{
  "commits": {
    "316332@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316332@main",
      "clUrl": "https://commits.webkit.org/316332@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314944\nrdar://177031898\n\nReviewed by Ryosuke Niwa.\n\ncallPromisePairFunction's sentinel check `!JSValue::decode(result)` only catches the\nzero empty-value sentinel returned by IDL argument conversion failures. When a\n[ReturnsPromisePair] operation is called with fewer than the mandatory number of\narguments, the generated bindings hit the missing-argument check emitted by\nCodeGeneratorJS.pm and `return throwVMError(...)`, which encodes a non-zero\nJSC::Exception* cell rather than the empty sentinel. After\nrejectPromisesWithExceptionIfAny clears the pending exception, the sentinel check\nevaluates false and the raw Exception cell is returned to JavaScript.\n\nThe Exception cell has JSType=CellType (0), not JSObject. A subsequent property\nstore such as `victim.foo = 0xdead` goes through JSCell::putInline -\u003e\noverridesPut() == false -\u003e asObject(this) -\u003e jsCast\u003cJSObject*\u003e. On production\nARM64 builds, ASSERT_WITH_SECURITY_IMPLICATION compiles to ((void)0), so the cast\nis a bare static_cast — type confusion. The resulting put allocates a Butterfly,\nclobbers Exception::m_value (offset +0x08) with the Butterfly pointer, and\nwrites the attacker-controlled value into property storage. The next GC then\ncrashes in Exception::visitChildrenImpl when visitor.append(m_value) treats the\nButterfly as a JSCell and SlotVisitor::drain dereferences an invalid StructureID.\n\nThis affects all [ReturnsPromisePair] IDL operations with mandatory arguments,\nnotably Navigation.navigate() / reload() / traverseTo() / back() / forward().\n\nFix callPromisePairFunction to capture catchScope.exception() before\nrejectPromisesWithExceptionIfAny clears it. If the functor threw, always rebuild\na valid result dictionary from the (now rejected) promises via\nconvertDictionaryToJS rather than returning the functor's return value. This\ncovers throwVMError, any future throw paths inside the functor, and the existing\nempty-sentinel case from IDL argument conversion failures.\n\nThe non-pair callPromiseFunction is unaffected: it already discards the functor's\nreturn value.\n\nTest: navigation-api/navigation-navigate-no-arguments-crash.html\n\n* LayoutTests/navigation-api/navigation-navigate-no-arguments-crash-expected.txt: Added.\n* LayoutTests/navigation-api/navigation-navigate-no-arguments-crash.html: Added.\n* Source/WebCore/bindings/js/JSDOMPromiseDeferred.h:\n(WebCore::callPromisePairFunction):\n\nOriginally-landed-as: 305413.921@safari-7624-branch (5977997682c7). rdar://181074612\nCanonical link: https://commits.webkit.org/316332@main",
      "email": "cdumez@apple.com",
      "hash": "e75354878ca37205ff0f69e9e8dedefd20d8c479",
      "subject": "Type confusion via raw Exception cell returned to script from callPromisePairFunction when throwVMError bypasses sentinel check"
    },
    "316333@main": {
      "author": "Jetzel Espinal",
      "avatar": "https://www.gravatar.com/avatar/2edd78d5d9f2f2e2e695465277634921?d=identicon\u0026s=64",
      "cl": "316333@main",
      "clUrl": "https://commits.webkit.org/316333@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318367\nrdar://181154892\n\nUnreviewed test gardening.\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/316333@main",
      "email": "jespinal23@apple.com",
      "hash": "a9b7a690e88e3fea3219371bbdb63028ed149037",
      "subject": "[GARDENING]REGRESSION(316165@main): TestWebKitAPI.JSBuffer.Data is a constant crash"
    },
    "316335@main": {
      "author": "Nikolas Zimmermann",
      "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64",
      "cl": "316335@main",
      "clUrl": "https://commits.webkit.org/316335@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318187\n\nReviewed by Carlos Alberto Lopez Perez.\n\nWebKit auto-enables ENABLE_SWIFT_DEMO_URI_SCHEME and\nENABLE_BACK_FORWARD_LIST_SWIFT for WPE/GTK whenever it finds a capable\nswiftc on PATH. In a cross build that picks up a host toolchain (e.g.\n/opt/swift), which cannot target the SDK, so the build fails while\ntrying to process a host header like bits/wordsize.h.\n\nSkip the Swift auto-detection when CMAKE_CROSSCOMPILING is set, so the\nfeatures default off for any cross build instead of guessing from a host\nswiftc. Any default explicitly set beforehand (by the user, the\nenvironment or a platform config) is respected, so a cross target that\ndoes ship a Swift runtime can opt back in by setting the *_DEFAULT\nvariables to ON.\n\n* Source/cmake/WebKitFeatures.cmake:\n\nCanonical link: https://commits.webkit.org/316335@main",
      "email": "nzimmermann@igalia.com",
      "hash": "7248cd80025616412b7f4f78ebb737fca98ee2b9",
      "subject": "[GTK][WPE] Do not auto-enable Swift when cross-building"
    },
    "316336@main": {
      "author": "Karl Dubost",
      "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64",
      "cl": "316336@main",
