{
  "commits": {
    "259384@main": {
      "author": "Anthony Tarbinian",
      "avatar": "https://www.gravatar.com/avatar/ef46154a1a21c6a5ef593e952ebc62f4?d=identicon\u0026s=64",
      "cl": "259384@main",
      "clUrl": "https://commits.webkit.org/259384@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316653\nrdar://179100444\n\nReviewed by Charlie Wolfe.\n\nCurrently, the URL of a cross-origin iframe can be guessed based\non the timing of a load event of a same-document navigation.\n\nBefore this patch, WebKit fires a synthetic load event when a\ncross-origin frame is navigated to the same-document (see\nFrameLoader::loadInSameDocument from https://commits.webkit.org/259384@main ).\n\nHowever, this load event fires immediately and synchronously.\nSo from JS, the timing of this immediate load event could be noticed\nand used as an oracle to determine if a cross-origin iframe is a the\nsame URL as the navigation destination.\n\nThis patch adds a delayed timer before firing the load event\nwhen a cross-origin parent initiates a same-document navigation.\n\nThis fix is similar to what is described in https://chromium-review.googlesource.com/c/chromium/src/+/7560041\n\nTest: http/tests/navigation/cross-origin-iframe-fragment-navigation-onload-url-leak.html\n\n* LayoutTests/http/tests/navigation/cross-origin-iframe-fragment-navigation-onload-url-leak-expected.txt: Added.\n* LayoutTests/http/tests/navigation/cross-origin-iframe-fragment-navigation-onload-url-leak.html: Added.\n* LayoutTests/http/tests/navigation/cross-origin-iframe-location-hash-reexecute-onload.html:\n    Added delay to wait for delayed load\n* LayoutTests/http/tests/navigation/cross-origin-navigation-fires-onload.html:\n    Added delay to wait for delayed load\n* Source/WebCore/loader/FrameLoader.cpp:\n(WebCore::FrameLoader::FrameLoader):\n    Initialize timer\n(WebCore::FrameLoader::clear):\n    Stop timer\n(WebCore::FrameLoader::startCrossOriginParentSyntheticSameDocLoadEventTimer):\n    Start a new timer and cancel an existing one, if any.\n(WebCore::FrameLoader::crossOriginParentSyntheticSameDocLoadEventTimerFired):\n    Dispatch load event when timer fires\n(WebCore::FrameLoader::loadInSameDocument):\n    Start timer\n(WebCore::FrameLoader::stopAllLoadersAndCheckCompleteness):\n    Stop timer\n(WebCore::FrameLoader::frameDetached):\n    Stop timer\n(WebCore::FrameLoader::continueLoadAfterNavigationPolicy):\n    Stop timer\n* Source/WebCore/loader/FrameLoader.h:\n\nCanonical link: https://commits.webkit.org/316098@main",
      "email": "a_tarbinian@apple.com",
      "hash": "d7c0b5ae247bd01a12f6741b142f8e6b5aeaeda8",
      "subject": "Fire async load event to prevent guessing a cross-origin iframe's URL"
    },
    "316073@main": {
      "author": "Devin Rousso",
      "avatar": "https://www.gravatar.com/avatar/c9e757d973342c773f107a94b70cb9cd?d=identicon\u0026s=64",
      "cl": "316073@main",
      "clUrl": "https://commits.webkit.org/316073@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=287639\n\u003crdar://problem/145226764\u003e\n\nReviewed by Qianlang Chen.\n\nWait to set the `title` of the `WI.TimelineMarker` until when it's added to the DOM as it's not needed until then.\nAs a byproduct, this is after the `_startTime` is set, which is needed to ensure the right timestamp is shown.\n\n* Source/WebInspectorUI/UserInterface/Views/TimelineRuler.js:\n(WI.TimelineRuler.prototype.addMarker):\n(WI.TimelineRuler.prototype._updateMarkers):\n\nCanonical link: https://commits.webkit.org/316073@main",
      "email": "hi@devinrousso.com",
      "hash": "39abc0748ebf842bfc66a51c49419cfd2bb7353e",
      "subject": "Web Inspector: timeline exports/imports wrong timestamp for performance.mark()"
    },
    "316074@main": {
      "author": "Devin Rousso",
      "avatar": "https://www.gravatar.com/avatar/c9e757d973342c773f107a94b70cb9cd?d=identicon\u0026s=64",
      "cl": "316074@main",
      "clUrl": "https://commits.webkit.org/316074@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=291623\n\u003crdar://problem/149847746\u003e\n\nReviewed by Qianlang Chen.\n\nConvert the local file's contents to UTF-8 instead of assuming that it's Latin1.\n\n* Source/WebKit/UIProcess/Inspector/mac/RemoteWebInspectorUIProxyMac.mm:\n(WebKit::RemoteWebInspectorUIProxy::platformLoad):\n* Source/WebKit/UIProcess/Inspector/mac/WebInspectorUIProxyMac.mm:\n(WebKit::WebInspectorUIProxy::platformLoad):\n\n* LayoutTests/http/tests/inspector/network/local-resource-override-mapped-to-file.html:\n* LayoutTests/http/tests/inspector/network/local-resource-override-mapped-to-file-expected.txt:\n\nCanonical link: https://commits.webkit.org/316074@main",
      "email": "hi@devinrousso.com",
      "hash": "21ae2b0e4d3313ed711aa3898a5ab88e877ccec0",
      "subject": "Wrong character encoding of local reponse override when mapped to file (interpreted as Latin1/ISO-8859-1)"
    },
    "316075@main": {
      "author": "Marta Darbinyan",
      "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64",
      "cl": "316075@main",
      "clUrl": "https://commits.webkit.org/316075@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318155\nrdar://180965366\n\nUnreviewed test gardening\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/316075@main",
      "email": "darbinyan@apple.com",
      "hash": "e5f14b7b33b2af10263749861fb731d8674c98fc",
      "subject": "[Gardening]: [iOS] TestWebKitAPI.PasteHTML.DoesNotTransformColorsOfLightContent is flaky failure on EWS bots"
    },
    "316076@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316076@main",
      "clUrl": "https://commits.webkit.org/316076@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317996\nrdar://180784731\n\nReviewed by Kimmo Kinnunen.\n\nImageBuffer's constructor takes ImageBufferParameters by value but then\ncopies it into the m_parameters member. ImageBufferParameters wraps a\nref-counted DestinationColorSpace, so the extra copy causes redundant\nref/deref churn on the color space for every off-screen buffer allocation.\n\nMove the by-value parameter into the member instead, matching the\nadjacent m_backend(WTF::move(backend)) initializer.\n\n* Source/WebCore/platform/graphics/ImageBuffer.cpp:\n(WebCore::ImageBuffer::ImageBuffer):\n\nCanonical link: https://commits.webkit.org/316076@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "2abc9bd76357f82bfa6a03743305b4f0ba10125d",
      "subject": "ImageBuffer constructor should move its Parameters instead of copying"
    },
    "316077@main": {
      "author": "Simon Fraser",
      "avatar": "https://www.gravatar.com/avatar/3763324aa0cdfa93be751c6081b8006a?d=identicon\u0026s=64",
      "cl": "316077@main",
      "clUrl": "https://commits.webkit.org/316077@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318055\nrdar://99614217\n\nReviewed by Wenson Hsieh and Abrar Rahman Protyasha.\n\nFix node snapshots to work correctly for elements affected by CSS transforms.\n\n`RenderObject::subtreePaintRootRect()` (renamed from `paintingRootRect`) takes\nan argument specifying whether to respect transforms, and uses that to compute\nabsolute rects as appropriate.\n\n`snapshotNode()` then calls `subtreePaintRootRect(..., RespectTransforms::Yes)`,\nbut also now returns the paintingRect and elementRect computed taking transforms\ninto account. This means that `createDragImageForImage()` no longer needs to\ncompute the rects itself.\n\nThe final part of the fix in `EventHandler::handleDrag()` ensures that the offset\nof the drag image from the cursor is correct; `absoluteBoundingBoxRect()` respects\ntransforms.\n\nTests: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebViewSnapshot.mm\n       Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ios/DragAndDropTestsIOS.mm\n       Tools/TestWebKitAPI/Tests/WebKit/WKWebView/mac/DragAndDropTestsMac.mm\n\n* Source/WebCore/inspector/agents/InspectorPageAgent.cpp:\n(WebCore::InspectorPageAgent::snapshotNode):\n(WebCore::InspectorPageAgent::snapshotRect):\n* Source/WebCore/page/ContextMenuController.cpp:\n(WebCore::prepareContextForQRCode):\n* Source/WebCore/page/EventHandler.cpp:\n(WebCore::EventHandler::handleDrag):\n* Source/WebCore/page/FrameSnapshotting.cpp:\n(WebCore::snapshotNode):\n* Source/WebCore/page/FrameSnapshotting.h:\n* Source/WebCore/platform/DragImage.cpp:\n(WebCore::createDragImageForImage):\n* Source/WebCore/rendering/RenderObject.cpp:\n(WebCore::RenderObject::addAbsoluteRectForLayer):\n(WebCore::RenderObject::subtreePaintRootRect):\n(WebCore::RenderObject::paintingRootRect): Deleted.\n* Source/WebCore/rendering/RenderObject.h:\n* Source/WebKit/WebProcess/Automation/WebAutomationSessionProxy.cpp:\n(WebKit::snapshotElementRectForScreenshot):\n* Source/WebKit/WebProcess/FullScreen/WebFullScreenManager.cpp:\n(WebKit::screenRectOfContents):\n* Source/WebKit/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp:\n(WebKit::InjectedBundleNodeHandle::renderedImage):\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::shareableBitmapSnapshotForNode):\n(WebKit::WebPage::snapshotNode):\n* Tools/TestWebKitAPI/Resources/cocoa/DataTransfer-setDragImage.html:\n* Tools/TestWebKitAPI/Resources/cocoa/node-snapshotting.html:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebViewSnapshot.mm:\n(TestWebKitAPI::TEST(WKWebView, SnapshotNodeWithTransform)):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ios/DragAndDropTestsIOS.mm:\n(TestWebKitAPI::TEST(DragAndDropTests, DragLiftPreviewDataTransferSetDragImage)):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/mac/DragAndDropTestsMac.mm:\n(TEST(DragAndDropTests, DragPreviewOriginForTransformedElement)):\n\nCanonical link: https://commits.webkit.org/316077@main",
      "email": "simon.fraser@apple.com",
      "hash": "0e3ecbee7ab1e0aac1be7f61b27174787a049722",
      "subject": "Drag image of DOM elements with CSS transforms aren't rendered correctly"
    },
    "316078@main": {
      "author": "Mike Wyrzykowski",
      "avatar": "https://www.gravatar.com/avatar/4b1bc9e238714f95e22d5d2454c07066?d=identicon\u0026s=64",
      "cl": "316078@main",
      "clUrl": "https://commits.webkit.org/316078@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315368\nrdar://177434793\n\nReviewed by Cameron McCormack.\n\nAdd missing cross-origin check when the cache is reached.\n\nTests: fast/webgpu/regression/repro_315368.html\n       fast/webgpu/regression/repro_315368b.html\n\n* LayoutTests/fast/webgpu/regression/repro_315368-expected.txt: Added.\n* LayoutTests/fast/webgpu/regression/repro_315368.html: Added.\n* LayoutTests/fast/webgpu/regression/repro_315368b-expected.txt: Added.\n* LayoutTests/fast/webgpu/regression/repro_315368b.html: Added.\n* Source/WebCore/Modules/WebGPU/GPUDevice.cpp:\n\nOriginally-landed-as: 305413.958@safari-7624-branch (1533e0fdea84). rdar://180429320\nCanonical link: https://commits.webkit.org/316078@main",
      "email": "mwyrzykowski@apple.com",
      "hash": "67b563b85f480c701685499724961248236b2915",
      "subject": "WebGPU importExternalTexture origin-clean bypass in Safari"
    },
    "316079@main": {
      "author": "Lily Spiniolas",
      "avatar": "https://www.gravatar.com/avatar/b65cfeb51301399bd50e338bb2d7613e?d=identicon\u0026s=64",
      "cl": "316079@main",
      "clUrl": "https://commits.webkit.org/316079@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318113\nrdar://180929851\n\nReviewed by Aditya Keerthi and Abrar Rahman Protyasha.\n\nEnsure the toolbar is not automatically hidden when the test runs\nby attaching a titlebar accessory to the window. Then, ensure the\ntop safe area inset is subtracted from the expected value since the scroll\npocket does not and should not extend into the top safe area inset.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ObscuredContentInsets.mm:\n(TestWebKitAPI::TEST(ObscuredContentInsets, ScrollPocketCoversFullScreenTitlebar)):\n\nCanonical link: https://commits.webkit.org/316079@main",
      "email": "lily_spiniolas@apple.com",
      "hash": "0453fb99bc696df8ff2607eee41adad5a31d11f2",
      "subject": "[macOS] API test ObscuredContentInsets.ScrollPocketCoversFullScreenTitlebar is failing"
    },
    "316080@main": {
      "author": "Shu-yu Guo",
      "avatar": "https://www.gravatar.com/avatar/3884544eb9e557e2ec917d32c6e12720?d=identicon\u0026s=64",
      "cl": "316080@main",
      "clUrl": "https://commits.webkit.org/316080@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313473\nrdar://175674018\n\nReviewed by Keith Miller.\n\nCurrently, ArrayBuffers that are created by WebAssembly.Memory.p.\ntoResizableBuffer do not keep that WebAssembly.Memory instance alive. This is a\nmemory safety footgun. While JS-originated resizable ABs reserve the virtual\nmemory of their max size up front, wasm-originated resizable ABs can either be\nbounds-checking which do not reserve virtual memory up front, or signaling,\nwhich do. Currently, because wasm-originated ArrayBuffers do not keep their\nWebAssembly.Memory alive, non-wasm ArrayBuffer code has to be aware of this\nimplementation in case the WebAssembly.Memory gets collected. This complicates\nthe object representation space and is error-prone.\n\nThis PR simplifies this set up by making wasm-originated ArrayBuffers and their\noriginator WebAssembly.Memory exist in a GC lifetime cycle. This means\nwasm-originated ABs _always_ delegate resizing to WebAssembly.Memory.\n\nThe weak pointer to the underlying Wasm::Memory in ArrayBuffers is no longer\nneeded and removed.\n\nThe spot fix to keep WebAssembly.Memory alive for the duration of\nArrayBuffer.prototype.resize from 305413.660@safari-7624-branch is also\nreverted as this fix removes the need for it.\n\nTest: JSTests/wasm/stress/wasm-resizable-buffer-resize-after-gc.js\n\n* JSTests/wasm/stress/wasm-resizable-buffer-resize-after-gc.js: Added.\n(flushStackRoots):\n* Source/JavaScriptCore/jsc.cpp:\n(JSC_DEFINE_HOST_FUNCTION):\n* Source/JavaScriptCore/runtime/ArrayBuffer.cpp:\n(JSC::ArrayBuffer::resize):\n(JSC::ArrayBuffer::setAssociatedWasmMemory): Deleted.\n* Source/JavaScriptCore/runtime/ArrayBuffer.h:\n* Source/JavaScriptCore/runtime/JSArrayBuffer.cpp:\n(JSC::JSArrayBuffer::associatedWasmMemoryWrapper const):\n(JSC::JSArrayBuffer::setAssociatedWasmMemoryWrapper):\n(JSC::JSArrayBuffer::clearAssociatedWasmMemoryWrapper):\n(JSC::JSArrayBuffer::visitChildrenImpl):\n* Source/JavaScriptCore/runtime/JSArrayBuffer.h:\n* Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n* Source/JavaScriptCore/wasm/WasmMemory.cpp:\n(JSC::Wasm::Memory::Memory):\n(JSC::Wasm::Memory::create):\n(JSC::Wasm::Memory::createZeroSized):\n(JSC::Wasm::Memory::tryCreate):\n(JSC::Wasm::Memory::growShared):\n(JSC::Wasm::Memory::grow):\n* Source/JavaScriptCore/wasm/WasmMemory.h:\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp:\n(JSC::JSWebAssemblyInstance::tryCreate):\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.cpp:\n(JSC::JSWebAssemblyMemory::adopt):\n(JSC::JSWebAssemblyMemory::associateArrayBuffer):\n(JSC::JSWebAssemblyMemory::disassociateArrayBuffer):\n(JSC::JSWebAssemblyMemory::growSuccessCallback):\n* Source/JavaScriptCore/wasm/js/WebAssemblyMemoryConstructor.cpp:\n(JSC::WebAssemblyMemoryConstructor::createMemoryFromDescriptor):\n* Source/WebCore/bindings/js/SerializedScriptValue.cpp:\n(WebCore::CloneDeserializer::readTerminal):\n\nOriginally-landed-as: 305413.790@safari-7624-branch (095fa99180ff). rdar://180428467\nCanonical link: https://commits.webkit.org/316080@main",
      "email": "syg@apple.com",
      "hash": "a012babd4f1611a4adb3b886d1c7ebb0360c1b54",
      "subject": "[JSC] Keep JSWebAssemblyMemory alive from wasm-originated JSArrayBuffers"
    },
    "316081@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "316081@main",
      "clUrl": "https://commits.webkit.org/316081@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318070\n\nReviewed by Antti Koivisto.\n\nShouldComputePreferred { ComputeActual, ComputePreferred } was the replaced-element\nwidth path's way of saying \"are we computing the intrinsic-width contribution or\nlaying out\": ComputePreferred is used only by computeIntrinsicLogicalWidthContributions,\nComputeActual everywhere else. That is exactly what IsComputingIntrinsicSize { No, Yes }\nalready expresses -- and it is used the same way, gating the percentage/calc min and max\nsizes that can't resolve during intrinsic sizing. \"Preferred\" was just the legacy term\nfor the min/max-content contributions.\n\nReplace ShouldComputePreferred with IsComputingIntrinsicSize (ComputePreferred -\u003e Yes,\nComputeActual -\u003e No) and remove the enum. No behavior change.\n\n* Source/WebCore/rendering/RenderBox.h:\n* Source/WebCore/rendering/RenderImage.cpp:\n(RenderImage::computeReplacedLogicalWidth):\n* Source/WebCore/rendering/RenderImage.h:\n* Source/WebCore/rendering/RenderReplaced.cpp:\n(RenderReplaced::computeReplacedLogicalWidth):\n(RenderReplaced::computeReplacedLogicalWidthRespectingMinMaxWidth):\n(RenderReplaced::computeIntrinsicLogicalWidthContributions):\n* Source/WebCore/rendering/RenderReplaced.h:\n* Source/WebCore/rendering/RenderVideo.cpp:\n(RenderVideo::computeReplacedLogicalWidth):\n* Source/WebCore/rendering/RenderVideo.h:\n* Source/WebCore/rendering/svg/RenderSVGRoot.cpp:\n(RenderSVGRoot::computeReplacedLogicalWidth):\n* Source/WebCore/rendering/svg/RenderSVGRoot.h:\n* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGRoot.cpp:\n(LegacyRenderSVGRoot::computeReplacedLogicalWidth):\n* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGRoot.h:\n\nCanonical link: https://commits.webkit.org/316081@main",
      "email": "zalan@apple.com",
      "hash": "47765a7a3b70f173fe5c95a26e139f95697a65a9",
      "subject": "[cleanup] Replace ShouldComputePreferred with IsComputingIntrinsicSize"
    },
    "316082@main": {
      "author": "Jeffrey Xu",
      "avatar": "https://www.gravatar.com/avatar/102604c66589181d1a1247ea63f49964?d=identicon\u0026s=64",
      "cl": "316082@main",
      "clUrl": "https://commits.webkit.org/316082@main",
      "description": "rdar://129831277\n\nReviewed by Chris Dumez.\n\nThe one-argument versions of checkedSum and checkedProduct are prone to misuse by performing the operation before passing the unchecked result to the function, e.g. checkedSum(a + b). Using a fold expression removes the need to include a base case, so we can require multiple arguments.\n\n* Source/JavaScriptCore/API/glib/JSCContext.cpp: Fix unchecked addition.\n* Source/WTF/wtf/CheckedArithmetic.h:\n(WTF::checkedSum): Replace recursive variadic function with fold and add requires expression.\n(WTF::checkedProduct): Replace recursive variadic function with fold and add requires expression.\n* Source/WTF/wtf/text/MakeString.h:\n(WTF::tryMakeStringFromAdapters): Add check to only call checkedSum if there's two or more arguments.\n(WTF::tryMakeAtomStringFromAdapters): Add check to only call checkedSum if there's two or more arguments.\n\nCanonical link: https://commits.webkit.org/316082@main",
      "email": "jeffrey_xu2@apple.com",
      "hash": "429ffbc56515710b3d8d7c638a10179985def466",
      "subject": "Require two or more arguments for checked arithmetic operations."
    },
    "316083@main": {
      "author": "Jetzel Espinal",
      "avatar": "https://www.gravatar.com/avatar/2edd78d5d9f2f2e2e695465277634921?d=identicon\u0026s=64",
      "cl": "316083@main",
      "clUrl": "https://commits.webkit.org/316083@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318157\nrdar://178158917\n\nUnreviewed test gardening.\n\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/316083@main",
      "email": "jespinal23@apple.com",
      "hash": "4f412c2bf8a6f8426b05806401f3d6aefadad794",
      "subject": "[GARDENING]4x imported/w3c/web-platform-tests/IndexedDB are constant text failures."
    },
    "316084@main": {
      "author": "Andrew Fryer",
      "avatar": "https://www.gravatar.com/avatar/693f8e74251268cad2daff9afdf907ca?d=identicon\u0026s=64",
      "cl": "316084@main",
      "clUrl": "https://commits.webkit.org/316084@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317809\nrdar://180580140\n\nReviewed by Yusuke Suzuki.\n\nAbstractInterpreter registers many structures (Graph::registerStructure)\nand this sets many CodeBlockJettisoningWatchpoints eagerly. This\njettisons CodeBlocks in cases when the emitted code doesn't speculate on\nthe watchpoint being set, which is wasteful.\n\nChange the DFG to explicitly watch structures with tryWatch or watch and\ndon't eagerly set the watchpoint in registerStructure. Also rename\ndfgShouldWatch to dfgMayWatch and a few other things to reflect this.\n\nBefore this change, we called dfgShouldWatch after registerStructure to\nknow that we already set the watchpoint. After this change, we need to\ncheck the result of tryWatch or isWatched or call watch to know that the\nwatchpoint has been set.\n\nNote that after this change, we can still set watchpoints that are not\nneeded for the emitted code; to avoid this, we'd need to keep track of\nwhich abstract values would need to set watchpoints to be trusted and\nonly set those watchpoints when trusting the abstract value enables\nemitting better code.\n\n* Source/JavaScriptCore/bytecode/CodeBlock.cpp:\n(JSC::CodeBlock::noteDFGWatchedStructure):\n(JSC::CodeBlock::~CodeBlock):\n(JSC::CodeBlock::jettison):\n* Source/JavaScriptCore/bytecode/CodeBlock.h:\n* Source/JavaScriptCore/bytecode/Watchpoint.h:\n(JSC::FireDetail::watchpointStructure const):\n* Source/JavaScriptCore/dfg/DFGAbstractValue.cpp:\n(JSC::DFG::AbstractValue::set):\n(JSC::DFG::AbstractValue::fastForwardToAndFilterSlow):\n(JSC::DFG::AbstractValue::fastForwardToSlow):\n* Source/JavaScriptCore/dfg/DFGAbstractValue.h:\n(JSC::DFG::AbstractValue::clobberStructures):\n(JSC::DFG::AbstractValue::fastForwardFromTo):\n(JSC::DFG::AbstractValue::fastForwardTo):\n(JSC::DFG::AbstractValue::fastForwardToAndFilterUnproven):\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::ByteCodeParser::planLoad):\n* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:\n(JSC::DFG::ConstantFoldingPhase::addStructureTransitionCheck):\n* Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.cpp:\n(JSC::DFG::DesiredWatchpoints::processNonLoadBearingStructureTransitions):\n* Source/JavaScriptCore/dfg/DFGDesiredWatchpoints.h:\n(JSC::DFG::DesiredWatchpoints::addPotentiallyWatchedTransition):\n(JSC::DFG::DesiredWatchpoints::isPotentiallyWatchedTransition const):\n(JSC::DFG::DesiredWatchpoints::takePotentiallyWatchedTransition):\n* Source/JavaScriptCore/dfg/DFGGraph.cpp:\n(JSC::DFG::Graph::promoteToConstant):\n(JSC::DFG::Graph::tryGetConstantProperty):\n(JSC::DFG::Graph::registerStructure):\n(JSC::DFG::Graph::registerStructureAndTryWatch):\n(JSC::DFG::Graph::tryWatch):\n(JSC::DFG::Graph::watch):\n(JSC::DFG::Graph::isWatched):\n(JSC::DFG::Graph::assertIsRegistered):\n(JSC::DFG::Graph::registerAndWatchStructureTransition): Deleted.\n* Source/JavaScriptCore/dfg/DFGGraph.h:\n* Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.cpp:\n(JSC::DFG::InPlaceAbstractState::endBasicBlock):\n* Source/JavaScriptCore/dfg/DFGInPlaceAbstractState.h:\n(JSC::DFG::InPlaceAbstractState::fastForward):\n(JSC::DFG::InPlaceAbstractState::fastForwardAndFilterUnproven):\n* Source/JavaScriptCore/dfg/DFGPlan.cpp:\n(JSC::DFG::Plan::finalizeInThread):\n* Source/JavaScriptCore/dfg/DFGStructureAbstractValue.cpp:\n(JSC::DFG::StructureAbstractValue::clobber):\n* Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h:\n* Source/JavaScriptCore/runtime/OptionsList.h:\n* Source/JavaScriptCore/runtime/Structure.h:\n\nCanonical link: https://commits.webkit.org/316084@main",
      "email": "a_fryer@apple.com",
      "hash": "17d76fab1e3b088fde6a048e60dc130972266ee0",
      "subject": "[JSC] Avoid setting unnecessary watchpoints"
    },
    "316085@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "316085@main",
      "clUrl": "https://commits.webkit.org/316085@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318037\n\u003crdar://problem/180943529\u003e\n\nReviewed by Antti Koivisto.\n\nRenderBox::width()/height() return the border box width/height, but the bare\nnames don't say so. They were the unqualified odd ones out next to\ncontentBoxWidth()/paddingBoxWidth()/clientWidth(), and now next to\nborderBoxSize(). Name them for what they are.\n\n* Source/WebCore/accessibility/AccessibilityRenderObject.cpp:\n(WebCore::AccessibilityRenderObject::computeIsIgnored const):\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::updateMainArticleElementAfterLayout):\n* Source/WebCore/dom/Position.cpp:\n(WebCore::endsOfNodeAreVisuallyDistinctPositions):\n* Source/WebCore/editing/CompositeEditCommand.cpp:\n(WebCore::CompositeEditCommand::addBlockPlaceholderIfNeeded):\n* Source/WebCore/editing/TextIterator.cpp:\n(WebCore::shouldEmitExtraNewlineForNode):\n(WebCore::TextIterator::shouldRepresentNodeOffsetZero):\n* Source/WebCore/html/HTMLTableColElement.cpp:\n(WebCore::HTMLTableColElement::attributeChanged):\n* Source/WebCore/html/HTMLTextFormControlElement.cpp:\n(WebCore::HTMLTextFormControlElement::setSelectionRange):\n* Source/WebCore/html/shadow/SliderThumbElement.cpp:\n(WebCore::RenderSliderContainer::layout):\n(WebCore::SliderThumbElement::setPositionFromPoint):\n* Source/WebCore/html/shadow/SpinButtonElement.cpp:\n(WebCore::SpinButtonElement::defaultEventHandler):\n* Source/WebCore/layout/integration/LayoutIntegrationBoxGeometryUpdater.cpp:\n(WebCore::LayoutIntegration::baselineForBox):\n* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:\n(WebCore::LayoutIntegration::LineLayout::firstInlineBoxRect const):\n* Source/WebCore/layout/layouttree/LayoutTreeBuilder.cpp:\n(WebCore::Layout::TreeBuilder::buildLayoutTree):\n* Source/WebCore/page/LocalFrameView.cpp:\n(WebCore::LocalFrameView::fixedContainerEdges const):\n* Source/WebCore/page/ios/FrameIOS.mm:\n(WebCore::LocalFrame::preferredHeight const):\n* Source/WebCore/rendering/AttachmentLayout.mm:\n(WebCore::AttachmentLayout::AttachmentLayout):\n* Source/WebCore/rendering/BaselineAlignment.cpp:\n(WebCore::BaselineAlignmentState::synthesizedBaseline):\n* Source/WebCore/rendering/CaretRectComputation.cpp:\n(WebCore::computeCaretRectForBox):\n* Source/WebCore/rendering/GridMasonryLayout.cpp:\n(WebCore::GridMasonryLayout::masonryAxisMarginBoxForItem):\n* Source/WebCore/rendering/LegacyInlineBox.cpp:\n(WebCore::LegacyInlineBox::locationIncludingFlipping const):\n* Source/WebCore/rendering/OutlinePainter.cpp:\n(WebCore::OutlinePainter::collectFocusRingRectsForBlock):\n* Source/WebCore/rendering/PositionedLayoutConstraints.cpp:\n(WebCore::PositionedLayoutConstraints::captureGridArea):\n* Source/WebCore/rendering/RenderBlock.cpp:\n(WebCore::RenderBlock::paintChild):\n(WebCore::clipOutOutOfFlowBoxes):\n(WebCore::RenderBlock::selectionGaps):\n(WebCore::isChildHitTestCandidate):\n(WebCore::RenderBlock::adjustBorderBoxRectForPainting):\n(WebCore::RenderBlock::paintRectToClipOutFromBorder):\n* Source/WebCore/rendering/RenderBlock.h:\n(WebCore::RenderBlock::logicalWidthForChild const):\n(WebCore::RenderBlock::logicalHeightForChild const):\n* Source/WebCore/rendering/RenderBlockFlow.cpp:\n(WebCore::RenderBlockFlow::layoutBlockChild):\n(WebCore::RenderBlockFlow::clipOutFloatingBoxes):\n(WebCore::RenderBlockFlow::clearFloats):\n(WebCore::RenderBlockFlow::flipFloatForWritingModeForChild const):\n(WebCore::RenderBlockFlow::findClosestTextAtAbsolutePoint):\n(WebCore::RenderBlockFlow::adjustComputedFontSizes):\n* Source/WebCore/rendering/RenderBox.cpp:\n(WebCore::RenderBox::absoluteQuads const):\n(WebCore::RenderBox::paddingBoxRect const):\n(WebCore::isCandidateForOpaquenessTest):\n(WebCore::RenderBox::foregroundIsKnownToBeOpaqueInRect const):\n(WebCore::RenderBox::repaintLayerRectsForImage):\n(WebCore::RenderBox::clipRect const):\n(WebCore::RenderBox::containingBlockRangeForPositioned const):\n(WebCore::RenderBox::convertRectToParentWritingMode const):\n(WebCore::RenderBox::flipForWritingModeForChild const):\n(WebCore::RenderBox::flipForWritingMode const):\n* Source/WebCore/rendering/RenderBox.h:\n(WebCore::RenderBox::borderBoxWidth const):\n(WebCore::RenderBox::borderBoxHeight const):\n(WebCore::RenderBox::tryLayoutDoingOutOfFlowMovementOnly):\n(WebCore::RenderBox::width const): Deleted.\n(WebCore::RenderBox::height const): Deleted.\n* Source/WebCore/rendering/RenderBoxInlines.h:\n(WebCore::RenderBox::marginBoxLogicalHeight const):\n(WebCore::RenderBox::logicalHeight const):\n(WebCore::RenderBox::logicalWidth const):\n(WebCore::RenderBox::paddingBoxHeight const):\n(WebCore::RenderBox::paddingBoxWidth const):\n(WebCore::RenderBox::paddingBoxRectIncludingScrollbar const):\n(WebCore::RenderBox::contentBoxRect const):\n* Source/WebCore/rendering/RenderButton.cpp:\n(WebCore::RenderButton::controlClipRect const):\n* Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp:\n(WebCore::RenderDeprecatedFlexibleBox::layoutBlock):\n(WebCore::RenderDeprecatedFlexibleBox::layoutHorizontalBox):\n(WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox):\n* Source/WebCore/rendering/RenderElement.cpp:\n(WebCore::RenderElement::repaintAfterLayoutIfNeeded):\n* Source/WebCore/rendering/RenderFileUploadControl.cpp:\n(WebCore::RenderFileUploadControl::paintControl):\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::crossAxisExtentForFlexItem const):\n(WebCore::RenderFlexibleBox::performFlexLayout):\n* Source/WebCore/rendering/RenderFragmentedFlow.cpp:\n(WebCore::RenderFragmentedFlow::offsetFromLogicalTopOfFirstFragment const):\n* Source/WebCore/rendering/RenderFrameSet.cpp:\n(WebCore::RenderFrameSet::paintColumnBorder):\n(WebCore::RenderFrameSet::paintRowBorder):\n(WebCore::RenderFrameSet::paint):\n(WebCore::RenderFrameSet::layout):\n* Source/WebCore/rendering/RenderGrid.cpp:\n(WebCore::RenderGrid::gridAreaRangeForOutOfFlow const):\n* Source/WebCore/rendering/RenderImage.cpp:\n(WebCore::RenderImage::collectSelectionGeometries):\n* Source/WebCore/rendering/RenderLayer.cpp:\n(WebCore::RenderLayer::minimumSizeForResizing const):\n(WebCore::RenderLayer::resize):\n* Source/WebCore/rendering/RenderListBox.cpp:\n(WebCore::RenderListBox::listIndexAtOffset const):\n(WebCore::RenderListBox::rectForScrollbar const):\n* Source/WebCore/rendering/RenderListBox.h:\n* Source/WebCore/rendering/RenderListMarker.cpp:\n(WebCore::RenderListMarker::layout):\n(WebCore::RenderListMarker::imageChanged):\n(WebCore::RenderListMarker::relativeMarkerRect):\n* Source/WebCore/rendering/RenderMarquee.cpp:\n(WebCore::RenderMarquee::computePosition):\n* Source/WebCore/rendering/RenderMultiColumnSet.cpp:\n(WebCore::RenderMultiColumnSet::paintColumnRules):\n* Source/WebCore/rendering/RenderReplica.cpp:\n(WebCore::RenderReplica::computeIntrinsicLogicalWidthContributions):\n* Source/WebCore/rendering/RenderScrollbar.cpp:\n(WebCore::RenderScrollbar::RenderScrollbar):\n(WebCore::RenderScrollbar::updateScrollbarParts):\n(WebCore::RenderScrollbar::minimumThumbLength const):\n* Source/WebCore/rendering/RenderSearchField.cpp:\n(WebCore::RenderSearchField::clientInsetLeft const):\n(WebCore::RenderSearchField::clientInsetRight const):\n(WebCore::RenderSearchField::clientPaddingRight const):\n* Source/WebCore/rendering/RenderTable.cpp:\n(WebCore::RenderTable::addOverflowFromInFlowChildren):\n(WebCore::RenderTable::overflowClipRect const):\n* Source/WebCore/rendering/RenderTableCell.cpp:\n(WebCore::RenderTableCell::localRectsForRepaint const):\n(WebCore::RenderTableCell::paintBackgroundsBehindCell):\n* Source/WebCore/rendering/RenderTableSection.cpp:\n(WebCore::RenderTableSection::offsetLeftForRowGroupBorder):\n(WebCore::RenderTableSection::offsetTopForRowGroupBorder):\n(WebCore::RenderTableSection::verticalRowGroupBorderHeight):\n(WebCore::RenderTableSection::horizontalRowGroupBorderWidth):\n* Source/WebCore/rendering/RenderTheme.cpp:\n(WebCore::RenderTheme::baselinePosition const):\n* Source/WebCore/rendering/RenderTreeAsText.cpp:\n(WebCore::RenderTreeAsText::writeRenderObject):\n(WebCore::externalRepresentation):\n* Source/WebCore/rendering/RenderVTTCue.cpp:\n(WebCore::RenderVTTCue::initializeLayoutParameters):\n(WebCore::RenderVTTCue::shouldSwitchDirection const):\n* Source/WebCore/rendering/RenderView.cpp:\n(WebCore::RenderView::layout):\n(WebCore::RenderView::paintBoxDecorations):\n* Source/WebCore/rendering/cocoa/RenderThemeCocoa.mm:\n(WebCore::RenderThemeCocoa::adjustedPaintRect const):\n(WebCore::shapeForButton):\n* Source/WebCore/rendering/ios/RenderThemeIOS.mm:\n(WebCore::RenderThemeIOS::adjustRoundBorderRadius):\n* Source/WebCore/rendering/mathml/RenderMathMLBlock.cpp:\n(WebCore::RenderMathMLBlock::layoutItems):\n* Source/WebCore/rendering/shapes/ShapeOutsideInfo.cpp:\n(WebCore::makeShapeForShapeOutside):\n* Source/WebKitLegacy/mac/DOM/DOMHTML.mm:\n(-[DOMHTMLElement absolutePosition::::]):\n* Source/WebKitLegacy/mac/DOM/DOMUIKitExtensions.mm:\n(-[DOMHTMLElement structuralComplexityContribution]):\n* Source/WebKitLegacy/mac/WebView/WebFrame.mm:\n(-[WebFrame renderedSizeOfNode:constrainedToWidth:]):\n\nCanonical link: https://commits.webkit.org/316085@main",
