<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>197306</bug_id>
          
          <creation_ts>2019-04-25 22:22:03 -0700</creation_ts>
          <short_desc>[JSC] linkPolymorphicCall now does GC</short_desc>
          <delta_ts>2019-04-26 16:32:51 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>New Bugs</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Yusuke Suzuki">ysuzuki</reporter>
          <assigned_to name="Yusuke Suzuki">ysuzuki</assigned_to>
          <cc>ews-watchlist</cc>
    
    <cc>keith_miller</cc>
    
    <cc>mark.lam</cc>
    
    <cc>msaboff</cc>
    
    <cc>saam</cc>
    
    <cc>webkit-bug-importer</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1530623</commentid>
    <comment_count>0</comment_count>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2019-04-25 22:22:03 -0700</bug_when>
    <thetext>[JSC] linkPolymorphicCall now does GC</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1530636</commentid>
    <comment_count>1</comment_count>
      <attachid>368305</attachid>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2019-04-25 23:23:02 -0700</bug_when>
    <thetext>Created attachment 368305
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1530637</commentid>
    <comment_count>2</comment_count>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2019-04-25 23:24:14 -0700</bug_when>
    <thetext>&lt;rdar://problem/50006719&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1530649</commentid>
    <comment_count>3</comment_count>
      <attachid>368305</attachid>
    <who name="EWS Watchlist">ews-watchlist</who>
    <bug_when>2019-04-26 01:41:48 -0700</bug_when>
    <thetext>Comment on attachment 368305
Patch

Attachment 368305 did not pass jsc-ews (mac):
Output: https://webkit-queues.webkit.org/results/12002939

New failing tests:
stress/proxy-set-prototype-of.js.dfg-eager
stress/super-property-access-tdz.js.ftl-eager
stress/const-semantics.js.ftl-eager
stress/string-to-string-error.js.dfg-eager-no-cjit-validate
stress/lexical-let-loop-semantics.js.dfg-eager
stress/proxy-get-prototype-of.js.ftl-eager
stress/finally-for-in.js.ftl-eager
stress/dfg-object-prototype-of.js.dfg-eager
stress/proxy-set-prototype-of.js.ftl-eager-no-cjit
stress/proxy-revoke.js.ftl-eager-no-cjit
stress/dataview-jit-bounds-checks.js.ftl-eager
stress/proxy-get-prototype-of.js.ftl-eager-no-cjit
stress/const-tdz.js.ftl-eager-no-cjit
stress/typedarray-access-neutered.js.dfg-eager-no-cjit-validate
stress/import-syntax.js.ftl-eager
stress/async-await-mozilla.js.dfg-eager-no-cjit-validate
stress/arrow-functions-as-default-parameter-values.js.ftl-eager
stress/lexical-let-tdz.js.dfg-eager-no-cjit-validate
stress/string-to-string-error.js.ftl-eager
stress/arrowfunction-lexical-bind-arguments-non-strict-1.js.ftl-eager-no-cjit
stress/global-import-function-should-return-a-promise-when-clearing-exceptions.js.dfg-eager-no-cjit-validate
stress/eval-func-decl-block-with-var-sinthesize.js.ftl-eager
stress/super-property-access-tdz.js.ftl-eager-no-cjit
stress/inline-call-to-recursive-tail-call.js.dfg-eager-no-cjit-validate
stress/dfg-reflect-get-prototype-of.js.dfg-eager
stress/typedarray-access-neutered.js.ftl-eager-no-cjit
stress/typedarray-access-neutered.js.dfg-eager
stress/arrowfunction-lexical-bind-arguments-non-strict-1.js.ftl-eager
stress/const-tdz.js.dfg-eager-no-cjit-validate
stress/string-to-string-error.js.ftl-eager-no-cjit
stress/typedarray-access-neutered.js.no-cjit-collect-continuously
stress/es6-default-parameters.js.dfg-eager
stress/const-tdz.js.ftl-eager
stress/string-value-of-error.js.dfg-eager-no-cjit-validate
stress/tail-call-recognize.js.ftl-eager-no-cjit
stress/const-loop-semantics.js.dfg-eager
stress/proxy-get-prototype-of.js.dfg-eager-no-cjit-validate
stress/tail-call-host-call-throw.js.ftl-eager
stress/dfg-object-proto-getter.js.dfg-eager
stress/dfg-object-proto-accessor.js.dfg-eager
stress/to-object-intrinsic.js.dfg-eager-no-cjit-validate
stress/global-import-function-should-return-a-promise-when-clearing-exceptions.js.ftl-eager-no-cjit
stress/string-value-of-error.js.ftl-eager
stress/async-iteration-yield-star.js.ftl-eager-no-cjit
stress/lexical-let-tdz.js.dfg-eager
stress/typedarray-access-neutered.js.ftl-eager
stress/lexical-let-tdz.js.ftl-eager
stress/const-semantics.js.dfg-eager
stress/const-tdz.js.dfg-eager
stress/arrow-functions-as-default-parameter-values.js.ftl-eager-no-cjit
stress/super-property-access-tdz.js.dfg-eager-no-cjit-validate
stress/proxy-revoke.js.dfg-eager-no-cjit-validate
stress/es6-default-parameters.js.ftl-eager
stress/string-to-string-error.js.dfg-eager
stress/dataview-typedarray-toindex.js.dfg-eager-no-cjit-validate
stress/tail-call-recognize.js.dfg-eager
stress/proxy-revoke.js.ftl-eager
stress/arrowfunction-lexical-bind-superproperty.js.dfg-eager
stress/arrowfunction-lexical-bind-this-8.js.dfg-eager
stress/string-value-of-error.js.ftl-eager-no-cjit
stress/lexical-let-tdz.js.ftl-eager-no-cjit
stress/string-value-of-error.js.dfg-eager
stress/eval-func-decl-block-with-var-sinthesize.js.ftl-eager-no-cjit
stress/es6-default-parameters.js.dfg-eager-no-cjit-validate
stress/super-property-access.js.dfg-eager
stress/constant-folding-osr-exit.js.ftl-eager
stress/super-property-access-tdz.js.dfg-eager
stress/proxy-get-prototype-of.js.dfg-eager
stress/arrowfunction-lexical-bind-superproperty.js.dfg-eager-no-cjit-validate
stress/object-create-define.js.ftl-eager-no-cjit
stress/arrowfunction-tdz-3.js.ftl-eager
stress/arrow-functions-as-default-parameter-values.js.dfg-eager
stress/async-await-mozilla.js.ftl-eager
stress/eval-func-decl-block-with-var-sinthesize.js.dfg-eager-no-cjit-validate
stress/tail-call-recognize.js.ftl-eager
stress/lexical-let-loop-semantics.js.ftl-eager-no-cjit
stress/to-object-intrinsic.js.dfg-eager
stress/array-species-create-should-handle-masquerader.js.dfg-eager</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1530658</commentid>
    <comment_count>4</comment_count>
      <attachid>368305</attachid>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2019-04-26 02:56:15 -0700</bug_when>
    <thetext>Comment on attachment 368305
Patch