      "clUrl": "https://commits.webkit.org/316336@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318201\nrdar://180551491\n\nReviewed by Brent Fulgham.\n\nThe Pinduoduo merchant back-office at mms.pinduoduo.com parses\nnavigator.userAgent with ua-parser-js and overlays a \"your browser is not\nChrome\" modal whenever the detected browser name is outside {Chrome, Edge, IE},\nblocking Safari. The check reads the user-agent string (not\nnavigator.userAgentData), and ua-parser-js evaluates its generic chrome/\u003cv\u003e\nrule before its Safari rule, so a UA carrying a Chrome token is reported as\nChrome and the gate passes.\n\nAdd a host-scoped entry to needsCustomUserAgentOverride() that splices a Chrome\ntoken into Safari's user agent preserving Safari's identity tokens.\nScoped to the host mms.pinduoduo.com rather than the pinduoduo.com\nregistrable domain so the consumer storefront and other subdomains are\nunaffected.\n\n* Source/WebCore/page/Quirks.cpp:\n\nCanonical link: https://commits.webkit.org/316336@main",
      "email": "karlcow@apple.com",
      "hash": "988c6a663e9a57f38025b5010074da3362b7455d",
      "subject": "[Quirks] mms.pinduoduo.com shows Safari a \"your browser is not Chrome\" interstitial"
    },
    "316337@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316337@main",
      "clUrl": "https://commits.webkit.org/316337@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314952\nrdar://177248996\n\nReviewed by Geoffrey Garen.\n\nJSTextTrackCue::visitAdditionalChildrenInGCThread() was accessing\n`TrackTraceCue::m_track` from the GC thread, even though it is a WeakPtr\nwhich can get nulled out on the main thread.\n\nTo address the issue:\n- Turn `TrackTraceCue::m_track` into a CheckedPtr. This is OK because the\n  ~Track() destructor takes care of nulling out its cues' m_track pointer\n  explicitly.\n- Add a Lock to synchronize setting m_track on the main thread in\n  `TextTrackCue::setTrack()` and accessing it on the GC thread.\n\n* Source/WebCore/bindings/js/JSTextTrackCueCustom.cpp:\n(WebCore::JSTextTrackCue::visitAdditionalChildren):\n* Source/WebCore/html/track/InbandDataTextTrack.h:\n* Source/WebCore/html/track/InbandGenericTextTrack.h:\n* Source/WebCore/html/track/InbandTextTrack.h:\n* Source/WebCore/html/track/InbandWebVTTTextTrack.h:\n* Source/WebCore/html/track/LoadableTextTrack.h:\n* Source/WebCore/html/track/TextTrack.h:\n* Source/WebCore/html/track/TextTrackCue.cpp:\n(WebCore::TextTrackCue::willChange):\n(WebCore::TextTrackCue::didChange):\n(WebCore::TextTrackCue::track const):\n(WebCore::TextTrackCue::protectedTrack const):\n(WebCore::TextTrackCue::setTrack):\n(WebCore::TextTrackCue::cueIndex const):\n(WebCore::TextTrackCue::hasEquivalentStartTime const):\n(WebCore::TextTrackCue::visitAdditionalChildren):\n* Source/WebCore/html/track/TextTrackCue.h:\n\nOriginally-landed-as: 305413.937@safari-7624-branch (133b57500c3a). rdar://180437357\nCanonical link: https://commits.webkit.org/316337@main",
      "email": "cdumez@apple.com",
      "hash": "e37953123ad26f8d04ee26239b50297fbc87554e",
      "subject": "Data race in JSTextTrackCue::visitAdditionalChildrenInGCThread leading to use-after-free (variant of bug 311800)"
    },
    "316338@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316338@main",
      "clUrl": "https://commits.webkit.org/316338@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314806\nrdar://176023893\n\nReviewed by Ryosuke Niwa.\n\nnavigator.clipboard.readText(), read(), writeText(), and write() relied on WebKit's\nlegacy UserGestureIndicator for activation checks (directly for writes, via\nLocalFrame::requestDOMPasteAccess() for reads). LocalDOMWindow::processPostMessage\nexplicitly forwards the active UserGestureToken into the receiving iframe's event\nhandler, so a user click on a top-level page let a cross-origin iframe see \"processing\na user gesture\" and access the clipboard. This violates the W3C Clipboard API spec,\nwhich requires transient activation on the relevant global object.\n\nFix this by checking LocalDOMWindow::hasTransientActivation() at the entry point of\neach clipboard method. Transient activation is a property of the window and only\npropagates to ancestor frames and same-origin descendant frames -- it is never\npropagated to cross-origin descendants via postMessage. This matches the behavior of\nBlink and Firefox.\n\nTest: http/tests/security/clipboard/clipboard-access-in-cross-origin-iframe-denied.html\n\n* LayoutTests/editing/async-clipboard/clipboard-change-data-while-getting-type.html:\n* LayoutTests/editing/async-clipboard/clipboard-get-type-with-old-items.html:\n* LayoutTests/editing/async-clipboard/resources/async-clipboard-helpers.js:\nFix existing tests so they keep passing.\n\n* LayoutTests/http/tests/security/clipboard/clipboard-access-in-cross-origin-iframe-denied-expected.txt: Added.\n* LayoutTests/http/tests/security/clipboard/clipboard-access-in-cross-origin-iframe-denied.html: Added.\n* LayoutTests/http/tests/security/clipboard/resources/clipboard-access-from-iframe.html: Added.\nNew test coverage.\n\n* LayoutTests/imported/w3c/web-platform-tests/clipboard-apis/async-navigator-clipboard-basics.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/clipboard-apis/async-navigator-clipboard-basics.https.html:\n* LayoutTests/imported/w3c/web-platform-tests/clipboard-apis/resources/user-activation.js:\nResync existing WPT test so it keeps passing.\n\n* Source/WebCore/Modules/async-clipboard/Clipboard.cpp:\n(WebCore::frameHasTransientActivation):\n(WebCore::shouldProceedWithClipboardWrite):\n(WebCore::Clipboard::readText):\n(WebCore::Clipboard::read):\n\nOriginally-landed-as: 305413.908@safari-7624-branch (526ac3579021). rdar://180436853\nCanonical link: https://commits.webkit.org/316338@main",