      "email": "zalan@apple.com",
      "hash": "b394fb2309d4f50f9324285c064f43c0ea36bf9d",
      "subject": "[cleanup] Rename RenderBox::width()/height() to borderBoxWidth()/borderBoxHeight()"
    },
    "316086@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "316086@main",
      "clUrl": "https://commits.webkit.org/316086@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313700\n\nReviewed by Aditya Keerthi.\n\nAutoFillButtonElement held its AutoFillButtonOwner as a raw C++ reference. When a click listener on the host\ninput element flips input.type in the middle of a click event dispatch, HTMLInputElement::updateType()\ndestroys the old TextFieldInputType (the only owner), but the button is kept alive by EventPath.\ncallDefaultEventHandlersInBubblingOrder then makes the virtual call m_owner.autoFillButtonElementWasClicked()\nthrough freed memory.\n\nFix mirrors the existing SpinButtonElement pattern: AutoFillButtonOwner now derives from\nAbstractRefCountedAndCanMakeWeakPtr, the back-reference is a WeakPtr that is null-checked (and RefPtr-protected)\nin defaultEventHandler, TextFieldInputType forwards ref()/deref() to InputType and clears the back-reference\nin removeShadowSubtree() via a new removeAutoFillButtonOwner().\n\nTest: fast/forms/auto-fill-button/auto-fill-button-click-then-type-change-crash.html\n\n* LayoutTests/fast/forms/auto-fill-button/auto-fill-button-click-then-type-change-crash-expected.txt: Added.\n* LayoutTests/fast/forms/auto-fill-button/auto-fill-button-click-then-type-change-crash.html: Added.\n* Source/WebCore/html/SearchInputType.h:\n* Source/WebCore/html/TextFieldInputType.cpp:\n(WebCore::TextFieldInputType::removeShadowSubtree):\n* Source/WebCore/html/TextFieldInputType.h:\n* Source/WebCore/html/shadow/AutoFillButtonElement.cpp:\n(WebCore::AutoFillButtonElement::defaultEventHandler):\n* Source/WebCore/html/shadow/AutoFillButtonElement.h:\n\nOriginally-landed-as: 305413.807@safari-7624-branch (354642cc1251). rdar://180428678\nCanonical link: https://commits.webkit.org/316086@main",
      "email": "rniwa@webkit.org",
      "hash": "fac72c776640f70077dd6f4b021916213c10709a",
      "subject": "Use-after-free in AutoFillButtonElement::defaultEventHandler"
    },
    "316087@main": {
      "author": "Ling Ho",
      "avatar": "https://www.gravatar.com/avatar/a317955e944b0846697e4a9c8cd28b65?d=identicon\u0026s=64",
      "cl": "316087@main",
      "clUrl": "https://commits.webkit.org/316087@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318152\nrdar://180319389 (Bugzilla radar extension should escape for defense in depth)\n\nReviewed by Alexey Proskuryakov.\n\n* Websites/bugs.webkit.org/extensions/Radar/Extension.pm:\n(_replace_radar): Escape radarURI and optionalPunctuation with\nhtml_quote before interpolating into the returned markup.\n\nCanonical link: https://commits.webkit.org/316087@main",
      "email": "lingho@apple.com",
      "hash": "49020aa70322a9037f8f63b6988820071e8a792e",
      "subject": "Bugzilla radar extension should escape for defense in depth"
    },
    "316089@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316089@main",
      "clUrl": "https://commits.webkit.org/316089@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318099\n\nReviewed by Darin Adler and Anne van Kesteren.\n\nContentSecurityPolicyTrustedTypesDirective::parse() classified each whitespace-\ndelimited tt-expression by matching only a *prefix* of the token: it used\nskipExactly()/skipExactlyIgnoringASCIICase() for the wildcard and the\n'allow-duplicates'/'none' keywords, and skipExactly\u003cisPolicyNameCharacter\u003e()\n(which advances a single character) for tt-policy-name, then stored the whole\ntoken without checking that nothing followed the matched prefix. As a result a\ntoken with trailing characters was misclassified. Most visibly,\n```\n      trusted-types *X\n```\nwas treated as the wildcard \"*\" and set m_allowAny, so trustedTypes.createPolicy()\nwas allowed for any name, even though \"*X\" is not a valid tt-expression. The\nkeyword forms ('allow-duplicates'X, 'none'X) and tt-policy-name validation (only\nthe first character was checked) had the same prefix-matching flaw.\n\nPer the Trusted Types spec, each tt-expression must match a tt-keyword, the\ntt-wildcard (\"*\"), or a tt-policy-name in its entirety; tt-wildcard is exactly\n\"*\" and tt-policy-name is 1*( ALPHA / DIGIT / \"-\" / \"#\" / \"=\" / \"_\" / \"/\" / \"@\"\n/ \".\" / \"%\" ). A token with any trailing character matches none of these and is\nan invalid expression that must be ignored.\n\nClassify each whole token instead of a prefix: compare the full token against\nthe keyword and wildcard literals, and accept a tt-policy-name only when every\ncharacter is a policy-name character. \"*X\" and similar malformed tokens are now\nrejected, so trusted-types with no other valid expression blocks policy creation.\n\nThis aligns WebKit with Blink and Gecko, both of which require the wildcard token\nto be exactly \"*\" and validate the entire policy-name token.\n\nTest: imported/w3c/web-platform-tests/trusted-types/trusted-types-wildcard-with-trailing-characters.html\n\n* LayoutTests/imported/w3c/web-platform-tests/trusted-types/trusted-types-wildcard-with-trailing-characters-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/trusted-types/trusted-types-wildcard-with-trailing-characters.html: Added.\n* Source/WebCore/page/csp/ContentSecurityPolicyTrustedTypesDirective.cpp:\n(WebCore::ContentSecurityPolicyTrustedTypesDirective::parse):\n\nCanonical link: https://commits.webkit.org/316089@main",
      "email": "cdumez@apple.com",
      "hash": "99a1610c70e2740d684e6d024775a2f3e2755e80",
      "subject": "CSP: trusted-types expressions must reject trailing characters after keywords and the wildcard"
    },
    "316090@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316090@main",
      "clUrl": "https://commits.webkit.org/316090@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318087\n\nReviewed by Darin Adler.\n\nm_collectionMode is written by recomputeCollectionMode() while holding m_observersLock\n(from addObserver()/removeObserver() on the main thread), but the dedicated resource-usage\nsampling thread read it in threadBody() without acquiring the lock. waitUntilObservers()\nreleases the lock before threadBody() reaches the read, so the locked main-thread write and\nthe unlocked background-thread read could run concurrently on a non-atomic variable, which is\na data race / undefined behavior. The field was also not annotated, so Clang's thread-safety\nanalysis could not catch the unguarded access.\n\nSynchronize m_collectionMode with the same lock that already guards the m_observers set it is\nderived from: annotate it WTF_GUARDED_BY_LOCK(m_observersLock) so unguarded accesses become a\nbuild error, and read it under a short Locker scope in threadBody() (without holding the lock\nacross the platformCollect* calls). recomputeCollectionMode() now accumulates into a local and\nperforms a single store, which it already does under the lock.\n\n* Source/WebCore/page/ResourceUsageThread.cpp:\n(WebCore::ResourceUsageThread::recomputeCollectionMode):\n(WebCore::ResourceUsageThread::threadBody):\n* Source/WebCore/page/ResourceUsageThread.h:\n(WebCore::ResourceUsageThread::WTF_GUARDED_BY_LOCK):\n\nCanonical link: https://commits.webkit.org/316090@main",
      "email": "cdumez@apple.com",
      "hash": "ccf04bde47571298cd62d79f0bcd83c2cd3a3db0",
      "subject": "ResourceUsageThread reads m_collectionMode off-thread without holding its lock"
    },
    "316091@main": {
      "author": "Sam Weinig",
      "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64",
      "cl": "316091@main",
      "clUrl": "https://commits.webkit.org/316091@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=308486\n\nReviewed by Darin Adler and Antti Koivisto.\n\nConverts the \u003cline-width\u003e value properties, `border-*-width`, `outline-width` and\n`column-rule-width`, as well as the `outline-offset` to evaluation time zoom.\n\nSpecial thanks to Sammy Gill for all the work need to make this perf-neutral.\n\nTests: imported/w3c/web-platform-tests/css/css-viewport/zoom/column-rule-width.html\n       imported/w3c/web-platform-tests/css/css-viewport/zoom/outline-offset.html\n       imported/w3c/web-platform-tests/css/css-viewport/zoom/outline-width.html\n       imported/w3c/web-platform-tests/css/css-viewport/zoom/reference/column-rule-width-ref.html\n       imported/w3c/web-platform-tests/css/css-viewport/zoom/reference/outline-offset-ref.html\n       imported/w3c/web-platform-tests/css/css-viewport/zoom/reference/outline-width-ref.html\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-viewport/zoom/column-rule-width-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-viewport/zoom/column-rule-width.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-viewport/zoom/outline-offset-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-viewport/zoom/outline-offset.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-viewport/zoom/outline-width-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-viewport/zoom/outline-width.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-viewport/zoom/reference/column-rule-width-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-viewport/zoom/reference/outline-offset-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-viewport/zoom/reference/outline-width-ref.html: Added.\n* Source/WebCore/accessibility/AccessibilityRenderObject.cpp:\n* Source/WebCore/css/CSSProperties.json:\n* Source/WebCore/dom/Node.h:\n* Source/WebCore/dom/TreeScope.h:\n* Source/WebCore/layout/formattingContexts/FormattingGeometry.cpp:\n* Source/WebCore/layout/formattingContexts/FormattingGeometry.h:\n* Source/WebCore/layout/formattingContexts/block/BlockFormattingGeometry.cpp:\n* Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayContentBuilder.cpp:\n* Source/WebCore/layout/integration/LayoutIntegrationBoxGeometryUpdater.cpp:\n* Source/WebCore/page/LocalFrameView.cpp:\n* Source/WebCore/page/SpatialNavigation.cpp:\n* Source/WebCore/platform/RectEdges.h:\n* Source/WebCore/rendering/BorderEdge.cpp:\n* Source/WebCore/rendering/BorderPainter.cpp:\n* Source/WebCore/rendering/BorderShape.cpp:\n* Source/WebCore/rendering/InlineBoxPainter.cpp:\n* Source/WebCore/rendering/NinePieceImagePainter.cpp:\n* Source/WebCore/rendering/OutlinePainter.cpp:\n* Source/WebCore/rendering/RenderBox.cpp:\n* Source/WebCore/rendering/RenderBoxModelObjectInlines.h:\n* Source/WebCore/rendering/RenderElement.cpp:\n* Source/WebCore/rendering/RenderImage.cpp:\n* Source/WebCore/rendering/RenderInline.cpp:\n* Source/WebCore/rendering/RenderMultiColumnSet.cpp:\n* Source/WebCore/rendering/RenderObject.cpp:\n* Source/WebCore/rendering/RenderObject.h:\n* Source/WebCore/rendering/RenderTable.cpp:\n* Source/WebCore/rendering/RenderTable.h:\n* Source/WebCore/rendering/RenderTableCell.cpp:\n* Source/WebCore/rendering/RenderTableSection.cpp:\n* Source/WebCore/rendering/RenderTheme.cpp:\n* Source/WebCore/rendering/cocoa/RenderThemeCocoa.mm:\n* Source/WebCore/rendering/ios/RenderThemeIOS.mm:\n* Source/WebCore/rendering/style/CollapsedBorderValue.h:\n* Source/WebCore/rendering/style/OutlineValue.h:\n* Source/WebCore/rendering/style/RenderStyle+GettersInlines.h:\n* Source/WebCore/rendering/style/RenderStyle.cpp:\n* Source/WebCore/rendering/style/RenderStyle.h:\n* Source/WebCore/rendering/svg/SVGBoundingBoxComputation.cpp:\n* Source/WebCore/rendering/svg/SVGRenderSupport.cpp:\n* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGModelObject.cpp:\n* Source/WebCore/style/StyleBuilderCustom.h:\n* Source/WebCore/style/StyleDifference.cpp:\n* Source/WebCore/style/values/backgrounds/StyleLineWidth.cpp:\n* Source/WebCore/style/values/backgrounds/StyleLineWidth.h:\n* Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm:\n* Source/WebKitLegacy/mac/DOM/DOM.mm:\n\nCanonical link: https://commits.webkit.org/316091@main",
      "email": "sam@webkit.org",
      "hash": "6ea7836374f5a9debb460a109f0fa7ea24cc84d2",
      "subject": "[EvaluationTimeZoom] Convert border, outline and column-rule-width properties to evaluation time zoom"
    },
    "316092@main": {
      "author": "Yijia Huang",
      "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64",
      "cl": "316092@main",
      "clUrl": "https://commits.webkit.org/316092@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318138\nrdar://180958190\n\nReviewed by Yusuke Suzuki.\n\nAnnotate every Temporal.PlainDate operation against the Stage 4\nspec; rename toPlainDate to validateAndCreateISODateRecord.\n\nTwo real bugs fixed:\n\n* Non-ISO PlainDate.add({hours: 24}) was a no-op. AddDurationToDate\nStep 4 (ToDateDurationRecordWithoutTime — rolls 24h into one day)\nwas only applied on the ISO path. Hoisted so both branches roll\ntime fields; delete the now-unused addDurationToDate helper.\n* Era codes for coptic/ethiopic (\"ce\"/\"bce\" -\u003e \"am\") and indian\n(\"saka\" -\u003e \"shaka\") diverged from temporal_rs / icu4x. Fixed in\nboth forward and reverse maps.\n\nRefactors: differenceTemporalPlainDate becomes a DifferenceOperation\ntemplate taking JSValue options; until()/since() are one-liners. Dead\nDuration-taking tryCreateIfValid overloads, parse\u003c\u003e, and fromObject\nremoved. Single-caller toString(JSValue) inlined into its prototype\nhost function.\n\nAdded a FIXME notes that bare \"islamic\" is still accepted on JSC but rejected on\nV8 — deferred to the Calendar internals phase.\n\nTests:\nJSTests/stress/temporal-non-iso-era-codes.js\nJSTests/stress/temporal-plain-date-add-time-rollover.js\n\nCanonical link: https://commits.webkit.org/316092@main",
      "email": "yijia_huang@apple.com",
      "hash": "c9647b14e97b537ef936327ab0e821f6b3c74e56",
      "subject": "[JSC][Temporal] Polish Temporal.PlainDate: spec alignment, era and date-add fixes"
    },
    "316093@main": {
      "author": "Aleksei Marchenko",
      "avatar": "https://www.gravatar.com/avatar/9a469093291c12531caccfcaa6ab73b1?d=identicon\u0026s=64",
      "cl": "316093@main",
      "clUrl": "https://commits.webkit.org/316093@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316954\nrdar://170323515\n\nReviewed by Mike Wyrzykowski.\n\nWKUSDStageConverter::convert() is a synchronous, CPU-heavy transform run\ninline on the model process's main queue. That process is multi-tenant, so\none conversion stalls interaction for every \u003cmodel\u003e in every tab.\n\nMove convert() onto a serial background WorkQueue owned by\nRKUSDModelLoadScheduler, handing the data off as a SharedBuffer so even the\nNSData copy happens off-main. Serial (not parallel) keeps at most one USD\nstage materialized at once, since several would risk a jetsam.\n\nEach conversion holds a ThreadSafeWeakPtr to its player: the worker skips\nthe convert, and the main thread skips delivery, if the \u003cmodel\u003e was\nunloaded -- destruction is the cancellation signal, no explicit handle.\nResolving that weak ref off-main could drop the player's last reference on\nthe WorkQueue, running ~ModelProcessModelPlayerProxy() (RealityKit\nteardown) off the main thread; ModelPlayer is pinned to\nWTF::DestructionThread::Main so the final destruction hops back to main.\n\n* Source/WebCore/Modules/model-element/ModelPlayer.h:\n* Source/WebKit/ModelProcess/cocoa/ModelProcessModelPlayerProxy.mm:\n(WebKit::RKUSDModelLoadScheduler::scheduleModelConversion):\n(WebKit::RKUSDModelLoadScheduler::loadNextModel):\n(WebKit::ModelProcessModelPlayerProxy::loadModel):\n\nCanonical link: https://commits.webkit.org/316093@main",
      "email": "aleksei@apple.com",
      "hash": "abc95c76eb7c76745bf91399fc658080d19ee4cb",
      "subject": "Convert models off the main thread in the model process"
    },
    "316094@main": {
      "author": "Wenson Hsieh",
      "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64",
      "cl": "316094@main",
      "clUrl": "https://commits.webkit.org/316094@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318078\nrdar://180873603\n\nReviewed by Abrar Rahman Protyasha.\n\nBuild on top of the changes in 315981@main, to complete the heuristic and map stale element `uid`s\nto elements in the current DOM. See below for more details.\n\nTest: TextExtractionTests.InteractionRemapsStaleNodeIdentifier\n\n* Source/WebCore/page/text-extraction/TextExtraction.cpp:\n(WebCore::TextExtraction::interactionDescription):\n\nSee changes in `_describeInteraction` below.\n\n* Source/WebCore/page/text-extraction/TextExtractionTypes.h:\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm:\n(-[WKWebView _convertToWebCoreInteraction:nodeIdentifier:]):\n(-[WKWebView _performInteraction:completionHandler:]):\n\nWhen performing an interaction, if the interaction fails due to the element being disconnected or\notherwise stale, try to resolve the `uid` against older cached extraction results and remap it to a\nnewer `uid` if the context in and around that newer `uid` matches the context in and around the\nstale `uid`.\n\n(-[WKWebView _performInteraction:inFrame:actionType:nodeIdentifier:staleNodeNote:shouldResolveStaleNodeIdentifier:completionHandler:]):\n(-[WKWebView _describeInteraction:completionHandler:]):\n(-[WKWebView _describeInteraction:inFrame:nodeIdentifier:staleNodeNote:shouldResolveStaleNodeIdentifier:completionHandler:]):\n\nSimilar to the above; this time, we additionally add a flag to the `interactionDescription` result\nthat indicates whether the element being described is disconnected from the DOM; if so, then we fall\nback to re-resolving it.\n\n(-[WKWebView _convertToWebCoreInteraction:]): Deleted.\n* Source/WebKit/UIProcess/TextExtractionCache.cpp:\n(WebKit::TextExtractionCache::add):\n(WebKit::TextExtractionCache::resolve const):\n\nSearch for stale node UIDs that appear in any cached results, not just the oldest one. This ensures\nthat even if the stale element appears in different contexts, we'll still be able to resolve it as\nlong as any of the contexts are similar enough to the latest extraction result.\n\n* Source/WebKit/UIProcess/TextExtractionCache.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:\n(TestWebKitAPI::TEST(TextExtractionTests, InteractionRemapsStaleNodeIdentifier)):\n\nCanonical link: https://commits.webkit.org/316094@main",
      "email": "wenson_hsieh@apple.com",
      "hash": "c7b96b676c378ff2df1de077acbd349d74a809b6",
      "subject": "[Text Extraction] Make it possible for clients to target elements using stale node UIDs"
    },
    "316095@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "316095@main",
      "clUrl": "https://commits.webkit.org/316095@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318172\nrdar://180973856\n\nUnreviewed re-land of 316070@main\n\n* Source/WebCore/platform/RectEdges.h:\n(WebCore::RectEdges::at const): Deleted.\n(WebCore::RectEdges::operator[] const): Deleted.\n(WebCore::RectEdges::top const): Deleted.\n(WebCore::RectEdges::right const): Deleted.\n(WebCore::RectEdges::bottom const): Deleted.\n(WebCore::RectEdges::left const): Deleted.\n* Source/WebKit/Configurations/WebKit.xcconfig:\n* Source/WebKit/DerivedSources-input.xcfilelist:\n* Source/WebKit/DerivedSources-output.xcfilelist:\n* Source/WebKit/DerivedSources.make:\n* Source/WebKit/Modules/Internal/module.modulemap:\n* Source/WebKit/UIProcess/mac/WKAppKitGestureController.h:\n* Source/WebKit/UIProcess/mac/WKAppKitGestureController.mm:\n(-[WKAppKitGestureController webView]):\n(-[WKAppKitGestureController panGestureRecognizer]):\n(-[WKAppKitGestureController setPanGestureRecognizer:]):\n(-[WKPanGestureRecognizer initWithPage:target:action:]): Deleted.\n(-[WKPanGestureRecognizer shouldRecognizeForDelta:]): Deleted.\n(-[WKAppKitGestureController setUpPanGestureRecognizer]): Deleted.\n* Source/WebKit/UIProcess/mac/WKAppKitGestureController.swift: Added.\n(WKPanGestureRecognizer.webView):\n(WKPanGestureRecognizer._shouldRecognize(forDelta:)):\n(WKAppKitGestureController.setUpPanGestureRecognizer):\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/316095@main",
      "email": "richard_robinson2@apple.com",
      "hash": "f3a3ac1dbc1d9f615b26d1d4374535efd766aec6",
      "subject": "Re-land [AppKit Gestures] Adopt the NSPanGestureRecognizer._shouldRecognize(forDelta:) SPI for WKPanGestureRecognizer"
    },
    "316096@main": {
      "author": "Jer Noble",
      "avatar": "https://www.gravatar.com/avatar/6d2cde9be23b98223ca964cb3b7813a0?d=identicon\u0026s=64",
      "cl": "316096@main",
      "clUrl": "https://commits.webkit.org/316096@main",
      "description": "rdar://180931617\nhttps://bugs.webkit.org/show_bug.cgi?id=318115\n\nReviewed by Eric Carlson.\n\nAdd tests covering previously untested areas of the MediaCapture-Streams\nspecifications, organized around two skeptical-audit cycles that\ndistinguished honest coverage from filename-keyword false positives in a\npre-existing area-coverage study.\n\nconstrainable-dictionary-shapes.html verifies the IDL shapes of\nDoubleRange / ULongRange (via getCapabilities) and ConstrainDoubleRange /\nConstrainULongRange / ConstrainDOMStringParameters /\nConstrainBooleanOrDOMStringParameters (via applyConstraints round-trip,\nusing frameRate, width, facingMode, and echoCancellation as the\nrepresentative constrainable properties).\n\nconstrainable-pattern-getters.html verifies that\nMediaStreamTrack.getCapabilities / getConstraints / getSettings each\nreturn the corresponding [[Capabilities]] / [[Constraints]] /\n[[Settings]] internal slot as a plain object, are idempotent across\ncalls without intervening mutation, and that getConstraints replaces\nrather than merges across successive applyConstraints calls.\n\nVideoFacingModeEnum-values.html asserts that any value returned via\ngetSettings().facingMode or getCapabilities().facingMode is from the\nspec-defined VideoFacingModeEnum domain {\"user\", \"environment\", \"left\",\n\"right\"}. This is a partial coverage of behavior 122; exhaustive\nenum-completeness testing would require mock-camera infrastructure that\nhonors the facingMode constructor argument through to getSettings()\n(currently it does not).\n\nmediastreamtrack-readyState-enum.html asserts that\nMediaStreamTrack.readyState only returns values from the\nMediaStreamTrackState enum ({\"live\", \"ended\"}) across creation, stop,\nand clone-of-live / clone-of-ended transitions.\n\nmediastream-onaddtrack-and-overconstrainederror-code.html verifies\nMediaStream.onaddtrack / onremovetrack IDL handler existence and\ndefaults, the addtrack event payload shape when fired by script\naddTrack, and OverconstrainedError's spec-mandated DOMException\ninheritance with .code = 0. The OverconstrainedError subtests fail\nbecause WebKit's OverconstrainedError is a standalone RefCounted\ninterface that doesn't inherit DOMException and has no .code attribute;\nthe failure is recorded in the test's expected.txt baseline and tracked\nby rdar://180728516.\n\nMediaDevices-getSupportedConstraints.html (modification) is extended\nwith explicit assertions for backgroundBlur and powerEfficient\ndefaulting to true. The pre-existing for-each loop only caught keys the\nUA already exposed, so the absence of these dictionary members went\nuntested.\n\nenumerateDevices-truncation.html asserts the spec-mandated truncation\nof microphone / camera lists in enumerateDevices() output to at most\none entry when the corresponding permission is denied (and the\n\"information can be exposed\" predicate returns false). Both subtests\nfail because WebKit returns the full device list with empty labels\ninstead of truncating, exposing the count to fingerprinting. Tracked\nby rdar://180672669.\n\nwebrtc/peerConnection-rvfc-metadata-timestamps.html asserts the\ntype / range semantics of VideoFrameMetadata.captureTime,\n.receiveTime, and .rtpTimestamp on a bidirectional RTCPeerConnection.\nreceiveTime and rtpTimestamp pass; captureTime fails because WebKit\nreturns NTP-epoch milliseconds (~4e12) instead of a value relative to\nPerformance.timeOrigin. Tracked by rdar://180672837.\n\nconfigurationchange-defer-and-abort.html asserts that the\nconfigurationchange task aborts when the track's readyState is already\n\"ended\" (PASSes) and that the task is deferred until unmute when\ntriggered while the track is muted (FAILs because WebKit drops the\nevent entirely; tracked by rdar://180728609).\n\n* LayoutTests/fast/mediastream/MediaDevices-getSupportedConstraints-expected.txt:\n* LayoutTests/fast/mediastream/MediaDevices-getSupportedConstraints.html:\n* LayoutTests/fast/mediastream/VideoFacingModeEnum-values-expected.txt: Added.\n* LayoutTests/fast/mediastream/VideoFacingModeEnum-values.html: Added.\n* LayoutTests/fast/mediastream/configurationchange-defer-and-abort-expected.txt: Added.\n* LayoutTests/fast/mediastream/configurationchange-defer-and-abort.html: Added.\n* LayoutTests/fast/mediastream/constrainable-dictionary-shapes-expected.txt: Added.\n* LayoutTests/fast/mediastream/constrainable-dictionary-shapes.html: Added.\n* LayoutTests/fast/mediastream/constrainable-pattern-getters-expected.txt: Added.\n* LayoutTests/fast/mediastream/constrainable-pattern-getters.html: Added.\n* LayoutTests/fast/mediastream/enumerateDevices-truncation-expected.txt: Added.\n* LayoutTests/fast/mediastream/enumerateDevices-truncation.html: Added.\n* LayoutTests/fast/mediastream/mediastream-onaddtrack-and-overconstrainederror-code-expected.txt: Added.\n* LayoutTests/fast/mediastream/mediastream-onaddtrack-and-overconstrainederror-code.html: Added.\n* LayoutTests/fast/mediastream/mediastreamtrack-readyState-enum-expected.txt: Added.\n* LayoutTests/fast/mediastream/mediastreamtrack-readyState-enum.html: Added.\n* LayoutTests/webrtc/peerConnection-rvfc-metadata-timestamps-expected.txt: Added.\n* LayoutTests/webrtc/peerConnection-rvfc-metadata-timestamps.html: Added.\n\nCanonical link: https://commits.webkit.org/316096@main",
      "email": "jer.noble@apple.com",
      "hash": "3e93b48a79d9ebd61a374d4c6395dea498821a8e",
      "subject": "[MediaStreams] Add tests for untested areas of the MediaCapture-Main and Extensions specifications"
    },
    "316097@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "316097@main",
      "clUrl": "https://commits.webkit.org/316097@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318080\nrdar://177199226\n\nReviewed by Abrar Rahman Protyasha.\n\nFor a single click, WKAppKitGestureRecognizer recognizes its single-click\nand mouse-tracking gesture recognizers simultaneously. The mouse-tracking\nrecognizer synthesizes a real mouse down/up pair as soon as the event\nregisters movement, while the single-click recognizer drives the deferred\nsynthetic click that ends in WebPage::completeSyntheticClick. Both paths\ndelivered a mouse down for the same event.\n\nBecause HTMLSelectElement::menuListDefaultEventHandler toggles the menu on\nevery mouse down — opening it when hidden and hiding it when shown — the\nfirst mouse down opened the popup and the second toggled it shut, sending a\nHidePopupMenu message back to the UI process.\n\nThe intended contract (309295@main) is that either the mouse-tracking\npath or the synthetic click path delivers a mouse down for a given\ninteraction, but never both. That contract was not enforced for a stationary\nevent.\n\nRestore the invariant in the mouse-tracking recognizer: while the event\nstays within the single-click recognizer's allowable movement it is a\nclick, so defer to the synthetic click path and do not synthesize a mouse\ndown (nor the mouse dragged that follows it). Only once movement exceeds\nthat threshold — at which point the single-click recognizer cancels and\nthe interaction becomes a drag — does mouse tracking take over event\ndelivery. Using the single-click recognizer's own allowable movement as\nthe boundary keeps the hand-off aligned with the point at which that\nrecognizer cancels, so exactly one path delivers a mouse down for any\ninteraction. The synthetic click path continues to produce the DOM\npointer and click events for a mouse event.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift\n\n* Source/WebKit/UIProcess/mac/WKAppKitGestureController.mm:\n(-[WKAppKitGestureController mouseTrackingGestureRecognized:]):\n\nThe actual fix\n\n* Tools/TestWebKitAPI/Helpers/cocoa/Foundation+Extras.swift:\n* Tools/TestWebKitAPI/Helpers/cocoa/WebPage+JavaScriptExpression.swift:\n\nTesting infra support\n\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift:\n\nThe test\n\nCanonical link: https://commits.webkit.org/316097@main",
      "email": "richard_robinson2@apple.com",
      "hash": "3f870e3c86093101519942d201c91d352842a0d8",
      "subject": "[AppKit Gestures] Clicking on select controls causes the menu to immediately disappear"
    },
    "316099@main": {
      "author": "Karl Dubost",
      "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64",
      "cl": "316099@main",
      "clUrl": "https://commits.webkit.org/316099@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318007\nrdar://180885531\n\nReviewed by Brent Fulgham.\n\nsetCurrentScale and setCurrentTranslate were SVGSVGElement methods in\nSVG Tiny 1.2. SVG 2 dropped them in favor of the currentScale attribute\nand the currentTranslate readonly attribute; no engine exposes them as\nWebIDL methods, so they are undefined on SVGSVGElement.prototype in\nWebKit, Gecko, and Blink. WebKit retains setCurrentScale() and\nsetCurrentTranslate() as C++ helpers (the latter is used to pan), routed\nthrough the attribute setters at the bindings layer rather than bound.\n\nAdd both to the SVGSVGElement removedMembers list so the historical\nremovals stay covered.\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/historical-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/historical.html:\n\nCanonical link: https://commits.webkit.org/316099@main",
      "email": "karlcow@apple.com",
      "hash": "b15d6bf67a4dfacb6a02064216c63fa094bbcd3e",
      "subject": "Extend svg/historical.html removed Members list to include setCurrentScale, setCurrentTranslate"
    },
    "316100@main": {
      "author": "Karl Dubost",
      "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64",
      "cl": "316100@main",
      "clUrl": "https://commits.webkit.org/316100@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318044\nrdar://180830216\n\nReviewed by Brent Fulgham.\n\nSVG 2 declares currentTranslate on SVGSVGElement with the WebIDL [SameObject]\nextended attribute, which requires the getter to return the same object on\nevery access. The existing WPT coverage for this corner of the SVG DOM is\nreftest-only and visual (svg/struct/reftests/currentScale*); nothing asserts\nthe JS-observable identity requirement\n\n    svg.currentTranslate === svg.currentTranslate.\n\nWebKit already satisfies this: currentTranslate is backed by a stable\nRef\u003cSVGPoint\u003e member returned by reference, so the same wrapper is observed on\nevery read. This adds a scripted testharness test that guards that behavior and\nexposes the cross-engine divergence upstream.\n\nThe test isolates the readonly check on the attribute value rather than object\nidentity, so an engine that fails [SameObject] still passes the readonly subtest\nif it honors readonly. No WebKit code change is required.\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/struct/SVGSVGElement-currentTranslate-SameObject-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/struct/SVGSVGElement-currentTranslate-SameObject.html: Added.\n\nCanonical link: https://commits.webkit.org/316100@main",
      "email": "karlcow@apple.com",
      "hash": "391677e4cebdc603c4d9b4ff9ddf540015d1e9a9",
      "subject": "WPT: add [SameObject] identity coverage for SVGSVGElement.currentTranslate"
    },
    "316101@main": {
      "author": "Karl Dubost",
      "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64",
      "cl": "316101@main",
      "clUrl": "https://commits.webkit.org/316101@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318060\nrdar://180852743\n\nReviewed by Brent Fulgham.\n\nThe SVG 2 IDL applies the WebIDL [SameObject] extended attribute\nto ~80 readonly attributes\n\n* every SVGAnimated* wrapper (x, y, width, cx, transform, gradientUnits,\n  href, …),\n* their baseVal/animVal sub-objects,\n* the live lists (points, requiredExtensions, systemLanguage),\n* viewBox, preserveAspectRatio, SVGTransform.matrix, currentTranslate,\n  and relList.\n\n[SameObject] requires the getter to return the same object on every\naccess. This adds a WPT test to verify that the rule is respected for\nall properties, and avoid any regressions in the future.\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/SameObject-identity-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/SameObject-identity.html: Added.\n\nCanonical link: https://commits.webkit.org/316101@main",
