Merge upstream/main (46525dbf2abb) — adopt libpas Windows is_symmetric

CMakePresets.json

@@ -85,6 +85,10 @@
                 "PORT": {
                     "type": "STRING",
                     "value": "Mac"
+                },
+                "ENABLE_EXPERIMENTAL_FEATURES": {
+                    "type": "BOOL",
+                    "value": "OFF"
                 }
             },
             "environment": {
@@ -107,19 +111,29 @@
         {
             "name": "mac-dev-release",
             "displayName": "macOS Development (Release, ccache, compile_commands)",
-            "inherits": ["mac-release", "dev"],
-            "cacheVariables": {
-                "ENABLE_EXPERIMENTAL_FEATURES": {
-                    "type": "BOOL",
-                    "value": "OFF"
-                }
-            }
+            "inherits": ["mac-release", "dev"]
         },
         {
             "name": "mac-dev-debug",
             "displayName": "macOS Development (Debug, ccache, compile_commands)",
             "inherits": ["mac-debug", "dev"]
         },
+        {
+            "name": "mac-dev-debug-o3",
+            "displayName": "macOS Development (Debug O3 optimization, ccache, compile_commands)",
+            "inherits": ["mac-debug", "dev"],
+            "binaryDir": "WebKitBuild/cmake-mac/DebugO3",
+            "cacheVariables": {
+                "CMAKE_C_FLAGS_DEBUG": {
+                    "type": "STRING",
+                    "value": "-g -O3"
+                },
+                "CMAKE_CXX_FLAGS_DEBUG": {
+                    "type": "STRING",
+                    "value": "-g -O3"
+                }
+            }
+        },
         {
             "name": "mac-dev-relwithdebinfo",
             "displayName": "macOS Development (RelWithDebInfo -- optimized + debuggable)",
@@ -207,6 +221,11 @@
             "displayName": "macOS Development Debug",
             "configurePreset": "mac-dev-debug"
         },
+        {
+            "name": "mac-dev-debug-o3",
+            "displayName": "macOS Development Debug O3",
+            "configurePreset": "mac-dev-debug-o3"
+        },
         {
             "name": "mac-dev-relwithdebinfo",
             "displayName": "macOS Development RelWithDebInfo",

Configurations/Version.xcconfig

@@ -23,7 +23,7 @@
 
 MAJOR_VERSION = 625;
 MINOR_VERSION = 1;
-TINY_VERSION = 14;
+TINY_VERSION = 16;
 MICRO_VERSION = 0;
 NANO_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION);

Configurations/WebKitProjectPaths.xcconfig

@@ -132,7 +132,7 @@ WEBCORE_TEST_SUPPORT_DIR = $(WEBCORE_TEST_SUPPORT_DIR_$(CONFIGURATION));
 WEBCORE_TEST_SUPPORT_DIR_Release = $(WEBCORE_TEST_SUPPORT_DIR_Engineering);
 WEBCORE_TEST_SUPPORT_DIR_Debug = $(WEBCORE_TEST_SUPPORT_DIR_Engineering);
 WEBCORE_TEST_SUPPORT_DIR_Production = $(SDK_DIR)$(WK_ALTERNATE_WEBKIT_SDK_PATH)$(WK_LIBRARY_HEADERS_FOLDER_PATH)/WebCoreTestSupport;
-WEBCORE_TEST_SUPPORT_DIR_Engineering = $(BUILT_PRODUCTS_DIR)/WebCoreTestSupport;
+WEBCORE_TEST_SUPPORT_DIR_Engineering = $(BUILT_PRODUCTS_DIR)$(WK_LIBRARY_HEADERS_FOLDER_PATH)/WebCoreTestSupport;
 
 // Where libwebrtc and ANGLE go.
 WEBCORE_LIBRARY_DIR = $(UMBRELLA_FRAMEWORKS_DIR)/WebCore.framework/Frameworks