      "email": "cdumez@apple.com",
      "hash": "73645abad282e4903019e36d01c753145fd79a14",
      "subject": "Cross-Origin Iframe Can Read Clipboard via Top-Level User Interaction in Safari"
    },
    "316339@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "316339@main",
      "clUrl": "https://commits.webkit.org/316339@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318373\nrdar://180277164\n\nReviewed by Dan Hecht.\n\nB3 CSE can handle store with narrower width. In this case, we emit\nnarrowing operations to reuse the value. For example,\n\n    @a: Load32(...)\n    @b: Store8(@a, LocationA)\n    ...\n    @d: Load8(LocationA)\n\nis converted to\n\n    @a: Load32(...)\n    @b: Store8(@a, LocationA)\n    ...\n    @c: BitAnd(@a, 0xff)\n    @d: Identity(@c)\n\nSo, we insert BitAnd to narrow @a to 8-bit size in this case.\nTo detect whether we need to insert these extras B3 values, we are\ntracking it in m_sets.\n\nBut when we materialize it, querying to this hash table for each Value\nin the graph is too costly, so we have a filter canHaveSet which checks\nvalue's opcode to filter out the candidate. However this opcode set is\nnot the right one since these values can be converted to Nop / Identity\nsometimes. For example, in the above CSE case, it is possible that we\ndetect that the above @b is meaningless and convert it to Nop because\nthe subsequent Store8(..., LocationA) exists (store elimination).\n\nTo filter correctly while keeping the efficacy of compile time, we add\nIndexSet for matched values. Under the hood, it is BitVector and\nefficienty handle the filtering.\n\nTest: JSTests/stress/b3-cse-fix.js\n\n* JSTests/stress/b3-cse-fix.js: Added.\n* Source/JavaScriptCore/b3/B3EliminateCommonSubexpressions.cpp:\n\nCanonical link: https://commits.webkit.org/316339@main",
      "email": "ysuzuki@apple.com",
      "hash": "2bd4edbe145cfb08dec3585fe4235c01869e1d7d",
      "subject": "[JSC] Fix B3 CSE extras adjustment"
    },
    "316340@main": {
      "author": "Alex Christensen",
      "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64",
      "cl": "316340@main",
      "clUrl": "https://commits.webkit.org/316340@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318367\nrdar://181154892\n\nUnreviewed.\n\nI introduced an over-release.  This fixes our memory management in the test.\n\n* TestExpectations/apitests:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/JSBuffer.mm:\n(TEST(JSBuffer, Data)):\n\nCanonical link: https://commits.webkit.org/316340@main",
      "email": "achristensen@apple.com",
      "hash": "249063616a39f626763a16d30295ed9288e1f80f",
      "subject": "REGRESSION(316165@main): TestWebKitAPI.JSBuffer.Data (api-test) is a constant crash"
    },
    "316341@main": {
      "author": "Tyler Wilcock",
      "avatar": "https://www.gravatar.com/avatar/9545082e6bed96158a9f52dac6e4b869?d=identicon\u0026s=64",
      "cl": "316341@main",
      "clUrl": "https://commits.webkit.org/316341@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318158\nrdar://179106823\n\nReviewed by Dominic Mazzoni.\n\nWith ENABLE(ACCESSIBILITY_LOCAL_FRAME), local frames compose an element's screen\nposition the same way remote frames do: a cached per-frame AXFrameGeometry.screenPosition\n(the frame's content origin on screen, with the frame's scroll baked in when it was\nsampled) plus the element's content-space rect. That cached geometry is refreshed only\nby an asynchronous re-push, so when a frame scrolls its own content, e.g. a horizontal\nCSS-column page-turn in Apple Books, the baked-in scroll goes stale until the re-push\nlands. An assistive technology reading in that window gets a mispositioned rect, so\npaginated content lands off the viewport and VoiceOver cannot reach it.\n\nStop depending on the re-push for a frame's own scroll. In convertFrameToSpace, read the\ncurrent scroll live (we are on the main thread here), undo the stale sampled scroll baked\ninto screenPosition, and re-apply the current scroll. In steady state the two are equal\nand this is a no-op. During the race it keeps the read correct. To carry the sampled scroll\nto the reader, capture it in AXObjectCache::setFrameGeometry and expose it via\nframeViewOriginScrollPosition().\n\nAlso fix the related first-access case: when accessibility turns on, frameGeometry()\nreturned the default {0,0} origin while it kicked off the asynchronous request, so an AT\nthat walks and caches frames immediately would receive mispositioned rects. Compute the\nscreen position synchronously on that first main-thread access instead, falling back to\nthe asynchronous request only when it can't be computed in-process.\n\n* LayoutTests/accessibility/ios-simulator/local-frame-content-scroll-geometry-expected.txt: Added.\n* LayoutTests/accessibility/ios-simulator/local-frame-content-scroll-geometry.html: Added.\n* LayoutTests/accessibility/resources/scrollable-iframe-content.html: Added.\n* Source/WebCore/accessibility/AXObjectCache.cpp:\n(WebCore::AXObjectCache::setFrameGeometry):\n* Source/WebCore/accessibility/AXObjectCache.h:\n* Source/WebCore/accessibility/AccessibilityObject.cpp:\n(WebCore::AccessibilityObject::convertFrameToSpace const):\n* Source/WebCore/accessibility/AccessibilityScrollView.cpp:\n(WebCore::AccessibilityScrollView::frameGeometry const):\n(WebCore::AccessibilityScrollView::frameViewOriginScrollPosition const):\n* Source/WebCore/accessibility/AccessibilityScrollView.h:\n\nCanonical link: https://commits.webkit.org/316341@main",
