Upgrade to upstream WebKit 01aaa3e0be0c

.gitignore

@@ -4,6 +4,7 @@
 .DS_Store
 .directory
 /WebKitBuild/
+/WebKitBuild*/
 /.clangd
 .claude/agents/
 /update-compile-commands-symlink.conf
@@ -100,3 +101,5 @@ CLAUDE.md
 *.profraw
 *.pas_stats.jsonl
 
+# Ignore libpas builds and log-outputs
+/Source/bmalloc/build*/

.submitproject-tools

@@ -5,5 +5,6 @@
     includedSubdirectoryPatterns = Tools/ImageDiff
     includedSubdirectoryPatterns = Tools/MiniBrowser
     includedSubdirectoryPatterns = Tools/TestRunnerShared
+    includedSubdirectoryPatterns = Tools/TestWebKitAPI
     includedSubdirectoryPatterns = Tools/WebKitTestRunner
     excludedSubdirectoryPatterns = Tools/WebKitTestRunner/gtk

.wkdev-sdk-version

@@ -1 +1 @@
-2.53-v8-8a63f74
+2.53-v9-c666b76

Configurations/Makefile

@@ -3,7 +3,7 @@
 # on. Update this list when new major versions are released, to support
 # building downlevels targeting those OS versions. Remove from this list when
 # WebKit drops downlevel support for an OS version.
-SUPPORTED_MAC_OS_VERSIONS = 15 26
+SUPPORTED_MAC_OS_VERSIONS = 15 27
 
 DeploymentTargets.xcconfig: Scripts/generate-deployment-target-xcconfig.py Makefile
 	./$< $(SUPPORTED_MAC_OS_VERSIONS) > $@

Configurations/Sanitizers.xcconfig

@@ -49,8 +49,9 @@ WK_SANITIZER_OTHER_TAPI_FLAGS_UBSAN_YES = -Xparser -fsanitize=undefined;
 WK_SANITIZER_WARNING_CFLAGS = $(WK_ANY_SANITIZER_WARNING_CFLAGS_$(WK_ANY_SANITIZER_ENABLED)) $(WK_STATIC_ANALYZER_WARNING_CFLAGS_$(RUN_CLANG_STATIC_ANALYZER));
 
 // Workaround for rdar://170982364
-WK_SANITIZER_OTHER_SWIFT_FLAGS = $(WK_SANITIZER_OTHER_SWIFT_FLAGS_ASAN_$(ENABLE_ADDRESS_SANITIZER));
+WK_SANITIZER_OTHER_SWIFT_FLAGS = $(WK_SANITIZER_OTHER_SWIFT_FLAGS_ASAN_$(ENABLE_ADDRESS_SANITIZER)) $(WK_SANITIZER_OTHER_SWIFT_FLAGS_TSAN_$(ENABLE_THREAD_SANITIZER));
 WK_SANITIZER_OTHER_SWIFT_FLAGS_ASAN_YES = -Xcc -D__SANITIZE_ADDRESS__;
+WK_SANITIZER_OTHER_SWIFT_FLAGS_TSAN_YES = -Xcc -D__SANITIZE_THREAD__;
 
 // All Sanitizers
 
@@ -81,6 +82,7 @@ CLANG_ADDRESS_SANITIZER_CONTAINER_OVERFLOW = $(ENABLE_ADDRESS_SANITIZER);
 
 // Disable compact unwind to work around "Too many personality routines" linker error with TSan builds.
 WK_THREAD_SANITIZER_OTHER_LDFLAGS_YES = $(WK_THREAD_SANITIZER_OTHER_LDFLAGS_$(PRODUCT_NAME));
+WK_THREAD_SANITIZER_OTHER_LDFLAGS_TestIPC = -Wl,-no_compact_unwind;
 WK_THREAD_SANITIZER_OTHER_LDFLAGS_TestWebKitAPI = -Wl,-no_compact_unwind;
 WK_THREAD_SANITIZER_OTHER_LDFLAGS_TestWebKitAPIBundle = -Wl,-no_compact_unwind;
 WK_THREAD_SANITIZER_OTHER_LDFLAGS_WebCore = -Wl,-no_compact_unwind;

