{
  "commits": {
    "314233@main": {
      "author": "Angelos Oikonomopoulos",
      "avatar": "https://www.gravatar.com/avatar/ee46106043323b10e0bb3c899f9590e5?d=identicon\u0026s=64",
      "cl": "314233@main",
      "clUrl": "https://commits.webkit.org/314233@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316776\n\nReviewed by Yusuke Suzuki.\n\nAfter https://commits.webkit.org/314233@main, on non-Cocoa, we need the\nmain thread to be the first to call initializeMainThread(), so do that\nbefore running the tests. Otherwise, at least\nstartMultithreadedMultiVMExecutionTest() calls the function after other\nthreads have been constructed, hitting the assertion re: the uid in\ninitializeMainThread.\n\nCanonical link: https://commits.webkit.org/316006@main",
      "email": "angelos@igalia.com",
      "hash": "d281dfa038598c7fa8f1aecfb93cb26c4b408268",
      "subject": "[JSC] testapi hits initializeMainThread assertion"
    },
    "315985@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "315985@main",
      "clUrl": "https://commits.webkit.org/315985@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317989\nrdar://180768852\n\nReviewed by Sosuke Suzuki.\n\nLet's have ByteTable-based latin1-table which converts CharacterClass\nmatching to table-based one when it is Char8 and matching is\ncomplicated. We use ByteTable for now as BitSet based one is slower than\nthis ByteTable-based one.\n\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n* Source/JavaScriptCore/yarr/YarrJIT.h:\n(JSC::Yarr::YarrBoyerMooreData::clearMaps):\n(JSC::Yarr::YarrBoyerMooreData::addLatin1Table):\n* Source/JavaScriptCore/yarr/YarrPattern.cpp:\n(JSC::Yarr::CharacterClassConstructor::charClass):\n(JSC::Yarr::CharacterClassConstructor::buildLatin1TableIfBeneficial):\n* Source/JavaScriptCore/yarr/YarrPattern.h:\n* Source/JavaScriptCore/yarr/YarrTZoneImpls.cpp:\n\nCanonical link: https://commits.webkit.org/315985@main",
      "email": "ysuzuki@apple.com",
      "hash": "8847f4666db3a6e8402489b2bfe627fb6949d0db",
      "subject": "[YARR] Add latin1Table for efficient Char8 filtering"
    },
    "315986@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "315986@main",
      "clUrl": "https://commits.webkit.org/315986@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317285\nrdar://179901173\n\nReviewed by Yijia Huang.\n\nThis patch implements MapIterator#next / SetIterator#next in C++. So we\nalso add intrinsic support in DFG so that we can move them to C++ while\nstill supporting inlining in DFG / FTL. We also remove many helper\nfunctions which are only used to implement MapIterator#next /\nSetIterator#next in builtin JS.\n\nTest: JSTests/stress/map-set-iterator-next-intrinsic.js\n\n* JSTests/stress/map-set-iterator-next-entries-double-fixup-exit-ok.js: Added.\n(shouldBe):\n(sumMapEntries):\n* JSTests/stress/map-set-iterator-next-intrinsic.js: Added.\n(shouldBe):\n(shouldThrow):\n(sumMapKeys):\n(sumMapValues):\n(stepShapesMap):\n(nextEmpty):\n(callMapNextWithBadThis):\n(callSetNextWithBadThis):\n(set var):\n(set shouldBe):\n(set add):\n(mixed):\n* Source/JavaScriptCore/CMakeLists.txt:\n* Source/JavaScriptCore/DerivedSources-input.xcfilelist:\n* Source/JavaScriptCore/DerivedSources.make:\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/builtins/BuiltinNames.h:\n* Source/JavaScriptCore/builtins/MapIteratorPrototype.js: Removed.\n* Source/JavaScriptCore/builtins/SetIteratorPrototype.js: Removed.\n* Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.cpp:\n(JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):\n* Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h:\n* Source/JavaScriptCore/bytecode/LinkTimeConstant.h:\n* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h:\n(JSC::BytecodeGenerator::emitIsArrayIterator):\n(JSC::BytecodeGenerator::emitIsMapIterator): Deleted.\n(JSC::BytecodeGenerator::emitIsSetIterator): Deleted.\n* Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:\n(JSC::mapIteratorInternalFieldIndex): Deleted.\n(JSC::setIteratorInternalFieldIndex): Deleted.\n(JSC::BytecodeIntrinsicNode::emit_intrinsic_getMapIteratorInternalField): Deleted.\n(JSC::BytecodeIntrinsicNode::emit_intrinsic_getSetIteratorInternalField): Deleted.\n(JSC::BytecodeIntrinsicNode::emit_intrinsic_putMapIteratorInternalField): Deleted.\n(JSC::BytecodeIntrinsicNode::emit_intrinsic_putSetIteratorInternalField): Deleted.\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::ByteCodeParser::handleIntrinsicCall):\n* Source/JavaScriptCore/runtime/Intrinsic.h:\n* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:\n(JSC::JSGlobalObject::init):\n* Source/JavaScriptCore/runtime/JSMapIterator.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION): Deleted.\n* Source/JavaScriptCore/runtime/JSMapIterator.h:\n* Source/JavaScriptCore/runtime/JSSetIterator.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION): Deleted.\n* Source/JavaScriptCore/runtime/JSSetIterator.h:\n* Source/JavaScriptCore/runtime/MapIteratorPrototype.cpp:\n(JSC::MapIteratorPrototype::finishCreation):\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n* Source/JavaScriptCore/runtime/SetIteratorPrototype.cpp:\n(JSC::SetIteratorPrototype::finishCreation):\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n\nCanonical link: https://commits.webkit.org/315986@main",
      "email": "ysuzuki@apple.com",
      "hash": "b89710391cb5e6695d92f6dc06cd8ac4973a7355",
      "subject": "[JSC] Map/Set iterator next function should be in C++"
    },
    "315987@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "315987@main",
      "clUrl": "https://commits.webkit.org/315987@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318041\nrdar://180826671\n\nReviewed by Sosuke Suzuki.\n\nCurrently StringList optimization in YarrJIT is disabled when captures\nare existing inside it. But if we are using MatchOnly mode \u0026\nno-capture-related things exist, then we can still use this optimization\nsince captures do not matter.\n\nTo attach MatchOnly etc. on YarrPattern construction, we move\nJITCompileMode to ExecutionMode and use it in YarrPattern too, since\nYarr::CompileMode already exists.\n\nTest: JSTests/stress/regexp-stringlist-match-only-captures.js\n\n* JSTests/stress/regexp-stringlist-match-only-captures.js: Added.\n(shouldBe):\n(test):\n* Source/JavaScriptCore/runtime/RegExp.cpp:\n(JSC::RegExp::compile):\n(JSC::RegExp::compileMatchOnly):\n* Source/JavaScriptCore/yarr/Yarr.h:\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n(JSC::Yarr::jitCompile):\n(JSC::Yarr::jitCompileInlinedTest):\n* Source/JavaScriptCore/yarr/YarrJIT.h:\n* Source/JavaScriptCore/yarr/YarrPattern.cpp:\n(JSC::Yarr::YarrPatternConstructor::checkForTerminalParentheses):\n(JSC::Yarr::YarrPattern::YarrPattern):\n* Source/JavaScriptCore/yarr/YarrPattern.h:\n\nCanonical link: https://commits.webkit.org/315987@main",
      "email": "ysuzuki@apple.com",
      "hash": "5dcf3d0b5d41091683c70d6fbca6940a59fce539",
      "subject": "[YARR] Use StringList optimization when captures are not used"
    },
    "315988@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "315988@main",
      "clUrl": "https://commits.webkit.org/315988@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318051\nrdar://180836330\n\nReviewed by Alan Baradlay.\n\ndrawBoxSideFromPath() re-fetched document().deviceScaleFactor() up to four\ntimes per call (and the function recurses for double/groove/ridge borders),\nas flagged by an existing FIXME. Compute it once at the top of the function\nand reuse it.\n\n* Source/WebCore/rendering/BorderPainter.cpp:\n(WebCore::BorderPainter::drawBoxSideFromPath const):\n\nCanonical link: https://commits.webkit.org/315988@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "729d9bb358d1634a1e8fd98b2a824950b0efc441",
      "subject": "Cache deviceScaleFactor in BorderPainter::drawBoxSideFromPath"
    },
    "315989@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "315989@main",
      "clUrl": "https://commits.webkit.org/315989@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317822\n\nReviewed by Yusuke Suzuki.\n\nWhen a RegExp with named captures is exec'd, JSC builds the \"groups\"\nobject by starting from nullPrototypeObjectStructure and calling\nputDirect for each capture name. On every exec this incurs, per group:\na hash lookup in m_namedGroupToParenIndices (redundant when there are no\nduplicate names), an AtomString table intern via Identifier::fromString\n(m_captureGroupNames held non-atomic Strings), and a Structure\ntransition table lookup. The shape of the groups object is fixed by the\npattern, so all of this is repeated work.\n\nStore m_captureGroupNames as Vector\u003cAtomString\u003e, atomized once in\nRegExp::finishCreation. Skip subpatternIdForGroupName when\nm_numDuplicateNamedCaptureGroups is zero, since the answer is just the\nloop index. Add RegExp::ensureGroupsStructure which lazily builds the\nfinal {name0, name1, ...} Structure off nullPrototypeObjectStructure\nand caches it in RareData (re-created when the realm differs, or\nbypassed when the group count exceeds inline capacity). Callers then\nallocate the groups object with that Structure directly and fill values\nvia putDirectOffset.\n\n                                      TipOfTree                  Patched\n\nregexp-named-capture-exec          51.9984+-0.5105     ^     28.5615+-0.1432        ^ definitely 1.8206x faster\nregexp-named-capture-replace       44.1759+-0.3794     ^     29.3697+-0.3389        ^ definitely 1.5041x faster\n\nTests: JSTests/microbenchmarks/regexp-named-capture-exec.js\n       JSTests/microbenchmarks/regexp-named-capture-replace.js\n\n* JSTests/microbenchmarks/regexp-named-capture-exec.js: Added.\n(test):\n* JSTests/microbenchmarks/regexp-named-capture-replace.js: Added.\n(test.replacer):\n(test):\n* Source/JavaScriptCore/runtime/RegExp.cpp:\n(JSC::RegExp::finishCreation):\n(JSC::RegExp::visitChildrenImpl):\n(JSC::RegExp::ensureGroupsStructure):\n* Source/JavaScriptCore/runtime/RegExp.h:\n* Source/JavaScriptCore/runtime/RegExpMatchesArray.cpp:\n(JSC::createRegExpMatchesArrayWithGroupsOrIndices):\n* Source/JavaScriptCore/runtime/StringPrototype.cpp:\n(JSC::replaceUsingRegExpSearch):\n\nCanonical link: https://commits.webkit.org/315989@main",
      "email": "sosuke@bun.sh",
      "hash": "cae81af25d037bae6d8013d1be7cf946132ebf75",
      "subject": "[JSC] Cache named-capture \"groups\" Structure on RegExp"
    },
    "315990@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "315990@main",
      "clUrl": "https://commits.webkit.org/315990@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318002\n\nReviewed by Anne van Kesteren and Darin Adler.\n\nDeleteSelectionCommand::removePreviouslySelectedEmptyTableRows() has a final\nblock whose job is to remove the *end* table row itself when the deleted\nselection left it empty (and the caret is not landing inside it). The block was\nguarded by `endTableRow != m_startTableRow`, but a refactoring typo initialized\nthe local `endTableRow` from `m_startTableRow` instead of `m_endTableRow`. That\nmade the guard always false, so the block became dead code and an empty trailing\nrow was never removed.\n\nThis regressed in 295798@main (\"Reduce incorrect usage of protectedX() in dom\nand editing\"), which mechanically rewrote:\n```\n      auto endTableRow = protectedEndTableRow();   // returned m_endTableRow\n```\ninto:\n```\n      RefPtr endTableRow = m_startTableRow;         // wrong member\n```\nsilently substituting the start row for the end row.\n\nFix the local to be initialized from m_endTableRow, restoring the intended\nbehavior. Note this is only observable when the end row is already empty and\nfalls inside the selection (e.g. a trailing empty row), because table-spanning\ndeletes preserve the content of the boundary rows.\n\nTest: editing/deleting/delete-empty-end-table-row.html\n\n* LayoutTests/editing/deleting/delete-empty-end-table-row-expected.txt: Added.\n* LayoutTests/editing/deleting/delete-empty-end-table-row.html: Added.\n* Source/WebCore/editing/DeleteSelectionCommand.cpp:\n(WebCore::DeleteSelectionCommand::removePreviouslySelectedEmptyTableRows):\n\nCanonical link: https://commits.webkit.org/315990@main",
      "email": "cdumez@apple.com",
      "hash": "105fc9b52b9ae74666096a6289b9717abde65177",
      "subject": "DeleteSelectionCommand leaves an empty trailing table row behind after deletion"
    },
    "315991@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "315991@main",
      "clUrl": "https://commits.webkit.org/315991@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318062\nrdar://180857876\n\nReviewed by Eric Carlson.\n\nSwitch the FullRangeVideo read to dynamic_cf_cast\u003cCFBooleanRef\u003e for\ntype safety and consistency.\n\n* Source/WebCore/platform/graphics/avfoundation/FormatDescriptionUtilities.cpp:\n(WebCore::colorSpaceFromFormatDescription):\n\nCanonical link: https://commits.webkit.org/315991@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "a7d492cff5b4d03f5f58ea6c391aecdf3cd8a60c",
      "subject": "Use dynamic_cf_cast\u003cCFBooleanRef\u003e for the FullRangeVideo extension in colorSpaceFromFormatDescription()"
    },
    "315992@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "315992@main",
      "clUrl": "https://commits.webkit.org/315992@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318081\nrdar://180875738\n\nReviewed by Alan Baradlay.\n\nCorrect a batch of typos in identifier names (functions, locals, and\nnamespace labels) across WebCore rendering.\n\n* Source/WebCore/rendering/EventRegion.cpp:\n* Source/WebCore/rendering/EventRegion.h:\n(convertGuardContainersToInterationIfNeeded -\u003e convertGuardContainersToInteractionIfNeeded)\n* Source/WebCore/rendering/RenderBlock.cpp:\n* Source/WebCore/rendering/RenderBlock.h:\n(paddingBoxLogicaHeightChanged -\u003e paddingBoxLogicalHeightChanged)\n(paintInfoForChildred -\u003e paintInfoForChildren)\n(ensureLayoutDepentBoxPosition -\u003e ensureLayoutDependentBoxPosition)\n* Source/WebCore/rendering/RenderBlockFlow.cpp:\n(lastCHild -\u003e lastChild)\n* Source/WebCore/rendering/RenderLayerCompositor.cpp:\n* Source/WebCore/rendering/RenderLayerCompositor.h:\n(layerScrollBehahaviorRelativeToCompositedAncestor -\u003e layerScrollBehaviorRelativeToCompositedAncestor)\n* Source/WebCore/rendering/RenderLayerScrollableArea.cpp:\n(localDamgeRect -\u003e localDamageRect)\n* Source/WebCore/rendering/RenderSelection.cpp:\n(slectionEntry -\u003e selectionEntry)\n* Source/WebCore/rendering/RenderTableCell.cpp:\n(computedLogicaSize -\u003e computedLogicalSize)\n(righHalftCollapsedBorder -\u003e rightHalfCollapsedBorder)\n* Source/WebCore/rendering/RenderTableRow.cpp:\n(propagageNeedsLayoutOnBorderSizeChange -\u003e propagateNeedsLayoutOnBorderSizeChange)\n* Source/WebCore/rendering/svg/RenderSVGText.cpp:\n* Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp:\n* Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h:\n(buildLayoutAttributesForForSubtree -\u003e buildLayoutAttributesForSubtree)\n* Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp:\n(namespace Webcore -\u003e namespace WebCore)\n\nCanonical link: https://commits.webkit.org/315992@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "c47f0fb29a8d379bf1c0e7e7a4543f9828a51438",
      "subject": "Fix misspelled identifiers in rendering code"
    },
    "315993@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "315993@main",
      "clUrl": "https://commits.webkit.org/315993@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318057\nrdar://180838428\n\nReviewed by Yijia Huang.\n\nThis patch speeds up AirFixObviousSpills.\n\n1. Visiting order is changed with RPO and prioritizing RPO ordering.\n2. clobberDefs unifies repeated dipatching of forEachArg. Also skip\n   non-Spill StackSlot handling as we only care about spilled StackSlots\n   for stack locations.\n3. clobberAllDefs unifies repeated dispatching as well.\n4. If delta=0, use Move instead of `Add %x, $0, %y`.\n\n* Source/JavaScriptCore/b3/air/AirFixObviousSpills.cpp:\n\nCanonical link: https://commits.webkit.org/315993@main",
      "email": "ysuzuki@apple.com",
      "hash": "4bbaa640d0a2f431eab09958b3df0c0938aa640c",
      "subject": "[JSC] Optimize AirFixObviousSpills"
    },
    "315994@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "315994@main",
      "clUrl": "https://commits.webkit.org/315994@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318065\nrdar://180865497\n\nReviewed by Yusuke Suzuki.\n\nReplace the hand-rolled round-up expression in OutOfLineBits::create()\nwith WTF::roundUpToMultipleOf(). This is just clearer.\n\nMark bitsInPointer(), maxInlineBits(), and byteCount() as constexpr so\nthat the compile-time divisor template form\nroundUpToMultipleOf\u003cbitsInPointer()\u003e() can be used.\n\n* Source/WTF/wtf/BitVector.cpp:\n(WTF::BitVector::OutOfLineBits::create):\n* Source/WTF/wtf/BitVector.h:\n(WTF::BitVector::bitsInPointer):\n(WTF::BitVector::maxInlineBits):\n(WTF::BitVector::byteCount):\n\nCanonical link: https://commits.webkit.org/315994@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "4654057d5187d9ce28ad082559c95838c931cf2f",
      "subject": "Use WTF::roundUpToMultipleOf in BitVector::OutOfLineBits::create"
    },
    "315995@main": {
      "author": "Sihui Liu",
      "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64",
      "cl": "315995@main",
      "clUrl": "https://commits.webkit.org/315995@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317942\nrdar://179510110\n\nReviewed by Chris Dumez.\n\nCrash logs indicate the network process may terminate healthy web processes due to a failed message check in\nNetworkStorageManager::didFinishHandlingVersionChangeTransaction. The root cause is currently unclear. A suspected cause\nis that IDBOpenDBRequest::dispatchEvent sends DidFinishHandlingVersionChangeTransaction during an error event while the\ntransaction is neither finished nor finishing, specifically before abort or commit occurs. To confirm this, add error\nlogging and an early return in IDBOpenDBRequest::dispatchEvent so the web process does not send the message when the\ntransaction state is unexpected. Additionally, add logs in IDBTransaction to confirm abort or commit is properly invoked\nfor future debugging.\n\nOn the network process side, downgrade the MESSAGE_CHECK to a RELEASE_LOG_FAULT with an early return. This prevents the\nnetwork process from killing a healthy web process while the cause remains unconfirmed.\n\n* Source/WebCore/Modules/indexeddb/IDBOpenDBRequest.cpp:\n(WebCore::IDBOpenDBRequest::dispatchEvent):\n* Source/WebCore/Modules/indexeddb/IDBTransaction.cpp:\n(WebCore::IDBTransaction::abortInternal):\n(WebCore::IDBTransaction::commitInternal):\n* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp:\n(WebKit::NetworkStorageManager::didFinishHandlingVersionChangeTransaction):\n\nCanonical link: https://commits.webkit.org/315995@main",
      "email": "sihui_liu@apple.com",
      "hash": "932d0653a366987cfa98000102db17162a395263",
      "subject": "Relax IndexedDB version change transaction MESSAGE_CHECK to RELEASE_LOG_FAULT with early return"
    },
    "315996@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "315996@main",
