{
  "commits": {
    "315783@main": {
      "author": "Jessica Cheung",
      "avatar": "https://www.gravatar.com/avatar/5c102f093ce6bc01424466a4cfdf1d1f?d=identicon\u0026s=64",
      "cl": "315783@main",
      "clUrl": "https://commits.webkit.org/315783@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317787\nrdar://180555195\n\nReviewed by Abrar Rahman Protyasha, Pascoe, and Aditya Keerthi.\n\nUpdate my status from \"committer\" to \"reviewer\".\n\n* metadata/contributors.json:\n\nCanonical link: https://commits.webkit.org/315783@main",
      "email": "jcheung23@apple.com",
      "hash": "73b247d49a3ef8274375f7f9f8b66071d893bf6c",
      "subject": "Update status of Jessica Cheung to 'reviewer' in contributors.json"
    },
    "315785@main": {
      "author": "Nikolas Zimmermann",
      "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64",
      "cl": "315785@main",
      "clUrl": "https://commits.webkit.org/315785@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315455\n\nReviewed by Carlos Alberto Lopez Perez.\n\nSwitch to Ubuntu 26.04 \"Resolute Raccoon\" based SDK and rebaseline the\nglib results affected by the new toolchain.\n\nThe wkdev SDK base image moved from Ubuntu 24.04 (libxml2 2.9.14) to\nUbuntu 26.04 (libxml2 2.15.2). The newer libxml2 reworded several XML\nparser diagnostics, which surface in test output, so need to rebaseline.\n\nThese are message-only changes from the parser, with no behavioural\nchange in WebKit. The remaining rebaselines are unrelated to libxml2:\nSelectors API conformance progressions, x-mac-thai decoding now parsing\ncorrectly after the ICU update, and SVG render-tree sub-pixel precision\ndiffs from the new toolchain math.\n\n* .wkdev-sdk-version:\n* LayoutTests/fast/borders/border-image-repeat-stretch.html:\n* LayoutTests/fast/inline/inline-background-clip-text-multiline.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-backgrounds/border-radius-clipping-with-transform-001.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-transforms/transform-background-001.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-transforms/transform-background-002.html:\n* LayoutTests/imported/w3c/web-platform-tests/svg/painting/reftests/marker-path-001.svg:\n* LayoutTests/platform/glib/dom/xhtml/level3/core/entitygetinputencoding03-expected.txt: Added.\n* LayoutTests/platform/glib/fast/dom/Range/surround-contents-font-face-crash-expected.txt: Added.\n* LayoutTests/platform/glib/fast/dom/SelectorAPI/resig-SelectorsAPI-test-expected.txt:\n* LayoutTests/platform/glib/fast/dom/adopt-attribute-crash-expected.txt: Added.\n* LayoutTests/platform/glib/fast/dom/xml-parser-error-message-crash-expected.txt: Copied from LayoutTests/platform/glib/svg/custom/bug78807-expected.txt.\n* LayoutTests/platform/glib/fast/encoding/invalid-xml-expected.txt: Added.\n* LayoutTests/platform/glib/fast/frames/onlyCommentInIFrame-expected.txt:\n* LayoutTests/platform/glib/fast/invalid/junk-data-expected.txt:\n* LayoutTests/platform/glib/fast/lists/list-item-compute-marker-style-crash-expected.txt: Added.\n* LayoutTests/platform/glib/fast/xsl/xslt-bad-import-uri-expected.txt: Added.\n* LayoutTests/platform/glib/fast/xsl/xslt-mismatched-tags-in-xslt-expected.txt: Added.\n* LayoutTests/platform/glib/fast/xsl/xslt-transform-to-fragment-no-xml-parsing-crash-expected.txt:\n* LayoutTests/platform/glib/http/tests/misc/xslt-bad-import-expected.txt: Added.\n* LayoutTests/platform/glib/http/tests/security/contentSecurityPolicy/xsl-redirect-blocked-expected.txt: Added.\n* LayoutTests/platform/glib/http/tests/security/contentTypeOptions/nosniff-xml-external-entity-expected.txt: Added.\n* LayoutTests/platform/glib/http/tests/security/cross-origin-xsl-redirect-BLOCKED-expected.txt: Added.\n* LayoutTests/platform/glib/svg/W3C-SVG-1.1/paths-data-03-f-expected.txt:\n* LayoutTests/platform/glib/svg/carto.net/tabgroup-expected.txt:\n* LayoutTests/platform/glib/svg/custom/bug45331-expected.txt:\n* LayoutTests/platform/glib/svg/custom/bug78807-expected.txt:\n* LayoutTests/platform/glib/svg/custom/use-font-face-crash-expected.txt:\n* LayoutTests/platform/glib/svg/custom/use-invalid-html-expected.txt: Added.\n* LayoutTests/platform/glib/svg/custom/use-referencing-style-crash-expected.txt: Copied from LayoutTests/platform/glib/svg/custom/bug78807-expected.txt.\n* LayoutTests/platform/gtk/TestExpectations:\n* LayoutTests/platform/gtk/http/tests/security/xss-DENIED-xsl-external-entity-redirect-expected.txt:\n* LayoutTests/platform/wpe/TestExpectations:\n* LayoutTests/platform/wpe/fast/canvas/image-buffer-backend-variants-expected.txt: Added.\n* LayoutTests/svg/as-image/svg-as-image-pattern-scale.html:\n* Source/cmake/OptionsCommon.cmake: Touch file by fixing a typo, to\n  trigger cmake cache deletion.\n* Tools/Scripts/webkitpy/port/glib.py:\n(GLibPort.setup_environ_for_server):\n\nCanonical link: https://commits.webkit.org/315785@main",
      "email": "nzimmermann@igalia.com",
      "hash": "469f4dc9f24750098ae537607cb68bc58484b7a9",
      "subject": "[GTK][WPE] Bump wkdev-sdk to Ubuntu 26.04 based SDK"
    },
    "315786@main": {
      "author": "Karl Dubost",
      "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64",
      "cl": "315786@main",
      "clUrl": "https://commits.webkit.org/315786@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315192\nrdar://178044478\n\nReviewed by Taher Ali.\n\nWhen a \u003ctext rotate=\"…\"\u003e contained a \u003ctextPath\u003e, the per-character\nsupplemental rotation was silently discarded: the path-tangent angle\noverwrote the rotate-attribute value already accumulated in `angle`,\nso getRotationOfChar() reported only the path tangent and rendered\nglyphs missed their per-character offset.\n\nSVG 2 §11.2.1 (rotate attribute on \u003ctext\u003e/\u003ctspan\u003e) requires that \"this\nsupplemental rotation [...] is supplemental to any rotation due to text\non a path and to text-orientation, glyph-orientation-horizontal, or\nglyph-orientation-vertical\".\nhttps://w3c.github.io/svgwg/svg2-draft/text.html#TextElementRotateAttribute\n\nFlips 5 subtests of svg/text/scripted/getrotationofchar.html from FAIL\nto PASS:\n- \u003ctextPath\u003e - horizontal-tb     (r: 45 -\u003e 70)\n- \u003ctextPath\u003e - vertical-rl       (r: 45 -\u003e 70)\n- \u003ctextPath\u003e - vertical-lr       (r: 45 -\u003e 70)\n- \u003ctextPath\u003e - sideways-rl       (r: 45 -\u003e 70)\n- \u003ctextPath\u003e - sideways-lr       (r: 225 -\u003e 250)\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/scripted/getrotationofchar-expected.txt: Progression\n* Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp:\n(WebCore::SVGTextLayoutEngine::layoutTextOnLineOrPath):\n\nCanonical link: https://commits.webkit.org/315786@main",
      "email": "karlcow@apple.com",
      "hash": "00af18f3806bce0e60e24978fd354f1fe622d481",
      "subject": "SVG `\u003ctextPath\u003e` discards the per-character `rotate` attribute"
    },
    "315787@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "315787@main",
      "clUrl": "https://commits.webkit.org/315787@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317713\n\nReviewed by Darin Adler.\n\nRename SaturatedArithmetic.h to SaturatingArithmetic.h and rename its\nAPIs from \"saturated\" to \"saturating\" (saturatedSum -\u003e saturatingSum,\nsaturatedDifference -\u003e saturatingDifference) for clarity, updating all\ncall sites accordingly.\n\n\"Saturating\" describes the operation, whereas \"saturated\" describes a\nstate. These functions perform an operation that saturates on overflow;\nthey clamp only when needed and otherwise return the ordinary result.\nNaming them after the behavior (\"saturating\") is therefore more accurate\nthan naming them after the one possible end-state (\"saturated\").\n\nThis also matches established convention: the canonical term is\n\"saturation arithmetic\", and the operation is named with the\n\"saturating\" form elsewhere (e.g. C++26's std::saturating_add /\nstd::saturating_sub in \u003cnumeric\u003e, and Rust's saturating_add /\nsaturating_sub). Notably, C++26's own documentation names the function\nsaturating_add (the operation) while describing a clamped result as\n\"saturated\" (the state) -- the same distinction drawn above. The header\nwas already named SaturatingArithmetic.h, so this makes the file and its\ncontents consistent.\n\n* Source/JavaScriptCore/heap/Heap.cpp:\n* Source/JavaScriptCore/heap/SlotVisitorInlines.h:\nUpdate FIXME comments to refer to SaturatingArithmetic.\n\n* Source/WTF/WTF.xcodeproj/project.pbxproj:\n* Source/WTF/wtf/CMakeLists.txt:\n* Source/WTF/wtf/SaturatingArithmetic.h: Renamed from Source/WTF/wtf/SaturatedArithmetic.h.\n(WTF::signedAddInt32Overflows):\n(WTF::saturatingSum\u003cint32_t\u003e):\n(WTF::signedSubtractInt32Overflows):\n(WTF::saturatingDifference\u003cint32_t\u003e):\n(WTF::saturatingSum):\n* Source/WTF/wtf/text/StringBuilder.cpp:\n* Source/WTF/wtf/text/StringBuilder.h:\n* Source/WTF/wtf/text/StringBuilderJSON.cpp:\n* Source/WebCore/platform/LayoutUnit.h:\n* Source/WebCore/rendering/RenderCounter.cpp:\n* Source/WebCore/style/computed/StyleComputedStyleBase.cpp:\n* Source/WebKit/Shared/EditingRange.h:\nUpdate call sites to use the renamed APIs.\n\n* Tools/TestWebKitAPI/CMakeLists.txt:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WTF/SaturatingArithmeticOperations.cpp: Renamed from Tools/TestWebKitAPI/Tests/WTF/SaturatedArithmeticOperations.cpp.\n\nCanonical link: https://commits.webkit.org/315787@main",
      "email": "cdumez@apple.com",
      "hash": "c15b3a37656b7e6d2097c69ea07ce2a1c023db2f",
      "subject": "Rename SaturatedArithmetic.h and its APIs to \"Saturating\" for clarity"
    },
    "315788@main": {
      "author": "Karl Dubost",
      "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64",
      "cl": "315788@main",
      "clUrl": "https://commits.webkit.org/315788@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=277228\nrdar://132671670\n\nReviewed by Simon Fraser.\n\nThis adds a WPT test for the case where a filter set on an inline\nelement should apply to a block-level descendant, even when the inline\nancestor has no inline children of its own. The CSS `filter` property\nis non-inherited per css-filter-effects-1 — the descendants are not\n\"inheriting\" the filter; the filter applies to the element together\nwith its painting subtree, which includes the block descendant and its\nown inline grandchild.\n\nThe shape exercised is:\n    \u003ca filter\u003e → \u003cdiv\u003e → \u003cspan class=\"box\"\u003e\n\nWith the bug, the inline `\u003ca\u003e` had a zero bounding box (RenderInline\nwith no inline children), so the source image was never built and the\ndescendant never rendered through the filter. It is now fixed in\nWebKit, but no WPT test guarded the regression.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/filter-effects/filtered-inline-applies-to-block-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/filter-effects/filtered-inline-applies-to-block-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/filter-effects/filtered-inline-applies-to-block.html: Added.\n\nCanonical link: https://commits.webkit.org/315788@main",
      "email": "karlcow@apple.com",
      "hash": "23bb224c5de47acfb0ec4de735615ff1520606de",
      "subject": "filter on an inline element does not apply to a block-level descendant"
    },
    "315789@main": {
      "author": "Jer Noble",
      "avatar": "https://www.gravatar.com/avatar/6d2cde9be23b98223ca964cb3b7813a0?d=identicon\u0026s=64",
      "cl": "315789@main",
      "clUrl": "https://commits.webkit.org/315789@main",
      "description": "rdar://175298523\nhttps://bugs.webkit.org/show_bug.cgi?id=316460\n\nReviewed by Jean-Yves Avenard.\n\nAdd a Quirk to CNN.com which \"mirrors\" the captions provided in the DOM\ninto VTTCues and a synthetic text track.\n\n* Source/WebCore/DerivedSources-input.xcfilelist:\n* Source/WebCore/DerivedSources.make:\n* Source/WebCore/Modules/modern-media-controls/media/CNNCaptionQuirk.js: Added.\n(CaptionMirror):\n(CaptionMirror.prototype.invalidate):\n(CaptionMirror.prototype._findPlayerRoot):\n(CaptionMirror.prototype._syncCues):\n(CaptionMirror.prototype._attachOverlayObserver):\n(CaptionMirror.prototype._attachCaptionObserver):\n(CaptionMirror.prototype._handlePresentationModeChanged):\n(window.setupCaptionMirroring):\n* Source/WebCore/PlatformCocoa.cmake:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/dom/DocumentMediaElement.cpp:\n(WebCore::DocumentMediaElement::setupAndCallCNNQuirkJS):\n(WebCore::DocumentMediaElement::ensureCNNQuirkScript):\n* Source/WebCore/dom/DocumentMediaElement.h:\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::postConnectionSteps):\n* Source/WebCore/page/Quirks.cpp:\n* Source/WebCore/page/Quirks.h:\n* Source/WebCore/page/QuirksData.h:\n* Source/WebCore/rendering/RenderTheme.h:\n(WebCore::RenderTheme::cnnQuirkScript):\n* Source/WebCore/rendering/cocoa/RenderThemeCocoa.h:\n* Source/WebCore/rendering/cocoa/RenderThemeCocoa.mm:\n(WebCore::RenderThemeCocoa::cnnQuirkScript):\n\nCanonical link: https://commits.webkit.org/315789@main",
      "email": "jer.noble@apple.com",
      "hash": "e923dba3a033f32e09809aa64920df2f86bbdaf4",
      "subject": "[iOS] CNN.com subtitles don't work in native fullscreen"
    },
    "315790@main": {
      "author": "Mike Wyrzykowski",
      "avatar": "https://www.gravatar.com/avatar/4b1bc9e238714f95e22d5d2454c07066?d=identicon\u0026s=64",
      "cl": "315790@main",
      "clUrl": "https://commits.webkit.org/315790@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317660\nrdar://180421888\n\nReviewed by Ruthvik Konda.\n\nIt's possible for m_page to go out of scope, so we should use\nWeakPtr here instead of WeakRef.\n\n* Source/WebKit/WebProcess/Model/WebModelPlayer.h:\n\nCanonical link: https://commits.webkit.org/315790@main",
      "email": "mwyrzykowski@apple.com",
      "hash": "4ccdefa8a552daf20710644ee8e45c0359adbaeb",
      "subject": "Model element: WeakRef member variable is acting like a WeakPtr"
    },
    "315791@main": {
      "author": "Phipson Lee",
      "avatar": "https://www.gravatar.com/avatar/8cbd3a1a983b7611a7c0492d86c4c610?d=identicon\u0026s=64",
      "cl": "315791@main",
      "clUrl": "https://commits.webkit.org/315791@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316863\nrdar://176508364\n\nReviewed by Wenson Hsieh.\n\nCurrently on visionOS, drag and drop previews are not bounded by the window or scene that it's in.\nAs a result, it directly uses the center of the UITargetedPreview as its anchor, which can exist\noutside the bounds of the webpage if the preview overflows inside a scrollView. This change\nintends to clamp the center of the preview such that it is always anchored within the viewport.\n\nThe clamping logic is shared via a small inline helper, clampedDragPreviewCenterAxis, declared\nin DragDropInteractionState.h and used from both the drag-and-drop preview helper in\nDragDropInteractionState and the context-menu-hint preview helper in WKContentViewInteraction.\n\n* Source/WebKit/UIProcess/ios/DragDropInteractionState.h:\n* Source/WebKit/UIProcess/ios/DragDropInteractionState.mm:\n(WebKit::clampedDragPreviewCenterAxis):\n(WebKit::createTargetedDragPreview):\n(WebKit::DragDropInteractionState::deliverDelayedDropPreview):\n(WebKit::DragDropInteractionState::previewForLifting const):\n(WebKit::DragDropInteractionState::previewForCancelling):\n(WebKit::DragDropInteractionState::createDragPreviewInternal const):\nUpdate calls to pass a scrollView for visionOS to clamp the UITargetedPreview center point.\n\n* Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm:\n(-[WKContentView dragInteraction:previewForLiftingItem:session:]):\n(-[WKContentView dragInteraction:previewForCancellingItem:withDefault:]):\n(createTargetedPreview):\n(-[WKContentView _createTargetedPreviewFromTextIndicator:previewContainer:]):\n(-[WKContentView _createTargetedContextMenuHintPreviewIfPossible]):\nUpdate calls to pass a scrollView for visionOS to clamp the UITargetedPreview center point.\n\nCanonical link: https://commits.webkit.org/315791@main",