Looking into the test failures.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1530673</commentid>
    <comment_count>5</comment_count>
      <attachid>368305</attachid>
    <who name="Saam Barati">saam</who>
    <bug_when>2019-04-26 08:16:40 -0700</bug_when>
    <thetext>Comment on attachment 368305
Patch

Nice find.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1530675</commentid>
    <comment_count>6</comment_count>
    <who name="Saam Barati">saam</who>
    <bug_when>2019-04-26 08:17:46 -0700</bug_when>
    <thetext>(In reply to Build Bot from comment #3)
&gt; Comment on attachment 368305 [details]
&gt; Patch
&gt; 
&gt; Attachment 368305 [details] did not pass jsc-ews (mac):
&gt; Output: https://webkit-queues.webkit.org/results/12002939
&gt; 
&gt; New failing tests:
&gt; stress/proxy-set-prototype-of.js.dfg-eager
&gt; stress/super-property-access-tdz.js.ftl-eager
&gt; stress/const-semantics.js.ftl-eager
&gt; stress/string-to-string-error.js.dfg-eager-no-cjit-validate
&gt; stress/lexical-let-loop-semantics.js.dfg-eager
&gt; stress/proxy-get-prototype-of.js.ftl-eager
&gt; stress/finally-for-in.js.ftl-eager
&gt; stress/dfg-object-prototype-of.js.dfg-eager
&gt; stress/proxy-set-prototype-of.js.ftl-eager-no-cjit
&gt; stress/proxy-revoke.js.ftl-eager-no-cjit
&gt; stress/dataview-jit-bounds-checks.js.ftl-eager
&gt; stress/proxy-get-prototype-of.js.ftl-eager-no-cjit
&gt; stress/const-tdz.js.ftl-eager-no-cjit
&gt; stress/typedarray-access-neutered.js.dfg-eager-no-cjit-validate
&gt; stress/import-syntax.js.ftl-eager
&gt; stress/async-await-mozilla.js.dfg-eager-no-cjit-validate
&gt; stress/arrow-functions-as-default-parameter-values.js.ftl-eager
&gt; stress/lexical-let-tdz.js.dfg-eager-no-cjit-validate
&gt; stress/string-to-string-error.js.ftl-eager
&gt; stress/arrowfunction-lexical-bind-arguments-non-strict-1.js.ftl-eager-no-cjit
&gt; stress/global-import-function-should-return-a-promise-when-clearing-
&gt; exceptions.js.dfg-eager-no-cjit-validate
&gt; stress/eval-func-decl-block-with-var-sinthesize.js.ftl-eager
&gt; stress/super-property-access-tdz.js.ftl-eager-no-cjit
&gt; stress/inline-call-to-recursive-tail-call.js.dfg-eager-no-cjit-validate
&gt; stress/dfg-reflect-get-prototype-of.js.dfg-eager
&gt; stress/typedarray-access-neutered.js.ftl-eager-no-cjit
&gt; stress/typedarray-access-neutered.js.dfg-eager
&gt; stress/arrowfunction-lexical-bind-arguments-non-strict-1.js.ftl-eager
&gt; stress/const-tdz.js.dfg-eager-no-cjit-validate
&gt; stress/string-to-string-error.js.ftl-eager-no-cjit
&gt; stress/typedarray-access-neutered.js.no-cjit-collect-continuously
&gt; stress/es6-default-parameters.js.dfg-eager
&gt; stress/const-tdz.js.ftl-eager
&gt; stress/string-value-of-error.js.dfg-eager-no-cjit-validate
&gt; stress/tail-call-recognize.js.ftl-eager-no-cjit
&gt; stress/const-loop-semantics.js.dfg-eager
&gt; stress/proxy-get-prototype-of.js.dfg-eager-no-cjit-validate
&gt; stress/tail-call-host-call-throw.js.ftl-eager
&gt; stress/dfg-object-proto-getter.js.dfg-eager
&gt; stress/dfg-object-proto-accessor.js.dfg-eager
&gt; stress/to-object-intrinsic.js.dfg-eager-no-cjit-validate
&gt; stress/global-import-function-should-return-a-promise-when-clearing-
&gt; exceptions.js.ftl-eager-no-cjit
&gt; stress/string-value-of-error.js.ftl-eager
&gt; stress/async-iteration-yield-star.js.ftl-eager-no-cjit
&gt; stress/lexical-let-tdz.js.dfg-eager
&gt; stress/typedarray-access-neutered.js.ftl-eager
&gt; stress/lexical-let-tdz.js.ftl-eager
&gt; stress/const-semantics.js.dfg-eager
&gt; stress/const-tdz.js.dfg-eager
&gt; stress/arrow-functions-as-default-parameter-values.js.ftl-eager-no-cjit
&gt; stress/super-property-access-tdz.js.dfg-eager-no-cjit-validate
&gt; stress/proxy-revoke.js.dfg-eager-no-cjit-validate
&gt; stress/es6-default-parameters.js.ftl-eager
&gt; stress/string-to-string-error.js.dfg-eager
&gt; stress/dataview-typedarray-toindex.js.dfg-eager-no-cjit-validate
&gt; stress/tail-call-recognize.js.dfg-eager
&gt; stress/proxy-revoke.js.ftl-eager
&gt; stress/arrowfunction-lexical-bind-superproperty.js.dfg-eager
&gt; stress/arrowfunction-lexical-bind-this-8.js.dfg-eager
&gt; stress/string-value-of-error.js.ftl-eager-no-cjit
&gt; stress/lexical-let-tdz.js.ftl-eager-no-cjit
&gt; stress/string-value-of-error.js.dfg-eager
&gt; stress/eval-func-decl-block-with-var-sinthesize.js.ftl-eager-no-cjit
&gt; stress/es6-default-parameters.js.dfg-eager-no-cjit-validate
&gt; stress/super-property-access.js.dfg-eager
&gt; stress/constant-folding-osr-exit.js.ftl-eager
&gt; stress/super-property-access-tdz.js.dfg-eager
&gt; stress/proxy-get-prototype-of.js.dfg-eager
&gt; stress/arrowfunction-lexical-bind-superproperty.js.dfg-eager-no-cjit-validate
&gt; stress/object-create-define.js.ftl-eager-no-cjit
&gt; stress/arrowfunction-tdz-3.js.ftl-eager
&gt; stress/arrow-functions-as-default-parameter-values.js.dfg-eager
&gt; stress/async-await-mozilla.js.ftl-eager
&gt; stress/eval-func-decl-block-with-var-sinthesize.js.dfg-eager-no-cjit-validate
&gt; stress/tail-call-recognize.js.ftl-eager
&gt; stress/lexical-let-loop-semantics.js.ftl-eager-no-cjit
&gt; stress/to-object-intrinsic.js.dfg-eager
&gt; stress/array-species-create-should-handle-masquerader.js.dfg-eager