      "clUrl": "https://commits.webkit.org/315996@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318003\n\nReviewed by Anne van Kesteren and Darin Adler.\n\nPer the File API \"read as text\" algorithm, the text encoding is determined in\nthe following order of precedence:\n  1. the explicit `encoding` argument, if it is a supported encoding;\n  2. otherwise, the `charset` parameter of the Blob's `type`, if present;\n  3. otherwise, UTF-8.\nSee the \"package data\" steps (Text case) in the specification:\nhttps://w3c.github.io/FileAPI/#blob-package-data\n\nWebKit implemented steps (1) and (3) but skipped (2): convertToText() hard-coded\n\"text/plain\" and only chose between the explicit encoding argument and UTF-8,\nnever consulting the Blob's type. As a result, reading a Blob whose type carries\na non-UTF-8 charset (e.g. `new Blob([bytes], { type: \"text/plain;charset=windows-1252\" })`)\nwith `FileReader.readAsText(blob)` (no encoding argument) decoded the data as\nUTF-8 instead of windows-1252, producing incorrect characters (U+FFFD).\n\nThis is a spec-conformance and interoperability bug: Firefox correctly honors the\nBlob type's charset, while WebKit and Chrome (which share the same FileReaderLoader\nheritage) both ignored it. This change brings WebKit in line with the specification\nand with Firefox. BOM detection continues to override the selected encoding, and an\nexplicit encoding argument still takes precedence over the Blob type's charset.\n\nFileReaderSync::readAsText() additionally never forwarded the Blob's type to the\nloader, so the synchronous reader could not honor the charset either; it now sets\nthe data type to match the asynchronous FileReader path.\n\nNote that Blob.text() is unaffected and remains UTF-8-only as required by its own\nspecification: it loads via BlobLoader, which never sets the loader's data type, so\nthe charset fallback resolves to UTF-8.\n\nTest: imported/w3c/web-platform-tests/FileAPI/reading-data-section/filereader_readAsText_blob_type_charset.any.js\n\n* Source/WebCore/fileapi/FileReaderLoader.cpp:\n(WebCore::FileReaderLoader::convertToText): Fall back to the charset parameter of\nthe Blob's type (m_dataType) when no valid explicit encoding was supplied, before\ndefaulting to UTF-8.\n\n* Source/WebCore/fileapi/FileReaderSync.cpp:\n(WebCore::FileReaderSync::readAsText): Forward the Blob's type to the loader so the\nsynchronous reader applies the same encoding-determination rules.\n\n* LayoutTests/imported/w3c/web-platform-tests/FileAPI/reading-data-section/filereader_readAsText_blob_type_charset.any.js: Added.\n* LayoutTests/imported/w3c/web-platform-tests/FileAPI/reading-data-section/filereader_readAsText_blob_type_charset.any.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/FileAPI/reading-data-section/filereader_readAsText_blob_type_charset.any.worker.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/FileAPI/reading-data-section/filereader_readAsText_blob_type_charset.any-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/FileAPI/reading-data-section/filereader_readAsText_blob_type_charset.any.worker-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/315996@main",
      "email": "cdumez@apple.com",
      "hash": "90c69edf1c0ebeef9a60ead6ad3e6cae9a19577a",
      "subject": "FileReader.readAsText() ignores the charset parameter of the Blob's type"
    },
    "315997@main": {
      "author": "Karl Dubost",
      "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64",
      "cl": "315997@main",
      "clUrl": "https://commits.webkit.org/315997@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=223597\nrdar://75969974\n\nReviewed by Wenson Hsieh.\n\nThe Clipboard API spec requires readText() to settle on a queued task,\nnot on the calling task.\n\n  Clipboard.readText() — step 3\n  https://w3c.github.io/clipboard-apis/#dom-clipboard-readtext\n\n  3. Run the following steps in parallel:\n     1. Let r be the result of running [check clipboard read permission].\n     2. If r is false, then queue a global task on the clipboard task\n        source ... reject p with \"NotAllowedError\" DOMException ...\n     3. Let data be a copy of the system clipboard data.\n     4. Queue a global task on the clipboard task source ... resolve p\n        with textString ...\n\nClipboard.read() has the same shape (#dom-clipboard-read).\n\nWebKit walked the pasteboard read synchronously and called\npromise-\u003eresolve() on the same call stack as the JS await. The promise\nsettled as a microtask of the calling task. Firefox and Chrome queue a\nreal task and settle later.\n\nThe user-visible symptom is the webcompat bug with a six-box OTP\ncomponent. It calls navigator.clipboard.readText() inside a paste handler\nthat does not preventDefault. Two writes race. The microtask resolve\nruns first and distributes \"123456\" to all six boxes. The native paste's\ninput event task then runs and a single-box state write clears boxes 2-6.\n\nFirefox and Chrome show the input event first, so distribution wins\nlast and all six boxes stay filled.\n\nTest: editing/async-clipboard/clipboard-read-text-resolves-after-input-event.html\n\n* LayoutTests/editing/async-clipboard/clipboard-read-text-resolves-after-input-event-expected.txt: Added.\n* LayoutTests/editing/async-clipboard/clipboard-read-text-resolves-after-input-event.html: Added.\n* Source/WebCore/Modules/async-clipboard/Clipboard.cpp:\n(WebCore::Clipboard::readText):\n(WebCore::Clipboard::read):\n* Source/WebCore/dom/TaskSource.h:\n\nCanonical link: https://commits.webkit.org/315997@main",
      "email": "karlcow@apple.com",
      "hash": "02741dfccee549e335bc3d542a0f5f851f9a153c",
      "subject": "Async Clipboard API should request paste access asynchronously"
    },
    "315998@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "315998@main",
      "clUrl": "https://commits.webkit.org/315998@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318094\nrdar://180889105\n\nReviewed by Chris Dumez.\n\nQuirks::needsConsistentQueryParameterFilteringQuirk() built a lowercased\ncopy of the URL (String::foldCase(), which allocates a new string) and\nre-parsed it into a URL before checking\nSettings::consistentQueryParameterFilteringQuirkEnabled(), which returns\nfalse in the common case and discards all of that work. The quirk is\nalso reached on every call to mayBenefitFromFingerprintingProtectionQuirk().\n\nMove the settings early-return ahead of the foldCase()/URL construction so\nthe allocation and parse only happen when the quirk is actually enabled.\nNo behavior change: the settings check does not depend on lowercaseURL, and\nthe function-local static wasLoggedOnce is unaffected by the reorder.\n\n* Source/WebCore/page/Quirks.cpp:\n\nCanonical link: https://commits.webkit.org/315998@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "e5c466e3ce900099323ab4a6ff06711af64287a3",
      "subject": "Avoid foldCase and URL re-parse when consistent query parameter filtering quirk is disabled"
    },
    "315999@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "315999@main",
      "clUrl": "https://commits.webkit.org/315999@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318084\n\nReviewed by Anne van Kesteren.\n\nWhen the user-agent parser encountered the \"Safari\" product token, it assigned the\nparsed version to BrowsersSeen::firefoxVersion instead of BrowsersSeen::safariVersion.\nThe safariVersion member was therefore never written, and was read back as the empty\nstring when the result was determined to be Safari, so navigator.userAgentData reported\nSafari with an empty browser version. As a secondary effect, a user-agent string listing\nboth Firefox and Safari products had its real Firefox version clobbered by the Safari\nproduct version.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/UserAgentStringParser.cpp\n\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/page/UserAgentStringParser.cpp:\n(WebCore::UserAgentStringParser::populateUserAgentData):\n* Source/WebCore/page/UserAgentStringParser.h:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebCore/UserAgentStringParser.cpp: Added.\n(TestWebKitAPI::parse):\n(TestWebKitAPI::TEST_F(UserAgentStringParserTest, SafariBrowserVersionIsReported)):\n(TestWebKitAPI::TEST_F(UserAgentStringParserTest, FirefoxVersionNotClobberedByTrailingSafariToken)):\n(TestWebKitAPI::TEST_F(UserAgentStringParserTest, ChromeBrowserVersionIsReported)):\n\nCanonical link: https://commits.webkit.org/315999@main",
      "email": "cdumez@apple.com",
      "hash": "bf4754390235b77cec6b3423764529a29eb4a252",
      "subject": "UserAgentStringParser stores the Safari product version into the wrong field"
    },
    "316000@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316000@main",
      "clUrl": "https://commits.webkit.org/316000@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318083\n\nReviewed by Alan Baradlay.\n\nremoveScrollerFromAnchorScrollAdjusters() range-iterates m_anchorScrollAdjusters\nand, for each adjuster invalidated by the scroller, calls\nunregisterAnchorScrollAdjusterFor(), which in turn calls removeFirstMatching()\non that same Vector. This was not safe.\n\n* Source/WebCore/page/LocalFrameViewLayoutContext.cpp:\n(WebCore::LocalFrameViewLayoutContext::removeScrollerFromAnchorScrollAdjusters):\n\nCanonical link: https://commits.webkit.org/316000@main",
      "email": "cdumez@apple.com",
      "hash": "e535d5008b4ad0faac481857b3c2fc0dc936d849",
      "subject": "LocalFrameViewLayoutContext::removeScrollerFromAnchorScrollAdjusters mutates m_anchorScrollAdjusters while iterating it"
    },
    "316001@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316001@main",
      "clUrl": "https://commits.webkit.org/316001@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314145\nrdar://176933795\n\nReviewed by Chris Dumez.\n\nA refresh (via \u003cmeta http-equiv=\"refresh\"\u003e or the HTTP Refresh header) whose\ntarget URL equals the current document's URL ignoring fragments, but adds or\nchanges the fragment identifier, is a same-document fragment navigation per the\nHTML \"navigate to a fragment\" step [1]. It must not issue a network request or emit\na new Referer header.\n\nScheduledRedirect::fire() decided whether the redirect was a \"refresh\" using\nequalIgnoringFragmentIdentifier(), which is true both for an identical URL and\nfor the same URL with a different fragment. In the latter case it wrongly forced\nResourceRequestCachePolicy::ReloadIgnoringCacheData, which makes\nFrameLoader::loadFrameRequest() pick FrameLoadType::Reload. Because\nshouldPerformFragmentNavigation() bails out for reloads, WebKit performed a full\nnetwork load of the fragment URL instead of an in-document scroll, sending a\nfresh Referer (the page's own URL) rather than preserving the original referrer.\n\nTreat the redirect as a same-document fragment navigation only when the refresh's\nown target URL carries a fragment that differs from the current document's\nfragment. The decision is made against the target captured at parse time, not\nagainst whatever fragment the user may have scrolled to afterward: a bare\n\u003cmeta http-equiv=\"refresh\"\u003e with no url= records a fragmentless target and must\nalways reload (preserving scroll restoration) even if the document's current URL\nhas since gained a fragment via location.assign('#1'). Only when the target\nitself adds or changes the fragment does the redirect flow as a Standard\nnavigation so shouldPerformFragmentNavigation() performs the same-document scroll\nwith the referrer unchanged.\n\n[1] https://html.spec.whatwg.org/multipage/browsing-the-web.html#navigate-fragid-step\n\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/refresh/same-document-refresh-expected.txt: Progression.\n* Source/WebCore/loader/NavigationScheduler.cpp:\n(WebCore::ScheduledRedirect::fire):\n\nCanonical link: https://commits.webkit.org/316001@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "d860ee92dac3d25b07d1315cc5ad860f54944135",
      "subject": "Meta refresh to URL with different fragment identifier should not be treated as a page reload"
    },
    "316002@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316002@main",
      "clUrl": "https://commits.webkit.org/316002@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318095\nrdar://180889276\n\nReviewed by Chris Dumez.\n\nThe embedded YouTube case in Quirks::triggerOptionalStorageAccessQuirk()\nhad two redundant checks:\n\n- The class-name test was \"X || X\": it called\n  element.hasClassName(\"ytp-watch-later-icon\") twice, OR'd together.\n- It re-tested ResourceLoadObserver::hasHadUserInteraction(youTubeDomain)\n  inside the block, even though the enclosing if already requires that\n  same condition to be true.\n\nBecause both the inner and outer paths return ShouldNotCancelEvent, the\nwhole branch collapses to: request document storage access when the\nelement has the watch-later icon class, then return ShouldNotCancelEvent.\nSimplified accordingly. No behavior change.\n\n* Source/WebCore/page/Quirks.cpp:\n\nCanonical link: https://commits.webkit.org/316002@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "9bb8e303b0b4e30586b3bc6229df8342f29f32b2",
      "subject": "Remove redundant duplicate checks in Quirks embedded YouTube storage access branch"
    },
    "316003@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316003@main",
      "clUrl": "https://commits.webkit.org/316003@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318101\nrdar://180894857\n\nReviewed by Chris Dumez.\n\nhandleTMobileQuirks() compared the host StringView returned by URL::host()\nagainst a bare const char* literal, which takes the strlen-based comparison\npath. Use an ASCIILiteral (_s) operand so the length-aware comparison is\nused, matching the convention used by the other host comparisons in the\nquirk handlers. No behavior change.\n\n* Source/WebCore/page/Quirks.cpp:\n\nCanonical link: https://commits.webkit.org/316003@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "3510b2d8216c23d016a1f27b5c2896356091dd5c",
      "subject": "Use an _s literal for the host comparison in Quirks::handleTMobileQuirks"
    },
    "316004@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316004@main",
      "clUrl": "https://commits.webkit.org/316004@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318082\nrdar://180876883\n\nReviewed by Rob Buis.\n\nIn prepareToRenderSVGContent() the inner `if` guarding the transparency\nlayer setup tested the exact same condition as the enclosing `if`\n(opacity \u003c 1 || hasBlendMode || isolateMaskForBlending || hasIsolation).\nThe inner check can never be false when reached, so it was dead code.\n\nRemove the redundant nested condition. No behavior change.\n\n* Source/WebCore/rendering/svg/SVGRenderingContext.cpp:\n(WebCore::SVGRenderingContext::prepareToRenderSVGContent):\n\nCanonical link: https://commits.webkit.org/316004@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "13a6b1ddfcb06175ad207b80ce914ea76963901d",
      "subject": "[SVG] Remove redundant duplicate condition in SVGRenderingContext::prepareToRenderSVGContent"
    },
    "316005@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316005@main",
      "clUrl": "https://commits.webkit.org/316005@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318097\nrdar://180889792\n\nReviewed by Chris Dumez.\n\nQuirks::needsCustomUserAgentOverride() called hostDomain.string() once per\ncomparison and compared the result against bare const char* literals, which\ntake String's operator==(const char*) path (a runtime strlen plus per-byte\ncompare). Bind the registrable domain string once (RegistrableDomain::string()\nreturns a const String\u0026 reference) and compare against ASCIILiteral (_s)\noperands, which carry their length and use the length-aware comparison. No\nbehavior change.\n\n* Source/WebCore/page/Quirks.cpp:\n\nCanonical link: https://commits.webkit.org/316005@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "7788a48f2c2316d68a110cbbe2afb98b6fb5160e",
      "subject": "Cache the registrable domain string and use _s literals in Quirks::needsCustomUserAgentOverride"
    },
    "316007@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316007@main",
      "clUrl": "https://commits.webkit.org/316007@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318102\nrdar://180895252\n\nReviewed by Chris Dumez.\n\ntriggerOptionalStorageAccessIframeQuirk() built RegistrableDomain { frameURL }\ntwice on the path where the quirk fires: once for the\nsubFrameDomainsForStorageAccessQuirk().contains() test and again as the\nargument to requestStorageAccessForNonDocumentQuirk(). Constructing a\nRegistrableDomain performs a public-suffix-list (PSL) lookup, so this did\nthe work twice for the same URL.\n\nHoist a single RegistrableDomain local, reuse it for contains(), and\nWTF::move() it into the call (also saving a copy). The surrounding block\nalready constructs RegistrableDomain { document-\u003eurl() } unconditionally for\nthe isProbablyGoogleCCTLD check, so this does not introduce PSL work on an\notherwise-cold path. No behavior change.\n\n* Source/WebCore/page/Quirks.cpp:\n\nCanonical link: https://commits.webkit.org/316007@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "7429b2822b74a3a85823d06460044593f1514fe1",
      "subject": "Avoid constructing the frame RegistrableDomain twice in Quirks::triggerOptionalStorageAccessIframeQuirk"
    },
    "316008@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316008@main",
      "clUrl": "https://commits.webkit.org/316008@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318098\n\nReviewed by Anne van Kesteren.\n\nContentSecurityPolicySourceList::parseNonceSource() and parseHashSource()\nverified that the byte at the current position was the closing quote, but never\nverified that the quote was the *last* character of the source expression. Both\ntake their StringParsingBuffer by value, and the caller discards the buffer on a\ntrue return, so any trailing characters were silently ignored. As a result a\nmalformed token such as\n```\n      script-src 'nonce-abc'X\n      script-src 'sha256-\u003cbase64\u003e='X\n```\nwas accepted as the valid nonce/hash 'nonce-abc' / 'sha256-\u003cbase64\u003e=', instead\nof being treated as an invalid source expression and dropped.\n\nPer the CSP3 grammar, nonce-source (\"'nonce-\" base64-value \"'\") and hash-source\n(\"'\" hash-algorithm \"-\" base64-value \"'\") must match a source-expression token\nin its entirety; a token with characters after the closing quote is invalid and\nmust be ignored during parsing. The non-quoted host/scheme/port/path path\nalready enforces this by requiring buffer.atEnd(), so the laxity was unique to\nthe quoted forms.\n\nThis aligns WebKit with Blink and Gecko, both of which reject these malformed\ntokens.\n\nConsume the closing quote with skipExactly() and require buffer.atEnd()\nafterwards, rejecting the source expression if any characters remain.\n\nTest: imported/w3c/web-platform-tests/content-security-policy/script-src/nonce-with-trailing-characters-blocked.html\n\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/nonce-with-trailing-characters-blocked-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/nonce-with-trailing-characters-blocked.html: Added.\n* Source/WebCore/page/csp/ContentSecurityPolicySourceList.cpp:\n(WebCore::ContentSecurityPolicySourceList::parseNonceSource):\n(WebCore::ContentSecurityPolicySourceList::parseHashSource):\n\nCanonical link: https://commits.webkit.org/316008@main",
      "email": "cdumez@apple.com",
      "hash": "3df73f1f9e3a5a8c5ed3891b5a4c35c8a2c95d4e",
      "subject": "CSP: nonce-source and hash-source must reject trailing characters after the closing quote"
    },
    "316009@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "316009@main",
      "clUrl": "https://commits.webkit.org/316009@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318077\nrdar://180872630\n\nReviewed by Sosuke Suzuki.\n\n@speciesConstructor was the only remaining function, and now all users\nof this are removed. Let's remove this file.\n\n* Source/JavaScriptCore/CMakeLists.txt:\n* Source/JavaScriptCore/DerivedSources-input.xcfilelist:\n* Source/JavaScriptCore/DerivedSources.make:\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/builtins/GlobalOperations.js: Removed.\n\nCanonical link: https://commits.webkit.org/316009@main",
      "email": "ysuzuki@apple.com",
      "hash": "1157dacf46843691a7bb9789808576974c8552cf",
      "subject": "[JSC] Remove GlobalOperations.js"
    },
    "316010@main": {
      "author": "David Stockley",
      "avatar": "https://www.gravatar.com/avatar/5a738bfcc4f0757e492ca6a792ef27f8?d=identicon\u0026s=64",
      "cl": "316010@main",