      "email": "phipson_lee@apple.com",
      "hash": "7f2f5f6ce7b6d51e28e206770772e99478884c8a",
      "subject": "Image preview during drag and drop sometimes appear outside of webpage bounds on visionOS"
    },
    "315792@main": {
      "author": "Charlie Wolfe",
      "avatar": "https://www.gravatar.com/avatar/857b3b5ff3394c31fa2689310a93dbab?d=identicon\u0026s=64",
      "cl": "315792@main",
      "clUrl": "https://commits.webkit.org/315792@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317444\nrdar://180069344\n\nReviewed by Sihui Liu.\n\nThe guard meant to reject an attribute value that is none of NSString, NSNumber or NSDate was\nwritten with ||. Since a value can be at most one of those classes, at least two of the negated\nchecks are always true, so the expression is always true. The body therefore fired on the very first\nattribute regardless of its type, terminating the loop and dropping every credential attribute from\nthe IPC encoding. Use \u0026\u0026 so the guard rejects only values that are none of the three classes.\n\nTest: Tools/TestWebKitAPI/Tests/IPC/IPCSerialization.mm\n* Source/WebKit/Shared/Cocoa/CoreIPCNSURLCredential.mm:\n(WebKit::CoreIPCNSURLCredential::CoreIPCNSURLCredential):\n* Tools/TestWebKitAPI/Tests/IPC/IPCSerialization.mm:\n(TEST(IPCSerialization, NSURLCredentialAttributes)):\n\nCanonical link: https://commits.webkit.org/315792@main",
      "email": "charliew@apple.com",
      "hash": "3ad9e87e41ee56322c335a1dfbd0ccf794e57f7f",
      "subject": "CoreIPCNSURLCredential attribute type guard is always true"
    },
    "315793@main": {
      "author": "Charlie Wolfe",
      "avatar": "https://www.gravatar.com/avatar/857b3b5ff3394c31fa2689310a93dbab?d=identicon\u0026s=64",
      "cl": "315793@main",
      "clUrl": "https://commits.webkit.org/315793@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317456\nrdar://180075625\n\nReviewed by Sihui Liu.\n\nThe reconstruction loop computed `value` via switchOn, then discarded it and inserted\n`attributes.get()` as the value for the key. This produced a self-referential dictionary mapping\nevery attribute key to the dictionary itself, so the real decoded attribute values were lost on the\nreceiving side. Insert value.get().\n\nTest: Tools/TestWebKitAPI/Tests/IPC/IPCSerialization.mm\n* Source/WebKit/Shared/Cocoa/CoreIPCNSURLCredential.mm:\n(WebKit::CoreIPCNSURLCredential::toID const):\n* Tools/TestWebKitAPI/Tests/IPC/IPCSerialization.mm:\n(TEST(IPCSerialization, NSURLCredentialAttributesToID)):\n\nCanonical link: https://commits.webkit.org/315793@main",
      "email": "charliew@apple.com",
      "hash": "48e92e82ebc073d528b212cef33c8504eb689cfc",
      "subject": "CoreIPCNSURLCredential::toID inserts the attributes dictionary as its own value"
    },
    "315794@main": {
      "author": "Lauro Moura",
      "avatar": "https://www.gravatar.com/avatar/6157f52d61e04c2c63fe7ff668ba69b3?d=identicon\u0026s=64",
      "cl": "315794@main",
      "clUrl": "https://commits.webkit.org/315794@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316719\n\nReviewed by Nikolas Zimmermann.\n\nSince 314640@main, WebPage installs a RemoteMediaSessionManager for\ntests with SiteIsolationEnabled. As Internals::resetToConsistentState\nunconditionally static_casts the manager to MediaSessionManagerGLib and\ncalls setters on it, it writes out of bounds on the actual underlying\nobject.\n\nFor example, this was leading to corruption of adjacent objects, like\nthe refcount of FontCascade-related classes or the vtable of objects\nused by FrameLoader::stopAllLoaders.\n\nThis commit guards the MediaSessionManagerGLib with a dynamicDowncast,\nso only objects of the proper type are written to, mirroring the pattern\nalready used in other classes in this file.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.cpp:\n(WebCore::MediaSessionManagerInterface::isMediaSessionManagerGLib const):\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.h:\n* Source/WebCore/platform/audio/glib/MediaSessionManagerGLib.h:\n(isType):\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::resetToConsistentState):\n\nCanonical link: https://commits.webkit.org/315794@main",
      "email": "lmoura@igalia.com",
      "hash": "ea237a349ded2681fcb6ced807a8fc484f71a876",
      "subject": "[GLib][Site Isolation] Internals::resetToConsistentState corrupts memory with unchecked static_cast to MediaSessionManagerGLib in site-isolation tests"
    },
    "315795@main": {
      "author": "Kiet Ho",
      "avatar": "https://www.gravatar.com/avatar/d9058b37006dce1f55f91b8ccc82f9a3?d=identicon\u0026s=64",
      "cl": "315795@main",
      "clUrl": "https://commits.webkit.org/315795@main",
      "description": "rdar://178750383\nhttps://bugs.webkit.org/show_bug.cgi?id=317193\n\nReviewed by Tim Nguyen.\n\nCSS identifiers can contain special characters by escaping them using '\\'.\nFor example, \"foo{bar}\" can be escaped to \"foo\\{bar\\}\" for use as a CSS\nidentifier. The tokenizer then unescapes \"foo\\{bar\\}\" in the CSS source code\ninto \"foo{bar}\". If this identifier is then serialized back into CSS\nusing .cssText, then the identifier should again be escaped.\n\nFrom code audit, the cssText implementation of some CSS at-rules don't\nproperly escape CSS identifiers. This patch fixes this by escaping\nidentifiers where needed. Additionally, this patch adds cssText tests\nfor every at-rule that accepts CSS identifiers.\n\nTests: imported/w3c/web-platform-tests/css/css-anchor-position/at-position-try-cssom.html\n       imported/w3c/web-platform-tests/css/css-conditional/container-queries/at-container-style-serialization.html\n       imported/w3c/web-platform-tests/css/css-counter-styles/counter-style-at-rule/fallback.html\n       imported/w3c/web-platform-tests/css/css-counter-styles/counter-style-at-rule/system-syntax.html\n       imported/w3c/web-platform-tests/css/css-fonts/parsing/font-palette-values-valid.html\n       imported/w3c/web-platform-tests/css/css-page/parsing/page-rules-001.html\n       imported/w3c/web-platform-tests/css/css-syntax/serialize-escape-identifiers.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/at-position-try-cssom-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/at-container-style-serialization-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/at-container-style-serialization.html:\n    - Import test cases from WPT\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-counter-styles/counter-style-at-rule/fallback-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-counter-styles/counter-style-at-rule/fallback.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-counter-styles/counter-style-at-rule/system-syntax-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-counter-styles/counter-style-at-rule/system-syntax.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-fonts/parsing/font-palette-values-valid-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-fonts/parsing/font-palette-values-valid.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-page/parsing/page-rules-001-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-page/parsing/page-rules-001.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-syntax/serialize-escape-identifiers-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-syntax/serialize-escape-identifiers.html:\n    - Import a test case (@media) from WPT\n    - Add test cases for @position-try, @counter-style and @page.\n\n* Source/WebCore/css/CSSCounterStyleDescriptors.cpp:\n(WebCore::CSSCounterStyleDescriptors::systemCSSText const):\n(WebCore::CSSCounterStyleDescriptors::fallbackCSSText const):\n* Source/WebCore/css/CSSCounterStyleRule.cpp:\n(WebCore::CSSCounterStyleRule::cssText const):\n* Source/WebCore/css/CSSFontPaletteValuesRule.cpp:\n(WebCore::CSSFontPaletteValuesRule::cssText const):\n* Source/WebCore/css/CSSKeyframesRule.cpp:\n(WebCore::CSSKeyframesRule::cssText const):\n* Source/WebCore/css/CSSPositionTryRule.cpp:\n(WebCore::CSSPositionTryRule::name const):\n* Source/WebCore/css/CSSPositionTryRule.h:\n* Source/WebCore/css/CSSPositionTryRule.idl:\n\nCanonical link: https://commits.webkit.org/315795@main",
      "email": "kiet.ho@apple.com",
      "hash": "cde6b7653a3727f86ebd093f379c565e28af4fd2",
      "subject": "Serializations of various CSS at-rules do not escape identifiers tokens"
    },
    "315796@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "315796@main",
      "clUrl": "https://commits.webkit.org/315796@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317776\nrdar://180545320\n\nReviewed by Pascoe and Megan Gardner.\n\n* Source/WebKit/Configurations/WebKit.xcconfig:\n\nCanonical link: https://commits.webkit.org/315796@main",
      "email": "richard_robinson2@apple.com",
      "hash": "e077bdf06a74c13ca983f317245dac5dedea7431",
      "subject": "[Swift in WebKit] Remove -no-verify-emitted-module-interface workaround that is no longer needed"
    },
    "315797@main": {
      "author": "Marta Darbinyan",
      "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64",
      "cl": "315797@main",
      "clUrl": "https://commits.webkit.org/315797@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317800\nrdar://180569290\n\nUnreviewed test gardening\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/315797@main",
      "email": "darbinyan@apple.com",
      "hash": "f4b78f4e7ae452e74b9e361406c87f6ccbdebe8f",
      "subject": "[Gardening]: REGRESSION(315609@main) [iOS] TestWebKitAPI.WKNavigation.PreferredHTTPSPolicyAutomaticHTTPFallbackAfterTerminateProcess"
    },
    "315798@main": {
      "author": "Sam Sneddon",
      "avatar": "https://www.gravatar.com/avatar/99f6b56d9db9d32920dfcc56deae86fc?d=identicon\u0026s=64",
      "cl": "315798@main",
      "clUrl": "https://commits.webkit.org/315798@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317693\nrdar://180451366\n\nReviewed by Tim Nguyen.\n\nThe few CSS value keywords that survive the\n\"prefixed-with-no-unprefixed-form\" filter never occur unprefixed in\nWPT sources and the value-rewriting never changes anything.\n\nThus, we simply remove the code to do this rewriting, on the\nassumption it'll never again be relevant, and we want to eliminate\nrewriting on import anyway.\n\n* Tools/Scripts/webkitpy/w3c/test_converter.py:\n(convert_for_webkit):\n(_W3CTestConverter.__init__):\n(_W3CTestConverter.output):\n(_W3CTestConverter.add_webkit_prefix_to_unprefixed_properties):\n(_W3CTestConverter.add_webkit_prefix_to_unprefixed_properties.replace):\n(_W3CTestConverter.convert_style_data):\n(_W3CTestConverter.legacy_read_webkit_prefixed_css_property_list): Deleted.\n(_W3CTestConverter.add_webkit_prefix_to_unprefixed_properties_and_values): Deleted.\n(_W3CTestConverter.add_webkit_prefix_following_regex): Deleted.\n* Tools/Scripts/webkitpy/w3c/test_converter_unittest.py:\n(W3CTestConverterTest.test_read_prefixed_property_list):\n(verify_no_conversion_happened):\n(verify_prefixed_properties):\n(verify_reference_relative_paths):\n(verify_prefixed_property_values): Deleted.\n(generate_test_content_properties_and_values): Deleted.\n* Tools/Scripts/webkitpy/w3c/test_importer.py:\n(TestImporter.import_tests):\n(TestImporter.write_import_log):\n* Tools/Scripts/webkitpy/w3c/test_importer_unittest.py:\n\nCanonical link: https://commits.webkit.org/315798@main",
      "email": "gsnedders@apple.com",
      "hash": "a833e5a15129d88cd09d13688eb6b2827cd59d8d",
      "subject": "Stop rewriting prefixed CSS values in import-w3c-tests"
    },
    "315799@main": {
      "author": "Fujii Hironori",
      "avatar": "https://www.gravatar.com/avatar/ef99cb23f5e5d27977968ca097d9a85f?d=identicon\u0026s=64",
      "cl": "315799@main",
      "clUrl": "https://commits.webkit.org/315799@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316973\n\nReviewed by Carlos Garcia Campos.\n\nPassive wheel event listers shouldn't block wheel event async scrolling. Turn\non ENABLE_WHEEL_EVENT_REGIONS macro for GTK and WPE ports.\n\nTests: tiled-drawing/scrolling/non-fast-region\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/glib/fast/events/wheel/wheel-event-on-svg-with-stroked-lines-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/events/wheel/wheel-event-on-svg-with-stroked-lines-with-layer-based-svg-engine-expected.txt: Removed.\n* LayoutTests/platform/glib/tiled-drawing/scrolling/non-fast-region/wheel-handler-in-columns-expected.txt: Added.\n* LayoutTests/platform/glib/tiled-drawing/scrolling/non-fast-region/wheel-handler-region-basic-expected.txt: Added.\n* LayoutTests/platform/wpe/TestExpectations:\n* Source/WTF/wtf/PlatformEnableGlib.h:\n* Source/WebCore/page/scrolling/coordinated/ScrollingTreeCoordinated.cpp:\n(WebCore::findEventListenerRegionTypes):\n(WebCore::ScrollingTreeCoordinated::eventListenerRegionTypesForPoint const):\n* Source/WebCore/page/scrolling/coordinated/ScrollingTreeCoordinated.h:\n\nCanonical link: https://commits.webkit.org/315799@main",
      "email": "fujii@igalia.com",
      "hash": "2e81a54d7f7c7c17ebe11f62e92995bd821f06c9",
      "subject": "[GTK][WPE] Enable WHEEL_EVENT_REGIONS"
    },
    "315800@main": {
      "author": "Ian Grunert",
      "avatar": "https://www.gravatar.com/avatar/6a676cf1bcb9ff83c6cd867a0e3a0fa4?d=identicon\u0026s=64",
      "cl": "315800@main",
      "clUrl": "https://commits.webkit.org/315800@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317791\n\nReviewed by Sosuke Suzuki and Yusuke Suzuki.\n\nUpdate my status from \"committer\" to \"reviewer\".\nRemoved an e-mail.\n\n* metadata/contributors.json:\n\nCanonical link: https://commits.webkit.org/315800@main",
      "email": "ian.grunert@gmail.com",
      "hash": "72741586752fef2ea4ff772f1f04277b38ebeebe",
      "subject": "Update status of Ian Grunert to 'reviewer' in contributors.json"
    },
    "315801@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "315801@main",
      "clUrl": "https://commits.webkit.org/315801@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317710\n\nReviewed by Yusuke Suzuki.\n\nSimilar to 315637@main. Parser::parseAssignmentExpression unconditionally creates\na save point, but it is consumed only when re-parsing as an arrow function\n(maybeValidArrowFunctionStart) or as a destructuring pattern (maybeAssignmentPattern).\nFor expressions starting with a numeric/string/template/regexp literal or a unary\noperator, both flags are false and the ~100 byte parser/lexer state copy is wasted.\nSince this function runs once per assignment expression (array elements, call\narguments, etc.), skip the copy when neither flag is set.\n\n* Source/JavaScriptCore/parser/Parser.cpp:\n(JSC::Parser\u003cLexerType\u003e::parseAssignmentExpression):\n\nCanonical link: https://commits.webkit.org/315801@main",
