that thread
runnable and inform it that it now holds the lock. This ensures perfect round-robin
fairness and allows us to reason theoretically about how long it may take for a thread to
grab the lock. For example, if we know that only N threads are running and each one may
contend on a critical section, and each one may hold the lock for at most S seconds, then
the time it takes to grab the lock is N * S. Unfortunately, FIFO locks perform very badly
in most cases. This is because for the common case of short critical sections, they force
a context switch after each critical section if the lock is contended.

This change makes WTF::Lock almost as fair as FIFO while still being as fast as barging.
Thanks to this new algorithm, you can now have both of these things at the same time.

This change makes WTF::Lock eventually fair. We can almost (more on the caveats below)
guarantee that the time it takes to grab a lock is N * max(1ms, S). In other words, critical
sections that are longer than 1ms are always fair. For shorter critical sections, the amount
of time that any thread waits is 1ms times the number of threads. There are some caveats
that arise from our use of randomness, but even then, in the limit as the critical section
length goes to infinity, the lock becomes fair. The corner cases are unlikely to happen; our
experiments show that the lock becomes exactly as fair as a FIFO lock for any critical
section that is 1ms or longer.

The fairness mechanism is broken into two parts. WTF::Lock can now choose to unlock a lock
fairly or unfairly thanks to the new ParkingLot token mechanism. WTF::Lock knows when to use
fair unlocking based on a timeout mechanism in ParkingLot called timeToBeFair.

ParkingLot::unparkOne() and ParkingLot::parkConditionally() can now communicate with each
other via a token. unparkOne() can pass a token, which parkConditionally() will return. This
change also makes parkConditionally() a lot more precise about when it was unparked due to a
call to unparkOne(). If unparkOne() is told that a thread was unparked then this thread is
guaranteed to report that it was unparked rather than timing out, and that thread is
guaranteed to get the token that unparkOne() passed. The token is an intptr_t. We use it as
a boolean variable in WTF::Lock, but you could use it to pass arbitrary data structures. By
default, the token is zero. WTF::Lock's unlock() will pass 1 as the token if it is doing
fair unlocking. In that case, unlock() will not release the lock, and lock() will know that
it holds the lock as soon as parkConditionally() returns. Note that this algorithm relies
on unparkOne() invoking WTF::Lock's callback while the queue lock is held, so that WTF::Lock
can make a decision about unlock strategy and inject a token while it has complete knowledge
over the state of the queue. As such, it's not immediately obvious how to implement this
algorithm on top of futexes. You really need ParkingLot!

WTF::Lock does not use fair unlocking every time. We expose a new API, Lock::unlockFairly(),
which forces the fair unlocking behavior. Additionally, ParkingLot now maintains a
per-bucket stochastic fairness timeout. When the timeout fires, the unparkOne() callback
sees UnparkResult::timeToBeFair = true. This timeout is set to be anywhere from 0ms to 1ms
at random. When a dequeue happens and there are threads that actually get dequeued, we check
if the time since the last unfair unlock (the last time timeToBeFair was set to true) is
more than the timeout amount. If so, then we set timeToBeFair to true and reset the timeout.
This means that in the absence of ParkingLot collisions, unfair unlocking is guaranteed to
happen at least o

[webkit-changes] [203351] trunk/Source/JavaScriptCore

2016-07-18 Thread keith_miller

Title: [203351] trunk/Source/_javascript_Core








Revision 203351
Author keith_mil...@apple.com
Date 2016-07-18 11:38:42 -0700 (Mon, 18 Jul 2016)


Log Message
Fix bad assertions in genericTypedArrayViewPrivateFuncSubarrayCreate
https://bugs.webkit.org/show_bug.cgi?id=159882


Reviewed by Mark Lam.

According the spec toInteger can return values we don't consider ints.
Such as, -0 and +/-Infinity. This broke some assertions in
genericTypedArrayViewPrivateFuncSubarrayCreate.

* runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
(JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
* tests/stress/typedarray-subarray.js:

Modified Paths

trunk/Source/_javascript_Core/ChangeLog
trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h
trunk/Source/_javascript_Core/tests/stress/typedarray-subarray.js




Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (203350 => 203351)

--- trunk/Source/_javascript_Core/ChangeLog	2016-07-18 18:32:52 UTC (rev 203350)
+++ trunk/Source/_javascript_Core/ChangeLog	2016-07-18 18:38:42 UTC (rev 203351)
@@ -1,3 +1,19 @@
+2016-07-18  Keith Miller  
+
+Fix bad assertions in genericTypedArrayViewPrivateFuncSubarrayCreate
+https://bugs.webkit.org/show_bug.cgi?id=159882
+
+
+Reviewed by Mark Lam.
+
+According the spec toInteger can return values we don't consider ints.
+Such as, -0 and +/-Infinity. This broke some assertions in
+genericTypedArrayViewPrivateFuncSubarrayCreate.
+
+* runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+(JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
+* tests/stress/typedarray-subarray.js:
+
 2016-07-16  Filip Pizlo  
 
 DFG CSE is broken for MultiGetByOffset


Modified: trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h (203350 => 203351)

--- trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h	2016-07-18 18:32:52 UTC (rev 203350)
+++ trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h	2016-07-18 18:38:42 UTC (rev 203351)
@@ -496,8 +496,11 @@
 // Get the length here; later assert that the length didn't change.
 unsigned thisLength = thisObject->length();
 
-ASSERT(exec->argument(0).isAnyInt());
-ASSERT(exec->argument(1).isUndefined() || exec->argument(1).isAnyInt());
+// I would assert that the arguments are integers here but that's not true since
+// https://tc39.github.io/ecma262/#sec-tointeger allows the result of the operation
+// to be +/- Infinity and -0.
+ASSERT(exec->argument(0).isNumber());
+ASSERT(exec->argument(1).isUndefined() || exec->argument(1).isNumber());
 unsigned begin = argumentClampedIndexFromStartOrEnd(exec, 0, thisLength);
 ASSERT(!vm.exception());
 unsigned end = argumentClampedIndexFromStartOrEnd(exec, 1, thisLength, thisLength);


Modified: trunk/Source/_javascript_Core/tests/stress/typedarray-subarray.js (203350 => 203351)

--- trunk/Source/_javascript_Core/tests/stress/typedarray-subarray.js	2016-07-18 18:32:52 UTC (rev 203350)
+++ trunk/Source/_javascript_Core/tests/stress/typedarray-subarray.js	2016-07-18 18:38:42 UTC (rev 203351)
@@ -58,4 +58,21 @@
 
 shouldBeTrue("forEachTypedArray(subclasses, testSpeciesRemoveConstructor)");
 
+debug("5.0 Coercion First Argument");
+shouldBeTrue("testPrototypeFunction('subarray', '(true)', [1, 2, 3, 4], [2, 3, 4])");
+shouldBeTrue("testPrototypeFunction('subarray', '(\"abc\")', [1, 2, 3, 4], [1, 2, 3, 4])");
+shouldBeTrue("testPrototypeFunction('subarray', '({ valueOf() { return Infinity; } })', [1, 2, 3, 4], [])");
+shouldBeTrue("testPrototypeFunction('subarray', '({ valueOf() { return -0; } })', [1, 2, 3, 4], [1, 2, 3, 4])");
+shouldBeTrue("testPrototypeFunction('subarray', '(null)', [1, 2, 3, 4], [1, 2, 3, 4])");
+shouldBeTrue("testPrototypeFunction('subarray', '(undefined)', [1, 2, 3, 4], [1, 2, 3, 4])");
+
+debug("5.1 Coercion Second Argument");
+shouldBeTrue("testPrototypeFunction('subarray', '(0, true)', [1, 2, 3, 4], [1])");
+shouldBeTrue("testPrototypeFunction('subarray', '(0, \"abc\")', [1, 2, 3, 4], [])");
+shouldBeTrue("testPrototypeFunction('subarray', '(0, \"1\")', [1, 2, 3, 4], [1])");
+shouldBeTrue("testPrototypeFunction('subarray', '(0, undefined)', [1, 2, 3, 4], [1, 2, 3, 4])");
+shouldBeTrue("testPrototypeFunction('subarray', '(0, { valueOf() { return Infinity; } })', [1, 2, 3, 4], [1, 2, 3, 4])");
+shouldBeTrue("testPrototypeFunction('subarray', '(0, { valueOf() { return -0; } })', [1, 2, 3, 4], [])");
+shouldBeTrue("testPrototypeFunction('subarray', '(0, null)', [1, 2, 3, 4], [])");
+
 finishJSTest();






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [203352] branches/safari-602-branch/

Title: [203352] branches/safari-602-branch/








Revision 203352
Author bshaf...@apple.com
Date 2016-07-18 11:46:31 -0700 (Mon, 18 Jul 2016)


Log Message
New Branch.

Added Paths

branches/safari-602-branch/




Diff




___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [203353] trunk/Source/JavaScriptCore

2016-07-18 Thread commit-queue

Title: [203353] trunk/Source/_javascript_Core








Revision 203353
Author commit-qu...@webkit.org
Date 2016-07-18 11:47:02 -0700 (Mon, 18 Jul 2016)


Log Message
REGRESSION(r202975): --minimal build is broken
https://bugs.webkit.org/show_bug.cgi?id=159765

Patch by Youenn Fablet  on 2016-07-18
Reviewed by Chris Dumez.

Covered partially by builtin generated test code.

Updating generator to add a global compilation guard around the code that generates all global internal properties.
Split the generate_methods function in two, one dedicated to the visit method and the second one dedicated to
the initialize method.

* Scripts/builtins/builtins_generate_internals_wrapper_implementation.py:
(BuiltinsInternalsWrapperImplementationGenerator.generate_section_for_object): Use splitted generation functions.
(BuiltinsInternalsWrapperImplementationGenerator.generate_visit_method): Response to generate the visit method.
(BuiltinsInternalsWrapperImplementationGenerator._generate_initialize_static_globals): Responsible to generate
the code to initialize the internal globals. This code is put in a global compilation guard in case all
internals are compiled out by specific builds.
(BuiltinsInternalsWrapperImplementationGenerator):
(BuiltinsInternalsWrapperImplementationGenerator.generate_initialize_method): Responsible to generate the
initialize method.
(BuiltinsInternalsWrapperImplementationGenerator.generate_methods): Deleted.
* Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result: Copyright change.
* Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result: Ditto.
* Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result: Ditto.
* Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result: Ditto.
* Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result: Reflects partially the built-in
generator change.