      "email": "karlcow@apple.com",
      "hash": "bf33722504a316a171dc877cdf2ff726ba2939f1",
      "subject": "WPT: add runtime [SameObject] identity coverage across the SVG2 DOM"
    },
    "316102@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316102@main",
      "clUrl": "https://commits.webkit.org/316102@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318056\nrdar://180838174\n\nReviewed by Dan Glastonbury.\n\nAdd { 0 } initializers to both members to match the rest of the struct and\nguarantee defined values for all default-constructed keys.\n\n* Source/WebCore/platform/graphics/FontCascadeCache.h:\n\nCanonical link: https://commits.webkit.org/316102@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "97d2c63b0b2b16a82428e172c8e701b2bee13639",
      "subject": "FontCascadeCacheKey has uninitialized fontSelectorId and fontSelectorVersion members"
    },
    "316103@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "316103@main",
      "clUrl": "https://commits.webkit.org/316103@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318178\nrdar://180988807\n\nUnreviewed build fix.\n\n* Source/WebKit/UIProcess/mac/WKAppKitGestureController.swift:\n\nCanonical link: https://commits.webkit.org/316103@main",
      "email": "richard_robinson2@apple.com",
      "hash": "74b0462dc75c13e9ed4fcde20cff983d4a526d0d",
      "subject": "Fix the build after 316095@main"
    },
    "316104@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "316104@main",
      "clUrl": "https://commits.webkit.org/316104@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318076\nrdar://180872461\n\nReviewed by Sosuke Suzuki.\n\nWe no longer use op_try_get_by_id and @tryGetById. Remove them.\n\n* JSTests/microbenchmarks/try-get-by-id-basic.js: Removed.\n* JSTests/microbenchmarks/try-get-by-id-polymorphic.js: Removed.\n* JSTests/modules/namespace-object-try-get.js: Removed.\n* JSTests/stress/regress-156992.js: Removed.\n* JSTests/stress/regress-179619.js:\n(tryGetByIdText): Deleted.\n* JSTests/stress/try-get-by-id-poly-proto.js: Removed.\n* JSTests/stress/try-get-by-id-should-spill-registers-dfg.js: Removed.\n* JSTests/stress/try-get-by-id.js: Removed.\n* Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h:\n* Source/JavaScriptCore/bytecode/BytecodeList.rb:\n* Source/JavaScriptCore/bytecode/BytecodeUseDef.cpp:\n(JSC::computeUsesForBytecodeIndexImpl):\n(JSC::computeDefsForBytecodeIndexImpl):\n* Source/JavaScriptCore/bytecode/CodeBlock.cpp:\n(JSC::CodeBlock::finishCreation):\n(JSC::CodeBlock::finalizeLLIntInlineCaches):\n* Source/JavaScriptCore/bytecode/GetByStatus.cpp:\n(JSC::GetByStatus::computeFromLLInt):\n* Source/JavaScriptCore/bytecode/Opcode.h:\n* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:\n(JSC::BytecodeGenerator::emitTryGetById): Deleted.\n* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h:\n* Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:\n(JSC::BytecodeIntrinsicNode::emit_intrinsic_tryGetById): Deleted.\n(JSC::BytecodeIntrinsicNode::emit_intrinsic_tryGetByIdWithWellKnownSymbol): Deleted.\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::ByteCodeParser::handleGetById):\n(JSC::DFG::ByteCodeParser::parseGetById):\n(JSC::DFG::ByteCodeParser::parseBlock):\n(JSC::DFG::ByteCodeParser::handleIteratorOpen):\n(JSC::DFG::ByteCodeParser::handleIteratorNext):\n* Source/JavaScriptCore/jit/JIT.cpp:\n(JSC::JIT::privateCompileMainPass):\n(JSC::JIT::privateCompileSlowCases):\n* Source/JavaScriptCore/jit/JIT.h:\n* Source/JavaScriptCore/jit/JITPropertyAccess.cpp:\n(JSC::JIT::emit_op_try_get_by_id): Deleted.\n(JSC::JIT::emitSlow_op_try_get_by_id): Deleted.\n* Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:\n* Source/JavaScriptCore/llint/LLIntSlowPaths.h:\n* Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm:\n* Source/JavaScriptCore/llint/LowLevelInterpreter64.asm:\n* Source/JavaScriptCore/lol/LOLJIT.cpp:\n(JSC::LOL::LOLJIT::privateCompileMainPass):\n(JSC::LOL::LOLJIT::privateCompileSlowCases):\n* Source/JavaScriptCore/lol/LOLJIT.h:\n\nCanonical link: https://commits.webkit.org/316104@main",
      "email": "ysuzuki@apple.com",
      "hash": "47d7768ee93950650ddd238b3c7bddfd3889fe03",
      "subject": "[JSC] Remove op_try_get_by_id and @tryGetById"
    },
    "316105@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "316105@main",
      "clUrl": "https://commits.webkit.org/316105@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318079\nrdar://180873581\n\nReviewed by Yijia Huang.\n\nIf CharacterClass holds m_latin1Table and no m_matches32 / m_ranges32 exist,\nThis is latin1 only CharacterClass. So we can use this table even in Char16\ncase with 0x100 guard. We also add the code using this table in\ninterpreter too.\n\n* Source/JavaScriptCore/yarr/YarrInterpreter.cpp:\n(JSC::Yarr::Interpreter::testCharacterClass):\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n\nCanonical link: https://commits.webkit.org/316105@main",
      "email": "ysuzuki@apple.com",
      "hash": "c1d34821e09a47b5e22e73e20ed5fed4b749e30e",
      "subject": "[YARR] Use m_latin1Table in Char16 case \u0026 interpreter"
    },
    "316106@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "316106@main",
      "clUrl": "https://commits.webkit.org/316106@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318008\n\nReviewed by Yusuke Suzuki.\n\nEvery read of RegExp.prototype.flags performs eight generic property gets on the\nreceiver, each landing in a host getter on RegExp.prototype, even when nothing is\noverridden.\n\nAdd a fast path that builds the flags string directly from the RegExp's flag bits\nwhen the receiver is an unmodified RegExpObject covered by\nregExpPrimordialPropertiesWatchpointSet.\n\n                                        Baseline                  Patched\n\nregexp-prototype-flags-getter      328.2361+-8.0599     ^     32.6714+-0.8326        ^ definitely 10.0466x faster\n\nTests: JSTests/microbenchmarks/regexp-prototype-flags-getter.js\n       JSTests/stress/regexp-flags-getter-fast-path.js\n\n* JSTests/microbenchmarks/regexp-prototype-flags-getter.js: Added.\n* JSTests/stress/regexp-flags-getter-fast-path.js: Added.\n(shouldBe):\n(get global):\n(PlainSubclass):\n(OverridingSubclass.prototype.get global):\n(OverridingSubclass):\n* Source/JavaScriptCore/runtime/RegExpPrototype.cpp:\n(JSC::regExpFlagsWatchpointIsValid):\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n\nCanonical link: https://commits.webkit.org/316106@main",
      "email": "sosuke@bun.sh",
      "hash": "cab8cdc40a6f3ab6e3943053356f3cd21a2d9e81",
      "subject": "[JSC] Add fast path for `RegExp#flags` getter"
    },
    "316107@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "316107@main",
      "clUrl": "https://commits.webkit.org/316107@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=313175\u003e\n\u003crdar://175164594\u003e\n\nReviewed by Said Abou-Hallawa.\n\n`HTMLCanvasElement::getContext()` and `OffscreenCanvas::getContext()`\ncheck `m_context` at the top, then call\n`convert\u003cIDLDictionary\u003c...\u003e\u003e()` on the settings argument.  Dictionary\nconversion invokes JS property getters, which can re-enter\n`getContext()` on the same canvas and assign `m_context`.  The outer\ncall then proceeds to `createContext2d()`/`createContextWebGL()`/\n`createContextBitmapRenderer()`, which overwrites `m_context` with a\nnew `unique_ptr`, destroying the inner context while its JS wrapper\nis still alive.  `CanvasRenderingContext` forwards `ref()`/`deref()`\nto its owning `CanvasBase`, so the wrapper's ref does not keep the\ncontext alive; on GC sweep the wrapper's `deref()` reads `m_canvas`\nfrom a freed `this`.\n\nRe-check `m_context` (and `m_detached` for `OffscreenCanvas`) after\ndictionary conversion.  If a re-entrant call set `m_context`, return\nthe existing context when the type matches and null otherwise,\nmatching the existing early-return semantics.\n\nAlso upgrade `ASSERT(!m_context)` to\n`ASSERT_WITH_SECURITY_IMPLICATION(!m_context)` in all four\n`createContext*()` methods.  These asserts guard the same invariant\nthis bug violates -- that `m_context` is assigned at most once --\nand a violation is security-relevant.\n\nTest: fast/canvas/canvas-getContext-reentrant.html\n\n* LayoutTests/fast/canvas/canvas-getContext-reentrant-expected.txt: Add.\n* LayoutTests/fast/canvas/canvas-getContext-reentrant.html: Add.\n* Source/WebCore/html/HTMLCanvasElement.cpp:\n(WebCore::HTMLCanvasElement::getContext):\n(WebCore::HTMLCanvasElement::createContext2d):\n(WebCore::HTMLCanvasElement::createContextWebGL):\n(WebCore::HTMLCanvasElement::createContextBitmapRenderer):\n(WebCore::HTMLCanvasElement::createContextWebGPU):\n* Source/WebCore/html/OffscreenCanvas.cpp:\n(WebCore::OffscreenCanvas::getContext):\n\nOriginally-landed-as: 305413.763@safari-7624-branch (40941e46f2d4). rdar://180436486\nCanonical link: https://commits.webkit.org/316107@main",
      "email": "ddkilzer@apple.com",
      "hash": "040ef6e21ffac03b6d6098e0e12354bdb5469ad1",
      "subject": "Crash in CanvasRenderingContext::deref after reentrant getContext()"
    },
    "316108@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "316108@main",
      "clUrl": "https://commits.webkit.org/316108@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318086\n\nReviewed by Yusuke Suzuki.\n\nFastStringifier bails out whenever the space argument is not undefined,\nso common pretty-printing calls like JSON.stringify(value, null, 2)\nalways run the general Stringifier, which is several times slower than\nthe fast path on typical config / logging shaped objects.\n\nThis patch resolves the gap inside FastStringifier and writes the\nnewline plus depth * gap indentation directly into the flat buffer.\nNumbers and 8-bit string spaces are handled; boxed primitives keep\nfalling back since unwrapping them is observable, and so do 16-bit gap\nstrings since the gap is stored as Latin-1. append() is templatized on\nHasGap so that the no-space instantiation compiles to the same code as\nbefore; a runtime-checked version regressed json-stringify-int32-array\nby 1.78x.\n\n                                              baseline                  patched\n\njson-stringify-int32-array                18.9412+-0.8168     ?     19.1482+-0.7348        ? might be 1.0109x slower\njson-stringify-many-objects              144.2817+-1.2609     ?    145.7997+-0.7796        ? might be 1.0105x slower\njson-stringify-empty-array                20.6268+-0.8005           20.2796+-0.3744          might be 1.0171x faster\njson-stringify-pretty-tab               1128.9899+-15.1355    ^    274.4653+-3.0505        ^ definitely 4.1134x faster\njson-stringify-array-replacer             13.6181+-0.1381     ?     13.7487+-0.2907        ?\njson-stringify-pretty                   1191.4510+-7.5572     ^    301.6980+-4.2533        ^ definitely 3.9492x faster\njson-stringify-many-objects-to-json       89.9216+-0.4452     ?     90.5576+-1.0200        ?\nvanilla-todomvc-json-stringify            40.9058+-0.6199     ^     38.5172+-0.8057        ^ definitely 1.0620x faster\n\nTests: JSTests/microbenchmarks/json-stringify-pretty-tab.js\n       JSTests/microbenchmarks/json-stringify-pretty.js\n       JSTests/stress/json-stringify-space-fast-path.js\n\n* JSTests/microbenchmarks/json-stringify-pretty-tab.js: Added.\n* JSTests/microbenchmarks/json-stringify-pretty.js: Added.\n* JSTests/stress/json-stringify-space-fast-path.js: Added.\n(f):\n(new.Date):\n(show):\n(const.space.of.spaces.const.value.of.values.catch):\n(print.string_appeared_here.slowErr.JSON.stringify):\n(print):\n* Source/JavaScriptCore/runtime/JSONObject.cpp:\n(JSC::gap):\n(JSC::bufferMode\u003e::setGap):\n(JSC::bufferMode\u003e::newLineAndIndentSize const):\n(JSC::bufferMode\u003e::appendNewLineAndIndentUnchecked):\n(JSC::bufferMode\u003e::append):\n(JSC::bufferMode\u003e::appendInt32Array):\n(JSC::bufferMode\u003e::stringify):\n\nCanonical link: https://commits.webkit.org/316108@main",
      "email": "sosuke@bun.sh",
      "hash": "7658c6d1236fe89d94477d91983f8db321bde587",
      "subject": "[JSC] Support space argument in `FastStringifier`"
    },
    "316109@main": {
      "author": "Basuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/5192a1151c7575317affb7a4633f8d63?d=identicon\u0026s=64",
      "cl": "316109@main",
      "clUrl": "https://commits.webkit.org/316109@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318112\nrdar://180926736\n\nReviewed by Sihui Liu.\n\nThis is the capture-side root cause behind bug 318015, which only added a defensive guard in\nthe per-frame back/forward walk.\n\nUnder UseUIProcessForBackForwardItemLoading, when a child frame performs a back/forward\nnavigation, WebPageProxy::frameStateForBackForwardChildFrame looks up the child's stored\nFrameState in the target back/forward item positionally: it takes the live frame's document-order\nindex (WebFrameProxy::indexInFrameTreeSiblings) and calls WebBackForwardList::findFrameStateInItem,\nwhich fetches the BF child via WebBackForwardListFrameItem::childItemAtIndex(index).\n\nBut the BF item's children are stored in commit/append order (the order in which each iframe\nrecorded its initial history item), which can differ from the live frame tree's document order.\nWhen a page has two sibling iframes and the second commits its initial history item before the\nfirst (e.g. the second has a script and the first is empty), the BF children end up reversed\nrelative to the live tree.\n\nWith that ordering mismatch, the positional lookup returns the wrong sibling's FrameState.\nframeStateForBackForwardChildFrame then sees frameState-\u003eframeID != live frame.frameID() and\n\"corrects\" it by calling WebBackForwardList::updateFrameIdentifier(storedID -\u003e liveID), which walks\nall back/forward entries and rewrites the first frame carrying storedID. That rewrites the\nunaffected sibling's frameID onto the navigated frame's frameID, leaving two sibling frame items\nwith the same frameID in a back/forward entry. The duplicate then makes the per-frame walk dispatch\na second GoToBackForwardItem to the same live frame, clobbering the intended navigation -- the flaky\ntimeout that bug 318015 fixed defensively. On Debug it also fires the\nHistoryItem::addChildItem duplicate-frameID assertion when the WebProcess reconstructs the\nHistoryItem from the corrupted FrameState.\n\nFix: in findFrameStateInItem, match the child by the live frame's identifier first\n(childItemForFrameID), and fall back to the positional lookup only when that identifier is absent --\ni.e. the stored identifiers no longer match the live frames, which happens after session restore or\nwhen a cross-site child frame is recreated (where updateFrameIdentifier then legitimately remaps the\nregenerated identifier). In the common live case the identifier matches, so the wrong sibling can no\nlonger be selected and updateFrameIdentifier is no longer triggered spuriously. The change is\nmirrored in the Swift (ENABLE_BACK_FORWARD_LIST_SWIFT) implementation.\n\nBecause the corruption is fixed at the source, the WebProcess never reconstructs a HistoryItem with\na duplicate frameID, so the bug-317799 Debug skip for the overlapping-navigations cluster test is\nremoved; the test passes on Debug with the fix.\n\nCovered by existing tests (SiteIsolation.NavigateFrameWithSiblingsBackForward, previously flaky;\nSiteIsolation.BackNavigationOverCrossSiteIframeWithoutBFCache; and the session-restore back/forward\ntests that exercise the positional fallback) and by\nhttp/wpt/site-isolation/overlapping-navigations-and-traversals/cross-document-traversal-cross-document-traversal.html\non Debug. Verified on both the C++ and Swift back/forward list implementations: the\nduplicate-frameID corruption no longer appears across many iterations (it reproduced roughly one run\nin ten to twenty-five before), and the Debug assertion fires without the fix and is quiet with it.\n\n* LayoutTests/platform/mac-wk2/TestExpectations: Remove the bug-317799 Debug skip.\n* Source/WebKit/UIProcess/WebBackForwardList.cpp:\n(WebKit::WebBackForwardList::findFrameStateInItem):\n* Source/WebKit/UIProcess/WebBackForwardList.h:\n* Source/WebKit/UIProcess/WebBackForwardList.swift:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::frameStateForBackForwardChildFrame):\n\nCanonical link: https://commits.webkit.org/316109@main",
      "email": "basuke@apple.com",
      "hash": "bbef52230d06c1615a08fc6c75d6cbf2e1648f53",
      "subject": "[Site Isolation] Positional back/forward child-frame lookup corrupts a sibling frameID, producing duplicate frameIDs in the BF tree"
    },
    "316110@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "316110@main",
      "clUrl": "https://commits.webkit.org/316110@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318128\nrdar://180951143\n\nReviewed by Abrar Rahman Protyasha.\n\nWe had some ideas for dictation tests to help increase our overall\ncoverage for this area, but unfortunately they did not land as part of\n316049@main since it got merged before I was able to get to it and add\nthe tests. This is just a follow up to help add the discussed tests as\nwell as some additional ones to just reinforce our changes.\n\nAlso go through a couple of places and adopt RetainPtr where possible.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ios/UIWKInteractionViewProtocol.mm:\n(TestWebKitAPI::TEST(UIWKInteractionViewProtocol, TextInteractionCanBeginInExistingSelection)):\n(TestWebKitAPI::TEST(UIWKInteractionViewProtocol, ReplaceDictatedTextContainingEmojis)):\n(TestWebKitAPI::TEST(UIWKInteractionViewProtocol, SuppressSelectionChangesDuringDictation)):\n(TestWebKitAPI::TEST(UIWKInteractionViewProtocol, ReplaceDictatedTextStartsComposition)):\n(TestWebKitAPI::TEST(UIWKInteractionViewProtocol, ReplaceDictatedTextContinuesComposition)):\nUpdated this test so that the dictated content is a little longer which\nmay be a bit more representative of actual use.\n\n(TestWebKitAPI::TEST(UIWKInteractionViewProtocol, ReplaceDictatedTextClearingEmitsCompositionEnd)):\n(TestWebKitAPI::TEST(UIWKInteractionViewProtocol, ReplaceDictatedTextReplacesSelectedText)):\n(TestWebKitAPI::TEST(UIWKInteractionViewProtocol, ReplaceDictatedTextReplacesSelectedPortion)):\n(TestWebKitAPI::TEST(UIWKInteractionViewProtocol, ReplaceDictatedTextReplacesMultiWordSelection)):\nMake sure that dictation still occurs as expected if the user already\nhad a selection in different scenarios.\n\n(TestWebKitAPI::TEST(UIWKInteractionViewProtocol, ReplaceDictatedTextEmitsCompositionEventSequence)):\nMake sure that we get full order of composition events as expected\nwith a start event, multiple updates, and a final end event. Previous\ntests were really only checking a subset of the expected events.\n\n(TestWebKitAPI::TEST(UIWKInteractionViewProtocol, ReplaceDictatedTextPreservesSurroundingText)):\nSimple one just to make sure that we get the text as expected if\ndictation starts in the middle of some content.\n\n(TestWebKitAPI::TEST(UIWKInteractionViewProtocol, ReplaceDictatedTextHandlesShrinkingHypothesis)):\nIt is possible for a subsequent hypothesis to be shorter than the\nprevious one.\n\nCanonical link: https://commits.webkit.org/316110@main",
      "email": "sammy.gill@apple.com",
      "hash": "59ff2db194f5065cea86cadd6229c9b36999c2c7",
      "subject": "Add some dictation tests post 316049@main."
    },
    "316111@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316111@main",
      "clUrl": "https://commits.webkit.org/316111@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318153\nrdar://180962809\n\nReviewed by Nikolas Zimmermann and Simon Fraser.\n\npaintOneLayer() evaluated `\u0026layer == \u0026m_owningLayer` twice back-to-back: once\nto conditionally assign svgPaintOrderItemRange, and again to open the block\nthat actually consumes it. The std::optional was declared in the outer scope\nsolely to bridge the two checks.\n\nsvgPaintOrderItemRange is only read inside the second block (the\npaintLayerContents() calls), so fold the assignment into that block and scope\nthe variable there. This evaluates the condition once and narrows the\nvariable's lifetime. No change in behavior.\n\n* Source/WebCore/rendering/RenderLayerBacking.cpp:\n(WebCore::RenderLayerBacking::paintIntoLayer):\n\nCanonical link: https://commits.webkit.org/316111@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "25db7a2d394b2a850d56037f38de03fd0181fb87",
      "subject": "Remove duplicate (\u0026layer == \u0026m_owningLayer) condition in RenderLayerBacking::paintIntoLayer"
    },
    "316112@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "316112@main",
      "clUrl": "https://commits.webkit.org/316112@main",
      "description": "rdar://175482151\n\nReviewed by Jean-Yves Avenard.\n\nWe add a thread annotation to make sure the conversion callback cannot be modified without the pixel buffer lock.\nWe update VideoFrameLibWebRTC::clone so that it holds the pixel buffer lock to ensure it gets a correct conversion callback.\nWe also copy the pixel buffer with a lock, as it could be null on the cloned video frame if the conversion callback has already been called.\n\nCovered by LayoutTests/http/wpt/webcodecs/frame-clone-and-convert.html, which does the following:\n1. Create a LibWebRTC VideoFrame.\n2. Encode it using VP8 so that the VideoFrame pixelBuffer method is executed in a background queue.\n3. In parallel, clone the VideoFrame to exercice the racy code path and encode the cloned frame.\n\n* LayoutTests/http/wpt/webcodecs/frame-clone-and-convert-expected.txt: Added.\n* LayoutTests/http/wpt/webcodecs/frame-clone-and-convert.html: Added.\n* Source/WebCore/platform/mediastream/libwebrtc/VideoFrameLibWebRTC.cpp:\n(WebCore::VideoFrameLibWebRTC::clone):\n* Source/WebCore/platform/mediastream/libwebrtc/VideoFrameLibWebRTC.h:\n\nOriginally-landed-as: 305413.760@safari-7624-branch (f4c62c374952). rdar://180436627\nCanonical link: https://commits.webkit.org/316112@main",
      "email": "youenn@apple.com",
      "hash": "e7f7480061c3edc6ddbadaad7fe202f28fcd6154",
      "subject": "[WebCore] Data race on VideoFrameLibWebRTC::m_conversionCallback between clone and pixelBuffer causes use-after-free"
    },
    "316113@main": {
      "author": "lilly",
      "avatar": "https://www.gravatar.com/avatar/6f92b711483096db0247c16946fb3f29?d=identicon\u0026s=64",
      "cl": "316113@main",
      "clUrl": "https://commits.webkit.org/316113@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317938\nrdar://180739848\n\nReviewed by Simon Fraser.\n\nAdds two geometry helpers to FloatSize needed for computing corner contour geometry per the CSS\nBorders 4 spec. normalized() returns a unit vector in the same direction (returning the original\nunchanged if its length is zero), and perpendicular() returns a 90° counter-clockwise rotation.\n\nNo new tests needed\n\n* Source/WebCore/platform/graphics/FloatSize.h:\n(WebCore::FloatSize::normalized const):\n(WebCore::FloatSize::perpendicular const):\n\nCanonical link: https://commits.webkit.org/316113@main",
      "email": "173393835+codedbycupidity@users.noreply.github.com",
      "hash": "dd8cbf1b99322f5d193b715dd1628c42a02aa859",
      "subject": "corner-shape: Add vector math helpers to FloatSize"
    },
    "316114@main": {
      "author": "Cole Carley",
      "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64",
      "cl": "316114@main",
      "clUrl": "https://commits.webkit.org/316114@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318169\nrdar://170649898\n\nReviewed by David Kilzer.\n\nA search string that folds to an all-ignorable collation key\nproduces a zero-length match at every offset.\n\nIn WebFoundTextRangeController::findTextRangesForStringMatches() a\nzero-length match at the start of the main frame becomes a WebFoundTextRange\nequal to the HashMap empty value. Inserting it into m_cachedFoundRanges trips\nthe HashMap key-validation RELEASE_ASSERT, crashing the Web Content process.\n\nTo fix this, we stop the search when the match length is zero. An all-ignorable\ntarget matches nothing meaningful, so reporting no matches is correct.\n\nTests: editing/find/ios/find-interaction-ignorable-character.html\n       Tools/TestWebKitAPI/Tests/WebKit/WKWebView/FindInPage.mm\n\n* LayoutTests/editing/find/ios/find-interaction-ignorable-character-expected.txt: Added.\n* LayoutTests/editing/find/ios/find-interaction-ignorable-character.html: Added.\n* LayoutTests/resources/ui-helper.js:\n(window.UIHelper.findStringMatchesUsingFindInteraction.return.new.Promise):\n(window.UIHelper.findStringMatchesUsingFindInteraction):\n* Source/WebCore/editing/CachedMatchFinder.cpp:\n(WebCore::CachedMatchFinder::performSearch):\n* Tools/TestRunnerShared/UIScriptContext/Bindings/UIScriptController.idl:\n* Tools/TestRunnerShared/UIScriptContext/UIScriptController.h:\n(WTR::UIScriptController::findStringMatchesUsingFindInteraction):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/FindInPage.mm:\n(TEST(WebKit, FindInPageIgnorableCharacterDoesNotCrash)):\n* Tools/WebKitTestRunner/ios/UIScriptControllerIOS.h:\n* Tools/WebKitTestRunner/ios/UIScriptControllerIOS.mm:\n(-[WTRTextSearchAggregator initWithCompletionHandler:]):\n(-[WTRTextSearchAggregator allFoundRanges]):\n(-[WTRTextSearchAggregator foundRange:forSearchString:inDocument:]):\n(-[WTRTextSearchAggregator finishedSearching]):\n(-[WTRTextSearchAggregator invalidateFoundRange:inDocument:]):\n(-[WTRTextSearchAggregator invalidate]):\n(WTR::UIScriptControllerIOS::findStringMatchesUsingFindInteraction):\n\nCanonical link: https://commits.webkit.org/316114@main",
      "email": "ccarley2@apple.com",
      "hash": "ce481c4cfedb670a0d26b50a5e0fe4b0051368e0",
      "subject": "Fix Find in Page crash on iOS"
    },
    "316115@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316115@main",
      "clUrl": "https://commits.webkit.org/316115@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318175\nrdar://180977788\n\nReviewed by Alan Baradlay.\n\nThe branch is entered only when `\u0026renderer == m_renderRange.start()`. Since\nrenderer is a reference, \u0026renderer is never null, so m_renderRange.start() is\nguaranteed non-null inside the block. The two further m_renderRange.start()\nchecks were therefore always true: the leading term of the Both test and the\nguard on the Start return.\n\nDrop both dead checks. The Start return becomes the unconditional fall-through\nafter the Both case, and the end() null check is retained since end() can\nlegitimately be null. No change in behavior.\n\n* Source/WebCore/rendering/RenderHighlight.cpp:\n(WebCore::RenderHighlight::highlightStateForRenderer):\n\nCanonical link: https://commits.webkit.org/316115@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "ad3c1ab54438f924e55d6727caad0c24d70f5d3d",
      "subject": "Remove redundant m_renderRange.start() null checks in RenderHighlight::highlightStateForRenderer"
    },
    "316116@main": {
      "author": "Mike Wyrzykowski",
      "avatar": "https://www.gravatar.com/avatar/4b1bc9e238714f95e22d5d2454c07066?d=identicon\u0026s=64",
      "cl": "316116@main",
      "clUrl": "https://commits.webkit.org/316116@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313360\nrdar://174662781\n\nReviewed by Dan Glastonbury.\n\nShare identifiers for render and compute pipelines to avoid\nvalidation succeeding for a given bind group + render pipeline\nwhich was validated for the hash key identical to the same\nbind group but with a compute pipeline which has the same key.\n\n* Source/WebGPU/WebGPU/ComputePipeline.mm:\n* Source/WebGPU/WebGPU/Device.h:\n* Source/WebGPU/WebGPU/RenderPipeline.mm:\n\nOriginally-landed-as: 305413.739@safari-7624-branch (427fc7a6307d). rdar://180429272\nCanonical link: https://commits.webkit.org/316116@main",
      "email": "mwyrzykowski@apple.com",
      "hash": "144aa0db1a51ac0b8a993f17bd35a136fb4a6b4a",
      "subject": "[GPUP] WebGPU BindGroup Validation-Cache Key Collision Leads to GPU OOB Write"
    },
    "316117@main": {
      "author": "Zak Ridouh",
      "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64",
      "cl": "316117@main",
      "clUrl": "https://commits.webkit.org/316117@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=314590\u003e\n\u003crdar://176483321\u003e\n\nReviewed by Gerald Squelart.\n\nconvertImagePixelsFromFloat16ToFloat16() early-returned on a color-space\nmismatch without writing the destination. The destination buffer is allocated\nvia JSC::Float16Array::tryCreateUninitialized() and ImageBufferBackend::\ngetPixelBuffer() only zero-fills on a size mismatch, so an RGBA16F\ngetPixelBuffer() readback whose output color space differed from the backing\nIOSurface's left the destination populated with uninitialized\nGigacage::Primitive heap. RemoteImageBuffer::getPixelBufferWithNewMemory()\nthen memcpy'd those bytes into WebContent-mapped shared memory causing a\nWebContent\u003c-\u003eGPUProcess heap disclosure.\n\nFloat16\u003c-\u003eFloat16 color-space conversion is unimplemented (the 8-bit sibling\npath also doesn't perform it). Remove the early return so the destination\nis always populated with the source pixels (alpha-format conversion applied),\nmatching the sibling's behavior and closing the disclosure.\n\nTest: ipc/rgba16f-getpixelbuffer-colorspace-mismatch-heap-disclosure.html\n\n* LayoutTests/ipc/rgba16f-getpixelbuffer-colorspace-mismatch-heap-disclosure-expected.txt: Added.\n* LayoutTests/ipc/rgba16f-getpixelbuffer-colorspace-mismatch-heap-disclosure.html: Added.\n* Source/WebCore/platform/graphics/PixelBufferConversion.cpp:\n(WebCore::convertImagePixelsFromFloat16ToFloat16):\n\nOriginally-landed-as: 305413.933@safari-7624-branch (e7a0eda7b7ff). rdar://180428968\nCanonical link: https://commits.webkit.org/316117@main",
      "email": "zakr@apple.com",
      "hash": "b6908339696324c13c05000979821df430e2cefa",
      "subject": "Uninitialized-heap disclosure in convertImagePixelsFromFloat16ToFloat16 via color-space early-return"
    },
    "316118@main": {
      "author": "Vassili Bykov",
      "avatar": "https://www.gravatar.com/avatar/73ac31c69ff9a621b733e47253103b8a?d=identicon\u0026s=64",
      "cl": "316118@main",
      "clUrl": "https://commits.webkit.org/316118@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314850\nrdar://176966728\n\nReviewed by Yusuke Suzuki.\n\nIn DFGArgumentsEliminationPhase::eliminateCandidatesThatInterfere(), the removeViaKill\nlambda contains two nested loops. The outer loop iterates over inline call frames. For\neach frame, the inner loop is expected to iterate the nodes of the given basic block in\nreverse order in the range [0, nodeIndex). However, because the inner loop mutates the\nlambda parameter nodeIndex directly, this only works as intended for the first inline call\nframe. Each subsequent call frame begins where the previous one left off.\n\nThe change introduces a separate iteration variable for the inner loop, which starts off\nat nodeIndex for each inline call frame. nodeIndex parameter is marked as 'const' to make\nexplicit the expectation that it should not change.\n\nTest: JSTests/stress/arguments-elimination-multiple-inline-call-frames.js\n\nOriginally-landed-as: 305413.912@safari-7624-branch (3270ebdb7366). rdar://180435783\nCanonical link: https://commits.webkit.org/316118@main",
      "email": "v_bykov@apple.com",
      "hash": "c3ca56b3af803be584aad6498beab4fec68b6a1e",
      "subject": "[JSC] DFGArgumentsEliminationPhase removeViaKill should reset node scan index between InlineCallFrames"
    },
    "316119@main": {
      "author": "Carlos Alberto Lopez Perez",
      "avatar": "https://www.gravatar.com/avatar/05326c1dbe06f486e884975e73f25179?d=identicon\u0026s=64",
      "cl": "316119@main",
      "clUrl": "https://commits.webkit.org/316119@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318205\n\nReviewed by Nikolas Zimmermann.\n\nEnsure to strip the binary and libraries before reporting the size.\nThat is done in a temporal file to not affect the original ones because\nthe user may want to keep those with debug symbols to use gdb or similar.\n\n* Tools/Scripts/webkitpy/browserperfdash/plans/browser_binary_size.py:\n(get_stripped_object_size):\n(get_basenames_and_sizes):\n(get_browser_relevant_objects_glib):\n\nCanonical link: https://commits.webkit.org/316119@main",
      "email": "clopez@igalia.com",
      "hash": "3ccfb3e02a8d5ab9539efb2a4c214ef48f247a71",
      "subject": "[Tools][WPE][browserperfdash-benchmark] browser-binary-size plan plugin should report the sizes of the stripped binaries and libs."