      "email": "sosuke@bun.sh",
      "hash": "1dff2312b262450f33a2a8b4f4a2f1008e60be63",
      "subject": "[JSC] Create a save point in `parseAssignmentExpression` only when it may be consumed"
    },
    "315802@main": {
      "author": "Andy Estes",
      "avatar": "https://www.gravatar.com/avatar/643f10f01b26fd94d03482a2013b2ea0?d=identicon\u0026s=64",
      "cl": "315802@main",
      "clUrl": "https://commits.webkit.org/315802@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317793\nrdar://180562637\n\nReviewed by Eric Carlson.\n\nMediaDeviceRoute.h defined a struct MediaSelectionOption, whose name shadows a different struct\ndefined in MediaSelectionOption.h. Instead of defining a new struct, we can just use the struct\nfrom MediaSelectionOption.h in MediaDeviceRoute.\n\nNo new tests. Covered by existing tests.\n\n* Source/WebCore/platform/audio/ios/MediaDeviceRoute.h:\n* Source/WebCore/platform/audio/ios/MediaDeviceRoute.mm:\n(WebCore::convert):\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.cpp:\n\nCanonical link: https://commits.webkit.org/315802@main",
      "email": "aestes@apple.com",
      "hash": "67e969df0ff86c5148fe3570ed17f8023c4ebf37",
      "subject": "[iOS] MediaSelectionOption in MediaDeviceRoute shadows an existing struct"
    },
    "315803@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "315803@main",
      "clUrl": "https://commits.webkit.org/315803@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317716\nrdar://180470182\n\nReviewed by Yijia Huang.\n\nWe are observing that this checks are too strong.\n\n1. If callLinkStatus.canOptimize() is false, let's not do anything.\n   Leave it unknown so that inlining etc. will just ignore that.\n   We should handle unused callsite as it deserves.\n2. From the inlining etc., if we already know that this callsite is\n   taking function expression from the same code, this is very likely a\n   closure call. Let's mark it as closure call and avoid using constant\n   call even if CallIC says so, because it is possible that we are\n   tiering up too early now.\n\n* JSTests/stress/arith-abs-to-arith-negate-range-optimizaton.js:\n* Source/JavaScriptCore/bytecode/CallLinkStatus.h:\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::ByteCodeParser::refineStatically):\n\nCanonical link: https://commits.webkit.org/315803@main",
      "email": "ysuzuki@apple.com",
      "hash": "07cae57442c99f84453f39bbca2fcbdc90849ea8",
      "subject": "[JSC] Weakening ByteCodeParser::refineStatically based on some additional information"
    },
    "315804@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "315804@main",
      "clUrl": "https://commits.webkit.org/315804@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317576\n\nReviewed by Darin Adler and Anne van Kesteren.\n\nUIEventWithKeyState tracks the AltGraph modifier: modifiersFromInitializer()\nreads EventModifierInit.modifierAltGraph and records Modifier::AltGraphKey in\nm_modifiers. However, getModifierState() had no branch for the \"AltGraph\" key\nidentifier, so it fell through to the default and returned false even when the\nevent was constructed with modifierAltGraph: true. This diverges from the UI\nEvents specification, which lists \"AltGraph\" as a valid modifier key value, and\nfrom Blink and Gecko, both of which report it.\n\nAdd an altGraphKey() accessor alongside capsLockKey() and handle \"AltGraph\" in\ngetModifierState(). This fixes the JS-constructed (initEvent) path.\n\nBeyond that, the AltGraph state was never propagated for trusted (native) events\non any platform. The PlatformEventModifier::AltGraphKey bit was set only from\ninitializers, and the WebKit-process WebEventModifier enum did not even have an\nAltGraphKey value, so the bit was dropped crossing the UI/Web process boundary.\nAs a result getModifierState(\"AltGraph\") would still return false for real\nkeystrokes even on keyboards that have an AltGr key.\n\nThe UI Events specification states that \"Some operating systems simulate the\nAltGraph modifier key with the combination of the Alt and Control modifier keys\"\nand that \"Implementations are encouraged to use the AltGraph modifier key\"\n(https://www.w3.org/TR/uievents/#keys-modifiers). It lists AltGraph as a\nfirst-class modifier key value and places no normative equivalence between\nAltGraph and Control+Alt. Blink and Gecko both follow this guidance, exposing\nAltGraph rather than Control + Alt for AltGr input. This change matches them; it\ndoes not implement the broader (and incorrect) notion that any Control+Alt is\nAltGraph (https://webkit.org/b/76988), which would break genuine Control+Alt\nshortcuts.\n\nPlumb AltGraph through the trusted-event path:\n- Add WebEventModifier::AltGraphKey and serialize it, and carry it through both\n  directions of WebEventConversion as well as modifiersFromPlatformEventModifiers.\n- Windows has no dedicated AltGr key and, on layouts that define AltGraph,\n  simulates it via the Control+Alt combination. WindowsKeyNames::\n  shouldExposeAltGraphForKeyEvent() reports AltGraph in place of Control + Alt in\n  the same three cases Blink does: a held right-Alt (VK_RMENU) on such a layout\n  (regardless of which key it modifies); a character message (WM_CHAR /\n  WM_SYSCHAR / WM_IME_CHAR) delivered while Control and Alt are down (the produced\n  character is itself the evidence of AltGr); and a key whose printable character\n  requires the Control+Alt combination on the active layout (an AltGraph-shifted\n  key). Mouse and wheel events carry no key code, so they use the right-Alt case\n  alone via shouldExposeLeftControlPlusRightAltAsAltGraph(). Both paths reuse the\n  existing m_hasAltGraph layout detection and m_printableKeyCodeToKey lookup.\n- GTK: map the X11 Mod5 state (GTK3) and the ISO_Level3/Level5 key values to\n  AltGraphKey. GTK4 no longer exposes the Mod5 mask through GdkModifierType, so\n  only the AltGraph key event itself is covered there.\n\nmacOS/iOS keyboards have no AltGr key, so the modifier is intentionally not\npopulated from native events on those platforms.\n\nThe accompanying web-platform-test exhaustively covers getModifierState() for\nevery modifier exposed through EventModifierInit (Control, Shift, Alt, Meta,\nAltGraph, CapsLock) on both KeyboardEvent and MouseEvent: each modifier set in\nisolation, all of them set together, and none set, asserting independence and\nthat the spec modifiers without an init member always read back as false.\n\nThe Windows AltGr handling cannot be exercised from a layout test (it depends on\nthe active OS keyboard layout), so it is covered by a TestWebKitAPI unit test\nthat mirrors Chromium's AltGraphEventTest: it activates the US English and\nFrench (France) layouts, synthesizes the relevant key state, and asserts that\nWindowsKeyNames reports AltGraph for the right-Alt, AltGraph-shifted, and\ncharacter-message cases while leaving plain Control+Alt and AltGraph-less layouts\nuntouched. It skips gracefully when a layout is not installed.\n\nTest: imported/w3c/web-platform-tests/uievents/constructors/event-getmodifierstate.html\n\n* LayoutTests/fast/events/constructors/keyboard-event-constructor-expected.txt:\n* LayoutTests/fast/events/constructors/keyboard-event-constructor.html:\n* LayoutTests/fast/events/constructors/keyboard-event-getModifierState-expected.txt:\n* LayoutTests/fast/events/constructors/keyboard-event-getModifierState.html:\n* LayoutTests/fast/events/constructors/mouse-event-getModifierState-expected.txt:\n* LayoutTests/fast/events/constructors/mouse-event-getModifierState.html:\n* LayoutTests/fast/events/init-event-clears-capslock-expected.txt:\n* LayoutTests/fast/events/init-event-clears-capslock.html:\n* LayoutTests/imported/w3c/web-platform-tests/uievents/constructors/event-getmodifierstate-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/uievents/constructors/event-getmodifierstate.html: Added.\n* Source/WebCore/dom/UIEventWithKeyState.cpp:\n(WebCore::UIEventWithKeyState::getModifierState const):\n* Source/WebCore/dom/UIEventWithKeyState.h:\n(WebCore::UIEventWithKeyState::altGraphKey const):\n* Source/WebCore/platform/PlatformEvent.h:\n* Source/WebCore/platform/win/WindowsKeyNames.cpp:\n(WebCore::WindowsKeyNames::currentKeyModifiers):\n(WebCore::WindowsKeyNames::printableKeyFromVirtualKey):\n(WebCore::WindowsKeyNames::domKeyFromParams):\n(WebCore::WindowsKeyNames::shouldExposeLeftControlPlusRightAltAsAltGraph):\n(WebCore::WindowsKeyNames::shouldExposeAltGraphForKeyEvent):\n* Source/WebCore/platform/win/WindowsKeyNames.h:\n* Source/WebKit/Shared/WebEvent.serialization.in:\n* Source/WebKit/Shared/WebEventConversion.cpp:\n(WebKit::platform):\n(WebKit::kit):\n* Source/WebKit/Shared/WebEventModifier.cpp:\n(WebKit::modifiersFromPlatformEventModifiers):\n* Source/WebKit/Shared/WebEventModifier.h:\n* Source/WebKit/Shared/gtk/WebEventFactory.cpp:\n(WebKit::modifiersForEvent):\n* Source/WebKit/Shared/win/WebEventFactory.cpp:\n(WebKit::modifiersForEvent):\n(WebKit::modifiersForCurrentKeyState):\n(WebKit::WebEventFactory::createWebKeyboardEvent):\n* Tools/TestWebKitAPI/PlatformWin.cmake:\n* Tools/TestWebKitAPI/Tests/WebCore/win/WindowsKeyNames.cpp: Added.\n\nCanonical link: https://commits.webkit.org/315804@main",
      "email": "cdumez@apple.com",
      "hash": "57433782cf018a78f66796bc6412e159a21ac082",
      "subject": "KeyboardEvent/MouseEvent getModifierState(\"AltGraph\") always returns false"
    },
    "315805@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "315805@main",
      "clUrl": "https://commits.webkit.org/315805@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317537\n\nReviewed by Yusuke Suzuki.\n\nDFG and FTL already inline the NumericStrings small-int cache lookup\n(values 0..1023) for ToString(Int32) with radix 10, but values outside\nthat range always take a vmCall to operationInt32ToStringWithValidRadix\neven when the int cache would hit. The hash used by the int cache is\nWTF::IntHash\u003cint\u003e, which is the rapidhash mum mixer that DFG/FTL already\nemit inline for Map/Set hashing via rapidHashMix64.\n\nEmit the same hash inline, index into m_intCache, and return the cached\nJSString directly when the slot's key matches and its jsString is\nnon-null. Only the miss path (collision or empty slot) calls into the\nruntime.\n\nThe radix-10 Int32 case is split out into compileInt32ToStringRadix10 so\nthat the 64-bit and 32-bit DFG backends can diverge cleanly: the 64-bit\nbackend adds the int-cache lookup (rapidHashMix64 needs 128-bit multiply)\nwhile the 32-bit backend keeps the existing small-int-only path.\n\n                                        baseline                  patched\n\nint32-to-string-int-cache-hit       27.1492+-0.3189     ^     11.4171+-0.1587        ^ definitely 2.3779x faster\n\n* JSTests/microbenchmarks/int32-to-string-int-cache-hit.js: Added.\n* JSTests/stress/to-string-int32-int-cache.js: Added.\n* Source/JavaScriptCore/b3/B3AbstractHeapRepository.h:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n* Source/JavaScriptCore/runtime/NumericStrings.h:\n\nCanonical link: https://commits.webkit.org/315805@main",
      "email": "sosuke@bun.sh",
      "hash": "186e2a91934e2dd2fe1f4e21b46c2135cca0fcbe",
      "subject": "[JSC] Inline `NumericStrings` int cache lookup in DFG and FTL `ToString(Int32)`"
    },
    "315806@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "315806@main",
      "clUrl": "https://commits.webkit.org/315806@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317823\n\nReviewed by Yusuke Suzuki.\n\nJSArray::fastFlat checks holesMustForwardToPrototype() only on the\nreceiver. When calculateFlattenedLength / fastFlatIntoBuffer recurse\ninto a nested child array, the check is not repeated, so a child whose\nprototype provides indexed properties (e.g. via Object.setPrototypeOf)\nhas its holes silently skipped instead of forwarding to the prototype\nchain as FlattenIntoArray requires.\n\n    let child = [, 1, 2];\n    Object.setPrototypeOf(child, { 0: 99 });\n    [child].flat();  // was [1, 2], should be [99, 1, 2]\n\nBail out to the slow path when a nested array's\nholesMustForwardToPrototype() is true.\n\nTest: JSTests/stress/array-prototype-flat-nested-holes-prototype.js\n\n* JSTests/stress/array-prototype-flat-nested-holes-prototype.js: Added.\n(shouldBe):\n(shouldBeArray):\n* Source/JavaScriptCore/runtime/JSArray.cpp:\n(JSC::calculateFlattenedLength):\n(JSC::fastFlatIntoBuffer):\n\nCanonical link: https://commits.webkit.org/315806@main",
      "email": "sosuke@bun.sh",
      "hash": "c05343136dd6915718266d138dcdb303e7bff5f0",
      "subject": "[JSC] `Array#flat` fast path drops prototype-backed holes in nested arrays"
    },
    "315807@main": {
      "author": "Karl Dubost",
      "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64",
      "cl": "315807@main",
      "clUrl": "https://commits.webkit.org/315807@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317725\nrdar://180490343\n\nReviewed by Simon Fraser.\n\nAn SVG with width=\"99.99999\" laid out one device pixel narrower than\nwidth=\"100\". Fractional intrinsic dimensions were truncated, not rounded,\nwhen stored as LayoutUnit.\n\nIn RenderReplaced::computeIntrinsicSizesConstrainedByTransferredMinMaxSizes,\nthe FloatSize\u0026 OUT-parameter is round-tripped through LayoutUnit before the\ncaller reads it. The brace-init LayoutUnit{float} truncates toward zero.\nFor 99.99999, that gave 99.984375. After paint-time snapping, that lost a\ndevice pixel.\n\nSwitch the conversion to LayoutUnit::fromFloatRound.\n\n* LayoutTests/TestExpectations:\n* Source/WebCore/rendering/RenderReplaced.cpp:\n(WebCore::RenderReplaced::computeIntrinsicSizesConstrainedByTransferredMinMaxSizes const):\nRound float intrinsic dimensions to nearest LayoutUnit instead of truncating.\n\nCanonical link: https://commits.webkit.org/315807@main",
      "email": "karlcow@apple.com",
      "hash": "95fb2ea4c7b35e3b2acffc1d2792458c2c5ecf2c",
      "subject": "SVG \u003cimg\u003e with near-integral intrinsic width renders one device pixel narrow"
    },
    "315808@main": {
      "author": "Adrian Taylor",
      "avatar": "https://www.gravatar.com/avatar/d2acb8ad2e2670ff74ae0d65fb27014c?d=identicon\u0026s=64",
      "cl": "315808@main",
      "clUrl": "https://commits.webkit.org/315808@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317688\nrdar://180449579\n\nReviewed by Mike Wyrzykowski.\n\nThis aims to enable Explicit Module Builds in Swift. This should allow multiple\nswift-frontend commands to avoid duplicating effort when importing C/C++\nmodules.\n\nCanonical link: https://commits.webkit.org/315808@main",
      "email": "adrian_taylor@apple.com",
      "hash": "429cef317f138696a883109d283d5dff09969ba6",
      "subject": "Enable explicit module builds on cmake"
    },
    "315809@main": {
      "author": "Nikolas Zimmermann",
      "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64",
      "cl": "315809@main",