Are these real? Maybe we want DeferGCForAWhile?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1530769</commentid>
    <comment_count>7</comment_count>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2019-04-26 11:31:04 -0700</bug_when>
    <thetext>(In reply to Saam Barati from comment #6)
&gt; (In reply to Build Bot from comment #3)
&gt; &gt; Comment on attachment 368305 [details]
&gt; &gt; Patch
&gt; &gt; 
&gt; &gt; Attachment 368305 [details] did not pass jsc-ews (mac):
&gt; &gt; Output: https://webkit-queues.webkit.org/results/12002939
&gt; &gt; 
&gt; &gt; New failing tests:
&gt; &gt; stress/proxy-set-prototype-of.js.dfg-eager
&gt; &gt; stress/super-property-access-tdz.js.ftl-eager
&gt; &gt; stress/const-semantics.js.ftl-eager
&gt; &gt; stress/string-to-string-error.js.dfg-eager-no-cjit-validate
&gt; &gt; stress/lexical-let-loop-semantics.js.dfg-eager
&gt; &gt; stress/proxy-get-prototype-of.js.ftl-eager
&gt; &gt; stress/finally-for-in.js.ftl-eager
&gt; &gt; stress/dfg-object-prototype-of.js.dfg-eager
&gt; &gt; stress/proxy-set-prototype-of.js.ftl-eager-no-cjit
&gt; &gt; stress/proxy-revoke.js.ftl-eager-no-cjit
&gt; &gt; stress/dataview-jit-bounds-checks.js.ftl-eager
&gt; &gt; stress/proxy-get-prototype-of.js.ftl-eager-no-cjit
&gt; &gt; stress/const-tdz.js.ftl-eager-no-cjit
&gt; &gt; stress/typedarray-access-neutered.js.dfg-eager-no-cjit-validate
&gt; &gt; stress/import-syntax.js.ftl-eager
&gt; &gt; stress/async-await-mozilla.js.dfg-eager-no-cjit-validate
&gt; &gt; stress/arrow-functions-as-default-parameter-values.js.ftl-eager
&gt; &gt; stress/lexical-let-tdz.js.dfg-eager-no-cjit-validate
&gt; &gt; stress/string-to-string-error.js.ftl-eager
&gt; &gt; stress/arrowfunction-lexical-bind-arguments-non-strict-1.js.ftl-eager-no-cjit
&gt; &gt; stress/global-import-function-should-return-a-promise-when-clearing-
&gt; &gt; exceptions.js.dfg-eager-no-cjit-validate
&gt; &gt; stress/eval-func-decl-block-with-var-sinthesize.js.ftl-eager
&gt; &gt; stress/super-property-access-tdz.js.ftl-eager-no-cjit
&gt; &gt; stress/inline-call-to-recursive-tail-call.js.dfg-eager-no-cjit-validate
&gt; &gt; stress/dfg-reflect-get-prototype-of.js.dfg-eager
&gt; &gt; stress/typedarray-access-neutered.js.ftl-eager-no-cjit
&gt; &gt; stress/typedarray-access-neutered.js.dfg-eager
&gt; &gt; stress/arrowfunction-lexical-bind-arguments-non-strict-1.js.ftl-eager
&gt; &gt; stress/const-tdz.js.dfg-eager-no-cjit-validate
&gt; &gt; stress/string-to-string-error.js.ftl-eager-no-cjit
&gt; &gt; stress/typedarray-access-neutered.js.no-cjit-collect-continuously
&gt; &gt; stress/es6-default-parameters.js.dfg-eager
&gt; &gt; stress/const-tdz.js.ftl-eager
&gt; &gt; stress/string-value-of-error.js.dfg-eager-no-cjit-validate