      "clUrl": "https://commits.webkit.org/316010@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315855\nrdar://172481255\n\nReviewed by Abrar Rahman Protyasha.\n\nWith Delegated Apple Pay, merchant sessions are created via a dedicated\ndelegatedSession endpoint, rather than the standard paymentSession endpoint.\nWhen a payment request is a delegated request, WebKit was still asking PassKit for\nthe non-delegated merchant URL, so the validationURL surfaced to the\nonvalidatemerchant event was wrong.\n\nPassKit added +paymentServicesMerchantURLForAPIType:isDelegated:completion:\nso that callers can indicate whether the request is delegated and get the correct\nendpoint back. The new selector is only present in newer versions of PassKit, so its\navailability is checked with a new `HAVE_PASSKIT_PAYMENT_SERVICES_MERCHANT_URL_IS_DELEGATED` macro.\n\n* Source/WTF/wtf/PlatformHave.h:\n* Source/WebCore/PAL/pal/spi/cocoa/PassKitSPI.h:\n* Source/WebKit/Configurations/AllowedSPI-legacy.toml:\n* Source/WebKit/Configurations/AllowedSPI.toml:\n* Source/WebKit/Platform/cocoa/PaymentAuthorizationViewController.mm:\n(-[WKPaymentAuthorizationViewControllerDelegate _getPaymentServicesMerchantURL:]):\n* Source/WebKit/Platform/ios/PaymentAuthorizationController.mm:\n(-[WKPaymentAuthorizationControllerDelegate _getPaymentServicesMerchantURL:]):\n\nCanonical link: https://commits.webkit.org/316010@main",
      "email": "stockley@apple.com",
      "hash": "69ab3832ce6b7d0e8ebf7a0a3223a1700df4a662",
      "subject": "Support returning \"delegatedSession\" endpoint name for Delegated Requests"
    },
    "316011@main": {
      "author": "Philippe Normand",
      "avatar": "https://www.gravatar.com/avatar/eef27203750af3510263cc29af21a16e?d=identicon\u0026s=64",
      "cl": "316011@main",
      "clUrl": "https://commits.webkit.org/316011@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317866\n\nReviewed by Xabier Rodriguez-Calvar.\n\nBuild GstVideoInfoDmaDrm for DRM caps and translate them to traditional GstVideoInfo when needed in\norder to avoid colorspace chroma-site validation issues.\n\n* Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.cpp:\n(WebCore::getVideoSizeAndFormatFromCaps):\n(WebCore::getVideoResolutionFromCaps):\n(WebCore::getSampleVideoInfo):\n(WebCore::GstMappedFrame::GstMappedFrame):\n(WebCore::videoColorSpaceFromCaps):\n* Source/WebCore/platform/graphics/gstreamer/VideoFrameGStreamer.cpp:\n(WebCore::VideoFrameGStreamer::infoFromCaps):\n\nCanonical link: https://commits.webkit.org/316011@main",
      "email": "philn@igalia.com",
      "hash": "97ff7579360cff11f3e08931d8c06f22a3d877d4",
      "subject": "[GStreamer] Chroma site validation failing for DMABuf caps"
    },
    "316012@main": {
      "author": "Philippe Normand",
      "avatar": "https://www.gravatar.com/avatar/eef27203750af3510263cc29af21a16e?d=identicon\u0026s=64",
      "cl": "316012@main",
      "clUrl": "https://commits.webkit.org/316012@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317917\n\nReviewed by Xabier Rodriguez-Calvar.\n\nWhen the ICE agent is given a valid GstPromise while closing connections, it should wait on its\ncompletion, otherwise a warning will be raised during the agent disposal because the promise result\nwould still be pending.\n\n* Source/WebCore/Modules/mediastream/gstreamer/GStreamerIceAgent.cpp:\n(webkitGstWebRTCIceAgentClose):\n\nCanonical link: https://commits.webkit.org/316012@main",
      "email": "philn@igalia.com",
      "hash": "01ddbb16534e71aaefff85fe7045f8b357885d8c",
      "subject": "[GStreamer][WebRTC] GstPromise warning raised after handling cloudflare bot check and before loading frame.work"
    },
    "316013@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "316013@main",
      "clUrl": "https://commits.webkit.org/316013@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318089\n\nReviewed by Yusuke Suzuki.\n\nRegExpSearchIntrinsic, RegExpTestIntrinsic, and PromisePrototypeCatchIntrinsic\nguard the receiver with Check(RegExpObjectUse / PromiseObjectUse) but never\nconsult the BadType exit profile, unlike their siblings (RegExpMatchIntrinsic,\nRegExpSplitIntrinsic, PromisePrototypeThenIntrinsic).\n\nTests: JSTests/stress/promise-prototype-catch-on-non-promise.js\n       JSTests/stress/regexp-prototype-symbol-search-on-non-regexp.js\n       JSTests/stress/regexp-prototype-test-on-non-regexp.js\n\n* JSTests/stress/promise-prototype-catch-on-non-promise.js: Added.\n(callCatch):\n(fake.then):\n* JSTests/stress/regexp-prototype-symbol-search-on-non-regexp.js: Added.\n(search):\n(fake.exec):\n* JSTests/stress/regexp-prototype-test-on-non-regexp.js: Added.\n(test):\n(fake.exec):\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::ByteCodeParser::handleIntrinsicCall):\n\nCanonical link: https://commits.webkit.org/316013@main",
      "email": "sosuke@bun.sh",
      "hash": "bf1915b95bd382bc5c1b714b78e9c9ab24ffb0b5",
      "subject": "[JSC] Add missing exit-profile bails to some DFG nodes"
    },
    "316014@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "316014@main",
      "clUrl": "https://commits.webkit.org/316014@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318058\n\nReviewed by Yusuke Suzuki.\n\nThe Array.from(arguments) fast path allocates a contiguous butterfly sized from the\narguments' length, but ClonedArguments' length is a writable own data property, so a\nuser-controlled value above MAX_STORAGE_VECTOR_LENGTH reaches\nIndexingHeader::setVectorLength and crashes on its RELEASE_ASSERT. Bail out to the\ngeneric Array.from path instead, as fastFlat already does.\n\n    'use strict';\n    function target() {\n        arguments.length = 0x10000001;\n        return Array.from(arguments);\n    }\n    target(1, 2, 3);\n\nTest: JSTests/stress/array-from-cloned-arguments-large-length.js\n\n* JSTests/stress/array-from-cloned-arguments-large-length.js: Added.\n(target):\n(catch):\n* Source/JavaScriptCore/runtime/ArrayConstructor.cpp:\n(JSC::tryCreateArrayFromArguments):\n\nCanonical link: https://commits.webkit.org/316014@main",
      "email": "sosuke@bun.sh",
      "hash": "fc179bd61c6cefb22988f84532515cff802cca0f",
      "subject": "[JSC] `Array.from(arguments)` fast path should bail out when length exceeds `MAX_STORAGE_VECTOR_LENGTH`"
    },
    "316015@main": {
      "author": "Diego Pino Garcia",
      "avatar": "https://www.gravatar.com/avatar/e8cce88637f1a6e79155e8371e24b2e8?d=identicon\u0026s=64",
      "cl": "316015@main",
      "clUrl": "https://commits.webkit.org/316015@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318107\n\nUnreviewed build fix.\n\nWork around clang-18 internal compiler error by replacing implicit lambda\ncapture with an explicit capture list.\n\n* Source/WebCore/rendering/svg/SVGRenderSupport.cpp:\n(WebCore::SVGRenderSupport::applyStrokeStyleToContext):\n\nCanonical link: https://commits.webkit.org/316015@main",
      "email": "dpino@igalia.com",
      "hash": "2173ca9c0c3e91af3259de9f68bd1dfa51384823",
      "subject": "[WPE] Build broken with clang-18"
    },
    "316016@main": {
      "author": "Carlos Alberto Lopez Perez",
      "avatar": "https://www.gravatar.com/avatar/05326c1dbe06f486e884975e73f25179?d=identicon\u0026s=64",
      "cl": "316016@main",
      "clUrl": "https://commits.webkit.org/316016@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318110\n\nUnreviewed gardening.\n\nThe test Bindings/insert-img-with-src.html fails because it prints\nto stdout an error related to not beeing able to access an external\nURL. In this case we simply skip the test instead of filtering that\nmessage beacause this test can't be benchmarked with the current\nrun-perf-test/WTR infrastructure because it needs to load some\ncontent filter rules to be able to meaningfully run the benchmark,\nand that is currently not supported.\n\nThe other two tests CSS/WhereIs*RuleIndexing.html test are generating\nlot of elements with the text \"x\" that later is dumped to stdout when\nthe test runner executes testRunner.dumpAsText(); and that confuses\nthe python tooling. In this case the fix chosen is to simply filter\nout lines containing only \"x\" as character (which is clearly garbage\nand not an indication of any error). Instead of doing that it was\ntested to remove the \"el.textContent = 'x';\" line from the tests,\nbut then the test gives different benchmark results, so to not\ninvalidate previous benchmark data results it is preferred to not\ntouch the test.\n\n* PerformanceTests/Skipped:\n* Tools/Scripts/webkitpy/performance_tests/perftest.py:\n(PerfTest):\n\nCanonical link: https://commits.webkit.org/316016@main",
      "email": "clopez@igalia.com",
      "hash": "02ce2969afb1e2ddc9361ff0f837a7ec3e2febee",
      "subject": "3 Performance tests are failing on GTK-Linux-64-bit-Release-Perf bot."
    },
    "316017@main": {
      "author": "Basuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/5192a1151c7575317affb7a4633f8d63?d=identicon\u0026s=64",
      "cl": "316017@main",
      "clUrl": "https://commits.webkit.org/316017@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318015\nrdar://180813822\n\nReviewed by Sihui Liu.\n\nUnder UseUIProcessForBackForwardItemLoading, WebPageProxy::dispatchPerFrameTraversals walks\nthe (from, to) back/forward frame trees and pairs each target child frame with a source child\nby frameID, falling back to position. When a back/forward entry's child frame tree carries a\nduplicated frameID — an unaffected sibling iframe that inherited the navigated frame's\nframeID — childItemForFrameID resolves two distinct target children to the same source child.\nThe walk then dispatches a second per-frame GoToBackForwardItem to the same live frame; the\nsecond message (same navigationID) supersedes the first, so the intended iframe navigation is\nlost and the back/forward action hangs.\n\nThis surfaces as a flaky ~33s timeout in SiteIsolation.NavigateFrameWithSiblingsBackForward on\napi-mac / api-mac-debug: navigating one of two sibling iframes and then going back/forward\nintermittently records the unaffected sibling with the navigated frame's frameID, so the\nforward traversal dispatches GoToBackForwardItem twice to the same frame and the expected\nnavigation never completes.\n\nFix: pair each source child with at most one target child. When the frameID-resolved source\nchild is already paired, fall back to position to recover the correct sibling, so a duplicated\nframeID can no longer route two target frames to the same live frame.\n\nThe underlying capture-side bug (a sibling inheriting another frame's frameID when the\nback/forward frame tree is recorded) is a separate, deeper issue in the same area as the\nBF-tree frameID staleness work; this change is a defensive guard in the walk.\n\nCovered by existing tests (SiteIsolation.NavigateFrameWithSiblingsBackForward, previously\nflaky; 50/50 iterations pass with this change).\n\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::dispatchPerFrameTraversals):\n\nCanonical link: https://commits.webkit.org/316017@main",
      "email": "basuke@apple.com",
      "hash": "60a8b5a259e838abb0c91565b594acc37dff175b",
      "subject": "[Site Isolation] Per-frame back/forward walk dispatches a duplicate traversal to one live frame, clobbering the iframe navigation"
    },
    "316018@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "316018@main",
      "clUrl": "https://commits.webkit.org/316018@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318016\n\nReviewed by Antti Koivisto.\n\nRenderBox::size() returns the border box size, but the bare name doesn't say so.\nCallers that wanted an unambiguous \"border box\" accessor were routing\nthrough borderBoxRect().size() instead of trusting size().\nName it for what it is, matching the existing borderBoxLogicalSize()/contentBoxSize() vocabulary.\n\nNo behavior change.\n\n* Source/WebCore/editing/TextIterator.cpp:\n(WebCore::fullyClipsContents):\n* Source/WebCore/html/shadow/SliderThumbElement.cpp:\n(WebCore::SliderThumbElement::setPositionFromPoint):\n* Source/WebCore/layout/integration/LayoutIntegrationBoxGeometryUpdater.cpp:\n(WebCore::LayoutIntegration::BoxGeometryUpdater::formattingContextConstraints):\n* Source/WebCore/layout/integration/LayoutIntegrationFormattingContextLayout.cpp:\n(WebCore::LayoutIntegration::populateRootRendererWithFloatsFromIFC):\n* Source/WebCore/layout/layouttree/LayoutTreeBuilder.cpp:\n(WebCore::Layout::printLayoutTreeForLiveDocuments):\n* Source/WebCore/page/IntersectionObserver.cpp:\n(WebCore::IntersectionObserver::computeIntersectionState const):\n* Source/WebCore/page/LocalFrameView.cpp:\n(WebCore::LocalFrameView::baseLayoutViewportSize const):\n* Source/WebCore/rendering/AccessibilityRegionContext.cpp:\n(WebCore::AccessibilityRegionContext::takeBounds):\n* Source/WebCore/rendering/BackgroundPainter.cpp:\n(WebCore::BackgroundPainter::calculateFillLayerImageGeometryImpl):\n* Source/WebCore/rendering/GridBaselineAlignment.cpp:\n(WebCore::GridBaselineAlignment::ascentForGridItem const):\n* Source/WebCore/rendering/OutlinePainter.cpp:\n(WebCore::OutlinePainter::collectFocusRingRects):\n(WebCore::OutlinePainter::collectFocusRingRectsForBlock):\n* Source/WebCore/rendering/RenderAttachment.cpp:\n(WebCore::RenderAttachment::layoutWideLayoutAttachmentOnly):\n* Source/WebCore/rendering/RenderBlock.cpp:\n(WebCore::RenderBlock::paintObject):\n(WebCore::RenderBlock::nodeAtPoint):\n(WebCore::RenderBlock::boundingRects const):\n(WebCore::RenderBlock::absoluteQuads const):\n* Source/WebCore/rendering/RenderBlock.h:\n(WebCore::RenderBlock::logicalSizeForChild const):\n* Source/WebCore/rendering/RenderBlockFlow.cpp:\n(WebCore::RenderBlockFlow::layoutBlock):\n* Source/WebCore/rendering/RenderBox.cpp:\n(WebCore::RenderBox::boundingRects const):\n(WebCore::RenderBox::paintMask):\n(WebCore::RenderBox::paintClippingMask):\n(WebCore::RenderBox::clipToPaddingBoxShape const):\n(WebCore::RenderBox::clipToContentBoxShape const):\n(WebCore::RenderBox::flipForWritingMode const):\n* Source/WebCore/rendering/RenderBox.h:\n(WebCore::RenderBox::borderBoxSize const):\n(WebCore::RenderBox::setBorderBoxSize):\n(WebCore::RenderBox::borderBoxRect const):\n(WebCore::RenderBox::size const): Deleted.\n(WebCore::RenderBox::setSize): Deleted.\n* Source/WebCore/rendering/RenderBoxInlines.h:\n(WebCore::RenderBox::setLogicalSize):\n(WebCore::RenderBox::marginBoxRect const):\n* Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp:\n(WebCore::RenderDeprecatedFlexibleBox::layoutBlock):\n* Source/WebCore/rendering/RenderElement.cpp:\n(WebCore::RenderElement::getTrailingCorner const):\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::mainAxisExtentForFlexItem const):\n(WebCore::RenderFlexibleBox::crossAxisExtent const):\n(WebCore::RenderFlexibleBox::mainAxisExtent const):\n(WebCore::RenderFlexibleBox::performFlexLayout):\n* Source/WebCore/rendering/RenderFragmentedFlow.cpp:\n(WebCore::RenderFragmentedFlow::absoluteQuadsForBox const):\n(WebCore::RenderFragmentedFlow::boxIsFragmented const):\n* Source/WebCore/rendering/RenderGrid.cpp:\n(WebCore::RenderGrid::layoutGrid):\n(WebCore::RenderGrid::layoutMasonry):\n* Source/WebCore/rendering/RenderImage.cpp:\n(WebCore::RenderImage::paintMissingImageState const):\n(WebCore::RenderImage::paintAreaElementFocusRing):\n* Source/WebCore/rendering/RenderListMarker.cpp:\n(WebCore::RenderListMarker::localSelectionRect):\n(WebCore::RenderListMarker::paint):\n* Source/WebCore/rendering/RenderMedia.cpp:\n(WebCore::RenderMedia::layout):\n* Source/WebCore/rendering/RenderReplaced.cpp:\n(WebCore::RenderReplaced::paint):\n(WebCore::RenderReplaced::localSelectionRect const):\n* Source/WebCore/rendering/RenderTable.cpp:\n(WebCore::RenderTable::paintObject):\n(WebCore::RenderTable::paintBoxDecorations):\n(WebCore::RenderTable::paintMask):\n(WebCore::RenderTable::nodeAtPoint):\n* Source/WebCore/rendering/RenderTableCell.cpp:\n(WebCore::backgroundRectForSection):\n(WebCore::RenderTableCell::paintBackgroundsBehindCell):\n* Source/WebCore/rendering/RenderTableRow.cpp:\n(WebCore::RenderTableRow::paintOutlineForRowIfNeeded):\n(WebCore::RenderTableRow::paintShadowForRowIfNeeded):\n* Source/WebCore/rendering/RenderTableSection.cpp:\n(WebCore::RenderTableSection::paint):\n(WebCore::RenderTableSection::paintRowGroupBorderIfRequired):\n* Source/WebCore/rendering/RenderTextControlSingleLine.cpp:\n(WebCore::RenderTextControlSingleLine::layout):\n* Source/WebCore/rendering/RenderVTTCue.cpp:\n(WebCore::RenderVTTCue::switchDirection):\n* Source/WebCore/rendering/RenderView.cpp:\n(WebCore::RenderView::viewRect const):\n* Source/WebCore/rendering/RenderWidget.cpp:\n(WebCore::RenderWidget::paint):\n* Source/WebCore/rendering/shapes/ShapeOutsideInfo.cpp:\n(WebCore::computeLogicalBoxSize):\n* Source/WebCore/rendering/svg/RenderSVGBlock.cpp:\n(WebCore::RenderSVGBlock::boundingRects const):\n(WebCore::RenderSVGBlock::absoluteQuads const):\n* Source/WebCore/rendering/svg/RenderSVGRoot.cpp:\n(WebCore::RenderSVGRoot::updateLayoutSizeIfNeeded):\n(WebCore::RenderSVGRoot::paintObject):\n(WebCore::RenderSVGRoot::nodeAtPoint):\n* Source/WebCore/rendering/svg/RenderSVGText.cpp:\n(WebCore::RenderSVGText::updatePositionAndOverflow):\n* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGRoot.cpp:\n(WebCore::LegacyRenderSVGRoot::layout):\n(WebCore::LegacyRenderSVGRoot::nodeAtPoint):\n\nCanonical link: https://commits.webkit.org/316018@main",
      "email": "zalan@apple.com",
      "hash": "15357d6483551fcdbbebf319b1ab57f261fa9525",
      "subject": "[cleanup] Rename RenderBox::size()/setSize() to borderBoxSize()/setBorderBoxSize()"
    },
    "316019@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "316019@main",
      "clUrl": "https://commits.webkit.org/316019@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318017\n\nReviewed by Antti Koivisto.\n\n* Source/WebCore/page/ResizeObservation.cpp:\n(ResizeObservation::computeObservedSizes):\n* Source/WebCore/rendering/RenderBox.h:\n* Source/WebCore/rendering/RenderBoxInlines.h:\n(RenderBox::borderBoxLogicalSize): Deleted.\n\nCanonical link: https://commits.webkit.org/316019@main",
      "email": "zalan@apple.com",
      "hash": "995552cbaa0758d67516fa8840f45b248ce77b0a",
      "subject": "[cleanup] Remove redundant RenderBox::borderBoxLogicalSize"
    },
    "316020@main": {
      "author": "Jean-Yves Avenard",
      "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64",
      "cl": "316020@main",
      "clUrl": "https://commits.webkit.org/316020@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318005\nrdar://180803445\n\nReviewed by Youenn Fablet.\n\nFollowing 315910@main and 315963@main MediaContainment is now always active,\nregardless of the value of the preference and demuxing always occurs in\nthe content process. We can remove the preference and its use.\n\nFly-by: clean-up a bit the handling of engine scope selection.\n\n* LayoutTests/ipc/media-containment-bypass-create-player.html:\n* LayoutTests/media/media-source/media-managedmse-aac-shared-format.html:\n* LayoutTests/media/media-source/media-managedmse-adts-aac-remove.html:\n* LayoutTests/media/media-source/media-managedmse-adts-aac.html:\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebCore/Modules/mediasource/MediaSource.cpp:\n(WebCore::MediaSource::createSourceBufferPrivate):\n* Source/WebCore/platform/graphics/MediaPlayer.cpp:\n(WebCore::MediaPlayer::mediaEngine):\n* Source/WebCore/platform/graphics/MediaPlayer.h:\n(WebCore::MediaPlayerFactory::supportedScope const):\n* Source/WebCore/platform/graphics/MediaPlayerEnums.h:\n* Source/WebCore/platform/graphics/MediaSourceConfiguration.h:\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:\n* Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferParserAVFObjC.mm:\n(WebCore::SourceBufferParserAVFObjC::SourceBufferParserAVFObjC):\n* Source/WebCore/platform/graphics/cocoa/MediaPlayerPrivateWebM.mm:\n* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.cpp:\n(WebKit::GPUConnectionToWebProcess::canDecodeExtendedType const):\n* Source/WebKit/GPUProcess/media/RemoteMediaPlayerManagerProxy.cpp:\n(WebKit::RemoteMediaPlayerManagerProxy::playbackEngineForConnection const):\n* Source/WebKit/Shared/WebCoreArgumentCodersMedia.serialization.in:\n\nCanonical link: https://commits.webkit.org/316020@main",
      "email": "jya@apple.com",
      "hash": "c76e79654cc0ce12d8995b92b5378bbecd669702",
      "subject": "MediaContainmentEnabled preference is now dead code."