      "clUrl": "https://commits.webkit.org/315809@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317782\n\nReviewed by Adrian Perez de Castro.\n\nA new wkdev-sdk image can ship a different toolchain and dependencies,\nwhich can influence the generated CMake cache. Invalidate the cache in\nshouldRemoveCMakeCache() when .wkdev-sdk-version is newer than\nCMakeCache.txt, mirroring the existing mtime-based check for *.cmake\nfiles under Source/cmake.\n\n* Tools/Scripts/webkitdirs.pm:\n(shouldRemoveCMakeCache):\n\nCanonical link: https://commits.webkit.org/315809@main",
      "email": "nzimmermann@igalia.com",
      "hash": "b74c6193c14d1e9b6c773a524e8a49c0667d9571",
      "subject": "[GTK][WPE] Regenerate CMake cache when .wkdev-sdk-version changes"
    },
    "315810@main": {
      "author": "Nikolas Zimmermann",
      "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64",
      "cl": "315810@main",
      "clUrl": "https://commits.webkit.org/315810@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317833\n\nReviewed by Alicia Boya Garcia.\n\nThe Ubuntu 26.04 wkdev-sdk bump (v7 -\u003e v8) upgraded CMake from 3.28.3 to\n4.2.3. Since CMake 3.29 the Ninja Swift_SHARED_LIBRARY_LINKER rule expands an\nOBJECT library's .o files onto the link line when the library is linked by\ntarget name -- 3.28.3 did NOT do that...\n\nPlatformWPE.cmake worked around the old behaviour by also passing the\nWPEPlatform objects explicitly via $\u003cTARGET_OBJECTS:...\u003e whenever SWIFT_REQUIRED\nwas activated. From CMake 3.29 on that lists every object a second time, so\nlinking libWPEWebKit-2.0.so failed with hundreds of multiple-definition\nerrors from the linker.\n\nThe object libraries still have to be linked by name to propagate their link\ninterface, so the explicit-objects workaround cannot simply be dropped: it is\nrequired on CMake \u003c 3.29 and harmful on CMake \u003e= 3.29.\n\n-\u003e Add a fix that works for both CMake \u003c 3.29 and \u003e= 3.29.\n\n* Source/WebKit/PlatformWPE.cmake:\n\nCanonical link: https://commits.webkit.org/315810@main",
      "email": "nzimmermann@igalia.com",
      "hash": "38985585468bf2f8114d6a3ccc067befb12ae83a",
      "subject": "[WPE] REGRESSION(315785@main): Swift-enabled build fails to link libWPEWebKit with multiple-definition errors"
    },
    "315811@main": {
      "author": "Jean-Yves Avenard",
      "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64",
      "cl": "315811@main",
      "clUrl": "https://commits.webkit.org/315811@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317825\nrdar://180007922\n\nReviewed by Youenn Fablet.\n\nThere's no VP9 decoder present in the iOS simulator ; force the use of the\nwebcodec one (pure software).\n\n* LayoutTests/media/video-webm-seek-multi-audio-tracks.html:\n\nCanonical link: https://commits.webkit.org/315811@main",
      "email": "jya@apple.com",
      "hash": "bdc22be302298e5e99d77fc5f318c0a5e9390f8b",
      "subject": "[ iOS Debug ] media/video-webm-seek-multi-audio-tracks.html is a constant timeout"
    },
    "315812@main": {
      "author": "Claudio Saavedra",
      "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64",
      "cl": "315812@main",
      "clUrl": "https://commits.webkit.org/315812@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317826\n\nUnreviewed build fixes.\n\n* Source/WebCore/Modules/webxr/XRCubeLayer.cpp:\n* Source/WebCore/css/CSSPageRule.cpp:\n* Source/WebCore/dom/WindowEventLoop.cpp:\n* Source/WebCore/inspector/agents/frame/FrameCSSAgent.cpp:\n* Source/WebCore/page/text-extraction/TextExtractionScriptFiltering.cpp:\n* Source/WebKit/WebProcess/WebPage/WebHistoryItemClient.cpp:\n\nCanonical link: https://commits.webkit.org/315812@main",
      "email": "csaavedra@igalia.com",
      "hash": "dd078b0a0839c6aa0f808d243a6bb0831e3228d8",
      "subject": "Non-unified build fixes for June 25th, 2026"
    },
    "315813@main": {
      "author": "Karl Dubost",
      "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64",
      "cl": "315813@main",
      "clUrl": "https://commits.webkit.org/315813@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316902\nrdar://179376053\n\nReviewed by Elika Etemad.\n\nThis fix an issue introduced in\nhttps://webkit.org/b/286753\nhttps://github.com/WebKit/WebKit/pull/57545\n\nA flex column with overflow:auto and top/bottom padding stopped including\nthat padding in scrollHeight when its items overflow the content edge.\n\n307212@main introduced scrollableContentAreaOverflowRect() returning the\npadding box instead of the content box when no overflow is recorded yet.\n\nReturn flippedContentBoxRect() instead, matching the pre-307212\nbehavior and the helper's name.\n\nIt also adds a WPT test to catch it next time.\n\nTest: imported/w3c/web-platform-tests/css/cssom-view/scrollWidthHeight-flex-column-padding-001.html\n      imported/w3c/web-platform-tests/css/cssom-view/scrollWidthHeight-child-border-within-padding.tentative.html\n\n* LayoutTests/compositing/shared-backing/overflow-scroll/relative-in-clipping-in-scroller-in-relative-clipping-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/overflow-padding-expected.txt:\n  fix this test\n* LayoutTests/imported/w3c/web-platform-tests/css/cssom-view/scrollWidthHeight-child-border-within-padding.tentative.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/cssom-view/scrollWidthHeight-child-border-within-padding.tentative-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/cssom-view/scrollWidthHeight-flex-column-padding-001-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/cssom-view/scrollWidthHeight-flex-column-padding-001.html: Added.\n* Source/WebCore/rendering/RenderBoxInlines.h:\n(WebCore::RenderBox::scrollableContentAreaOverflowRect const):\n\nCanonical link: https://commits.webkit.org/315813@main",
      "email": "karlcow@apple.com",
      "hash": "5a62fb16bf60aa6bc6943270c7d3c4ebbf58f5c5",
      "subject": "REGRESSION (307212@main Safari 26.x): flex column padding excluded from scrollHeight"
    },
    "315814@main": {
      "author": "Alejandro G. Castro",
      "avatar": "https://www.gravatar.com/avatar/c8c6e17acbdf0549b05d6f7fc2c1c4dc?d=identicon\u0026s=64",
      "cl": "315814@main",
      "clUrl": "https://commits.webkit.org/315814@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317834\n\nReviewed by Nikolas Zimmermann.\n\nUIGamepadProvider.cpp checks with !USE(WPE_PLATFORM) but only ENABLE(WPE_PLATFORM)\nis defined.\n\n* Source/WebKit/UIProcess/Gamepad/UIGamepadProvider.cpp:\n\nCanonical link: https://commits.webkit.org/315814@main",
      "email": "alex@igalia.com",
      "hash": "0cab62d0282e8ad1456594d923383f2804f9646f",
      "subject": "[WPE] platformSetDefaultGamepadProvider is defined twice in WPEPlatform-only builds"
    },
    "315815@main": {
      "author": "Enrique Ocaña González",
      "avatar": "https://www.gravatar.com/avatar/7c82fa40774dd34b018c3361f990a045?d=identicon\u0026s=64",
      "cl": "315815@main",
      "clUrl": "https://commits.webkit.org/315815@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317111\n\nReviewed by Xabier Rodriguez-Calvar.\n\nLibWebRTC has a dedicated Decoder component that is supposed to decode video\nframes and supply them like that to its observers. Under those assumptions,\nmissing some of those decoded frames (eg: because no observer is listening yet)\nisn't very problematic in this expected case.\n\nHowever, in order to facilitate hardware decoding, the libWebRTC Decoder\nimplementation provided by the GStreamer port emits encoded frames (that is,\ndoesn't decode at all) unders some circumstances, with the hope that those\nencoded frames end up reaching the playback pipeline and being decoded there.\n\nIn such a case, missing video frames because no observer has been registered\n(a circumstance that has been reported by at least one downstream setup but\nthat can't be reproduced reliably) can be problematic. Missing the first\n\"frames\" (buffers) of an encoded video means that the video headers (eg:\nSPS/PPS for H.264) are missed that's a condition the actual video decoder\ncan't recover from.\n\nThis patch provides a mechanism to keep undelivered buffers when they come\nin an encoded format and there's no registered observer to deliver them to,\nand redeliver them when the first observer is registered. This solves the\nproblem detected in the mentioned downstream setup.\n\nIf a format change is detected or if RealtimeMediaSource is stopping, the\nlist of pending frames is emtied, since there's no point anymore on\ndelivering them.\n\nCo-authored by: Ganesh prasad Sahu \u003cGaneshPrasad_Sahu@comcast.com\u003e\n\n* Source/WebCore/platform/VideoFrame.h:\n(WebCore::VideoFrame::isEncoded const): Added generic implementation to know if a VideoFrame has an encoded format or not. Defaults to false.\n(WebCore::VideoFrame::hasSameEncodedFormat const): Compares if format of one sample is the same as the one from another. Defaults to false.\n* Source/WebCore/platform/graphics/gstreamer/VideoFrameGStreamer.cpp:\n(WebCore::VideoFrameGStreamer::VideoFrameGStreamer): Added assertion to ensure m_sample is not null.\n(WebCore::VideoFrameGStreamer::isEncoded const): Specific implementation, only true when the caps are other than video/x-raw.\n(WebCore::VideoFrameGStreamer::hasSameEncodedFormat const): Format comparison is implemented by comparing caps.\n* Source/WebCore/platform/graphics/gstreamer/VideoFrameGStreamer.h: Added isEncoded() declaration.\n* Source/WebCore/platform/mediastream/RealtimeMediaSource.cpp:\n(WebCore::RealtimeMediaSource::videoFrameAvailable): Added code to hoard decoded frames when there's no observer, and redeliver then later. The frame delivery code is reused from the regular case, so it has been factored into a lambda. If a format change is detected, the pending frames are emptied, because there's no point on redelivering them (only the ones with the new format are relevant).\n(WebCore::RealtimeMediaSource::stop): Empty the pending frames, since there's no point in delivering them when we're stopping the whole RealtimeMediaSource.\n* Source/WebCore/platform/mediastream/RealtimeMediaSource.h: Added PendingVideoFrame struct to hold the pending frames and metadata, a Vector of pending frames, and the constant that defines the maximum number of frames that can be kept waiting redelivery.\n\nCanonical link: https://commits.webkit.org/315815@main",
      "email": "eocanha@igalia.com",
      "hash": "48ba671f2f85b586706f412bfb2d2479e5575b32",
      "subject": "[libWebRTC][GStreamer] Missing video in WebRTC playback when decoding on playback pipeline"
    },
    "315816@main": {
      "author": "Fady Farag",
      "avatar": "https://www.gravatar.com/avatar/0ac5127c69f90d0c57054173ae4c3108?d=identicon\u0026s=64",
      "cl": "315816@main",
      "clUrl": "https://commits.webkit.org/315816@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317718\nrdar://180472627\n\nReviewed by Chris Dumez.\n\nInitially, EditingRange::clampedFirstLineRange failed to link out-of-line when\nused from the IPC API tests even when using WK_EXPORT. The reason is that TestIPC\nlinks against libWebKitPlatform.a, not WebKit.framework. So, a symbol in the\nframework dylib is unreachable from the test regardless of export macros. This\ndefines the symbol out-of-line in a new translation unit such that it builds into\nlibWebKitPlatform.a so the symbol resolves directly.\n\n* Source/WebKit/Platform/EditingRangeClamping.cpp: Added.\n(WebKit::EditingRange::clampedFirstLineRange):\n* Source/WebKit/Platform/Sources.txt:\n* Source/WebKit/Shared/EditingRange.h:\n(WebKit::EditingRange::clampedFirstLineRange): Deleted.\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/315816@main",
      "email": "com.webkit.iidmsa@gmail.com",
      "hash": "d0b94cb5b4a4b6e623bd13d71d666de126d9897f",
      "subject": "Make `EditingRange::clampedFirstLineRange` defined out-of-line and move into a `.cpp` file"
    },
    "315817@main": {
      "author": "Sihui Liu",
      "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64",
      "cl": "315817@main",
      "clUrl": "https://commits.webkit.org/315817@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317676\nrdar://180432846\n\nReviewed by Basuke Suzuki.\n\nFix two issues exposed or caused by 315516@main, which led Site Isolation tests to fail on macOS Golden Gate:\n\n1. Iterating WTF::Vectors of Ref\u003cT\u003e-bearing elements from Swift via CxxVectorIterator hits rdar://173815363: Swift\nmishandles destruction of Ref\u003cT\u003e elements during iteration, producing assertions like \"ASSERTION FAILED: m_ptr\" in\nRef\u003cFrameState\u003e::get(). Two such loops in WebBackForwardList.swift were affected:\n- setBackForwardItemIdentifier(frameState:itemID:) iterating frameState.children (a Vector\u003cRef\u003cFrameState\u003e\u003e)\n- restoreFromState(backForwardListState:) iterating backForwardListState.items (a Vector\u003cBackForwardListItemState\u003e,\nwhose elements transitively hold a Ref\u003cFrameState\u003e)\nTo fix it, move both iterations into C++ helpers, mirroring the existing workaround pattern set by 310371@main for\nsetBackForwardItemIdentifiers.\n\n2. After session restore with andNavigate:YES, restoreFromSessionState calls goToBackForwardItem(currentItem). Under\nuseUIProcessForBackForwardItemLoading, the per-frame walk introduced by 315516@main compares currentItem.mainFrameItem()\nto item.mainFrameItem() — the same object — finds no per-frame itemSequenceNumber / documentSequenceNumber diff,\ndispatches no GoToBackForwardItem message, and only logs an error. The WebProcess never loads anything and the session\nrestore tests time out.\nTo fix it, Add an IsSessionRestoreNavigation parameter to goToBackForwardItem and pass Yes from restoreFromSessionState.\nWhen the walk dispatches no message, force a single GoToBackForwardItem on the target's main frame if there is no\ncurrent item OR the call is from session restore. Otherwise (e.g. a redundant go(to: currentlyLoadedItem) call, or\nBack-forward list corruption that produced identical sequence numbers across distinct items) the walk's verdict is\ntrustworthy: log the existing error and drop. The fallback uses sendGoToBackForwardItemForFrame to stay within the\nper-frame dispatch model and re-resolve the destination process for the target frame.\n\nThere is a drive-by fix to keep frameStateRef bound across completeFrameStateForNavigation so ARC keeps the underlying\nFrameState alive across the subsequent calls; relying on the temporary Ref's lifetime would require Swift to auto-retain\nthe Foreign Reference Type returned from .ptr(), which isn't guaranteed.\n\n* Source/WebKit/UIProcess/WebBackForwardList.cpp:\n(setFrameStateBackForwardItemIdentifier):\n(createItemsFromState):\n(itemAtIndexInBackForwardListItemVector):\n* Source/WebKit/UIProcess/WebBackForwardList.swift:\n(MakeAPIArray.restoreFromState(_:)):\n(MakeAPIArray.setBackForwardItemIdentifier(_:itemID:)):\n(MakeAPIArray.completeFrameStateForNavigation(_:)):\n* Source/WebKit/UIProcess/WebBackForwardListSwiftUtilities.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::goToBackForwardItem):\n(WebKit::WebPageProxy::restoreFromSessionState):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/315817@main",
      "email": "sihui_liu@apple.com",
      "hash": "5b2c8a7befcd089b1ab0393948036625913aebb4",
      "subject": "REGRESSION(315516@main): [iOS] TestWebKitAPI.SiteIsolation tests are flaky timeout"
    },
    "315818@main": {
      "author": "Diego Pino Garcia",
      "avatar": "https://www.gravatar.com/avatar/e8cce88637f1a6e79155e8371e24b2e8?d=identicon\u0026s=64",