&gt; &gt; stress/tail-call-recognize.js.ftl-eager-no-cjit
&gt; &gt; stress/const-loop-semantics.js.dfg-eager
&gt; &gt; stress/proxy-get-prototype-of.js.dfg-eager-no-cjit-validate
&gt; &gt; stress/tail-call-host-call-throw.js.ftl-eager
&gt; &gt; stress/dfg-object-proto-getter.js.dfg-eager
&gt; &gt; stress/dfg-object-proto-accessor.js.dfg-eager
&gt; &gt; stress/to-object-intrinsic.js.dfg-eager-no-cjit-validate
&gt; &gt; stress/global-import-function-should-return-a-promise-when-clearing-
&gt; &gt; exceptions.js.ftl-eager-no-cjit
&gt; &gt; stress/string-value-of-error.js.ftl-eager
&gt; &gt; stress/async-iteration-yield-star.js.ftl-eager-no-cjit
&gt; &gt; stress/lexical-let-tdz.js.dfg-eager
&gt; &gt; stress/typedarray-access-neutered.js.ftl-eager
&gt; &gt; stress/lexical-let-tdz.js.ftl-eager
&gt; &gt; stress/const-semantics.js.dfg-eager
&gt; &gt; stress/const-tdz.js.dfg-eager
&gt; &gt; stress/arrow-functions-as-default-parameter-values.js.ftl-eager-no-cjit
&gt; &gt; stress/super-property-access-tdz.js.dfg-eager-no-cjit-validate
&gt; &gt; stress/proxy-revoke.js.dfg-eager-no-cjit-validate
&gt; &gt; stress/es6-default-parameters.js.ftl-eager
&gt; &gt; stress/string-to-string-error.js.dfg-eager
&gt; &gt; stress/dataview-typedarray-toindex.js.dfg-eager-no-cjit-validate
&gt; &gt; stress/tail-call-recognize.js.dfg-eager
&gt; &gt; stress/proxy-revoke.js.ftl-eager
&gt; &gt; stress/arrowfunction-lexical-bind-superproperty.js.dfg-eager
&gt; &gt; stress/arrowfunction-lexical-bind-this-8.js.dfg-eager
&gt; &gt; stress/string-value-of-error.js.ftl-eager-no-cjit
&gt; &gt; stress/lexical-let-tdz.js.ftl-eager-no-cjit
&gt; &gt; stress/string-value-of-error.js.dfg-eager
&gt; &gt; stress/eval-func-decl-block-with-var-sinthesize.js.ftl-eager-no-cjit
&gt; &gt; stress/es6-default-parameters.js.dfg-eager-no-cjit-validate
&gt; &gt; stress/super-property-access.js.dfg-eager
&gt; &gt; stress/constant-folding-osr-exit.js.ftl-eager
&gt; &gt; stress/super-property-access-tdz.js.dfg-eager
&gt; &gt; stress/proxy-get-prototype-of.js.dfg-eager
&gt; &gt; stress/arrowfunction-lexical-bind-superproperty.js.dfg-eager-no-cjit-validate
&gt; &gt; stress/object-create-define.js.ftl-eager-no-cjit
&gt; &gt; stress/arrowfunction-tdz-3.js.ftl-eager
&gt; &gt; stress/arrow-functions-as-default-parameter-values.js.dfg-eager
&gt; &gt; stress/async-await-mozilla.js.ftl-eager
&gt; &gt; stress/eval-func-decl-block-with-var-sinthesize.js.dfg-eager-no-cjit-validate
&gt; &gt; stress/tail-call-recognize.js.ftl-eager
&gt; &gt; stress/lexical-let-loop-semantics.js.ftl-eager-no-cjit
&gt; &gt; stress/to-object-intrinsic.js.dfg-eager
&gt; &gt; stress/array-species-create-should-handle-masquerader.js.dfg-eager
&gt; 
&gt; Are these real? Maybe we want DeferGCForAWhile?