Modified Paths

trunk/Source/_javascript_Core/ChangeLog
trunk/Source/_javascript_Core/Scripts/builtins/builtins_generate_internals_wrapper_implementation.py
trunk/Source/_javascript_Core/Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result
trunk/Source/_javascript_Core/Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result
trunk/Source/_javascript_Core/Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result
trunk/Source/_javascript_Core/Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result
trunk/Source/_javascript_Core/Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result




Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (203352 => 203353)

--- trunk/Source/_javascript_Core/ChangeLog	2016-07-18 18:46:31 UTC (rev 203352)
+++ trunk/Source/_javascript_Core/ChangeLog	2016-07-18 18:47:02 UTC (rev 203353)
@@ -1,3 +1,33 @@
+2016-07-18  Youenn Fablet  
+
+REGRESSION(r202975): --minimal build is broken
+https://bugs.webkit.org/show_bug.cgi?id=159765
+
+Reviewed by Chris Dumez.
+
+Covered partially by builtin generated test code.
+
+Updating generator to add a global compilation guard around the code that generates all global internal properties.
+Split the generate_methods function in two, one dedicated to the visit method and the second one dedicated to
+the initialize method.
+
+* Scripts/builtins/builtins_generate_internals_wrapper_implementation.py:
+(BuiltinsInternalsWrapperImplementationGenerator.generate_section_for_object): Use splitted generation functions.
+(BuiltinsInternalsWrapperImplementationGenerator.generate_visit_method): Response to generate the visit method.
+(BuiltinsInternalsWrapperImplementationGenerator._generate_initialize_static_globals): Responsible to generate
+the code to initialize the internal globals. This code is put in a global compilation guard in case all
+internals are compiled out by specific builds.
+(BuiltinsInternalsWrapperImplementationGenerator):
+(BuiltinsInternalsWrapperImplementationGenerator.generate_initialize_method): Responsible to generate the
+initialize method.
+(BuiltinsInternalsWrapperImplementationGenerator.generate_methods): Deleted.
+* Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result: Copyright change.
+* Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result: Ditto.
+* Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result: Ditto.
+* Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result: Ditto.
+* Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result: Reflects partially the built-in
+generator change.
+
 2016-07-18  Keith Miller  
 
 Fix bad assertions in genericTypedArrayViewPrivateFuncSubarrayCreate


Modified: trunk/Source/

[webkit-changes] [203354] trunk/Source

Title: [203354] trunk/Source








Revision 203354
Author bshaf...@apple.com
Date 2016-07-18 11:48:23 -0700 (Mon, 18 Jul 2016)


Log Message
Versioning.

Modified Paths

trunk/Source/_javascript_Core/Configurations/Version.xcconfig
trunk/Source/WebCore/Configurations/Version.xcconfig
trunk/Source/WebInspectorUI/Configurations/Version.xcconfig
trunk/Source/WebKit/mac/Configurations/Version.xcconfig
trunk/Source/WebKit2/Configurations/Version.xcconfig




Diff

Modified: trunk/Source/_javascript_Core/Configurations/Version.xcconfig (203353 => 203354)

--- trunk/Source/_javascript_Core/Configurations/Version.xcconfig	2016-07-18 18:47:02 UTC (rev 203353)
+++ trunk/Source/_javascript_Core/Configurations/Version.xcconfig	2016-07-18 18:48:23 UTC (rev 203354)
@@ -21,9 +21,9 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-MAJOR_VERSION = 602;
+MAJOR_VERSION = 603;
 MINOR_VERSION = 1;
-TINY_VERSION = 42;
+TINY_VERSION = 1;
 MICRO_VERSION = 0;
 NANO_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION);


Modified: trunk/Source/WebCore/Configurations/Version.xcconfig (203353 => 203354)

--- trunk/Source/WebCore/Configurations/Version.xcconfig	2016-07-18 18:47:02 UTC (rev 203353)
+++ trunk/Source/WebCore/Configurations/Version.xcconfig	2016-07-18 18:48:23 UTC (rev 203354)
@@ -21,9 +21,9 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-MAJOR_VERSION = 602;
+MAJOR_VERSION = 603;
 MINOR_VERSION = 1;
-TINY_VERSION = 42;
+TINY_VERSION = 1;
 MICRO_VERSION = 0;
 NANO_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION);


Modified: trunk/Source/WebInspectorUI/Configurations/Version.xcconfig (203353 => 203354)

--- trunk/Source/WebInspectorUI/Configurations/Version.xcconfig	2016-07-18 18:47:02 UTC (rev 203353)
+++ trunk/Source/WebInspectorUI/Configurations/Version.xcconfig	2016-07-18 18:48:23 UTC (rev 203354)
@@ -1,6 +1,6 @@
-MAJOR_VERSION = 602;
+MAJOR_VERSION = 603;
 MINOR_VERSION = 1;
-TINY_VERSION = 42;
+TINY_VERSION = 1;
 MICRO_VERSION = 0;
 NANO_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION);


Modified: trunk/Source/WebKit/mac/Configurations/Version.xcconfig (203353 => 203354)

--- trunk/Source/WebKit/mac/Configurations/Version.xcconfig	2016-07-18 18:47:02 UTC (rev 203353)
+++ trunk/Source/WebKit/mac/Configurations/Version.xcconfig	2016-07-18 18:48:23 UTC (rev 203354)
@@ -21,9 +21,9 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-MAJOR_VERSION = 602;
+MAJOR_VERSION = 603;
 MINOR_VERSION = 1;
-TINY_VERSION = 42;
+TINY_VERSION = 1;
 MICRO_VERSION = 0;
 NANO_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION);


Modified: trunk/Source/WebKit2/Configurations/Version.xcconfig (203353 => 203354)

--- trunk/Source/WebKit2/Configurations/Version.xcconfig	2016-07-18 18:47:02 UTC (rev 203353)
+++ trunk/Source/WebKit2/Configurations/Version.xcconfig	2016-07-18 18:48:23 UTC (rev 203354)
@@ -21,9 +21,9 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-MAJOR_VERSION = 602;
+MAJOR_VERSION = 603;
 MINOR_VERSION = 1;
-TINY_VERSION = 42;
+TINY_VERSION = 1;
 MICRO_VERSION = 0;
 NANO_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION);






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [203356] trunk

Title: [203356] trunk








Revision 203356
Author fpi...@apple.com
Date 2016-07-18 11:55:31 -0700 (Mon, 18 Jul 2016)


Log Message
OSR entry into DFG has problems with lexical scoping
https://bugs.webkit.org/show_bug.cgi?id=159687

Reviewed by Saam Barati.
Source/_javascript_Core:


What a fun bug! It turns out that uses of lexical scoping, like "let", may sometimes cause us
to not be able to OSR enter into a loop from baseline to DFG. The bug is in a mitigation for
a different bug, which in turn had a mitigation for yet another bug, so the story here is a
long one.

DFG OSR entry has long had a mitigation for the following bug: the DFG bytecode parser may
choose to make us always OSR exit at some instruction if it thinks that it doesn't have
enough profiling for that instruction. We will do this if some kinds of put_by_id only
execute once, for example. This causes problems for loopy benchmarks like this:

put_by_id(something crazy);
for (var i = 0; i < bigNumber; ++i) simpleMath;

In this case, the put_by_id will have only executed once, and since it did something crazy
that one time, the bytecode parser will replace it with ForceOSRExit.

This creates an OSR entry bug: DFG CFA will then prove that the loop is unreachable, and will
tell OSR entry that it's impossible to enter into that loop.

We mitigated this bug a long time ago by recording mustHandleValues for loops at which we
want to enter. We inject these values into DFG CFA and we force CFA to recognize that the
loop is reachable even if CFA wanted to prove that it wasn't.

But this leads to another bug: we need to scrape the values from the stack inside
operationOptimize() and then we need to reason about them in the compiler. Some of those
values may be garbage, which would cause pandemonium inside the compiler. We also mitigated
this bug, by only recording the "vars", since those are guaranteed to be reset by op_enter.

And that's where the lexical scoping bug happens: "let" bound variables aren't part of the
"vars". DFG will see that they are live, but mustHandleValues will not have anything for
those variables, so CFA will prove that the values are Bottom. Then OSR entry will always
fail because no value is ever a subset of Bottom.

The first part of the fix is to ensure that mustHandleValues record all of the values on the
stack (i.e. within m_numCalleeLocals, rather than just m_numVars). But this creates a second
problem: we may record garbage. This patch includes a better fix for the garbage: before
touching mustHandleValues we run the bytecode liveness analysis and clear any values that are
not live. This ensures that we clear the garbage.

This is an enormous speed-up on microbenchmarks that use lexical scoping and have some crazy
put_by_id in the lead-up to the hot loop.

* dfg/DFGCFAPhase.cpp:
(JSC::DFG::CFAPhase::run):
* dfg/DFGOSREntry.cpp:
(JSC::DFG::prepareOSREntry):
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::compileInThreadImpl):
(JSC::DFG::Plan::checkLivenessAndVisitChildren):
(JSC::DFG::Plan::cancel):
(JSC::DFG::Plan::cleanMustHandleValuesIfNecessary):
* dfg/DFGPlan.h:
(JSC::DFG::Plan::canTierUpAndOSREnter):
* jit/JITOperations.cpp:

LayoutTests:


* js/regress/script-tests/strict-osr-entry.js: Added.
(let.o.apply_):
* js/regress/strict-osr-entry-expected.txt: Added.
* js/regress/strict-osr-entry.html: Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/_javascript_Core/ChangeLog
trunk/Source/_javascript_Core/dfg/DFGCFAPhase.cpp
trunk/Source/_javascript_Core/dfg/DFGOSREntry.cpp
trunk/Source/_javascript_Core/dfg/DFGPlan.cpp
trunk/Source/_javascript_Core/dfg/DFGPlan.h
trunk/Source/_javascript_Core/jit/JITOperations.cpp


Added Paths

trunk/LayoutTests/js/regress/script-tests/strict-osr-entry.js
trunk/LayoutTests/js/regress/strict-osr-entry-expected.txt
trunk/LayoutTests/js/regress/strict-osr-entry.html




Diff

Modified: trunk/LayoutTests/ChangeLog (203355 => 203356)

--- trunk/LayoutTests/ChangeLog	2016-07-18 18:51:13 UTC (rev 203355)
+++ trunk/LayoutTests/ChangeLog	2016-07-18 18:55:31 UTC (rev 203356)
@@ -1,3 +1,15 @@
+2016-07-12  Filip Pizlo  
+
+OSR entry into DFG has problems with lexical scoping
+https://bugs.webkit.org/show_bug.cgi?id=159687
+
+Reviewed by Saam Barati.
+
+* js/regress/script-tests/strict-osr-entry.js: Added.
+(let.o.apply_):
+* js/regress/strict-osr-entry-expected.txt: Added.
+* js/regress/strict-osr-entry.html: Added.
+
 2016-07-18  Youenn Fablet  
 
 [Streams API] ReadableStream should throw a RangeError in case of NaN highWaterMark


Added: trunk/LayoutTests/js/regress/script-tests/strict-osr-entry.js (0 => 203356)

--- trunk/LayoutTests/js/regress/script-tests/strict-osr-entry.js	(rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/strict-osr-entry.js	2016-07-18 18:55:31 UTC (rev 203356)
@@ -0,0 +1,17 @@
+"use strict";