      "cl": "315818@main",
      "clUrl": "https://commits.webkit.org/315818@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317734\n\nReviewed by Claudio Saavedra and Carlos Alberto Lopez Perez.\n\nThese two bots are no longer needed since:\n  - ARM32 architecture is no longer supported in WPE\n  - ARM64 architecture is covered in WPE via 'WPE-Linux-ARM64-bit-Release-Build' bot.\n\n* Tools/CISupport/build-webkit-org/config.json:\n* Tools/CISupport/build-webkit-org/factories_unittest.py:\n(TestExpectedBuildSteps):\n\nCanonical link: https://commits.webkit.org/315818@main",
      "email": "dpino@igalia.com",
      "hash": "63e8f8b1fce35057a9a9a8559d5c169d33382520",
      "subject": "[build.webkit.org] Remove WPE ARM32 and ARM64 build post-commit bots"
    },
    "315819@main": {
      "author": "Per Arne Vollan",
      "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64",
      "cl": "315819@main",
      "clUrl": "https://commits.webkit.org/315819@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317795\nrdar://180342936\n\nReviewed by Sihui Liu.\n\nFailing to set user dir suffix is not a fatal condition.\n\n* Source/WebKit/Shared/mac/AuxiliaryProcessMac.mm:\n(WebKit::populateSandboxInitializationParameters):\n\nCanonical link: https://commits.webkit.org/315819@main",
      "email": "pvollan@apple.com",
      "hash": "c06326d5937a47d0a25ae7bf542a60956e0f5c12",
      "subject": "Setting user dir suffix should not be fatal"
    },
    "315820@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "315820@main",
      "clUrl": "https://commits.webkit.org/315820@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317832\n\nReviewed by Darin Adler.\n\nViewTransition::m_initialPageZoom had no inline initializer and was not\ninitialized in the class constructor. It is initialized in some places\nbut only when certain conditions are true, this is fragile. Let's\ninitialize this data member unconditionally to be safe.\n\n* Source/WebCore/dom/ViewTransition.h:\n\nCanonical link: https://commits.webkit.org/315820@main",
      "email": "cdumez@apple.com",
      "hash": "9a4725274a21f7abe3377121e66adde1f8017203",
      "subject": "ViewTransition::m_initialPageZoom may be used uninitialized"
    },
    "315821@main": {
      "author": "Eric Carlson",
      "avatar": "https://www.gravatar.com/avatar/e227ff07cc6d645fc1c69fd56c2c8cb8?d=identicon\u0026s=64",
      "cl": "315821@main",
      "clUrl": "https://commits.webkit.org/315821@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317671\nrdar://180429147\n\nReviewed by Youenn Fablet.\n\nWhen a WKWebView is created (e.g. for a new tab or background page), _setupScrollAndContentViews\ncalls _dispatchSetOrientationForMediaCapture before the view has been placed in a window. At\nthat point windowScene is nil, so _deviceOrientationIgnoringOverrides returns\nUIInterfaceOrientationUnknown (mapped to 0°). GPUProcess::setOrientationForMediaCapture\nbroadcasts this value to every connection, overwriting the correct landscape orientation of\nany camera source running on a different page. The camera then produces permanently rotated\nframes until the user physically rotates the device.\n\nGuard _dispatchSetOrientationForMediaCapture against dispatching orientation=0 when windowScene\nis nil: in that state 0 means Unknown rather than Portrait, so there is nothing useful to send.\ndidMoveToWindow fires with a valid scene once the view is placed in a window, at which point the\ncorrect orientation is dispatched.\n\nAlso fix a secondary issue in LocalSampleBufferDisplayLayer: when enqueueVideoFrame detects a\nrotation change it calls updateSampleLayerBoundsAndPosition without explicit bounds. Previously\nthis swapped the stale root-layer bounds on the sample buffer display layer immediately, producing\na transient wrong-sized frame. Now only the affine transform is applied in the no-bounds path;\nthe caller provides correct bounds via updateBoundsAndPosition once the rotation change has\npropagated through the media pipeline.\n\n* Source/WebKit/UIProcess/API/ios/WKWebViewIOS.mm:\n(-[WKWebView _dispatchSetOrientationForMediaCapture:]): Skip dispatch when orientation is 0\nand windowScene is nil.\n* Source/WebCore/platform/graphics/avfoundation/objc/LocalSampleBufferDisplayLayer.h:\n(LocalSampleBufferDisplayLayer::setVideoFrameRotationForTesting):\n* Source/WebCore/platform/graphics/avfoundation/objc/LocalSampleBufferDisplayLayer.mm:\n(LocalSampleBufferDisplayLayer::sampleLayerBoundsForTesting):\n(LocalSampleBufferDisplayLayer::updateSampleLayerBoundsAndPosition): Apply transform but\nskip bounds update when called without explicit bounds.\n(LocalSampleBufferDisplayLayer::enqueueVideoFrame): Restore call to\nupdateSampleLayerBoundsAndPosition when rotation changes so the transform is applied promptly.\n* Source/WebCore/platform/mediastream/cocoa/AVVideoCaptureSource.mm:\n(AVVideoCaptureSource::orientationChanged): Log incoming orientation before computing rotation.\n(AVVideoCaptureSource::rotationAngleForHorizonLevelDisplayChanged): Fix log to record the\nprevious rotation before the update.\n(AVVideoCaptureSource::computeVideoFrameRotation): Log the rotation transition.\n* Source/WebCore/platform/mediastream/RealtimeMediaSourceSettings.cpp:\n(WebCore::RealtimeMediaSourceSettings::convertFlagsToString): Fix empty-prefix check.\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/LocalSampleBufferDisplayLayerTests.mm: Added.\n(TestWebKitAPI::TEST(LocalSampleBufferDisplayLayer, RotationChangeShouldNotSwapStaleBounds)):\n\nCanonical link: https://commits.webkit.org/315821@main",
      "email": "eric.carlson@apple.com",
      "hash": "d8266c6d0ba999557510ce09aa76750affcfc4cd",
      "subject": "[Cocoa] Transient device rotation can result in incorrect video frame orientation"
    },
    "315822@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "315822@main",
      "clUrl": "https://commits.webkit.org/315822@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=285420\nrdar://142807293\n\nReviewed by Taher Ali.\n\nThis bug is progressed by 315468@main, so this is just to add additional\ntest case so we have regression coverage for this case as well.\n\n* LayoutTests/svg/repaint/svg-outline-repaint-on-hover.html: Added.\n* LayoutTests/svg/repaint/svg-outline-repaint-on-hover-expected.txt: Added.\n\n\u003e Platform Specific Expectation due to no hover on iOS:\n* LayoutTests/platform/ios/svg/repaint/svg-outline-repaint-on-hover-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/315822@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "4ad0a5f848b133318fc64266e559bd641b6d98cb",
      "subject": "[Test Coverage] CSS outline on an inline \u003csvg\u003e is not repainted when toggled on :hover (appears stale / missing)"
    },
    "315823@main": {
      "author": "Nikolas Zimmermann",
      "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64",
      "cl": "315823@main",
      "clUrl": "https://commits.webkit.org/315823@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317843\n\nReviewed by Adrian Taylor.\n\nWhen staging public headers we only ever copy or symlink files, never\nremove them. So renaming or deleting a header left the old copy behind in\nthe framework Headers dir. With Clang modules that leftover file gets\npicked up alongside the new one, causing duplicate definitions and build\nfailures - for example the SaturatedArithmetic.h -\u003e SaturatingArithmetic.h\nrename broke the wtf module.\n\nMove the cleanup that WEBKIT_SYMLINK_FILES already did into a shared\nWEBKIT_PRUNE_STALE_DESTINATION helper, and add a PRUNE_STALE option to both\nWEBKIT_COPY_FILES and WEBKIT_SYMLINK_FILES. Turn it on for the framework\nheader stagers, which own their destination. It stays optional because some\ncopy steps share a destination, where pruning would delete another step's\noutput.\n\n* Source/JavaScriptCore/CMakeLists.txt:\n* Source/WTF/wtf/CMakeLists.txt:\n* Source/WebCore/CMakeLists.txt:\n* Source/WebCore/PAL/pal/CMakeLists.txt:\n* Source/WebKit/CMakeLists.txt:\n* Source/WebKitLegacy/CMakeLists.txt:\n* Source/bmalloc/CMakeLists.txt:\n* Source/cmake/WebKitMacros.cmake:\n\nCanonical link: https://commits.webkit.org/315823@main",
      "email": "nzimmermann@igalia.com",
      "hash": "adf29ea7ecf4e77e125f79d021fd12033fd023fd",
      "subject": "[CMake] Prune stale staged headers so renamed headers don't break module builds"
    },
    "315824@main": {
      "author": "Yijia Huang",
      "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64",
      "cl": "315824@main",
      "clUrl": "https://commits.webkit.org/315824@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317785\nrdar://180554350\n\nReviewed by Yusuke Suzuki.\n\nJSON::Value::dump prints String values via out.print(builder.toString()),\nwhich dispatches through PrintStream's printInternal(const CString\u0026)\noverload. That overload truncates large CStrings, replacing the tail\nwith \"...[N characters not shown]\" — a sane policy for terminal log\noutput, but it silently corrupts the JSON we just escaped: the closing\n'\"' of the string literal gets eaten, and the next \"key\": appears as if\ninside the string, leaving an unparseable file.\n\nReachable in practice via the JSC bytecode profiler (jsc -p file.json):\nJS source code in the \"source\" field of each Bytecodes record routinely\ncrosses the truncation threshold on JetStream3 subtests like\nbabylonjs-startup-es5 (30+ truncations in one profile, breaking\ndownstream parsers).\n\nBypass by routing through PrintStream's const char* overload, which is a\nplain printf(\"%s\", ...) with no length cap. CString from String::utf8()\nis null-terminated, so this is safe.\n\nA FIXME notes that PrintStream's truncation policy should not apply to\nfile persistence at all — a systematic fix in PrintStream would also\ncover SamplingProfiler text dumps and any future site that prints large\nStrings to disk. This patch only covers the JSON path, which is the\nonly one currently observed to break structured output.\n\nCanonical link: https://commits.webkit.org/315824@main",
      "email": "yijia_huang@apple.com",
      "hash": "cd07e3f6c0c048727d29f1c470315bcbf81cad36",
      "subject": "JSON::Value::dump corrupts large string values via PrintStream truncation"
    },
    "315825@main": {
      "author": "Issac Roy",
      "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64",
      "cl": "315825@main",
      "clUrl": "https://commits.webkit.org/315825@main",
      "description": "rdar://178840213\nhttps://bugs.webkit.org/show_bug.cgi?id=317359\n\nReviewed by Ryan Haddad.\n\nUpload the logs from the `run-api-tests-parallel-safety` step to S3.\nCreated basic unit tests for `RunAPITestsParallelSafety`.\n\n* Tools/CISupport/ews-build/steps.py:\n(RunAPITestsParallelSafety.run): Added logging to upload logs to S3.\n* Tools/CISupport/ews-build/steps_unittest.py: Added\n\nCanonical link: https://commits.webkit.org/315825@main",
      "email": "issacroy05@gmail.com",
      "hash": "2b15caaa5231f1472c8ad718b1755c5c87bdc85f",
      "subject": "[ews-build] Upload run-api-tests-parallel-safety logs to S3"
    },
    "315826@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "315826@main",
      "clUrl": "https://commits.webkit.org/315826@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317816\nrdar://180585525\n\nReviewed by Taher Ali.\n\nIn SVGResourcesCycleSolver::resourceContainsCycles(), the inner range-based\nfor loop declared a variable named `resource`, shadowing the function's\n`resource` parameter of the same type. Rename the loop variable to\n`childResource` to remove the shadowing. No behavior change.\n\n* Source/WebCore/rendering/svg/legacy/SVGResourcesCycleSolver.cpp:\n(WebCore::SVGResourcesCycleSolver::resourceContainsCycles):\n\nCanonical link: https://commits.webkit.org/315826@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "678a72bcb8503b8d9e493d8d3cf38376f033b5bf",
      "subject": "[LegacySVG] Rename inner loop variable in SVGResourcesCycleSolver"
    },
    "315827@main": {
      "author": "Andy Estes",
      "avatar": "https://www.gravatar.com/avatar/643f10f01b26fd94d03482a2013b2ea0?d=identicon\u0026s=64",
      "cl": "315827@main",
      "clUrl": "https://commits.webkit.org/315827@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317862\nrdar://180600008\n\nUnreviewed build fix.\n\n* Source/WebCore/testing/cocoa/WebMockMediaDeviceRoute.mm:\n\nCanonical link: https://commits.webkit.org/315827@main",
      "email": "aestes@apple.com",
      "hash": "965bad71f4eb4d8ef2795ed472c63fb236da1b33",
      "subject": "Fix the iOS Simulator build"
    },
    "315828@main": {
      "author": "Brady Eidson",
      "avatar": "https://www.gravatar.com/avatar/31bed81d6d8ef517f93b30add03f5651?d=identicon\u0026s=64",
      "cl": "315828@main",
      "clUrl": "https://commits.webkit.org/315828@main",
      "description": "rdar://180473685\nhttps://bugs.webkit.org/show_bug.cgi?id=317790\n\nReviewed by Alex Christensen.\n\nThere was no need for this particular virtual dance. So let's just remove it.\n\nNo new tests needed.\n\n* Source/WebKit/UIProcess/AuxiliaryProcessProxy.cpp:\n(WebKit::AuxiliaryProcessProxy::AuxiliaryProcessProxy):\n(WebKit::AuxiliaryProcessProxy::environmentIdentifier):\n* Source/WebKit/UIProcess/AuxiliaryProcessProxy.h:\n(WebKit::AuxiliaryProcessProxy::clientName const):\n* Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp:\n(WebKit::GPUProcessProxy::GPUProcessProxy):\n* Source/WebKit/UIProcess/GPU/GPUProcessProxy.h:\n* Source/WebKit/UIProcess/Model/ModelProcessProxy.cpp:\n(WebKit::ModelProcessProxy::ModelProcessProxy):\n* Source/WebKit/UIProcess/Model/ModelProcessProxy.h:\n* Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp:\n(WebKit::NetworkProcessProxy::NetworkProcessProxy):\n* Source/WebKit/UIProcess/Network/NetworkProcessProxy.h:\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::WebProcessProxy):\n* Source/WebKit/UIProcess/WebProcessProxy.h:\n\nCanonical link: https://commits.webkit.org/315828@main",
      "email": "beidson@apple.com",
      "hash": "87794cc4aa21b4ed76c0850ee6d14706d3d18279",
      "subject": "WKWebsiteDataStore dealloc crashes with pure virtual function call in WebKit::AuxiliaryProcessProxy"
    },
    "315829@main": {
      "author": "Marta Darbinyan",
      "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64",
      "cl": "315829@main",
      "clUrl": "https://commits.webkit.org/315829@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317857\nrdar://180635604\n\nUnreviewed test gardening\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/315829@main",
      "email": "darbinyan@apple.com",
      "hash": "551730d10c22be136ae02a00812031902e3d4803",
      "subject": "[Gardening]: REGRESSION(315779@main): [macOS Debug] [ASSERTION FAILED: allItems().get({ *m_frameState-\u003eframeItemID, *m_frameState-\u003eitemIDhttp/tests/site-isolation/frame-index.html is a flaky crash"
    },
    "315830@main": {
      "author": "Elliott Williams",
      "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64",
      "cl": "315830@main",