Introduction.md

@@ -982,7 +982,7 @@ that `JSStyleSheet` should be kept alive so long as the garbage collector had en
 ```cpp
 bool JSStyleSheetOwner::isReachableFromOpaqueRoots(JSC::Handle<JSC::Unknown> handle, void*, AbstractSlotVisitor& visitor, const char** reason)
 {
-    auto* jsStyleSheet = jsCast<JSStyleSheet*>(handle.slot()->asCell());
+    auto* jsStyleSheet = downcast<JSStyleSheet>(handle.slot()->asCell());
     void* root = WebCore::root(&jsStyleSheet->wrapped());
     if (UNLIKELY(reason))
         *reason = "Reachable from jsStyleSheet";

JSTests/microbenchmarks/for-of-map-entries-small.js

@@ -0,0 +1,14 @@
+const map = new Map();
+for (let i = 0; i < 10; ++i)
+    map.set(i, i * 2);
+
+function test(map) {
+    let sum = 0;
+    for (let [k, v] of map)
+        sum += k + v;
+    return sum;
+}
+noInline(test);
+
+for (let i = 0; i < 1e5; ++i)
+    test(map);

JSTests/microbenchmarks/for-of-map-entries.js

@@ -0,0 +1,14 @@
+const map = new Map();
+for (let i = 0; i < 100; ++i)
+    map.set(i, i * 2);
+
+function test(map) {
+    let sum = 0;
+    for (let [k, v] of map)
+        sum += k + v;
+    return sum;
+}
+noInline(test);
+
+for (let i = 0; i < 1e4; ++i)
+    test(map);

JSTests/microbenchmarks/for-of-set-values-small.js

@@ -0,0 +1,14 @@
+const set = new Set();
+for (let i = 0; i < 10; ++i)
+    set.add(i);
+
+function test(set) {
+    let sum = 0;
+    for (let x of set)
+        sum += x;
+    return sum;
+}
+noInline(test);
+
+for (let i = 0; i < 1e5; ++i)
+    test(set);

JSTests/microbenchmarks/for-of-set-values.js

@@ -0,0 +1,14 @@
+const set = new Set();
+for (let i = 0; i < 100; ++i)
+    set.add(i);
+
+function test(set) {
+    let sum = 0;
+    for (let x of set)
+        sum += x;
+    return sum;
+}
+noInline(test);
+
+for (let i = 0; i < 1e4; ++i)
+    test(set);

JSTests/microbenchmarks/intl-constructor-collator.js

@@ -0,0 +1,10 @@
+function test() {
+    let count = 0;
+    for (let i = 0; i < 1e4; ++i)
+        count += new Intl.Collator("en-US").compare !== undefined;
+    return count;
+}
+
+const result = test();
+if (result !== 1e4)
+    throw new Error("Bad result: " + result);

JSTests/microbenchmarks/intl-constructor-datetimeformat.js

@@ -0,0 +1,10 @@
+function test() {
+    let count = 0;
+    for (let i = 0; i < 1e4; ++i)
+        count += new Intl.DateTimeFormat("en-US").format !== undefined;
+    return count;
+}
+
+const result = test();
+if (result !== 1e4)
+    throw new Error("Bad result: " + result);

JSTests/microbenchmarks/intl-constructor-durationformat.js

@@ -0,0 +1,10 @@
+function test() {
+    let count = 0;
+    for (let i = 0; i < 1e4; ++i)
+        count += new Intl.DurationFormat("en").format !== undefined;
+    return count;
+}
+
+const result = test();
+if (result !== 1e4)
+    throw new Error("Bad result: " + result);

JSTests/microbenchmarks/intl-constructor-numberformat.js

@@ -0,0 +1,10 @@
+function test() {
+    let count = 0;
+    for (let i = 0; i < 1e4; ++i)
+        count += new Intl.NumberFormat("en-US").format !== undefined;
+    return count;
+}
+
+const result = test();
+if (result !== 1e4)
+    throw new Error("Bad result: " + result);

JSTests/microbenchmarks/intl-constructor-relativetimeformat.js

@@ -0,0 +1,10 @@
+function test() {
+    let count = 0;
+    for (let i = 0; i < 1e4; ++i)
+        count += new Intl.RelativeTimeFormat("en").format !== undefined;
+    return count;
+}
+
+const result = test();
+if (result !== 1e4)
+    throw new Error("Bad result: " + result);

JSTests/microbenchmarks/object-create-null-cse.js

@@ -0,0 +1,21 @@
+function test(o, proto)
+{
+    var s = o.a + o.b + o.c + o.d + o.e + o.f;
+    Object.create(proto);
+    s += o.a + o.b + o.c + o.d + o.e + o.f;
+    s += o.a + o.b + o.c + o.d + o.e + o.f;
+    s += o.a + o.b + o.c + o.d + o.e + o.f;
+    s += o.a + o.b + o.c + o.d + o.e + o.f;
+    s += o.a + o.b + o.c + o.d + o.e + o.f;
+    s += o.a + o.b + o.c + o.d + o.e + o.f;
+    s += o.a + o.b + o.c + o.d + o.e + o.f;
+    return s;
+}
+noInline(test);
+
+var o = { a: 1, b: 2, c: 3, d: 4, e: 5, f: 6 };
+var result = 0;
+for (var i = 0; i < 2e6; ++i)
+    result += test(o, null);
+if (result !== 168 * 2e6)
+    throw new Error("bad result: " + result);

JSTests/microbenchmarks/string-pad-end-consume.js

@@ -0,0 +1,13 @@
+// padEnd a short string and consume the result via charCodeAt.
+function bench() {
+    let total = 0;
+    const base = "hello";
+    for (let i = 0; i < 1e6; ++i) {
+        const s = base.padEnd(80);
+        total += s.charCodeAt(79);
+    }
+    return total;
+}
+noInline(bench);
+