[webkit-changes] [203355] branches/safari-602-branch/Source/JavaScriptCore

Title: [203355] branches/safari-602-branch/Source/_javascript_Core








Revision 203355
Author bshaf...@apple.com
Date 2016-07-18 11:51:13 -0700 (Mon, 18 Jul 2016)


Log Message
Merged r203353.  rdar://problem/27405849

Modified Paths

branches/safari-602-branch/Source/_javascript_Core/ChangeLog
branches/safari-602-branch/Source/_javascript_Core/Scripts/builtins/builtins_generate_internals_wrapper_implementation.py
branches/safari-602-branch/Source/_javascript_Core/Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result
branches/safari-602-branch/Source/_javascript_Core/Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result
branches/safari-602-branch/Source/_javascript_Core/Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result
branches/safari-602-branch/Source/_javascript_Core/Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result
branches/safari-602-branch/Source/_javascript_Core/Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result




Diff

Modified: branches/safari-602-branch/Source/_javascript_Core/ChangeLog (203354 => 203355)

--- branches/safari-602-branch/Source/_javascript_Core/ChangeLog	2016-07-18 18:48:23 UTC (rev 203354)
+++ branches/safari-602-branch/Source/_javascript_Core/ChangeLog	2016-07-18 18:51:13 UTC (rev 203355)
@@ -1,3 +1,37 @@
+2016-07-18  Babak Shafiei  
+
+Merge r203353.
+
+2016-07-18  Youenn Fablet  
+
+REGRESSION(r202975): --minimal build is broken
+https://bugs.webkit.org/show_bug.cgi?id=159765
+
+Reviewed by Chris Dumez.
+
+Covered partially by builtin generated test code.
+
+Updating generator to add a global compilation guard around the code that generates all global internal properties.
+Split the generate_methods function in two, one dedicated to the visit method and the second one dedicated to
+the initialize method.
+
+* Scripts/builtins/builtins_generate_internals_wrapper_implementation.py:
+(BuiltinsInternalsWrapperImplementationGenerator.generate_section_for_object): Use splitted generation functions.
+(BuiltinsInternalsWrapperImplementationGenerator.generate_visit_method): Response to generate the visit method.
+(BuiltinsInternalsWrapperImplementationGenerator._generate_initialize_static_globals): Responsible to generate
+the code to initialize the internal globals. This code is put in a global compilation guard in case all
+internals are compiled out by specific builds.
+(BuiltinsInternalsWrapperImplementationGenerator):
+(BuiltinsInternalsWrapperImplementationGenerator.generate_initialize_method): Responsible to generate the
+initialize method.
+(BuiltinsInternalsWrapperImplementationGenerator.generate_methods): Deleted.
+* Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result: Copyright change.
+* Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result: Ditto.
+* Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result: Ditto.
+* Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result: Ditto.
+* Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result: Reflects partially the built-in
+generator change.
+
 2016-07-16  Filip Pizlo  
 
 DFG CSE is broken for MultiGetByOffset


Modified: branches/safari-602-branch/Source/_javascript_Core/Scripts/builtins/builtins_generate_internals_wrapper_implementation.py (203354 => 203355)

--- branches/safari-602-branch/Source/_javascript_Core/Scripts/builtins/builtins_generate_internals_wrapper_implementation.py	2016-07-18 18:48:23 UTC (rev 203354)
+++ branches/safari-602-branch/Source/_javascript_Core/Scripts/builtins/builtins_generate_internals_wrapper_implementation.py	2016-07-18 18:51:13 UTC (rev 203355)
@@ -83,7 +83,8 @@
 lines = []
 
 lines.append(self.generate_constructor())
-lines.append(self.generate_methods())
+lines.append(self.generate_visit_method())
+lines.append(self.generate_initialize_method())
 return '\n'.join(lines)
 
 def accessor_name(self, object):
@@ -113,26 +114,38 @@
 lines.append("#undef DECLARE_GLOBAL_STATIC")
 return '\n'.join(lines)
 
-def generate_methods(self):
+def generate_visit_method(self):
 lines = ["void JSBuiltinInternalFunctions::visit(JSC::SlotVisitor& visitor)",
  "{"]
 for object in self.internals:
 visit = "%s.visit(visitor);" % self.member_name(object)
 lines.append(BuiltinsGenerator.wrap_with_guard(object.annotations.get('conditional'), visit))
-lines.append("UNUSED_PARAM(visitor);\n}")
+lines.append("UNUSED_PARAM

[webkit-changes] [203358] trunk/LayoutTests

Title: [203358] trunk/LayoutTests








Revision 203358
Author ryanhad...@apple.com
Date 2016-07-18 11:57:47 -0700 (Mon, 18 Jul 2016)


Log Message
Marking fast/shapes/shape-outside-floats/shape-outside-big-box-border-radius-002.html as flaky on ios-sim
https://bugs.webkit.org/show_bug.cgi?id=159881

Unreviewed test gardening.

* platform/ios-simulator-wk2/TestExpectations:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/platform/ios-simulator-wk2/TestExpectations




Diff

Modified: trunk/LayoutTests/ChangeLog (203357 => 203358)

--- trunk/LayoutTests/ChangeLog	2016-07-18 18:57:43 UTC (rev 203357)
+++ trunk/LayoutTests/ChangeLog	2016-07-18 18:57:47 UTC (rev 203358)
@@ -1,5 +1,14 @@
 2016-07-18  Ryan Haddad  
 
+Marking fast/shapes/shape-outside-floats/shape-outside-big-box-border-radius-002.html as flaky on ios-sim
+https://bugs.webkit.org/show_bug.cgi?id=159881
+
+Unreviewed test gardening.
+
+* platform/ios-simulator-wk2/TestExpectations:
+
+2016-07-18  Ryan Haddad  
+
 Marking http/tests/loading/basic-auth-resend-wrong-credentials.html as flaky on Mac and iOS WK2
 https://bugs.webkit.org/show_bug.cgi?id=159884
 


Modified: trunk/LayoutTests/platform/ios-simulator-wk2/TestExpectations (203357 => 203358)

--- trunk/LayoutTests/platform/ios-simulator-wk2/TestExpectations	2016-07-18 18:57:43 UTC (rev 203357)
+++ trunk/LayoutTests/platform/ios-simulator-wk2/TestExpectations	2016-07-18 18:57:47 UTC (rev 203358)
@@ -1913,4 +1913,6 @@
 
 webkit.org/b/159840 [ Release ] http/tests/cache/disk-cache/disk-cache-request-max-stale.html [ Pass Timeout ]
 
-webkit.org/b/159884 [ Debug ] http/tests/loading/basic-auth-resend-wrong-credentials.html [ Pass Failure ]
\ No newline at end of file
+webkit.org/b/159884 [ Debug ] http/tests/loading/basic-auth-resend-wrong-credentials.html [ Pass Failure ]
+
+webkit.org/b/159881 [ Release ] fast/shapes/shape-outside-floats/shape-outside-big-box-border-radius-002.html [ Pass ImageOnlyFailure ]
\ No newline at end of file






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [203357] trunk/LayoutTests

Title: [203357] trunk/LayoutTests








Revision 203357
Author ryanhad...@apple.com
Date 2016-07-18 11:57:43 -0700 (Mon, 18 Jul 2016)


Log Message
Marking http/tests/loading/basic-auth-resend-wrong-credentials.html as flaky on Mac and iOS WK2
https://bugs.webkit.org/show_bug.cgi?id=159884

Unreviewed test gardening.

* platform/ios-simulator-wk2/TestExpectations:
* platform/mac-wk2/TestExpectations:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/platform/ios-simulator-wk2/TestExpectations
trunk/LayoutTests/platform/mac-wk2/TestExpectations




Diff

Modified: trunk/LayoutTests/ChangeLog (203356 => 203357)

--- trunk/LayoutTests/ChangeLog	2016-07-18 18:55:31 UTC (rev 203356)
+++ trunk/LayoutTests/ChangeLog	2016-07-18 18:57:43 UTC (rev 203357)
@@ -1,3 +1,13 @@
+2016-07-18  Ryan Haddad  
+
+Marking http/tests/loading/basic-auth-resend-wrong-credentials.html as flaky on Mac and iOS WK2
+https://bugs.webkit.org/show_bug.cgi?id=159884
+
+Unreviewed test gardening.
+
+* platform/ios-simulator-wk2/TestExpectations:
+* platform/mac-wk2/TestExpectations:
+
 2016-07-12  Filip Pizlo  
 
 OSR entry into DFG has problems with lexical scoping


Modified: trunk/LayoutTests/platform/ios-simulator-wk2/TestExpectations (203356 => 203357)

--- trunk/LayoutTests/platform/ios-simulator-wk2/TestExpectations	2016-07-18 18:55:31 UTC (rev 203356)
+++ trunk/LayoutTests/platform/ios-simulator-wk2/TestExpectations	2016-07-18 18:57:43 UTC (rev 203357)
@@ -1911,4 +1911,6 @@
 
 webkit.org/b/159724 [ Release ] imported/w3c/web-platform-tests/XMLHttpRequest/send-redirect-post-upload.htm [ Failure ]
 
-webkit.org/b/159840 [ Release ] http/tests/cache/disk-cache/disk-cache-request-max-stale.html [ Pass Timeout ]
\ No newline at end of file
+webkit.org/b/159840 [ Release ] http/tests/cache/disk-cache/disk-cache-request-max-stale.html [ Pass Timeout ]
+
+webkit.org/b/159884 [ Debug ] http/tests/loading/basic-auth-resend-wrong-credentials.html [ Pass Failure ]
\ No newline at end of file


Modified: trunk/LayoutTests/platform/mac-wk2/TestExpectations (203356 => 203357)

--- trunk/LayoutTests/platform/mac-wk2/TestExpectations	2016-07-18 18:55:31 UTC (rev 203356)
+++ trunk/LayoutTests/platform/mac-wk2/TestExpectations	2016-07-18 18:57:43 UTC (rev 203357)
@@ -524,3 +524,5 @@
 webkit.org/b/159430 [ Debug Sierra+ ] media/restore-from-page-cache.html [ Pass Crash ]
 
 webkit.org/b/159724 [ Release ] imported/w3c/web-platform-tests/XMLHttpRequest/send-redirect-post-upload.htm [ Failure ]
+
+webkit.org/b/159884 http/tests/loading/basic-auth-resend-wrong-credentials.html [ Pass Failure ]






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [203359] branches/safari-602-branch/Source

Title: [203359] branches/safari-602-branch/Source








Revision 203359
Author bshaf...@apple.com
Date 2016-07-18 12:07:09 -0700 (Mon, 18 Jul 2016)


Log Message
Merge patch for rdar://problem/27360961.