    },
    "316021@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316021@main",
      "clUrl": "https://commits.webkit.org/316021@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318071\nrdar://180869510\n\nReviewed by Lily Spiniolas.\n\ncolorWithTargetLuminance() called std::clamp(0.f, targetLuminance, 1.f),\nwhich clamps the constant 0 into the range [targetLuminance, 1] rather\nthan clamping targetLuminance into [0, 1]. For a targetLuminance greater\nthan 1 this violates std::clamp()'s lo \u003c= hi precondition (undefined\nbehavior) and yields an out-of-range luminance; the only saving grace is\nthat the sole caller currently passes a fixed 0.5, masking the bug.\n\nPass the arguments in the correct order so targetLuminance is clamped to\nthe valid [0, 1] range.\n\n* Source/WebCore/rendering/cocoa/RenderThemeCocoa.mm:\n(WebCore::colorWithTargetLuminance):\n\nCanonical link: https://commits.webkit.org/316021@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "41dcbb4310386635ed1cac662e25346e1f0a0e8e",
      "subject": "colorWithTargetLuminance() passes std::clamp() arguments in the wrong order"
    },
    "316022@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316022@main",
      "clUrl": "https://commits.webkit.org/316022@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318072\nrdar://180869927\n\nReviewed by Lily Spiniolas.\n\nIn the horizontal writing-mode branch of RenderThemeCocoa's concentric\ncorner-radius computation, canBeConcentric compared inlineDistance against\ntopDistance twice, never checking bottomDistance. A control whose inner\nbutton had unequal top and bottom insets could therefore be incorrectly\ntreated as concentric.\n\nCompare against bottomDistance for the second check.\n\n* Source/WebCore/rendering/cocoa/RenderThemeCocoa.mm:\n(WebCore::cornerRadiusForConcentricTextBasedControl):\n\nCanonical link: https://commits.webkit.org/316022@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "cb53eb3c0066e97618a2b01593898a8ee18e7aee",
      "subject": "Concentric inner-button corner radius check ignores bottom inset for horizontal text controls"
    },
    "316023@main": {
      "author": "Sergio Villar Senin",
      "avatar": "https://www.gravatar.com/avatar/2d83fda649cd4acc99663f5ce5aaedee?d=identicon\u0026s=64",
      "cl": "316023@main",
      "clUrl": "https://commits.webkit.org/316023@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317729\n\nReviewed by Dan Glastonbury.\n\nThe OpenXR backend was hardwired to OpenGLES/EGL: EGL display/context\ncreation, the XrGraphicsBinding struct, the graphics requirements check, the\nrequired instance extensions and the render fence wait were all spread across\nOpenXRCoordinator. OpenXR itself is graphics library agnostic so we\nshould try to keep that independence to eventually support other\ngraphics libraries (e.g. Vulkan) for WebXR.\n\nAdded an abstract OpenXRGraphicsBinding with a single concrete implementation,\nOpenXRGraphicsBindingOpenGLES, that reproduces the current behavior. The\nlifecycle is split into three phases so that it can also fit APIs whose device\ncreation requires the OpenXR instance/system (unlike EGL):\n\n- requiredInstanceExtensions(): before xrCreateInstance (main thread).\n- initializeDisplay(): creates the platform display (main thread).\n- initializeForSession(): creates the context/device and fill the XrGraphicsBinding\n  once the instance and system are known (render thread).\n\nThe OpenXRCoordinator now holds a unique_ptr\u003cOpenXRGraphicsBinding\u003e in place\nof the GLDisplay/GLContext/GBMDevice/XrGraphicsBinding members, delegating the\ninstance extension list, display/context setup, session graphics binding, the\nendFrame fence wait and the two-phase teardown to it. No behavior change.\n\nSwapchains logic is also moved to the new OpenXRGraphicsBinding, in particular:\n\n- the preferred color format selection that used to be hardcoded in createSwapchain()\n- enumerateSwapchainImages()\n\nOpenXRSwapchain no longer depends on the OpenGLES image struct, it now stores the\nopaque uint64_t handles returned by the binding and delegates enumeration to it\nat creation time.\n\nThe last step was to move the texture sharing code also to the new\ngraphics binding object:\n\n- exportTexture(): the GL texture -\u003e EGLImage -\u003e DMABuf/AHardwareBuffer export\n  (includes Android, DMABuf and GBM paths).\n- needsBlit()/blit(): used in those cases in which the texture sharing\n  mechanism uses its own resources (like Android and GBM paths).\n- other specific paths (like setDevice in GBM code path) were also\n  moved.\n\nWe're using this change to merge needsBlit() with blitTexture() in a new\nblitTextureIfNeeded() because they were exclusively used in pairs, there\nwere not other usages of needsBlit().\n\nThis is mostly about moving code, so there shouldn't be any behavioral\nchange and the original code should be nearly identical to the one in\nthe new abstract class (modulo trivial refactorings like the needsBlit).\n\n* Source/WebKit/SourcesGTK.txt:\n* Source/WebKit/SourcesWPE.txt:\n* Source/WebKit/UIProcess/XR/openxr/OpenXRGraphicsBinding.h: Added.\n* Source/WebKit/UIProcess/XR/openxr/OpenXRGraphicsBindingOpenGLES.cpp: Added.\n(WebKit::OpenXRGraphicsBindingOpenGLES::create):\n(WebKit::OpenXRGraphicsBindingOpenGLES::~OpenXRGraphicsBindingOpenGLES):\n(WebKit::OpenXRGraphicsBindingOpenGLES::requiredInstanceExtensions const):\n(WebKit::OpenXRGraphicsBindingOpenGLES::initializeDisplay):\n(WebKit::OpenXRGraphicsBindingOpenGLES::initializeForSession):\n(WebKit::OpenXRGraphicsBindingOpenGLES::sessionGraphicsBinding const):\n(WebKit::OpenXRGraphicsBindingOpenGLES::selectColorFormat const):\n(WebKit::OpenXRGraphicsBindingOpenGLES::enumerateSwapchainImages const):\n(WebKit::OpenXRGraphicsBindingOpenGLES::waitFrameFence):\n(WebKit::OpenXRGraphicsBindingOpenGLES::releaseSessionGraphics):\n(WebKit::OpenXRGraphicsBindingOpenGLES::exportOpenXRTextureAndroid):\n(WebKit::OpenXRGraphicsBindingOpenGLES::exportOpenXRTextureDMABuf):\n(WebKit::OpenXRGraphicsBindingOpenGLES::exportOpenXRTextureGBM):\n(WebKit::OpenXRGraphicsBindingOpenGLES::exportTexture):\n(WebKit::OpenXRGraphicsBindingOpenGLES::commitFrame):\n(WebKit::OpenXRGraphicsBindingOpenGLES::exportTexture2D):\n(WebKit::OpenXRGraphicsBindingOpenGLES::blitTextureIfNeeded):\n(WebKit::OpenXRGraphicsBindingOpenGLES::exportCubeBuffer):\n(WebKit::OpenXRGraphicsBindingOpenGLES::reconstructCubeFaces):\n* Source/WebKit/UIProcess/XR/openxr/OpenXRGraphicsBindingOpenGLES.h: Added.\n* Source/WebKit/UIProcess/XR/openxr/OpenXRLayer.cpp:\n(WebKit::OpenXRLayerProjection::startFrame):\n(WebKit::OpenXRQuadLayer::startFrame):\n(WebKit::OpenXREquirectLayer::startFrame):\n(WebKit::OpenXRCylinderLayer::startFrame):\n(WebKit::OpenXRCubeLayer::startFrame):\n(WebKit::OpenXRLayer::~OpenXRLayer): Deleted.\n(WebKit::OpenXRLayer::exportOpenXRTextureAndroid): Deleted.\n(WebKit::OpenXRLayer::exportOpenXRTextureDMABuf): Deleted.\n(WebKit::OpenXRLayer::setGBMDevice): Deleted.\n(WebKit::OpenXRLayer::exportOpenXRTextureGBM): Deleted.\n(WebKit::OpenXRLayer::blitTexture const): Deleted.\n(WebKit::OpenXRLayer::exportOpenXRTexture): Deleted.\n(WebKit::OpenXRCubeLayer::~OpenXRCubeLayer): Deleted.\n(WebKit::OpenXRCubeLayer::reconstructCubeFaces): Deleted.\n* Source/WebKit/UIProcess/XR/openxr/OpenXRLayer.h:\n(WebKit::OpenXRLayer::needsBlitTexture const): Deleted.\n* Source/WebKit/UIProcess/XR/openxr/OpenXRSwapchain.cpp:\n(WebKit::OpenXRSwapchain::create):\n(WebKit::OpenXRSwapchain::OpenXRSwapchain):\n(WebKit::OpenXRSwapchain::acquireImage):\n* Source/WebKit/UIProcess/XR/openxr/OpenXRSwapchain.h:\n(WebKit::OpenXRSwapchain::acquiredTexture const):\n(WebKit::OpenXRSwapchain::imageCount const):\n* Source/WebKit/UIProcess/XR/openxr/PlatformXROpenXR.cpp:\n(WebKit::OpenXRCoordinator::createSwapchain const):\n(WebKit::OpenXRCoordinator::createLayerProjection):\n(WebKit::OpenXRCoordinator::createCompositionLayer):\n(WebKit::OpenXRCoordinator::createInstance):\n(WebKit::OpenXRCoordinator::initializeDevice):\n(WebKit::OpenXRCoordinator::createSessionIfNeeded):\n(WebKit::OpenXRCoordinator::cleanupSessionAndAssociatedResources):\n(WebKit::OpenXRCoordinator::cleanupInstanceAndAssociatedResources):\n(WebKit::OpenXRCoordinator::populateFrameData):\n(WebKit::OpenXRCoordinator::endFrame):\n(WebKit::OpenXRCoordinator::createGLDisplay const): Deleted.\n(WebKit::OpenXRCoordinator::tryInitializeGraphicsBinding): Deleted.\n* Source/WebKit/UIProcess/XR/openxr/PlatformXROpenXR.h:\n\nCanonical link: https://commits.webkit.org/316023@main",
      "email": "svillar@igalia.com",
      "hash": "d92d5a69f22d9b42cda91e6ae19674765616fee9",
      "subject": "[OpenXR] Remove the dependency with OpenGLES"
    },
    "316024@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316024@main",
      "clUrl": "https://commits.webkit.org/316024@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318074\nrdar://180871950\n\nReviewed by Lily Spiniolas.\n\nThe touchEventTypes OptionSet in EventRegion.cpp listed\nMouseMove/NonPassiveMouseMove twice (a copy-paste duplicate) and omitted\nMouseUp/NonPassiveMouseUp entirely. As a result, mouseup event listeners\nwere not accounted for when building touch event regions, even though the\nEventListenerRegionType enum defines both values and they are already\nhandled by touchEventNonPassiveTypes and eventTypeForEventListenerType().\n\nReplace the duplicate MouseMove entry with the missing MouseUp pair.\n\n* Source/WebCore/rendering/EventRegion.cpp:\n\nCanonical link: https://commits.webkit.org/316024@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "95ee9a5a9578e98ad66013edf7c8c7cf631dedf5",
      "subject": "[Event Regions] touchEventTypes set has duplicate MouseMove and is missing MouseUp"
    },
    "316025@main": {
      "author": "Sihui Liu",
      "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64",
      "cl": "316025@main",
      "clUrl": "https://commits.webkit.org/316025@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317965\nrdar://180757482\n\nReviewed by Basuke Suzuki.\n\nWhen site isolation is on but the back/forward cache is not actually in use, SuspendedPageProxy can still be created\nwith a null m_suspendedFrameItemID (e.g. to delay tearing down the old page and avoid a white flash during navigation)\nIn this case suspendSubframeProcesses() is never called, so subframe processes never receive addSuspendedPageProxy().\nHowever, teardown() unconditionally iterated over all remote pages in the BrowsingContextGroup and called\nremoveSuspendedPageProxy() on each of their processes, hitting assertion m_suspendedPages.contains(suspendedPage).\n\nFix by guarding the loop with m_suspendedFrameItemID: if it is not set, suspendSubframeProcesses() was never called and\nthere is nothing to clean up in subframe processes. Within the loop, mirror the hasSubframeInProcess() filter from\nsuspendSubframeProcesses() so that only processes that actually received addSuspendedPageProxy() get the matching\nremoveSuspendedPageProxy().\n\n* Source/WebKit/UIProcess/SuspendedPageProxy.cpp:\n(WebKit::SuspendedPageProxy::teardown):\n\nCanonical link: https://commits.webkit.org/316025@main",
      "email": "sihui_liu@apple.com",
      "hash": "7223c62c181adfde7ae62a19d8ff5b4b5907ccc3",
      "subject": "[Site Isolation][Debug] Fix TestWebKitAPI.SiteIsolation.DrawAfterNavigateToDomainAgain"
    },
    "316026@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316026@main",
      "clUrl": "https://commits.webkit.org/316026@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=273346\nrdar://127517211\n\nReviewed by Eric Carlson.\n\nMerge (Test Only): https://chromium.googlesource.com/chromium/src.git/+/ca7a61971dd87991e2b923eb66448bdd8129284c\n\nAdd a direct API test, ported from Blink's TimeRangesTest.Nearest, to cover\nthe single-argument nearest() behavior including exact start/end boundary\ninputs.\n\n* Tools/TestWebKitAPI/Tests/WebCore/TimeRanges.cpp:\n(TestWebKitAPI::TEST(TimeRanges, Nearest)):\n\nCanonical link: https://commits.webkit.org/316026@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "f7278b91b3b05920dc1002d9abb5e5ba48f50151",
      "subject": "[TimeRanges] Add API test coverage for TimeRanges::nearest()"
    },
    "316027@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316027@main",
      "clUrl": "https://commits.webkit.org/316027@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318069\nrdar://180869111\n\nReviewed by Alan Baradlay.\n\nlastLineItemsCountInOriginalOrder was initialized from lineStates.first()\ninstead of lineStates.last() — a copy/paste typo from the line above. This\npatch fixes it.\n\nWhen the first and last lines of a wrapping flex container have a different\nnumber of items, the count used to locate the container's last baseline was\nwrong, so the baseline was taken from a baseline-aligned item on the first\nline instead of an item on the last line. Added a reftest covering this case\n(first line: two items, last line: one item); it failed before this change\nand matches Chrome and Firefox now.\n\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::performFlexLayout):\n* LayoutTests/imported/w3c/web-platform-tests/css/css-flexbox/multiline-last-baseline-item-count-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-flexbox/multiline-last-baseline-item-count-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-flexbox/multiline-last-baseline-item-count.html: Added.\n\nCanonical link: https://commits.webkit.org/316027@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "bcc89c676083459b13d02ccefc82a665613ae626",
      "subject": "Fix typo in RenderFlexibleBox::performFlexLayout(): last-line item count read from first line"
    },
    "316028@main": {
      "author": "Wenson Hsieh",
      "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64",
      "cl": "316028@main",
      "clUrl": "https://commits.webkit.org/316028@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317987\nrdar://180636729\n\nReviewed by Abrar Rahman Protyasha.\n\nMake several small adjustments to how client-specified `replacementStrings` works:\n\n-   Make matching case-insensitive\n-   Make matching diacritic-insensitive\n-   Fold quotes when finding replacements\n-   Apply longer replacements before shorter ones (so that a shorter replacement string that's\n    contained in another longer replacement string doesn't cause the longer replacement string to\n    not apply).\n\nTests:  TextExtractionTests.ReplacementStringsLongestMatchWins\n        TextExtractionTests.ReplacementStringsCaseAndQuoteInsensitive\n        TextExtractionTests.ReplacementStringsDiacriticInsensitive\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/PlatformCocoa.cmake:\n* Source/WebKit/Shared/TextExtractionToStringConversion.cpp:\n(WebKit::foldForReplacement):\n(WebKit::foldTextForReplacement):\n(WebKit::TextExtractionAggregator::applyReplacements):\n* Source/WebKit/Shared/TextExtractionToStringConversion.h:\n(WebKit::TextExtractionOptions::TextExtractionOptions):\n* Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm:\n(extractReplacementStrings):\n* Source/WebKit/UIProcess/API/Cocoa/_WKTextExtraction.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:\n(TestWebKitAPI::TEST(TextExtractionTests, ReplacementStringsLongestMatchWins)):\n(TestWebKitAPI::TEST(TextExtractionTests, ReplacementStringsCaseAndQuoteInsensitive)):\n(TestWebKitAPI::TEST(TextExtractionTests, ReplacementStringsDiacriticInsensitive)):\n\nCanonical link: https://commits.webkit.org/316028@main",