      "email": "tyler_w@apple.com",
      "hash": "79927d64201a2baed8ee1604f9c46cc4aa3c14c2",
      "subject": "AX: After ACCESSIBILITY_LOCAL_FRAME, VoiceOver can read stale element geometry after a frame scrolls its own content"
    },
    "316343@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "316343@main",
      "clUrl": "https://commits.webkit.org/316343@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318334\n\nReviewed by Yusuke Suzuki.\n\nencode() (shared by encodeURIComponent / encodeURI / escape) emits each\nescaped octet with two StringBuilder appends, where the second one goes\nthrough the generic hex() adapter: it constructs a HexNumberBuffer and\nruns the out-of-line arbitrary-width hex loop plus string-adapter\ndispatch per octet. This dominates the profile on escape-heavy inputs.\n\nBuild the \"%XY\" triple on the stack with the constexpr nibble helpers\nfrom wtf/ASCIICType.h and append it once. The output is byte-identical.\n\n                                            Baseline                  Patched\n\nencode-uri-component-unicode            71.1958+-1.1739     ^     52.1049+-1.0046        ^ definitely 1.3664x faster\nencode-uri-component-query-string       78.8259+-2.7355     ^     61.2906+-1.1368        ^ definitely 1.2861x faster\n\nTests: JSTests/microbenchmarks/encode-uri-component-query-string.js\n       JSTests/microbenchmarks/encode-uri-component-unicode.js\n\n* JSTests/microbenchmarks/encode-uri-component-query-string.js: Added.\n* JSTests/microbenchmarks/encode-uri-component-unicode.js: Added.\n* Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp:\n(JSC::encode):\n\nCanonical link: https://commits.webkit.org/316343@main",
      "email": "sosuke@bun.sh",
      "hash": "c96c07c35cc49de658a762231a6f984545f714ce",
      "subject": "[JSC] Use direct 3-character append for `\"%XY\"` escapes in `encode()`"
    },
    "316344@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316344@main",
      "clUrl": "https://commits.webkit.org/316344@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315004\nrdar://177019828\n\nReviewed by Basuke Suzuki.\n\nA compromised Web Content process can cause the UI process to write attacker-chosen\nbytes to ~/Downloads/Unknown with no user interaction, no `download` attribute, and\nno Content-Disposition header. The renderer opens a popup navigation to a\ndata:application/octet-stream;base64,\u003cpayload\u003e URL; because the MIME type is not\nshowable, the navigation delegate's stock policy returns\nWKNavigationResponsePolicyDownload. WebPageProxy::receivedNavigationResponsePolicyDecision\nunconditionally mints a real DownloadProxy for the data: URL, the natural\nWebFrame::startDownload -\u003e NetworkConnectionToWebProcess::StartDownload flow runs,\nand the data: URL bytes land on disk. The renderer-supplied user-gesture token is\nforged to bypass the popup blocker; everything downstream is stock behavior.\n\nRefuse PolicyAction::Download for data: URLs in\nWebPageProxy::receivedNavigationResponsePolicyDecision unless the navigation was\ndriven by the API client. The carve-out uses Navigation::m_requestIsFromClientInput\n(set only by UIProcess paths such as -loadRequest:), not the renderer-supplied\nisRequestFromClientOrUserInput flag. Legitimate data: URL downloads via\n\u003ca href=\"data:...\" download\u003e use the navigation-action policy, and explicit downloads\nvia -[WKWebView startDownloadUsingRequest:] use a separate API path -- neither\nreaches receivedNavigationResponsePolicyDecision.\n\nAs defense in depth, also extend the existing disallowDataRequest() check in\nDocumentLoader::continueAfterContentPolicy to the PolicyAction::Download branch so\nthe same restriction that already applies to PolicyAction::Use applies to downloads.\nThe Web Content process is the compromised party in this report, so this is not the\nprimary defense, but it keeps non-Cocoa ports and future flows consistent.\n\n* Source/WebCore/loader/DocumentLoader.cpp:\n(WebCore::DocumentLoader::continueAfterContentPolicy):\n* Source/WebKit/UIProcess/API/APINavigation.h:\n(API::Navigation::isFromAPIClientRequest const):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::receivedNavigationResponsePolicyDecision):\n\nOriginally-landed-as: 305413.929@safari-7624-branch (8aeb259135a8). rdar://181074672\nCanonical link: https://commits.webkit.org/316344@main",
      "email": "cdumez@apple.com",
      "hash": "f23ffb5a845006c8efbdf8a18a15f69a617fec00",
      "subject": "Compromised Web Content can use a navigation-response Download policy on a data: URL to write attacker-controlled bytes to disk"
    },