JSTests/microbenchmarks/array-buffer-is-view.js

@@ -0,0 +1,27 @@
+function isView(value)
+{
+    return ArrayBuffer.isView(value);
+}
+noInline(isView);
+
+let buffer = new ArrayBuffer(64);
+let values = [
+    [ new Int32Array(buffer), true ],
+    [ new Uint8Array(4), true ],
+    [ new Float64Array(2), true ],
+    [ new DataView(buffer), true ],
+    [ buffer, false ],
+    [ [], false ],
+    [ {}, false ],
+    [ 42, false ],
+    [ "text", false ],
+    [ null, false ],
+    [ undefined, false ],
+];
+
+for (var i = 0; i < 1e6; ++i) {
+    for (let pair of values) {
+        if (isView(pair[0]) != pair[1])
+            throw new Error(`bad value: ${String(pair[0])}`);
+    }
+}

JSTests/microbenchmarks/array-includes-string-rope-before-match.js

@@ -0,0 +1,21 @@
+function makeRope(a, b) {
+    return a + b;
+}
+noInline(makeRope);
+
+var array = [
+    undefined, undefined, undefined, undefined,
+    undefined, undefined, undefined, undefined,
+    makeRope('he', 'y'),
+    '',
+];
+
+function test(array) {
+    return array.includes('');
+}
+noInline(test);
+
+for (var i = 0; i < 1e6; ++i) {
+    if (!test(array))
+        throw new Error("bad");
+}

JSTests/microbenchmarks/array-indexof-string-rope-before-match.js

@@ -0,0 +1,21 @@
+function makeRope(a, b) {
+    return a + b;
+}
+noInline(makeRope);
+
+var array = [
+    undefined, undefined, undefined, undefined,
+    undefined, undefined, undefined, undefined,
+    makeRope('he', 'y'),
+    '',
+];
+
+function test(array) {
+    return array.indexOf('', 1);
+}
+noInline(test);
+
+for (var i = 0; i < 1e6; ++i) {
+    if (test(array) !== 9)
+        throw new Error("bad");
+}

JSTests/microbenchmarks/array-prototype-filter-int32.js

@@ -0,0 +1,19 @@
+function test(array) {
+    return array.filter(x => (x & 1) === 0);
+}
+noInline(test);
+
+var array = [];
+for (var i = 0; i < 64; ++i)
+    array.push(i);
+
+var result;
+for (var i = 0; i < 1e6; ++i)
+    result = test(array);
+
+if (result.length !== 32)
+    throw new Error("bad length: " + result.length);
+for (var i = 0; i < 32; ++i) {
+    if (result[i] !== i * 2)
+        throw new Error("bad value at " + i + ": " + result[i]);
+}

JSTests/microbenchmarks/async-generator-yield-star.js

@@ -0,0 +1,28 @@
+// Microbenchmark: `yield*` delegation inside an async generator.
+//
+// createAsyncGen delegates its whole output to `list` via `yield*`. This exercises the
+// op_async_iterator_open / op_async_iterator_next path (GetIterator(async) + the delegated
+// next()/await loop) rather than the old generic manual iterator-protocol loop, and it lets the
+// delegation participate in the fast async-generator consumer/driver optimizations. The result is
+// driven by a `for await` consumer, so both the producer's `yield*` and the consumer's iteration
+// are measured end to end.
+
+var list = [];
+for (var i = 0; i < 100; ++i)
+    list.push(i);
+
+async function* createAsyncGen(list) {
+    yield* list;
+}
+
+async function run() {
+    var sum = 0;
+    for (var n = 0; n < 15e3; ++n) {
+        for await (var v of createAsyncGen(list))
+            sum += v;
+    }
+    return sum;
+}
+
+run();
+drainMicrotasks();

JSTests/microbenchmarks/date-time-complex.js

@@ -0,0 +1,14 @@
+// Toggle `complex` by hand to measure alternating-locale constructions.
+const complex = false;
+const iterations = 1000000;
+let dtf;
+
+if (!complex) {
+    for (let i = 0; i < iterations; i++) {
+        dtf = new Intl.DateTimeFormat();
+    }
+} else {
+    for (let i = 0; i < iterations; i++) {
+        dtf = new Intl.DateTimeFormat(i % 2 ? "en-US" : "en-GB");
+    }
+}

