{
  "commits": {
    "315975@main": {
      "author": "Timothy Hatcher",
      "avatar": "https://www.gravatar.com/avatar/d0f8f949749d89ed152fa835ede38c5b?d=identicon\u0026s=64",
      "cl": "315975@main",
      "clUrl": "https://commits.webkit.org/315975@main",
      "description": "https://webkit.org/b/317981\nrdar://177298426\n\nReviewed by Kiara Rose.\n\nWhen a content script called runtime.sendMessage before a non-persistent\nbackground page or service worker had finished its initial load and registered\nits runtime.onMessage listener, the message was delivered to no listener and\nsilently dropped instead of being queued until the background content loaded.\nThis happened reliably on the first load after install, or whenever the\npersisted background listener state had been cleared, because the empty\nlistener set made wakeUpBackgroundContentIfNecessaryToFireEvents() treat the\nevent as unhandled rather than deferring it.\n\nUntil the background content has loaded once, an empty listener set means the\nlisteners aren't known yet, not that the event is unhandled, so queue the task\nto fire after the background content loads rather than dropping it. Track this\nwith m_backgroundContentHasLoadedOnce so that once the background has loaded an\nempty set remains authoritative and unhandled events still avoid waking it.\n\nForwarding events during the initial load also exposed a latent bug where\ndidOpenWindow() did not forward its SuppressEvents argument to didOpenTab(),\ncausing pre-existing tabs enumerated by populateWindowsAndTabs() to fire\ntabs.onCreated; that spurious event was previously masked by the early-out.\n\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionContextCocoa.mm:\n(WebKit::WebExtensionContext::unload): Reset m_backgroundContentHasLoadedOnce so the\ncleared listener set is treated as unknown again on the next load.\n(WebKit::WebExtensionContext::didOpenWindow): Forward suppressEvents to didOpenTab() so\ntabs of windows enumerated during the initial population don't fire tabs.onCreated.\n(WebKit::WebExtensionContext::performTasksAfterBackgroundContentLoads): Set\nm_backgroundContentHasLoadedOnce once the background content has finished loading.\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.cpp:\n(WebKit::WebExtensionContext::wakeUpBackgroundContentIfNecessaryToFireEvents): Queue the\nevent instead of dropping it when the listener set is empty and the background has never\nloaded, since the handling listener may register during the in-flight load.\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.h: Add m_backgroundContentHasLoadedOnce.\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIRuntime.mm:\n(TestWebKitAPI::TEST): Add SendMessageFromContentScriptWhileBackgroundIsLoading, which\nsends a content-script message while the background content races its initial load.\n\nCanonical link: https://commits.webkit.org/315975@main",
      "email": "timothy@apple.com",
      "hash": "7682d9817bed6645aa2516eb20a1b5a2ca48d735",
      "subject": "runtime.sendMessage from a content script is dropped if sent while the background content is still loading."
    },
    "315976@main": {
      "author": "Yijia Huang",
      "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64",
      "cl": "315976@main",
      "clUrl": "https://commits.webkit.org/315976@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318018\nrdar://180818044\n\nReviewed by Yusuke Suzuki.\n\nFixupPhase currently inserts a ForceOSRExit before a GetByVal whose value\nprofile produced no prediction. This is over-conservative: the resulting DFG\nplan exits whenever control reaches the GetByVal site, gets jettisoned, and\ntends to be recompiled with the same defect on subsequent attempts.\n\nSet the prediction to SpecBytecodeTop instead. DFG generates code that\nhandles any JSValue type, and downstream nodes still apply their own\nspeculations via edge UseKinds — so a localized OSR exit only fires when\nthe actual runtime type mismatches a downstream node's expectation.\n\nSpecBytecodeTop is the established \"any type\" fallback elsewhere in the\nDFG: DFGPredictionPropagationPhase uses it for WeakMapGet,\nResolveScopeForHoistingFuncDeclInEval, and GetCellButterflySlot in non-Int32\narray modes.\n\nCanonical link: https://commits.webkit.org/315976@main",