    "316345@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "316345@main",
      "clUrl": "https://commits.webkit.org/316345@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318333\n\nReviewed by Yusuke Suzuki.\n\nWhen the multiline flag is set, the EOL string list optimization produces\nincorrect matches:\n\n    /^(?:a|a\\nx)$/m.exec(\"a\\nx\")   // actual(JIT): \"a\\nx\", expected: \"a\"\n    /^(?:a\\nb|a)$/m.exec(\"a\\nbQ\")  // actual(JIT): null,   expected: \"a\"\n\nThis patch fixes the bug by disabling the optimization when the multiline\nflag is set.\n\nTest: JSTests/stress/regexp-stringlist-eol-multiline.js\n\n* JSTests/stress/regexp-stringlist-eol-multiline.js: Added.\n(shouldBe):\n* Source/JavaScriptCore/yarr/YarrPattern.cpp:\n(JSC::Yarr::YarrPatternConstructor::checkForTerminalParentheses):\n\nCanonical link: https://commits.webkit.org/316345@main",
      "email": "sosuke@bun.sh",
      "hash": "630d6be8962a1cc6f8158ade1ea590bd5397129e",
      "subject": "[YARR] EOL string list optimization produces incorrect matches with multiline flag"
    },
    "316346@main": {
      "author": "Kiet Ho",
      "avatar": "https://www.gravatar.com/avatar/d9058b37006dce1f55f91b8ccc82f9a3?d=identicon\u0026s=64",
      "cl": "316346@main",
      "clUrl": "https://commits.webkit.org/316346@main",
      "description": "rdar://181117984\nhttps://bugs.webkit.org/show_bug.cgi?id=318330\n\nReviewed by Alan Baradlay.\n\n* Source/WebCore/rendering/TextAutoSizing.cpp:\n    - Add missing header RenderElementInlines.h, it's causing build\n      failures on my local machine.\n\nCanonical link: https://commits.webkit.org/316346@main",
      "email": "kiet.ho@apple.com",
      "hash": "dbd6abf540f48f3a6cef40371641e62bd48e73de",
      "subject": "[CMake] Fix build failures"
    },
    "316347@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316347@main",
      "clUrl": "https://commits.webkit.org/316347@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318313\nrdar://181102771\n\nReviewed by Charlie Wolfe and Abrar Rahman Protyasha.\n\ninitUIEvent takes its view argument as RefPtr\u003cWindowProxy\u003e\u0026\u0026 but assigned it\nto m_view by copy, causing needless ref-count churn. Move it into place, as\nthe two UIEvent constructors taking the same parameter already do.\n\n* Source/WebCore/dom/UIEvent.cpp:\n(WebCore::UIEvent::initUIEvent):\n\nCanonical link: https://commits.webkit.org/316347@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "6ca136fcd7bf6b7d6a5cbbe19c5e57f944584165",
      "subject": "UIEvent::initUIEvent copies RefPtr\u003cWindowProxy\u003e\u0026\u0026 viewArg instead of moving it"
    },
    "316348@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316348@main",
      "clUrl": "https://commits.webkit.org/316348@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318302\nrdar://181099545\n\nReviewed by Charlie Wolfe.\n\nPopoverData default-constructs both m_popoverState and m_visibilityState\nwithout initializers, leaving them holding indeterminate values. While\nm_popoverState is set immediately at its sole creation site,\nm_visibilityState is only assigned later when the popover is first shown\nor hidden, so isPopoverShowing() can read uninitialized memory before\nthat (e.g. togglePopover() on a freshly-attributed popover). Since\nPopoverVisibilityState is an enum : bool, a nonzero garbage byte reads\nas Showing.\n\nGive both members in-class initializers.\n\n* Source/WebCore/dom/PopoverData.h:\n\nCanonical link: https://commits.webkit.org/316348@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "0f4651107b5a20246a1d7c255c6f4902a30f9b86",
      "subject": "PopoverData::m_popoverState and m_visibilityState are uninitialized"
    },
    "316349@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316349@main",
      "clUrl": "https://commits.webkit.org/316349@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318311\nrdar://181102368\n\nReviewed by Charlie Wolfe.\n\ndidSetStringData() computed lowercasedType from type.convertToASCIILowercase()\nand then called type.convertToASCIILowercase() a second time when passing the\nargument to removeStringItemOfLowercasedType(), redundantly recomputing the\nlowercased string. Reuse the already-computed local instead.\n\nAlso capture lowercasedType by reference rather than by value in the\nremoveStringItemOfLowercasedType() findIf lambda, since the lambda runs\nsynchronously and the string outlives the call, avoiding an unnecessary\nString ref-count churn.\n\nNo change in behavior.\n\n* Source/WebCore/dom/DataTransferItemList.cpp:\n(WebCore::removeStringItemOfLowercasedType):\n(WebCore::DataTransferItemList::didSetStringData):\n\nCanonical link: https://commits.webkit.org/316349@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "10b8dc99403e192b8b8a969079e2feb72dba51ac",
      "subject": "DataTransferItemList::didSetStringData recomputes convertToASCIILowercase() instead of reusing cached value"
    },
    "316350@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316350@main",