      "email": "wenson_hsieh@apple.com",
      "hash": "494a85cc8e3931ca3faffc009cb57656658bb3af",
      "subject": "[Text Extraction] `replacementStrings` should apply case- and diacritic-insensitively"
    },
    "316029@main": {
      "author": "Ruthvik Konda",
      "avatar": "https://www.gravatar.com/avatar/bca33cefcce93017251a8fbc1204cdc4?d=identicon\u0026s=64",
      "cl": "316029@main",
      "clUrl": "https://commits.webkit.org/316029@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317960\nrdar://180753798\n\nReviewed by Mike Wyrzykowski.\n\nThe \u003cstorage\u003e address space only supports the read and read_write access modes, so a\npointer type such as ptr\u003cstorage, u32, write\u003e must be rejected. The pointer type\nconstructor parsed the access mode but did not reject write; reject it there, matching\nthe validation already applied to variable declarations.\n\n* LayoutTests/http/tests/webgpu/webgpu/shader/validation/types/pointer-expected.txt:\n* Source/WebGPU/WGSL/TypeCheck.cpp:\n(WGSL::TypeChecker::declareBuiltins):\n* Tools/TestWebKitAPI/Tests/WGSL/TypeCheckingTests.mm:\n(TestWGSLAPI::TEST(WGSLTypeCheckingTests, PointerAccessMode)):\n\nCanonical link: https://commits.webkit.org/316029@main",
      "email": "rkonda2@apple.com",
      "hash": "dbb0c0cd1d45afda1de7c1485b6e118c34086d2d",
      "subject": "[WGSL] shader,validation,types,pointer:access_mode:* is failing"
    },
    "316030@main": {
      "author": "Claudio Saavedra",
      "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64",
      "cl": "316030@main",
      "clUrl": "https://commits.webkit.org/316030@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318116\n\nUnreviewed gardening.\n\nThis test is actually failing because of a bug in libsoup 3.6.6 that was fixed in 3.6.7.\nThe expectation is wrong. Remove it and mark the failure instead.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/glib/http/tests/download/basic-ascii-expected.txt: Removed.\n\nCanonical link: https://commits.webkit.org/316030@main",
      "email": "csaavedra@igalia.com",
      "hash": "b53cf69305e5a030ae868d94c63e7c9b73e828d1",
      "subject": "[GLIB] Remove erroneous test expectation for basic-ascii.html"
    },
    "316031@main": {
      "author": "Antoine Quint",
      "avatar": "https://www.gravatar.com/avatar/9b3ef1e754f8d994f21ff67c660cbbe6?d=identicon\u0026s=64",
      "cl": "316031@main",
      "clUrl": "https://commits.webkit.org/316031@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313961\nrdar://175759878\n\nReviewed by Simon Fraser.\n\nCalling `AnimationTimelinesController::suspendAnimations()` ends up calling\n`DocumentTimeline::applyPendingAcceleratedAnimations()` which may trigger\na style recalculation for the targets of accelerated animations.\n\nSuch style recalculations may update the animation-to-timeline relationships\ndue to the `scroll-timeline` and `view-timeline` set of properties. This, in\nturn, will cause `AnimationTimelinesController::suspendAnimations()` to have\nthe list of timelines it iterates over mutate. As such we now make a copy of\nthat list prior to iteration.\n\nThe new test was generated with AI assistance and adapted.\n\nTest: webanimations/accelerated-animation-suspension-crash.html\n\n* LayoutTests/webanimations/accelerated-animation-suspension-crash-expected.txt: Added.\n* LayoutTests/webanimations/accelerated-animation-suspension-crash.html: Added.\n* Source/WebCore/animation/AnimationTimelinesController.cpp:\n(WebCore::AnimationTimelinesController::suspendAnimations):\n\nOriginally-landed-as: 305413.836@safari-7624-branch (f0d08798b749). rdar://180429306\nCanonical link: https://commits.webkit.org/316031@main",
      "email": "graouts@webkit.org",
      "hash": "5c9eba910d588525ef83eca05fb5ad76218d6d4c",
      "subject": "[web-animations] use-after-free in AnimationTimelinesController::suspendAnimations: m_timelines rehashes during iteration when DocumentTimeline::suspendAnimations forces layout"
    },
    "316032@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "316032@main",
      "clUrl": "https://commits.webkit.org/316032@main",
      "description": "rdar://174529502\n\nReviewed by Jean-Yves Avenard.\n\nIf crafting an IPC message containing a SharedVideoFrameInfo with bytesPerRow=0, a WebProcess can learn about uninitialized memory.\nTo prevent this, we memset the allocated CVPixelBuffer data to 0.\n\n* Source/WebCore/platform/cocoa/SharedVideoFrameInfo.mm:\n(WebCore::copyToCVPixelBufferPlane):\n\nOriginally-landed-as: 305413.766@safari-7624-branch (4d49c876befa). rdar://180427261\nCanonical link: https://commits.webkit.org/316032@main",
      "email": "youenn@apple.com",
      "hash": "5d977a0a03600c676749065916a89af91ec2d687",
      "subject": "[CoreIPC] RemoteVideoFrameObjectHeap::convertFrameBuffer uninitialized GPUP heap disclosure via SharedVideoFrameInfo bytesPerRow"
    },
    "316033@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "316033@main",
      "clUrl": "https://commits.webkit.org/316033@main",
      "description": "rdar://174529502\n\nReviewed by Jean-Yves Avenard.\n\nIf crafting an IPC message containing a SharedVideoFrameInfo with bytesPerRow=0, a WebProcess can learn about uninitialized memory.\nTo prevent this, we memset the allocated CVPixelBuffer data to 0.\n\n* Source/WebCore/platform/cocoa/SharedVideoFrameInfo.mm:\n(WebCore::copyToCVPixelBufferPlane):\n\nOriginally-landed-as: 305413.837@safari-7624-branch (b61fc5f3853e). rdar://180427261\nCanonical link: https://commits.webkit.org/316033@main",
      "email": "youenn@apple.com",
      "hash": "7c03dc511c70a90534618e5592a4bc07d91f70a3",
      "subject": "[CoreIPC] RemoteVideoFrameObjectHeap::convertFrameBuffer uninitialized GPUP heap disclosure via SharedVideoFrameInfo bytesPerRow"
    },
    "316035@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "316035@main",
      "clUrl": "https://commits.webkit.org/316035@main",
      "description": "rdar://175673953\n\nReviewed by Chris Dumez.\n\nFiring an event synchronously while iterating through documents is unsafe.\nInstead we queue a task to fire the events in their own task.\nThis way we can iterate through documents without risking to mutate documents.\n\nTest: http/wpt/background-fetch/change-documents-in-progress-event.window.html\n\n* LayoutTests/http/wpt/background-fetch/change-documents-in-progress-event-sw.js: Added.\n* LayoutTests/http/wpt/background-fetch/change-documents-in-progress-event.window-expected.txt: Added.\n* LayoutTests/http/wpt/background-fetch/change-documents-in-progress-event.window.html: Added.\n* LayoutTests/http/wpt/background-fetch/change-documents-in-progress-event.window.js: Added.\n(promise_test.async t):\n* Source/WebCore/workers/service/background-fetch/BackgroundFetchRegistration.cpp:\n(WebCore::BackgroundFetchRegistration::updateInformation):\n\nOriginally-landed-as: 305413.782@safari-7624-branch (1b0af7fe2393). rdar://180427961\nCanonical link: https://commits.webkit.org/316035@main",
      "email": "youenn@apple.com",
      "hash": "bbd73ca6e43642eb61c6ec6e6f1b56d7cfb189b4",
      "subject": "[WebCore] heap use-after-free in SWClientConnection::updateBackgroundFetchRegistration due to live HashTable iterator invalidation during synchronous progress event dispatch"
    },
    "316036@main": {
      "author": "Antoine Quint",
      "avatar": "https://www.gravatar.com/avatar/9b3ef1e754f8d994f21ff67c660cbbe6?d=identicon\u0026s=64",
      "cl": "316036@main",
      "clUrl": "https://commits.webkit.org/316036@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314086\nrdar://175530372\n\nReviewed by Ryosuke Niwa.\n\nEnsure we only attempt to resolve animated styles for keyframes with a computed\noffset in `KeyframeEffect::computeExtentOfTransformAnimation()`.\n\nTest: webanimations/accelerated-animation-with-view-progress-timeline-range-but-no-timeline.html\n\n* LayoutTests/webanimations/accelerated-animation-with-view-progress-timeline-range-but-no-timeline-expected.txt: Added.\n* LayoutTests/webanimations/accelerated-animation-with-view-progress-timeline-range-but-no-timeline.html: Added.\n* Source/WebCore/animation/KeyframeEffect.cpp:\n(WebCore::KeyframeEffect::computeExtentOfTransformAnimation const):\n\nOriginally-landed-as: 305413.835@safari-7624-branch (347b3963d6ca). rdar://180438252\nCanonical link: https://commits.webkit.org/316036@main",
      "email": "graouts@webkit.org",
      "hash": "06319c3a2573192333d4816893560010cd8c75f7",
      "subject": "[web-animations] accelerated animation with view progress timeline range but no timeline yields a crash"
    },
    "316037@main": {
      "author": "Said Abou-Hallawa",
      "avatar": "https://www.gravatar.com/avatar/ae80a929a378a055822829ae63903296?d=identicon\u0026s=64",
      "cl": "316037@main",
      "clUrl": "https://commits.webkit.org/316037@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313935\nrdar://176138322\n\nReviewed by Darin Adler.\n\nPathCG::strokeContains() is not thread-safe because it accesses a global\nCGContextRef managed by NeverDestroyed in scratchContext(). If multiple offscreen\ncanvases call CanvasRenderingContext2D:isPointInStroke() on worker threads, they\nare going to call PathCG::strokeContains(). This means the same CGContextRef will\nbe used by these workers. This lake of global variable synchronization can lead\nto all sort of security and correctness bugs depending on what was set in the\ncontext when it is referenced.\n\nThe fix is to protect scratchContext() by a locker. This will allow only one caller\nto have access to the underlying CGContextRef.\n\nTest: fast/canvas/offscreen-worker-unsafe-isPointInStroke-call.html\n\n* LayoutTests/fast/canvas/offscreen-worker-unsafe-isPointInStroke-call-expected.txt: Added.\n* LayoutTests/fast/canvas/offscreen-worker-unsafe-isPointInStroke-call.html: Added.\n* Source/WebCore/platform/graphics/cg/PathCG.cpp:\n(WebCore::PathCG::strokeContains const):\n(WebCore::PathCG::strokeBoundingRect const):\n\nOriginally-landed-as: 305413.891@safari-7624-branch (232dada9ad29). rdar://180437343\nCanonical link: https://commits.webkit.org/316037@main",
      "email": "said@apple.com",
      "hash": "95f9f59bb141325d7468be23bb9e570ad751d71a",
      "subject": "PathCG::strokeContains() is not thread safe"
    },
    "316038@main": {
      "author": "Ruthvik Konda",
      "avatar": "https://www.gravatar.com/avatar/bca33cefcce93017251a8fbc1204cdc4?d=identicon\u0026s=64",
      "cl": "316038@main",
      "clUrl": "https://commits.webkit.org/316038@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314684\nrdar://176482460\n\nReviewed by Mike Wyrzykowski.\n\nDevice::createBindGroup checked that descriptor.entryCount matched the\nlayout's entry count, but not that each entry.binding was unique.\nDuplicate entries caused dynamicBuffers and m_dynamicOffsetsIndices to\nbe built with extra records, so dynamic-offset validation in setBindGroup\nno longer corresponded to the offsets applied at dispatch.\n\nTrack seen binding indices with a HashSet at the top of the per-entry\nloop and reject duplicates with a validation error, mirroring the\nexisting check in Device::createBindGroupLayout.\n\n* LayoutTests/fast/webgpu/bind-group-duplicate-binding-expected.txt: Added.\n* LayoutTests/fast/webgpu/bind-group-duplicate-binding.html: Added.\n* Source/WebGPU/WebGPU/BindGroup.mm:\n(WebGPU::Device::createBindGroup):\n\nOriginally-landed-as: 305413.903@safari-7624-branch (b49e6e956529). rdar://180428744\nCanonical link: https://commits.webkit.org/316038@main",
      "email": "rkonda2@apple.com",
      "hash": "57ae1268754271fe3e80a72f98e2a7749bb2fde8",
      "subject": "[WebGPU] Reject duplicate binding entries in Device::createBindGroup"
    },
    "316039@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "316039@main",
      "clUrl": "https://commits.webkit.org/316039@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316311\nrdar://problem/178734954\n\nReviewed by Brandon Stewart.\n\nIntroduce ContentBoxSize, BorderBoxSize, and MarginBoxSize wrapper types in\nGridSizeTypes.h to make size type conversions explicit inside grid\nsizing code. The idea is that these wrapper types are only used *within*\nthe public API and any internal functions it needs to compute the\nreturned size. The only time the value should be extracted from the\nwrapper type is when we are returning the value from the public API.\nRight now these functions return the BorderBoxSize simply because that\nis what they currently compute, but eventually they will return a\nMarginBoxSize since that is the size grid layout uses.\n\nThis helps make it obvious how the returned value is computed and also\nmakes it obvious if there are any bugs. In fact, there were a few\ndifferent spots where we were incorrectly using mixed types when we\nshould not have been and we fix those in this PR:\n- inlineContentSizeSuggestion returned a content-box value (from\n  IntegrationUtils::minContentWidth) but was mixed with border-box values\n  from inlineSpecifiedSizeSuggestion in automaticMinimumInlineSize. Fixed\n  by constructing BorderBoxSize from ContentBoxSize + borderAndPadding.\n\n- The max-size clamp in automaticMinimumInlineSize/automaticMinimumBlockSize\n  compared a border-box content-based minimum against a content-box max-size\n  value. Fixed by converting the max-size to border-box before comparison.\n\n- usedInlineSizeForGridItem/usedBlockSizeForGridItem compared a border-box\n  minimumSize against content-box stretchedWidth and content-box maximumSize.\n  Fixed by computing all three at the border-box level.\n\nHowever, since we currently do not run GFC if any of the items have any\nborder or padding this has no effect on any type of content that does\nrun through GFC.\n\nCanonical link: https://commits.webkit.org/316039@main",
      "email": "sammy.gill@apple.com",
      "hash": "5a636ef55dd96d05288e2d4b5097ab00524f6df9",
      "subject": "[GFC] Add size type wrapper structs to help annotate code."