      "clUrl": "https://commits.webkit.org/315830@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316821\nrdar://179255886\n\nUnreviewed build fix.\n\nEWS is seeing spurious module \"is out of date and needs to be rebuilt:\nsignature mismatch\" failures. This should be solvable by switching to\nexplicitly built modules for Swift-C++ interop. We've done that in most\nof our Swift-C++ targets already, but seemingly forgot to in\nTestWebKitAPI.\n\nAs a follow-up, I intend to standardize this build setting across the\nproject.\n\n* Tools/TestWebKitAPI/Configurations/Base.xcconfig:\n\nCanonical link: https://commits.webkit.org/315830@main",
      "email": "emw@apple.com",
      "hash": "ed89aa899427e68da30e33c423c79f2220ea2db0",
      "subject": "[Build] Spurious module compilation failures in TestWebKitAPI (signature mismatch)"
    },
    "315831@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "315831@main",
      "clUrl": "https://commits.webkit.org/315831@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317815\nrdar://180584501\n\nReviewed by Taher Ali.\n\nUse nullptr instead of '0' in LegacySVG code. No behavior change.\n\n* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGContainer.h:\n* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGImage.h:\n* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGPath.cpp:\n(WebCore::markerForType):\n* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGShape.h:\n\nCanonical link: https://commits.webkit.org/315831@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "cdec22a7cb373f908d71077f356bce9538ade97e",
      "subject": "[LegacySVG] Use nullptr instead of 0 for pointers"
    },
    "315832@main": {
      "author": "Sam Sneddon",
      "avatar": "https://www.gravatar.com/avatar/99f6b56d9db9d32920dfcc56deae86fc?d=identicon\u0026s=64",
      "cl": "315832@main",
      "clUrl": "https://commits.webkit.org/315832@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316941\nrdar://179407377\n\nReviewed by Cole Carley.\n\nFixing WPT linter's behaviour is slightly too complex; we should just\ndisable the exit code check until we have a meaningful exit code from\nthe linter.\n\n* Tools/Scripts/webkitpy/w3c/wpt_linter.py:\n(WPTLinter._run_lint):\n\nCanonical link: https://commits.webkit.org/315832@main",
      "email": "gsnedders@apple.com",
      "hash": "8a18f8b8098a774f5778c3b0dfe18a950a7c82cd",
      "subject": "WPT linter failing with errors"
    },
    "315833@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "315833@main",
      "clUrl": "https://commits.webkit.org/315833@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314869\nrdar://177130998\n\nReviewed by Adrian Taylor and Mike Wyrzykowski.\n\nAdopt the `-clang-header-expose-decls=has-expose-attr-or-stdlib` and\n`-emit-clang-header-min-access internal` Swift flag options in WebGPU. The latter makes it so that\n`internal` symbols are exposed to C++ instead of just `public` symbols, and the former limits it so\nthat only symbols annotated with `@_expose(Cxx)` are exposed. This improves encapsulation and makes\nWebGPU more aligned with WebKit, and removes the need to have any `public` symbols in WebGPU.\n\nThis is also a pre-requisite for being able to adopt internal bridging headers to replace internal modules.\n\nAlso clean up all the \"thunk\" names to be more normally named and simpler.\n\n* Source/WebGPU/Configurations/WebGPU.xcconfig:\n* Source/WebGPU/WebGPU/Buffer.h:\n* Source/WebGPU/WebGPU/Buffer.mm:\n(WebGPU::Buffer::getMappedRange):\n(wgpuBufferCopy):\n* Source/WebGPU/WebGPU/Buffer.swift:\n(bufferCopyFrom(_:from:offset:)):\n(bufferGetMappedRange(_:offset:size:)):\n(Buffer_copyFrom_thunk(_:from:offset:)): Deleted.\n(Buffer_getMappedRange_thunk(_:offset:size:)): Deleted.\n* Source/WebGPU/WebGPU/CommandEncoder.mm:\n(WebGPU::CommandEncoder::beginComputePass):\n(WebGPU::CommandEncoder::runClearEncoder):\n(WebGPU::CommandEncoder::beginRenderPass):\n(WebGPU::CommandEncoder::copyBufferToBuffer):\n(WebGPU::CommandEncoder::copyBufferToTexture):\n(WebGPU::CommandEncoder::clearTextureIfNeeded):\n(WebGPU::CommandEncoder::copyTextureToBuffer):\n(WebGPU::CommandEncoder::copyTextureToTexture):\n(WebGPU::CommandEncoder::clearBuffer):\n(WebGPU::CommandEncoder::finish):\n(WebGPU::CommandEncoder::resolveQuerySet):\n* Source/WebGPU/WebGPU/CommandEncoder.swift:\n(commandEncoderClearTextureIfNeeded(_:destination:slice:)):\n(CommandEncoder_clearTextureIfNeeded_thunk(_:destination:slice:)): Deleted.\n* Source/WebGPU/WebGPU/Queue.mm:\n(WebGPU::Queue::writeBuffer):\n* Source/WebGPU/WebGPU/Queue.swift:\n(queueWriteBuffer(_:buffer:bufferOffset:data:)):\n(Queue_writeBuffer_thunk(_:buffer:bufferOffset:data:)): Deleted.\n\nCanonical link: https://commits.webkit.org/315833@main",
      "email": "richard_robinson2@apple.com",
      "hash": "7581588fd861762e6abe201ba15ecf8fe930fa09",
      "subject": "[Swift in WebKit] Adopt `emit-clang-header-min-access` flag in WebGPU"
    },
    "315834@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "315834@main",
      "clUrl": "https://commits.webkit.org/315834@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317717\nrdar://176424187\n\nReviewed by Abrar Rahman Protyasha.\n\nOn macOS, when using the AppKit-gestures text interaction path (driven by\nNSTextSelectionManager), click-dragging a selection to the edge of the window\ndid not autoscroll the page. The selection stopped growing at whatever was\nalready on screen, so it was impossible to select past the visible content\nwithout manually scrolling first. iOS already supports this via UIKit's\nUITextAutoscrolling protocol, which performs edge detection and drives the\nweb process's autoscroll timer; AppKit has no equivalent, so nothing started\nor sustained the scroll.\n\nImplement selection-drag autoscroll for macOS by reusing the existing\nselection-autoscroll machinery that iOS relies on (EventHandler's\nm_isAutoscrolling / m_targetAutoscrollPositionInRootView, AutoscrollController's\n50ms Selection timer, and the WebPage StartAutoscrollAtPosition /\nCancelAutoscroll messages). The decision of when to autoscroll lives entirely\nin the web process, which already computes the visible content rect and owns\nthe edge-band constants, so the UI process does not duplicate that geometry.\n\nHow it works:\n\n  - On each extent-point update during a range-selection drag (the messages\n    the UI process already sends as the cursor moves, and re-sends as the page\n    scrolls), WebPage::updateSelectionWithExtentPointAndBoundary asks the\n    EventHandler whether the point sits within the visible-edge band. If so it\n    starts (or keeps) selection autoscroll targeting that point; otherwise it\n    cancels. This is re-evaluated every update, so holding the cursor near the\n    edge keeps scrolling and dragging back toward the middle stops it -- the\n    macOS counterpart to UIKit's UITextAutoscrolling edge detection.\n\n  - While autoscrolling, EventHandler::targetPositionInWindowForSelectionAutoscroll\n    pushes the target point past the nearest visible-content edge, scaling the\n    push by how deep into the edge band the point is. Because the push is a fixed\n    distance past the edge in root-view coordinates, the autoscroll timer's\n    windowToContents mapping yields a stable per-tick scroll delta, so the page\n    keeps scrolling at a constant velocity for as long as the gesture holds near\n    (or past) the edge -- without the UI process having to re-push a target.\n\n  - As the page scrolls, WebViewImpl::pageDidScroll asks the text selection\n    controller to re-extend the selection toward the last drag point, so the\n    selection keeps growing into the newly revealed content. This mirrors the\n    iOS -updateSelection re-extension.\n\nThe edge-detection predicate (isPointNearSelectionAutoscrollEdge) and the\ntarget-push (pushSelectionAutoscrollTargetPastVisibleEdges) share a single\nhelper, selectionAutoscrollGeometry, for the visible rect and page-scale\nfactor. Sharing one source of truth guarantees the \"should we scroll\" decision\nand \"how far past the edge\" computation use the same edge band, so they cannot\ndisagree (e.g. when the page is magnified to a scale below 1).\n\nWhile autoscrolling on Cocoa, EventHandler::updateSelectionForMouseDrag is\nsuppressed: the selection is re-extended by the UI process toward the live drag\npoint as the page scrolls, so re-extending here from the stale last-known mouse\nposition would fight that. This is a no-op on iOS, where\nsupportsSelectionUpdatesOnMouseDrag() already returns false; the corresponding\npreprocessor guard is widened from !PLATFORM(IOS_FAMILY) to !PLATFORM(COCOA) to\nmatch.\n\n* Source/WebCore/page/EventHandler.cpp:\n(WebCore::EventHandler::updateSelectionForMouseDrag): Bail during autoscroll on\nCocoa so the UI-process-driven re-extension is authoritative.\n\n* Source/WebCore/page/EventHandler.h:\n* Source/WebCore/page/mac/EventHandlerMac.mm:\n(WebCore::selectionAutoscrollGeometry): Added; shared visible-rect + zoom scale.\n(WebCore::EventHandler::isPointNearSelectionAutoscrollEdge): Added.\n(WebCore::EventHandler::targetPositionInWindowForSelectionAutoscroll): Push the\ntarget past the nearest visible edge while autoscrolling.\n\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm:\n(WebKit::WebPage::rendererForSelectionAutoscroll): Added; factored out renderer\nresolution shared by the start path and the extent-point edge check.\n\n(WebKit::WebPage::startAutoscrollAtPosition): Use the shared helper.\n\n(WebKit::WebPage::updateSelectionWithExtentPointAndBoundary): On macOS, start or\ncancel selection autoscroll based on edge proximity.\n\n* Source/WebKit/UIProcess/mac/WKTextSelectionController.h:\n* Source/WebKit/UIProcess/mac/WKTextSelectionController.swift:\n(reextendSelectionForAutoscrollIfNeeded): Re-extend toward the last drag point\non scroll; gated on an in-flight drag rather than UI-cached autoscroll state.\n(beginRangeSelection / continueRangeSelection / endRangeSelection): Track the\nlast extent point; cancel autoscroll at gesture begin/end as a safety net.\n\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::pageDidScroll): Re-extend the selection as the page\nautoscrolls.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKitGesturesTests.swift:\n(draggingSelectionToWindowEdgeAutoscrolls): Added.\n\n(holdingSelectionDragNearEdgeKeepsScrolling): Added; verifies the scroll\ncontinues across the hold rather than bursting and stopping early.\n\n(holdingSelectionDragMidContentDoesNotAutoscroll): Added.\n(selectionAutoscrollStopsAfterGestureEnds): Added.\n(draggingSelectionToTopEdgeScrollsUp): Added.\n\nCanonical link: https://commits.webkit.org/315834@main",
      "email": "richard_robinson2@apple.com",
      "hash": "17c30e3cfa7cb856ba46e621918774758aab0da3",
      "subject": "[AppKit Gestures] Clicking and dragging text selection to the edge of the window does not autoscroll"
    },
    "315835@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "315835@main",
      "clUrl": "https://commits.webkit.org/315835@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317639\nrdar://180387513\n\nReviewed by Richard Robinson.\n\nOn a recent PR, the style checker suggested that I apply `swift format`\nover a couple of SwiftBrowser source files, so we just do the entire\nsubtree in this patch.\n\n* Tools/SwiftBrowser/Source/SwiftBrowser.swift:\n(SwiftBrowserApp.body):\n* Tools/SwiftBrowser/Source/ViewModel/DialogPresenter.swift:\n(handleJavaScriptPrompt(_:defaultText:initiatedBy:)): Deleted.\n(handleFileInputPrompt(_:initiatedBy:)): Deleted.\n* Tools/SwiftBrowser/Source/ViewModel/NavigationDecider.swift:\n(NavigationDecider.decidePolicy(for:preferences:)): Deleted.\n* Tools/SwiftBrowser/Source/Views/BrowserView.swift:\n(url):\n* Tools/SwiftBrowser/Source/Views/ContentView.swift:\n(DialogActionsView.body):\n(DialogMessageView.body):\n(ContentView.body):\n(url):\n\nCanonical link: https://commits.webkit.org/315835@main",
      "email": "a_protyasha@apple.com",
      "hash": "2491dbe7351197b3bc14f2563e2451373c2fc7d8",
      "subject": "Apply swift format over Tools/SwiftBrowser"
    },
    "315836@main": {
      "author": "Nathan Solomon",
      "avatar": "https://www.gravatar.com/avatar/511ed1e062e5bfec8adff762a004a148?d=identicon\u0026s=64",
      "cl": "315836@main",
      "clUrl": "https://commits.webkit.org/315836@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317810\nrdar://180581088\n\nReviewed by Ryan Reno.\n\nFollowing 315733@main, an ElementDidFocus IPC can be deferred until the next\nrendering update, except at a few flush points where any pending ElementDidFocus\nIPC is forced out (e.g. when an evaluateJavaScript or synthetic click completes).\n\nThe test ModalDialogDuringOverlappingFocus.mm (introduced in 314318@main) assumed\nthat a script calling element.focus() on two elements in a row would send two\nElementDidFocus IPCs.\n\nAfter 315733@main this test times out, because the two focus() calls coalesce into\na single ElementDidFocus IPC (carrying focus info for only the second element).\nOnly one of the two strong-password-assistance completion handlers the test waits\non is delivered, so the test blocks forever waiting for the second.\n\nFix the test by issuing each element.focus() in its own evaluateJavaScript call.\nEach evaluateJavaScript forces any pending ElementDidFocus IPC to be sent when it\ncompletes, so both focus completions are delivered and the test proceeds.\n\n315733@main does not re-introduce the regression that 314318@main fixed.\n314318@main fixed a hang caused by two overlapping _elementDidFocus: completion\nscopes unwinding in non-LIFO order. The second-to-fire scope wrote its stale\ncaptured YES over the first's correct NO, leaving _isFocusingElementWithKeyboard\nstuck and deferring every later modal dialog forever. 315733@main only ever\nreduces the number of ElementDidFocus IPCs. It coalesces multiple same-turn\nfocus() calls into one, producing fewer scopes and never more, so it makes the\nordering problem less likely rather than more. When two focus() calls land in\nseparate rendering updates, two scopes are still created, and 314318@main's\ngeneration-counter fix still resolves the unwind correctly.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ios/ModalDialogDuringOverlappingFocus.mm:\n(TestWebKitAPI::TEST(ModalDialogDuringOverlappingFocus, AlertNotDeferredAfterFIFOAsyncFocusCompletions)):\n\nCanonical link: https://commits.webkit.org/315836@main",
      "email": "nathan_solomon@apple.com",
      "hash": "13f0b855614682b002820fa2c726acefbeb423b7",
      "subject": "REGRESSION(315733@main): [iOS]TestWebKitAPI.ModalDialogDuringOverlappingFocus.AlertNotDeferredAfterFIFOAsyncFocusCompletions is constant timeout"
    },
    "315837@main": {
      "author": "Ben Nham",
      "avatar": "https://www.gravatar.com/avatar/dc0914eabf69047ee3397794c2d17bf7?d=identicon\u0026s=64",
      "cl": "315837@main",
      "clUrl": "https://commits.webkit.org/315837@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317774\nrdar://180545219\n\nReviewed by Per Arne Vollan.\n\n`window.webkit.evaluateScript` is exposed to the normal world if the user registers a message\nhandler or WKJSBuffer in the normal world. This isn't intended; regular webpages can just call\n`eval` instead. `evaluateScript` just gives the ability to customize the source URL of the script\nfor Web Inspector, which isn't something intended to be exposed to regular webpages.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/UserContentController.mm\n\n* Source/WebCore/bindings/js/DOMWrapperWorld.h:\n(WebCore::DOMWrapperWorld::isNonNormal const):\n* Source/WebCore/page/WebKitNamespace.idl:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/UserContentController.mm:\n(TEST(WKUserContentController, MessageHandlerInjectsWebKitNamespace)):\n(TEST(WKUserContentController, JSBufferInjectsWebKitNamespace)):\n\nCanonical link: https://commits.webkit.org/315837@main",