      "clUrl": "https://commits.webkit.org/316350@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318321\nrdar://181106538\n\nReviewed by Simon Fraser.\n\nSVGMarkerElement::attributeChanged() handled the markerUnitsAttr and\norientAttr cases with an early return; instead of break;, unlike every\nother attribute and every peer resource element (pattern/mask/etc.).\nThe new base value was parsed and stored, but the return skipped the\nSVGElement::attributeChanged() call at the end of the switch, so\nsvgAttributeChanged() -\u003e invalidateMarkerResource() never ran and the\nreferencing element was not repainted until an unrelated invalidation.\n\nFix by falling through with break; so both attributes invalidate the\nmarker resource, matching the other cases.\n\nTests: svg/repaint/marker-markerUnits-dynamic-update-repaint.html\n svg/repaint/marker-orient-dynamic-update-repaint.html\n\n* LayoutTests/svg/repaint/marker-markerUnits-dynamic-update-repaint-expected.txt: Added.\n* LayoutTests/svg/repaint/marker-markerUnits-dynamic-update-repaint.html: Added.\n* LayoutTests/svg/repaint/marker-orient-dynamic-update-repaint-expected.txt: Added.\n* LayoutTests/svg/repaint/marker-orient-dynamic-update-repaint.html: Added.\n* Source/WebCore/svg/SVGMarkerElement.cpp:\n(WebCore::SVGMarkerElement::attributeChanged):\n\nCanonical link: https://commits.webkit.org/316350@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "aeebf22258151fda6a4262d15107025125332642",
      "subject": "Dynamic orient/markerUnits changes on SVGMarkerElement don't repaint referencing element"
    },
    "316351@main": {
      "author": "Yury Semikhatsky",
      "avatar": "https://www.gravatar.com/avatar/d0aee26d9689e84bd1a7f0ed8f262fe1?d=identicon\u0026s=64",
      "cl": "316351@main",
      "clUrl": "https://commits.webkit.org/316351@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=293654\n\nReviewed by Devin Rousso.\n\nEnabling the feature by default on Windows to align with Cocoa and Linux.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/316351@main",
      "email": "yurys@chromium.org",
      "hash": "d88e45cbfee4da4c0d849604285c95939fc44772",
      "subject": "[Win] Enable DataTransferItems by default"
    },
    "316352@main": {
      "author": "Cameron McCormack",
      "avatar": "https://www.gravatar.com/avatar/b2bb1b369be938a743e50f595bfa0798?d=identicon\u0026s=64",
      "cl": "316352@main",
      "clUrl": "https://commits.webkit.org/316352@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318306\nrdar://181101209\n\nReviewed by Geoffrey Garen.\n\nThe \"transform with ease at 50%\" subtest compares the ::view-transition-group()\ntransform against a live translate() reference using exact string equality. The\nmatrix components differ by very small amounts, likely due to float/double\nprecision differences. Compare the transform components with tolerance using\nassert_matrix_equals instead.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-view-transitions/dynamic-stylesheet-animations-timing-function-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-view-transitions/dynamic-stylesheet-animations-timing-function.html:\n\nCanonical link: https://commits.webkit.org/316352@main",
      "email": "heycam@apple.com",
      "hash": "9a435fce25792e3a7e4dba6a6487acc7cc76d51b",
      "subject": "View transition transform test fails due to float vs double blending precision"
    },
    "316353@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316353@main",
      "clUrl": "https://commits.webkit.org/316353@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318312\nrdar://181102600\n\nReviewed by Charlie Wolfe.\n\nupdateViewportProximity() called contains() and then ensure() on\nm_elementViewportProximities, hashing and probing the element twice.\nUse the ensure() AddResult's isNewEntry to gate the relevancy-update\nscheduling instead, collapsing it to a single lookup. No behavior change.\n\n* Source/WebCore/dom/ContentVisibilityDocumentState.cpp:\n(WebCore::ContentVisibilityDocumentState::updateViewportProximity):\n\nCanonical link: https://commits.webkit.org/316353@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "fdd7e7a09627bed6022d7dc130eb1cfd983d74d2",
      "subject": "ContentVisibilityDocumentState::updateViewportProximity does a redundant hash lookup"
    },
    "316354@main": {
      "author": "Aleksei Marchenko",
      "avatar": "https://www.gravatar.com/avatar/9a469093291c12531caccfcaa6ab73b1?d=identicon\u0026s=64",
      "cl": "316354@main",
      "clUrl": "https://commits.webkit.org/316354@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318359\nrdar://181041290\n\nReviewed by Richard Robinson.\n\n* Source/WTF/wtf/PlatformHave.h:\n\nCanonical link: https://commits.webkit.org/316354@main",
      "email": "aleksei@apple.com",
      "hash": "6fc97c210997b6adead58252222f602b670c7bd7",
      "subject": "Upstream HAVE_MODEL_MEMORY_ATTRIBUTION feature flag"
    },
    "316355@main": {
      "author": "Andres Gonzalez",
      "avatar": "https://www.gravatar.com/avatar/4e49c1280c6711bf7da7c7c121e013f6?d=identicon\u0026s=64",
      "cl": "316355@main",