    },
    "316120@main": {
      "author": "Charlie Wolfe",
      "avatar": "https://www.gravatar.com/avatar/857b3b5ff3394c31fa2689310a93dbab?d=identicon\u0026s=64",
      "cl": "316120@main",
      "clUrl": "https://commits.webkit.org/316120@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313478\nrdar://174964081\n\nReviewed by Matthew Finkel.\n\nThe completion handler for requestStorageAccess() preserved the user gesture whenever the prompt was\nnot shown, including on the no-gesture fast-reject path. This synthesized a UserGestureIndicator\nfrom nothing, allowing the .catch handler to call gesture-gated APIs from a cross-site iframe with\nzero user interaction.\n\nGate gesture preservation on a real gesture having existed at call time.\n\nTest: http/tests/storageAccess/request-storage-access-rejected-without-gesture-should-not-activate.html\n\n* LayoutTests/http/tests/storageAccess/request-storage-access-rejected-without-gesture-should-not-activate-expected.txt: Added.\n* LayoutTests/http/tests/storageAccess/request-storage-access-rejected-without-gesture-should-not-activate.html: Added.\n* LayoutTests/http/tests/storageAccess/resources/request-storage-access-without-gesture-check-activation-iframe.html: Added.\n* Source/WebCore/dom/DocumentStorageAccess.cpp:\n(WebCore::DocumentStorageAccess::requestStorageAccess):\n(WebCore::DocumentStorageAccess::requestStorageAccessQuirk):\n* Source/WebCore/dom/DocumentStorageAccess.h:\n* Source/WebCore/page/ChromeClient.h:\n(WebCore::ChromeClient::requestStorageAccess):\n* Source/WebKit/NetworkProcess/Classifier/WebResourceLoadStatisticsStore.cpp:\n(WebKit::WebResourceLoadStatisticsStore::requestStorageAccess):\n* Source/WebKit/NetworkProcess/Classifier/WebResourceLoadStatisticsStore.h:\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:\n(WebKit::NetworkConnectionToWebProcess::requestStorageAccess):\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.h:\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.messages.in:\n* Source/WebKit/Scripts/webkit/messages.py:\n(headers_for_type):\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:\n(WebKit::WebChromeClient::requestStorageAccess):\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::requestStorageAccess):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n\nOriginally-landed-as: 305413.854@safari-7624-branch (6fae18f756d2). rdar://180436613\nCanonical link: https://commits.webkit.org/316120@main",
      "email": "charliew@apple.com",
      "hash": "d8576e6cceeb0595321ad30fb85d0b861377ce9d",
      "subject": "Reject requestStorageAccess() without gesture should not synthesize user activation"
    },
    "316121@main": {
      "author": "Jer Noble",
      "avatar": "https://www.gravatar.com/avatar/6d2cde9be23b98223ca964cb3b7813a0?d=identicon\u0026s=64",
      "cl": "316121@main",
      "clUrl": "https://commits.webkit.org/316121@main",
      "description": "rdar://174740124\nhttps://bugs.webkit.org/show_bug.cgi?id=313917\n\nReviewed by Simon Fraser.\n\n* Source/WebCore/platform/mock/mediasource/MockBox.cpp:\n(WebCore::MockInitializationBox::MockInitializationBox):\n(WebCore::MockSampleBox::MockSampleBox):\n\nOriginally-landed-as: 305413.813@safari-7624-branch (4f7a3cfefe44). rdar://180437504\nCanonical link: https://commits.webkit.org/316121@main",
      "email": "jer.noble@apple.com",
      "hash": "82a21e0b3ea89e71d4d34894e98f6c5ebe254a87",
      "subject": "MockSampleBox should not have negative timeScales and duration"
    },
    "316122@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "316122@main",
      "clUrl": "https://commits.webkit.org/316122@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318039\n\u003crdar://problem/180975454\u003e\n\nReviewed by Antti Koivisto.\n\nFollow-up to the width()/height() -\u003e borderBoxWidth()/borderBoxHeight() rename.\nsetWidth()/setHeight() set the border box width/height, but the bare names\ndidn't say so -- the unqualified odd ones out next to setBorderBoxSize() and the\nborderBox* getters. Name them for what they are.\n\nMechanical rename across WebCore; no behavior change.\n\n* Source/WebCore/layout/integration/flex/LayoutIntegrationFlexLayout.cpp:\n(FlexLayout::layout):\n(FlexLayout::updateRenderers):\n* Source/WebCore/layout/integration/grid/LayoutIntegrationGridLayout.cpp:\n(GridLayout::updateGridItemRenderers):\n(GridLayout::updateFormattingContextRootRenderer):\n* Source/WebCore/rendering/RenderBox.h:\n* Source/WebCore/rendering/RenderBoxInlines.h:\n(RenderBox::setLogicalHeight):\n(RenderBox::setLogicalWidth):\n* Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp:\n(RenderDeprecatedFlexibleBox::layoutBlock):\n(RenderDeprecatedFlexibleBox::layoutHorizontalBox):\n(RenderDeprecatedFlexibleBox::layoutSingleClampedFlexItem):\n(RenderDeprecatedFlexibleBox::layoutVerticalBox):\n* Source/WebCore/rendering/RenderFrameSet.cpp:\n(RenderFrameSet::layout):\n(resetFrameRendererAndDescendants):\n(RenderFrameSet::positionFrames):\n* Source/WebCore/rendering/RenderListMarker.cpp:\n(RenderListMarker::layout):\n* Source/WebCore/rendering/RenderReplaced.cpp:\n(RenderReplaced::layout):\n* Source/WebCore/rendering/RenderScrollbarPart.cpp:\n(RenderScrollbarPart::layoutHorizontalPart):\n(RenderScrollbarPart::layoutVerticalPart):\n(RenderScrollbarPart::computeScrollbarWidth):\n(RenderScrollbarPart::computeScrollbarHeight):\n(RenderScrollbarPart::paintIntoRect):\n* Source/WebCore/rendering/svg/RenderSVGForeignObject.cpp:\n(RenderSVGForeignObject::updateLogicalWidth):\n\nCanonical link: https://commits.webkit.org/316122@main",
      "email": "zalan@apple.com",
      "hash": "3c46119f53450bbe2474543a21f78b7b24b28fec",
      "subject": "[cleanup] Rename RenderBox::setWidth()/setHeight() to setBorderBoxWidth()/setBorderBoxHeight()"
    },
    "316123@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "316123@main",
      "clUrl": "https://commits.webkit.org/316123@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318020\n\nReviewed by Antti Koivisto.\n\nThese call sites only read the size of borderBoxRect(); none of them use its\nlocation. borderBoxRect() is { 0, 0, borderBoxSize() }, so constructing the\npositioned rect just to call .size()/.width()/.height()/.isEmpty() is wasteful\nand hides the intent. Use the direct accessor (borderBoxSize(), borderBoxWidth(),\nborderBoxHeight()) instead. No behavior change.\n\n* Source/WebCore/rendering/RenderBox.cpp:\n(RenderBox::reflectionOffset):\n* Source/WebCore/rendering/svg/RenderSVGRoot.cpp:\n(RenderSVGRoot::paint):\n(RenderSVGRoot::boundingRects):\n* Source/WebCore/style/values/transforms/StyleTransformList.cpp:\n(Blending\u003cTransformList\u003e::blend):\n\nCanonical link: https://commits.webkit.org/316123@main",
      "email": "zalan@apple.com",
      "hash": "bdf08cf8d7889d8990a601ff576fad7c06b89e3f",
      "subject": "[cleanup] Use RenderBox::borderBoxSize() in size-only callers of borderBoxRect()"
    },
    "316124@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316124@main",
      "clUrl": "https://commits.webkit.org/316124@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314295\nrdar://176438133\n\nReviewed by Ryosuke Niwa.\n\nStop capturing `host` and `protocol` by reference in the lambda since\nthe lambda can get called asynchronously.\n\n* Source/WebKit/UIProcess/WebsiteData/Cocoa/WebsiteDataStoreCocoa.mm:\n(WebKit::WebsiteDataStore::beginAppBoundDomainCheck):\n\nOriginally-landed-as: 305413.851@safari-7624-branch (3602ee8745a7). rdar://180438476\nCanonical link: https://commits.webkit.org/316124@main",
      "email": "cdumez@apple.com",
      "hash": "e1084c3d52e835ffeaa42129b87e311e0cf5acf9",
      "subject": "Use-after-free under WebsiteDataStore::beginAppBoundDomainCheck()"
    },
    "316125@main": {
      "author": "Kimmo Kinnunen",
      "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64",
      "cl": "316125@main",
      "clUrl": "https://commits.webkit.org/316125@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312564\nrdar://174640403\n\nReviewed by Dan Glastonbury.\n\nAllocate the read pixels area with zero init.\n\n* Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGL.cpp:\n(WebKit::RemoteGraphicsContextGL::readPixelsInline):\n\nOriginally-landed-as: 305413.708@safari-7624-branch (0c204da15932). rdar://180438472\nCanonical link: https://commits.webkit.org/316125@main",
      "email": "kkinnunen@apple.com",
      "hash": "8c0e20bc65f3887acb03bda989f747dd047ab015",
      "subject": "WebGL: Uninitialized FastMalloc heap disclosure in RemoteGraphicsContextGL::readPixelsInline"
    },
    "316126@main": {
      "author": "Said Abou-Hallawa",
      "avatar": "https://www.gravatar.com/avatar/ae80a929a378a055822829ae63903296?d=identicon\u0026s=64",
      "cl": "316126@main",
      "clUrl": "https://commits.webkit.org/316126@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314906\nrdar://176813834\n\nReviewed by Darin Adler.\n\nFilterImage provides three different representations of the image: ImageBuffer,\nUnpremultiplied PixelBuffer and Premultiplied PixelBuffer. These three buffers\nare lazily created. Each of them is created only when it is needed. But keep in\nmind they are copies of each other. In other words, when one is created it has\nto copy the pixels from the existing buffers. Otherwise it has to be zero-filled.\n\nA problem may happen when copying the pixels from one buffer to a newly created\nbuffer fails. In this case we send uninitialized PixelBuffer which may expose user\nprivate data. Not able to copy existing pixels to the PixelBuffer should be treated\nas an error. So a null PixelBuffer should be returned in this case.\n\n* Source/WebCore/platform/graphics/cpu/arm/filters/FEBlendNeonApplier.cpp:\n(WebCore::FEBlendNeonApplier::apply const):\n* Source/WebCore/platform/graphics/filters/FilterImage.cpp:\n(WebCore::copyImageBytes):\n(WebCore::FilterImage::pixelBuffer):\n(WebCore::FilterImage::getPixelBuffer):\n(WebCore::FilterImage::copyPixelBuffer):\n* Source/WebCore/platform/graphics/filters/FilterImage.h:\n\nOriginally-landed-as: 305413.919@safari-7624-branch (dbf10417aa9e). rdar://180436188\nCanonical link: https://commits.webkit.org/316126@main",
      "email": "said@apple.com",
      "hash": "bb98ffd5c7336141c471e359b03b57d0f6de7142",
      "subject": "FilterImage may return uninitialized PixelBuffer"
    },
    "316127@main": {
      "author": "Anand Srinivasan",
      "avatar": "https://www.gravatar.com/avatar/84643a20c269974c2df6681742daf0a4?d=identicon\u0026s=64",
      "cl": "316127@main",
      "clUrl": "https://commits.webkit.org/316127@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312415\nrdar://174714198\n\nReviewed by Yijia Huang.\n\nIn YarrJIT negativeOffsetIndexedAddress computes a negative offset from\na base address but the function mistakenly uses the original value\ninstead of the adjusted value. This patch fixes it to use the adjusted\nvalue.\n\nTest: JSTests/stress/yarr-negative-offset.js\n\n* JSTests/stress/yarr-negative-offset.js: Added.\n(catch):\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n\nOriginally-landed-as: 305413.685@safari-7624-branch (30c8460241f3). rdar://180436598\nCanonical link: https://commits.webkit.org/316127@main",
      "email": "anand_srinivasan@apple.com",
      "hash": "bd5f1e5b17d9fbc4bfc6e5d78e1f7d6153f7416a",
      "subject": "YarrJIT negativeOffsetIndexedAddress discards adjusted base register"
    },
    "316128@main": {
      "author": "Kai Tamkun",
      "avatar": "https://www.gravatar.com/avatar/dff073cba21885df4d9f73ed3cc493c2?d=identicon\u0026s=64",
      "cl": "316128@main",
      "clUrl": "https://commits.webkit.org/316128@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313252\nrdar://175498631\n\nReviewed by Yijia Huang.\n\nThis patch fixes the abstract interpreter's structure prediction for the spread operator.\nInstead of only cellButterflyStructure(CopyOnWriteArrayWithContiguous), it now also takes\ncellButterflyOnlyAtomStringsStructure into account.\n\nTest: JSTests/stress/spread-with-OnlyAtomStringsStructure.js\n\n* JSTests/stress/spread-with-OnlyAtomStringsStructure.js: Added.\n(index):\n* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:\n(JSC::DFG::AbstractInterpreter\u003cAbstractStateType\u003e::executeEffects):\n\nOriginally-landed-as: 305413.768@safari-7624-branch (62a1052dd1fe). rdar://180435430\nCanonical link: https://commits.webkit.org/316128@main",
      "email": "k_tamkun@apple.com",
      "hash": "0d6fe1662d2de50ca7f91db10a75541c19bf178d",
      "subject": "[JSC] Spread operator doesn't account for cellButterflyOnlyAtomStringsStructure in DFG"
    },
    "316129@main": {
      "author": "Zak Ridouh",
      "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64",
      "cl": "316129@main",
      "clUrl": "https://commits.webkit.org/316129@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=313818\u003e\n\u003crdar://174678764\u003e\n\nReviewed by Sihui Liu.\n\nMemoryIndexCursor caches an IndexValueStore::Iterator across IPC messages.\nFor Prev/Prevunique cursors this wraps std::set\u003cIDBKeyData\u003e::reverse_iterator\nobjects (one for the outer IndexValueStore::m_orderedKeys set, one nested in\nIndexValueEntry::Iterator for the inner per-index-key set). A\nstd::reverse_iterator stores a forward base() iterator pointing one element\npast the logical position; for libc++ std::set that is a raw __tree_node*.\n\nMemoryIndexCursor::indexValueChanged() only invalidates m_currentIterator\nwhen the changed (key, primaryKey) equals the cursor's current logical\nposition. Deleting the next-higher index key (Variant A, outer set) or the\nnext-higher primary key under a shared index key (Variant B, inner set)\ntherefore frees exactly the __tree_node base() references while the guard\nearly-returns. The next IterateCursor IPC executes ++m_reverseIterator =\u003e\n--base() =\u003e __tree_prev_iter(freed_node), a heap-use-after-free in\ncom.apple.WebKit.Networking reachable from a compromised WebContent process\nvia NetworkStorageManager IPC with WCP-controlled\nIDBDatabaseIdentifier.m_isTransient = true forcing MemoryIDBBackingStore.\n\nFix by gating the equality early-return on info().isDirectionForward(). For\nreverse cursors we now invalidate m_currentIterator on any index mutation;\niterate() already re-seeks via reverseFind(m_currentKey, m_currentPrimaryKey)\nwhen the iterator is invalid. Both removeEntriesWithValueKey() erase paths\n(outer m_orderedKeys.erase() and inner IndexValueEntry::removeKey()) reach\nindexValueChanged() through MemoryIndex::notifyCursorsOfValueChange(), so\nboth variants are closed.\n\n* LayoutTests/storage/indexeddb/index-cursor-reverse-delete-next-higher-key-private-expected.txt: Added.\n* LayoutTests/storage/indexeddb/index-cursor-reverse-delete-next-higher-key-private.html: Added.\n* Source/WebCore/Modules/indexeddb/server/MemoryIndexCursor.cpp:\n(WebCore::IDBServer::MemoryIndexCursor::indexValueChanged):\n\nOriginally-landed-as: 305413.842@safari-7624-branch (d14d12e915f3). rdar://180436983\nCanonical link: https://commits.webkit.org/316129@main",
      "email": "zakr@apple.com",
      "hash": "16b1bde3c1918236d0eefee504bcf4180566087f",
      "subject": "[CoreIPC] [NP] Heap UAF in WebCore::IDBServer::MemoryIndexCursor reverse iterator when a Prev/Prevunique cursor's next-higher index entry is deleted"
    },
    "316130@main": {
      "author": "Kimmo Kinnunen",
      "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64",
      "cl": "316130@main",
      "clUrl": "https://commits.webkit.org/316130@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312470\nrdar://174919762\n\nReviewed by Dan Glastonbury.\n\nThe implementation of DrawElements would be inconsistent:\n\nThe implementation has multiple stages of possible intermediate buffers.\nAt various stages, offsets and counts were mixed between incorrect\nstages.\n\nHistorically the confusions were partly due to the logic loading\nthe primitive ranges sometimes from generate intermediary buffers,\nsometimes from the original client-provided buffer. This was partly\nfixed to load only from client-provided buffers and client arrays\nin \"WebGL: consecutive UNSIGNED_BYTE drawElements() draw in wrong\nlocation\", but this caused a regression by other part of the code\nusing counts from incorrect stages.\n\nThe implementation strategy would not working for non-strip topologies,\nsuch as GL_TRIANGLES, in primitive restart cases when provoking vertex\nrewrite was needed. The provoking vertex rewrite operates per primitive.\nFor strip topologies, this works as each vertex index also defines a\nprimitive. For non-strip topologies, this is not possible as the\nprovoking vertex generation shader cannot know where the primitive\nstarts. Example: GL_TRIANGLES of {0, ff, 1, 2, 3, 4} would be dispatched\nas primitives starting at 0 and 2, but the proper dispatch list\nwould contain just primitive at 1.\n\nFurthermore, the logic to determine drawn index ranges was based on\nscanning for primitive restart ranges, and then converting those\nto draw index ranges. This algorithm was brittle and contained\nquite many confusions.\n\nFix by:\n- Resolve the draw index ranges by resolving the draw index ranges\n  instead of restart ranges. These index ranges are then intersected\n  with the client provided offset and count, which define the first\n  index, last index range pair.\n- Consistently resolve the draw index ranges ƒrom the client buffers.\n- Keep all intermediate buffers consistent with the first index, count:\n  the intermediate buffers always have the similar unused prefix\n  than the original client-provided index buffer.\n- Keep all the intermediate buffers offsets separated from the\n  client-provided offset (first index). The intermediate buffers are\n  allocated from the buffer pool, so they're not separate buffers but\n  buffer, offset pairs. Keep these buffer, offset pairs separate from\n  the client first index\n- For non-strip topology draws, provide the draw ranges already to the\n  provoking vertex shader helper. The provoking vertex shader is\n  only run for the real draw indices instead of the full draw.\n  This allows the shader to function correctly.\n\n* Source/ThirdParty/ANGLE/ANGLE.xcodeproj/project.pbxproj:\n* Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/BufferMtl.h:\n(rx::DrawIndexRange::DrawIndexRange):\n(rx::BufferMtl::DrawIndexRangeCache::DrawIndexRangeCache):\n(rx::IndexRange::IndexRange): Deleted.\n(rx::BufferMtl::RestartRangeCache::RestartRangeCache): Deleted.\n* Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/BufferMtl.mm:\n(rx::BufferMtl::markConversionBuffersDirty):\n(rx::BufferMtl::clearConversionBuffers):\n(rx::CalculateDrawIndexRanges):\n(rx::BufferMtl::getDrawIndexRanges):\n(rx::BufferMtl::GetDrawIndexRangesFromClientData):\n(rx::IndexConversionBufferMtl::getRangeForConvertedBuffer): Deleted.\n(rx::CalculateRestartRanges): Deleted.\n(rx::BufferMtl::getRestartIndices): Deleted.\n(rx::BufferMtl::GetRestartIndicesFromClientData): Deleted.\n* Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ContextMtl.h:\n(rx::ContextMtl::getProvokingVertexHelper):\n* Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ContextMtl.mm:\n(rx::ContextMtl::drawElementsImpl):\n* Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ProvokingVertexHelper.h:\n* Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ProvokingVertexHelper.mm:\n(rx::ProvokingVertexHelper::preconditionIndexBuffer):\n(rx::ProvokingVertexHelper::generateIndexBuffer):\n* Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/VertexArrayMtl.h:\n* Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/VertexArrayMtl.mm:\n(rx::AppendDrawCommands):\n(rx::AppendDrawCommandRanges):\n(rx::VertexArrayMtl::resolveDrawElementsDraw):\n(rx::VertexArrayMtl::getIndexBuffer): Deleted.\n(rx::VertexArrayMtl::getDrawIndices): Deleted.\n* Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/VertexArrayMtl_unittest.mm: Added.\n* Source/ThirdParty/ANGLE/src/tests/gl_tests/DrawElementsTest.cpp:\n(angle::convertIndexBufferContents):\n\nOriginally-landed-as: 305413.713@safari-7624-branch (23eba5e02916). rdar://180437073\nCanonical link: https://commits.webkit.org/316130@main",
      "email": "kkinnunen@apple.com",
      "hash": "8d4c7092266659c6cf81d92ba23176feb8852178",
      "subject": "ANGLE: Metal: Inconsistent implementation of various DrawElements variations"
    },
    "316131@main": {
      "author": "Tadeu Zagallo",
      "avatar": "https://www.gravatar.com/avatar/d517fd5480efde083cc7b6af36c73ced?d=identicon\u0026s=64",
      "cl": "316131@main",
      "clUrl": "https://commits.webkit.org/316131@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315196\nrdar://176882934\n\nReviewed by Mike Wyrzykowski.\n\nRenderPassEncoder::clampIndexBufferToValidValues guards baseVertex magnitude with\n-baseVertex \u003e static_cast\u003cint64_t\u003e(minVertexCount), but the unary negation runs\nin 32-bit signed arithmetic before the comparison widens, so baseVertex == INT32_MIN\nwraps to itself and passes the guard. The fix widens baseVertex to int64_t before\nnegation and sign extension preserves all valid negative baseVertex values, so the\nguard's behaviour is unchanged for every input except INT32_MIN, whose magnitude (2^31)\nis now representable and correctly rejected.\n\nTest: fast/webgpu/nocrash/fuzz-176882934.html\n\n* LayoutTests/fast/webgpu/nocrash/fuzz-176882934-expected.txt: Added.\n* LayoutTests/fast/webgpu/nocrash/fuzz-176882934.html: Added.\n* Source/WebGPU/WebGPU/RenderPassEncoder.mm:\n(WebGPU::RenderPassEncoder::clampIndexBufferToValidValues):\n\nOriginally-landed-as: 305413.952@safari-7624-branch (04553772a362). rdar://180436823\nCanonical link: https://commits.webkit.org/316131@main",
      "email": "tzagallo@apple.com",
      "hash": "543f99d9d38bc37514d8cb3a4e03f66e41e5089d",
      "subject": "[WebGPU] signed-negation overflow on baseVertex==INT32_MIN in RenderPassEncoder::clampIndexBufferToValidValues"
    },
    "316132@main": {
      "author": "Vignesh Rao",
      "avatar": "https://www.gravatar.com/avatar/2af4792c9be54a712b6c920fe10635ba?d=identicon\u0026s=64",
      "cl": "316132@main",
      "clUrl": "https://commits.webkit.org/316132@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313063\nrdar://174492346\n\nReviewed by Keith Miller.\n\nAfter a re-tier, when a fresh BBQCallee replaces a retired one,\nm_osrEntryCallees may hold a stale weak ref to an OMGOSREntryCallee not owned\nby the current BBQCallee. Currently, updateCallsitesToCallUs will not track\nthis since it assumes that this OMGOSREntryCallee will be owned by the BBQCallee\n\nThis patch fixes it by unconditionally keeping the OMGOSREntryCallee alive\nwhile we update all the callsites within it. The assert in ~BBQCallee is void\nnow since an OMGOSREntryCallee can now have multiple owners.\n\n* Source/JavaScriptCore/wasm/WasmCallee.cpp:\n(JSC::Wasm::BBQCallee::~BBQCallee):\n* Source/JavaScriptCore/wasm/WasmCalleeGroup.cpp:\n(JSC::Wasm::CalleeGroup::updateCallsitesToCallUs):\n\nOriginally-landed-as: 305413.784@safari-7624-branch (84a5f91f00a5). rdar://180437899\nCanonical link: https://commits.webkit.org/316132@main",
      "email": "v_rao@apple.com",
      "hash": "20d1bae11e90cb09967c16480965584fc14b89c6",
      "subject": "[JSC] Unconditionally keep OMGOSREntryCallee alive while updating its callsites"
    },
    "316133@main": {
      "author": "Anthony Tarbinian",
      "avatar": "https://www.gravatar.com/avatar/ef46154a1a21c6a5ef593e952ebc62f4?d=identicon\u0026s=64",
      "cl": "316133@main",
      "clUrl": "https://commits.webkit.org/316133@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312391\nrdar://173799670\n\nReviewed by Sihui Liu.\n\nWhen an IndexedDB connection is closed while a version\nchange transaction is active, UniqueIDBDatabase::connectionClosedFromClient\nsuccessfully closes the version change transaction however it does\nnot clear any other pending transactions due to an early return\nwhen clearing version change transactions.\n\nInstead of being defensive and clearing the pending transaciton\nin the case of the early return, we should reject any incoming\ntransactions which come on a version change connection.\n\nOnly whenever a version change operation completes, can\na new transaction be established. So, this patch rejects any\nincoming transactions which come while a version change operation\nis active.\n\nThe IndexedDB spec describes the steps for starting a new transaction:\n\n\tThe transaction(storeNames, mode, options) method steps are:\n\t1. If a live upgrade transaction is associated with the connection, throw an \"InvalidStateError\" DOMException.\n\nhttps://w3c.github.io/IndexedDB/#dom-idbdatabase-transaction\n\nThis check already happens in the web process during\nIDBDatabase::transaction where it returns an \"InvalidStateError\"\nin this state.\n\nHowever, this doesn't account for a compromised web process\nwho avoids this client side check and makes it across IPC\nto invoke transaction creation in the NetworkProcess.\n\nThis patch adds a check for this scenario of a comprimised web\nprocess who manages to start a new transaction during a\nversion change, if this is detected, we return early and\ndon't move forward with creating the transaction\n\nThis patch checks that the current connection isn't the\nstored UniqueIDBDatabase::m_versionChangeDatabaseConnection.\nThat member variable will point to the active version change connection,\nif any, and it is cleared when the version change completes.\nIt also checks if m_versionChangeTransaction is non-null\nsince it will only be null once the version change transaction\nis completed.\n\n* LayoutTests/ipc/networksindexeddb-close-connection-during-version-change-expected.txt: Added.\n* LayoutTests/ipc/networksindexeddb-close-connection-during-version-change.html: Added.\n* Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.cpp:\n(WebCore::IDBServer::UniqueIDBDatabase::isVersionChangeTransactionActive const):\n* Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.h:\n* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp:\n(WebKit::NetworkStorageManager::establishTransaction):\n(WebKit::NetworkStorageManager::databaseConnectionPendingClose):\n\nOriginally-landed-as: 305413.734@safari-7624-branch (6b2393e40648). rdar://180437837\nCanonical link: https://commits.webkit.org/316133@main",
      "email": "a_tarbinian@apple.com",
      "hash": "e2b88c2f80488fed156450007f317f5ff0e564f4",
      "subject": "Reject IndexedDB transactions during version change operation"
    },
    "316134@main": {
      "author": "Tadeu Zagallo",
      "avatar": "https://www.gravatar.com/avatar/d517fd5480efde083cc7b6af36c73ced?d=identicon\u0026s=64",
      "cl": "316134@main",
      "clUrl": "https://commits.webkit.org/316134@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315496\nrdar://176812014\n\nReviewed by Mike Wyrzykowski.\n\nWe were using weak pointers to compare the autogenerated pipeline layouts when\nchecking for compatibility of two bind groups, however the weak pointer can be\nnull in two scenarios: when the layout is explicit or when the pipeline layout\nhas been destroyed. That could result in incorrectly considering two bind groups\ncompatible when one is pipeline layout is explicit and the other has been destroyed.\nIn order to avoid that we explicitly check whether both bind groups use auto\ngenerated layouts.\n\nTest: fast/webgpu/regression/repro_176812014.html\n\n* LayoutTests/fast/webgpu/regression/repro_176812014-expected.txt: Added.\n* LayoutTests/fast/webgpu/regression/repro_176812014.html: Added.\n* Source/WebGPU/WebGPU/BindGroupLayout.mm:\n(WebGPU::BindGroupLayout::errorValidatingBindGroupCompatibility const):\n\nOriginally-landed-as: 305413.964@safari-7624-branch (48e38ee5acbc). rdar://180428905\nCanonical link: https://commits.webkit.org/316134@main",
      "email": "tzagallo@apple.com",
      "hash": "aad3188c8a8d1f828860100602581ee568aa24d5",
      "subject": "[WebGPU] Stale WeakPtr comparison in BindGroupLayout::errorValidatingBindGroupCompatibility allows incompatible auto/explicit layout pairing"
    },
    "316135@main": {
      "author": "Simon Lewis",
      "avatar": "https://www.gravatar.com/avatar/f354c01a964923e67771a097d7d2f084?d=identicon\u0026s=64",
      "cl": "316135@main",
      "clUrl": "https://commits.webkit.org/316135@main",
      "description": "rdar://175520011\n\nReviewed by Jean-Yves Avenard\n\nWebCodecsAudioData is annotated with ReportExtraMemoryCost, so the generated\nJS wrapper's visitChildren calls WebCodecsAudioData::memoryCost() from a\nconcurrent GC marker thread. memoryCost() dereferenced m_data.audioData (a\nRefPtr\u003cPlatformRawAudioData\u003e) without synchronization while close() on the\nmain thread assigns m_data.audioData = nullptr and frees the\nPlatformRawAudioData, leading to a heap-use-after-free in\nPlatformRawAudioDataCocoa::memoryCost().\n\nCache the memory cost in a std::atomic\u003csize_t\u003e on WebCodecsAudioData,\ncomputed once at construction time on the main thread and zeroed in close(),\nso the GC-thread memoryCost() never touches the RefPtr. This matches the\nexisting pattern in ImageBitmap.\n\n* LayoutTests/fast/webcodecs/audio-data-close-during-gc-crash-expected.txt: Added.\n* LayoutTests/fast/webcodecs/audio-data-close-during-gc-crash.html: Added.\n* Source/WebCore/Modules/webcodecs/WebCodecsAudioData.cpp:\n(WebCore::WebCodecsAudioData::WebCodecsAudioData):\n(WebCore::WebCodecsAudioData::close):\n* Source/WebCore/Modules/webcodecs/WebCodecsAudioData.h:\n(WebCore::WebCodecsAudioData::memoryCost const):\n\nOriginally-landed-as: 305413.845@safari-7624-branch (2102c1dad1d3). rdar://180438342\nCanonical link: https://commits.webkit.org/316135@main",
      "email": "simon.lewis@apple.com",
      "hash": "e147963ac4e9a6cf2bb7c40c23d26b85637db828",
      "subject": "use-after-free in WebCodecsAudioData::memoryCost() via concurrent GC marker / close()"
    },
    "316136@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316136@main",
      "clUrl": "https://commits.webkit.org/316136@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315538\nrdar://177375129\n\nReviewed by Timothy Hatcher.\n\nWhen WebExtensionStorageSQLiteStore::setKeyedData hits an INSERT error\nmid-batch (e.g. SQLITE_FULL), it returns a keysSuccessfullySet vector\nthat is non-empty but smaller than the input map. The completion lambda\nin storageSet then iterated `data.keys()` while calling `data.remove()`\ninside the loop. `keys()` returns a live iterator range backed by raw\npointers into the HashTable buffer, and remove() can shrink/rehash and\nfree that buffer, leaving the iterator dangling — a heap UAF in the UI\nProcess driven by IPC from the WebContent process.\n\nReplace the iterate-and-mutate loop with HashMap::removeIf, which walks\nthe table safely.\n\n* Source/WebKit/UIProcess/Extensions/API/WebExtensionContextAPIStorage.cpp:\n(WebKit::WebExtensionContext::storageSet):\n\nOriginally-landed-as: 305413.961@safari-7624-branch (de9fb008197a). rdar://180427449\nCanonical link: https://commits.webkit.org/316136@main",
      "email": "cdumez@apple.com",
      "hash": "d9783c3c13e7b9da3ff3cdb8947022f377b20c62",
      "subject": "[WebKit Process Model] Use-after-free in WebExtensionContext::storageSet from HashMap mutation during keys() iteration"
    },
    "316137@main": {
      "author": "Kai Tamkun",
      "avatar": "https://www.gravatar.com/avatar/dff073cba21885df4d9f73ed3cc493c2?d=identicon\u0026s=64",
      "cl": "316137@main",
      "clUrl": "https://commits.webkit.org/316137@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312513\nrdar://174428778\n\nReviewed by Yusuke Suzuki.\n\nAdjusts TypedArray.from to properly handle cases where the map function changes the bounds of the arraylike input.\n\nTest: JSTests/stress/typedarray-from-oob.js\n\n* JSTests/stress/typedarray-from-oob.js: Added.\n(testResize):\n(testDetach):\n* Source/JavaScriptCore/builtins/TypedArrayConstructor.js:\n(from):\n\nOriginally-landed-as: 305413.702@safari-7624-branch (e99a325bb9b8). rdar://180429231\nCanonical link: https://commits.webkit.org/316137@main",
      "email": "k_tamkun@apple.com",
      "hash": "7a9d14998def6f77f60708cb89c5e68db69982e5",
      "subject": "[JSC] TypedArray.from() Out-of-Bounds Read via Resizable ArrayBuffer resize/transfer in mapFn callback."