JSTests/microbenchmarks/for-await-of-array.js

@@ -0,0 +1,34 @@
+// Microbenchmark: for-await-of over a sync array iterable (async-from-sync wrapper; fast Array modes).
+
+var data = [];
+for (var i = 0; i < 128; ++i)
+    data.push(i);
+
+async function values() {
+    var sum = 0;
+    for (var n = 0; n < 6e3; ++n)
+        for await (var v of data)
+            sum += v;
+    return sum;
+}
+
+async function keys() {
+    var sum = 0;
+    for (var n = 0; n < 6e3; ++n)
+        for await (var k of data.keys())
+            sum += k;
+    return sum;
+}
+
+async function entries() {
+    var sum = 0;
+    for (var n = 0; n < 6e3; ++n)
+        for await (var [k, v] of data.entries())
+            sum += k + v;
+    return sum;
+}
+
+values();
+keys();
+entries();
+drainMicrotasks();

JSTests/microbenchmarks/for-await-of-generic-iterable.js

@@ -0,0 +1,27 @@
+// Microbenchmark: for-await-of over a user-defined sync iterable (async-from-sync wrapper; Generic cooperative
+// driver -- next() is a real JS call, driven directly without allocating a per-step promise).
+
+function makeIterable(length) {
+    return {
+        [Symbol.iterator]() {
+            var i = 0;
+            return {
+                next() {
+                    return i < length ? { value: i++, done: false } : { value: undefined, done: true };
+                }
+            };
+        }
+    };
+}
+var iterable = makeIterable(64);
+
+async function run() {
+    var sum = 0;
+    for (var n = 0; n < 16e3; ++n)
+        for await (var v of iterable)
+            sum += v;
+    return sum;
+}
+
+run();
+drainMicrotasks();

JSTests/microbenchmarks/for-await-of-map.js

@@ -0,0 +1,34 @@
+// Microbenchmark: for-await-of over a sync Map iterable (async-from-sync wrapper; fast Map modes).
+
+var map = new Map();
+for (var i = 0; i < 128; ++i)
+    map.set(i, i * 2);
+
+async function entries() {
+    var sum = 0;
+    for (var n = 0; n < 6e3; ++n)
+        for await (var [k, v] of map)
+            sum += k + v;
+    return sum;
+}
+
+async function keys() {
+    var sum = 0;
+    for (var n = 0; n < 6e3; ++n)
+        for await (var k of map.keys())
+            sum += k;
+    return sum;
+}
+
+async function values() {
+    var sum = 0;
+    for (var n = 0; n < 6e3; ++n)
+        for await (var v of map.values())
+            sum += v;
+    return sum;
+}
+
+entries();
+keys();
+values();
+drainMicrotasks();

JSTests/microbenchmarks/for-await-of-promise-elements.js

@@ -0,0 +1,17 @@
+// Microbenchmark: for-await-of over a sync iterable of promises. Each element is Await-ed through the
+// async-from-sync wrapper (the AsyncFromSyncIteratorContinuation Await of a genuine promise value).
+
+var data = [];
+for (var i = 0; i < 64; ++i)
+    data.push(Promise.resolve(i));
+
+async function run() {
+    var sum = 0;
+    for (var n = 0; n < 16e3; ++n)
+        for await (var v of data)
+            sum += v;
+    return sum;
+}
+
+run();
+drainMicrotasks();

JSTests/microbenchmarks/for-await-of-set.js

@@ -0,0 +1,25 @@
+// Microbenchmark: for-await-of over a sync Set iterable (async-from-sync wrapper; fast Set modes).
+
+var set = new Set();
+for (var i = 0; i < 128; ++i)
+    set.add(i);
+
+async function values() {
+    var sum = 0;
+    for (var n = 0; n < 8e3; ++n)
+        for await (var v of set)
+            sum += v;
+    return sum;
+}
+
+async function entries() {
+    var sum = 0;
+    for (var n = 0; n < 8e3; ++n)
+        for await (var [a, b] of set.entries())
+            sum += a + b;
+    return sum;
+}
+
+values();
+entries();
+drainMicrotasks();