      "clUrl": "https://commits.webkit.org/316355@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318346\n\u003crdar://problem/181133129\u003e\n\nReviewed by Tyler Wilcock.\n\nmacOS VoiceOver asks for the line number containing a character index via the\nAXLineForIndex parameterized attribute. WebCore already answers this on macOS\n(handleParamLineForIndexAttribute in WebAccessibilityObjectWrapperMac.mm, backed\nby AccessibilityObject::doAXLineForIndex), but the iOS accessibility wrapper had\nno equivalent, so a client on iOS could only reconstruct the line number by\nwalking line ranges. This matters for Catalyst apps whose web content reaches\nmacOS VoiceOver through the iOS-to-macOS platform translation: without a\nline-number-for-index attribute the translation has to synthesize the number by\nhopping AXTextLineRangeForPosition in the app process rather than reading it from\nthe render tree.\n\nThis patch adds -[WebAccessibilityObjectWrapper lineNumberForIndex:], computed in\nthe web process via doAXLineForIndex, returning nil when the element exposes no\nline geometry (mirroring the macOS handler, which maps a negative line to a\nmissing value). Unlike the macOS registration it is not gated on the element\nbeing a text control, so static text such as wrapped article paragraphs is\ncovered too.\n\nEnabled the existing cross-platform test accessibility/textarea-line-for-index.html\non iOS. It previously ran only on macOS because the iOS DumpRenderTree and\nWebKitTestRunner accessibility elements stubbed lineForIndex to return -1; both\nnow forward to the new lineNumberForIndex: selector, mapping a missing value back\nto -1 to match the macOS runner. The test is re-enabled over the iOS accessibility\ndirectory skip in platform/ios/TestExpectations and reuses the shared expected\nresult.\n\n* LayoutTests/platform/ios/TestExpectations:\n* Source/WebCore/accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:\n(-[WebAccessibilityObjectWrapper lineNumberForIndex:]):\n* Tools/DumpRenderTree/ios/AccessibilityUIElementIOS.mm:\n(AccessibilityUIElement::lineForIndex):\n* Tools/WebKitTestRunner/InjectedBundle/ios/AccessibilityUIElementIOS.mm:\n(AccessibilityUIElementIOS::lineForIndex):\n\nCanonical link: https://commits.webkit.org/316355@main",
      "email": "andresg_22@apple.com",
      "hash": "0556b61ecd863c668fe5442d27f06c87b16195fb",
      "subject": "AX: Expose the line number for a character index on the iOS accessibility wrapper."
    },
    "316356@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "316356@main",
      "clUrl": "https://commits.webkit.org/316356@main",
      "description": "rdar://175625015\n\nReviewed by Jean-Yves Avenard.\n\nWhile we should fix the RtpTransceiver/PeerConnection relationship in libwebrtc, we instead do a short term fix in WebCore layer by making RTCRtpTransceiver.setCodecPreferences a no-op when peer connection is destroyed or closed.\n\nTest: webrtc/transceiver-setCodecPreferences-closed.html\n\n* LayoutTests/webrtc/transceiver-setCodecPreferences-closed-expected.txt: Added.\n* LayoutTests/webrtc/transceiver-setCodecPreferences-closed.html: Added.\n* Source/WebCore/Modules/mediastream/RTCRtpTransceiver.cpp:\n(WebCore::RTCRtpTransceiver::setCodecPreferences):\n\nOriginally-landed-as: 305413.781@safari-7624-branch (456c1826db44). rdar://181076635\nCanonical link: https://commits.webkit.org/316356@main",
      "email": "youenn@apple.com",
      "hash": "a14d1c0731137bfcf330d8706fadd983b9834b17",
      "subject": "Safari \u0026 Chrome for iOS: Use-after-free in WebKit libwebrtc `RtpTransceiver` codec state reachable via `RTCRtpTransceiver.setCodecPreferences` after garbage-collected `RTCPeerConnection`"
    },
    "316357@main": {
      "author": "Alex Christensen",
      "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64",
      "cl": "316357@main",
      "clUrl": "https://commits.webkit.org/316357@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318387\nrdar://181173621\n\nReviewed by Brady Eidson.\n\nWe were sending the type across IPC as a FrameTreeSyncDataType then sending the variant,\nwith many assumptions that the two were always equal.  Since they're always supposed to be\nequal, remove the type and just use the variant's index as...its index.\n\nAlso, we were default constructing a variant, then destroying the variant's first type,\nthen calling emplace to insert the Nth type, then moving it.  Use WTF::InPlaceIndex instead,\nwhich is our version of std::in_place_index.  This saves a constructor and a destructor call,\nand it allows a possibility of a variant with no default constructable types.\n\n* Source/WebCore/Scripts/generate-process-sync-data.py:\n(generate_process_sync_client_impl):\n(generate_synched_data_header):\n(generate_process_sync_data_serialiation_in):\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::updateTopDocumentSyncData):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::broadcastFrameTreeSyncData):\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::frameTreeSyncDataChangedInAnotherProcess):\n\nCanonical link: https://commits.webkit.org/316357@main",
      "email": "achristensen@apple.com",
      "hash": "f58d3e08fbbfdc5fa9f149e12d7f83ff16bf82aa",
      "subject": "Remove redundant info when sending FrameTreeSyncSerializationData across IPC"
    },
    "316358@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "316358@main",