Yes, I tested it on my home machine yesterday and it was real.
It seems that JITCode is changing and operationOptimize see unexpected JITType for the CodeBlock (rough investigation I did yesterday).
And my impression is that we should use DeferGCForAWhile. After I figured out what is happening, and if it is fixed with DeferGCForAWhile, I&apos;ll land this with DeferGCForAWhile and comment about the behavior.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1530817</commentid>
    <comment_count>8</comment_count>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2019-04-26 14:55:53 -0700</bug_when>
    <thetext>(In reply to Yusuke Suzuki from comment #7)
&gt; (In reply to Saam Barati from comment #6) 
&gt; &gt; Are these real? Maybe we want DeferGCForAWhile?
&gt; 
&gt; Yes, I tested it on my home machine yesterday and it was real.
&gt; It seems that JITCode is changing and operationOptimize see unexpected
&gt; JITType for the CodeBlock (rough investigation I did yesterday).
&gt; And my impression is that we should use DeferGCForAWhile. After I figured
&gt; out what is happening, and if it is fixed with DeferGCForAWhile, I&apos;ll land
&gt; this with DeferGCForAWhile and comment about the behavior.

When GC happens, it may jettison CodeBlock, and it makes operationLinkPolymorphicCall&apos;s SlowPathReturnType result broken. We should not perform GC in linkPolymorphicCall. So, DeferGCForAWhile is the correct fix.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1530858</commentid>
    <comment_count>9</comment_count>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2019-04-26 16:32:51 -0700</bug_when>
    <thetext>Committed r244711: &lt;https://trac.webkit.org/changeset/244711&gt;</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>368305</attachid>
            <date>2019-04-25 23:23:02 -0700</date>
            <delta_ts>2019-04-26 08:16:40 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-197306-20190425232301.patch</filename>
            <type>text/plain</type>
            <size>6907</size>
            <attacher name="Yusuke Suzuki">ysuzuki</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMjQ0NjY2CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw
dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCBh
OGFkNDc1ZjRkNGQzNWIxZDZjYjdkMTkxZGZiYjE2NjRhM2M2YTQ1Li5kM2Y2YzY0MmRhMTRkOGJh
NTFjYzMxMmQwYTA4YmY1NjBiMjhjNzUxIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv
cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs
MyArMSwxOSBAQAorMjAxOS0wNC0yNSAgWXVzdWtlIFN1enVraSAgPHlzdXp1a2lAYXBwbGUuY29t
PgorCisgICAgICAgIFtKU0NdIGxpbmtQb2x5bW9ycGhpY0NhbGwgbm93IGRvZXMgR0MKKyAgICAg
ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE5NzMwNgorCisgICAg
ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFByZXZpb3VzbHksIHdl
IGFzc3VtZWQgdGhhdCBsaW5rUG9seW1vcnBoaWNDYWxsIGRvZXMgbm90IHBlcmZvcm0gYWxsb2Nh
dGlvbnMuIFNvIHdlIHB1dCBDYWxsVmFyaWFudCBpbnRvIGEgVmVjdG9yPD4uCisgICAgICAgIEJ1