    },
    "316138@main": {
      "author": "Rob Buis",
      "avatar": "https://www.gravatar.com/avatar/74fb5af173895d2a7814b0aed1238a39?d=identicon\u0026s=64",
      "cl": "316138@main",
      "clUrl": "https://commits.webkit.org/316138@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318132\n\nReviewed by Nikolas Zimmermann.\n\nFix animateMotion-spline-invalid-keyTimes.html by keeping the animation invalid when keyTimes list does not end with 1\nfor the spline calcMode [1].\n\n[1] https://svgwg.org/specs/animations/#KeyTimesAttribute\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animateMotion-spline-invalid-keyTimes-expected.txt:\n* Source/WebCore/svg/SVGAnimationElement.cpp:\n(WebCore::SVGAnimationElement::startedActiveInterval):\n\nCanonical link: https://commits.webkit.org/316138@main",
      "email": "rbuis@igalia.com",
      "hash": "4691d48077d6de7bb72d10ba3f171dc41fcc87ad",
      "subject": "Fix animateMotion-spline-invalid-keyTimes.html"
    },
    "316139@main": {
      "author": "Shu-yu Guo",
      "avatar": "https://www.gravatar.com/avatar/3884544eb9e557e2ec917d32c6e12720?d=identicon\u0026s=64",
      "cl": "316139@main",
      "clUrl": "https://commits.webkit.org/316139@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314747\nrdar://176792407\n\nReviewed by Keith Miller.\n\nThe DFG barrier insertion phase works by tracking an \"epoch\" serial number,\nwhich is bumped every time it encounters a node that can GC. The assumption is\nthat each DFG node either does a store, which would need to be considered for\nbarrier insertion, or performs a GC.\n\nMultiPutByOffset is a \"fat\" node that can GC and perform a store after that GC,\nin sequence. The current analysis therefore incorrectly elides the barrier for\nit. This PR fixes by special casing.\n\nTest: JSTests/stress/multi-put-by-offset-reallocating-storage-needs-write-barrier.js\n\n* JSTests/stress/multi-put-by-offset-reallocating-storage-needs-write-barrier.js: Added.\n(foo):\n* Source/JavaScriptCore/dfg/DFGStoreBarrierInsertionPhase.cpp:\n\nOriginally-landed-as: 305413.909@safari-7624-branch (2b4933eb1658). rdar://180427769\nCanonical link: https://commits.webkit.org/316139@main",
      "email": "syg@apple.com",
      "hash": "2620d0dbd518fe150e430667996aeb2d94ecd75d",
      "subject": "[JSC] Insert barrier for MultiPutByOffset when it can reallocate storage"
    },
    "316140@main": {
      "author": "Jonathan Bedard",
      "avatar": "https://www.gravatar.com/avatar/24548a6c84377efe7594acc92601e839?d=identicon\u0026s=64",
      "cl": "316140@main",
      "clUrl": "https://commits.webkit.org/316140@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318219\nrdar://181020438\n\nUnreviewed build fix.\n\n* Source/WebKit/UIProcess/mac/WKAppKitGestureController.swift:\n\nCanonical link: https://commits.webkit.org/316140@main",
      "email": "jbedard@apple.com",
      "hash": "ff4c71709968a3deef34f315736b65abef410b0b",
      "subject": "REGRESSION(316095@main): error: initializer 'init(_:)' is not available due to missing import of defining module 'WebCore_Private' [#MemberImportVisibility]"
    },
    "316141@main": {
      "author": "Nikolas Zimmermann",
      "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64",
      "cl": "316141@main",
      "clUrl": "https://commits.webkit.org/316141@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318220\n\nUnreviewed gardening.\n\nForgot to reset LBSE specific results after 315674@main, fix that.\n\n* LayoutTests/platform/ios/svg/compositing/anonymous-RenderSVGViewportContainer-no-repaints-expected.txt:\n* LayoutTests/platform/ios/svg/compositing/segment-removed-after-anchor-decomposited-layer-tree-expected.txt: Added.\n* LayoutTests/platform/ios/svg/compositing/transform-change-repainting-viewBox-repaintRects-expected.txt: Added.\n* LayoutTests/platform/ios/svg/transforms/nested-svg-transform-attribute-creates-layer-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/316141@main",
      "email": "nzimmermann@igalia.com",
      "hash": "ebcf15019b705c4f4b52eed43c85192089f709d8",
      "subject": "[LBSE] Rebaseline iOS specific results after 315674@main"
    },
    "316142@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "316142@main",
      "clUrl": "https://commits.webkit.org/316142@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318180\nrdar://180990441\n\nReviewed by Tadeu Zagallo.\n\nThis patch adds operationGetByValArrayStorageInt, which is tailored for\nArrayStorage slow path operation. DFG / FTL can use this when we already\nspeculate ArrayStorage, but it is a slow path.\n\n                                                 ToT                     Patched\n\nget-by-val-array-storage-sparse-hole      122.9244+-1.1533     ^     62.5947+-9.6089        ^ definitely 1.9638x faster\nget-by-val-array-storage-sparse           117.8623+-0.4612     ^     84.7042+-0.5769        ^ definitely 1.3915x faster\n\nTests: JSTests/microbenchmarks/get-by-val-array-storage-sparse-hole.js\n       JSTests/microbenchmarks/get-by-val-array-storage-sparse.js\n\n* JSTests/microbenchmarks/get-by-val-array-storage-sparse-hole.js: Added.\n(get array):\n* JSTests/microbenchmarks/get-by-val-array-storage-sparse.js: Added.\n(get array):\n* Source/JavaScriptCore/dfg/DFGOperations.cpp:\n(JSC::DFG::getByValArrayStorageInt):\n(JSC::DFG::JSC_DEFINE_JIT_OPERATION):\n* Source/JavaScriptCore/dfg/DFGOperations.h:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:\n(JSC::DFG::SpeculativeJIT::compileGetByVal):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:\n(JSC::DFG::SpeculativeJIT::compileGetByVal):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileGetByValImpl):\n\nCanonical link: https://commits.webkit.org/316142@main",
      "email": "ysuzuki@apple.com",
      "hash": "5dd6865434312c3def91b287b6faba33ba795833",
      "subject": "[JSC] Add ArrayStorage + GetByVal specific operation"
    },
    "316143@main": {
      "author": "Brady Eidson",
      "avatar": "https://www.gravatar.com/avatar/31bed81d6d8ef517f93b30add03f5651?d=identicon\u0026s=64",
      "cl": "316143@main",
      "clUrl": "https://commits.webkit.org/316143@main",
      "description": "rdar://174702519\n\nReviewed by Ben Nham.\n\nWhen considering whether a given web process should have access to a given back/forward entry,\nthe global map is the wrong tool.\n\nCheck on a per-process basis instead.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKBackForwardListTests.mm\n\n* Source/WebKit/UIProcess/WebBackForwardList.cpp:\n(WebKit::messageCheckItemURLs):\n(WebKit::WebBackForwardList::backForwardAddItemShared):\n(WebKit::WebBackForwardList::backForwardSetChildItem):\n(WebKit::WebBackForwardList::backForwardUpdateItem):\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::checkURLReceivedFromWebProcess):\n* Tools/TestWebKitAPI/Tests/WebKit/WKBackForwardListTests.mm:\n(\u003cscript\u003e):\n(ForgedFileURLItemIsRejected)):\n\nOriginally-landed-as: 305413.831@safari-7624-branch (249edf86a9f5). rdar://180428225\nCanonical link: https://commits.webkit.org/316143@main",
      "email": "beidson@apple.com",
      "hash": "9d4788bb9669dff43ad84c9be5c8215617954fa5",
      "subject": "Need a process-specific `WebBackForwardListItem::allItems()` instead of the process-global map for better message checking"
    },
    "316144@main": {
      "author": "Karl Dubost",
      "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64",
      "cl": "316144@main",
      "clUrl": "https://commits.webkit.org/316144@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=266832\nrdar://120284006\n\nReviewed by Elika Etemad.\n\nSVG text on a path (and any per-character-positioned text) was laid out one\nUnicode code point at a time: SVGTextLayoutEngine opened a fresh\nsingle-code-point fragment for every code point whenever a per-character\ncondition fired (text on a path, an explicit rotate, vertical text, …),\nand SVGTextBoxPainter then shaped each fragment's substring in isolation. A lone\ncombining mark shaped on its own (e.g. U+0301, or the Devanagari virama U+094D)\nmakes the font emit a dotted circle.\n\nSVG 2 section 11 addresses the text-positioning attributes (x/y/dx/dy/rotate)\nper Unicode code point, but it also defines a \"typographic character\"\n\n    a UAX #29 grapheme cluster such as a base letter plus its\n    combining marks, or a Devanagari syllable\n\nas an indivisible unit whose internal glyph arrangement is \"not user\ncontrollable\". So code points are addressed, but typographic characters\nare positioned and shaped. WebKit placed code points.\n\nCompute grapheme-cluster boundaries over the renderer text with an ICU\ncharacter-break iterator, keyed by the same code-unit offset the layout loop\nwalks, and only let a cluster-start code point open a new fragment. A\ncontinuation code point (a combining mark, a Devanagari continuation, the\nsecond regional indicator of a flag) now joins the current fragment, so the\npainter hands base + marks to the shaper together. This is font-independent, so\nit groups base + mark even when the font has no composed glyph -- precisely the\ndotted-circle case. Per-code-point metrics, character-data lookups, and the\ngetNumberOfChars / query contract are unchanged; the fragment simply spans\nmultiple metrics entries, which recordTextFragment already sums.\n\nMatches Gecko and Blink, which both treat the typographic character as the\npositioning unit. For pure ASCII / precomposed Latin-1 text every code point is\na grapheme boundary, so behavior is unchanged there.\n\nTests: imported/w3c/web-platform-tests/svg/text/reftests/textpath-combining-marks-ref.html\n       imported/w3c/web-platform-tests/svg/text/reftests/textpath-combining-marks.html\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/reftests/textpath-combining-marks-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/reftests/textpath-combining-marks-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/reftests/textpath-combining-marks.html: Added.\n* Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp:\n(WebCore::SVGTextLayoutEngine::layoutTextOnLineOrPath):\n\nCanonical link: https://commits.webkit.org/316144@main",
      "email": "karlcow@apple.com",
      "hash": "ef2bac73ff9346238a2821c222980d38f9aaad97",
      "subject": "Combining marks on SVG \u003ctextPath\u003e render as dotted circles"
    },
    "316145@main": {
      "author": "Lily Spiniolas",
      "avatar": "https://www.gravatar.com/avatar/b65cfeb51301399bd50e338bb2d7613e?d=identicon\u0026s=64",
      "cl": "316145@main",
      "clUrl": "https://commits.webkit.org/316145@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317824\nrdar://179516708\n\nReviewed by Wenson Hsieh and Abrar Rahman Protyasha.\n\nIn Safari, if the option to automatically hide the toolbar in fullscreen\nis enabled, the top obscured content inset becomes zero while the toolbar\nis hidden.\n\nIn WebPage::sidesRequiringFixedContainerEdges(), we skip the top edge\nif the top obscured content inset is zero. This means that, if a user\nis in fullscreen with the toolbar hidden, navigates to a website with\na fixed top header, scrolls down, and then reveals the toolbar, the\nscroll pocket color will not match the header.\n\nTo fix this, we add an aditional case where we add the top edge:\nwhen the window is in fullscreen, and the toolbar overlay height\nis greater than zero.\n\nTested by new `ObscuredContentInsets` API tests\n`ScrollPocketCoversFullScreenTitlebarAfterReload`\nand `ScrollPocketCoversFullScreenTitlebarAfterMovingIntoFullScreenWindow`.\n\n* Source/WebKit/Shared/WebPageCreationParameters.h:\n* Source/WebKit/Shared/WebPageCreationParameters.serialization.in:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::creationParameters):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/mac/WebPageProxyMac.mm:\n(WebKit::WebPageProxy::setWindowIsInNativeFullScreen):\n(WebKit::WebPageProxy::setFullScreenTitlebarOverlayIsRevealed):\n* Source/WebKit/UIProcess/mac/WebViewImpl.h:\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(-[WKWindowVisibilityObserver startObserving:]):\n(-[WKWindowVisibilityObserver _windowDidEnterFullScreen:]):\n(-[WKWindowVisibilityObserver _windowDidExitFullScreen:]):\n(WebKit::WebViewImpl::windowDidEnterOrExitFullScreen):\n(WebKit::WebViewImpl::viewDidMoveToWindow):\n(WebKit::WebViewImpl::setFullScreenTitlebarOverlayHeight):\n(-[WKWindowVisibilityObserver _windowDidEnterOrExitFullScreen:]): Deleted.\n* Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm:\n(WebKit::WebPage::sidesRequiringFixedContainerEdges const):\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.messages.in:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ObscuredContentInsets.mm:\n(TestWebKitAPI::TEST(ObscuredContentInsets, ScrollPocketCoversFullScreenTitlebar)):\n(TestWebKitAPI::createFullScreenCapableWindow):\n(TestWebKitAPI::TEST(ObscuredContentInsets, ScrollPocketCoversFullScreenTitlebarAfterReload)):\n(TestWebKitAPI::TEST(ObscuredContentInsets, ScrollPocketCoversFullScreenTitlebarAfterMovingIntoFullScreenWindow)):\n\nCanonical link: https://commits.webkit.org/316145@main",
      "email": "lily_spiniolas@apple.com",
      "hash": "5c93ade672f8cebd902fc2e07d4656f7a4db0d00",
      "subject": "[macOS] Scroll pocket color may be lost in fullscreen after refresh"
    },
    "316146@main": {
      "author": "Jean-Yves Avenard",
      "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64",
      "cl": "316146@main",
      "clUrl": "https://commits.webkit.org/316146@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317681\nrdar://180439090\n\nReviewed by Jer Noble.\n\nMediaSourcePrivate now owns a single gap policy consulted at every\nbuffered-range boundary. Three tolerances replace the prior fixed\ntimeFudgeFactor:\n\n- Start-of-stream allowance: 1s. Per MSE 2 §presentation-start-time:\n\"implementations MAY choose to allow a current playback position at\nor after presentation start time and before the first TimeRanges to\nplay the first TimeRanges if that TimeRanges starts within a\nreasonably short time, like 1 second, after presentation start time\".\nApplied only when time is before ranges.start(0). HTMLMediaElement.\nbuffered reported to JS is unchanged.\n\n- Mid-stream gap tolerance: 125 ms. Default tolerance for gaps between\nbuffered sub-ranges.\n\n- Audio-covered gap tolerance: 250 ms. Widened tolerance when an active\naudio track covers the gap position (typical video-only gap with\naudio continuous through it).\n\nsetTimeFudgeFactor IPC and MediaSource::currentTimeFudgeFactor removed.\n\n* LayoutTests/media/media-source/media-source-fudge-factor-expected.txt: Removed.\n* LayoutTests/media/media-source/media-source-fudge-factor.html: Removed.\n* LayoutTests/media/media-source/media-source-gap-policy-expected.txt: Added.\n* LayoutTests/media/media-source/media-source-gap-policy.html: Added.\n* LayoutTests/media/media-source/media-source-video-renders.html:\n* Source/WebCore/Modules/mediasource/MediaSource.cpp:\n(WebCore::MediaSource::setPrivateAndOpen):\n(WebCore::MediaSource::currentTimeFudgeFactor): Deleted.\n* Source/WebCore/Modules/mediasource/MediaSource.h:\n* Source/WebCore/platform/graphics/MediaSourcePrivate.cpp:\n(WebCore::MediaSourcePrivate::hasFutureTime const):\n(WebCore::MediaSourcePrivate::hasBufferedTime const):\n(WebCore::MediaSourcePrivate::hasCurrentTime const):\n(WebCore::MediaSourcePrivate::isBuffered const):\n(WebCore::MediaSourcePrivate::cancelPendingWaitForTarget):\n(WebCore::MediaSourcePrivate::updateBufferedRanges):\n(WebCore::MediaSourcePrivate::nextStallTime const):\n(WebCore::MediaSourcePrivate::gapToleranceAtTime const): returns the applicable tolerance for time,\nconsulted by hasFutureTime, hasBufferedTime, isBuffered, nextStallTime,\ncanCompleteWaitForTarget, and TrackBuffer's enqueue gap check.\n(WebCore::MediaSourcePrivate::isWithinStartGapAllowance const):\n* Source/WebCore/platform/graphics/MediaSourcePrivate.h:\n* Source/WebCore/platform/graphics/PlatformTimeRanges.cpp:\n(WebCore::PlatformTimeRanges::containWithEpsilon const): overload so\nthat isBuffered can apply a per-position tolerance at each gap.\n* Source/WebCore/platform/graphics/PlatformTimeRanges.h:\n* Source/WebCore/platform/graphics/SourceBufferPrivate.cpp:\n(WebCore::SourceBufferPrivate::reenqueueMediaForTime):\n(WebCore::SourceBufferPrivate::addTrackBuffer):\n(WebCore::SourceBufferPrivate::isAudioBufferedAt const):\n(WebCore::SourceBufferPrivate::audioBufferedRanges const):\n* Source/WebCore/platform/graphics/SourceBufferPrivate.h:\n(WebCore::SourceBufferPrivate::timeFudgeFactor const): Deleted.\n* Source/WebCore/platform/graphics/TrackBuffer.cpp:\n(WebCore::TrackBuffer::create):\n(WebCore::TrackBuffer::TrackBuffer):\n(WebCore::TrackBuffer::isAcceptableEnqueueGap const):\n(WebCore::TrackBuffer::nextSample):\n(WebCore::TrackBuffer::reenqueueMediaForTime):\n* Source/WebCore/platform/graphics/TrackBuffer.h:\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:\n(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::resetStallForTime): Move nextStallTime(time)\nlogic to MediaSourcePrivate.\n* Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:\n* Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:\n(WebCore::SourceBufferPrivateAVFObjC::timeFudgeFactor const): Deleted.\n* Source/WebCore/platform/graphics/cocoa/MediaPlayerPrivateWebM.mm:\n(WebCore::MediaPlayerPrivateWebM::reenqueueMediaForTime):\n(WebCore::MediaPlayerPrivateWebM::addTrackBuffer):\n(WebCore::MediaPlayerPrivateWebM::monitorReadyState):\n* Source/WebKit/GPUProcess/media/RemoteMediaSourceProxy.cpp:\n(WebKit::RemoteMediaSourceProxy::setTimeFudgeFactor): Deleted.\n* Source/WebKit/GPUProcess/media/RemoteMediaSourceProxy.h:\n* Source/WebKit/GPUProcess/media/RemoteMediaSourceProxy.messages.in:\n* Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp:\n(WebKit::MediaPlayerPrivateRemote::currentTimeWithLockHeld const):\n* Source/WebKit/WebProcess/GPU/media/MediaSourcePrivateRemote.cpp:\n(WebKit::MediaSourcePrivateRemote::setTimeFudgeFactor): Deleted.\n* Source/WebKit/WebProcess/GPU/media/MediaSourcePrivateRemote.h:\n\nCanonical link: https://commits.webkit.org/316146@main",
      "email": "jya@apple.com",
      "hash": "a828526141568b22502568378e54a53f77fe85ef",
      "subject": "[MSE] Loosen gap tolerance during playback and seek"
    },
    "316147@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "316147@main",
      "clUrl": "https://commits.webkit.org/316147@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318045\n\nReviewed by Antti Koivisto.\n\nFollow-up to 318020, which swept the size-only callers of borderBoxRect() but\nnot the frameRect().size() spelling of the same thing. These RenderTableCell\npaint helpers only want the border box size, and frameRect().size() is exactly\nborderBoxSize() (both are m_frameRect.size()), so use the direct accessor. No\nbehavior change.\n\n* Source/WebCore/rendering/RenderTableCell.cpp:\n(RenderTableCell::paintCollapsedBorders):\n(RenderTableCell::paintBoxDecorations):\n(RenderTableCell::paintMask):\n\nCanonical link: https://commits.webkit.org/316147@main",
      "email": "zalan@apple.com",
      "hash": "b590f9134b0ac936876ee26bcc7204a25f5bb19f",
      "subject": "[cleanup] Use RenderBox::borderBoxSize() in size-only callers of frameRect()"
    },
    "316148@main": {
      "author": "Justin Michaud",
      "avatar": "https://www.gravatar.com/avatar/36e0433ee725a08f7e1122a6bc584b57?d=identicon\u0026s=64",
      "cl": "316148@main",
      "clUrl": "https://commits.webkit.org/316148@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314417\n\nReviewed by Keith Miller.\n\nThis is useful for cases when you need to cache something that can't\ncreated statically.\n\nWe also add a generated test to gently exercise this new code.\n\nWe also add a new safe iterator mechanism to ensure that this new API\ncan't be used unsafely.\n\n* Source/WTF/wtf/TinyLRUCache.h:\n(WTF::TinyLRUCache::~TinyLRUCache):\n(WTF::TinyLRUCache::TinyLRUCache):\n(WTF::TinyLRUCache::operator=):\n(WTF::TinyLRUCache::FindResult::~FindResult):\n(WTF::TinyLRUCache::FindResult::operator bool const):\n(WTF::TinyLRUCache::FindResult::operator* const):\n(WTF::TinyLRUCache::FindResult::operator-\u003e const):\n(WTF::TinyLRUCache::FindResult::FindResult):\n(WTF::TinyLRUCache::FindResult::assertValid const):\n(WTF::TinyLRUCache::get):\n(WTF::TinyLRUCache::findIfCached):\n(WTF::TinyLRUCache::insert):\n(WTF::TinyLRUCache::clear):\n(WTF::TinyLRUCache::size const):\n(WTF::TinyLRUCache::trackFindResult):\n(WTF::TinyLRUCache::invalidateIterators):\n(WTF::TinyLRUCache::findInternal):\n(WTF::TinyLRUCache::insertInternal):\n* Tools/TestWebKitAPI/CMakeLists.txt:\n* Tools/TestWebKitAPI/Tests/WTF/TinyLRUCache.cpp: Added.\n(TestWebKitAPI::CountingPolicy::createValueForKey):\n(TestWebKitAPI::TEST(WTF_TinyLRUCache, GetCachesOnHit)):\n(TestWebKitAPI::TEST(WTF_TinyLRUCache, GetEvictsLRU)):\n(TestWebKitAPI::NullKeyPolicy::isKeyNull):\n(TestWebKitAPI::NullKeyPolicy::createValueForNullKey):\n(TestWebKitAPI::NullKeyPolicy::createValueForKey):\n(TestWebKitAPI::TEST(WTF_TinyLRUCache, GetWithNullKeyReturnsNullValueAndDoesNotStore)):\n(TestWebKitAPI::TEST(WTF_TinyLRUCache, FindIfCachedReturnsNullOnMiss)):\n(TestWebKitAPI::TEST(WTF_TinyLRUCache, FindIfCachedHitsAfterInsert)):\n(TestWebKitAPI::TEST(WTF_TinyLRUCache, InsertEvictsLRU)):\n(TestWebKitAPI::TEST(WTF_TinyLRUCache, FindIfCachedPromotesToMRU)):\n(TestWebKitAPI::TEST(WTF_TinyLRUCache, ClearReleasesEntriesAndResetsSize)):\n(TestWebKitAPI::TrackedRefCounted::create):\n(TestWebKitAPI::TrackedRefCounted::value const):\n(TestWebKitAPI::TrackedRefCounted::~TrackedRefCounted):\n(TestWebKitAPI::TrackedRefCounted::TrackedRefCounted):\n(TestWebKitAPI::TEST(WTF_TinyLRUCache, ClearReleasesRefsImmediately)):\n(TestWebKitAPI::TEST(WTF_TinyLRUCache, EvictionViaInsertReleasesRef)):\n(TestWebKitAPI::TEST(WTF_TinyLRUCache, FindIfCachedDoesNotConsumeEntry)):\n(TestWebKitAPI::TEST(WTF_TinyLRUCache, FindIfCachedAfterClearMisses)):\n(TestWebKitAPI::TEST(WTF_TinyLRUCache, FindOrComputeWorkflow)):\n(TestWebKitAPI::TEST(WTF_TinyLRUCache, FindResultSafeAfterCacheDestroyed)):\n(TestWebKitAPI::TEST(WTF_TinyLRUCache, InsertInvalidatesFindResult)):\n(TestWebKitAPI::TEST(WTF_TinyLRUCache, ClearInvalidatesFindResult)):\n(TestWebKitAPI::TEST(WTF_TinyLRUCache, SubsequentFindInvalidatesPriorFindResult)):\n(TestWebKitAPI::TEST(WTF_TinyLRUCacheDeathTest, UseAfterInsertDeathTest)):\n(TestWebKitAPI::TEST(WTF_TinyLRUCacheDeathTest, UseAfterClearDeathTest)):\n(TestWebKitAPI::TEST(WTF_TinyLRUCacheDeathTest, UseAfterSubsequentFindDeathTest)):\n\nCanonical link: https://commits.webkit.org/316148@main",
      "email": "jmichaud@igalia.com",
      "hash": "9b4ffe1f77999658bdda22d8b76dee99fa6e5c7c",
      "subject": "Add findIfCached / insert to TinyLRUCache"
    },
    "316149@main": {
      "author": "Charlie Wolfe",
      "avatar": "https://www.gravatar.com/avatar/857b3b5ff3394c31fa2689310a93dbab?d=identicon\u0026s=64",
      "cl": "316149@main",
      "clUrl": "https://commits.webkit.org/316149@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312798\nrdar://174708437\n\nReviewed by Matthew Finkel.\n\nResourceLoadStatisticsUpdated, LogUserInteraction, and RequestStorageAccessUnderOpener accept\nWebContent-supplied data with no validation. A WCP can forge storageAccessUnderTopFrameDomains and\nisPrevalentResource in the ITP database, then obtain cross-origin cookie access without a user\nprompt.\n\nVerify that ResourceLoadStatisticsUpdated only contains fields the WebContent process legitimately\nobserves, and that LogUserInteraction and RequestStorageAccessUnderOpener are called with domains\nthe process owns.\n\nTest: ipc/forged-resource-load-statistics-storage-access.html\n\n* LayoutTests/ipc/forged-resource-load-statistics-storage-access-expected.txt: Added.\n* LayoutTests/ipc/forged-resource-load-statistics-storage-access.html: Added.\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:\n(WebKit::NetworkConnectionToWebProcess::logUserInteraction):\n(WebKit::resourceLoadStatisticsContainsOnlyObservableFields):\n(WebKit::NetworkConnectionToWebProcess::resourceLoadStatisticsUpdated):\n(WebKit::NetworkConnectionToWebProcess::requestStorageAccessUnderOpener):\n\nOriginally-landed-as: 305413.716@safari-7624-branch (9d8f969c538a). rdar://180428563\nCanonical link: https://commits.webkit.org/316149@main",
      "email": "charliew@apple.com",
      "hash": "5044a542fff2e6738265591c28b44eedf72c6bd8",
      "subject": "Validate several ITP and storage access IPC messages"
    },
    "316150@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316150@main",
      "clUrl": "https://commits.webkit.org/316150@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313618\nrdar://175673155\n\nReviewed by Ryosuke Niwa.\n\ncallPromisePairFunction stored the functor's EncodedJSValue and returned it\nafter passing the catch scope through rejectPromiseWithExceptionIfAny. When the\ngenerated operation body threw during IDL argument conversion, it returned\nencodedJSValue() (the empty JSValue sentinel) with a pending exception. The\nfirst rejectPromiseWithExceptionIfAny call cleared that exception to reject the\nfirst promise, so the second call was a no-op — leaving the second promise\nunrejected — and RETURN_IF_EXCEPTION did not fire. The empty sentinel was then\nreturned to JavaScript as a script-visible value.\n\nFix by:\n  - Introducing rejectPromisesWithExceptionIfAny, which saves the error value\n    before clearing the exception and rejects both promises. Shared\n    takeNonTerminationException helper factors out the check-save-clear logic\n    from rejectPromiseWithExceptionIfAny.\n  - Adding a DictionaryType template parameter to callPromisePairFunction. When\n    the functor returns an empty JSValue (the error-path sentinel),\n    callPromisePairFunction reconstructs a valid result dictionary from the\n    rejected promises via convertDictionaryToJS.\n  - Threading the concrete dictionary type (e.g. Navigation::Result) from the\n    code generator through callReturningPromisePair to callPromisePairFunction.\n\nTest: navigation-api/navigation-navigate-throwing-argument-conversion.html\n\n* LayoutTests/navigation-api/navigation-navigate-throwing-argument-conversion-expected.txt: Added.\n* LayoutTests/navigation-api/navigation-navigate-throwing-argument-conversion.html: Added.\n* Source/WebCore/bindings/js/JSDOMOperationReturningPromise.h:\n(WebCore::IDLOperationReturningPromise::callReturningPromisePair):\n* Source/WebCore/bindings/js/JSDOMPromiseDeferred.cpp:\n(WebCore::takeNonTerminationException):\n(WebCore::rejectPromiseWithExceptionIfAny):\n(WebCore::rejectPromisesWithExceptionIfAny):\n* Source/WebCore/bindings/js/JSDOMPromiseDeferred.h:\n(WebCore::callPromisePairFunction):\n* Source/WebCore/bindings/scripts/CodeGeneratorJS.pm:\n(GenerateOperationTrampolineDefinition):\n* Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp:\n(WebCore::JSC_DEFINE_HOST_FUNCTION):\n\nOriginally-landed-as: 305413.776@safari-7624-branch (332eff8c4870). rdar://180436895\nCanonical link: https://commits.webkit.org/316150@main",
      "email": "cdumez@apple.com",
      "hash": "6ea1f0a2bf517e6e086f8b9e28a6f52e003c07d0",
      "subject": "[WebCore][bindings] Empty JSValue returned to script from callPromisePairFunction when argument conversion throws"
    },
    "316151@main": {
      "author": "Said Abou-Hallawa",
      "avatar": "https://www.gravatar.com/avatar/ae80a929a378a055822829ae63903296?d=identicon\u0026s=64",
      "cl": "316151@main",
      "clUrl": "https://commits.webkit.org/316151@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314326\nrdar://175670940\n\nReviewed by Simon Fraser.\n\nBetween the call to `updateLayoutIgnorePendingStylesheets()` and the call to\n`SVGGeometryElement::getTotalLength()`, `SVGGeometryElement::getPointAtLength()`\ncaches its renderer() in a raw pointer. The problem is `getTotalLength()` also\ncalls `updateLayoutIgnorePendingStylesheets()` which may delete the renderer.\nThis will make `getPointAtLength()` use-after-free the cached raw pointer renderer.\n\nRearrange the code such that `updateLayoutIgnorePendingStylesheets()` is called\nonly once per `getPointAtLength()` and read `this-\u003erenderer()` exactly before it\nis referenced.\n\n* Source/WebCore/svg/SVGGeometryElement.cpp:\n(WebCore::SVGGeometryElement::calculateTotalLength const):\n(WebCore::SVGGeometryElement::getTotalLength const):\n(WebCore::SVGGeometryElement::calculatePointAtLength const):\n(WebCore::SVGGeometryElement::getPointAtLength const):\n* Source/WebCore/svg/SVGGeometryElement.h:\n\nOriginally-landed-as: 305413.857@safari-7624-branch (d1e59347508c). rdar://180437982\nCanonical link: https://commits.webkit.org/316151@main",
      "email": "said@apple.com",
      "hash": "a93904b9771d104ee1230f7d2ce6e1024b030657",
      "subject": "Use-after-free in SVGGeometryElement::getPointAtLength — raw renderer pointer held across nested updateLayout"
    },
    "316152@main": {
      "author": "Shu-yu Guo",
      "avatar": "https://www.gravatar.com/avatar/3884544eb9e557e2ec917d32c6e12720?d=identicon\u0026s=64",
      "cl": "316152@main",
      "clUrl": "https://commits.webkit.org/316152@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314438\nrdar://176445615\n\nReviewed by Yusuke Suzuki.\n\nWhile the spec currently technically allows for defining private fields and\nmethods on WasmGC objects, this is against the spirit of those objects being\nfixed-layout.\n\nFor compat, both V8 and SpiderMonkey also disallow addition of private names on\nWasmGC objects.\n\nTest: JSTests/wasm/gc/private-fields-and-methods.js\n\n* JSTests/wasm/gc/private-fields-and-methods.js: Added.\n(testPrivateMethodOnStruct.B):\n(testPrivateMethodOnStruct.D.prototype.m):\n(testPrivateMethodOnStruct.D):\n(testPrivateMethodOnStruct):\n(testPrivateFieldOnStruct.B):\n(testPrivateFieldOnStruct.D):\n(testPrivateFieldOnStruct):\n(testPrivateMethodOnArray.B):\n(testPrivateMethodOnArray.D.prototype.m):\n(testPrivateMethodOnArray.D):\n(testPrivateMethodOnArray):\n(testPrivateFieldOnArray.B):\n(testPrivateFieldOnArray.D):\n(testPrivateFieldOnArray):\n(testPrivateGetterOnStruct.B):\n(testPrivateGetterOnStruct.D.prototype.get x):\n(testPrivateGetterOnStruct.D):\n(testPrivateGetterOnStruct):\n(testGCSurvival.B):\n(testGCSurvival.D.prototype.m):\n(testGCSurvival.D):\n(testGCSurvival):\n* Source/JavaScriptCore/runtime/JSObjectInlines.h:\n(JSC::JSObject::getPrivateField):\n(JSC::JSObject::setPrivateField):\n(JSC::JSObject::definePrivateField):\n(JSC::JSObject::setPrivateBrand):\n\nOriginally-landed-as: 305413.881@safari-7624-branch (525600a227a6). rdar://180438063\nCanonical link: https://commits.webkit.org/316152@main",
      "email": "syg@apple.com",
      "hash": "736ce62a5254f322562cf1ee8f4e12c98a913029",
      "subject": "[JSC] Disallow defining private names on WasmGC objects"
    },
    "316153@main": {
      "author": "Said Abou-Hallawa",
      "avatar": "https://www.gravatar.com/avatar/ae80a929a378a055822829ae63903296?d=identicon\u0026s=64",
      "cl": "316153@main",
      "clUrl": "https://commits.webkit.org/316153@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314345\nrdar://175674593\n\nReviewed by Simon Fraser.\n\n`FEGaussianBlurSoftwareApplier::apply()` creates uninitialized `tempBuffer`\nthrough `createScratchPixelBuffer()`.\n\n-- If the stdDeviation of feGaussianBlur is asymmetric, e.g. \"5 0\", then applying\n   this filter falls back to `boxBlurUnaccelerated()`.\n-- If the input of feGaussianBlur isAlphaImage, e.g. feColorMatrix(luminanceToAlpha),\n   then `boxBlur()` short-circuits to `boxBlurAlphaOnly()`, which writes only\n   the alpha channel of each pixel.\n-- If one of the stdDeviation is zero, e.g. \"5 0\", `boxBlurUnaccelerated()` will\n   copy the `tempBuffer` to the `destinationPixelBuffer` with three uninitialized\n   channels before it returns.\n\nIf isAlphaImage is true Make sure `tempBuffer` is zero-filled.\n\n* Source/WebCore/platform/graphics/filters/software/FEGaussianBlurSoftwareApplier.cpp:\n(WebCore::FEGaussianBlurSoftwareApplier::boxBlurGeneric):\n\nOriginally-landed-as: 305413.858@safari-7624-branch (96b0a368415e). rdar://180437556\nCanonical link: https://commits.webkit.org/316153@main",
      "email": "said@apple.com",
      "hash": "d3cffddf149e0bcfbf135ddd233c66cf0caf4f97",
      "subject": "Uninitialized result of FEGaussianBlur if the input isAlphaImage"
    },
    "316154@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "316154@main",
      "clUrl": "https://commits.webkit.org/316154@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318227\nrdar://181029069\n\nReviewed by Lily Spiniolas.\n\nIn this patch, we let Xcode sort the entries in this project file after\nthe addition of AttributedStringFontCache.mm in 316044@main.\n\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/316154@main",
      "email": "a_protyasha@apple.com",
      "hash": "8e5b8549ead676b61521dafa9a2dc1d159d38dd5",
      "subject": "Sort TestWebKitAPI pbxproj file after 316044@main"
    },
    "316155@main": {
      "author": "Kimmo Kinnunen",
      "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64",
      "cl": "316155@main",
      "clUrl": "https://commits.webkit.org/316155@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312566\nrdar://174740214\n\nReviewed by Dan Glastonbury.\n\nFilter out pixelStorei parameters.\n\n* Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.cpp:\n(WebCore::GraphicsContextGLANGLE::pixelStorei):\n\nOriginally-landed-as: 305413.710@safari-7624-branch (dd484347691b). rdar://180435316\nCanonical link: https://commits.webkit.org/316155@main",
      "email": "kkinnunen@apple.com",
      "hash": "ce030f744b02e378e10393b0edc00ef7c54df5cf",
      "subject": "WebGL: GraphicsContextGLANGLE PACK_* state is modifiable through pixelStorei"
    },
    "316156@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316156@main",
      "clUrl": "https://commits.webkit.org/316156@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318073\nrdar://180871490\n\nReviewed by Antti Koivisto.\n\nThis patch aligns WebKit with Gecko / Firefox and Blink / Chromium.\n\ncomputeStyleForPseudoElementStyle() set the text fill color from\nusedStrokeColor() — a copy/paste from the strokeColor line below it. As a\nresult, marked text styled via a highlight pseudo-element (::highlight(),\n::target-text, ::spelling-error, ::grammar-error) rendered its glyph fill\nusing the stroke color rather than the text/fill color, and ignored any\napplied color filter.\n\nSet fillColor from visitedDependentTextFillColorApplyingColorFilter(),\nmatching how the fill color is resolved in TextPaintStyle.cpp.\n\nTests: fast/css/highlight-pseudo-fill-applies-color-filter.html\n       imported/w3c/web-platform-tests/css/css-pseudo/highlight-fill-color-ignores-stroke-color-ref.html\n       imported/w3c/web-platform-tests/css/css-pseudo/highlight-fill-color-ignores-stroke-color.html\n\n* LayoutTests/fast/css/highlight-pseudo-fill-applies-color-filter-expected.html: Added.\n* LayoutTests/fast/css/highlight-pseudo-fill-applies-color-filter.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo/highlight-fill-color-ignores-stroke-color-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo/highlight-fill-color-ignores-stroke-color-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo/highlight-fill-color-ignores-stroke-color.html: Added.\n* Source/WebCore/rendering/StyledMarkedText.cpp:\n(WebCore::computeStyleForPseudoElementStyle):\n\nCanonical link: https://commits.webkit.org/316156@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "8bdea3050d839cea58c0c51722b524572780fd01",