Modified Paths

branches/safari-602-branch/Source/_javascript_Core/ChangeLog
branches/safari-602-branch/Source/_javascript_Core/Configurations/FeatureDefines.xcconfig
branches/safari-602-branch/Source/WTF/ChangeLog
branches/safari-602-branch/Source/WTF/wtf/FeatureDefines.h
branches/safari-602-branch/Source/WebCore/ChangeLog
branches/safari-602-branch/Source/WebCore/Configurations/FeatureDefines.xcconfig
branches/safari-602-branch/Source/WebCore/css/CSSParser.cpp
branches/safari-602-branch/Source/WebKit/mac/ChangeLog
branches/safari-602-branch/Source/WebKit/mac/Configurations/FeatureDefines.xcconfig
branches/safari-602-branch/Source/WebKit2/ChangeLog
branches/safari-602-branch/Source/WebKit2/Configurations/FeatureDefines.xcconfig
branches/safari-602-branch/Source/WebKit2/Shared/WebPreferencesDefinitions.h




Diff

Modified: branches/safari-602-branch/Source/_javascript_Core/ChangeLog (203358 => 203359)

--- branches/safari-602-branch/Source/_javascript_Core/ChangeLog	2016-07-18 18:57:47 UTC (rev 203358)
+++ branches/safari-602-branch/Source/_javascript_Core/ChangeLog	2016-07-18 19:07:09 UTC (rev 203359)
@@ -1,5 +1,16 @@
 2016-07-18  Babak Shafiei  
 
+Merge patch for rdar://problem/27360961.
+
+2016-06-23  Dean Jackson  
+
+Disable some features on safari-602-branch.
+
+
+* Configurations/FeatureDefines.xcconfig:
+
+2016-07-18  Babak Shafiei  
+
 Merge r203353.
 
 2016-07-18  Youenn Fablet  


Modified: branches/safari-602-branch/Source/_javascript_Core/Configurations/FeatureDefines.xcconfig (203358 => 203359)

--- branches/safari-602-branch/Source/_javascript_Core/Configurations/FeatureDefines.xcconfig	2016-07-18 18:57:47 UTC (rev 203358)
+++ branches/safari-602-branch/Source/_javascript_Core/Configurations/FeatureDefines.xcconfig	2016-07-18 19:07:09 UTC (rev 203359)
@@ -53,15 +53,15 @@
 ENABLE_ES6_MODULES = ;
 ENABLE_CONTENT_FILTERING = ENABLE_CONTENT_FILTERING;
 ENABLE_CSP_NEXT = ;
-ENABLE_CSS_ANIMATIONS_LEVEL_2 = ENABLE_CSS_ANIMATIONS_LEVEL_2;
+ENABLE_CSS_ANIMATIONS_LEVEL_2 = ;
 ENABLE_CSS_BOX_DECORATION_BREAK = ENABLE_CSS_BOX_DECORATION_BREAK;
 ENABLE_CSS_COMPOSITING = ENABLE_CSS_COMPOSITING;
 ENABLE_CSS_DEVICE_ADAPTATION = ;
-ENABLE_CSS_GRID_LAYOUT = ENABLE_CSS_GRID_LAYOUT;
+ENABLE_CSS_GRID_LAYOUT = ;
 ENABLE_CSS_IMAGE_ORIENTATION = ;
 ENABLE_CSS_IMAGE_RESOLUTION = ;
 ENABLE_CSS_REGIONS = ENABLE_CSS_REGIONS;
-ENABLE_CSS_SELECTORS_LEVEL4 = ENABLE_CSS_SELECTORS_LEVEL4;
+ENABLE_CSS_SELECTORS_LEVEL4 = ;
 ENABLE_CSS_SHAPES = ENABLE_CSS_SHAPES;
 ENABLE_CSS3_TEXT = ;
 ENABLE_CURSOR_VISIBILITY = ENABLE_CURSOR_VISIBILITY;
@@ -74,11 +74,11 @@
 ENABLE_DOM4_EVENTS_CONSTRUCTOR = ENABLE_DOM4_EVENTS_CONSTRUCTOR;
 ENABLE_ENCRYPTED_MEDIA[sdk=macosx*] = ENABLE_ENCRYPTED_MEDIA;
 ENABLE_ENCRYPTED_MEDIA_V2[sdk=macosx*] = ENABLE_ENCRYPTED_MEDIA_V2;
-ENABLE_FETCH_API = ENABLE_FETCH_API;
+ENABLE_FETCH_API = ;
 ENABLE_FILTERS_LEVEL_2 = ENABLE_FILTERS_LEVEL_2;
 ENABLE_FONT_LOAD_EVENTS = ;
 ENABLE_FULLSCREEN_API[sdk=macosx*] = ENABLE_FULLSCREEN_API;
-ENABLE_GAMEPAD[sdk=macosx*] = ENABLE_GAMEPAD;
+ENABLE_GAMEPAD[sdk=macosx*] = ;
 ENABLE_GAMEPAD_DEPRECATED = ;
 ENABLE_GEOLOCATION = ENABLE_GEOLOCATION;
 ENABLE_ICONDATABASE[sdk=macosx*] = ENABLE_ICONDATABASE;
@@ -85,9 +85,9 @@
 ENABLE_SERVICE_CONTROLS[sdk=macosx*] = ENABLE_SERVICE_CONTROLS;
 ENABLE_INDEXED_DATABASE = ENABLE_INDEXED_DATABASE;
 ENABLE_INDEXED_DATABASE_IN_WORKERS = ENABLE_INDEXED_DATABASE_IN_WORKERS;
-ENABLE_INDIE_UI = ENABLE_INDIE_UI;
-ENABLE_INPUT_TYPE_COLOR[sdk=macosx*] = ENABLE_INPUT_TYPE_COLOR;
-ENABLE_INPUT_TYPE_COLOR_POPOVER[sdk=macosx*] = ENABLE_INPUT_TYPE_COLOR_POPOVER;
+ENABLE_INDIE_UI = ;
+ENABLE_INPUT_TYPE_COLOR[sdk=macosx*] = ;
+ENABLE_INPUT_TYPE_COLOR_POPOVER[sdk=macosx*] = ;
 ENABLE_INPUT_TYPE_DATE[sdk=iphone*] = ENABLE_INPUT_TYPE_DATE;
 ENABLE_INPUT_TYPE_DATETIME_INCOMPLETE = ;
 ENABLE_INPUT_TYPE_DATETIMELOCAL[sdk=iphone*] = ENABLE_INPUT_TYPE_DATETIMELOCAL;
@@ -133,12 +133,12 @@
 ENABLE_MEDIA_SOURCE[sdk=macosx*] = ENABLE_MEDIA_SOURCE;
 
 ENABLE_MEDIA_STATISTICS = ;
-ENABLE_MEDIA_STREAM = ENABLE_MEDIA_STREAM;
+ENABLE_MEDIA_STREAM = ;
 ENABLE_METER_ELEMENT[sdk=macosx*] = ENABLE_METER_ELEMENT;
 ENABLE_MHTML = ;
 ENABLE_MOUSE_CURSOR_SCALE[sdk=macosx*] = ENABLE_MOUSE_CURSOR_SCALE;
 ENABLE_NAVIGATOR_CONTENT_UTILS = ;
-ENABLE_NAVIGATOR_HWCONCURRENCY = ENABLE_NAVIGATOR_HWCONCURRENCY;
+ENABLE_NAVIGATOR_HWCONCURRENCY = ;
 ENABLE_NOSNIFF = ;
 ENABLE_NOTIFICATIONS[sdk=macosx*] = ENABLE_NOTIFICATIONS;
 ENABLE_PDFKIT_PLUGIN[sdk=macosx*] = ENABLE_PDFKIT_PLUGIN;
@@ -154,7 +154,7 @@
 ENABLE_RUBBER_BANDING[sdk=macosx*] = ENABLE_RUBBER_BANDING;
 ENABLE_CSS_SCROLL_SNAP = ENABLE_CSS_SCROLL_SNAP;
 ENABLE_SPEECH_SYNTHESIS = ENABLE_SPEECH_SYNTHESIS;
-ENABLE_STREAMS_API = ENABLE_STREAMS_API;
+ENABLE_STREAMS_API = ;

[webkit-changes] [203360] branches/safari-602-branch/Source/JavaScriptCore

Title: [203360] branches/safari-602-branch/Source/_javascript_Core








Revision 203360
Author bshaf...@apple.com
Date 2016-07-18 12:12:24 -0700 (Mon, 18 Jul 2016)


Log Message
Merged r203351.  rdar://problem/27327111

Modified Paths

branches/safari-602-branch/Source/_javascript_Core/ChangeLog
branches/safari-602-branch/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h
branches/safari-602-branch/Source/_javascript_Core/tests/stress/typedarray-subarray.js




Diff

Modified: branches/safari-602-branch/Source/_javascript_Core/ChangeLog (203359 => 203360)

--- branches/safari-602-branch/Source/_javascript_Core/ChangeLog	2016-07-18 19:07:09 UTC (rev 203359)
+++ branches/safari-602-branch/Source/_javascript_Core/ChangeLog	2016-07-18 19:12:24 UTC (rev 203360)
@@ -1,5 +1,25 @@
 2016-07-18  Babak Shafiei  
 
+Merge r203351.
+
+2016-07-18  Keith Miller  
+
+Fix bad assertions in genericTypedArrayViewPrivateFuncSubarrayCreate
+https://bugs.webkit.org/show_bug.cgi?id=159882
+
+
+Reviewed by Mark Lam.
+
+According the spec toInteger can return values we don't consider ints.
+Such as, -0 and +/-Infinity. This broke some assertions in
+genericTypedArrayViewPrivateFuncSubarrayCreate.
+
+* runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+(JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
+* tests/stress/typedarray-subarray.js:
+
+2016-07-18  Babak Shafiei  
+
 Merge patch for rdar://problem/27360961.
 