dCBub3csIFdlYkFzc2VtYmx5RnVuY3Rpb24ncyBlbnRyeXBvaW50IGdlbmVyYXRpb24gY2FuIGFs
bG9jYXRlIEpTVG9XYXNtSUNDYWxsZWUgYW5kIGNhdXNlIEdDLiBTaW5jZSBDYWxsTGlua0luZm8K
KyAgICAgICAgZG9lcyBub3QgaG9sZCB0aGVzZSBjZWxscywgdGhleSBjYW4gYmUgY29sbGVjdGVk
LCBhbmQgd2Ugd2lsbCBzZWUgZGVhZCBjZWxscyBpbiB0aGUgbWlkZGxlIG9mIGxpbmtQb2x5bW9y
cGhpY0NhbGwuCisgICAgICAgIFdlIHNob3VsZCBkZWZlciBHQyBpbiBsaW5rUG9seW1vcnBoaWND
YWxsLiBEZWZlckdDIG1heSBjYXVzZSBHQyBhbmQgY2xlYXIgQ2FsbExpbmtJbmZvIGp1c3QgYmVm
b3JlIGZpbmlzaGluZworICAgICAgICBsaW5rUG9seW1vcnBoaWNDYWxsLCBidXQgaXQgaXMgT0sg
c2luY2UgaXQganVzdCByZXZlcnRzIHRoZSBjYWxsLgorCisgICAgICAgICogaml0L1JlcGF0Y2gu
Y3BwOgorICAgICAgICAoSlNDOjpsaW5rUG9seW1vcnBoaWNDYWxsKToKKwogMjAxOS0wNC0yNSAg
VGltb3RoeSBIYXRjaGVyICA8dGltb3RoeUBhcHBsZS5jb20+CiAKICAgICAgICAgRGlzYWJsZSBk
YXRlIGFuZCB0aW1lIGlucHV0cyBvbiBpT1NNYWMuCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNj
cmlwdENvcmUvaml0L1JlcGF0Y2guY3BwIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2ppdC9SZXBh
dGNoLmNwcAppbmRleCBlZmNhNWYwMDk1NDlmYmViOTdhNTc5MzM0OGU2ZjZjZmMxYTA1YzZjLi5h
MzUyNGYyMmM0ZTY1YjAzZDBkODJiOTAxNDZhYzBiM2RjYTIzNGE2IDEwMDY0NAotLS0gYS9Tb3Vy
Y2UvSmF2YVNjcmlwdENvcmUvaml0L1JlcGF0Y2guY3BwCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0
Q29yZS9qaXQvUmVwYXRjaC5jcHAKQEAgLTk2OCw2ICs5NjgsOCBAQCB2b2lkIGxpbmtQb2x5bW9y
cGhpY0NhbGwoCiAgICAgQVNTRVJUKGNhbGxlckZyYW1lLT5jYWxsZWUoKS5pc0NlbGwoKSk7CiAK
ICAgICBWTSYgdm0gPSBjYWxsZXJGcmFtZS0+dm0oKTsKKyAgICBEZWZlckdDIGRlZmVyR0Modm0u
aGVhcCk7CisKICAgICBDb2RlQmxvY2sqIGNhbGxlckNvZGVCbG9jayA9IGNhbGxlckZyYW1lLT5j
b2RlQmxvY2soKTsKICAgICBib29sIGlzV2ViQXNzZW1ibHkgPSBpc1dlYkFzc2VtYmx5VG9KU0Nh
bGxlZShjYWxsZXJGcmFtZS0+Y2FsbGVlKCkuYXNDZWxsKCkpOwogCmRpZmYgLS1naXQgYS9Ub29s
cy9DaGFuZ2VMb2cgYi9Ub29scy9DaGFuZ2VMb2cKaW5kZXggNmY3MzA1NGI0ZGM5YTA5MGVhMGFl
Yjk4ZGMyOTI4N2M4N2JjZjdhMS4uYTVjNDY5MTE5ODgzMjhhMThmNmVkNjA0NTZkY2I2NjIxMDE4
MjAzMyAxMDA2NDQKLS0tIGEvVG9vbHMvQ2hhbmdlTG9nCisrKyBiL1Rvb2xzL0NoYW5nZUxvZwpA
QCAtMSwzICsxLDE1IEBACisyMDE5LTA0LTI1ICBZdXN1a2UgU3V6dWtpICA8eXN1enVraUBhcHBs
ZS5jb20+CisKKyAgICAgICAgW0pTQ10gbGlua1BvbHltb3JwaGljQ2FsbCBub3cgZG9lcyBHQwor
ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTk3MzA2CisK
KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgVGhlIHRlc3Qg
aXMgc2Vuc2l0aXZlIHRvIGFsbG9jYXRpb25zIGFuZCBldmVuIGFkZGluZyAkdm0gbWFrZXMgaXQg
bm9uLXJlcHJvZHVjaWJsZS4KKyAgICAgICAgVG8gYWRkIHRoaXMgdGVzdCwgd2UgYWRkIGBydW5X
aXRob3V0QmFzZU9wdGlvbmAuCisKKyAgICAgICAgKiBTY3JpcHRzL3J1bi1qc2Mtc3RyZXNzLXRl
c3RzOgorCiAyMDE5LTA0LTI1ICBUaW1vdGh5IEhhdGNoZXIgIDx0aW1vdGh5QGFwcGxlLmNvbT4K
IAogICAgICAgICBEaXNhYmxlIGRhdGUgYW5kIHRpbWUgaW5wdXRzIG9uIGlPU01hYy4KZGlmZiAt
LWdpdCBhL1Rvb2xzL1NjcmlwdHMvcnVuLWpzYy1zdHJlc3MtdGVzdHMgYi9Ub29scy9TY3JpcHRz
L3J1bi1qc2Mtc3RyZXNzLXRlc3RzCmluZGV4IDZlYjI5ZmQ3ZjdlZGVlZjU2OGFhMDJmZWFjNDRj
ODgyNThhYWFlZTAuLmNmYWU5Yzk1ODk1ZmRlNTM0YzAxYjQ5MjFlOWM3MDE5NTEwMmY0OGUgMTAw
NzU1Ci0tLSBhL1Rvb2xzL1NjcmlwdHMvcnVuLWpzYy1zdHJlc3MtdGVzdHMKKysrIGIvVG9vbHMv
U2NyaXB0cy9ydW4tanNjLXN0cmVzcy10ZXN0cwpAQCAtNjE2LDEwICs2MTYsMTggQEAgZGVmIHJ1