      "email": "nham@apple.com",
      "hash": "869eb5505b526c284d74ba427c400061315fb2c2",
      "subject": "Only expose evaluateScript in non-normal worlds"
    },
    "315838@main": {
      "author": "Alicia Boya Garcia",
      "avatar": "https://www.gravatar.com/avatar/89fdc5feb8ae1de4c43d003eba230998?d=identicon\u0026s=64",
      "cl": "315838@main",
      "clUrl": "https://commits.webkit.org/315838@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317865\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/gtk/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/315838@main",
      "email": "aboya@igalia.com",
      "hash": "7ad84af2d86eada3f2405d0044bf369978888614",
      "subject": "[glib] Unreviewed test gardening"
    },
    "315839@main": {
      "author": "Marta Darbinyan",
      "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64",
      "cl": "315839@main",
      "clUrl": "https://commits.webkit.org/315839@main",
      "description": "rdar://180652415\nhttps://bugs.webkit.org/show_bug.cgi?id=317869\n\nReviewed by Ryan Haddad.\n\nDue to the large backlog in iOS queues it needs additional bots to speed up the test requests.\n\n* Tools/CISupport/ews-build/config.json:\n\nCanonical link: https://commits.webkit.org/315839@main",
      "email": "darbinyan@apple.com",
      "hash": "4b4b5e7c36b7a99504cdbf5fbe3590231dac6ea0",
      "subject": "[EWS] Moving Sequoia builders to iOS wpt queue to add extra bot resources"
    },
    "315840@main": {
      "author": "Per Arne Vollan",
      "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64",
      "cl": "315840@main",
      "clUrl": "https://commits.webkit.org/315840@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317750\nrdar://180418990\n\nReviewed by Chris Dumez and Jer Noble.\n\nIn some cases, an incorrect format string is being used, leading to incorrect logs.\n\nThis is caused by calling os_log in inline functions, which can lead to ODR violations. See rdar://145164014.\n\nThis is addressed by moving the use of os_log to the implementation file.\n\n* Source/WTF/wtf/Logger.cpp:\n(WTF::Logger::osLog):\n* Source/WTF/wtf/Logger.h:\n(WTF::Logger::log):\n(WTF::Logger::logVerbose):\n\nCanonical link: https://commits.webkit.org/315840@main",
      "email": "pvollan@apple.com",
      "hash": "6521420c005ad3c90e20e164455f01041c83f5fc",
      "subject": "Logging using os_log is incorrect in some cases"
    },
    "315841@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "315841@main",
      "clUrl": "https://commits.webkit.org/315841@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317867\nrdar://180649149\n\nReviewed by Jessica Cheung.\n\n* .github/CODEOWNERS:\n\nCanonical link: https://commits.webkit.org/315841@main",
      "email": "richard_robinson2@apple.com",
      "hash": "05c75ef4dc27d8ebd5e38a06f0d0c01ca64aff86",
      "subject": "Remove myself as a codeowner of /Tools/TestWebKitAPI/Tests/WebKit"
    },
    "315842@main": {
      "author": "Keith Miller",
      "avatar": "https://www.gravatar.com/avatar/bddc1595b29098429a6ce7c8bf4aced2?d=identicon\u0026s=64",
      "cl": "315842@main",
      "clUrl": "https://commits.webkit.org/315842@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317848\nrdar://180624399\n\nReviewed by Elliott Williams.\n\nApply PGO profiling data to WTF and bmalloc/libpas. This appears to be\na .5-7% Speedometer3 progression and a .2-4% JetStream3 progression on\nthe latest devices.\n\nTo make this work the copy-profiling-data.py is moved to bmalloc and\nexported via PrivateHeaders from there rather than from JSC.\nAdditionally, since the uncompressed profdata is relatively large the\ncopy-profiling-data.py script attempts to symlink the data from a the\nrespective upstream project if the same profdata is shared.\n\nAlso, to work around Verify Modules phase using CFLAGS strip the\nprofiling flag in VerifyModuleTask.py so the build command doesn't\nerror.\n\nCanonical link: https://commits.webkit.org/315842@main",
      "email": "keith_miller@apple.com",
      "hash": "c7357533bed82a9da2e04af51194a0640b3d4526",
      "subject": "Apply PGO to WTF/bmalloc"
    },
    "315843@main": {
      "author": "Karl Dubost",
      "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64",
      "cl": "315843@main",
      "clUrl": "https://commits.webkit.org/315843@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317184\nrdar://179778617\n\nReviewed by Nikolas Zimmermann.\n\nThis adds two WPT tests which were not covered by the current WPT test\nsuite about the mask element in SVG.\n\nIt makes sure to check the effect of maskUnits value on the size of the\nstroke of a graphics.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-masking/mask-svg-content/mask-on-thin-stroked-path-default-expected.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-masking/mask-svg-content/mask-on-thin-stroked-path-default-ref.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-masking/mask-svg-content/mask-on-thin-stroked-path-default.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-masking/mask-svg-content/mask-on-thin-stroked-path-userspaceonuse-expected.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-masking/mask-svg-content/mask-on-thin-stroked-path-userspaceonuse-ref.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-masking/mask-svg-content/mask-on-thin-stroked-path-userspaceonuse.svg: Added.\n\nCanonical link: https://commits.webkit.org/315843@main",
      "email": "karlcow@apple.com",
      "hash": "d4ec0a394fdb91ba60ee19a0b44066b654cc2442",
      "subject": "Add WPT tests to show the effects of maskUnits and defaults on a path."
    },
    "315844@main": {
      "author": "Yijia Huang",
      "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64",
      "cl": "315844@main",
      "clUrl": "https://commits.webkit.org/315844@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317792\nrdar://180562156\n\nReviewed by Sosuke Suzuki.\n\nPre-existing entry points had naming inconsistencies and dead spec links:\nfromDurationLike (no spec name), toISO8601Duration / toLimitedDuration\n(linked to sec-temporal-tolimitedtemporalduration, an abstract op removed\nfrom the current spec). Per-unit getters duplicated boilerplate;\naddDurations took a runtime AddOrSubtract tag where every callsite passes\na constant.\n\nThis patch consolidates to two entry points: ToTemporalDuration (raw\nrecord) and ToTemporalPartialDurationRecord (shared by the object branch\nand Duration.prototype.with). AddDurations becomes a template member\nfunction with `if constexpr` operation tag, DCEing the unused branch.\nThe per-unit getters collapse into one macro applied via\nJSC_TEMPORAL_UNITS.\n\nCanonical link: https://commits.webkit.org/315844@main",
      "email": "yijia_huang@apple.com",
      "hash": "e9a2811a8b97dad042b40fa6cf1f897f50a85f6c",
      "subject": "[JSC][Temporal] Polish Duration converters, accessors, and arithmetic"
    },
    "315845@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "315845@main",
      "clUrl": "https://commits.webkit.org/315845@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317868\nrdar://180651355\n\nReviewed by Alan Baradlay.\n\nThe modern layout (LFC) code still referred to a box's min/max-content\ncontribution as its \"preferred\" width, even though it computes exactly that\ncontribution (per css-sizing-3 §4.3). Bring it in line with the rendering-side\ncleanup (314036@main, bug 315891):\n\n- LogicalWidthType::Preferred{Maximum,Minimum} -\u003e {Max,Min}ContentContribution.\n  Max/MinContent stays as-is — those are the content *size*\n  (computeIntrinsicLogicalWidths), not the contribution.\n- IntegrationUtils::preferred{Min,Max}Width -\u003e\n  {min,max}ContentLogicalWidthContribution, matching the\n  RenderBox::{min,max}ContentLogicalWidthContribution they forward to, plus\n  the grid callers in GridLayoutUtils.\n- Reword the comments in block/inline formatting contexts describing the\n  intrinsic width contribution computation.\n\nThe CSS 2.2 table-layout / shrink-to-fit / aspect-ratio \"preferred\" spec terms\nare intentionally left unchanged.\n\nNo behavior change.\n\nCanonical link: https://commits.webkit.org/315845@main",
      "email": "sammy.gill@apple.com",
      "hash": "f18d94d48d0d726f6f79a95f6273271fdd84654e",
      "subject": "[Cleanup] Stray references to preferred widths in LFC code"
    },
    "315847@main": {
      "author": "Simon Lewis",
      "avatar": "https://www.gravatar.com/avatar/f354c01a964923e67771a097d7d2f084?d=identicon\u0026s=64",
      "cl": "315847@main",
      "clUrl": "https://commits.webkit.org/315847@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317870\n\nUnreviewed build fix.\n\n315833@main (7581588fd861) made WebGPU's Swift interop functions internal +\n@_expose(Cxx) and added -emit-clang-header-min-access internal /\n-clang-header-expose-decls=has-expose-attr-or-stdlib to WebGPU.xcconfig only.\nThe CMake build still requested min-access public and lacked the expose-decls\nflag, so WebGPUSwift-Generated.h came out empty and Buffer.mm / Queue.mm /\nCommandEncoder.mm failed with undeclared identifiers.\n\n315823@main (adf29ea7ecf4) added PRUNE_STALE to WebKitLegacy_CopyHeaders. On\nmacOS WebKitLegacy_PUBLIC_FRAMEWORK_HEADERS is empty and the destination is\npopulated by PlatformMac.cmake's file(WRITE) forwarding-header loop, so the\nprune step deleted every staged WebKitLegacy header at configure time, breaking\nall \u003cWebKit/DOM.h\u003e, \u003cWebKit/WebFeature.h\u003e, \u003cWebKitLegacy/WebArchive.h\u003e etc.\nincludes.\n\n315816@main (d0b94cb5b4a4) moved EditingRange::clampedFirstLineRange into\nPlatform/EditingRangeClamping.cpp so it lands in libWebKitPlatform.a for\nXcode's TestIPC. The CMake TestIPC target compiles a hand-picked source list\ninstead, which was missing the new file and failed to link.\n\n* Source/WebGPU/WebGPU/CMakeLists.txt:\n* Source/WebKitLegacy/CMakeLists.txt:\n* Tools/TestWebKitAPI/PlatformMac.cmake:\n\nCanonical link: https://commits.webkit.org/315847@main",
      "email": "simon.lewis@apple.com",
      "hash": "53297d97056f4fe7e05f5c3bccf744da567fb530",
      "subject": "[CMake][Mac] Unreviewed build fix after 315816@main, 315823@main and 315833@main"
    },
    "315848@main": {
      "author": "Pouneh Bahrami",
      "avatar": "https://www.gravatar.com/avatar/c3e7b86f60b5dae1470ceeb5d929f12d?d=identicon\u0026s=64",
      "cl": "315848@main",
      "clUrl": "https://commits.webkit.org/315848@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316361\nrdar://176030553\n\nReviewed by Matthew Finkel.\n\nDedicatedWorker WebSocket connections were not being subjected to ITP\nthird-party cookie blocking, unlike DedicatedWorker fetch requests which\nalready carried isInitiatedByDedicatedWorker through NetworkResourceLoadParameters.\n\nThis patch threads a new isInitiatedByDedicatedWorker boolean from the worker\nthread through WorkerThreadableWebSocketChannel::Bridge::initialize() where\nit is derived via is\u003cDedicatedWorkerGlobalScope\u003e(scope) into the WebSocketTaskCocoa\nconstructor, where it replaces the previous shouldBlockCookies() call with\nthirdPartyCookieBlockingDecisionForRequest(..., isInitiatedByDedicatedWorker)\nso that the same ITP cookie-blocking policy applied to worker fetch requests is\nnow also applied to worker WebSocket handshakes.\n\nTest: http/tests/websocket/tests/hybi/websocket-blocked-sending-cookie-as-third-party-from-worker.html\n\n* LayoutTests/http/tests/websocket/tests/hybi/resources/websocket-blocked-sending-cookie-as-third-party-worker.js: Added.\n(ws.onopen):\n(ws.onerror):\n* LayoutTests/http/tests/websocket/tests/hybi/websocket-blocked-sending-cookie-as-third-party-from-worker-expected.txt: Added.\n* LayoutTests/http/tests/websocket/tests/hybi/websocket-blocked-sending-cookie-as-third-party-from-worker.html: Added.\n* LayoutTests/ipc/create-socket-channel-invalid-url-crash.html:\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Modules/websockets/IsInitiatedByDedicatedWorker.h: Copied from Source/WebKitLegacy/WebCoreSupport/LegacySocketProvider.h.\n* Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.cpp:\n(WebCore::ThreadableWebSocketChannel::create):\n* Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.h:\n* Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp:\n(WebCore::WorkerThreadableWebSocketChannel::Peer::Peer):\n(WebCore::WorkerThreadableWebSocketChannel::Peer::create):\n(WebCore::WorkerThreadableWebSocketChannel::Bridge::mainThreadInitialize):\n(WebCore::WorkerThreadableWebSocketChannel::Bridge::initialize):\n* Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.h:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/loader/EmptyClients.cpp:\n* Source/WebCore/page/SocketProvider.h:\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:\n(WebKit::NetworkConnectionToWebProcess::createSocketChannel):\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.h:\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.messages.in:\n* Source/WebKit/NetworkProcess/NetworkSession.cpp:\n(WebKit::NetworkSession::createWebSocketTask):\n* Source/WebKit/NetworkProcess/NetworkSession.h:\n* Source/WebKit/NetworkProcess/NetworkSocketChannel.cpp:\n(WebKit::NetworkSocketChannel::create):\n(WebKit::NetworkSocketChannel::NetworkSocketChannel):\n* Source/WebKit/NetworkProcess/NetworkSocketChannel.h:\n* Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.h:\n* Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm:\n(WebKit::NetworkSessionCocoa::createWebSocketTask):\n* Source/WebKit/NetworkProcess/cocoa/WebSocketTaskCocoa.h:\n* Source/WebKit/NetworkProcess/cocoa/WebSocketTaskCocoa.mm:\n(WebKit::WebSocketTask::create):\n(WebKit::WebSocketTask::WebSocketTask):\n* Source/WebKit/NetworkProcess/curl/NetworkSessionCurl.cpp:\n(WebKit::NetworkSessionCurl::createWebSocketTask):\n* Source/WebKit/NetworkProcess/curl/NetworkSessionCurl.h:\n* Source/WebKit/NetworkProcess/soup/NetworkSessionSoup.cpp:\n(WebKit::NetworkSessionSoup::createWebSocketTask):\n* Source/WebKit/NetworkProcess/soup/NetworkSessionSoup.h:\n* Source/WebKit/Shared/WebCoreArgumentCodersPlatform.serialization.in:\n* Source/WebKit/WebProcess/Network/WebSocketChannel.cpp:\n(WebKit::WebSocketChannel::create):\n(WebKit::WebSocketChannel::WebSocketChannel):\n(WebKit::WebSocketChannel::connect):\n* Source/WebKit/WebProcess/Network/WebSocketChannel.h:\n* Source/WebKit/WebProcess/Network/WebSocketProvider.cpp:\n(WebKit::WebSocketProvider::createWebSocketChannel):\n* Source/WebKit/WebProcess/Network/WebSocketProvider.h:\n* Source/WebKitLegacy/WebCoreSupport/LegacySocketProvider.cpp:\n(LegacySocketProvider::createWebSocketChannel):\n* Source/WebKitLegacy/WebCoreSupport/LegacySocketProvider.h:\n\nCanonical link: https://commits.webkit.org/315848@main",
      "email": "pbahrami@apple.com",
      "hash": "a6b2961021cdb76fc1299d403e7088155110b114",
      "subject": "Block third-party cookies for DedicatedWorker WebSocket connections."