    },
    "316040@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316040@main",
      "clUrl": "https://commits.webkit.org/316040@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313626\nrdar://175672431\n\nReviewed by Ryosuke Niwa.\n\nProtect the watcher before calling destroy() on it.\n\nTest: fast/dom/CloseWatcher-watcher-crash.html\n\n* LayoutTests/fast/dom/CloseWatcher-watcher-crash-expected.txt: Added.\n* LayoutTests/fast/dom/CloseWatcher-watcher-crash.html: Added.\n* Source/WebCore/html/closewatcher/CloseWatcher.cpp:\n(WebCore::CloseWatcher::create):\n\nOriginally-landed-as: 305413.770@safari-7624-branch (a2cb3a724645). rdar://180428565\nCanonical link: https://commits.webkit.org/316040@main",
      "email": "cdumez@apple.com",
      "hash": "ae9baa4b0135d0c8e4c549793240905223f69d3e",
      "subject": "use-after-free in CloseWatcher::destroy(): abort-signal algorithm calls destroy() via WeakPtr while CloseWatcherManager holds the last Ref"
    },
    "316041@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316041@main",
      "clUrl": "https://commits.webkit.org/316041@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315348\nrdar://176891673\n\nReviewed by Ryosuke Niwa.\n\nWebFrameProxy::nextSibling() and previousSibling() obtain an iterator from\nm_parentFrame-\u003em_childFrames.find(this) but compare it against this frame's own\nm_childFrames.end(). ListHashSet const_iterator equality compares only m_position,\nso the not-found guard is structurally always false in Release. They also call\nlast()/first() on the parent's m_childFrames without checking isEmpty(), which\ndereferences the sentinel of an empty list.\n\nA child can have a non-null m_parentFrame whose m_childFrames no longer contains\nit because webProcessWillShutDown() and removeChildFrames() drop the parent's\nchild set without nulling each child's m_parentFrame. A compromised WebContent\nprocess can keep such a frame alive across pages because focusedFrameChanged()\ndoes not verify that the looked-up frame belongs to this page before storing it\nin m_focusedFrame. Under Site Isolation, FindStringCallbackAggregator's destructor\nthen traverses from focusedOrMainFrame() through nextSibling() on the orphaned\nchild, advances past the parent's sentinel, and returns \u0026parent.m_parentFrame's\nWeakPtr impl typed as WebFrameProxy*, leading to an EXC_ARM_PAC_FAIL in CFRetain\nin the UI process.\n\nFix all four sites: compare against the parent's end(), early-return when the\nparent's child set is empty, null each child's m_parentFrame when emptying\nm_childFrames in webProcessWillShutDown() and removeChildFrames(), and\nMESSAGE_CHECK in focusedFrameChanged() that the frame belongs to this page.\nAlso do hardening in ListHashSet so that calling first() / last() on an\nempty set crashes safely.\n\nTest: http/tests/site-isolation/find-string-with-cross-page-focused-frame-crash.html\n\n* LayoutTests/http/tests/site-isolation/find-string-with-cross-page-focused-frame-crash-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/find-string-with-cross-page-focused-frame-crash.html: Added.\n* Source/WTF/wtf/ListHashSet.h:\n(WTF::U\u003e::first):\n(WTF::U\u003e::first const):\n(WTF::U\u003e::last):\n(WTF::U\u003e::last const):\n* Source/WebKit/UIProcess/WebFrameProxy.cpp:\n(WebKit::WebFrameProxy::webProcessWillShutDown):\n(WebKit::WebFrameProxy::removeChildFrames):\n(WebKit::WebFrameProxy::nextSibling const):\n(WebKit::WebFrameProxy::previousSibling const):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::focusedFrameChanged):\n\nOriginally-landed-as: 305413.957@safari-7624-branch (7b5d09d5675a). rdar://180428790\nCanonical link: https://commits.webkit.org/316041@main",
      "email": "cdumez@apple.com",
      "hash": "15c722b934e53ef7e5da1dcf30715b7b6a797a93",
      "subject": "[WebKit Process Model | All] Wrong-container end() comparison in WebFrameProxy::nextSibling/previousSibling"
    },
    "316042@main": {
      "author": "Etienne Segonzac",
      "avatar": "https://www.gravatar.com/avatar/3566820d0ba7e035bc440dc736c17f0c?d=identicon\u0026s=64",
      "cl": "316042@main",
      "clUrl": "https://commits.webkit.org/316042@main",
      "description": "rdar://175331820\n\nReviewed by Lily Spiniolas and Simon Fraser.\n\nWhile appending new regions, if we need to modify the current one,\nmake sure to read back from the vector instead of reusing the reference.\n\n* Source/WebCore/rendering/EventRegion.cpp:\n(WebCore::EventRegionContext::shrinkWrapInteractionRegions):\n\nOriginally-landed-as: 305413.780@safari-7624-branch (6ccb8fc1f9e8). rdar://180435523\nCanonical link: https://commits.webkit.org/316042@main",
      "email": "sgz@apple.com",
      "hash": "eaa2b441ff2ce947929fb6965b86123905c0c858",
      "subject": "[WebCore] Heap-use-after-free in EventRegionContext::shrinkWrapInteractionRegions when m_interactionRegions.insert reallocates under a held reference"
    },
    "316043@main": {
      "author": "Kai Tamkun",
      "avatar": "https://www.gravatar.com/avatar/dff073cba21885df4d9f73ed3cc493c2?d=identicon\u0026s=64",
      "cl": "316043@main",
      "clUrl": "https://commits.webkit.org/316043@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312781\nrdar://174994263\n\nReviewed by Yijia Huang.\n\nExempts resizable/growable-shared views from GetIndexedPropertyStorage constant folding.\nConverting the vector to a constant storage pointer is invalid if the vector can be\nreallocated without notice.\n\nresizable-array-constant-folding.js tests the effects of writing to a WebAssembly\nmemory grown after constant folding.\n\n* JSTests/stress/resizable-array-constant-folding.js: Added.\n(trigger):\n* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:\n(JSC::DFG::ConstantFoldingPhase::foldConstants):\n\nOriginally-landed-as: 305413.726@safari-7624-branch (80760a59ebe9). rdar://180437068\nCanonical link: https://commits.webkit.org/316043@main",
      "email": "k_tamkun@apple.com",
      "hash": "13bfbf94f49eab45ea7bf22c2c02759bf911bc11",
      "subject": "[JSC] Use-after-free after Wasm memory grow via stale pointer folded by DFGConstantFoldingPhase"
    },
    "316044@main": {
      "author": "Megan Gardner",
      "avatar": "https://www.gravatar.com/avatar/b466a5bcbfabf4d82a8ecc595db5a531?d=identicon\u0026s=64",
      "cl": "316044@main",
      "clUrl": "https://commits.webkit.org/316044@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317589\nrdar://175785816\n\nReviewed by Abrar Rahman Protyasha.\n\nWhen the same font appears in many attribute runs of an NSAttributedString — the typical shape of styled mail content\n— AttributedString::fromNSAttributedString and AttributedString::nsAttributedString redo expensive font work for every\nrun. On the encode side that means Font::create + platformGlyphInit + determinePitch, which queries\nkCTFontIsUserInstalledAttribute via uncached XT property lookups; on the decode side it means\nCTFontDescriptorCreateWithAttributesAndOptions + CTFontCreateWithFontDescriptor. In a sample taken while typing into a\ncomplex Mail message, that work dominated the IPC dispatch CPU.\n\nAdd a per-call cache in each direction. The encode-side cache is keyed on CTFontRef identity because\nNSAttributedString interns shared font attributes, so the same pointer recurs across runs. The decode-side cache is\nkeyed on a stringified summary of InstalledFont content (postScriptName, descriptor options, point size, plus traits,\nopticalSize, and variations content) because each AttributeValue carries its own copy. Both caches live for one\nfromNSAttributedString / nsAttributedString call and are threaded through the existing parameter pattern that already\npasses the table/list/block ID maps.\n\nThe decode-side key omits matrix, paletteColors, and featureSettings; when any of those is set on the source font the\ncall falls through to the slow path uncached. Those are uncommon in mail and including them in a stringified key would\nbe either lossy (matrix is opaque CFData; palette colors are CGColors) or expensive enough to defeat the cache.\n\nAdds two miss counters with WEBCORE_EXPORT accessors for testing, and a TestWebKitAPI test that round-trips a\n200-run NSMutableAttributedString whose runs all share one NSFont (alternated by foreground color so the runs don't\ncoalesce) and asserts each direction's miss counter advanced by exactly 1.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/cocoa/AttributedStringFontCache.mm\n\n* Source/WebCore/editing/cocoa/AttributedString.h:\n* Source/WebCore/editing/cocoa/AttributedString.mm:\n(WebCore::AttributedString::encodeFontCacheMissesForTesting):\n(WebCore::AttributedString::decodeFontCacheMissesForTesting):\n(WebCore::stringifyCFNumber):\n(WebCore::stringifyCFBoolean):\n(WebCore::cacheKeyForInstalledFont):\n(WebCore::toNSObject):\n(WebCore::toNSDictionary):\n(WebCore::AttributedString::documentAttributesAsNSDictionary const):\n(WebCore::AttributedString::nsAttributedString const):\n(WebCore::extractValue):\n(WebCore::extractDictionary):\n(WebCore::AttributedString::fromNSAttributedStringAndDocumentAttributes):\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/AttributedStringFontCache.mm: Added.\n(TestWebKitAPI::TEST(AttributedStringFontCache, RoundTripDeduplicatesSharedFont)):\n(TestWebKitAPI::fontWithBaselineAdjust):\n(TestWebKitAPI::baselineAdjustForFont):\n(TestWebKitAPI::TEST(AttributedStringFontCache, PostScriptFontsDifferingInBaselineAdjustDoNotCollide)):\n\nCanonical link: https://commits.webkit.org/316044@main",
      "email": "megan_gardner@apple.com",
      "hash": "b17b549e3fbe4a929404b037e1888f4db2dbb91f",
      "subject": "Typing in complicated Mail replies lags."
    },
    "316045@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316045@main",
      "clUrl": "https://commits.webkit.org/316045@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318104\nrdar://180896838\n\nReviewed by Simon Fraser.\n\nInlineBoxPainter::paintMask() and InlineBoxPainter::paintDecorations() each\ncontained an identical copy of the math that lays out a border/mask nine-piece\nimage as one continuous strip across the fragments of an inline box that has\nbeen split over multiple lines (the line-leftward/rightward width accumulation\nplus the stripX/stripY/stripWidth/stripHeight derivation).\n\nExtract that shared computation into a new helper,\nInlineBoxPainter::computeNinePieceImageStrip(), and call it from both sites.\nThis is a pure refactor with no behavior change: the helper preserves the\nexisting math verbatim (including the pre-existing RTL FIXME), and each caller\nkeeps its own clip-rect setup since those differ (mask vs. border image,\ndifferent graphics contexts).\n\n* Source/WebCore/rendering/InlineBoxPainter.cpp:\n(WebCore::InlineBoxPainter::computeNinePieceImageStrip const):\n(WebCore::InlineBoxPainter::paintMask):\n(WebCore::InlineBoxPainter::paintDecorations):\n* Source/WebCore/rendering/InlineBoxPainter.h:\n\nCanonical link: https://commits.webkit.org/316045@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "ec4c328ee08b66cae29d2c266b6c1cd7b2972c8d",
      "subject": "Deduplicate the multi-line nine-piece image strip computation in InlineBoxPainter"
    },
    "316046@main": {
      "author": "Rupin Mittal",
      "avatar": "https://www.gravatar.com/avatar/3e3de9845931d2dc844afb00056ec94e?d=identicon\u0026s=64",
      "cl": "316046@main",
      "clUrl": "https://commits.webkit.org/316046@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313866\nrdar://174663032\n\nReviewed by Per Arne Vollan.\n\nConsider this sequence of events:\n1. A compromised web process schedules a load with its own origin used for\n   firstPartyForCookies.\n2. NetworkConnectionToWebProcess::scheduleResourceLoad() is called and the\n   message check passes.\n3. The request goes through and the server responds with 302 (redirect).\n4. NetworkResourceLoader::continueWillSendRedirectedRequest() calls\n   WebResourceLoader::WillSendRequest() which gives the web process the chance\n   to alter the request that will be sent to perform the redirect.\n5. The compromised web process alters the request so that firstPartyForCookies\n   is now a different origin.\n6. NetworkResourceLoader::continueWillSendRequest() receives this altered\n   request and passes it off to CFNetwork.\n7. The result of this request is that the compromised web process receives\n   the cookies of this different origin.\n\nThere are multiple callsites of continueWillSendRequest(), but only one place\nwhich allows the web process to alter the request before it's given to\ncontinueWillSendRequest(). So we fix this by adding a message check right\nbefore that callsite that will double check that the origin contained in this\npotentially modified request from the web process is in this web process's\nallowed list. If not, the web process will be killed so that it doesn't recieve\nthe cross-origin cookies.\n\nWe also only do this message check if the web process actually changes the\norigin. This is because there are cases where the origin is not yet in the\nallowlist but not because the web process modified it (like in:\nimported/w3c/web-platform-tests/speculation-rules/prefetch/redirect-url.https.html?origin=cross-site-redirect\nwhere there is a cross-site redirect as part of a prefetch, so the cross-site\norigin is supplied by the server but hasn't made it into the allow list since\nthe navigation to it is not complete).\n\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:\n(WebKit::NetworkResourceLoader::continueWillSendRedirectedRequest):\n\nOriginally-landed-as: 305413.834@safari-7624-branch (9fd9439df22f). rdar://180437365\nCanonical link: https://commits.webkit.org/316046@main",
      "email": "rupin@apple.com",
      "hash": "64315b6f7b375021083fe772cf91baca65617cb1",
      "subject": "WebResourceLoader::WillSendRequest reply may lead to cross-origin cookie access"
    },
    "316047@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316047@main",
      "clUrl": "https://commits.webkit.org/316047@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318092\nrdar://180888279\n\nReviewed by Simon Fraser.\n\nm_updatingMarqueePosition is a plain bool, not a bitfield, so the stale\nFIXME claiming SetForScope\u003c\u003e can't be used no longer applies. Replace the\nmanual save/set/restore of the re-entrancy guard with a SetForScope, which\nis RAII-safe and removes the misleading comment. No behavior change.\n\n* Source/WebCore/rendering/RenderLayerScrollableArea.cpp:\n(WebCore::RenderLayerScrollableArea::updateMarqueePosition):\n\nCanonical link: https://commits.webkit.org/316047@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "d4516a404df87b6d4b0370bf00cf7c0ea60cf321",
      "subject": "Use SetForScope in RenderLayerScrollableArea::updateMarqueePosition()"
    },
    "316049@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "316049@main",
      "clUrl": "https://commits.webkit.org/316049@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317864\nrdar://163454428\n\nReviewed by Wenson Hsieh.\n\nMake replaceDictatedText use Editor::setComposition instead of\nEditor::insertText so that dictation streaming is tracked as a\ncomposition. This means JS frameworks (draft.js, ProseMirror, etc.)\nsee compositionstart/compositionupdate/compositionend events instead of\nplain insertText, allowing them to defer DOM reconciliation during\ndictation.\n\nThis is needed to fix a bug on x.com where dictating to compose a new\npost would result in the backspace no longer working. This is because\nthe mutations that are occurring to update the text are changing the DOM\nunderneath draft.js in a way that ends up putting them in a bad state.\nIt does look like draft.js listens for composition events and even\ncreates a MutationObserver at the start of the composition. By doing\nthis it allows them to recover and put the DOM back in the state they\nwant which allows the backspace to work. It also looks like other\nengines on other platforms do the same thing so this also brings us\ncloser to interoperability.\n\nOn the first replaceDictatedText call (no existing composition), we find\nthe initial text that was inserted earlier from a call to insertText,\nselect it, delete it with deleteSelectionWithSmartDelete, then start a\ncomposition via setComposition. On subsequent calls, setComposition\ninternally selects and replaces the existing composition via selectComposition().\nWhen newText is empty and there is no composition, we just delete the\npreviously dictated text and return, avoiding a spurious compositionend.\n\nCanonical link: https://commits.webkit.org/316049@main",
      "email": "sammy.gill@apple.com",
      "hash": "ec004b440d887772ccf6b4b7a5f57a75cf317cf8",
      "subject": "x.com: Software keyboard delete key is unresponsive after using dictation"
    },
    "316050@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "316050@main",
      "clUrl": "https://commits.webkit.org/316050@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317983\nrdar://problem/180765717\n\nReviewed by Alan Baradlay.\n\nThe grid coverage check uses MarginEdge::isPossiblyZero() to decide whether a\ngrid item has margins that force the legacy path. However, isPossiblyZero()\nreturns true for both the `auto` keyword and calc() values (keywords and calc()\nare always treated as possibly-zero), so a grid item with an `auto` margin or a\ncalc() margin was not detected as having a margin and was allowed onto the\nmodern GFC path.\n\nThe modern path does not support these margins:\n- auto margins were treated as zero, so the item was start-aligned within its\n  grid area instead of having the auto margin absorb the free space (e.g. a\n  `margin: auto 0` item was not centered in its row).\n- a calc() margin containing a percentage was treated as a zero offset, so the\n  item was placed at the start of its grid area (e.g. `margin-left: calc(10px +\n  30%)` produced a 0px offset instead of 70px against a 200px grid area).\n\nDetect both cases explicitly via MarginEdge::isAuto() and\nMarginEdge::isCalculated() so these items fall back to the legacy grid layout\npath, which resolves the margins correctly. Non-zero fixed and percentage\nmargins were already routed to legacy by the existing isPossiblyZero() check.\n\nAdd two reftests (reduced from grid-block-axis-alignment-auto-margins-008.html)\nthat use explicit row placement so the items stay on the modern path,\nexercising the auto-margin and calc()-margin cases directly.\n\nCanonical link: https://commits.webkit.org/316050@main",
      "email": "sammy.gill@apple.com",
      "hash": "3d436acad33f6ebc79a75acf0aed418a489c37f9",
      "subject": "[GFC] Items with auto or calc margins are not supported"
    },
    "316051@main": {
      "author": "Pouneh Bahrami",
      "avatar": "https://www.gravatar.com/avatar/c3e7b86f60b5dae1470ceeb5d929f12d?d=identicon\u0026s=64",
      "cl": "316051@main",
      "clUrl": "https://commits.webkit.org/316051@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317982\nrdar://180754626\n\nReviewed by Simon Fraser.\n\nAdd the missing `isInitiatedByDedicatedWorker` field to the IPC message\nin the test to match the current CreateSocketChannel parameter struct.\n\n* LayoutTests/ipc/networksessioncocoa-empty-resource-request.html:\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/316051@main",
      "email": "pbahrami@apple.com",
      "hash": "cb78589da1c78d37b37c6f118003c959f0e81002",
      "subject": "ipc/networksessioncocoa-empty-resource-request.html is constant text failure"
    },
    "316052@main": {
      "author": "Philippe Normand",
      "avatar": "https://www.gravatar.com/avatar/eef27203750af3510263cc29af21a16e?d=identicon\u0026s=64",
      "cl": "316052@main",
      "clUrl": "https://commits.webkit.org/316052@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318118\n\nReviewed by Claudio Saavedra.\n\nVariables assigned from `adopt*` calls should use the corresponding smart pointer type, as\nrecommended by the coding style.\n\nCanonical link: https://commits.webkit.org/316052@main",
      "email": "philn@igalia.com",
      "hash": "27221ed7b61f58777d205e3057a29343fcf3f14e",
      "subject": "[GLib] Explicitly type variables assigned from adoptGRef calls"
    },
    "316053@main": {
      "author": "Philippe Normand",
      "avatar": "https://www.gravatar.com/avatar/eef27203750af3510263cc29af21a16e?d=identicon\u0026s=64",
      "cl": "316053@main",
      "clUrl": "https://commits.webkit.org/316053@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317971\n\nReviewed by Alicia Boya Garcia and Xabier Rodriguez-Calvar.\n\nRemove the assert on caps event push result otherwise we can get racy crashes on post-commit bots\nwhen a flush-start event is pushed downstream from another thread just before a caps change has to\nbe notified.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n* Source/WebCore/platform/graphics/gstreamer/mse/WebKitMediaSourceGStreamer.cpp:\n(webKitMediaSrcLoop):\n\nCanonical link: https://commits.webkit.org/316053@main",
      "email": "philn@igalia.com",
      "hash": "abc2312528f8a06206ca57c929c3c0c317ac90f2",
      "subject": "[WPE] media/media-source/media-source-real-play-after-eos.html is crashing"
    },
    "316054@main": {
      "author": "Geoffrey Garen",
      "avatar": "https://www.gravatar.com/avatar/9f2ee1a184d00263dc68af055f15b697?d=identicon\u0026s=64",
      "cl": "316054@main",