      "email": "yijia_huang@apple.com",
      "hash": "7f36028faf14865063b1025b190d7bf0a4553eb3",
      "subject": "[JSC][DFG] Widen GetByVal prediction to SpecBytecodeTop instead of forcing OSR exit when value profile is empty"
    },
    "315977@main": {
      "author": "Tim Nguyen",
      "avatar": "https://www.gravatar.com/avatar/208c05ac2decdf818a4a08ada568328e?d=identicon\u0026s=64",
      "cl": "315977@main",
      "clUrl": "https://commits.webkit.org/315977@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317720\nrdar://180473472\n\nReviewed by Sam Weinig.\n\nThe no-clamp keyword allows progress() to return values outside [0, 1].\nWhen from == to and no-clamp is specified, the result is -∞, 0, or +∞\ndepending on whether the progress value is less than, equal to, or greater\nthan the shared value. This commit also fixes the existing clamped\nfrom == to behavior, which was previously producing incorrect results\n(NaN or 1 instead of 0).\n\nThe no-clamp variant is represented as a separate ProgressNoClamp struct\nrather than a bool flag on Progress, following the same pattern used by\nRoundNearest/RoundUp/RoundDown/RoundToZero. This means copy, conversion,\nevaluation, and simplification all work correctly through the existing\ngeneric template machinery without any special-case overloads.\n\nSpec change: https://github.com/w3c/csswg-drafts/commit/a44eb8c76fe066d115b019895ee1c4fb90389384\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/progress-computed-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/progress-serialize-expected.txt:\n* Source/WebCore/css/CSSValueKeywords.in:\n* Source/WebCore/css/calc/CSSCalcExecutor.h:\n(WebCore::CSSCalc::OperatorExecutor\u003cOperator::Progress\u003e::operator()):\n(WebCore::CSSCalc::OperatorExecutor\u003cOperator::ProgressNoClamp\u003e::operator()):\n* Source/WebCore/css/calc/CSSCalcOperator.cpp:\n(WebCore::CSSCalc::operator\u003c\u003c):\n* Source/WebCore/css/calc/CSSCalcOperator.h:\n* Source/WebCore/css/calc/CSSCalcTree+Mappings.h:\n* Source/WebCore/css/calc/CSSCalcTree+Parser.cpp:\n(WebCore::CSSCalc::consumeProgressImpl):\n(WebCore::CSSCalc::consumeProgress):\n* Source/WebCore/css/calc/CSSCalcTree+Serialization.cpp:\n(WebCore::CSSCalc::serializeMathFunctionPrefix):\n* Source/WebCore/css/calc/CSSCalcTree+Simplification.cpp:\n(WebCore::CSSCalc::simplify):\n* Source/WebCore/css/calc/CSSCalcTree+Simplification.h:\n* Source/WebCore/css/calc/CSSCalcTree.cpp:\n(WebCore::CSSCalc::toType):\n* Source/WebCore/css/calc/CSSCalcTree.h:\n(WebCore::CSSCalc::get):\n* Source/WebCore/style/calc/StyleCalculationTree.cpp:\n* Source/WebCore/style/calc/StyleCalculationTree.h:\n(WebCore::Style::Calculation::get):\n\nCanonical link: https://commits.webkit.org/315977@main",
      "email": "ntim@apple.com",
      "hash": "9b15b6d2ae8ff74a27eab213292e77653955ca90",
      "subject": "[css-values] Add `no-clamp` option to `progress()` function"
    },
    "315978@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "315978@main",
      "clUrl": "https://commits.webkit.org/315978@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315168\nrdar://177505963\n\nReviewed by Justin Michaud.\n\nLet's align OrderedHashTable's load factor polic to normal HashTable.\nUntil a particular threshold, use 75%, after that, use 50%.\n\n* Source/WTF/benchmarks/HashSetVariantsBenchmark.cpp: Added.\n(main):\n* Source/WTF/wtf/OrderedHashTable.h:\n\nCanonical link: https://commits.webkit.org/315978@main",
      "email": "ysuzuki@apple.com",
      "hash": "021df62bfacca0026e6ccdc66ed256ec4aa05b2d",
      "subject": "[WTF] Align load factor policy of OrderedHashTable to HashTable"
    },
    "315979@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "315979@main",
      "clUrl": "https://commits.webkit.org/315979@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318053\nrdar://180837003\n\nReviewed by Wenson Hsieh.\n\n* Source/WTF/wtf/PlatformHave.h:\n\nCanonical link: https://commits.webkit.org/315979@main",
      "email": "richard_robinson2@apple.com",
      "hash": "05f6624993f371d307d63d2becc0ff732b1b910a",
      "subject": "Upstream the `HAVE_DDSCANNER_QOS_CONFIGURATION` compile-time feature flag"
    },
    "315980@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "315980@main",