bldpdGhPdXRwdXRIYW5kbGVyKGtpbmQsIG91dHB1dEhhbmRsZXIsICpvcHRpb25zKQogICAgIGFk
ZFJ1bkNvbW1hbmQoa2luZCwgW3BhdGhUb1ZNLnRvX3NdICsgQkFTRV9PUFRJT05TICsgJHRlc3RT
cGVjaWZpY1JlcXVpcmVkT3B0aW9ucyArIG9wdGlvbnMgKyBbJGJlbmNobWFyay50b19zXSwgb3V0
cHV0SGFuZGxlciwgc2ltcGxlRXJyb3JIYW5kbGVyKQogZW5kCiAKK2RlZiBydW5XaXRoT3V0cHV0
SGFuZGxlcldpdGhvdXRCYXNlT3B0aW9uKGtpbmQsIG91dHB1dEhhbmRsZXIsICpvcHRpb25zKQor
ICAgIGFkZFJ1bkNvbW1hbmQoa2luZCwgW3BhdGhUb1ZNLnRvX3NdICsgJHRlc3RTcGVjaWZpY1Jl
cXVpcmVkT3B0aW9ucyArIG9wdGlvbnMgKyBbJGJlbmNobWFyay50b19zXSwgb3V0cHV0SGFuZGxl
ciwgc2ltcGxlRXJyb3JIYW5kbGVyKQorZW5kCisKIGRlZiBydW4oa2luZCwgKm9wdGlvbnMpCiAg
ICAgcnVuV2l0aE91dHB1dEhhbmRsZXIoa2luZCwgc2lsZW50T3V0cHV0SGFuZGxlciwgKm9wdGlv
bnMpCiBlbmQKIAorZGVmIHJ1bldpdGhvdXRCYXNlT3B0aW9uKGtpbmQsICpvcHRpb25zKQorICAg
IHJ1bldpdGhPdXRwdXRIYW5kbGVyV2l0aG91dEJhc2VPcHRpb24oa2luZCwgc2lsZW50T3V0cHV0
SGFuZGxlciwgKm9wdGlvbnMpCitlbmQKKwogZGVmIHJ1bk5vRlRMKCpvcHRpb25hbFRlc3RTcGVj
aWZpY09wdGlvbnMpCiAgICAgcnVuKCJuby1mdGwiLCAqb3B0aW9uYWxUZXN0U3BlY2lmaWNPcHRp
b25zKQogZW5kCmRpZmYgLS1naXQgYS9KU1Rlc3RzL0NoYW5nZUxvZyBiL0pTVGVzdHMvQ2hhbmdl
TG9nCmluZGV4IDMxNWVjZWU3MTI1OGNlM2MzZTE0ZDQ2ZTEwMzBiNTNjMzIzZWU4YjQuLjYzZTA0
NDdhNTQxOWU1ZGY3MWM1YzhiM2JhZDhmMzJlNTY2NmUyOGEgMTAwNjQ0Ci0tLSBhL0pTVGVzdHMv
Q2hhbmdlTG9nCisrKyBiL0pTVGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTQgQEAKKzIwMTkt
MDQtMjUgIFl1c3VrZSBTdXp1a2kgIDx5c3V6dWtpQGFwcGxlLmNvbT4KKworICAgICAgICBbSlND
XSBsaW5rUG9seW1vcnBoaWNDYWxsIG5vdyBkb2VzIEdDCisgICAgICAgIGh0dHBzOi8vYnVncy53
ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xOTczMDYKKworICAgICAgICBSZXZpZXdlZCBieSBO
T0JPRFkgKE9PUFMhKS4KKworICAgICAgICAqIHN0cmVzcy9saW5rLXBvbHltb3JwaGljLWNhbGwt
Y2FuLWdjLmpzOiBBZGRlZC4KKyAgICAgICAgKG1vZHVsZSk6CisgICAgICAgIChpbnN0YW5jZSk6
CisKIDIwMTktMDQtMjMgIFNhYW0gQmFyYXRpICA8c2JhcmF0aUBhcHBsZS5jb20+CiAKICAgICAg
ICAgTElDTSBpbmNvcnJlY3RseSBhc3N1bWVzIGl0J2xsIG5ldmVyIGluc2VydCBhIG5vZGUgd2hp
Y2ggcHJvdmFibHkgT1NSIGV4aXRzCmRpZmYgLS1naXQgYS9KU1Rlc3RzL3N0cmVzcy9saW5rLXBv
bHltb3JwaGljLWNhbGwtY2FuLWdjLmpzIGIvSlNUZXN0cy9zdHJlc3MvbGluay1wb2x5bW9ycGhp
Yy1jYWxsLWNhbi1nYy5qcwpuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAw
MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi4xYmY2ZmUxMWJkZGM0MDMwZDNlMjUzMjA5MmYx
NTY3OWNkYWU5OTk0Ci0tLSAvZGV2L251bGwKKysrIGIvSlNUZXN0cy9zdHJlc3MvbGluay1wb2x5
bW9ycGhpYy1jYWxsLWNhbi1nYy5qcwpAQCAtMCwwICsxLDY1IEBACisvL0Agc2tpcCBpZiAhJGpp
dFRlc3RzCisvL0Agc2tpcCBpZiAhJGlzRlRMUGxhdGZvcm0KKy8vQCBydW5XaXRob3V0QmFzZU9w
dGlvbigiZGVmYXVsdCIsICItLXNsb3dQYXRoQWxsb2NzQmV0d2VlbkdDcz0xMCIsICItLWppdFBv
bGljeVNjYWxlPTAiLCAiLS11c2VDb25jdXJyZW50SklUPTAiLCAiLS12YWxpZGF0ZUV4Y2VwdGlv
bkNoZWNrcz0xIikKKyd1c2Ugc3RyaWN0JzsKK2xldCBvID0geworICAgIHgwOiAoKT0+MCwKKyAg
ICB4MTogKCk9PjAsCisgICAgeDI6ICgpPT4wLAorfTsKKworZnVuY3Rpb24gbW9kdWxlKGJ5dGVz
KSB7CisgICAgbGV0IGJ1ZmZlciA9IG5ldyBBcnJheUJ1ZmZlcihieXRlcy5sZW5ndGgpOworICAg
IGxldCB2aWV3ID0gbmV3IFVpbnQ4QXJyYXkoYnVmZmVyKTsKKyAgICBmb3IgKGxldCBpID0gMDsg
aSA8IGJ5dGVzLmxlbmd0aDsgKytpKSB7CisgICAgICAgIHZpZXdbaV0gPSBieXRlcy5jaGFyQ29k