      "subject": "Marked-text highlight pseudo-element fill color is taken from the stroke color"
    },
    "316157@main": {
      "author": "Anand Srinivasan",
      "avatar": "https://www.gravatar.com/avatar/84643a20c269974c2df6681742daf0a4?d=identicon\u0026s=64",
      "cl": "316157@main",
      "clUrl": "https://commits.webkit.org/316157@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314589\nrdar://176137052\n\nReviewed by Yusuke Suzuki.\n\nPatterns with many sequential non-greedy quantified parenthesized groups\n(e.g. (?:a){0,2}? repeated thousands of times) cause O(N^2) code emission\nin saveParenContext/restoreParenContext, as each group saves/restores all\nframe slots for the entire pattern. This patch adds a code size limit in\nVM options above which the code bails out to the interpreter.\n\nTest: JSTests/stress/regexp-many-non-greedy-paren-groups.js\n\n* JSTests/stress/regexp-many-non-greedy-paren-groups.js: Added.\n(testLargeNonGreedyParens):\n* Source/JavaScriptCore/runtime/OptionsList.h:\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n(JSC::Yarr::dumpCompileFailure):\n* Source/JavaScriptCore/yarr/YarrJIT.h:\n\nOriginally-landed-as: 305413.923@safari-7624-branch (e6d449d59b50). rdar://180427748\nCanonical link: https://commits.webkit.org/316157@main",
      "email": "anand_srinivasan@apple.com",
      "hash": "0012e6118d87c33aaae3c342375566b32762093c",
      "subject": "Add size limit to Yarr generated code"
    },
    "316158@main": {
      "author": "Ling Ho",
      "avatar": "https://www.gravatar.com/avatar/a317955e944b0846697e4a9c8cd28b65?d=identicon\u0026s=64",
      "cl": "316158@main",
      "clUrl": "https://commits.webkit.org/316158@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318161\nrdar://180319278\n\nReviewed by Alexey Proskuryakov.\n\nConstruct the autocomplete suggestion menu with createElement and\nbehavior.\n\n* Websites/bugs.webkit.org/committers-autocomplete.js:\n(updateMenu.appendSpan):\n(updateMenu):\n\nCanonical link: https://commits.webkit.org/316158@main",
      "email": "lingho@apple.com",
      "hash": "3ab3db0b0feca78b2895ab53af90b90e46e44f21",
      "subject": "DOM XSS in committers-autocomplete.js"
    },
    "316159@main": {
      "author": "Said Abou-Hallawa",
      "avatar": "https://www.gravatar.com/avatar/ae80a929a378a055822829ae63903296?d=identicon\u0026s=64",
      "cl": "316159@main",
      "clUrl": "https://commits.webkit.org/316159@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312945\nrdar://174640273\n\nReviewed by Kimmo Kinnunen.\n\nRemoteImageBuffer fails to GetPixelBuffer if the destination colorSpace is non-RGB\nmodel (e.g. kCGColorSpaceGenericCMYK). In this case the PixelBuffer is allocated\nbut never be initialized. So stale heap can be exposed to callers.\n\nTo fix this an IPC validator is needed to ensure the colorSpace is indeed RGB model.\nAnd to handle other possible unknown failures, the destination PixelBuffer will\nbe zero-filled if vImage fails to do the conversion the colorSpace conversion.\n\n* Source/WebCore/platform/graphics/DestinationColorSpace.cpp:\n(WebCore::DestinationColorSpace::usesRGBColorModel const):\n* Source/WebCore/platform/graphics/DestinationColorSpace.h:\n* Source/WebCore/platform/graphics/PixelBufferConversion.cpp:\n(WebCore::convertImagePixelsAccelerated):\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Tools/TestWebKitAPI/Tests/WebCore/ImageBufferTests.cpp:\n(TestWebKitAPI::TEST(ImageBufferTests, GetPixelBufferAllZeros)):\n\nOriginally-landed-as: 305413.874@safari-7624-branch (8e2784fd0807). rdar://180429216\n* Source/WebKit/Shared/WebCoreArgumentCodersPlatform.serialization.in:\n\nCanonical link: https://commits.webkit.org/316159@main",
      "email": "said@apple.com",
      "hash": "0f857107ffab578c2c25cb74afd5c68e22fc3a33",
      "subject": "GetPixelBuffer should zeroFill the destination if any error happens"
    },
    "316160@main": {
      "author": "Roberto Rodriguez",
      "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64",
      "cl": "316160@main",
      "clUrl": "https://commits.webkit.org/316160@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317730\nrdar://180530658\n\nReviewed by Anne van Kesteren.\n\nLowercase each CSP directive name as soon as it is read, aligning with the 'Parse a serialized CSP'\nsection of the CSP Level 3 spec (https://w3c.github.io/webappsec-csp/#parse-serialized-policy).\nThe case insensitive name comparisons become plain equality checks, and the extra lowercasing in the\nreporting path is removed. When an author writes a directive name in some casing other than the spec's\nlowercase form, it now behaves like the lowercase form.\n\nTest: http/tests/security/contentSecurityPolicy/directive-name-case-insensitive.html\n      http/tests/security/contentSecurityPolicy/directive-name-case-insensitive-strict-dynamic.html\n\n* LayoutTests/http/tests/security/contentSecurityPolicy/directive-name-case-insensitive-expected.txt: Added.\n* LayoutTests/http/tests/security/contentSecurityPolicy/directive-name-case-insensitive-strict-dynamic-expected.txt: Added.\n* LayoutTests/http/tests/security/contentSecurityPolicy/directive-name-case-insensitive-strict-dynamic.html: Added.\n* LayoutTests/http/tests/security/contentSecurityPolicy/directive-name-case-insensitive.html: Added.\n* Source/WebCore/page/csp/ContentSecurityPolicy.cpp:\n(WebCore::ContentSecurityPolicy::reportViolation const):\n* Source/WebCore/page/csp/ContentSecurityPolicyDirectiveList.cpp:\n(WebCore::ContentSecurityPolicyDirectiveList::parse):\n(WebCore::ContentSecurityPolicyDirectiveList::parseDirective):\n(WebCore::ContentSecurityPolicyDirectiveList::addDirective):\n* Source/WebCore/page/csp/ContentSecurityPolicySourceList.cpp:\n(WebCore::ContentSecurityPolicySourceList::isProtocolAllowedByStar const):\n\nCanonical link: https://commits.webkit.org/316160@main",
      "email": "roberto_rodriguez2@apple.com",
      "hash": "00534948835e357313fb11e13bda0e58486df5fc",
      "subject": "Lowercase CSP directive names eagerly"
    },
    "316161@main": {
      "author": "Basuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/5192a1151c7575317affb7a4633f8d63?d=identicon\u0026s=64",
      "cl": "316161@main",
      "clUrl": "https://commits.webkit.org/316161@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317458\nrdar://180077264\n\nReviewed by Sihui Liu.\n\nUnder UseUIProcessForBackForwardItemLoading, WebPageProxy::dispatchPerFrameTraversals\nwalks the (current, target) BF frame trees and dispatches a per-frame\nGoToBackForwardItem whenever itemSequenceNumber differs. When the target entry\nholds the stale \"initial about:blank\" state for an iframe whose live document has\nsince loaded a real URL, the walk dispatches a navigation back to about:blank and\nregresses the live iframe.\n\nThe HTML spec (https://html.spec.whatwg.org/#initialise-the-document-object)\nrequires the iframe's initial about:blank entry to be replaced by the iframe's\nfirst real navigation, but WebKit's BF list does not propagate that replacement\nto non-current entries. The legacy navigatedFrameID-heuristic routing path\nmasked the issue by never dispatching a per-frame iframe traversal in the first\nplace; the walk-as-replacement (https://bugs.webkit.org/show_bug.cgi?id=317090)\nexposes it because it compares each frame's state pair-wise.\n\nReproduction is the imported WPT\nimported/w3c/web-platform-tests/html/browsers/browsing-the-web/history-traversal/history-traversal-navigate-parent-while-child-loading.html\nwhich performs a parent pushState() while an iframe is mid-initial-navigation,\nthen asserts on history.back() that the iframe URL is preserved. Without the\nfix, the iframe regresses:\n\n  FAIL pushState() in parent while child is doing initial navigation, then go back\n  assert_equals: expected \"http://web-platform.test:8800/common/blank.html\" but got \"about:blank\"\n\nThis regression surfaces only when UseUIProcessForBackForwardItemLoading is\nenabled under SiteIsolationEnabled, the configuration that PR #67459\n(https://bugs.webkit.org/show_bug.cgi?id=316588) re-enables in the test harness.\n\nFix: introduce a walk-side guard isStaleInitialAboutBlankIframeTarget that skips\ndispatching a per-frame traversal into a non-main child frame's stale initial\nabout:blank entry. The stale entry is identified by an authoritative\nisInitialAboutBlank flag, not a URL-string match. The flag rides the existing\nHistoryItem -\u003e FrameState pipeline (mirroring wasCreatedByJSWithoutUserInteraction):\nHistoryController::initializeItem sets it from DocumentLoader::isInitialAboutBlank(),\nwhich is true only for the frame's initial empty document; toFrameState /\napplyFrameState round-trip it through SessionState serialization. Because an\nintentional iframe.src=\"about:blank\" navigation happens after\ncommittedFirstRealDocumentLoad() its DocumentLoader is not the initial empty\ndocument, so its flag is false and the walk dispatches the traversal as a real\nnavigation. The earlier URL-string heuristic (toURL is empty or \"about:blank\")\ncould not distinguish the initial empty document from an intentional about:blank\nload and so would have wrongly skipped the latter; the flag closes that gap.\n\nA spec-level fix would be to propagate the initial about:blank replacement to\nolder BF entries when an iframe completes its first real navigation; that is a\nseparate follow-up bug and is not attempted here because it touches\nBackForwardClient / HistoryController across processes and is out of scope for\nthis regression.\n\nThe imported WPT\nimported/w3c/web-platform-tests/html/browsers/browsing-the-web/history-traversal/history-traversal-navigate-parent-while-child-loading.html\ncovers the behavior but shares the upstream baseline across configurations, so\nit cannot pin SiteIsolationEnabled / UseUIProcessForBackForwardItemLoading via a\nwebkit-test-runner header and only exercises this fix once the test harness\nauto-couples the flags (bug 316588). Add a http/wpt/site-isolation copy that\npins both flags in its header, so the regression is covered on this PR\nindependently of 316588. Verified negatively: the copy fails (iframe regresses\nto about:blank) without this fix and passes with it.\n\nAdd an API test that covers the gap the flag closes, which the WPT above does\nnot: a child frame that navigates intentionally to about:blank after its first\nreal load, then back. With the old URL-string heuristic the back traversal into\nthat intentional about:blank entry was wrongly skipped and the child was\nstranded on the prior real URL; with the isInitialAboutBlank flag it is\ndispatched. Verified negatively: the test fails at the go-back assertion with\nthe old heuristic and passes with the flag.\n\n* LayoutTests/http/wpt/site-isolation/history-traversal/history-traversal-navigate-parent-while-child-loading.html: Added.\n* LayoutTests/http/wpt/site-isolation/history-traversal/history-traversal-navigate-parent-while-child-loading-expected.txt: Added.\n* Source/WebCore/history/HistoryItem.h:\n(WebCore::HistoryItem::setIsInitialAboutBlank):\n(WebCore::HistoryItem::isInitialAboutBlank const):\n* Source/WebCore/loader/HistoryController.cpp:\n(WebCore::HistoryController::initializeItem):\n* Source/WebKit/Shared/SessionState.cpp:\n(WebKit::FrameState::FrameState):\n(WebKit::FrameState::copy):\n(WebKit::FrameState::replacePayloadFrom):\n* Source/WebKit/Shared/SessionState.h:\n* Source/WebKit/Shared/SessionState.serialization.in:\n* Source/WebKit/WebProcess/WebCoreSupport/SessionStateConversion.cpp:\n(WebKit::toFrameState):\n(WebKit::applyFrameState):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::isStaleInitialAboutBlankIframeTarget):\n(WebKit::WebPageProxy::dispatchPerFrameTraversals):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::TEST):\n\nCanonical link: https://commits.webkit.org/316161@main",
      "email": "basuke@apple.com",
      "hash": "e23afe633acbe60a383dea12b39e33856b074239",
      "subject": "[Site Isolation] Per-frame back/forward walk regresses iframe to stale initial about:blank"
    },
    "316162@main": {
      "author": "Issac Roy",
      "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64",
      "cl": "316162@main",
      "clUrl": "https://commits.webkit.org/316162@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=294566\nrdar://153547585\n\nReviewed by Sam Sneddon.\n\nWhen --print-expectations is passed a path that matches no tests, _collect_tests\nreturns empty sets and aggregate_tests is empty. The call to max() over an empty\ngenerator then raises ValueError. Guard against this by skipping to the next\ndriver iteration when no tests are found, matching the behavior of run() which\nalso short-circuits on an empty test set.\n\n* Tools/Scripts/webkitpy/layout_tests/controllers/manager.py:\n(Manager.print_expectations): Guard against ValueError when no tests are found.\n* Tools/Scripts/webkitpy/layout_tests/controllers/manager_unittest.py:\n(test_print_expectations_no_tests_found): Added test for the case when no tests\nare found.\n\nCanonical link: https://commits.webkit.org/316162@main",
      "email": "issacroy05@gmail.com",
      "hash": "e081edf2cd1304ad8c7b521f4def4ee87508e9ad",
      "subject": "[Scripts] --print-expectations fails when no tests match"
    },
    "316163@main": {
      "author": "Marcus Plutowski",
      "avatar": "https://www.gravatar.com/avatar/0dc4fa1c337348e333de44505752edb8?d=identicon\u0026s=64",
      "cl": "316163@main",
      "clUrl": "https://commits.webkit.org/316163@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318170\nrdar://165772439\n\nReviewed by Yusuke Suzuki and Dan Hecht.\n\nThis was disabled (or rather, soft-mode was enabled) for the benefit of\ninternal development stability, a need which has since passed.\n\nThis patch removes the soft-mode entitlments and thus re-enables MTE\nhard-mode for all processes.\n\n* Source/WebKit/Scripts/process-entitlements.sh: remove soft-mode entitlments\n\nCanonical link: https://commits.webkit.org/316163@main",
      "email": "marcus_plutowski@apple.com",
      "hash": "8d85f545cea5c8741fd893cbfb172a92e647c5a7",
      "subject": "Re-enable MTE hard-mode"
    },
    "316164@main": {
      "author": "Kai Tamkun",
      "avatar": "https://www.gravatar.com/avatar/dff073cba21885df4d9f73ed3cc493c2?d=identicon\u0026s=64",
      "cl": "316164@main",
      "clUrl": "https://commits.webkit.org/316164@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312405\nrdar://174630697\n\nReviewed by Yusuke Suzuki.\n\nAdds usage of GCSafeConcurrentJSLocker in three repatch methods.\nThis avoids a data race.\n\nTest: JSTests/stress/regress-174630697.js\n\n* JSTests/stress/regress-174630697.js: Added.\n* Source/JavaScriptCore/bytecode/Repatch.cpp:\n(JSC::repatchGetBySlowPathCall):\n(JSC::repatchPutBySlowPathCall):\n(JSC::repatchInBySlowPathCall):\n\nOriginally-landed-as: 305413.703@safari-7624-branch (bb9e30e27a73). rdar://180436444\nCanonical link: https://commits.webkit.org/316164@main",
      "email": "k_tamkun@apple.com",
      "hash": "140ce5b5c1ce2e8a74af55850e65a948f43a24be",
      "subject": "[JSC] Missing codeBlock-\u003em_lock in repatchGetBySlowPathCall"
    },
    "316165@main": {
      "author": "Alex Christensen",
      "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64",
      "cl": "316165@main",
      "clUrl": "https://commits.webkit.org/316165@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318234\nrdar://181037054\n\nReviewed by Richard Robinson.\n\nThis is the first in a 2-step process to remove WKJSScriptingBuffer.\nI got some API review feedback that WKJSScriptingBuffer is an odd wrapper\naround NSData so why not just use NSData directly?  This change will\nallow Safari to switch from WKJSScriptingBuffer to NSData without breaking\nbinary or source compatibility.  The next change will change the parameter\nfrom id to NSData.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/JSBuffer.mm\n\n* Source/WebKit/UIProcess/API/Cocoa/WKUserContentController.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKUserContentController.mm:\n(-[WKUserContentController addBuffer:name:contentWorld:]):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/JSBuffer.mm:\n(TEST(JSBuffer, Data)):\n\nCanonical link: https://commits.webkit.org/316165@main",
      "email": "achristensen@apple.com",
      "hash": "7deaf9ddf361672fb0b5183b85c57fe0b16df3db",
      "subject": "Prepare to replace WKJSScriptingBuffer with NSData"
    },
    "316166@main": {
      "author": "Rupin Mittal",
      "avatar": "https://www.gravatar.com/avatar/3e3de9845931d2dc844afb00056ec94e?d=identicon\u0026s=64",
      "cl": "316166@main",
      "clUrl": "https://commits.webkit.org/316166@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314149\nrdar://175677292\n\nReviewed by Brady Eidson and Per Arne Vollan.\n\nNetworkConnectionToWebProcess::registerInternalFileBlobURL() takes in a a file\npath called replacementPath and a SandboxExtensionHandle. If the web process\nsends an empty handle, then the only validation done on replacementPath is\nisFilePathAllowed(), which may be too permissive. Later on, the web process could\nsend the IPC NetworkConnectionToWebProcess::unregisterBlobURL() with a null\ntopOrigin, which kicks off this chain: BlobData destroyed, BlobDataFileReference\ndestroyed, FileSystem::deleteFile(m_replacementPath) which deleted the file at\nthe replacementPath that was passed in.\n\nThis may allow the web process to delete a file that it shouldn't be able to.\n\nTo prevent this, we add a message check which confirms that if the web process\nwould like to use the file at the replacementPath it specifies, it must have\na sandbox extension allowing it to do so. Otherwise, the web process will be\nterminated.\n\nWe also add a fixme comment to note that in the future, we should look into\nensuring that the web process does not send file paths to the network process\nat all.\n\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:\n(WebKit::NetworkConnectionToWebProcess::registerInternalFileBlobURL):\n\nOriginally-landed-as: 305413.843@safari-7624-branch (32b29db38205). rdar://180437008\nCanonical link: https://commits.webkit.org/316166@main",
      "email": "rupin@apple.com",
      "hash": "a18c0a8d15801b652cd1db8724d3d07e129f14bd",
      "subject": "Unvalidated replacementPath in NetworkConnectionToWebProcess::registerInternalFileBlobURL() could lead to wrongful file deletion"
    },
    "316167@main": {
      "author": "Rupin Mittal",
      "avatar": "https://www.gravatar.com/avatar/3e3de9845931d2dc844afb00056ec94e?d=identicon\u0026s=64",
      "cl": "316167@main",
      "clUrl": "https://commits.webkit.org/316167@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313496\nrdar://174708224\n\nReviewed by Charlie Wolfe and Sihui Liu.\n\nA web process could send an IPC message containing a cross-site origin and\nloadPing() would then send the request to the cross-site origin which would\nrespond with its cookies.\n\nTo prevent this, add a MESSAGE_CHECK in loadPing() which will check if the\nweb process has first party cookie access to the origin in the request and\nterminate the web process if not.\n\nNew layout test confirms that we hit the message check:\nloadping-firstpartyforcookies-message-check.html\n\n* LayoutTests/ipc/coreipc.js:\n(export.ArgumentSerializer):\n* LayoutTests/ipc/loadping-firstpartyforcookies-message-check-expected.txt: Added.\n* LayoutTests/ipc/loadping-firstpartyforcookies-message-check.html: Added.\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:\n(WebKit::NetworkConnectionToWebProcess::loadPing):\n\nOriginally-landed-as: 305413.799@safari-7624-branch (fd5906672902). rdar://180435156\nCanonical link: https://commits.webkit.org/316167@main",
      "email": "rupin@apple.com",
      "hash": "6aa96bce5d11350a8e088781eede139a860d8bb6",
      "subject": "Missing allowsFirstPartyForCookies check in loadPing() IPC may lead to cross-origin cookie access"
    },
    "316168@main": {
      "author": "Andy Estes",
      "avatar": "https://www.gravatar.com/avatar/643f10f01b26fd94d03482a2013b2ea0?d=identicon\u0026s=64",
      "cl": "316168@main",
      "clUrl": "https://commits.webkit.org/316168@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318166\nrdar://178555755\n\nReviewed by Jer Noble.\n\nRemoved support for AVMediaSource from MediaDeviceRoute and simplified the code now that an\nAVPlaybackControl-conforming object is the only observee.\n\nNo new tests. Covered by existing tests.\n\n* Source/WebCore/platform/audio/ios/MediaDeviceRoute.h:\n(WebCore::MediaDeviceRouteClient::errorDidChange):\n(WebCore::MediaDeviceRouteClient::playbackPositionDidChange):\n(WebCore::MediaDeviceRouteClient::playbackErrorDidChange): Deleted.\n(WebCore::MediaDeviceRouteClient::currentPlaybackPositionDidChange): Deleted.\n* Source/WebCore/platform/audio/ios/MediaDeviceRoute.mm:\n(-[WebPlaybackControlObserver setPlaybackControl:]):\n(-[WebPlaybackControlObserver observeValueForKeyPath:ofObject:change:context:]):\n(-[WebPlaybackControlObserver dealloc]):\n(WebCore::convert):\n(WebCore::MediaDeviceRoute::setPlaybackPosition):\n(-[WebMediaSourceObserver initWithRoute:]): Deleted.\n(-[WebMediaSourceObserver mediaSource]): Deleted.\n(-[WebMediaSourceObserver setMediaSource:]): Deleted.\n(-[WebMediaSourceObserver playbackControl]): Deleted.\n(-[WebMediaSourceObserver setPlaybackControl:]): Deleted.\n(-[WebMediaSourceObserver observeValueForKeyPath:ofObject:change:context:]): Deleted.\n(-[WebMediaSourceObserver dealloc]): Deleted.\n(WebCore::MediaDeviceRoute::playbackError const): Deleted.\n(WebCore::MediaDeviceRoute::currentPlaybackPosition const): Deleted.\n(WebCore::MediaDeviceRoute::setCurrentPlaybackPosition): Deleted.\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.cpp:\n(WebCore::MediaPlayerPrivateWirelessPlayback::seekToTarget):\n(WebCore::MediaPlayerPrivateWirelessPlayback::errorDidChange):\n(WebCore::MediaPlayerPrivateWirelessPlayback::playbackPositionDidChange):\n(WebCore::MediaPlayerPrivateWirelessPlayback::ensureTimebase):\n(WebCore::MediaPlayerPrivateWirelessPlayback::playbackErrorDidChange): Deleted.\n(WebCore::MediaPlayerPrivateWirelessPlayback::currentPlaybackPositionDidChange): Deleted.\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.h:\n\nCanonical link: https://commits.webkit.org/316168@main",
      "email": "aestes@apple.com",
      "hash": "20202846a16f7e7b51ed01f4fad523d23ac72ae4",
      "subject": "[iOS] Remove support for AVMediaSource from MediaDeviceRoute"
    },
    "316169@main": {
      "author": "Antti Koivisto",
      "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64",
      "cl": "316169@main",
      "clUrl": "https://commits.webkit.org/316169@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318212\nrdar://181014309\n\nReviewed by Alan Baradlay and Sam Weinig.\n\nhttps://drafts.csswg.org/css-mixins-1/#evaluate-a-custom-function\n\n    3. Add a custom property to argument rule with a name of the parameter’s name, and a value\n       of first-valid(arg value, default value).\n\nThis patch implements first-valid() internally for @function use but does not yet expose\nit externally.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/dashed-function-cycles-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/dashed-function-eval-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-attr-expected.txt:\n\n* Source/WebCore/style/StyleBuilder.cpp:\n(WebCore::Style::Builder::applyCustomPropertyFromCallingContext):\n\nA parameter shadows inherited custom properties; other properties are inherited lazily from\nthe calling context.\n\n(WebCore::Style::Builder::applyCustomPropertyImpl):\n\nIn a function context an invalid value resolves to guaranteed-invalid, not unset.\n\n(WebCore::Style::Builder::resolveCustomPropertyValue):\n\nPass the registration so first-valid() can validate candidates against the target syntax.\n\n* Source/WebCore/style/StyleBuilder.h:\n* Source/WebCore/style/StyleSubstitutionResolver.cpp:\n(WebCore::Style::SubstitutionResolver::substituteFirstValid):\n\nSubstitute to the first candidate valid for the target syntax, else guaranteed-invalid.\n\n(WebCore::Style::SubstitutionResolver::resolveAndRegisterDashedFunctionArguments):\n\nBuild each parameter value as first-valid(arg, default). A missing positional argument for a\nparameter without a default makes the invocation guaranteed-invalid.\n\n(WebCore::Style::SubstitutionResolver::substituteDashedFunction):\n\nLeave a failed argument substitution guaranteed-invalid rather than aborting the function.\n\n* Source/WebCore/style/StyleSubstitutionResolver.h:\n\nCanonical link: https://commits.webkit.org/316169@main",
      "email": "antti@apple.com",
      "hash": "6c94926886b44e8b5d50d95ba23c2cce00a32c16",
      "subject": "[css-mixins-1] Implement argument parsing in terms of first-valid()"
    },
    "316170@main": {
      "author": "Ling Ho",
      "avatar": "https://www.gravatar.com/avatar/a317955e944b0846697e4a9c8cd28b65?d=identicon\u0026s=64",
      "cl": "316170@main",
      "clUrl": "https://commits.webkit.org/316170@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317709\nrdar://180318956\n\nReviewed by Stephanie Lewis.\n\nEscape matched text in Commits extension link generation\n\n_replace_reference interpolated matched comment text into an \u003ca\u003e tag\nwithout HTML-encoding it. Because bug_format_comment regexes run before\nhtml_quote in Bugzilla::Template::quoteUrls and their return values are\nreinserted after escaping, that text reached the page unescaped (core\navoids this by calling html_quote itself).\n\nFix: run both captured groups through Bugzilla::Util::html_quote before\ninterpolation (primary fix), and narrow the two \\S+ matchers to the\nlegal commit-identifier charset [A-Za-z0-9._/-]+ as defense in depth.\n\n* Websites/bugs.webkit.org/extensions/Commits/Extension.pm:\n(bug_format_comment):\n(_replace_reference):\n\nCanonical link: https://commits.webkit.org/316170@main",
      "email": "lingho@apple.com",
      "hash": "f9eddcaf98287f34656c442729d52b77fe28b714",
      "subject": "Stored XSS on bugs.webkit.org in Commits extension; fix guidance (escape captured groups; optionally tighten \\S+)"
    },
    "316171@main": {
      "author": "Devin Rousso",
      "avatar": "https://www.gravatar.com/avatar/c9e757d973342c773f107a94b70cb9cd?d=identicon\u0026s=64",
      "cl": "316171@main",
      "clUrl": "https://commits.webkit.org/316171@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=235859\n\u003crdar://problem/88527162\u003e\n\nReviewed by Yusuke Suzuki.\n\nUnlike private fields that live as own-properties, private methods/accessors instead live in the class lexical scope behind a private brand.\n\nIn order for Web Inspector to display them, they have to be gathered from the class scope of the object's class (and ancestor superclasses).\n\n* Source/JavaScriptCore/inspector/InjectedScriptSource.js:\n(let.InjectedScript.prototype._forEachPropertyDescriptor):\n* Source/JavaScriptCore/inspector/JSInjectedScriptHost.h:\n* Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp:\n(Inspector::JSInjectedScriptHost::getOwnPrivatePropertyMethods): Added.\n* Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp:\n(Inspector::JSInjectedScriptHostPrototype::finishCreation):\n(Inspector::jsInjectedScriptHostPrototypeFunctionGetOwnPrivatePropertyMethods): Added.\n\n* LayoutTests/inspector/runtime/getProperties-expected.txt:\n* LayoutTests/inspector/runtime/getDisplayableProperties-expected.txt:\n\nCanonical link: https://commits.webkit.org/316171@main",
      "email": "hi@devinrousso.com",
      "hash": "4b7a49ae210b8b428eef19e382d8246568a13f33",
      "subject": "Web Inspector: Support ES2022 Private Methods"
    },
    "316172@main": {
      "author": "Simon Lewis",
      "avatar": "https://www.gravatar.com/avatar/f354c01a964923e67771a097d7d2f084?d=identicon\u0026s=64",
      "cl": "316172@main",
      "clUrl": "https://commits.webkit.org/316172@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317767\nrdar://180539641\n\nReviewed by Richard Robinson.\n\nThis change also addresses SaferCPP issues for CoreIPCSecTrust\nwhen moving the defines.\n\nCovered by existing tests.\n* Source/WTF/wtf/PlatformHave.h:\n* Source/WebKit/Shared/cf/CoreIPCSecTrust.mm:\n(WebKit::updatePolicyVector):\n(WebKit::CoreIPCSecTrust::CoreIPCSecTrust):\n\nCanonical link: https://commits.webkit.org/316172@main",
      "email": "simon.lewis@apple.com",
      "hash": "508bfb240c52c8817dac7a8bd717c8cfa0a65eec",
      "subject": "Migrate CoreIPC defines from WebKitAdditions"
    },
    "316173@main": {
      "author": "Ruthvik Konda",
      "avatar": "https://www.gravatar.com/avatar/bca33cefcce93017251a8fbc1204cdc4?d=identicon\u0026s=64",
      "cl": "316173@main",
      "clUrl": "https://commits.webkit.org/316173@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318135\nrdar://180954475\n\nReviewed by Mike Wyrzykowski.\n\n`RefPtr\u003cT\u003e` has constructors that take `WeakPtr\u003cT\u003e` and `ThreadSafeWeakPtr\u003cT\u003e`\ndirectly (RefPtr.h:104, 106), calling `.get()` internally. Removing redundant\n`.get()` calls at thirteen sites in `WebModelPlayer` simplifies the code\nwithout changing behavior, since the constructor invokes `.get()` itself.\n\nNo new tests needed (no behavioral change).\n\n* Source/WebKit/WebProcess/Model/WebModelPlayer.mm:\n(WebKit::ModelDisplayBufferDisplayDelegate::display):\n(WebKit::WebModelPlayer::WebModelPlayer):\n(WebKit::WebModelPlayer::load):\n(WebKit::WebModelPlayer::notifyEntityTransformUpdated):\n(WebKit::WebModelPlayer::sizeDidChange):\n(WebKit::WebModelPlayer::snapshotCurrentFrame):\n(WebKit::WebModelPlayer::scheduleUpdateIfNeeded):\n(WebKit::WebModelPlayer::scheduleDisplayUpdate):\n(WebKit::WebModelPlayer::setEnvironmentMap):\n(WebKit::WebModelPlayer::visibilityStateDidChange):\n(WebKit::WebModelPlayer::updateScreenHeadroomFromPage):\n\nCanonical link: https://commits.webkit.org/316173@main",
      "email": "rkonda2@apple.com",
      "hash": "88e4fef2d2777c3f1313007b6d1c169fdb8198b1",
      "subject": "Reduce use of `.get()` for smart pointers in WebModelPlayer"
    },
    "316174@main": {
      "author": "Rob Buis",
      "avatar": "https://www.gravatar.com/avatar/74fb5af173895d2a7814b0aed1238a39?d=identicon\u0026s=64",
      "cl": "316174@main",
      "clUrl": "https://commits.webkit.org/316174@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318224\n\nReviewed by Nikolas Zimmermann.\n\nFix some failures in imported/w3c/web-platform-tests/svg/styling by copying the\nHTMLStyleElement code that handles dynamic changes of type and media attributes.\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/styling/attr-style-media-dynamic-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/styling/attr-style-type-dynamic-expected.txt:\n* Source/WebCore/svg/SVGStyleElement.cpp:\n(WebCore::SVGStyleElement::attributeChanged):\n\nCanonical link: https://commits.webkit.org/316174@main",
      "email": "rbuis@igalia.com",
      "hash": "ae0d90b965a8ae1d40a6c2ad9d1bfdad66dffed8",
      "subject": "Fix some failures in imported/w3c/web-platform-tests/svg/styling"
    },
    "316175@main": {
      "author": "Anthony Tarbinian",
      "avatar": "https://www.gravatar.com/avatar/e2fb942081a29714985c48f402fa1788?d=identicon\u0026s=64",
      "cl": "316175@main",
      "clUrl": "https://commits.webkit.org/316175@main",
      "description": "with audio-thread kernel reallocation\nrdar://174652790\nhttps://bugs.webkit.org/show_bug.cgi?id=312796\n\nReviewed by Chris Dumez.\n\nBiquadFilterNode::setType() runs on the main thread from JS bindings and calls\nBiquadProcessor::setType(), which in turn calls AudioDSPKernelProcessor::reset()\nto iterate m_kernels and virtual-call reset() on each kernel. This was done\nwithout holding the context's graphLock().\n\nConcurrently, every render quantum the audio thread runs\nAudioBasicProcessorNode::checkNumberOfChannelsForInput() under graphLock() and,\nwhen the input channel count has changed, calls uninitialize() / initialize()\non the processor, which clear()s and move-assigns m_kernels.\n\nWith the lock held only on one side, the main thread could load a kernel pointer\nfrom a Vector slot that is being/already freed, leading to a use-after-free virtual\ndispatch into a destroyed BiquadDSPKernel and writes through stale Biquad\nbuffer spans, or a null deref if the slot was already zeroed.\n\nFix by taking context().graphLock() in BiquadFilterNode::setType(), matching the\nexisting convention in WaveShaperNode::setOversampleForBindings() and\nAudioNode::setChannelCount().\n\nTest: webaudio/biquadfilternode-set-type-channel-count-race.html\n* LayoutTests/webaudio/biquadfilternode-set-type-channel-count-race-expected.txt: Added.\n* LayoutTests/webaudio/biquadfilternode-set-type-channel-count-race.html: Added.\n* Source/WebCore/Modules/webaudio/BiquadFilterNode.cpp:\n(WebCore::BiquadFilterNode::setType):\n\nOriginally-landed-as: 305413.717@safari-7624-branch (41efaeddddf2). rdar://180436998\nCanonical link: https://commits.webkit.org/316175@main",
      "email": "atar137h@gmail.com",
      "hash": "2f91fd7d2ec69d1ca85edef694626ee9cebac8f1",
      "subject": "[WebCore] Take graphLock() in BiquadFilterNode::setType() to avoid race"
    },
    "316177@main": {
      "author": "Ling Ho",
      "avatar": "https://www.gravatar.com/avatar/a317955e944b0846697e4a9c8cd28b65?d=identicon\u0026s=64",
      "cl": "316177@main",
      "clUrl": "https://commits.webkit.org/316177@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317806\nrdar://180321002\n\nReviewed by Stephanie Lewis.\n\nWhen rendering binary image diffs in the legacy SVN format, PrettyPatch\ninterpolated the image URL into the generated markup without escaping it,\nunlike the equivalent handling elsewhere. Escape the value before it is\nemitted so untrusted content cannot affect the surrounding HTML.\n\n* Websites/bugs.webkit.org/PrettyPatch/PrettyPatch.rb:\n\nCanonical link: https://commits.webkit.org/316177@main",
      "email": "lingho@apple.com",
      "hash": "9bb8fdfc34571f35695a3510d84fac8bebde1ecf",
      "subject": "PrettyPatch should HTML-escape image URLs when rendering binary image diffs"
    },
    "316178@main": {
      "author": "Samuel Engida",
      "avatar": "https://www.gravatar.com/avatar/c20e63346226d2b574502a26843ccd10?d=identicon\u0026s=64",
      "cl": "316178@main",
      "clUrl": "https://commits.webkit.org/316178@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317956\nrdar://180738811\n\nReviewed by Elliott Williams.\n\nThis adds the missing macOS 26 case so the lookup\nresolves correctly:\n\n  - SYSTEM_VERSION_MAJOR_SHORT_MACOS_260000 = 26\n  - macOS 26 maps to system version prefix 21\n\n* Configurations/Version.xcconfig:\n\nCanonical link: https://commits.webkit.org/316178@main",