      "clUrl": "https://commits.webkit.org/315980@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317998\nrdar://180785695\n\nReviewed by Kimmo Kinnunen.\n\nImageBuffer::hasBackend() only calls backend(), which is already a const\nmember function, so the method can be const itself. Mark it const for\nconst-correctness.\n\n* Source/WebCore/platform/graphics/ImageBuffer.h:\n(WebCore::ImageBuffer::hasBackend const):\n(WebCore::ImageBuffer::hasBackend): Deleted.\n\nCanonical link: https://commits.webkit.org/315980@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "0a98e10bf3540dd8f58983de37e1b0b0964fd768",
      "subject": "ImageBuffer::hasBackend() should be const"
    },
    "315981@main": {
      "author": "Wenson Hsieh",
      "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64",
      "cl": "315981@main",
      "clUrl": "https://commits.webkit.org/315981@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318038\nrdar://180823125\n\nReviewed by Richard Robinson.\n\nIt's possible for agentic text extraction clients to issue clicks over stale unique node `uid`s; for\ninstance, consider an agent that navigates from one page:\n\n```\n…\nbutton uid=2845 haspopup=true label=Menu\nbutton uid=2846 haspopup=true\nimage uid=2847 src=avatar.svg alt='Account menu'\n'MyChart'\n'by Epic'\n…\n```\n\n…to another page:\n\n```\n…\nbutton uid=3004 haspopup=true label=Menu\nbutton uid=3005 haspopup=true\nimage uid=3006 src=avatar.svg alt='Account menu'\n'MyChart'\n'by Epic'\n…\n```\n\n…and then attempts to issue a click on `uid=2845`. We'll currently reject the `click` interaction,\ncommunicating in the summary string that the targeted node UID is not rendered. This can end up\nconfusing or otherwise misaligning a weaker model, which may end up assuming that (in this\nparticular example) the `Menu` button is simply no longer accessible in the current page, rather\nthan realizing that it had provided a stale `uid`.\n\nTo mitigate this, we work towards a mechanism where:\n\n-   We cache the last few text extraction results.\n-   When a `uid` target is stale, we fall back to searching for that `uid` in these cached results.\n-   If the context before or after the `uid` is identical (ignoring the `uid`s themselves) to the\n    context before or after a `uid` in the latest text extraction results taken from the current\n    page, then treat it as if the agent had targeted the new, matching `uid` instead.\n\nThis patch only introduces the concept of an text extraction result cache, which we'll later consult\nto resolve stale `uid`s to active `uid`s in the current context, as a fallback.\n\n* Source/WebCore/page/text-extraction/TextExtraction.cpp:\n(WebCore::TextExtraction::invalidNodeIdentifierDescription):\n(WebCore::TextExtraction::resolveMouseTarget):\n* Source/WebKit/Shared/TextExtractionToStringConversion.cpp:\n(WebKit::TextExtractionAggregator::~TextExtractionAggregator):\n(WebKit::TextExtractionAggregator::takeResults):\n(WebKit::TextExtractionAggregator::addResult):\n(WebKit::lineWithoutNodeIdentifier):\n(WebKit::addPartsForItem):\n\nWhile extracting text, we now also build up a parallel representation of the text extraction\nresults, where the `uid` is separated out from the rest of the content. This representation allows\nus to later efficiently:\n\n1. Check which `uid`s are present in a cached text extraction result.\n2. If present, we can easily check the surrounding context around the `uid` to see if it matches.\n\n* Source/WebKit/Shared/TextExtractionToStringConversion.h:\n* Source/WebKit/Sources.txt:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm:\n(-[WKWebView _extractDebugTextWithConfigurationWithoutUpdatingFilterRules:assertionScope:completionHandler:]):\n* Source/WebKit/UIProcess/TextExtractionCache.cpp: Added.\n(WebKit::TextExtractionCache::add):\n(WebKit::TextExtractionCache::contextWindowBefore):\n(WebKit::TextExtractionCache::contextWindowAfter):\n(WebKit::TextExtractionCache::resolve const):\n* Source/WebKit/UIProcess/TextExtractionCache.h: Added.\n(WebKit::TextExtractionCache::clear):\n\nAdd a helper class that represents a cached text extraction result, which we use to do the fallback\n`uid` lookup above.\n\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::textExtractionCache):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxyInternals.h:\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/315981@main",