ZUF0KGkpOworICAgIH0KKyAgICByZXR1cm4gbmV3IFdlYkFzc2VtYmx5Lk1vZHVsZShidWZmZXIp
OworfQorCitmdW5jdGlvbiBpbnN0YW5jZShieXRlcywgaW1wb3J0cyA9IHtvfSkgeworICAgIHJl
dHVybiBuZXcgV2ViQXNzZW1ibHkuSW5zdGFuY2UobW9kdWxlKGJ5dGVzKSwgaW1wb3J0cyk7Cit9
CisKK2Z1bmN0aW9uIGNhbGwoaW5zdGFuY2VfLCBuYW1lKSB7CisgICAgcmV0dXJuIGluc3RhbmNl
Xy5leHBvcnRzW25hbWVdKCk7Cit9CisKK2Z1bmN0aW9uIGV4cG9ydHMobmFtZSwgaW5zdGFuY2Vf
KSB7CisgICAgcmV0dXJuIHsgW25hbWVdOiBpbnN0YW5jZV8uZXhwb3J0cyB9OworfQorCitmdW5j
dGlvbiBydW4oYWN0aW9uKSB7CisgICAgYWN0aW9uKCk7Cit9CisKK2Z1bmN0aW9uIGZuMSgpIHsK
K30KK2Z1bmN0aW9uIGZuMSgpIHsKK30KK2Z1bmN0aW9uIGZuMSgpIHsKK30KK2Z1bmN0aW9uIGZu
MSgpIHsKK30KK2Z1bmN0aW9uIGZuMSgpIHsKK30KK2Z1bmN0aW9uIGZuMSgpIHsKK30KK2Z1bmN0
aW9uIGZuMSgpIHsKK30KK2Z1bmN0aW9uIGZuMSgpIHsKK30KKwordHJ5IHsKKyAgICAoZnVuY3Rp
b24gZigpIHsKKyAgICAgICAgZigpOworICAgIH0oKSk7Cit9IGNhdGNoIChlKSB7Cit9CisKK2xl
dCAkMSA9IGluc3RhbmNlKCdcMGFzbVx4MDFcMFwwXDBceDAxXHg5MVx4ODBceDgwXHg4MFwwXHgw
NGBcMFwwYFwwXHgwMVx4N0ZgXDBceDAxfWBceDAxXHg3Rlx4MDFceDdGXHgwM1x4ODdceDgwXHg4
MFx4ODBcMFx4MDZcMFx4MDFceDAxXHgwMlx4MDNceDAxXHgwNVx4ODRceDgwXHg4MFx4ODBcMFx4
MDFceDAxXHgwMVx4MDFceDA3w6tceDgwXHg4MFx4ODBcMFx4MDZceDBGemVyb19ldmVyeXRoaW5n
XDBcMFx4MTJ0ZXN0X3N0b3JlX3RvX2xvYWRcMFx4MDFceDEzdGVzdF9yZWR1bmRhbnRfbG9hZFww
XHgwMlx4MEZ0ZXN0X2RlYWRfc3RvcmVcMFx4MDNceDA2bWFsbG9jXDBceDA0XHgwRm1hbGxvY19h
bGlhc2luZ1wwXHgwNVxuXHhCRFx4ODFceDgwXHg4MFwwXHgwNlx4OUVceDgwXHg4MFx4ODBcMFww
QVwwQVx4MDA2XHgwMlwwQVx4MDRBXHgwMDZceDAyXDBBXGJBXHgwMDZceDAyXDBBXGZBXHgwMDZc
eDAyXDBceDBCXHg5OFx4ODBceDgwXHg4MFwwXDBBXGJBXHgwMDZceDAyXDBBXHgwNUNcMFwwXDBc
eDgwOFx4MDJcMEFcYihceDAyXDBceDBCXHhBMlx4ODBceDgwXHg4MFwwXHgwMVx4MDJceDdGQVxi
KFx4MDJcMCFcMEFceDA1QVx4ODBceDgwXHg4MFx4ODB4Nlx4MDJcMEFcYihceDAyXDAhXHgwMSBc
MCBceDAxalx4MEJceDlGXHg4MFx4ODBceDgwXDBceDAxXHgwMX1BXGJBXHhBM8OGXHg4Q1x4OTlc
eDAyNlx4MDJcMEFceDBCKlx4MDJcMCFcMEFcYkFceDAwNlx4MDJcMCBcMFx4MEJceDg0XHg4MFx4
ODBceDgwXDBcMEFceDEwXHgwQlx4QTNceDgwXHg4MFx4ODBcMFx4MDFceDAyXHg3RkFceDA0XHgx
MFx4MDQhXDBBXHgwNFx4MTBceDA0IVx4MDEgXDBBKjZceDAyXDAgXHgwMUErNlx4MDJcMCBcMChc
eDAyXDBceDBCJyk7CisKK2NhbGwoJDEsICd6ZXJvX2V2ZXJ5dGhpbmcnKTsKK3J1bigoKSA9PiBj
YWxsKCQxLCAnemVyb19ldmVyeXRoaW5nJywgW10pKTsKK3J1bigoKSA9PiBjYWxsKGluc3RhbmNl
KCdcMGFzbVx4MDFcMFwwXDBceDAxXHg4OFx4ODBceDgwXHg4MFwwXHgwMmBcMFwwYFwwXHgwMX1c
eDAyXHg5Nlx4ODBceDgwXHg4MFwwXHgwMVx4MDIkMVx4MEZ0ZXN0X2RlYWRfc3RvcmVcMFx4MDFc
eDAzXHg4Mlx4ODBceDgwXHg4MFwwXHgwMVwwXHgwN1x4ODdceDgwXHg4MFx4ODBcMFx4MDFceDAz
cnVuXDBceDAxXG5ceDlBXHg4MFx4ODBceDgwXDBceDAxXHg5NFx4ODBceDgwXHg4MFwwXDBceDAy
QFx4MTBcMFx4QkNDI1wwXDBcMFx4QkNGRVxyXDBceDBGXHgwQlwwXHgwQicsIGV4cG9ydHMoJyQx
JywgJDEpKSwgJ3J1bicsIFtdKSk7CitydW4oKCkgPT4gY2FsbCgkMSwgJ21hbGxvY19hbGlhc2lu
ZycsIFtdKSk7Cg==
</data>
<flag name="review"
          id="384616"
          type_id="1"
          status="+"
          setter="saam"
    />
    <flag name="commit-queue"
          id="384607"
          type_id="3"
          status="-"
          setter="ews-watchlist"
    />
          </attachment>
      

    </bug>

</bugzilla>