 2016-06-23  Dean Jackson  


Modified: branches/safari-602-branch/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h (203359 => 203360)

--- branches/safari-602-branch/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h	2016-07-18 19:07:09 UTC (rev 203359)
+++ branches/safari-602-branch/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h	2016-07-18 19:12:24 UTC (rev 203360)
@@ -496,8 +496,11 @@
 // Get the length here; later assert that the length didn't change.
 unsigned thisLength = thisObject->length();
 
-ASSERT(exec->argument(0).isAnyInt());
-ASSERT(exec->argument(1).isUndefined() || exec->argument(1).isAnyInt());
+// I would assert that the arguments are integers here but that's not true since
+// https://tc39.github.io/ecma262/#sec-tointeger allows the result of the operation
+// to be +/- Infinity and -0.
+ASSERT(exec->argument(0).isNumber());
+ASSERT(exec->argument(1).isUndefined() || exec->argument(1).isNumber());
 unsigned begin = argumentClampedIndexFromStartOrEnd(exec, 0, thisLength);
 ASSERT(!vm.exception());
 unsigned end = argumentClampedIndexFromStartOrEnd(exec, 1, thisLength, thisLength);


Modified: branches/safari-602-branch/Source/_javascript_Core/tests/stress/typedarray-subarray.js (203359 => 203360)

--- branches/safari-602-branch/Source/_javascript_Core/tests/stress/typedarray-subarray.js	2016-07-18 19:07:09 UTC (rev 203359)
+++ branches/safari-602-branch/Source/_javascript_Core/tests/stress/typedarray-subarray.js	2016-07-18 19:12:24 UTC (rev 203360)
@@ -58,4 +58,21 @@
 
 shouldBeTrue("forEachTypedArray(subclasses, testSpeciesRemoveConstructor)");
 
+debug("5.0 Coercion First Argument");
+shouldBeTrue("testPrototypeFunction('subarray', '(true)', [1, 2, 3, 4], [2, 3, 4])");
+shouldBeTrue("testPrototypeFunction('subarray', '(\"abc\")', [1, 2, 3, 4], [1, 2, 3, 4])");
+shouldBeTrue("testPrototypeFunction('subarray', '({ valueOf() { return Infinity; } })', [1, 2, 3, 4], [])");
+shouldBeTrue("testPrototypeFunction('subarray', '({ valueOf() { return -0; } })', [1, 2, 3, 4], [1, 2, 3, 4])");
+shouldBeTrue("testPrototypeFunction('subarray', '(null)', [1, 2, 3, 4], [1, 2, 3, 4])");
+shouldBeTrue("testPrototypeFunction('subarray', '(undefined)', [1, 2, 3, 4], [1, 2, 3, 4])");
+
+debug("5.1 Coercion Second Argument");
+shouldBeTrue("testPrototypeFunction('subarray', '(0, true)', [1, 2, 3, 4], [1])");
+shouldBeTrue("testPrototypeFunction('subarray', '(0, \"abc\")', [1, 2, 3, 4], [])");
+shouldBeTrue("testPrototypeFunction('subarray', '(0, \"1\")', [1, 2, 3, 4], [1])");
+shouldBeTrue("testPrototypeFunction('subarray', '(0, undefined)', [1, 2, 3, 4], [1, 2, 3, 4])");
+shouldBeTrue("testPrototypeFunction('subarray', '(0, { valueOf() { return Infinity; } })', [1, 2, 3, 4], [1, 2, 3, 4])");
+shouldBeTrue("testPrototypeFunction('subarray', '(0, { valueOf() { return -0; } })', [1, 2, 3, 4], [])");
+shouldBeTrue("testPrototypeFunction('subarray', '(0, null)', [1, 2, 3, 4], [])");
+
 finishJSTest();






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [203361] trunk

Title: [203361] trunk








Revision 203361
Author fpi...@apple.com
Date 2016-07-18 12:12:57 -0700 (Mon, 18 Jul 2016)


Log Message
DFG should really support jneq_ptr
https://bugs.webkit.org/show_bug.cgi?id=159700

Reviewed by Keith Miller.

Source/_javascript_Core:

Prior to this change, DFG statically speculated that jneq_ptr would always fall through. This
meant that programs that called o.apply() or o.call() where apply or call weren't the
expected ones (i.e. the function.prototype.apply/call) would rage-recompile forever.

This adds profiling to jneq_ptr. We now know if it always falls through or sometimes doesn't.
If it sometimes doesn't, we now emit an actual control flow diamond. I decided to add a new
NodeType for "equal pointer", since none of the existing ones really captured that. For
example, there was no way to express "equal pointer" for strings or symbols. We don't use it
for that right now, but we might, and if we did, then it would be hugely surprising that the
DFG interpreted this as value equality. So, the DFG now has CompareEqPtr, which means exactly
what jneq_ptr means by "equal pointer".

This is an enormous speed-up on microbenchmarks. I would assume that it's a speed-up on some
real things, too, but I don't know that for a fact.

* bytecode/BytecodeList.json:
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
(JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
(JSC::BytecodeGenerator::emitExpectedFunctionSnippet):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNode.h:
(JSC::DFG::Node::hasCellOperand):
* dfg/DFGNodeType.h:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileRecordRegExpCachedResult):
(JSC::DFG::SpeculativeJIT::compileCompareEqPtr):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGValidate.cpp:
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareEqPtr):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareLess):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEqConstant): Deleted.
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_jneq_ptr):
(JSC::JIT::emit_op_eq):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_jneq_ptr):
(JSC::JIT::emit_op_eq):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:

LayoutTests:

These tests now run super fast.

* js/regress/apply-not-apply-expected.txt: Added.
* js/regress/apply-not-apply.html: Added.
* js/regress/call-or-not-call-expected.txt: Added.
* js/regress/call-or-not-call.html: Added.
* js/regress/script-tests/apply-not-apply.js: Added.
(let.o.apply):
(foo):
* js/regress/script-tests/call-or-not-call.js: Added.
(let.o.call):
(foo):

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/_javascript_Core/ChangeLog
trunk/Source/_javascript_Core/bytecode/BytecodeList.json
trunk/Source/_javascript_Core/bytecode/CodeBlock.cpp
trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp
trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h
trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp
trunk/Source/_javascript_Core/dfg/DFGClobberize.h
trunk/Source/_javascript_Core/dfg/DFGDoesGC.cpp
trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp
trunk/Source/_javascript_Core/dfg/DFGNode.h
trunk/Source/_javascript_Core/dfg/DFGNodeType.h
trunk/Source/_javascript_Core/dfg/DFGPredictionPropagationPhase.cpp
trunk/Source/_javascript_Core/dfg/DFGSafeToExecute.h
trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp
trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.h
trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT32_64.cpp
trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp
trunk/Source/_javascript_Core/dfg/DFGValidate.cpp
trunk/Source/_javascript_Core/ftl/FTLCapabilities.cpp
trunk/Source/_javascript_Core/ftl/FTLLowerDFGToB3.cpp
trunk/Source/_javascript_Core/jit/JITOpcodes.cpp
trunk/Source/_javascript_Core/jit/JITOpcodes32_64.cpp
trunk/Source/_javascript_Core/llint/LowLevelInterpreter32_64.asm
trunk/Source/_javascript_Core/llint/LowLevelInterpreter64.asm


Added Paths

trunk/LayoutTests/js/regress/apply-not-apply-expected.txt
trunk/LayoutTests/js/regress/apply-not-apply.html
trunk/LayoutTests/js/regress/call-or-not-call-expected.txt
trunk/LayoutTests/js/regress/call-or-not-call.html
trunk/LayoutTests/js/regress/script-tests/apply-not-apply.js
trunk/LayoutTests/js/regress/s

[webkit-changes] [203363] trunk/Source/WebCore

2016-07-18 Thread commit-queue

Title: [203363] trunk/Source/WebCore








Revision 203363
Author commit-qu...@webkit.org
Date 2016-07-18 12:23:41 -0700 (Mon, 18 Jul 2016)


Log Message
Move MediaSampleAVFObjC into its own file
https://bugs.webkit.org/show_bug.cgi?id=159796


In preparation for a feature that uses MediaSampleAVFObjC, but does
not need SourceBufferPrivateAVFObjC, it is beneficial to move
MediaSampleAVFObjC to its own file.

Patch by George Ruan  on 2016-07-18
Reviewed by Eric Carlson.

* WebCore.xcodeproj/project.pbxproj:
* platform/MediaSample.h: Allow setting trackID to associate
MediaSample id with MediaStreamTrackPrivate id.
* platform/graphics/avfoundation/MediaSampleAVFObjC.h: Added.
* platform/graphics/avfoundation/objc/MediaSampleAVFObjC.mm: Moved
from MediaSampleAVFObjC
(WebCore::MediaSampleAVFObjC::presentationTime):
(WebCore::MediaSampleAVFObjC::decodeTime):
(WebCore::MediaSampleAVFObjC::duration):
(WebCore::MediaSampleAVFObjC::sizeInBytes):
(WebCore::MediaSampleAVFObjC::platformSample):
(WebCore::CMSampleBufferIsRandomAccess):
(WebCore::MediaSampleAVFObjC::flags):
(WebCore::MediaSampleAVFObjC::presentationSize):
(WebCore::MediaSampleAVFObjC::dump):
(WebCore::MediaSampleAVFObjC::offsetTimestampsBy):
(WebCore::MediaSampleAVFObjC::setTimestamps):
* platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
Moved MediaSampleAVFObjC to its own file.
(WebCore::MediaSampleAVFObjC::platformSample): Deleted.
(WebCore::CMSampleBufferIsRandomAccess): Deleted.
(WebCore::MediaSampleAVFObjC::flags): Deleted.
(WebCore::MediaSampleAVFObjC::presentationSize): Deleted.
(WebCore::MediaSampleAVFObjC::dump): Deleted.
(WebCore::MediaSampleAVFObjC::offsetTimestampsBy): Deleted.
(WebCore::MediaSampleAVFObjC::setTimestamps): Deleted.
* platform/mock/mediasource/MockSourceBufferPrivate.cpp:

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj
trunk/Source/WebCore/platform/MediaSample.h
trunk/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm
trunk/Source/WebCore/platform/mock/mediasource/MockSourceBufferPrivate.cpp


Added Paths

trunk/Source/WebCore/platform/graphics/avfoundation/MediaSampleAVFObjC.h
trunk/Source/WebCore/platform/graphics/avfoundation/objc/MediaSampleAVFObjC.mm




Diff

Modified: trunk/Source/WebCore/ChangeLog (203362 => 203363)

--- trunk/Source/WebCore/ChangeLog	2016-07-18 19:18:23 UTC (rev 203362)
+++ trunk/Source/WebCore/ChangeLog	2016-07-18 19:23:41 UTC (rev 203363)
@@ -1,3 +1,43 @@
+2016-07-18  George Ruan  
+
+Move MediaSampleAVFObjC into its own file
+https://bugs.webkit.org/show_bug.cgi?id=159796
+
+
+In preparation for a feature that uses MediaSampleAVFObjC, but does
+not need SourceBufferPrivateAVFObjC, it is beneficial to move
+MediaSampleAVFObjC to its own file.
+
+Reviewed by Eric Carlson.
+
+* WebCore.xcodeproj/project.pbxproj:
+* platform/MediaSample.h: Allow setting trackID to associate
+MediaSample id with MediaStreamTrackPrivate id.
+* platform/graphics/avfoundation/MediaSampleAVFObjC.h: Added.
+* platform/graphics/avfoundation/objc/MediaSampleAVFObjC.mm: Moved
+from MediaSampleAVFObjC
+(WebCore::MediaSampleAVFObjC::presentationTime):
+(WebCore::MediaSampleAVFObjC::decodeTime):
+(WebCore::MediaSampleAVFObjC::duration):
+(WebCore::MediaSampleAVFObjC::sizeInBytes):
+(WebCore::MediaSampleAVFObjC::platformSample):
+(WebCore::CMSampleBufferIsRandomAccess):
+(WebCore::MediaSampleAVFObjC::flags):
+(WebCore::MediaSampleAVFObjC::presentationSize):
+(WebCore::MediaSampleAVFObjC::dump):
+(WebCore::MediaSampleAVFObjC::offsetTimestampsBy):
+(WebCore::MediaSampleAVFObjC::setTimestamps):
+* platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
+Moved MediaSampleAVFObjC to its own file.
+(WebCore::MediaSampleAVFObjC::platformSample): Deleted.
+(WebCore::CMSampleBufferIsRandomAccess): Deleted.
+(WebCore::MediaSampleAVFObjC::flags): Deleted.
+(WebCore::MediaSampleAVFObjC::presentationSize): Deleted.
+(WebCore::MediaSampleAVFObjC::dump): Deleted.
+(WebCore::MediaSampleAVFObjC::offsetTimestampsBy): Deleted.
+(WebCore::MediaSampleAVFObjC::setTimestamps): Deleted.
+* platform/mock/mediasource/MockSourceBufferPrivate.cpp:
+
 2016-07-18  Eric Carlson  
 