      "clUrl": "https://commits.webkit.org/316054@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318120\nrdar://180945755\n\nReviewed by David Kilzer.\n\n* Tools/Scripts/analyze-safer-cpp: When a header changes, instead of searching\nthe whole project for a .cpp file that #includes it (which is slow, and can\nfail), just compile the header stand-alone. .h files don't get entries in\ncompile_commands.json, so just borrow the compiler flags from any other file\nin the same folder.\n\nWe still prefer to compile a related .cpp file if we can find one trivially\nbecause the .cpp file may instantiate templates, revealing failures that weren't\nvisible in the template definitions alone.\n\nCanonical link: https://commits.webkit.org/316054@main",
      "email": "ggaren@apple.com",
      "hash": "5237eb1d8302b04c9e8fe380f173be9492657620",
      "subject": "analyze-safer-cpp: Improve header-only analysis"
    },
    "316056@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316056@main",
      "clUrl": "https://commits.webkit.org/316056@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312553\nrdar://174708131\n\nReviewed by Brady Eidson.\n\nIn the macOS 15+ / iOS 18+ secure-coding path (HAVE_WK_SECURE_CODING_NSURLREQUEST),\nCoreIPCNSURLRequest forwards fields from the decoded IPC message into\n-[NSURLRequest _initWithWebKitPropertyListData:] inside NetworkProcess. CFNetwork\ninterprets NSString entries in bodyParts as POSIX file paths\n(CFURLCreateWithFileSystemPath -\u003e CFReadStreamCreateWithFile), so a compromised\nWebContent process could exfiltrate any NetworkProcess-readable file by injecting\narbitrary paths into bodyParts.\n\nThe legitimate encoder in ResourceRequestCocoa.mm already clears the HTTP body\nbefore serialization (setHTTPBody:nil / setHTTPBodyStream:nil at lines 127-128),\nso body and bodyParts are normally empty in the serialized NSURLRequest. However,\nthat strip is encoder-side only and a compromised WebContent process can populate\nthese fields directly on the wire. The HTTP body is carried separately via\nWebCore::FormData which has its own validation.\n\nStop extracting body and bodyParts on the encoder side; stop forwarding them on\nthe receiver side in toID(); add assertions that they remain empty.\n\n* Source/WebKit/Shared/Cocoa/CoreIPCNSURLRequest.mm:\n(WebKit::CoreIPCNSURLRequest::CoreIPCNSURLRequest):\n(WebKit::CoreIPCNSURLRequest::toID const):\n\nOriginally-landed-as: 305413.696@safari-7624-branch (0df93a7f1b13). rdar://180428381\nCanonical link: https://commits.webkit.org/316056@main",
      "email": "cdumez@apple.com",
      "hash": "a38f039d8f8a22dd138a45c0f8d33b9dc8528c9d",
      "subject": "[CoreIPC] [NP] CoreIPCNSURLRequest bodyParts Forwarded to CFNetwork Leads to Arbitrary File Exfiltration"
    },
    "316057@main": {
      "author": "Philippe Normand",
      "avatar": "https://www.gravatar.com/avatar/eef27203750af3510263cc29af21a16e?d=identicon\u0026s=64",
      "cl": "316057@main",
      "clUrl": "https://commits.webkit.org/316057@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318121\n\nReviewed by Claudio Saavedra.\n\n* Tools/Scripts/webkitpy/style/checkers/cpp.py:\n(check_auto_with_adopt):\n* Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py:\n(WebKitStyleTest.test_auto_with_adopt):\n\nCanonical link: https://commits.webkit.org/316057@main",
      "email": "philn@igalia.com",
      "hash": "56939ebf3e60c91e41ee69d7b891c04c13c3e546",
      "subject": "Add C++ coding style check for auto = adoptGRef cases"
    },
    "316058@main": {
      "author": "Antti Koivisto",
      "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64",
      "cl": "316058@main",
      "clUrl": "https://commits.webkit.org/316058@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318122\nrdar://180949766\n\nReviewed by Tim Nguyen.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/e2e90ba5fc9185e9a27d3c0f367d90d6719be941\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/apply-nested-declarations-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/apply-nested-declarations.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/apply-top-level-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/invalid-at-top-level-expected.txt.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/apply-top-level.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/invalid-at-top-level.html.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/apply-within-mixin-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixins-including-mixins-expected.txt.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/apply-within-mixin.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixins-including-mixins.html.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/contents-nested-declarations-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/contents-nested-declarations-fallback-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/contents-nested-declarations-fallback.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/contents-nested-declarations.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/contents-rule-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/contents-rule.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/cssom.tentative-expected.txt: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/cssom.tentative.html: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/dashed-function-eval-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/dashed-function-eval.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-parameter-types.tentative-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/parameter-types.tentative-expected.txt.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-parameter-types.tentative.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/parameter-types.tentative.html.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-shadow-animations.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-shadow-cache.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-shadow-container-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-shadow-container.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-shadow.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/imported-sheet-with-mixin.css: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/imported-sheet-with-red-mixin.css: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/local-inherit-substitution-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/local-inherit-substitution.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-basic-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/basic-expected.txt.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-basic.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/basic.html.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-conditionals-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-conditionals.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-cross-stylesheet-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/cross-stylesheet-expected.txt.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-cross-stylesheet.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/cross-stylesheet.html.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-cssom.tentative-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-cssom.tentative.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-cycle.tentative-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/cycle.tentative-expected.txt.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-cycle.tentative.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/cycle.tentative.html.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-declarations-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/declarations-expected.txt.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-declarations.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/declarations.html.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-from-import-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/import-expected.txt.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-from-import-with-media-queries-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/import-with-media-queries-expected.txt.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-from-import-with-media-queries.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/import-with-media-queries.html.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-from-import.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/import.html.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-invalidation.tentative-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/invalidation.tentative-expected.txt.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-invalidation.tentative.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/invalidation.tentative.html.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-layers-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-layers.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-locals-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-locals.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-media-query-invalidation-2-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-media-query-invalidation-2.html: Copied from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/media-queries.html.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-media-query-invalidation-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/media-queries-expected.txt.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-media-query-invalidation.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/media-queries.html.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-parameters-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-parameters.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-parsing-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-parsing.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-shadow-dom-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/shadow-dom-expected.txt.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/mixin-shadow-dom.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/shadow-dom.html.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/resources/imported-sheet-with-mixin.css: Added.\n(@mixin --m1()):\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/resources/imported-sheet-with-red-mixin.css: Added.\n(@mixin --m1()):\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/resources/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/w3c-import.log:\n\nCanonical link: https://commits.webkit.org/316058@main",
      "email": "antti@apple.com",
      "hash": "d51ea3b68e0671d52af8337604d65efb24917cde",
      "subject": "[css-mixins-1] Re-import tests"
    },
    "316059@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316059@main",
      "clUrl": "https://commits.webkit.org/316059@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318064\nrdar://180858861\n\nReviewed by Simon Fraser.\n\nAdd ASSERT_NOT_REACHED() plus a trailing return nullptr.\n\n* Source/WebCore/platform/graphics/cg/GradientRendererCG.cpp:\n(WebCore::gradientOptionsDictionary):\n\nCanonical link: https://commits.webkit.org/316059@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "60ca519c17a68908689f706ea7479d30f2395707",
      "subject": "[CG] gradientOptionsDictionary() can fall off the end of a non-void switch"
    },
    "316060@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "316060@main",
      "clUrl": "https://commits.webkit.org/316060@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317538\nrdar://180222652\n\nReviewed by Mike Wyrzykowski.\n\nAlso moves `tabFocusesLinks` from WKWebViewInternal to WKWebViewPrivate since it makes more\nsense from a correctness perspective and elides the need for forward declarations.\n\nThis also revealed a bug in the Objective-C GTest version of WKWebViewSameConfiguration, since\nit wasn't actually even doing anything, since the error was silently ignored and then everything\nelse after that was just `nil`.\n\n* Source/WebKit/UIProcess/API/Cocoa/WKPreferencesInternal.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivate.h:\n* Tools/TestWebKitAPI/SourcesCocoa.txt:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/Coding.mm: Removed.\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/CodingTests.swift: Added.\n(CodingTests.wkPreferences):\n(CodingTests.wkProcessPoolShared):\n(CodingTests.wkProcessPool):\n(CodingTests.wkWebsiteDataStoreDefault):\n(CodingTests.wkWebsiteDataStoreNonPersistent):\n(CodingTests.wkWebViewConfiguration):\n(CodingTests.wkWebView):\n(CodingTests.wkWebViewSameConfiguration):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebLocks.mm:\n\nCanonical link: https://commits.webkit.org/316060@main",
      "email": "richard_robinson2@apple.com",
      "hash": "9b7da99e5160649fde6b3341a8651f52ce598506",
      "subject": "[Swift Testing] Convert `WKWebView.Coding` tests to Swift Testing"
    },
    "316061@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316061@main",
      "clUrl": "https://commits.webkit.org/316061@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314538\nrdar://174499511\n\nReviewed by Sihui Liu.\n\nIDBKeyData implements CustomHashTraits, and IDBKeyDataHashTraits uses the\nstd::nullptr_t variant (IDBKeyData::isNull()) as the HashMap empty value.\nA compromised WebContent process can send PutOrAdd with an IDBKeyData\nwhose variant is std::nullptr_t; the message passes IPC decoding and\nreaches MemoryObjectStore::addRecord, which inserts the key into\nm_keyValueStore — a HashMap whose empty sentinel is exactly that value —\ncrashing the Network process via the HashMap key validation RELEASE_ASSERT.\nThe IDBKeyData::Invalid variant is similarly unusable as a HashMap key.\n\nAdd a MESSAGE_CHECK at the putOrAdd handler that keyData is either a\nplaceholder or a valid key. IDBTransaction::putOrAdd sends a placeholder\n(nullptr_t + isPlaceholder=true) for auto-generated keys, which is\nreplaced with the generated key on the server side before any HashMap\ninsertion, so placeholders are exempt. The check cannot be hoisted into\nthe IDBKeyData IPC validator because std::nullptr_t and Invalid variants\nhave legitimate non-placeholder IPC uses (e.g. IDBCursor::advance sends\na null IDBKeyData as the \"no search key\" sentinel; Invalid IDBKeyData\ncan come from detached-ArrayBuffer index keys in multi-entry indexes).\n\nTest: ipc/networkstoragemanager-putoradd-nullptr-key.html\n\n* LayoutTests/ipc/networkstoragemanager-putoradd-nullptr-key-expected.txt: Added.\n* LayoutTests/ipc/networkstoragemanager-putoradd-nullptr-key.html: Added.\n* Source/WebCore/Modules/indexeddb/IDBKeyData.h:\n* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp:\n(WebKit::NetworkStorageManager::putOrAdd):\n\nOriginally-landed-as: 305413.887@safari-7624-branch (7cf0b2823ce9). rdar://180428546\nCanonical link: https://commits.webkit.org/316061@main",
      "email": "cdumez@apple.com",
      "hash": "937bbd7aea09c489b1aa36657ed464bc8bcfb64f",
      "subject": "[IndexedDB] IDBKeyData validation on CoreIPC should reject invalid key types"
    },
    "316062@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316062@main",
      "clUrl": "https://commits.webkit.org/316062@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318131\nrdar://180952966\n\nReviewed by Sammy Gill.\n\nRenderTheme.cpp had two identical `#if PLATFORM(COCOA)` blocks each\nincluding \u003cwtf/cocoa/RuntimeApplicationChecksCocoa.h\u003e. Remove one of them.\n\n* Source/WebCore/rendering/RenderTheme.cpp:\n\nCanonical link: https://commits.webkit.org/316062@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "38d4499ed8bfc7378a25d43c53787fa9aee5e5e0",
      "subject": "Remove duplicate #include of RuntimeApplicationChecksCocoa.h in RenderTheme.cpp"
    },
    "316063@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "316063@main",
      "clUrl": "https://commits.webkit.org/316063@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318147\nrdar://180960359\n\nReviewed by Richard Robinson and Aditya Keerthi.\n\nThe intention with 315851@main was to opt out of installing\nNSRefreshController if there is no conformance to NSRefreshControlHosting.\nThe protocol is actually named \"AppKit.NSRefreshControlHosting\", however,\nso 315851@main unfortunately disabled refresh control in all\nconfigurations.\n\nThis commit fixes the protocol name we want to match against, that way\nwe get refresh control in configurations where  WKWebView+RefreshControl\ndoes get compiled.\n\n* Tools/MiniBrowser/mac/WK2BrowserWindowController.m:\n(-[WK2BrowserWindowController awakeFromNib]):\n\nCanonical link: https://commits.webkit.org/316063@main",
      "email": "a_protyasha@apple.com",
      "hash": "65c0985a6dbd03cef31a6e2b4129c547d6864107",
      "subject": "REGRESSION(315851@main): Cannot pull-to-refresh in any configuration"
    },
    "316064@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316064@main",
      "clUrl": "https://commits.webkit.org/316064@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318133\nrdar://180953714\n\nReviewed by Alan Baradlay.\n\nThe FlowDirection::RightToLeft case in the fieldset border switch was\nmissing a break statement. It is harmless but just to be consistent with\nothers, this patch adds it.\n\nNo change in behavior.\n\n* Source/WebCore/rendering/RenderTreeAsText.cpp:\n(WebCore::RenderTreeAsText::writeRenderObject):\n\nCanonical link: https://commits.webkit.org/316064@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "55a120e94a2db3144c74a2698e6aad63d178f751",
      "subject": "Add missing break in RightToLeft case of fieldset border switch in RenderTreeAsText.cpp"
    },
    "316065@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "316065@main",
      "clUrl": "https://commits.webkit.org/316065@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318052\nrdar://180836842\n\nReviewed by Abrar Rahman Protyasha.\n\n* Source/WTF/wtf/PlatformHave.h:\n\nCanonical link: https://commits.webkit.org/316065@main",
      "email": "richard_robinson2@apple.com",
      "hash": "42e6089e8db46ef7b7b32a0650255091894cbdf7",
      "subject": "Upstream the `HAVE_NSTEXTPLACEHOLDER_RECTS` compile-time feature flag"
    },
    "316066@main": {
      "author": "Antti Koivisto",
      "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64",
      "cl": "316066@main",
      "clUrl": "https://commits.webkit.org/316066@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318117\nrdar://180942670\n\nReviewed by Alan Baradlay.\n\nhttps://drafts.csswg.org/css-mixins-1/#evaluating-custom-functions\n\n\"The hypothetical element `inherits` the values of all custom properties as if it were\n a child of its calling context, with its function parameters overriding `inherited`\n custom properties of the same name.\"\n\nThe function body's builder keeps a pointer to the calling context's builder and resolves\ninherited custom properties against it lazily, only when the body references them, so no\nsnapshot of the calling style is needed. Also handles CSS-wide keyword arguments/defaults\nand results, and propagates attr()-taint through function results.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/dashed-function-cycles-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/dashed-function-eval-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-attr-expected.txt:\n* Source/WebCore/style/StyleBuilder.cpp:\n(WebCore::Style::Builder::applyCustomProperty):\n\nResolve an inherited custom property (var() or the inherit keyword) on the calling\ncontext's builder on demand.\n\n(WebCore::Style::Builder::applyCustomPropertyImpl):\n(WebCore::Style::Builder::resolveFunctionResult):\n\nReturn the resolved value or, per spec, an unresolved CSS-wide keyword.\n\n(WebCore::Style::Builder::resolveCustomPropertyValue):\n* Source/WebCore/style/StyleBuilder.h:\n* Source/WebCore/style/StyleBuilderState.h:\n(WebCore::Style::BuilderState::callingContextBuilder const):\n\nThe calling context's builder while resolving a function's hypothetical element.\n\n* Source/WebCore/style/StyleSubstitutionResolver.cpp:\n(WebCore::Style::SubstitutionResolver::resolveAndRegisterDashedFunctionArguments):\n\nConstruct a bare CSS-wide keyword argument/default as a keyword so it resolves against\nthe calling context.\n\n(WebCore::Style::SubstitutionResolver::substituteDashedFunction):\n\nEmit a CSS-wide keyword result as the keyword token for an untyped function (invalid\nfor a typed return type), and propagate attr()-taint from the result.\n\n* Source/WebCore/style/StyleSubstitutionResolver.h:\n\nCanonical link: https://commits.webkit.org/316066@main",
      "email": "antti@apple.com",
      "hash": "97e17db91411c05c25be1c624107db47e1f39010",
      "subject": "[css-mixins-1] Function body should inherit computed custom property values from the calling context"
    },
    "316067@main": {
      "author": "Marta Darbinyan",
      "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64",
      "cl": "316067@main",
      "clUrl": "https://commits.webkit.org/316067@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318150\nrdar://180961731\n\nUnreviewed test gardening\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/316067@main",
      "email": "darbinyan@apple.com",
      "hash": "3a92711994cbf76e2639eed29aa4344ffe2d33cb",
      "subject": "[ Gardening ]: [macOS] imported/w3c/web-platform-tests/css/css-backgrounds/background-clip tests are constant failure with image diff"
    },
    "316068@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "316068@main",