      "email": "sa_engida@apple.com",
      "hash": "d7eb859e77ec20de2fb76043835de0b924ed22f0",
      "subject": "Add system version prefix mapping for macOS 26"
    },
    "316179@main": {
      "author": "Anthony Tarbinian",
      "avatar": "https://www.gravatar.com/avatar/ef46154a1a21c6a5ef593e952ebc62f4?d=identicon\u0026s=64",
      "cl": "316179@main",
      "clUrl": "https://commits.webkit.org/316179@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312480\nrdar://174651594\n\nReviewed by Geoffrey Garen.\n\nIn media artwork image loading, it is possible for a\ncallback lambda to outlive the lifetime of the\nMediaMetadata which it captures with a raw \"this\".\n\nThis callback is stored in ArtworkImageLoader::m_callback\nand ArtworkImageLoader is owned by MediaMetadata.\n\nThe lambda captures a raw this to MediaMetadata during\nMediaMetadata::tryNextArtworkImage.\n\nHowever, it's possible for the lambda to outlive ArtworkImageLoader\nand, in turn, MediaMetadata after beeing std::exchanged outside\nof the artwork loader in ArtworkImageLoader::notifyFinished.\nThen, it's possible for MediaMetadata to be destroyed while\nthe lambda has a dangling \"this\" pointer to the destroyed object.\n\nThis patch changes the lambda to capture a WeakPtr\nto \"this\" (MediaMetadata) and returns early if it has\nbeen destroyed. If weakThis is still alive, we keep it alive for the\nduration of the lambda body with a RefPtr.\n\n* LayoutTests/fast/mediasession/metadata/artwork-image-loader-callback-crash-expected.txt: Added.\n* LayoutTests/fast/mediasession/metadata/artwork-image-loader-callback-crash.html: Added.\n* Source/WebCore/Modules/mediasession/MediaMetadata.cpp:\n(WebCore::MediaMetadata::tryNextArtworkImage):\n\tChanged the artwork loader lambda to capture a WeakPtr\n\tto \"this\" and early return if weakThis is null.\n\tThe rest of the lambda explicitly uses weakThis where needed.\n* Source/WebCore/Modules/mediasession/MediaMetadata.h:\n\tChanged MediaMetadata to inherit from CanMakeWeakPtr.\n\nOriginally-landed-as: 305413.695@safari-7624-branch (9da5185f2406). rdar://180437956\nCanonical link: https://commits.webkit.org/316179@main",
      "email": "a_tarbinian@apple.com",
      "hash": "d6fb60c4fa7912ac11adc9b79f6de7aac952d967",
      "subject": "[WebCore] Capture WeakPtr to this (MediaMetadata) in ArtworkImageLoader callback"
    },
    "316180@main": {
      "author": "Said Abou-Hallawa",
      "avatar": "https://www.gravatar.com/avatar/ae80a929a378a055822829ae63903296?d=identicon\u0026s=64",
      "cl": "316180@main",
      "clUrl": "https://commits.webkit.org/316180@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318238\nrdar://181042189\n\nReviewed by Richard Robinson.\n\nIn 312893@main and 296430@main, ImageFrame was changed to include more than one\nNativeImage. Managing the decodedSize has to be adjusted to take this into account.\nWe should consider removing one or more NativeImages from ImageFrame.\n\nIn BitmapImageSource::cacheNativeImageAtIndex() one or more NativeImage are removed.\nBut only one NativeImage is added.\n\nRemoving the NativeImages is done first by `destroyNativeImageAtIndex()`. The size\nof the removed NativeImages is decremented correctly from decodedSize.\n\nAdding the new NativeImage is done second. The whole size of the `ImageFrame` is\nadded to the decodedSize which this is wrong. And this is the cause of this\nassertion. The size of the added NativeImage should be added only to decodedSize.\n\n* Source/WebCore/platform/graphics/BitmapImageSource.cpp:\n(WebCore::BitmapImageSource::cacheNativeImageAtIndex):\n\nCanonical link: https://commits.webkit.org/316180@main",
      "email": "said@apple.com",
      "hash": "bf0c7c6154c617cd29731d5f3a05d3918ec8efa2",
      "subject": "REGRESSION(312893@main): ASSERT(m_decodedSize \u003e= decodedSize) in BitmapImageSource::decodedSizeReset()"
    },
    "316181@main": {
      "author": "Antti Koivisto",
      "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64",
      "cl": "316181@main",
      "clUrl": "https://commits.webkit.org/316181@main",
      "description": "rdar://177479772\n\nReviewed by Ryosuke Niwa.\n\nDraining the custom element reaction stack in startElementNs runs the\nconstructor synchronously, which can re-parent newElement, adopt it into\nanother document, or detach the current parser node. parserAppendChild\nrequires its argument to have no parent and to share our document, so\nfalling through into it leaves the tree linked into two child lists.\n\nRe-check those invariants after the reaction stack drains and stop\nparsing if any of them no longer holds. A spec-aligned follow-up should\nroute XML element creation through constructElementWithFallback like\nHTMLDocumentParser does, which post-validates and falls back to\nHTMLUnknownElement; a FIXME records that.\n\nTest: fast/custom-elements/xml-parser-reparent-during-construction-crash.xhtml\n* LayoutTests/fast/custom-elements/xml-parser-reparent-during-construction-crash-expected.txt: Added.\n* LayoutTests/fast/custom-elements/xml-parser-reparent-during-construction-crash.xhtml: Added.\n* Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp:\n(WebCore::XMLDocumentParser::startElementNs):\n\nOriginally-landed-as: 305413.947@safari-7624-branch (19beaaec03d0). rdar://180436996\nCanonical link: https://commits.webkit.org/316181@main",
      "email": "antti@apple.com",
      "hash": "ba3be26a064abdfdcc87698f202ff0be33452663",
      "subject": "[WebCore] use-after-free in Style::TreeResolver — XMLDocumentParser::startElementNs missing parentNode re-check after custom-element upgrade"
    },
    "316182@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "316182@main",
      "clUrl": "https://commits.webkit.org/316182@main",
      "description": "rdar://174079512\n\nReviewed by Wenson Hsieh.\n\nThe pdfOpenWithPreview IPC response sanitizes the WCP supplied filename\nwhile it is still percent encoded. Then, pathToPDFOnDisk percent decodes\nthe assembled path. As such, a %2F (`/`) sequence can pass through\nsanitization but still decodes to `/` after assembly.\n\nThis means that a compromised web content process could write to a PDF\nfile outside of the temporary WebKit PDF directory with a properly\ncrafted IPC message.\n\nIn this patch, we address this asymmetry by percent decoding the\nfilename before sanitization. We also remove the percent decoding that\nhappens post joining. Instead, we enforce an invariant that rejects any\nsanitized filename that is not its own last path component.\n\nTests: TestWebKitAPI.WebKit.OpenPDFWithPreviewIPCTraversalEncodedFilename\n       TestWebKitAPI.WebKit.OpenPDFWithPreviewIPCTraversalUnencodedFilename\n\n* Source/WebKit/UIProcess/mac/WebPageProxyMac.mm:\n(WebKit::pathToPDFOnDisk):\n(WebKit::WebPageProxy::savePDFToTemporaryFolderAndOpenWithNativeApplication):\n* Tools/TestWebKitAPI/Tests/WebKitCocoa/UIDelegate.mm:\n(-[OpenPDFWithPreviewDelegate _webView:shouldAllowPDFAtURL:toOpenFromFrame:completionHandler:]):\n((WebKit, OpenPDFWithPreviewIPCTraversalEncodedFilename)):\n((WebKit, OpenPDFWithPreviewIPCTraversalUnencodedFilename)):\n\nOriginally-landed-as: 305413.948@safari-7624-branch (06ccfa7d7a2d). rdar://180438093\nCanonical link: https://commits.webkit.org/316182@main",
      "email": "a_protyasha@apple.com",
      "hash": "b12f122d84409745fa49aa45e2776aa59fdda5aa",
      "subject": "Compromised web content processes can use percent-encoded path separators in PDF suggested filenames to write outside temporary directory"
    },
    "316183@main": {
      "author": "Kai Tamkun",
      "avatar": "https://www.gravatar.com/avatar/dff073cba21885df4d9f73ed3cc493c2?d=identicon\u0026s=64",
      "cl": "316183@main",
      "clUrl": "https://commits.webkit.org/316183@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313490\nrdar://175674067\n\nReviewed by Yusuke Suzuki.\n\nDelays an ensureStillAliveHere call until after a GC-capable function invocation.\n\nTest: JSTests/stress/array-indexof-ensure-still-alive.js\n\n* JSTests/stress/array-indexof-ensure-still-alive.js: Added.\n(opt):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileArrayIndexOfOrArrayIncludes):\n\nOriginally-landed-as: 305413.767@safari-7624-branch (db99db96e504). rdar://180437023\nCanonical link: https://commits.webkit.org/316183@main",
      "email": "k_tamkun@apple.com",
      "hash": "a2de66fe98291779d77a15d831083e51ab664b53",
      "subject": "[JSC][FTL] compileArrayIndexOfOrArrayIncludes (UntypedUse + Array::Contiguous): ensureStillAliveHere(base) placed before GC-capable vmCall"
    },
    "316184@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "316184@main",
      "clUrl": "https://commits.webkit.org/316184@main",
      "description": "rdar://176025005\n\nReviewed by Eric Carlson.\n\nWe store constraints in the callback by value instead of reference to make sure that the constraints are valid if the callback is called asynchronously.\n\nTest: fast/mediastream/applyConstraints-with-takePhoto.html\n\n* LayoutTests/fast/mediastream/applyConstraints-with-takePhoto-expected.txt: Added.\n* LayoutTests/fast/mediastream/applyConstraints-with-takePhoto.html: Added.\n* Source/WebKit/GPUProcess/webrtc/UserMediaCaptureManagerProxy.cpp:\n\nOriginally-landed-as: 305413.816@safari-7624-branch (207238632262). rdar://180436666\nCanonical link: https://commits.webkit.org/316184@main",
      "email": "youenn@apple.com",
      "hash": "54b8e49ebf3396dbcea92fcbbcec2a0233264291",
      "subject": "Heap UaF in GPU Process via MediaStreamTrack.clone() + ImageCapture.takePhoto() + applyConstraints()"
    },
    "316185@main": {
      "author": "Kai Tamkun",
      "avatar": "https://www.gravatar.com/avatar/dff073cba21885df4d9f73ed3cc493c2?d=identicon\u0026s=64",
      "cl": "316185@main",
      "clUrl": "https://commits.webkit.org/316185@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312487\nrdar://172210517\n\nReviewed by Keith Miller.\n\nCorrectly sets HasNonConfigurableProperties and related bits during Structure construction\nif the IndexingType has an array storage shape.\n\nTest: JSTests/stress/slowputarraystorage-stale-structure-bit.js\n\n* JSTests/stress/slowputarraystorage-stale-structure-bit.js: Added.\n(get k):\n(get configurable):\n(set t):\n(catch):\n* Source/JavaScriptCore/runtime/Structure.cpp:\n(JSC::Structure::Structure):\n\nOriginally-landed-as: 305413.704@safari-7624-branch (dacb07e7c6bd). rdar://180427686\nCanonical link: https://commits.webkit.org/316185@main",
      "email": "k_tamkun@apple.com",
      "hash": "336c35e2c17c5f8c619d9a136dc8465cdba55e95",
      "subject": "[JSC] Stale structure bit in SlowPutArrayStorage"
    },
    "316186@main": {
      "author": "Dawn Morningstar",
      "avatar": "https://www.gravatar.com/avatar/9b791f3f02553608941e76bb5eecd471?d=identicon\u0026s=64",
      "cl": "316186@main",
      "clUrl": "https://commits.webkit.org/316186@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318259\nrdar://181053851\n\nUnreviewed test gardening.\n\n* LayoutTests/platform/ios/TestExpectations:\n\nCanonical link: https://commits.webkit.org/316186@main",
      "email": "morningstar@apple.com",
      "hash": "e540a45a4fa5f397f287874ffaeea0ee9aaefa6f",
      "subject": "[ Gardening ] Mark expectations for layout-tests that have been filed"
    },
    "316187@main": {
      "author": "Basuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/5192a1151c7575317affb7a4633f8d63?d=identicon\u0026s=64",
      "cl": "316187@main",
      "clUrl": "https://commits.webkit.org/316187@main",
      "description": "rdar://174708348\n\nReviewed by Ryosuke Niwa.\n\nThe shouldRestrictHTTPResponseAccess field in NetworkResourceLoadParameters\nwas sent from WebContent process to NetworkProcess via IPC with no validation.\nA compromised WebContent process could set it to false to bypass response\nheader sanitization (Set-Cookie stripping, cross-origin header filtering).\n\nThe field was originally introduced in 2018 as a runtime-configurable flag\n(RestrictedHTTPResponseAccess preference) to allow WK1 to opt out of\nsanitization. After WK1 was removed, the preference was hardcoded to true\n(288687@main), but the IPC parameter was never cleaned up.\n\nSince shouldPerformSecurityChecks() unconditionally returns true, this field\nalways carried the value true from a legitimate WebContent process. Remove\nit entirely and make sanitization unconditional on the NetworkProcess side.\n\nNo new tests (hardening, no behavior change for legitimate WebContent process).\n\n* Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.h:\n* Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.serialization.in:\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:\n(WebKit::NetworkResourceLoader::sanitizeResponseIfPossible):\n* Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp:\n(WebKit::WebLoaderStrategy::scheduleLoadFromNetworkProcess):\n(WebKit::WebLoaderStrategy::loadResourceSynchronously):\n(WebKit::WebLoaderStrategy::startPingLoad):\n(WebKit::WebLoaderStrategy::preconnectTo):\n\nOriginally-landed-as: 305413.689@safari-7624-branch (1db91ab9400c). rdar://180428250\nCanonical link: https://commits.webkit.org/316187@main",
      "email": "basuke@apple.com",
      "hash": "c5fabb4129dc9dcba8ebba81189a118d2997a0ab",
      "subject": "Remove shouldRestrictHTTPResponseAccess from NetworkResourceLoadParameters"
    },
    "316188@main": {
      "author": "Eric Carlson",
      "avatar": "https://www.gravatar.com/avatar/e227ff07cc6d645fc1c69fd56c2c8cb8?d=identicon\u0026s=64",
      "cl": "316188@main",
      "clUrl": "https://commits.webkit.org/316188@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314107\nrdar://175402146\n\nReviewed by Youenn Fablet and David Kilzer.\n\nWhen WebCodecs AudioEncoder receives consecutive AudioData frames whose PCM\nformat differs (e.g. f32-planar then s16) but whose sampleRate and\nnumberOfChannels are unchanged, encode() replaces the AudioSampleBufferConverter\nand calls finish() on the old one. The returned Ref\u003cGenericPromise\u003e was\ndropped, so nothing kept the encoder alive while the old converter's async\ndrain ran on its own serial queue. If the client then called close(), which\nkeeps the encoder alive for the new converter only, the old converter could\nfire its CMBufferQueueTrigger into a freed InternalAudioEncoderCocoa,\nproducing a heap use-after-free in compressedAudioOutputBufferCallback.\n\nApply the same whenSettled keep-alive that close() already uses, so the\nencoder stays alive on queueSingleton() until the old converter has finished\ndraining.\n\nTest: http/wpt/webcodecs/audio-encoder-pcm-format-change.html\n\n* LayoutTests/http/wpt/webcodecs/audio-encoder-pcm-format-change-expected.txt: Added.\n* LayoutTests/http/wpt/webcodecs/audio-encoder-pcm-format-change.html: Added.\n* Source/WebCore/platform/audio/cocoa/AudioEncoderCocoa.cpp:\n(WebCore::InternalAudioEncoderCocoa::encode):\n\nOriginally-landed-as: 305413.864@safari-7624-branch (8230e88bd918). rdar://180436545\nCanonical link: https://commits.webkit.org/316188@main",
      "email": "eric.carlson@apple.com",
      "hash": "b48b4d4d4034d4a207ba2e0d61570ecc051f30a4",
      "subject": "[WebCore] Use-after-free in InternalAudioEncoderCocoa on ASBD change because converter-\u003efinish() promise is discarded"
    },
    "316189@main": {
      "author": "Shu-yu Guo",
      "avatar": "https://www.gravatar.com/avatar/3884544eb9e557e2ec917d32c6e12720?d=identicon\u0026s=64",
      "cl": "316189@main",
      "clUrl": "https://commits.webkit.org/316189@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313265\nrdar://175520268\n\nReviewed by Yusuke Suzuki.\n\nStructures with CachedDictionaryKind can add new properties without\ntransitioning structures. Therefore, property absences are not cacheable. This\nPR fixes a bug in DFG which incorrectly caches property absences on structures\nwith CachedDictionaryKind.\n\nTest: JSTests/stress/dfg-ensure-absence-cached-dictionary-then.js\n\n* JSTests/stress/dfg-ensure-absence-cached-dictionary-then.js: Added.\n(createObject1):\n(createObject2):\n(opt):\n(main):\n* Source/JavaScriptCore/dfg/DFGGraph.cpp:\n(JSC::DFG::Graph::tryEnsureAbsence):\n* Source/JavaScriptCore/runtime/Structure.h:\n(JSC::Structure::propertyAccessesAreCacheableForAbsence):\n\nOriginally-landed-as: 305413.731@safari-7624-branch (343b8326d944). rdar://180437776\nCanonical link: https://commits.webkit.org/316189@main",
      "email": "syg@apple.com",
      "hash": "d75a9fda98e0e3033e8e7060fd341f0bf1c01d21",
      "subject": "[JSC] Do not cache property absence on dictionaries"
    },
    "316190@main": {
      "author": "Antti Koivisto",
      "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64",
      "cl": "316190@main",
      "clUrl": "https://commits.webkit.org/316190@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318225\nrdar://181027296\n\nReviewed by Tim Nguyen.\n\nAdd CSSCustomPropertySyntax serialization support and use it for @function serialization.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/at-function-cssom-expected.txt:\n* Source/WebCore/css/CSSFunctionRule.cpp:\n(WebCore::CSSFunctionRule::getParameters const):\n(WebCore::CSSFunctionRule::returnType const):\n(WebCore::CSSFunctionRule::cssText const):\n* Source/WebCore/css/parser/CSSCustomPropertySyntax.cpp:\n(WebCore::typeNameForType):\n(WebCore::serializeCustomPropertySyntax):\n(WebCore::serializeCustomPropertySyntaxAsCSSType):\n* Source/WebCore/css/parser/CSSCustomPropertySyntax.h:\n\nCanonical link: https://commits.webkit.org/316190@main",
      "email": "antti@apple.com",
      "hash": "a0291f16f65d6af683f9dc070d837206e8703bc5",
      "subject": "[css-mixins-1] Serialize types"
    },
    "316191@main": {
      "author": "Basuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/5192a1151c7575317affb7a4633f8d63?d=identicon\u0026s=64",
      "cl": "316191@main",
      "clUrl": "https://commits.webkit.org/316191@main",
      "description": "rdar://174708287\n\nReviewed by Per Arne Vollan (OOPS\\!).\n\nestablishSharedWorkerContextConnection accepts a WebContent-supplied Site with no\nMESSAGE_CHECK, allowing a compromised web process to hijack SharedWorker context\nconnections for arbitrary domains. This mirrors the fix applied to the ServiceWorker\nequivalent (establishSWContextConnection) in rdar://107063897.\n\nTwo changes:\n1. Add allowsFirstPartyForCookies validation with MESSAGE_CHECK_COMPLETION before\n   creating the context connection, matching the ServiceWorker pattern.\n2. In WebSharedWorkerServer::addContextConnection, skip contextConnectionCreated when\n   the domain already has a registered connection (replace debug-only ASSERT with\n   runtime guard).\n\nNo new tests. Covered by existing SharedWorker tests.\n\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:\n(WebKit::NetworkConnectionToWebProcess::establishSharedWorkerContextConnection):\n* Source/WebKit/NetworkProcess/SharedWorker/WebSharedWorkerServer.cpp:\n(WebKit::WebSharedWorkerServer::addContextConnection):\n\nOriginally-landed-as: 305413.712@safari-7624-branch (701d9d99f21d). rdar://180428538\nCanonical link: https://commits.webkit.org/316191@main",
      "email": "basuke@apple.com",
      "hash": "019c43fd5de39b7d45fc2c9bfa821802535f9009",
      "subject": "[SharedWorker] Add MESSAGE_CHECK to establishSharedWorkerContextConnection"
    },
    "316192@main": {
      "author": "Antti Koivisto",
      "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64",
      "cl": "316192@main",
      "clUrl": "https://commits.webkit.org/316192@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318260\nrdar://181055085\n\nReviewed by Tim Nguyen.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/at-function-cssom-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/cssom/variable-names-expected.txt:\n* Source/WebCore/css/StyleProperties.cpp:\n(WebCore::StyleProperties::asTextInternal const):\n\nUse serializeIdentifier.\n\nCanonical link: https://commits.webkit.org/316192@main",
      "email": "antti@apple.com",
      "hash": "95a70d5d80d3ce2c37ba7202d673b7a2574af819",
      "subject": "Custom property names in declaration blocks should be serialized escaped"
    },
    "316193@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316193@main",
      "clUrl": "https://commits.webkit.org/316193@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314862\nrdar://176914483\n\nReviewed by Alex Christensen.\n\nA compromised WebContent process can poison the Network Process persistent\ndisk cache for an arbitrary cross-origin partition.\n\nNetworkConnectionToWebProcess::useRedirectionForCurrentNavigation accepts a\nWebContent-supplied ResourceResponse with no validation and stashes it on the\nloader as m_redirectionForCurrentNavigation. When the loader's WillSendRequest\nasync reply later delivers a WebContent-supplied ResourceRequest,\nNetworkResourceLoader::continueWillSendRequest takes the\nm_redirectionForCurrentNavigation early-return into willSendRedirectedRequest\n*before* the setCachePartition(originalRequest().cachePartition()) restore,\nso NetworkCache::Cache::storeRedirect keys the on-disk record by the\nunvalidated WebContent-chosen {cachePartition, url} and persists the\nWebContent-supplied 301 with WebContent-chosen Location:.\n\nFix this by:\n  1. Hoisting the setCachePolicy/setCachePartition restore to the top of\n     continueWillSendRequest so every path through the function — including the\n     m_redirectionForCurrentNavigation, service-worker and m_shouldRestartLoad\n     early returns — uses the original (Network-Process-side) cache partition,\n     never the value round-tripped through the WebContent process.\n  2. Promoting the debug ASSERT(isMainFrameLoad()) and\n     ASSERT(response.isRedirection()) at the\n     NetworkConnectionToWebProcess::useRedirectionForCurrentNavigation IPC\n     entry point to MESSAGE_CHECKs. The legitimate sender\n     (WebPage::useRedirectionForCurrentNavigation, driven by\n     RedirectSOAuthorizationSession in the UI process) only ever targets the\n     main-frame main-resource loader with a redirection response; anything else\n     is a compromised WebContent process.\n\nTest: ipc/use-redirection-for-current-navigation-message-check.html\n\n* LayoutTests/ipc/use-redirection-for-current-navigation-message-check-expected.txt: Added.\n* LayoutTests/ipc/use-redirection-for-current-navigation-message-check.html: Added.\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:\n(WebKit::NetworkConnectionToWebProcess::useRedirectionForCurrentNavigation):\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:\n(WebKit::NetworkResourceLoader::continueWillSendRequest):\n\nOriginally-landed-as: 305413.915@safari-7624-branch (a547e707161f). rdar://180438355\nCanonical link: https://commits.webkit.org/316193@main",
      "email": "cdumez@apple.com",
      "hash": "c312747ab66d89c767c51172ca1eab0b9de5d288",
      "subject": "[WebKit Networking] continueWillSendRequest m_redirectionForCurrentNavigation early-return reaches Cache::storeRedirect with unrestored cachePartition"
    },
    "316194@main": {
      "author": "Elliott Williams",
      "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64",
      "cl": "316194@main",
      "clUrl": "https://commits.webkit.org/316194@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318239\nrdar://181044227\n\nUnreviewed CI fix. The webkit-swift-interface patch no longer applies\ncleanly, blocking build perf testing.\n\n* Tools/Scripts/measure-build-time:\n\nCanonical link: https://commits.webkit.org/316194@main",
      "email": "emw@apple.com",
      "hash": "cfced00e156e52c60a90495f76959ed2752a4167",
      "subject": "[CI] Update measure-build-time swift patch"
    },
    "316195@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316195@main",
      "clUrl": "https://commits.webkit.org/316195@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312456\nrdar://174652399\n\nReviewed by Ryosuke Niwa.\n\nWebLockManager::MainThreadBridge::query() was taking in a CompletionHandler\nbut it may sometimes fail to call its completion handler. This happened\nwhen the worker thread is exiting, causing `ScriptExecutionContext::ensureOnContextThread()`\nto fail. Not calling the completion handler is bad but what's worse is that\nthe completion handler would end up getting destroyed on the main thread.\nThe completion handler was capturing a promise from the worker thread,\nwhich led to security bugs.\n\nTo address the issue:\n1. Have WebLockManager::MainThreadBridge::query() take in a Function\n   instead of a CompletionHandler given that it cannot always call\n   its callback.\n2. Have WebLockManager store the promise in a HashMap and only capture\n   a promise identifier in the MainThreadBridge::query() lambda instead\n   of the promise itself. This pattern was already used for other\n   promises in this class.\n\nTest: workers/weblock-manager-query-crash.html\n\n* LayoutTests/workers/weblock-manager-query-crash-expected.txt: Added.\n* LayoutTests/workers/weblock-manager-query-crash.html: Added.\n* Source/WebCore/Modules/web-locks/WebLockManager.cpp:\n(WebCore::WebLockManager::MainThreadBridge::abortLockRequest):\n(WebCore::WebLockManager::MainThreadBridge::query):\n(WebCore::WebLockManager::query):\n(WebCore::WebLockManager::clientIsGoingAway):\n* Source/WebCore/Modules/web-locks/WebLockManager.h:\n\nOriginally-landed-as: 305413.688@safari-7624-branch (0b964ced2532). rdar://180436136\nCanonical link: https://commits.webkit.org/316195@main",
      "email": "cdumez@apple.com",
      "hash": "7a5ee54cd51a6c3aa25ca7f40f440d8ec7dc43cb",
      "subject": "UAF due to cross-thread destruction of worker DeferredPromise in WebLockManager::query()"
    },
    "316196@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316196@main",
      "clUrl": "https://commits.webkit.org/316196@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318189\nrdar://180998972\n\nReviewed by Alan Baradlay.\n\nLineState's constructor takes `FlexLayoutItems\u0026\u0026 flexLayoutItems` (an\nrvalue reference), signaling intent to move. However, inside the member\ninitializer list a named rvalue-reference parameter is an lvalue, so\n`flexLayoutItems(flexLayoutItems)` selected the Vector copy constructor\nand deep-copied the whole Vector\u003cFlexLayoutItem, s_flexLayoutItemsInitialCapacity\u003e\non every flex line.\n\nThe caller already passes WTF::move(lineItems), so the intended behavior\nwas always a move. Wrap the parameter in WTF::move() to elide the\nper-line copy.\n\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::LineState::LineState):\n\nCanonical link: https://commits.webkit.org/316196@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "428365d538396bd73d446fa27beb62b3768b83ca",
      "subject": "RenderFlexibleBox::LineState constructor copies FlexLayoutItems instead of moving it"
    },
    "316197@main": {
      "author": "Nikolas Zimmermann",
      "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64",
      "cl": "316197@main",
      "clUrl": "https://commits.webkit.org/316197@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318268\n\nUnreviewed.\n\n315468@main added a new test, which needs a LBSE specific baseline (different repaint rect order / batching).\n\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/repaint/svg-outline-repaint-on-hover-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/316197@main",
      "email": "nzimmermann@igalia.com",
      "hash": "600eab67eab029ce922b74f6cd1769fe655d89e7",
      "subject": "[LBSE] Add LBSE specific result for svg/repaint/svg-outline-repaint-on-hover.html after 315468@main"
    },
    "316198@main": {
      "author": "Alex Christensen",
      "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64",
      "cl": "316198@main",
      "clUrl": "https://commits.webkit.org/316198@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318264\nrdar://181058988\n\nReviewed by Wenson Hsieh.\n\nIn order to help some clients move off _WKJSHandle on to WKJSHandle,\nwe need to provide equivalent and similarly named interfaces.\n\n* Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm:\n(-[WKWebView _getSelectorPathData:completionHandler:]):\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivate.h:\n* Source/WebKit/UIProcess/API/Cocoa/_WKTextExtraction.h:\n* Source/WebKit/UIProcess/API/Cocoa/_WKTextExtraction.mm:\n(-[_WKTextExtractionConfiguration targetNodeHandle]):\n(-[_WKTextExtractionConfiguration setTargetNodeHandle:]):\n(-[_WKTextExtractionResult requestHandleForNodeIdentifier:searchText:completionHandler:]):\n(-[_WKTextExtractionResult requestContainerHandleForNodeIdentifier:searchText:completionHandler:]):\n(-[_WKTextExtractionResult requestContainerHandleForSearchTexts:nodeIdentifier:completionHandler:]):\n\nCanonical link: https://commits.webkit.org/316198@main",
      "email": "achristensen@apple.com",
      "hash": "d81bcc3d833cfce4e4b892e4c3758454c01498b6",
      "subject": "Prepare for removal of _WKJSHandle"
    },
    "316199@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "316199@main",
      "clUrl": "https://commits.webkit.org/316199@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318223\nrdar://181023846\n\nReviewed by Dan Hecht and Tadeu Zagallo.\n\nWe were using `UncheckedKeyHashMap\u003cuint64_t, SparseArrayEntry, ...\u003e` for\nSparseArrayValueMap since its key range is [0, UINT32_MAX]. So we cannot\nhave a space for \"empty\" and \"deleted\", thus we were using uint64_t as a\nkey. However, this makes each KeyValuePair sizeof(uint64_t) * 3.\nIf we look into the value side, it is having `unsigned attributes`, but\nit is not using all bits. We can convert this Map to\n`UncheckedKeyHashSet\u003cSparseArrayEntry, ...\u003e` and we can store \"empty\" and\n\"deleted\" as bit flags in attributes side. So we can make KeyValuePair\nsizeof(uint64_t) * 2, so 33% reduction in size (and since it becomes\n16bytes, it is good for index computation \u0026 cache efficacy).\n\n* Source/JavaScriptCore/dfg/DFGOperations.cpp:\n(JSC::DFG::getByValArrayStorageInt):\n* Source/JavaScriptCore/runtime/JSArray.cpp:\n(JSC::JSArray::setLengthWithArrayStorage):\n* Source/JavaScriptCore/runtime/JSObject.cpp:\n(JSC::JSObject::getOwnPropertySlotByIndex):\n(JSC::JSObject::enterDictionaryIndexingModeWhenArrayStorageAlreadyExists):\n(JSC::JSObject::deletePropertyByIndex):\n(JSC::JSObject::getOwnIndexedPropertyNames):\n(JSC::JSObject::defineOwnIndexedProperty):\n(JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):\n(JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):\n(JSC::JSObject::putDirectIndexBeyondVectorLengthWithArrayStorage):\n* Source/JavaScriptCore/runtime/JSObjectInlines.h:\n(JSC::JSObject::forEachOwnIndexedProperty):\n* Source/JavaScriptCore/runtime/PropertySlot.h:\n* Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp:\n(JSC::SparseArrayValueMap::add):\n(JSC::SparseArrayValueMap::remove):\n(JSC::SparseArrayValueMap::putEntry):\n(JSC::SparseArrayValueMap::putDirect):\n(JSC::SparseArrayValueMap::getConcurrently):\n(JSC::SparseArrayEntry::forceSet):\n(JSC::SparseArrayEntry::get const):\n(JSC::SparseArrayEntry::getConcurrently const):\n(JSC::SparseArrayEntry::put):\n(JSC::SparseArrayEntry::getNonSparseMode const):\n(JSC::SparseArrayValueMap::visitChildrenImpl):\n* Source/JavaScriptCore/runtime/SparseArrayValueMap.h:\n(JSC::SparseArrayEntry::SparseArrayEntry):\n(JSC::SparseArrayEntry::index const):\n(JSC::SparseArrayEntry::attributes const):\n(JSC::SparseArrayEntry::isEmptyBucket const):\n(JSC::SparseArrayEntry::isDeletedBucket const):\n(JSC::SparseArrayEntry::asValue):\n(JSC::SparseArrayEntry::asValue const):\n(JSC::SparseArrayEntryHash::hash):\n(JSC::SparseArrayEntryHash::equal):\n(JSC::SparseArrayEntryHashTraits::emptyValue):\n(JSC::SparseArrayEntryHashTraits::isEmptyValue):\n(JSC::SparseArrayEntryHashTraits::constructDeletedValue):\n(JSC::SparseArrayEntryHashTraits::isDeletedValue):\n(JSC::SparseArrayEntryTranslator::hash):\n(JSC::SparseArrayEntryTranslator::equal):\n(JSC::SparseArrayEntry::forceSet): Deleted.\n\nCanonical link: https://commits.webkit.org/316199@main",
      "email": "ysuzuki@apple.com",
      "hash": "b80bcf43bdceb9913c30b5aa85a18b41e3547396",
      "subject": "[JSC] Make SparseArrayValueMap 33% compact by using HashSet"
    },
    "316200@main": {
      "author": "Marta Darbinyan",
      "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64",
      "cl": "316200@main",
      "clUrl": "https://commits.webkit.org/316200@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318267\nrdar://181060652\n\nUnreviewed test gardening\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/316200@main",
      "email": "darbinyan@apple.com",
      "hash": "4758ac8a8b1f0e211cae7a46c444366104fc831c",
      "subject": "[ Gardening ]: [iOS] Multiple TestWebKitAPI.WebAuthenticationPanel tests are flaky timeouts"
    },
    "316201@main": {
      "author": "Sihui Liu",
      "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64",
      "cl": "316201@main",
      "clUrl": "https://commits.webkit.org/316201@main",
      "description": "rdar://176915104\n\nReviewed by Per Arne Vollan.\n\nAdd [EnabledBy=AllowTestOnlyIPC] so the generated dispatcher rejects this message outside of test configurations,\nmatching other test-only endpoints such as GeneralStoragePathForTesting.\n\n* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.messages.in:\n\nOriginally-landed-as: 305413.938@safari-7624-branch (40dbe4d64205). rdar://180437831\nCanonical link: https://commits.webkit.org/316201@main",
      "email": "sihui_liu@apple.com",
      "hash": "a90c33d29e3a223df7d7420f48c51f429e429751",
      "subject": "Gate CacheStorageRepresentation IPC behind AllowTestOnlyIPC"
    },
    "316202@main": {
      "author": "Yulun Wu",
      "avatar": "https://www.gravatar.com/avatar/9e34d6632f4d926cdf6fe8dce07f9cb7?d=identicon\u0026s=64",
      "cl": "316202@main",
      "clUrl": "https://commits.webkit.org/316202@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318159\n\u003crdar://180968579\u003e\n\nReviewed by Sammy Gill.\n\n315911@main incorrectly included preferredSize.isFitContent() in\nGridLayoutUtils::preferredSizeDependsOnContainingBlockSize(), causing\ngrid items with fit-content to incorrectly contribute used minimum size\ninstead of min-content size when sizing tracks.\n\nNote that our avoidance reasons are only allowing grids with auto and\nfixed grid item widths to run through GFC.\n\nhttps://searchfox.org/wubkat/source/Source/WebCore/layout/integration/grid/LayoutIntegrationGridCoverage.cpp#226\n\n* Source/WebCore/layout/formattingContexts/grid/GridLayoutUtils.cpp:\n(WebCore::Layout::GridLayoutUtils::preferredSizeDependsOnContainingBlockSize):\n\nCanonical link: https://commits.webkit.org/316202@main",
      "email": "yulun_wu@apple.com",
      "hash": "6db96cd11f963bfa6a9874768309a175de3049cd",
      "subject": "[GFC] fit-content grid items should contribute min-content instead of used minimum size when sizing tracks."