 [MSE][Mac] Pass AVSampleBufferDisplayLayer HDCP status to a newly created key session


Modified: trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj (203362 => 203363)

--- trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj	2016-07-18 19:18:23 UTC (rev 203362)
+++ trunk/Source/WebCore/WebCore.xcodeproj/project.pbxproj	2016-07-18 19:23:41 UTC (rev 203363)
@@ -980,6 +980,8 @@
 		1AF8E1C3125673E000230FF7 /* ProxyServerCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AF8E1C1125673E0

[webkit-changes] [203362] trunk/Source/WebCore

2016-07-18 Thread eric . carlson

Title: [203362] trunk/Source/WebCore








Revision 203362
Author eric.carl...@apple.com
Date 2016-07-18 12:18:23 -0700 (Mon, 18 Jul 2016)


Log Message
[MSE][Mac] Pass AVSampleBufferDisplayLayer HDCP status to a newly created key session
https://bugs.webkit.org/show_bug.cgi?id=159812


Reviewed by Jon Lee.

No new tests, it isn't possible to test this with our current testing infrastructure.

* platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
* platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
(WebCore::SourceBufferPrivateAVFObjC::setCDMSession): Call layerDidReceiveError if there has
been an HDCP error.
(WebCore::SourceBufferPrivateAVFObjC::rendererDidReceiveError): Remember an HDCP error.

Modified Paths

trunk/Source/WebCore/ChangeLog
trunk/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h
trunk/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm




Diff

Modified: trunk/Source/WebCore/ChangeLog (203361 => 203362)

--- trunk/Source/WebCore/ChangeLog	2016-07-18 19:12:57 UTC (rev 203361)
+++ trunk/Source/WebCore/ChangeLog	2016-07-18 19:18:23 UTC (rev 203362)
@@ -1,3 +1,19 @@
+2016-07-18  Eric Carlson  
+
+[MSE][Mac] Pass AVSampleBufferDisplayLayer HDCP status to a newly created key session
+https://bugs.webkit.org/show_bug.cgi?id=159812
+
+
+Reviewed by Jon Lee.
+
+No new tests, it isn't possible to test this with our current testing infrastructure.
+
+* platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
+* platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
+(WebCore::SourceBufferPrivateAVFObjC::setCDMSession): Call layerDidReceiveError if there has
+been an HDCP error.
+(WebCore::SourceBufferPrivateAVFObjC::rendererDidReceiveError): Remember an HDCP error.
+
 2016-07-18  Yoav Weiss  
 
 Add preload to features.json


Modified: trunk/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h (203361 => 203362)

--- trunk/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h	2016-07-18 19:12:57 UTC (rev 203361)
+++ trunk/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h	2016-07-18 19:18:23 UTC (rev 203362)
@@ -146,6 +146,7 @@
 HashMap> m_audioRenderers;
 RetainPtr m_delegate;
 RetainPtr m_errorListener;
+RetainPtr m_hdcpError;
 OSObjectPtr m_hasSessionSemaphore;
 
 MediaSourcePrivateAVFObjC* m_mediaSource;


Modified: trunk/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm (203361 => 203362)

--- trunk/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm	2016-07-18 19:12:57 UTC (rev 203361)
+++ trunk/Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm	2016-07-18 19:18:23 UTC (rev 203362)
@@ -945,6 +945,17 @@
 dispatch_semaphore_signal(m_hasSessionSemaphore.get());
 m_hasSessionSemaphore = nullptr;
 }
+
+if (m_hdcpError) {
+WeakPtr weakThis = createWeakPtr();
+callOnMainThread([weakThis] {
+if (!weakThis || !weakThis->m_session || !weakThis->m_hdcpError)
+return;
+
+bool ignored = false;
+weakThis->m_session->layerDidReceiveError(nullptr, weakThis->m_hdcpError.get(), ignored);
+});
+}
 }
 }
 
@@ -993,6 +1004,9 @@
 {
 LOG(MediaSource, "SourceBufferPrivateAVFObjC::rendererDidReceiveError(%p): renderer(%p), error(%@)", this, renderer, [error description]);
 
+if ([error code] == 'HDCP')
+m_hdcpError = error;
+
 // FIXME(142246): Remove the following once  is resolved.
 bool anyIgnored = false;
 for (auto& client : m_errorClients) {






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [203364] trunk

Title: [203364] trunk








Revision 203364
Author fpi...@apple.com
Date 2016-07-18 12:32:34 -0700 (Mon, 18 Jul 2016)


Log Message
DFG and FTL should support op_call_eval
https://bugs.webkit.org/show_bug.cgi?id=159786

Reviewed by Saam Barati.
Source/_javascript_Core:


This adds support for op_call_eval in DFG and FTL by brute force:

- There is now a CallEval() node type, which compiles exactly the same way that we do in
  baseline.

- We teach the DFG and bytecode liveness that the scope register and 'this' are read by
  CallEval()/op_call_eval.

We can compile eval quite well, except that right now we cannot inline functions that use
eval. It would be nice to do that, but the payoff is probably smaller. "Don't inline users
of eval" may even be an OK inlining heuristic. Not inlining users of eval allows me to
reuse the baseline implementation, which is really great. Otherwise, I'd have to get rid
of things like the rogue reads of scope register and 'this'.

The goal here is to produce speed-ups for code that has functions that do both eval and
some computational stuff. Obviously, we're not producing any benefit for the eval itself.
But now the other stuff in a function that uses eval will get to participate in
optimization.

This is a huge speed-up on microbenchmarks.

* bytecode/BytecodeUseDef.h:
(JSC::computeUsesForBytecodeOffset):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::printCallOp):
(JSC::CodeBlock::dumpBytecode):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::setLocal):
(JSC::DFG::ByteCodeParser::setArgument):
(JSC::DFG::ByteCodeParser::flush):
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCapabilities.cpp:
(JSC::DFG::capabilityLevel):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::needsScopeRegister):
(JSC::DFG::Graph::needsFlushedThis):
* dfg/DFGHeapLocation.cpp:
(WTF::printInternal):
* dfg/DFGHeapLocation.h:
* dfg/DFGMayExit.cpp:
* dfg/DFGNode.h:
(JSC::DFG::Node::hasHeapPrediction):
* dfg/DFGNodeType.h:
* dfg/DFGOSRExitCompiler.cpp:
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGStackLayoutPhase.cpp:
(JSC::DFG::StackLayoutPhase::run):
* dfg/DFGWatchpointCollectionPhase.cpp:
(JSC::DFG::WatchpointCollectionPhase::handle):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLCompile.cpp:
(JSC::FTL::compile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
(JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
(JSC::FTL::DFG::LowerDFGToB3::compileLoadVarargs):
* jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer):
(JSC::AssemblyHelpers::emitDumbVirtualCall):
* jit/AssemblyHelpers.h:
(JSC::AssemblyHelpers::emitTypeOf):
* jit/JITCall.cpp:
(JSC::JIT::compileCallEvalSlowCase):
* jit/JITCall32_64.cpp:
(JSC::JIT::compileCallEvalSlowCase):
* jit/JITOperations.cpp:
* tests/stress/exit-then-eval.js: Added.
(foo):
* tests/stress/force-exit-then-eval-dfg.js: Added.
(foo):
* tests/stress/force-exit-then-eval.js: Added.
(foo):

LayoutTests:


* js/regress/eval-compute-expected.txt: Added.
* js/regress/eval-compute.html: Added.
* js/regress/eval-not-eval-compute-args-expected.txt: Added.
* js/regress/eval-not-eval-compute-args.html: Added.
* js/regress/eval-not-eval-compute-expected.txt: Added.
* js/regress/eval-not-eval-compute.html: Added.
* js/regress/script-tests/eval-compute.js: Added.
(foo):
* js/regress/script-tests/eval-not-eval-compute-args.js: Added.
(foo):
(i.result.foo):
* js/regress/script-tests/eval-not-eval-compute.js: Added.
(foo):
(i.result.foo):

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/_javascript_Core/ChangeLog
trunk/Source/_javascript_Core/bytecode/BytecodeUseDef.h
trunk/Source/_javascript_Core/bytecode/CodeBlock.cpp
trunk/Source/_javascript_Core/dfg/DFGAbstractInterpreterInlines.h
trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp
trunk/Source/_javascript_Core/dfg/DFGCapabilities.cpp
trunk/Source/_javascript_Core/dfg/DFGClobberize.h
trunk/Source/_javascript_Core/dfg/DFGDoesGC.cpp
trunk/Source/_javascript_Core/dfg/DFGFixupPhase.cpp
trunk/Source/_javascript_Core/dfg/DFGGraph.h
trunk/Source/_javascript_Core/dfg/DFGHeapLocation.cpp
trunk/Source/_javascript_Core/dfg/DFGHeapLocation.h
trunk/Source/_javascript_Core/dfg/DFGMayExit.cpp
trunk/Source/_javascript_Core/dfg/DFGNode.h
trunk/Source/_javascript_Core/dfg/DFGNodeType.h
trunk/Source/_javascript_Core/dfg/DFGOSRExitCompiler.cpp
trunk/Source/_j

[webkit-changes] [203365] trunk/Source

Title: [203365] trunk/Source








Revision 203365
Author fpi...@apple.com
Date 2016-07-18 12:51:45 -0700 (Mon, 18 Jul 2016)


Log Message
RegisterSet should use a Bitmap instead of a BitVector so that it never allocates memory and is trivial to copy
https://bugs.webkit.org/show_bug.cgi?id=159863

Reviewed by Saam Barati.

Source/_javascript_Core:

Switch RegisterSet set to Bitmap because Bitmap doesn't ever allocate memory and can be
assigned by memcpy. This should be a performance improvement for compiler code that does a
lot of things with RegisterSet. For example, it's one of the fundamental data structures in
Air. The previous use of BitVector meant that almost every operation on RegisterSet would
have a slow path call. On ARM64, it would mean memory allocation for any RegisterSet that
used all available registers.

This meant adding even more GPR/FPR reflection to the MacroAssembler API: we now have consts
called numGPRs and numFPRs. This is necessary to statically size the Bitmap in RegisterSet.