      "email": "wenson_hsieh@apple.com",
      "hash": "f9ad94e23bc21d20b48be8c4304e29215b7c9023",
      "subject": "[Text Extraction] Work towards making it possible for clients to target stale node UIDs"
    },
    "315982@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "315982@main",
      "clUrl": "https://commits.webkit.org/315982@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318049\nrdar://180836227\n\nReviewed by Kimmo Kinnunen.\n\nImageBuffer::transferToNewContext() was the only method in ImageBuffer\nthat dereferenced backend() raw, while every sibling method guards with\n`if (auto* backend = ensureBackend())`. Its sole caller,\nRemoteRenderingBackend::moveToImageBuffer(), operates on a serialized\nImageBuffer taken from the resource cache. Backend allocation can\nlegitimately fail (size limits / OOM), leaving a live ImageBuffer whose\nm_backend is null, so transferToNewContext() would null-deref.\n\nGuard the access with ensureBackend(), matching the established pattern\nused throughout ImageBuffer. When there is no backend there is nothing\nto transfer, so skipping the call is correct.\n\n* Source/WebCore/platform/graphics/ImageBuffer.cpp:\n(WebCore::ImageBuffer::transferToNewContext):\n\nCanonical link: https://commits.webkit.org/315982@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "9ca4025a7330d295a5f7931d5cbebea6788e7b46",
      "subject": "ImageBuffer::transferToNewContext() can null-deref backend()"
    },
    "315983@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "315983@main",
      "clUrl": "https://commits.webkit.org/315983@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317999\nrdar://180786679\n\nReviewed by Kimmo Kinnunen.\n\nGraphicsContext::fillRoundedRect() and the\nfillRect(rect, color, op, blendMode) overload save and restore only the\ncomposite operator around their temporary state change. They read the\noperator after the blend mode has already been mutated and restore it\nwith setCompositeOperation(), whose blendMode parameter defaults to\nBlendMode::Normal. This silently drops any non-Normal blend mode that was\nactive on the context before the call.\n\nCapture the full CompositeMode (operator + blend mode) before mutating\nand restore it with setCompositeMode().\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/cocoa/GraphicsContextCGTests.mm\n\n* Source/WebCore/platform/graphics/GraphicsContext.cpp:\n(WebCore::GraphicsContext::fillRect):\n(WebCore::GraphicsContext::fillRoundedRect):\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/GraphicsContextCGTests.mm:\n(TestWebKitAPI::TEST(GraphicsContextTests, FillRoundedRectPreservesActiveBlendMode)):\n(TestWebKitAPI::TEST(GraphicsContextTests, FillRectWithBlendModePreservesActiveBlendMode)):\n\nCanonical link: https://commits.webkit.org/315983@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "1bfbf096b177ccd38479b4d3f890db5643efed34",
      "subject": "GraphicsContext::fillRoundedRect and fillRect clobber an active non-Normal blend mode"
    },
    "315984@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "315984@main",
      "clUrl": "https://commits.webkit.org/315984@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318063\nrdar://180858531\n\nReviewed by Eric Carlson.\n\nThe handlers for the ForegroundColorARGB, BackgroundColorARGB, and\nCharacterBackgroundColorARGB markup attributes in processCueAttributes()\nwere byte-identical except for the InbandGenericCue setter they called:\neach cast the value to a CFArrayRef, ran it through\nmakeSimpleColorFromARGBCFArray(), and applied the result.\n\nExtract the shared logic into an applyColorAttribute() lambda that takes\na pointer-to-member setter, collapsing three ~11-line blocks into one\nhelper plus three one-line dispatches. No change in behavior.\n\n* Source/WebCore/platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp:\n(WebCore::InbandTextTrackPrivateAVF::processCueAttributes):\n\nCanonical link: https://commits.webkit.org/315984@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "012c7fc8787cf44798f92c07ac4efe4a1105aac0",
      "subject": "[AVFoundation] De-duplicate the ARGB color-extraction blocks in processCueAttributes()"
    }
  },
  "date": "2026-06-28",
  "days": 1,
  "generatedAt": "2026-06-28T22:05:21Z",
