748ddee

BBQ FusedIf should propagate allocated scratch register to new block
https://bugs.webkit.org/show_bug.cgi?id=286512
rdar://142474221

Reviewed by Yusuke Suzuki.

Since FusedIf allocates a scratch register, the new block created by
FusedIf needs to be aware of this allocation, or else it may try to
allocate another register in the same place.

* Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp:
(JSC::Wasm::BBQJITImpl::BBQJIT::addFusedIfCompare):

Originally-landed-as: 283286.632@safari-7620-branch (4af308c795b6). rdar://148112940
Canonical link: https://commits.webkit.org/293229@main

bc947c0

Do not start new transaction when there is active version change transcation
rdar://142170054

Reviewed by Brady Eidson.

According to spec (https://w3c.github.io/IndexedDB/#upgrade-transaction-construct), version change (or upgrade)
transaction has exclusive access to database. The current implementation enforces this on client side (web process) by
not adding new transaction on server when there is ongoing version change transaction. This patch adds this check to
server side since web process could be compromised and schedule transactions unexpectedly.

* Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.cpp:
(WebCore::IDBServer::UniqueIDBDatabase::takeNextRunnableTransaction):

Originally-landed-as: 283286.631@safari-7620-branch (43d9bdf80277). rdar://148113398
Canonical link: https://commits.webkit.org/293228@main

575e580

Crash in transform fast-path parsing
https://bugs.webkit.org/show_bug.cgi?id=286462
rdar://142276253

Reviewed by Darin Adler.

* LayoutTests/fast/css/transform-translate-parsing-crash-expected.txt: Added.
* LayoutTests/fast/css/transform-translate-parsing-crash.html: Added.
* Source/WebCore/css/parser/CSSParserFastPaths.cpp:
(WebCore::parseSimpleTransformValue):

Check we don't access out of bounds indexes.

Originally-landed-as: 283286.630@safari-7620-branch (c09afb6b82bf). rdar://148113678
Canonical link: https://commits.webkit.org/293227@main

68444c0

[CoreIPC] [GPU] SharedVideoFrameInfo::copyToCVPixelBufferPlane can crash
rdar://142965165

Reviewed by Chris Dumez and Eric Carlson.

Make sure to use alpha row size to compute storage size instead of relying on the size being the same as plane A.
We also fix an issue in SharedVideoFrameInfo::decode where we were not checking for planeAlpha size being correctly decoded.

Covered by added unit test.

* Source/WebCore/platform/cocoa/SharedVideoFrameInfo.mm:
(WebCore::SharedVideoFrameInfo::storageSize const):
(WebCore::SharedVideoFrameInfo::decode):
* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* Tools/TestWebKitAPI/Tests/WebCore/cocoa/SharedVideoFrame.mm: Added.
(TestWebKitAPI::TEST(WebCore, SharedVideoFramePlaneAlphaSize)):

Originally-landed-as: 283286.629@safari-7620-branch (55b915bbbe64). rdar://148113842
Canonical link: https://commits.webkit.org/293226@main

cec3cb9