Here's the breakdown of sizes of RegisterSet on different CPUs:

x86-32: 8 bits (GPRs) + 8 bits (FPRs) + 1 bit (is deleted) = 1x uint32_t.
x86-64: 16 bits + 16 bits + 1 bit = 2x uint32_t.
ARMv7: 16 bits + 16 bits + 1 bit = 2x uint32_t.
ARM64: 32 bits + 32 bits + 1 bit = 3x uint32_t.

* assembler/MacroAssemblerARM.h:
* assembler/MacroAssemblerARM64.h:
* assembler/MacroAssemblerARMv7.h:
* assembler/MacroAssemblerX86.h:
* assembler/MacroAssemblerX86Common.h:
(JSC::MacroAssemblerX86Common::scratchRegister):
* assembler/MacroAssemblerX86_64.h:
* jit/RegisterSet.h:
(JSC::RegisterSet::set):
(JSC::RegisterSet::get):
(JSC::RegisterSet::setAll):
(JSC::RegisterSet::merge):
(JSC::RegisterSet::filter):
(JSC::RegisterSet::exclude):
(JSC::RegisterSet::numberOfSetRegisters):
(JSC::RegisterSet::RegisterSet):
(JSC::RegisterSet::isEmptyValue):
(JSC::RegisterSet::isDeletedValue):
(JSC::RegisterSet::operator==):
(JSC::RegisterSet::operator!=):
(JSC::RegisterSet::hash):
(JSC::RegisterSet::forEach):
(JSC::RegisterSet::setMany):

Source/WTF:

Give Bitmap all of the power of BitVector (except for automatic resizing). This means a
variant of set() that takes a bool, and a bunch of helper methods (merge, filter, exclude,
forEachSetBit, ==, !=, and hash).

* wtf/Bitmap.h:
(WTF::WordType>::set):
(WTF::WordType>::testAndSet):
(WTF::WordType>::isFull):
(WTF::WordType>::merge):
(WTF::WordType>::filter):
(WTF::WordType>::exclude):
(WTF::WordType>::forEachSetBit):
(WTF::=):
(WTF::WordType>::hash):

Modified Paths

trunk/Source/_javascript_Core/ChangeLog
trunk/Source/_javascript_Core/assembler/MacroAssemblerARM.h
trunk/Source/_javascript_Core/assembler/MacroAssemblerARM64.h
trunk/Source/_javascript_Core/assembler/MacroAssemblerARMv7.h
trunk/Source/_javascript_Core/assembler/MacroAssemblerX86.h
trunk/Source/_javascript_Core/assembler/MacroAssemblerX86Common.h
trunk/Source/_javascript_Core/assembler/MacroAssemblerX86_64.h
trunk/Source/_javascript_Core/jit/RegisterSet.h
trunk/Source/WTF/ChangeLog
trunk/Source/WTF/wtf/Bitmap.h




Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (203364 => 203365)

--- trunk/Source/_javascript_Core/ChangeLog	2016-07-18 19:32:34 UTC (rev 203364)
+++ trunk/Source/_javascript_Core/ChangeLog	2016-07-18 19:51:45 UTC (rev 203365)
@@ -1,3 +1,51 @@
+2016-07-17  Filip Pizlo  
+
+RegisterSet should use a Bitmap instead of a BitVector so that it never allocates memory and is trivial to copy
+https://bugs.webkit.org/show_bug.cgi?id=159863
+
+Reviewed by Saam Barati.
+
+Switch RegisterSet set to Bitmap because Bitmap doesn't ever allocate memory and can be
+assigned by memcpy. This should be a performance improvement for compiler code that does a
+lot of things with RegisterSet. For example, it's one of the fundamental data structures in
+Air. The previous use of BitVector meant that almost every operation on RegisterSet would
+have a slow path call. On ARM64, it would mean memory allocation for any RegisterSet that
+used all available registers.
+
+This meant adding even more GPR/FPR reflection to the MacroAssembler API: we now have consts
+called numGPRs and numFPRs. This is necessary to statically size the Bitmap in RegisterSet.
+
+Here's the breakdown of sizes of RegisterSet on different CPUs:
+
+x86-32: 8 bits (GPRs) + 8 bits (FPRs) + 1 bit (is deleted) = 1x uint32_t.
+x86-64: 16 bits + 16 bits + 1 bit = 2x uint32_t.
+ARMv7: 16 bits + 16 bits + 1 bit = 2x uint32_t.
+ARM64: 32 bits + 32 bits + 1 bit = 3x uint32_t.
+
+* assembler/MacroAssemblerARM.h:
+* assembler/MacroAssemblerARM64.h:
+* assembler/MacroAssemblerARMv7.h:
+* assembler/MacroAssemblerX86.h:
+* assembler/MacroAssemblerX86Common.h:
+(JSC::MacroAssemblerX86Common::scratchRegister):
+* assembler/MacroAssembler

[webkit-changes] [203366] trunk/LayoutTests

Title: [203366] trunk/LayoutTests








Revision 203366
Author ryanhad...@apple.com
Date 2016-07-18 13:03:18 -0700 (Mon, 18 Jul 2016)


Log Message
Marking media/video-load-preload-metadata.html as flaky on Mac.
https://bugs.webkit.org/show_bug.cgi?id=128312

Unreviewed test gardening.

* platform/mac/TestExpectations:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/platform/mac/TestExpectations




Diff

Modified: trunk/LayoutTests/ChangeLog (203365 => 203366)

--- trunk/LayoutTests/ChangeLog	2016-07-18 19:51:45 UTC (rev 203365)
+++ trunk/LayoutTests/ChangeLog	2016-07-18 20:03:18 UTC (rev 203366)
@@ -1,3 +1,12 @@
+2016-07-18  Ryan Haddad  
+
+Marking media/video-load-preload-metadata.html as flaky on Mac.
+https://bugs.webkit.org/show_bug.cgi?id=128312
+
+Unreviewed test gardening.
+
+* platform/mac/TestExpectations:
+
 2016-07-15  Filip Pizlo  
 
 DFG and FTL should support op_call_eval


Modified: trunk/LayoutTests/platform/mac/TestExpectations (203365 => 203366)

--- trunk/LayoutTests/platform/mac/TestExpectations	2016-07-18 19:51:45 UTC (rev 203365)
+++ trunk/LayoutTests/platform/mac/TestExpectations	2016-07-18 20:03:18 UTC (rev 203366)
@@ -1450,3 +1450,5 @@
 webkit.org/b/158500 storage/indexeddb/database-close-private.html [ Pass Failure ]
 
 webkit.org/b/158640 imported/blink/storage/indexeddb/blob-valid-after-deletion.html [ Pass Failure ]
+
+webkit.org/b/128312 media/video-load-preload-metadata.html [ Pass Failure ]






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [203367] trunk/LayoutTests

Title: [203367] trunk/LayoutTests








Revision 203367
Author ryanhad...@apple.com
Date 2016-07-18 13:12:00 -0700 (Mon, 18 Jul 2016)


Log Message
Marking imported/w3c/web-platform-tests/XMLHttpRequest/event-readystatechange-loaded.htm as flaky on mac-debug WK1
https://bugs.webkit.org/show_bug.cgi?id=159893

Unreviewed test gardening.

* platform/mac-wk1/TestExpectations:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/platform/mac-wk1/TestExpectations




Diff

Modified: trunk/LayoutTests/ChangeLog (203366 => 203367)

--- trunk/LayoutTests/ChangeLog	2016-07-18 20:03:18 UTC (rev 203366)
+++ trunk/LayoutTests/ChangeLog	2016-07-18 20:12:00 UTC (rev 203367)
@@ -1,5 +1,14 @@
 2016-07-18  Ryan Haddad  
 
+Marking imported/w3c/web-platform-tests/XMLHttpRequest/event-readystatechange-loaded.htm as flaky on mac-debug WK1
+https://bugs.webkit.org/show_bug.cgi?id=159893
+
+Unreviewed test gardening.
+
+* platform/mac-wk1/TestExpectations:
+
+2016-07-18  Ryan Haddad  
+
 Marking media/video-load-preload-metadata.html as flaky on Mac.
 https://bugs.webkit.org/show_bug.cgi?id=128312
 


Modified: trunk/LayoutTests/platform/mac-wk1/TestExpectations (203366 => 203367)

--- trunk/LayoutTests/platform/mac-wk1/TestExpectations	2016-07-18 20:03:18 UTC (rev 203366)
+++ trunk/LayoutTests/platform/mac-wk1/TestExpectations	2016-07-18 20:12:00 UTC (rev 203367)
@@ -254,3 +254,4 @@
 
 [ Yosemite ] http/tests/media/hls/video-controller-getStartDate.html [ Pass Timeout ]
 
+webkit.org/b/159893 [ Debug ] imported/w3c/web-platform-tests/XMLHttpRequest/event-readystatechange-loaded.htm [ Pass Failure ]






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [203368] trunk

Title: [203368] trunk








Revision 203368
Author fpi...@apple.com
Date 2016-07-18 13:12:45 -0700 (Mon, 18 Jul 2016)


Log Message
Object.preventExtensions/seal/freeze makes code much slower
https://bugs.webkit.org/show_bug.cgi?id=143247

Reviewed by Michael Saboff.

Source/_javascript_Core:

This has been a huge pet peeve of mine for a long time, but I was always afraid of fixing
it because I thought that it would be hard. Well, it looks like it's not hard at all.

The problem is that you cannot mutate a structure that participates in transition caching.
You can only clone the structure and mutate that one. But if you do this, you have to make
a hard choice:

1) Clone the structure without caching the transition. This is what the code did before
   this change. It's the most obvious choice, but it introduces an uncacheable transition
   that leads to an explosion of structures, which then breaks all inline caches.

2) Perform one of the existing cacheable transitions. Cacheable transitions can either add
   properties or they can do one of the NonPropertyTransitions, which until now have been
   restricted to just IndexingType transitions. So, only adding transitions or making
   certain prescribed changes to the indexing type count as cacheable transitions.

This change decouples NonPropertyTransition from IndexingType and adds three new kinds of
transitions: PreventExtensions, Seal, and Freeze. We have to give any cacheable transition
a name that fully disambiguates this transition from any other, so that the transition can
be cached. Since we're already giving them names in an enum, I figured that the most
pragmatic way to implement them is to have Structure::nonPropertyTransition() case on the
NonPropertyTransition and implement all of the mutations associated with that transition.
The alternative would have been to allow callers of nonPropertyTransition() to supply
something like a lambda that describes the mutation, but this seemed awkward since each
set of mutations has to anyway be tied to one of the NonPropertyTransition members.

This is an enormous speed-up on microbenchmarks that use Object.preventExtensions(),
Object.seal(), or Object.freeze(). I don't know if "real" benchmarks use these features
and I don't really care. This should be fast.