  "markdown": "## Highlights\n- **Rendering** Fixed rounded-rect and rect fills resetting a non-Normal blend mode, preventing incorrect compositing in active paint sequences. [commit 315983@main](https://commits.webkit.org/315983@main)\n- **Security** Fixed a null dereference in `ImageBuffer::transferToNewContext()`, closing off a crash path in graphics buffer handoff. [commit 315982@main](https://commits.webkit.org/315982@main)\n- **Web Platform** Added the `no-clamp` option to CSS `progress()`, bringing more precise control over computed progress values. [commit 315977@main](https://commits.webkit.org/315977@main)\n- **V8** JSC DFG now widens `GetByVal` prediction to `SpecBytecodeTop` when value profiling is empty, avoiding unnecessary OSR exits. [commit 315976@main](https://commits.webkit.org/315976@main)\n- **UI** Fixed `runtime.sendMessage` from content scripts being dropped while the background content is still loading, improving extension startup reliability. [commit 315975@main](https://commits.webkit.org/315975@main)\n- **Perf** Aligned `OrderedHashTable` load factor policy with `HashTable`, a low-level tuning change that should make hash table behavior more consistent under growth. [commit 315978@main](https://commits.webkit.org/315978@main)\n- **Build** Upstreamed the `HAVE_DDSCANNER_QOS_CONFIGURATION` compile-time feature flag, reducing downstream divergence around platform capability checks. [commit 315979@main](https://commits.webkit.org/315979@main)\n- **Web Platform** Text Extraction moved toward supporting stale node UIDs as client targets, which should make extracted-text references more resilient across DOM changes. [commit 315981@main](https://commits.webkit.org/315981@main)\n\n## What landed by area\n\n### Graphics and Rendering\n- **Rendering** Made `GraphicsContext::fillRoundedRect` and `fillRect` preserve an active non-Normal blend mode instead of clobbering it. [commit 315983@main](https://commits.webkit.org/315983@main)\n- **Security** Guarded `ImageBuffer::transferToNewContext()` against a null `backend()` dereference. [commit 315982@main](https://commits.webkit.org/315982@main)\n- **Refactor** Made `ImageBuffer::hasBackend()` `const`, a small cleanup that tightens API correctness around buffer state queries. [commit 315980@main](https://commits.webkit.org/315980@main)\n\n### CSS and Web Platform\n- **Web Platform** Added the `no-clamp` option to the CSS `progress()` function so callers can opt out of clamped output. [commit 315977@main](https://commits.webkit.org/315977@main) [bug 317720](https://bugs.webkit.org/show_bug.cgi?id=317720)\n- **Web Platform** Continued Text Extraction work so clients can eventually target stale node UIDs more reliably. [commit 315981@main](https://commits.webkit.org/315981@main) [bug 318038](https://bugs.webkit.org/show_bug.cgi?id=318038)\n\n### JavaScriptCore\n- **V8** Improved JSC DFG speculative behavior for `GetByVal` by widening prediction to `SpecBytecodeTop` when value profiles are empty, instead of forcing an OSR exit. [commit 315976@main](https://commits.webkit.org/315976@main) [bug 318018](https://bugs.webkit.org/show_bug.cgi?id=318018)\n- **Perf** Aligned `OrderedHashTable` load factor policy with `HashTable`, reducing one more behavioral mismatch in WTF container internals. [commit 315978@main](https://commits.webkit.org/315978@main) [bug 315168](https://bugs.webkit.org/show_bug.cgi?id=315168)\n\n### Extensions and Messaging\n- **UI** Fixed a race where `runtime.sendMessage` from a content script could be dropped if sent while background content was still loading. [commit 315975@main](https://commits.webkit.org/315975@main)\n\n### Media\n- **Media** De-duplicated ARGB color extraction blocks in `processCueAttributes()` under AVFoundation, trimming repeated cue-processing logic. [commit 315984@main](https://commits.webkit.org/315984@main) [bug 318063](https://bugs.webkit.org/show_bug.cgi?id=318063)\n\n### Build and Platform Configuration\n- **Build** Upstreamed the `HAVE_DDSCANNER_QOS_CONFIGURATION` compile-time feature flag to make platform configuration less downstream-specific. [commit 315979@main](https://commits.webkit.org/315979@main) [bug 318053](https://bugs.webkit.org/show_bug.cgi?id=318053)",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [],
  "since": "2026-06-28",
  "totals": {
    "commits": 10,
    "features": 10,
    "rolls": 0
  },
  "until": "2026-06-28"
}