      "clUrl": "https://commits.webkit.org/316068@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318100\nrdar://179514078\n\nReviewed by Simon Fraser and Abrar Rahman Protyasha.\n\nRemoteScrollingTreeMac::hasNodeWithAnimatedScrollChanged() asserted that it was\nrunning on the scrolling thread, but it can also legitimately be reached on the\nmain thread. After a scroll-to-refresh driven reload, the scrolling tree is\ncommitted on the main thread, and ScrollingTreeScrollingNodeDelegateMac::updateFromStateNode()\nrestores the saved rubber-band state by synchronously starting a rubber-band animation.\nThat calls setScrollAnimationInProgress(true), which toggles\nScrollingTree::m_treeState.nodesWithActiveScrollAnimations from empty to non-empty and\ninvokes hasNodeWithAnimatedScrollChanged() — on the main thread, tripping\nASSERT(ScrollingThread::isCurrentThread()) in debug builds.\n\nThe assertion was overly strict. The mutated state is guarded by m_treeStateLock,\nwhich is held across the mutation regardless of the calling thread, and the\noverride body only does a RunLoop::mainSingleton().dispatch(), which is safe from\nany thread; the main-thread caller was therefore always correct.\n\nFix by removing the assertion.\n\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteScrollingTreeMac.mm:\n(WebKit::RemoteScrollingTreeMac::hasNodeWithAnimatedScrollChanged):\n\nCanonical link: https://commits.webkit.org/316068@main",
      "email": "richard_robinson2@apple.com",
      "hash": "6c93b8ced48c62e201b957d849faf08cfc73ea91",
      "subject": "[Debug] UI process sometimes crashes after scroll to refresh (ScrollingThread::isCurrentThread() assert under RemoteScrollingTreeMac::hasNodeWithAnimatedScrollChanged())"
    },
    "316069@main": {
      "author": "Said Abou-Hallawa",
      "avatar": "https://www.gravatar.com/avatar/ae80a929a378a055822829ae63903296?d=identicon\u0026s=64",
      "cl": "316069@main",
      "clUrl": "https://commits.webkit.org/316069@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318046\nrdar://179152566\n\nReviewed by Mike Wyrzykowski.\n\nCGImageCreatePixelBufferAttributesForHDRTarget() is to get the attributes of the\ntarget CVPixelBuffer. The target pixel format is set explicitly to 'RGhA'.\n\nInstead of calling VTCreateCGImageFromCVPixelBuffer(), CVPixelBufferGetIOSurface()\nand CGImageCreateFromIOSurface() are used to get a CGImage from the target\nCVPixelBuffer.\n\n* Source/WebCore/Configurations/AllowedSPI.toml:\n* Source/WebCore/PAL/pal/spi/cg/ImageIOSPI.h:\n(CF_CLOSED_ENUM):\n* Source/WebCore/platform/graphics/cocoa/CVPixelBufferUtilities.cpp:\n(WebCore::createScratchCVPixelBuffer):\n* Source/WebCore/platform/graphics/cocoa/CVPixelBufferUtilities.h:\n* Source/WebCore/platform/graphics/cocoa/ShareableGainMap.cpp:\n(WebCore::setDictionaryValue):\n(WebCore::ShareableGainMap::applyGainMapToBaseImage const):\n\nCanonical link: https://commits.webkit.org/316069@main",
      "email": "said@apple.com",
      "hash": "dfcca6f9900ac6564be76443848bf518bf8c4bf2",
      "subject": "REGRESSION(313341@main): All gain-map images are decoded into 8-bits per channel pixels"
    },
    "316070@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "316070@main",
      "clUrl": "https://commits.webkit.org/316070@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318040\nrdar://180824633\n\nReviewed by Abrar Rahman Protyasha.\n\nAlso take the opportunity to convert `WKPanGestureRecognizer` to Swift.\n\n* Source/WebCore/platform/RectEdges.h:\nAnnotate some functions to specify the lifetimes of their returned value.\n\n* Source/WebKit/Modules/Internal/module.modulemap:\nAdd WKAppKitGestureController to the module so Swift can see it\n\n* Source/WebKit/UIProcess/mac/WKAppKitGestureController.h:\nExpose some methods/properties so that the Objective-C and Swift sides of WKAppKitGestureController can interop.\nThese will be removed as more of the file becomes Swift.\n\n* Source/WebKit/UIProcess/mac/WKAppKitGestureController.mm:\n(-[WKAppKitGestureController webView]):\n(-[WKAppKitGestureController panGestureRecognizer]):\n(-[WKAppKitGestureController setPanGestureRecognizer:]):\n(-[WKPanGestureRecognizer initWithPage:target:action:]): Deleted.\n(-[WKPanGestureRecognizer shouldRecognizeForDelta:]): Deleted.\n(-[WKAppKitGestureController setUpPanGestureRecognizer]): Deleted.\nRemove the Obj-C implementation\n\n* Source/WebKit/UIProcess/mac/WKAppKitGestureController.swift: Added.\n(WKPanGestureRecognizer.webView):\n(WKPanGestureRecognizer._shouldRecognize(forDelta:)):\n(WKAppKitGestureController.setUpPanGestureRecognizer):\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\nImplementation in Swift, and use the `NSPanGestureRecognizer._shouldRecognize(forDelta:)` SPI.\n\nCanonical link: https://commits.webkit.org/316070@main",
      "email": "richard_robinson2@apple.com",
      "hash": "cc76b52970313c929ffe2570f568b52e686ea50a",
      "subject": "[AppKit Gestures] Adopt the `NSPanGestureRecognizer._shouldRecognize(forDelta:)` SPI for WKPanGestureRecognizer"
    },
    "316071@main": {
      "author": "Devin Rousso",
      "avatar": "https://www.gravatar.com/avatar/c9e757d973342c773f107a94b70cb9cd?d=identicon\u0026s=64",
      "cl": "316071@main",
      "clUrl": "https://commits.webkit.org/316071@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=289172\n\u003crdar://problem/146863680\u003e\n\nReviewed by Qianlang Chen.\n\nThere's no reason to delay calculating the ordering of pseudo-element styles until after inline styles are fetched.\n\n* Source/WebInspectorUI/UserInterface/Models/DOMNodeStyles.js:\n(WI.DOMNodeStyles.prototype.refresh.fetchedMatchedStyles):\n(WI.DOMNodeStyles.prototype._updateStyleCascade):\n\n* Source/WebInspectorUI/UserInterface/Views/SpreadsheetRulesStyleDetailsPanel.js:\n(WI.SpreadsheetRulesStyleDetailsPanel.prototype.layout):\n\n* LayoutTests/inspector/css/getMatchedStylesForNodeBackdropPseudoId.html:\n* LayoutTests/inspector/css/getMatchedStylesForNodeMarkerPseudoId.html:\n* LayoutTests/inspector/css/getMatchedStylesForNodeViewTransitionPseudoElements.html:\n\nCanonical link: https://commits.webkit.org/316071@main",
      "email": "hi@devinrousso.com",
      "hash": "aeccc1a965fcd8cd5c69eaa7ea1532fad549cba6",
      "subject": "Uncaught Exception: TypeError: undefined is not an object (evaluating 'style of orderedStyles')"
    },
    "316072@main": {
      "author": "Andy Estes",
      "avatar": "https://www.gravatar.com/avatar/643f10f01b26fd94d03482a2013b2ea0?d=identicon\u0026s=64",
      "cl": "316072@main",
      "clUrl": "https://commits.webkit.org/316072@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318136\nrdar://180956144\n\nReviewed by Abrar Rahman Protyasha.\n\nTestWebKitAPI.app failed to launch on iOS Simulators because it embeds BrowserEngineKit extensions\nwithout having the com.apple.developer.web-browser-engine.host entitlement. TestWebKitAPI's\nprocess-entitlements.sh script added this entitlement to its generated .xcent file, but when\nENABLE_DEBUG_DYLIB is enabled the entitlements would be incorrectly added as a section in the debug\n.dylib rather than the stub binary. Since TestWebKitAPI.app doesn't need the feature enabled by\nENABLE_DEBUG_DYLIB, disabled it so that codesigning works as expected on iOS Simulator.\n\n* Tools/TestWebKitAPI/Configurations/TestWebKitAPIApp.xcconfig:\n\nCanonical link: https://commits.webkit.org/316072@main",
      "email": "aestes@apple.com",
      "hash": "aa29d1df6e5c227f3d0bcf2ebc8e3e1c45351420",
      "subject": "[iOS Simulator] TestWebKitAPI.app fails to launch due to missing web browser host entitlement"
    }
  },
  "date": "2026-06-29",
  "days": 1,
  "generatedAt": "2026-06-29T22:06:08Z",
  "markdown": "## Highlights\n- **Security** Fixed CoreIPC request body forwarding that could exfiltrate arbitrary local files through CFNetwork. [commit 316056@main](https://commits.webkit.org/316056@main)\n- **Security** Closed a cross-origin cookie access path in WebResourceLoader::WillSendRequest reply handling. [commit 316046@main](https://commits.webkit.org/316046@main)\n- **Security** Fixed a JSC Wasm use-after-free caused by stale pointers after memory growth in DFG constant folding. [commit 316043@main](https://commits.webkit.org/316043@main)\n- **Security** Tightened IndexedDB IPC validation so invalid key types are rejected at the CoreIPC boundary. [commit 316061@main](https://commits.webkit.org/316061@main)\n- **Web Platform** Async Clipboard paste access now requests permission asynchronously, aligning behavior with the platform model. [commit 315997@main](https://commits.webkit.org/315997@main)\n- **Rendering** Fixed a gain-map regression that forced all images down to 8 bits per channel. [commit 316069@main](https://commits.webkit.org/316069@main)\n- **UI** Restored pull-to-refresh after a regression that broke it in every configuration. [commit 316063@main](https://commits.webkit.org/316063@main)\n- **Perf** Improved Mail editing latency for complicated replies. [commit 316044@main](https://commits.webkit.org/316044@main)\n- **V8** JSC landed a cluster of runtime and compiler improvements, including faster regex and iterator paths plus better DFG bailout behavior. [commit 315986@main](https://commits.webkit.org/315986@main)\n- **GPU** WebGPU now rejects duplicate bind group entries up front instead of accepting invalid binding state. [commit 316038@main](https://commits.webkit.org/316038@main)\n\n## What landed by area\n\n### JavaScriptCore and regex\n- **V8** Added missing DFG exit-profile bails to avoid invalid optimized paths in some nodes. [commit 316013@main](https://commits.webkit.org/316013@main)\n- **V8** Made `Array.from(arguments)` fast path bail out when argument count exceeds storage vector limits. [commit 316014@main](https://commits.webkit.org/316014@main)\n- **V8** Removed `GlobalOperations.js`, continuing the shift of runtime paths out of JS glue. [commit 316009@main](https://commits.webkit.org/316009@main)\n- **Perf** Optimized AirFixObviousSpills in the backend. [commit 315993@main](https://commits.webkit.org/315993@main)\n- **Perf** Cached named-capture `groups` Structure on RegExp to cut repeated setup overhead. [commit 315989@main](https://commits.webkit.org/315989@main)\n- **Perf** Moved Map/Set iterator `next` into C++ for a cheaper hot path. [commit 315986@main](https://commits.webkit.org/315986@main)\n- **Perf** Added a latin1Table to YARR for more efficient Char8 filtering. [commit 315985@main](https://commits.webkit.org/315985@main)\n- **Perf** Used StringList optimization in YARR when captures are not needed. [commit 315987@main](https://commits.webkit.org/315987@main)\n- **Build** Fixed `testapi` hitting an `initializeMainThread` assertion. [commit 314233@main](https://commits.webkit.org/314233@main)\n\n### Security and process safety\n- **Security** Fixed CloseWatcher destruction reentrancy that could trigger a use-after-free through abort-signal callbacks. [commit 316040@main](https://commits.webkit.org/316040@main)\n- **Security** Fixed a WebCore use-after-free in `EventRegionContext::shrinkWrapInteractionRegions` during vector reallocation. [commit 316042@main](https://commits.webkit.org/316042@main)\n- **Security** Fixed SWClientConnection background fetch registration updates mutating a live hash table during synchronous dispatch. [commit 316035@main](https://commits.webkit.org/316035@main)\n- **Security** Fixed uninitialized GPUP heap disclosure in `RemoteVideoFrameObjectHeap::convertFrameBuffer`. [commit 316033@main](https://commits.webkit.org/316033@main)\n- **Security** Fixed the same GPUP heap disclosure issue in a follow-up landing. [commit 316032@main](https://commits.webkit.org/316032@main)\n- **Security** Fixed `PathCG::strokeContains()` thread safety. [commit 316037@main](https://commits.webkit.org/316037@main)\n- **Security** Tightened CSP parsing so nonce-source and hash-source reject trailing junk after the closing quote. [commit 316008@main](https://commits.webkit.org/316008@main)\n- **Security** Fixed mutation-during-iteration in `LocalFrameViewLayoutContext::removeScrollerFromAnchorScrollAdjusters`. [commit 316000@main](https://commits.webkit.org/316000@main)\n\n### Web platform, DOM, editing, and storage\n- **Web Platform** `FileReader.readAsText()` now honors the Blob type's charset parameter. [commit 315996@main](https://commits.webkit.org/315996@main)\n- **Web Platform** Meta refresh to a URL with only a different fragment no longer gets treated as a full page reload. [commit 316001@main](https://commits.webkit.org/316001@main)\n- **Web Platform** `css-mixins-1` function bodies now inherit computed custom property values from the calling context. [commit 316066@main](https://commits.webkit.org/316066@main)\n- **Web Platform** Re-imported `css-mixins-1` tests after the behavior fix. [commit 316058@main](https://commits.webkit.org/316058@main)\n- **Web Platform** Added delegated request support for returning the `\"delegatedSession\"` endpoint name. [commit 316010@main](https://commits.webkit.org/316010@main)\n- **UI** `DeleteSelectionCommand` no longer leaves an empty trailing table row after deletion. [commit 315990@main](https://commits.webkit.org/315990@main)\n- **Privacy** Relaxed an IndexedDB version change transaction `MESSAGE_CHECK` to a logged fault with early return, reducing fatal behavior on bad messages. [commit 315995@main](https://commits.webkit.org/315995@main)\n- **A11y** Text Extraction replacement strings now match case-insensitively and diacritic-insensitively. [commit 316028@main](https://commits.webkit.org/316028@main)\n\n### Rendering, layout, and animations\n- **Rendering** Added support in GFC for items with auto or calc margins. [commit 316050@main](https://commits.webkit.org/316050@main)\n- **Refactor** Added size-type wrapper structs in GFC to make annotations clearer and safer. [commit 316039@main](https://commits.webkit.org/316039@main)\n- **Rendering** Fixed a web-animations crash when accelerated animation has a view progress timeline range but no timeline. [commit 316036@main](https://commits.webkit.org/316036@main)\n- **Rendering** Fixed a use-after-free in `AnimationTimelinesController::suspendAnimations` caused by rehash during iteration. [commit 316031@main](https://commits.webkit.org/316031@main)\n- **Rendering** Fixed `RenderFlexibleBox` reading last-line item count from the first line. [commit 316027@main](https://commits.webkit.org/316027@main)\n- **Rendering** Fixed event region bookkeeping so touch event types include `MouseUp` and stop duplicating `MouseMove`. [commit 316024@main](https://commits.webkit.org/316024@main)\n- **Rendering** Fixed concentric inner-button corner radius checks ignoring bottom inset for horizontal text controls. [commit 316022@main](https://commits.webkit.org/316022@main)\n- **Rendering** Fixed `colorWithTargetLuminance()` passing `std::clamp()` arguments in the wrong order. [commit 316021@main](https://commits.webkit.org/316021@main)\n- **Refactor** Removed redundant `RenderBox::borderBoxLogicalSize`. [commit 316019@main](https://commits.webkit.org/316019@main)\n- **Refactor** Renamed `RenderBox::size()` and `setSize()` to `borderBoxSize()` and `setBorderBoxSize()` for clarity. [commit 316018@main](https://commits.webkit.org/316018@main)\n- **Refactor** Deduplicated multi-line nine-piece image strip computation in `InlineBoxPainter`. [commit 316045@main](https://commits.webkit.org/316045@main)\n- **Perf** Cached deviceScaleFactor in `BorderPainter::drawBoxSideFromPath`. [commit 315988@main](https://commits.webkit.org/315988@main)\n- **Refactor** Removed a redundant duplicate condition in `SVGRenderingContext::prepareToRenderSVGContent`. [commit 316004@main](https://commits.webkit.org/316004@main)\n- **Refactor** Fixed misspelled identifiers in rendering code. [commit 315992@main](https://commits.webkit.org/315992@main)\n- **Refactor** Used `SetForScope` in `RenderLayerScrollableArea::updateMarqueePosition()`. [commit 316047@main](https://commits.webkit.org/316047@main)\n\n### Media, graphics, GPU, and XR\n- **Media** Removed dead `MediaContainmentEnabled` preference code. [commit 316020@main](https://commits.webkit.org/316020@main)\n- **Media** Switched `colorSpaceFromFormatDescription()` to `dynamic_cf_cast\u003cCFBooleanRef\u003e` for FullRangeVideo parsing. [commit 315991@main](https://commits.webkit.org/315991@main)\n- **GPU** Fixed WGSL pointer access mode validation test failures. [commit 316029@main](https://commits.webkit.org/316029@main)\n- **GPU** OpenXR no longer depends on OpenGLES. [commit 316023@main](https://commits.webkit.org/316023@main)\n- **Media** Added API coverage for `TimeRanges::nearest()`. [commit 316026@main](https://commits.webkit.org/316026@main)\n- **Build** Fixed a CG switch in `gradientOptionsDictionary()` that could fall off the end of a non-void function. [commit 316059@main](https://commits.webkit.org/316059@main)\n\n### Networking, loading, and quirks\n- **Networking** Fixed wrong-container `end()` comparisons in `WebFrameProxy::nextSibling` and `previousSibling`. [commit 316041@main](https://commits.webkit.org/316041@main)\n- **Networking** Fixed duplicate traversal during per-frame back/forward walk under Site Isolation that could clobber iframe navigation. [commit 316017@main](https://commits.webkit.org/316017@main)\n- **Networking** Fixed `UserAgentStringParser` storing Safari product version in the wrong field. [commit 315999@main](https://commits.webkit.org/315999@main)\n- **Perf** Avoided constructing the frame `RegistrableDomain` twice in optional storage access iframe quirks. [commit 316007@main](https://commits.webkit.org/316007@main)\n- **Perf** Cached the registrable domain string and used `_s` literals in custom UA override quirks. [commit 316005@main](https://commits.webkit.org/316005@main)\n- **Perf** Used an `_s` literal for host comparison in the T-Mobile quirks path. [commit 316003@main](https://commits.webkit.org/316003@main)\n- **Refactor** Removed redundant duplicate checks in embedded YouTube storage access quirks. [commit 316002@main](https://commits.webkit.org/316002@main)\n- **Perf** Avoided `foldCase` and URL re-parse when consistent query parameter filtering quirk is disabled. [commit 315998@main](https://commits.webkit.org/315998@main)\n\n### Platform UI, input, and Apple ports\n- **UI** Adopted `NSPanGestureRecognizer._shouldRecognize(forDelta:)` SPI for `WKPanGestureRecognizer`. [commit 316070@main](https://commits.webkit.org/316070@main)\n- **UI** Fixed a debug-only UI process crash after scroll-to-refresh. [commit 316068@main](https://commits.webkit.org/316068@main)\n- **Mobile** Fixed x.com so the software keyboard delete key responds again after dictation. [commit 316049@main](https://commits.webkit.org/316049@main)\n- **Perf** Upstreamed the `HAVE_NSTEXTPLACEHOLDER_RECTS` compile-time feature flag. [commit 316065@main](https://commits.webkit.org/316065@main)\n- **Build** Fixed iOS Simulator `TestWebKitAPI.app` launch failures caused by a missing web browser host entitlement. [commit 316072@main](https://commits.webkit.org/316072@main)\n- **Build** Converted `WKWebView.Coding` tests to Swift Testing. [commit 316060@main](https://commits.webkit.org/316060@main)\n\n### GTK, WPE, GStreamer, and Linux ports\n- **Media** Fixed a WPE crash in `media-source-real-play-after-eos.html`. [commit 316053@main](https://commits.webkit.org/316053@main)\n- **Build** Fixed WPE build breakage with clang-18. [commit 316015@main](https://commits.webkit.org/316015@main)\n- **Media** Fixed a GStreamer WebRTC `GstPromise` warning around Cloudflare bot check flows and frame.work loading. [commit 316012@main](https://commits.webkit.org/316012@main)\n- **Media** Fixed GStreamer Chroma site validation failures for DMABuf caps. [commit 316011@main](https://commits.webkit.org/316011@main)\n- **Build** Explicitly typed variables assigned from `adoptGRef` calls in GLib code. [commit 316052@main](https://commits.webkit.org/316052@main)\n- **Build** Added a C++ coding style check for `auto = adoptGRef` cases. [commit 316057@main](https://commits.webkit.org/316057@main)\n- **Build** Improved `analyze-safer-cpp` header-only analysis. [commit 316054@main](https://commits.webkit.org/316054@main)\n- **Build** Removed an erroneous GLib test expectation for `basic-ascii.html`. [commit 316030@main](https://commits.webkit.org/316030@main)\n- **Perf** Fixed three performance tests failing on the GTK Linux release perf bot. [commit 316016@main](https://commits.webkit.org/316016@main)\n\n### Tests, tooling, and smaller correctness fixes\n- **DevTools** Fixed an uncaught `TypeError` from `orderedStyles` handling. [commit 316071@main](https://commits.webkit.org/316071@main)\n- **Build** Fixed constant image diff failures in imported WPT `background-clip` tests on macOS. [commit 316067@main](https://commits.webkit.org/316067@main)\n- **Build** Fixed constant text failure in `ipc/networksessioncocoa-empty-resource-request.html`. [commit 316051@main](https://commits.webkit.org/316051@main)\n- **Build** Added a missing `break` in the right-to-left fieldset border switch in `RenderTreeAsText.cpp`. [commit 316064@main](https://commits.webkit.org/316064@main)\n- **Build** Removed a duplicate include of `RuntimeApplicationChecksCocoa.h` in `RenderTheme.cpp`. [commit 316062@main](https://commits.webkit.org/316062@main)\n- **Build** Fixed a Site Isolation debug test for draw-after-navigate-to-domain-again. [commit 316025@main](https://commits.webkit.org/316025@main)\n- **Build** Rounded up with `WTF::roundUpToMultipleOf` in `BitVector::OutOfLineBits::create`. [commit 315994@main](https://commits.webkit.org/315994@main)\n\n## Reverts \u0026 Reapplies\n\nNone.",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [
    {
      "name": "Unreviewed",
      "count": 2
    },
    {
      "name": "Versioning.",
      "count": 1
    }
  ],
  "since": "2026-06-29",
  "totals": {
    "commits": 88,
    "features": 85,
    "rolls": 3
  },
  "until": "2026-06-29"
}