* runtime/JSObject.cpp:
(JSC::JSObject::notifyPresenceOfIndexedAccessors):
(JSC::JSObject::createInitialUndecided):
(JSC::JSObject::createInitialInt32):
(JSC::JSObject::createInitialDouble):
(JSC::JSObject::createInitialContiguous):
(JSC::JSObject::convertUndecidedToInt32):
(JSC::JSObject::convertUndecidedToDouble):
(JSC::JSObject::convertUndecidedToContiguous):
(JSC::JSObject::convertInt32ToDouble):
(JSC::JSObject::convertInt32ToContiguous):
(JSC::JSObject::convertDoubleToContiguous):
(JSC::JSObject::switchToSlowPutArrayStorage):
* runtime/Structure.cpp:
(JSC::Structure::suggestedArrayStorageTransition):
(JSC::Structure::addPropertyTransition):
(JSC::Structure::toUncacheableDictionaryTransition):
(JSC::Structure::sealTransition):
(JSC::Structure::freezeTransition):
(JSC::Structure::preventExtensionsTransition):
(JSC::Structure::takePropertyTableOrCloneIfPinned):
(JSC::Structure::nonPropertyTransition):
(JSC::Structure::pin):
(JSC::Structure::pinForCaching):
(JSC::Structure::allocateRareData):
* runtime/Structure.h:
* runtime/StructureTransitionTable.h:
(JSC::toAttributes):
(JSC::changesIndexingType):
(JSC::newIndexingType):
(JSC::preventsExtensions):
(JSC::setsDontDeleteOnAllProperties):
(JSC::setsReadOnlyOnAllProperties):

LayoutTests:

These tests now run ~25x faster.

* js/regress/freeze-and-do-work-expected.txt: Added.
* js/regress/freeze-and-do-work.html: Added.
* js/regress/prevent-extensions-and-do-work-expected.txt: Added.
* js/regress/prevent-extensions-and-do-work.html: Added.
* js/regress/script-tests/freeze-and-do-work.js: Added.
(Foo):
* js/regress/script-tests/prevent-extensions-and-do-work.js: Added.
(Foo):
* js/regress/script-tests/seal-and-do-work.js: Added.
(Foo):
* js/regress/seal-and-do-work-expected.txt: Added.
* js/regress/seal-and-do-work.html: Added.

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/Source/_javascript_Core/ChangeLog
trunk/Source/_javascript_Core/runtime/JSObject.cpp
trunk/Source/_javascript_Core/runtime/Structure.cpp
trunk/Source/_javascript_Core/runtime/Structure.h
trunk/Source/_javascript_Core/runtime/StructureTransitionTable.h


Added Paths

trunk/LayoutTests/js/regress/freeze-and-do-work-expected.txt
trunk/LayoutTests/js/regress/freeze-and-do-work.html
trunk/LayoutTests/js/regress/prevent-extensions-and-do-work-expected.txt
trunk/LayoutTests/js/regress/prevent-extensions-and-do-work.html
trunk/LayoutTests/js/regress/script-tests/freeze-and-do-work.js
trunk/LayoutTests/js/regress/script-tests/prevent-extensions-and-do-work.js
trunk/LayoutTests/js/regress/script-tests/seal-and-do-work.js
trunk/LayoutTests/js/regress/seal-and-do-work-expected.txt
trunk/LayoutTe

[webkit-changes] [203369] trunk/LayoutTests

Title: [203369] trunk/LayoutTests








Revision 203369
Author ryanhad...@apple.com
Date 2016-07-18 13:16:55 -0700 (Mon, 18 Jul 2016)


Log Message
Marking storage/indexeddb/modern/abort-requests-cancelled.html as flaky on mac-wk1
https://bugs.webkit.org/show_bug.cgi?id=156070

Unreviewed test gardening.

* platform/mac-wk1/TestExpectations:

Modified Paths

trunk/LayoutTests/ChangeLog
trunk/LayoutTests/platform/mac-wk1/TestExpectations




Diff

Modified: trunk/LayoutTests/ChangeLog (203368 => 203369)

--- trunk/LayoutTests/ChangeLog	2016-07-18 20:12:45 UTC (rev 203368)
+++ trunk/LayoutTests/ChangeLog	2016-07-18 20:16:55 UTC (rev 203369)
@@ -1,3 +1,12 @@
+2016-07-18  Ryan Haddad  
+
+Marking storage/indexeddb/modern/abort-requests-cancelled.html as flaky on mac-wk1
+https://bugs.webkit.org/show_bug.cgi?id=156070
+
+Unreviewed test gardening.
+
+* platform/mac-wk1/TestExpectations:
+
 2016-07-17  Filip Pizlo  
 
 Object.preventExtensions/seal/freeze makes code much slower


Modified: trunk/LayoutTests/platform/mac-wk1/TestExpectations (203368 => 203369)

--- trunk/LayoutTests/platform/mac-wk1/TestExpectations	2016-07-18 20:12:45 UTC (rev 203368)
+++ trunk/LayoutTests/platform/mac-wk1/TestExpectations	2016-07-18 20:16:55 UTC (rev 203369)
@@ -255,3 +255,5 @@
 [ Yosemite ] http/tests/media/hls/video-controller-getStartDate.html [ Pass Timeout ]
 
 webkit.org/b/159893 [ Debug ] imported/w3c/web-platform-tests/XMLHttpRequest/event-readystatechange-loaded.htm [ Pass Failure ]
+
+webkit.org/b/156070 storage/indexeddb/modern/abort-requests-cancelled.html [ Pass Timeout ]






___
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

[webkit-changes] [203371] trunk/Source/WebKit2

2016-07-18 Thread timothy_horton

Title: [203371] trunk/Source/WebKit2








Revision 203371
Author timothy_hor...@apple.com
Date 2016-07-18 13:41:18 -0700 (Mon, 18 Jul 2016)


Log Message
Mail contents are temporarily obscured by black rectangles when returning from suspend and in app switcher
https://bugs.webkit.org/show_bug.cgi?id=159894


Reviewed by Simon Fraser.

* UIProcess/ApplicationStateTracker.h:
* UIProcess/ApplicationStateTracker.mm:
(WebKit::ApplicationStateTracker::ApplicationStateTracker):
(WebKit::ApplicationStateTracker::~ApplicationStateTracker):
(WebKit::ApplicationStateTracker::applicationDidCreateWindowContext):
* UIProcess/ios/WKContentView.mm:
(-[WKContentView didMoveToWindow]):
(-[WKContentView _applicationDidCreateWindowContext]):
(-[WKContentView _applicationWillEnterForeground]): Deleted.
* UIProcess/ios/WKPDFView.mm:
(-[WKPDFView didMoveToWindow]):
(-[WKPDFView _applicationDidCreateWindowContext]):
* UIProcess/ios/WebPageProxyIOS.mm:
(WebKit::WebPageProxy::applicationDidFinishSnapshottingAfterEnteringBackground):
Hide content at window context creation time, instead of when the application
becomes foregrounded. Otherwise, background snapshots (which create/destroy
window contexts, but do not bring the app into the foreground) can have
parented layers that have volatile surfaces in them. In the normal case,
we will subsequently get foregrounded and re-build the layer tree; in the
background snapshot case, we will just have an empty layer tree.

In the future, we should consider making ApplicationStateTracker use
window context creation/destruction to drive web process lifetime, so
that we can actually paint correctly for background snapshots.

Modified Paths

trunk/Source/WebKit2/ChangeLog
trunk/Source/WebKit2/UIProcess/ApplicationStateTracker.h
trunk/Source/WebKit2/UIProcess/ApplicationStateTracker.mm
trunk/Source/WebKit2/UIProcess/ios/WKContentView.mm
trunk/Source/WebKit2/UIProcess/ios/WKPDFView.mm




Diff

Modified: trunk/Source/WebKit2/ChangeLog (203370 => 203371)

--- trunk/Source/WebKit2/ChangeLog	2016-07-18 20:31:20 UTC (rev 203370)
+++ trunk/Source/WebKit2/ChangeLog	2016-07-18 20:41:18 UTC (rev 203371)
@@ -1,3 +1,36 @@
+2016-07-18  Tim Horton  
+
+Mail contents are temporarily obscured by black rectangles when returning from suspend and in app switcher
+https://bugs.webkit.org/show_bug.cgi?id=159894
+
+
+Reviewed by Simon Fraser.
+
+* UIProcess/ApplicationStateTracker.h:
+* UIProcess/ApplicationStateTracker.mm:
+(WebKit::ApplicationStateTracker::ApplicationStateTracker):
+(WebKit::ApplicationStateTracker::~ApplicationStateTracker):
+(WebKit::ApplicationStateTracker::applicationDidCreateWindowContext):
+* UIProcess/ios/WKContentView.mm:
+(-[WKContentView didMoveToWindow]):
+(-[WKContentView _applicationDidCreateWindowContext]):
+(-[WKContentView _applicationWillEnterForeground]): Deleted.
+* UIProcess/ios/WKPDFView.mm:
+(-[WKPDFView didMoveToWindow]):
+(-[WKPDFView _applicationDidCreateWindowContext]):
+* UIProcess/ios/WebPageProxyIOS.mm:
+(WebKit::WebPageProxy::applicationDidFinishSnapshottingAfterEnteringBackground):
+Hide content at window context creation time, instead of when the application
+becomes foregrounded. Otherwise, background snapshots (which create/destroy
+window contexts, but do not bring the app into the foreground) can have
+parented layers that have volatile surfaces in them. In the normal case,
+we will subsequently get foregrounded and re-build the layer tree; in the
+background snapshot case, we will just have an empty layer tree.
+
+In the future, we should consider making ApplicationStateTracker use
+window context creation/destruction to drive web process lifetime, so
+that we can actually paint correctly for background snapshots.
+
 2016-07-18  Carlos Garcia Campos  
 
 Unreviewed. Update OptionsGTK.cmake and NEWS for 2.13.3 release.


Modified: trunk/Source/WebKit2/UIProcess/ApplicationStateTracker.h (203370 => 203371)

--- trunk/Source/WebKit2/UIProcess/ApplicationStateTracker.h	2016-07-18 20:31:20 UTC (rev 203370)
+++ trunk/Source/WebKit2/UIProcess/ApplicationStateTracker.h	2016-07-18 20:41:18 UTC (rev 203371)
@@ -39,7 +39,7 @@
 
 class ApplicationStateTracker {
 public:
-ApplicationStateTracker(UIView *, SEL didEnterBackgroundSelector, SEL didFinishSnapshottingAfterEnteringBackgroundSelector, SEL willEnterForegroundSelector);
+ApplicationStateTracker(UIView *, SEL didEnterBackgroundSelector, SEL didCreateWindowContextSelector, SEL didFinishSnapshottingAfterEnteringBackgroundSelector, SEL willEnterForegroundSelector);
 ~ApplicationStateTracker();
 
 bool isInBackground() const { return m_isInBackground; }
@@ -46,11 +46,13 @@
 
 private:
 void applicationDidEnterBackground();
+void applicationDidCreateWindowContext();
 void a

[webkit-changes] [203372] trunk/LayoutTests