    },
    "316203@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316203@main",
      "clUrl": "https://commits.webkit.org/316203@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314528\nrdar://176568667\n\nReviewed by Ryosuke Niwa.\n\ncreateInternalTransformStream invokes the createInternalTransformStreamFromTransformer\nbuiltin and converts its result via convert\u003cIDLSequence\u003cIDLObject\u003e\u003e, which uses\nthe JS iteration protocol. If a page overrides Array.prototype[Symbol.iterator],\nit can substitute arbitrary objects for the readable/writable entries the\nbuiltin would otherwise return. The only guard was ASSERT(results.size() == 3),\nwhich is a no-op in release, after which jsDynamicCast\u003cJSReadableStream*\u003e /\njsDynamicCast\u003cJSWritableStream*\u003e were dereferenced unconditionally — turning a\nnon-matching object into a controlled type confusion (controlled deref via\nm_wrapped, write-increment via Ref\u003c\u003e::ref(), and a vtable call on attacker\ndata when JS later touches .readable / .writable).\n\nReplace the ASSERT with a runtime size check, null-check the jsDynamicCast\nresults, and throw a TypeError on either failure.\n\nTest: streams/transform-stream-poisoned-iterator-crash.html\n\n* LayoutTests/streams/transform-stream-poisoned-iterator-crash-expected.txt: Added.\n* LayoutTests/streams/transform-stream-poisoned-iterator-crash.html: Added.\n* Source/WebCore/Modules/streams/TransformStream.cpp:\n(WebCore::createInternalTransformStream):\n\nOriginally-landed-as: 305413.875@safari-7624-branch (cb2c361c977a). rdar://180436852\nCanonical link: https://commits.webkit.org/316203@main",
      "email": "cdumez@apple.com",
      "hash": "8fd92b1021d310b2580eb3ac7913911eb14dc476",
      "subject": "[WebCore] TransformStream type confusion when Array.prototype[Symbol.iterator] is overridden"
    },
    "316204@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316204@main",
      "clUrl": "https://commits.webkit.org/316204@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313533\nrdar://175743852\n\nReviewed by Kimmo Kinnunen.\n\nsendMessageImpl() is thread-safe but was reading and invoking\nm_outgoingMessageQueueIsGrowingLargeCallback outside m_outgoingMessagesLock,\nwhile invalidate() was clearing it on the dispatcher thread without holding\nthe lock. This is a data race on the Function object.\n\nWrap the callback in a Box\u003c\u003e (ThreadSafeRefCounted) so it can be safely copied under\nthe lock and invoked outside it. Guard all accesses to the member with\nm_outgoingMessagesLock.\n\n* Source/WebKit/Platform/IPC/Connection.cpp:\n(IPC::Connection::setOutgoingMessageQueueIsGrowingLargeCallback):\n(IPC::Connection::invalidate):\n(IPC::Connection::sendMessageImpl):\n* Source/WebKit/Platform/IPC/Connection.h:\n\nOriginally-landed-as: 305413.761@safari-7624-branch (153d034e52b2). rdar://180436058\nCanonical link: https://commits.webkit.org/316204@main",
      "email": "cdumez@apple.com",
      "hash": "267fa38ebab73cb1b298cd198f1412e532ec74dd",
      "subject": "Fix data race on m_outgoingMessageQueueIsGrowingLargeCallback in IPC::Connection"
    }
  },
  "date": "2026-06-30",
  "days": 1,
  "generatedAt": "2026-06-30T22:06:51Z",
  "markdown": "## Highlights\n- **Security** WebKit closed a broad set of memory safety and validation bugs across IPC, WebCore, WebGPU, WebGL, Media, and storage, with several fixes blocking exploitable use-after-free, OOB, and data disclosure paths. [commit 316204@main](https://commits.webkit.org/316204@main)\n- **Security** TransformStream no longer hits a type confusion when `Array.prototype[Symbol.iterator]` is overridden, tightening a dangerous script-triggerable edge case in streams. [commit 316203@main](https://commits.webkit.org/316203@main)\n- **Security** Worker-side Web Locks query handling got a use-after-free fix for `DeferredPromise` lifetime across threads, removing a subtle cross-thread teardown hazard. [commit 316195@main](https://commits.webkit.org/316195@main)\n- **Security** Networking tightened several high-risk paths, including cookie checks for `loadPing()`, blob file path validation, redirect cache partition restoration, and PDF temp-file path handling. [commit 316167@main](https://commits.webkit.org/316167@main)\n- **GPU** WebGPU and WebGL landed multiple hardening fixes for validation-cache collisions, origin-clean bypass, integer overflow, heap disclosure, and unsafe pixel reads. [commit 316116@main](https://commits.webkit.org/316116@main)\n- **V8** JavaScriptCore shipped a dense batch of correctness and perf work: array access fast paths, `RegExp#flags` optimization, Temporal spec alignment, stringifier improvements, and a pile of GC and JIT safety fixes. [commit 316142@main](https://commits.webkit.org/316142@main)\n- **Rendering** Layout and rendering moved forward on grid sizing, evaluation-time zoom, SVG text and geometry correctness, transformed drag images, and several box model cleanups. [commit 316202@main](https://commits.webkit.org/316202@main)\n- **DevTools** Web Inspector gained ES2022 private method support and fixed local override encoding plus timeline timestamp export/import for `performance.mark()`. [commit 316171@main](https://commits.webkit.org/316171@main)\n- **Media** Media work mixed security and UX: safer audio/video frame lifetime handling, more tolerant MSE gap behavior, off-main-thread model conversion, and more MediaStreams test coverage. [commit 316146@main](https://commits.webkit.org/316146@main)\n\n## What landed by area\n\n### JavaScriptCore\n- **V8** SparseArrayValueMap got 33 percent more compact by switching to `HashSet`, cutting memory overhead in sparse array bookkeeping. [commit 316199@main](https://commits.webkit.org/316199@main)\n- **Security** JSC stopped caching property absence on dictionaries, fixing a correctness hole around dictionary-mode object access. [commit 316189@main](https://commits.webkit.org/316189@main)\n- **Security** SlowPutArrayStorage no longer leaves a stale structure bit behind, closing a dangerous array storage state bug. [commit 316185@main](https://commits.webkit.org/316185@main)\n- **Security** FTL's `compileArrayIndexOfOrArrayIncludes` now keeps the base alive before a GC-capable VM call. [commit 316183@main](https://commits.webkit.org/316183@main)\n- **Security** `repatchGetBySlowPathCall` now takes `codeBlock-\u003em_lock`, fixing a race in slow-path patching. [commit 316164@main](https://commits.webkit.org/316164@main)\n- **Security** Yarr generated code now has a size limit, reducing risk from pathological regexp compilation. [commit 316157@main](https://commits.webkit.org/316157@main)\n- **Security** JSC now disallows defining private names on WasmGC objects. [commit 316152@main](https://commits.webkit.org/316152@main)\n- **V8** Added an `ArrayStorage + GetByVal` specific operation for tighter array element access. [commit 316142@main](https://commits.webkit.org/316142@main)\n- **Security** `MultiPutByOffset` now inserts a barrier when storage can be reallocated. [commit 316139@main](https://commits.webkit.org/316139@main)\n- **Security** `TypedArray.from()` no longer allows an out-of-bounds read during Resizable ArrayBuffer resize or transfer in a `mapFn` callback. [commit 316137@main](https://commits.webkit.org/316137@main)\n- **Security** OMG OSR entry callees are now kept alive while callsites are updated. [commit 316132@main](https://commits.webkit.org/316132@main)\n- **Security** The DFG spread operator fix accounts for `cellButterflyOnlyAtomStringsStructure`. [commit 316128@main](https://commits.webkit.org/316128@main)\n- **Security** YarrJIT fixed `negativeOffsetIndexedAddress` losing its adjusted base register. [commit 316127@main](https://commits.webkit.org/316127@main)\n- **V8** `DFGArgumentsEliminationPhase` now resets node scan index between inline call frames. [commit 316118@main](https://commits.webkit.org/316118@main)\n- **V8** `FastStringifier` now supports the `space` argument. [commit 316108@main](https://commits.webkit.org/316108@main)\n- **Perf** Added a fast path for the `RegExp#flags` getter. [commit 316106@main](https://commits.webkit.org/316106@main)\n- **V8** Yarr now uses `m_latin1Table` in `Char16` handling and the interpreter. [commit 316105@main](https://commits.webkit.org/316105@main)\n- **Refactor** Removed `op_try_get_by_id` and `@tryGetById`. [commit 316104@main](https://commits.webkit.org/316104@main)\n- **V8** Temporal.PlainDate got more spec alignment, including era handling and date-add fixes. [commit 316092@main](https://commits.webkit.org/316092@main)\n- **Perf** JSC now avoids setting unnecessary watchpoints. [commit 316084@main](https://commits.webkit.org/316084@main)\n- **Security** JSWebAssemblyMemory is now kept alive from wasm-originated JSArrayBuffers. [commit 316080@main](https://commits.webkit.org/316080@main)\n\n### Networking, Storage, and Process Model\n- **Security** `CacheStorageRepresentation` IPC is now gated behind `AllowTestOnlyIPC`. [commit 316201@main](https://commits.webkit.org/316201@main)\n- **Security** Redirect handling in WebKit Networking now restores `cachePartition` before reaching `Cache::storeRedirect`. [commit 316193@main](https://commits.webkit.org/316193@main)\n- **Refactor** Removed `shouldRestrictHTTPResponseAccess` from `NetworkResourceLoadParameters`. [commit 316187@main](https://commits.webkit.org/316187@main)\n- **Security** SharedWorker context establishment gained `MESSAGE_CHECK` validation. [commit 316191@main](https://commits.webkit.org/316191@main)\n- **Security** `loadPing()` IPC now enforces `allowsFirstPartyForCookies` checks to prevent cross-origin cookie access. [commit 316167@main](https://commits.webkit.org/316167@main)\n- **Security** `registerInternalFileBlobURL()` now validates `replacementPath`, blocking wrongful file deletion. [commit 316166@main](https://commits.webkit.org/316166@main)\n- **Security** Site Isolation fixed a per-frame back-forward walk regression that could resurrect a stale initial `about:blank` in iframes. [commit 316161@main](https://commits.webkit.org/316161@main)\n- **Security** Several ITP and storage access IPC messages now get explicit validation. [commit 316149@main](https://commits.webkit.org/316149@main)\n- **Security** `WebBackForwardListItem::allItems()` is now process-specific instead of process-global, improving message checking. [commit 316143@main](https://commits.webkit.org/316143@main)\n- **Security** IndexedDB now rejects transactions during version change operations. [commit 316133@main](https://commits.webkit.org/316133@main)\n- **Security** The IDB memory index cursor reverse iterator no longer hits a heap use-after-free when entries are deleted during reverse traversal. [commit 316129@main](https://commits.webkit.org/316129@main)\n- **Security** `WebsiteDataStore::beginAppBoundDomainCheck()` got a use-after-free fix. [commit 316124@main](https://commits.webkit.org/316124@main)\n- **Privacy** `requestStorageAccess()` rejection without a user gesture no longer synthesizes user activation. [commit 316120@main](https://commits.webkit.org/316120@main)\n- **Security** Site Isolation fixed child-frame positional lookup corrupting sibling frame IDs in the BF tree. [commit 316109@main](https://commits.webkit.org/316109@main)\n- **Security** Cross-origin iframes now fire the async load event in a way that prevents URL guessing. [commit 259384@main](https://commits.webkit.org/259384@main)\n\n### Rendering, Layout, and CSS\n- **Rendering** Grid `fit-content` sizing now uses min-content contribution instead of used minimum size when sizing tracks. [commit 316202@main](https://commits.webkit.org/316202@main)\n- **Rendering** Custom property names in declaration blocks are now serialized with proper escaping. [commit 316192@main](https://commits.webkit.org/316192@main)\n- **Web Platform** CSS Mixins serialization types landed for `css-mixins-1`. [commit 316190@main](https://commits.webkit.org/316190@main)\n- **Web Platform** CSS Mixins argument parsing now works in terms of `first-valid()`. [commit 316169@main](https://commits.webkit.org/316169@main)\n- **UI** Marked-text highlight fill color no longer incorrectly comes from the stroke color. [commit 316156@main](https://commits.webkit.org/316156@main)\n- **Refactor** Size-only callers now use `RenderBox::borderBoxSize()` instead of `frameRect()`. [commit 316147@main](https://commits.webkit.org/316147@main)\n- **Rendering** Combining marks on SVG `textPath` no longer render as dotted circles. [commit 316144@main](https://commits.webkit.org/316144@main)\n- **Refactor** Size-only callers now use `RenderBox::borderBoxSize()` instead of `borderBoxRect()`. [commit 316123@main](https://commits.webkit.org/316123@main)\n- **Refactor** `RenderBox::setWidth()` and `setHeight()` were renamed to `setBorderBoxWidth()` and `setBorderBoxHeight()`. [commit 316122@main](https://commits.webkit.org/316122@main)\n- **Refactor** Redundant null checks were removed in `RenderHighlight::highlightStateForRenderer`. [commit 316115@main](https://commits.webkit.org/316115@main)\n- **Web Platform** `corner-shape` added vector math helpers to `FloatSize`. [commit 316113@main](https://commits.webkit.org/316113@main)\n- **Rendering** Border, outline, and column-rule width now participate in evaluation-time zoom. [commit 316091@main](https://commits.webkit.org/316091@main)\n- **Refactor** `RenderBox::width()` and `height()` were renamed to `borderBoxWidth()` and `borderBoxHeight()`. [commit 316085@main](https://commits.webkit.org/316085@main)\n- **Refactor** `ShouldComputePreferred` was replaced with `IsComputingIntrinsicSize`. [commit 316081@main](https://commits.webkit.org/316081@main)\n- **Rendering** Drag images for DOM elements with CSS transforms now render correctly. [commit 316077@main](https://commits.webkit.org/316077@main)\n\n### Graphics, SVG, and Images\n- **Security** `BitmapImageSource::decodedSizeReset()` got a regression fix for decoded-size accounting assertions. [commit 316180@main](https://commits.webkit.org/316180@main)\n- **Web Platform** Imported WPT SVG styling failures were fixed. [commit 316174@main](https://commits.webkit.org/316174@main)\n- **Security** `GetPixelBuffer` now zero-fills the destination on any error. [commit 316159@main](https://commits.webkit.org/316159@main)\n- **Security** `FEGaussianBlur` no longer returns uninitialized results for alpha-image input. [commit 316153@main](https://commits.webkit.org/316153@main)\n- **Security** `SVGGeometryElement::getPointAtLength` no longer keeps a raw renderer pointer across nested `updateLayout()`. [commit 316151@main](https://commits.webkit.org/316151@main)\n- **Web Platform** `animateMotion-spline-invalid-keyTimes.html` was fixed. [commit 316138@main](https://commits.webkit.org/316138@main)\n- **Security** `FilterImage` no longer returns an uninitialized `PixelBuffer`. [commit 316126@main](https://commits.webkit.org/316126@main)\n- **Security** `convertImagePixelsFromFloat16ToFloat16` no longer discloses uninitialized heap data on a color-space early return. [commit 316117@main](https://commits.webkit.org/316117@main)\n- **Rendering** Duplicate self-layer checks were removed in `RenderLayerBacking::paintIntoLayer`. [commit 316111@main](https://commits.webkit.org/316111@main)\n- **Security** `FontCascadeCacheKey` no longer leaves `fontSelectorId` and `fontSelectorVersion` uninitialized. [commit 316102@main](https://commits.webkit.org/316102@main)\n- **Web Platform** WPT added runtime `[SameObject]` identity coverage across the SVG2 DOM. [commit 316101@main](https://commits.webkit.org/316101@main)\n- **Web Platform** WPT added `[SameObject]` identity coverage for `SVGSVGElement.currentTranslate`. [commit 316100@main](https://commits.webkit.org/316100@main)\n- **Web Platform** `svg/historical.html` now lists removed `setCurrentScale` and `setCurrentTranslate` members. [commit 316099@main](https://commits.webkit.org/316099@main)\n\n### Media, Audio, and Model Pipeline\n- **Security** `InternalAudioEncoderCocoa` fixed a use-after-free on ASBD change when `converter-\u003efinish()`'s promise gets discarded. [commit 316188@main](https://commits.webkit.org/316188@main)\n- **Security** `MediaMetadata` artwork loading now captures a `WeakPtr` to avoid callback lifetime issues. [commit 316179@main](https://commits.webkit.org/316179@main)\n- **Security** `BiquadFilterNode::setType()` now takes `graphLock()` to avoid a race. [commit 316175@main](https://commits.webkit.org/316175@main)\n- **Media** MSE playback and seek now tolerate gaps more loosely, reducing unnecessary stalls. [commit 316146@main](https://commits.webkit.org/316146@main)\n- **Media** `MockSampleBox` no longer accepts negative time scales and duration. [commit 316121@main](https://commits.webkit.org/316121@main)\n- **Security** `VideoFrameLibWebRTC` fixed a data race on `m_conversionCallback` between clone and pixel-buffer access. [commit 316112@main](https://commits.webkit.org/316112@main)\n- **Media** Added broader MediaStreams test coverage for previously untested parts of MediaCapture-Main and Extensions. [commit 316096@main](https://commits.webkit.org/316096@main)\n- **Perf** Models are now converted off the main thread in the model process. [commit 316093@main](https://commits.webkit.org/316093@main)\n\n### GPU, WebGL, and WebGPU\n- **Security** The GPU process fixed a heap use-after-free path involving `MediaStreamTrack.clone()`, `ImageCapture.takePhoto()`, and `applyConstraints()`. [commit 316184@main](https://commits.webkit.org/316184@main)\n- **GPU** WebGL ANGLE now lets `pixelStorei` modify `PACK_*` state correctly. [commit 316155@main](https://commits.webkit.org/316155@main)\n- **Security** WebGPU bind group layout compatibility validation no longer relies on a stale `WeakPtr` comparison. [commit 316134@main](https://commits.webkit.org/316134@main)\n- **Security** WebGPU fixed signed-negation overflow when `baseVertex == INT32_MIN` during index buffer clamping. [commit 316131@main](https://commits.webkit.org/316131@main)\n- **GPU** ANGLE Metal fixed inconsistent behavior across several `DrawElements` variants. [commit 316130@main](https://commits.webkit.org/316130@main)\n- **Security** `RemoteGraphicsContextGL::readPixelsInline` no longer leaks uninitialized FastMalloc heap data. [commit 316125@main](https://commits.webkit.org/316125@main)\n- **Security** WebGPU bind group validation cache key collisions no longer enable GPU out-of-bounds writes. [commit 316116@main](https://commits.webkit.org/316116@main)\n- **Security** WebGPU `importExternalTexture` no longer bypasses origin-clean checks. [commit 316078@main](https://commits.webkit.org/316078@main)\n\n### WebCore DOM, Bindings, and Security Hardening\n- **Security** `Style::TreeResolver` no longer hits a use-after-free when XML parsing triggers custom element upgrade during `startElementNs`. [commit 316181@main](https://commits.webkit.org/316181@main)\n- **Security** Bindings now avoid returning an empty `JSValue` to script from `callPromisePairFunction` when argument conversion throws. [commit 316150@main](https://commits.webkit.org/316150@main)\n- **Security** `WebExtensionContext::storageSet` fixed a use-after-free caused by HashMap mutation during `keys()` iteration. [commit 316136@main](https://commits.webkit.org/316136@main)\n- **Security** `WebCodecsAudioData::memoryCost()` fixed a use-after-free from concurrent GC marking and `close()`. [commit 316135@main](https://commits.webkit.org/316135@main)\n- **Security** `CanvasRenderingContext::deref` no longer crashes after reentrant `getContext()`. [commit 316107@main](https://commits.webkit.org/316107@main)\n- **Security** `AutoFillButtonElement::defaultEventHandler` got a use-after-free fix. [commit 316086@main](https://commits.webkit.org/316086@main)\n\n### Web Platform, CSP, and API Surface\n- **Refactor** `_WKJSHandle` removal prep work landed. [commit 316198@main](https://commits.webkit.org/316198@main)\n- **Build** macOS 26 system version prefix mapping was added. [commit 316178@main](https://commits.webkit.org/316178@main)\n- **Mobile** iOS removed support for `AVMediaSource` from `MediaDeviceRoute`. [commit 316168@main](https://commits.webkit.org/316168@main)\n- **Security** CSP directive names are now lowercased eagerly. [commit 316160@main](https://commits.webkit.org/316160@main)\n- **Build** MTE hard-mode was re-enabled. [commit 316163@main](https://commits.webkit.org/316163@main)\n- **Web Platform** Checked arithmetic operations now require two or more arguments. [commit 316082@main](https://commits.webkit.org/316082@main)\n- **Security** Trusted Types parsing now rejects trailing characters after keywords and wildcard. [commit 316089@main](https://commits.webkit.org/316089@main)\n\n### DevTools, Inspector, and WebKit tooling\n- **DevTools** Web Inspector now supports ES2022 private methods. [commit 316171@main](https://commits.webkit.org/316171@main)\n- **Build** PrettyPatch now HTML-escapes image URLs when rendering binary diffs. [commit 316177@main](https://commits.webkit.org/316177@main)\n- **Security** bugs.webkit.org's Commits extension fixed stored XSS guidance by escaping captured groups and tightening matching. [commit 316170@main](https://commits.webkit.org/316170@main)\n- **Build** CoreIPC defines were migrated from WebKitAdditions. [commit 316172@main](https://commits.webkit.org/316172@main)\n- **Build** `--print-expectations` now handles the no-matching-tests case. [commit 316162@main](https://commits.webkit.org/316162@main)\n- **Security** `committers-autocomplete.js` fixed a DOM XSS bug. [commit 316158@main](https://commits.webkit.org/316158@main)\n- **Build** WPE browserperfdash binary-size reporting now uses stripped binaries and libraries. [commit 316119@main](https://commits.webkit.org/316119@main)\n- **A11y** Added dictation tests after earlier speech-related changes. [commit 316110@main](https://commits.webkit.org/316110@main)\n- **Security** Bugzilla radar extension output is now escaped for defense in depth. [commit 316087@main](https://commits.webkit.org/316087@main)\n- **DevTools** Local response overrides mapped to files now preserve the right character encoding instead of forcing Latin1. [commit 316074@main](https://commits.webkit.org/316074@main)\n- **DevTools** Timeline export and import now keeps correct timestamps for `performance.mark()`. [commit 316073@main](https://commits.webkit.org/316073@main)\n\n### Apple platform UI and app integration\n- **Mobile** Find in Page crash on iOS was fixed. [commit 316114@main](https://commits.webkit.org/316114@main)\n- **UI** macOS fullscreen no longer loses scroll pocket color after refresh. [commit 316145@main](https://commits.webkit.org/316145@main)\n- **UI** AppKit select controls no longer immediately dismiss their menu on click. [commit 316097@main](https://commits.webkit.org/316097@main)\n- **UI** `WKPanGestureRecognizer` again uses the `_shouldRecognize(forDelta:)` SPI after a reland. [commit 316095@main](https://commits.webkit.org/316095@main)\n- **A11y** Text Extraction can now target elements using stale node UIDs. [commit 316094@main](https://commits.webkit.org/316094@main)\n- **Build** Fixed the build after `316095@main`. [commit 316103@main](https://commits.webkit.org/316103@main)\n- **Build** A missing `WebCore_Private` import causing member import visibility build failures was fixed. [commit 316140@main](https://commits.webkit.org/316140@main)\n- **Build** `WKJSScriptingBuffer` replacement prep continued with an `NSData` transition. [commit 316165@main](https://commits.webkit.org/316165@main)\n\n### Test infrastructure and gardening\n- **Build** iOS WebAuthenticationPanel API tests were marked flaky on timeout. [commit 316200@main](https://commits.webkit.org/316200@main)\n- **Build** LBSE added a specific result for `svg-outline-repaint-on-hover.html` after [bug 318268](https://bugs.webkit.org/show_bug.cgi?id=318268). [commit 316197@main](https://commits.webkit.org/316197@main)\n- **Build** Layout-test expectations were marked for newly filed failures. [commit 316186@main](https://commits.webkit.org/316186@main)\n- **Build** Imported WPT IndexedDB constant text failures were gardened. [commit 316083@main](https://commits.webkit.org/316083@main)\n- **Build** LBSE rebaselined iOS-specific results after earlier landing fallout. [commit 316141@main](https://commits.webkit.org/316141@main)\n- **Build** TestWebKitAPI pbxproj was resorted after an earlier change. [commit 316154@main](https://commits.webkit.org/316154@main)\n- **Build** iOS `PasteHTML.DoesNotTransformColorsOfLightContent` flake was marked on EWS bots. [commit 316075@main](https://commits.webkit.org/316075@main)\n- **Build** The measure-build-time Swift patch was updated. [commit 316194@main](https://commits.webkit.org/316194@main)\n\n## Reverts \u0026 Reapplies\n- **UI** Re-landed AppKit gesture recognizer SPI adoption for `WKPanGestureRecognizer` after earlier fallout. [commit 316095@main](https://commits.webkit.org/316095@main)",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [
    {
      "name": "Cherry-pick",
      "count": 1
    },
    {
      "name": "Unreviewed",
      "count": 1
    }
  ],
  "since": "2026-06-30",
  "totals": {
    "commits": 132,
    "features": 130,
    "rolls": 2
  },
  "until": "2026-06-30"
}