+bench();

JSTests/microbenchmarks/string-pad-end-indexof.js

@@ -0,0 +1,13 @@
+// padEnd then indexOf forces full rope resolution + linear scan.
+function bench() {
+    let total = 0;
+    const base = "hello";
+    for (let i = 0; i < 1e6; ++i) {
+        const s = base.padEnd(80);
+        total += s.indexOf("x");
+    }
+    return total;
+}
+noInline(bench);
+
+bench();

JSTests/stress/iterator-dfg-fast-path-bad-time.js

@@ -0,0 +1,65 @@
+// Stress the DFG iterator_next fast path for Map iteration under "having a bad time".
+// In that state, the NewArray([key, value]) pair-allocation for Map entries takes
+// the operationNewArray slow path (a C++ call under DECLARE_THROW_SCOPE). This
+// exercises NewArray's ExitsForExceptions classification: if allocation throws,
+// exception unwind must not replay the already-advanced MapIteratorNext.
+//
+// Two phases:
+//   (1) warm up with normal allocation so DFG/FTL compiles the fast NewArray path,
+//   (2) flip to bad-time (invalidates the havingABadTime watchpoint installed by
+//       FixupPhase::watchHavingABadTime on NewArray) to force recompilation through
+//       the slow allocation path.
+
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error('bad: ' + actual + ' vs ' + expected);
+}
+noInline(shouldBe);
+
+const map = new Map();
+for (let i = 0; i < 16; ++i)
+    map.set(i, i * 10);
+// 0+0 + 1+10 + ... + 15+150 = sum(0..15) + 10*sum(0..15) = 120 + 1200 = 1320
+const expectedMapSum = 1320;
+
+const set = new Set();
+for (let i = 0; i < 16; ++i)
+    set.add(i);
+const expectedSetSum = 120;
+
+function sumMapEntries(m) {
+    let total = 0;
+    for (const [k, v] of m)
+        total += k + v;
+    return total;
+}
+noInline(sumMapEntries);
+
+function sumSetValues(s) {
+    let total = 0;
+    for (const v of s)
+        total += v;
+    return total;
+}
+noInline(sumSetValues);
+
+// Phase 1: warm up with normal fast allocation.
+for (let i = 0; i < testLoopCount; ++i) {
+    shouldBe(sumMapEntries(map), expectedMapSum);
+    shouldBe(sumSetValues(set), expectedSetSum);
+}
+
+// Phase 2: trigger bad-time by installing a getter on a numeric-indexed slot
+// of Object.prototype. This fires the havingABadTime watchpoint, invalidating
+// any compiled code that relied on NewArray taking the fast inline-allocation
+// path. Subsequent runs must still iterate correctly.
+Object.defineProperty(Object.prototype, "0", {
+    get() { return "shadow"; },
+    set(v) { },
+    configurable: true,
+});
+
+for (let i = 0; i < testLoopCount; ++i) {
+    shouldBe(sumMapEntries(map), expectedMapSum);
+    shouldBe(sumSetValues(set), expectedSetSum);
+}

JSTests/stress/iterator-dfg-fast-path-mixed-modes.js

@@ -0,0 +1,58 @@
+// Stress the DFG iterator_open / iterator_next fast path when a single
+// call site observes Array, Map, Set, and a Generic user-defined iterable.
+// The seenModes IterationMetadata accumulates FastArray|FastMap|FastSet|Generic,
+// and the DFG parser emits the full chained fast path. This exercises the
+// connectFailedBlock/numberOfRemainingModes bookkeeping across all four modes.
+
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error('bad: ' + actual + ' vs ' + expected);
+}
+noInline(shouldBe);
+
+function sumIterable(iterable) {
+    let sum = 0;
+    for (const entry of iterable) {
+        if (typeof entry === "number")
+            sum += entry;                   // Array / Set yields values
+        else if (Array.isArray(entry))
+            sum += entry[0] + entry[1];     // Map yields [key, value]
+        else
+            sum += entry.val;               // Generic iterator yields {val}
+    }
+    return sum;
+}
+noInline(sumIterable);
+
+const arr = [1, 2, 3, 4];
+const map = new Map([[10, 1], [20, 2], [30, 3]]);
+const set = new Set([100, 200, 300]);
+
+function makeGeneric() {
+    let i = 0;
+    return {
+        [Symbol.iterator]() { return this; },
+        next() {
+            if (i >= 4)
+                return { value: undefined, done: true };
+            return { value: { val: ++i * 1000 }, done: false };
+        }
+    };
+}
+
+const arrSum = 1 + 2 + 3 + 4;
+const mapSum = (10 + 1) + (20 + 2) + (30 + 3);
+const setSum = 100 + 200 + 300;
+const genSum = 1000 + 2000 + 3000 + 4000;
+
+for (let i = 0; i < testLoopCount; i++) {
+    const idx = i & 3;
+    if (idx === 0)
+        shouldBe(sumIterable(arr), arrSum);
+    else if (idx === 1)
+        shouldBe(sumIterable(map), mapSum);
+    else if (idx === 2)
+        shouldBe(sumIterable(set), setSum);
+    else
+        shouldBe(sumIterable(makeGeneric()), genSum);
+}