    }
  },
  "date": "2026-06-25",
  "days": 1,
  "generatedAt": "2026-06-25T22:06:04Z",
  "markdown": "## Highlights\n\n- **Privacy** DedicatedWorker WebSocket handshakes now block third-party cookies, closing a cross-context cookie leak and aligning worker networking with stricter partitioning. [commit 315848@main](https://commits.webkit.org/315848@main)\n- **Security** `evaluateScript` is now only exposed in non-normal worlds, tightening script injection surface for embedders and automation. [commit 315837@main](https://commits.webkit.org/315837@main)\n- **Perf** WebKit now applies PGO to WTF/bmalloc, a low-level optimization pass that should pay back broadly in allocator-heavy paths. [commit 315842@main](https://commits.webkit.org/315842@main)\n- **Build** Explicit module builds are now enabled for CMake, a big build-system step that also triggered a wave of follow-up fixes across staged headers and Swift-enabled ports. [commit 315808@main](https://commits.webkit.org/315808@main)\n- **Web Platform** `KeyboardEvent` and `MouseEvent` now report `getModifierState(\"AltGraph\")` correctly instead of always returning false. [commit 315804@main](https://commits.webkit.org/315804@main)\n- **V8** JavaScriptCore fixed `Array#flat` dropping prototype-backed holes in nested arrays, bringing observable behavior back in line for tricky array shapes. [commit 315806@main](https://commits.webkit.org/315806@main)\n- **Rendering** A Safari 26.x regression in flex column `scrollHeight` is fixed, restoring padding-inclusive layout metrics in a common overflow case. [commit 315813@main](https://commits.webkit.org/315813@main)\n- **Media** WebRTC playback on GStreamer no longer loses video when decoding happens on the playback pipeline. [commit 315815@main](https://commits.webkit.org/315815@main)\n- **UI** AppKit text selections now autoscroll again when dragged to the window edge, fixing a rough editing interaction on macOS. [commit 315834@main](https://commits.webkit.org/315834@main)\n\n## What landed by area\n\n### JavaScriptCore and language runtime\n\n- **V8** JavaScriptCore polished Temporal Duration converters, accessors, and arithmetic, tightening a large surface of spec behavior. [commit 315844@main](https://commits.webkit.org/315844@main)\n- **V8** `JSON::Value::dump` no longer corrupts large string values through `PrintStream` truncation. [commit 315824@main](https://commits.webkit.org/315824@main)\n- **V8** JavaScriptCore fixed `Array#flat` so nested arrays preserve prototype-backed holes on the fast path. [commit 315806@main](https://commits.webkit.org/315806@main)\n- **Perf** DFG and FTL now inline `NumericStrings` int cache lookup for `ToString(Int32)`, shaving overhead from a hot conversion path. [commit 315805@main](https://commits.webkit.org/315805@main)\n- **V8** `ByteCodeParser::refineStatically` now weakens results using additional information instead of overcommitting speculative analysis. [commit 315803@main](https://commits.webkit.org/315803@main)\n- **Perf** `parseAssignmentExpression` now creates a save point only when it may actually be consumed, reducing parser bookkeeping. [commit 315801@main](https://commits.webkit.org/315801@main)\n\n### Web Platform, DOM, and API behavior\n\n- **Security** `evaluateScript` is now restricted to non-normal worlds. [commit 315837@main](https://commits.webkit.org/315837@main)\n- **Web Platform** `getModifierState(\"AltGraph\")` now works for both keyboard and mouse events instead of always returning false. [commit 315804@main](https://commits.webkit.org/315804@main)\n- **Web Platform** CSS at-rule serialization now escapes identifier tokens correctly. [commit 315795@main](https://commits.webkit.org/315795@main)\n- **Refactor** `SaturatedArithmetic` was renamed to `SaturatingArithmetic` for clearer API naming. [commit 315787@main](https://commits.webkit.org/315787@main)\n- **Refactor** The model element's `WeakRef` member now behaves consistently instead of effectively acting like a `WeakPtr`. [commit 315790@main](https://commits.webkit.org/315790@main)\n\n### Rendering, layout, CSS, and SVG\n\n- **Rendering** Added WPT coverage for `maskUnits` behavior and defaults on paths, improving SVG interoperability test depth. [commit 315843@main](https://commits.webkit.org/315843@main)\n- **Refactor** Layout formatting context code dropped stray references to preferred widths. [commit 315845@main](https://commits.webkit.org/315845@main)\n- **Rendering** CSS outline on inline `\u003csvg\u003e` now repaints correctly when toggled on `:hover`. [commit 315822@main](https://commits.webkit.org/315822@main)\n- **Rendering** `ViewTransition::m_initialPageZoom` is no longer left potentially uninitialized. [commit 315820@main](https://commits.webkit.org/315820@main)\n- **Rendering** Flex column `scrollHeight` once again includes padding after a Safari 26.x regression. [commit 315813@main](https://commits.webkit.org/315813@main)\n- **Rendering** SVG `\u003cimg\u003e` with near-integral intrinsic width no longer renders one device pixel too narrow. [commit 315807@main](https://commits.webkit.org/315807@main)\n- **Rendering** Filters on inline elements now apply correctly to block-level descendants. [commit 315788@main](https://commits.webkit.org/315788@main)\n- **Rendering** SVG `\u003ctextPath\u003e` now honors per-character `rotate`. [commit 315786@main](https://commits.webkit.org/315786@main)\n- **Refactor** LegacySVG replaced `0` pointer literals with `nullptr`. [commit 315831@main](https://commits.webkit.org/315831@main)\n- **Refactor** LegacySVG renamed an inner loop variable in `SVGResourcesCycleSolver` for clarity. [commit 315826@main](https://commits.webkit.org/315826@main)\n\n### Media, WebRTC, and graphics\n\n- **Media** Transient device rotation on Cocoa no longer leaves video frames with the wrong orientation. [commit 315821@main](https://commits.webkit.org/315821@main)\n- **Media** GStreamer WebRTC playback now keeps video when decoding is done on the playback pipeline. [commit 315815@main](https://commits.webkit.org/315815@main)\n- **Media** CNN subtitles now work again in native fullscreen on iOS. [commit 315789@main](https://commits.webkit.org/315789@main)\n- **GPU** WebGPU's Swift bridge now adopts `emit-clang-header-min-access`, continuing the Swift-in-WebKit integration cleanup. [commit 315833@main](https://commits.webkit.org/315833@main)\n- **Mobile** On iOS, `MediaSelectionOption` in `MediaDeviceRoute` no longer shadows an existing struct. [commit 315802@main](https://commits.webkit.org/315802@main)\n\n### Networking, storage, and process plumbing\n\n- **Privacy** DedicatedWorker WebSocket connections now block third-party cookies. [commit 315848@main](https://commits.webkit.org/315848@main)\n- **Security** `WKWebsiteDataStore` deallocation no longer crashes through a pure virtual call in `AuxiliaryProcessProxy`. [commit 315828@main](https://commits.webkit.org/315828@main)\n- **Networking** Setting a user dir suffix is no longer fatal, making configuration more forgiving in practice. [commit 315819@main](https://commits.webkit.org/315819@main)\n- **Security** `Internals::resetToConsistentState` on GLib site-isolation tests no longer corrupts memory via an unchecked `static_cast`. [commit 315794@main](https://commits.webkit.org/315794@main)\n- **Networking** `CoreIPCNSURLCredential::toID` no longer inserts the attributes dictionary as its own value. [commit 315793@main](https://commits.webkit.org/315793@main)\n- **Security** `CoreIPCNSURLCredential` no longer relies on an attribute type guard that was always true. [commit 315792@main](https://commits.webkit.org/315792@main)\n\n### UI, editing, and platform interaction\n\n- **UI** Dragging a text selection to the edge of the window now autoscrolls again under AppKit gestures. [commit 315834@main](https://commits.webkit.org/315834@main)\n- **UI** On visionOS, drag-and-drop image previews no longer sometimes appear outside webpage bounds. [commit 315791@main](https://commits.webkit.org/315791@main)\n- **Refactor** `EditingRange::clampedFirstLineRange` moved out of line into a `.cpp` file, reducing header weight and churn. [commit 315816@main](https://commits.webkit.org/315816@main)\n\n### Build, ports, and infrastructure\n\n- **Build** A Mac CMake build fix cleaned up fallout from the explicit modules and Swift header changes. [commit 315847@main](https://commits.webkit.org/315847@main)\n- **Build** `os_log` usage was fixed for cases where logging semantics were wrong. [commit 315840@main](https://commits.webkit.org/315840@main)\n- **Build** Sequoia builders were moved to the iOS WPT queue to free up bot resources. [commit 315839@main](https://commits.webkit.org/315839@main)\n- **Build** GLib test gardening landed to stabilize port coverage. [commit 315838@main](https://commits.webkit.org/315838@main)\n- **Build** SwiftBrowser was run through `swift format`, reducing style drift in the tools tree. [commit 315835@main](https://commits.webkit.org/315835@main)\n- **Build** WPT linter failures were fixed. [commit 315832@main](https://commits.webkit.org/315832@main)\n- **Build** TestWebKitAPI module compilation no longer fails spuriously with signature mismatches. [commit 315830@main](https://commits.webkit.org/315830@main)\n- **Build** EWS now uploads `run-api-tests-parallel-safety` logs to S3 for easier failure inspection. [commit 315825@main](https://commits.webkit.org/315825@main)\n- **Build** CMake now prunes stale staged headers so renamed headers do not poison module builds. [commit 315823@main](https://commits.webkit.org/315823@main)\n- **Build** The iOS Simulator build is fixed. [commit 315827@main](https://commits.webkit.org/315827@main)\n- **Build** WPE-only builds no longer define `platformSetDefaultGamepadProvider` twice. [commit 315814@main](https://commits.webkit.org/315814@main)\n- **Build** Non-unified build fixes landed for the day's changes. [commit 315812@main](https://commits.webkit.org/315812@main)\n- **Build** Swift-enabled WPE builds now link cleanly without multiple-definition failures. [commit 315810@main](https://commits.webkit.org/315810@main)\n- **Build** GTK and WPE now regenerate CMake cache when `.wkdev-sdk-version` changes. [commit 315809@main](https://commits.webkit.org/315809@main)\n- **Build** Explicit module builds were enabled on CMake. [commit 315808@main](https://commits.webkit.org/315808@main)\n- **Build** GTK and WPE bumped wkdev-sdk to an Ubuntu 26.04 based SDK. [commit 315785@main](https://commits.webkit.org/315785@main)\n- **Build** WPE ARM32 and ARM64 post-commit bots were removed from build.webkit.org. [commit 315818@main](https://commits.webkit.org/315818@main)\n- **Build** Swift in WebKit dropped the no-longer-needed `-no-verify-emitted-module-interface` workaround. [commit 315796@main](https://commits.webkit.org/315796@main)\n- **UI** GTK and WPE enabled `WHEEL_EVENT_REGIONS`, improving event-region handling on those ports. [commit 315799@main](https://commits.webkit.org/315799@main)\n- **Build** Prefixed CSS values are no longer rewritten during `import-w3c-tests`, reducing import noise and accidental churn. [commit 315798@main](https://commits.webkit.org/315798@main)\n\n### Test gardening and contributor metadata\n\n- **Build** An iOS modal dialog regression test timeout after async focus completions was fixed. [commit 315836@main](https://commits.webkit.org/315836@main)\n- **Build** A flaky macOS Debug site-isolation crash test was gardened after a post-315779 regression. [commit 315829@main](https://commits.webkit.org/315829@main)\n- **Build** iOS site-isolation timeout flakiness after 315516 was addressed. [commit 315817@main](https://commits.webkit.org/315817@main)\n- **Build** An iOS Debug timeout in `media/video-webm-seek-multi-audio-tracks.html` was fixed. [commit 315811@main](https://commits.webkit.org/315811@main)\n- **Build** A flaky iOS `PreferredHTTPSPolicyAutomaticHTTPFallbackAfterTerminateProcess` API test was gardened. [commit 315797@main](https://commits.webkit.org/315797@main)\n- **Refactor** A codeowner entry was removed from `Tools/TestWebKitAPI/Tests/WebKit`. [commit 315841@main](https://commits.webkit.org/315841@main)\n- **Refactor** `contributors.json` now marks Ian Grunert as reviewer. [commit 315800@main](https://commits.webkit.org/315800@main)\n- **Refactor** `contributors.json` now marks Jessica Cheung as reviewer. [commit 315783@main](https://commits.webkit.org/315783@main)",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [
    {
      "name": "Unreviewed",
      "count": 2
    }
  ],
  "since": "2026-06-25",
  "totals": {
    "commits": 66,
    "features": 64,
    "rolls": 2
  },
  "until": "2026-06-25"
}