      "clUrl": "https://commits.webkit.org/316358@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318085\n\nReviewed by Yusuke Suzuki.\n\nSome C++ standard libraries do not know that __int128_t exists. Under the\nMicrosoft STL, std::numeric_limits\u003c__int128_t\u003e falls through to the primary\ntemplate (is_signed == false, max() == 0), so CheckedArithmetic rejected\nnegative values fed into a Checked\u003cInt128\u003e; and the STL's #pragma pack(push, 8)\nunder-aligned __int128_t members inside library templates, so e.g.\nstd::pair\u003cint64_t, Int128\u003e placed its second member at offset 8 while\nstd::get() handed out a fully aligned reference, and the 16-byte-aligned loads\nemitted through it faulted. In practice, every negative Temporal duration was\na RangeError, and Duration.prototype.round with relativeTo crashed. The\nPlayStation ports' standard library has the same numeric_limits gap. The\naligned(16) typedef workaround from webkit.org/b/274765 does not help inside\ntemplates, because template arguments are canonicalized.\n\nInstead of teaching those configurations about __int128_t, stop using it\nthere: extend the CMake __int128_t check to require a functional\nstd::numeric_limits\u003c__int128_t\u003e, so HAVE(INT128_T) is unset under the\nMicrosoft and PlayStation STLs and WTF::Int128 falls back to the software\n[U]Int128Impl, which has proper numeric_limits specializations, no alignment\nassumptions the STL cannot honor, and is already exercised by other\nconfigurations (e.g. watchOS). This also makes the clang-cl aligned-typedef\nworkaround dead, so remove it.\n\n* JSTests/stress/temporal-int128-alignment-and-limits.js: Added.\n* Source/WTF/wtf/Int128.h:\n* Source/cmake/OptionsCommon.cmake:\n* Tools/TestWebKitAPI/Tests/WTF/Int128.cpp:\n\nCanonical link: https://commits.webkit.org/316358@main",
      "email": "sosuke@bun.sh",
      "hash": "be7d4ca66743f064939eb9ed5f02b8d57661b517",
      "subject": "[WTF] `Int128` should fall back to `Int128Impl` when the standard library does not support `__int128_t`"
    },
    "316359@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "316359@main",
      "clUrl": "https://commits.webkit.org/316359@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318195\n\nReviewed by Yusuke Suzuki.\n\nSome DFG intrinsic inline paths allocate objects (iterator result objects,\niterators, result arrays) with structures from the parsing realm's global\nobject. But the spec requires creating them in the callee function's realm,\nand that is what the C++ implementations do. Since native functions from\ndifferent realms share NativeExecutables, installing another realm's method\non the caller realm's prototype reaches these inline paths, and none of the\nwatchpoints they rely on cover this. The result prototype then observably\ndiffers between DFG / FTL and lower tiers:\n\n    const other = createGlobalObject();\n    Array.prototype.slice = other.Array.prototype.slice;\n    // After DFG tier-up, Object.getPrototypeOf([1, 2, 3].slice(0))\n    // changes from other.Array.prototype to Array.prototype.\n\nExtract the existing ArrayEntries guard into calleeMayBeCrossRealm and\napply it to all intrinsics that allocate realm-owned objects: Map / Set /\nString / RegExpString iterator creation and next, ArraySlice / ArraySplice /\nArrayConcat, and ObjectKeys / ObjectGetOwnPropertyNames /\nObjectGetOwnPropertySymbols.\n\nTests: JSTests/stress/dfg-array-concat-cross-realm-species.js\n       JSTests/stress/dfg-array-slice-cross-realm-species.js\n       JSTests/stress/dfg-array-splice-cross-realm-species.js\n       JSTests/stress/dfg-map-entries-keys-values-cross-realm-iterator-object.js\n       JSTests/stress/dfg-map-set-iterator-next-cross-realm-result-object.js\n       JSTests/stress/dfg-object-get-own-property-names-cross-realm.js\n       JSTests/stress/dfg-object-get-own-property-symbols-cross-realm.js\n       JSTests/stress/dfg-object-keys-cross-realm.js\n       JSTests/stress/dfg-regexp-string-iterator-next-cross-realm-result-object.js\n       JSTests/stress/dfg-set-entries-values-cross-realm-iterator-object.js\n       JSTests/stress/dfg-string-iterator-cross-realm-iterator-object.js\n       JSTests/stress/dfg-string-iterator-next-cross-realm-result-object.js\n\n* JSTests/stress/dfg-array-concat-cross-realm-species.js: Added.\n(shouldBe):\n(test):\n* JSTests/stress/dfg-array-slice-cross-realm-species.js: Added.\n(shouldBe):\n(test):\n* JSTests/stress/dfg-array-splice-cross-realm-species.js: Added.\n(shouldBe):\n(test):\n* JSTests/stress/dfg-map-entries-keys-values-cross-realm-iterator-object.js: Added.\n(shouldBe):\n(testEntries):\n(testKeys):\n(testValues):\n* JSTests/stress/dfg-map-set-iterator-next-cross-realm-result-object.js: Added.\n(shouldBe):\n(testMap):\n* JSTests/stress/dfg-object-get-own-property-names-cross-realm.js: Added.\n(shouldBe):\n(test):\n* JSTests/stress/dfg-object-get-own-property-symbols-cross-realm.js: Added.\n(shouldBe):\n(test):\n* JSTests/stress/dfg-object-keys-cross-realm.js: Added.\n(shouldBe):\n(test):\n* JSTests/stress/dfg-regexp-string-iterator-next-cross-realm-result-object.js: Added.\n(shouldBe):\n(test):\n* JSTests/stress/dfg-set-entries-values-cross-realm-iterator-object.js: Added.\n(shouldBe):\n* JSTests/stress/dfg-string-iterator-cross-realm-iterator-object.js: Added.\n(shouldBe):\n(test):\n* JSTests/stress/dfg-string-iterator-next-cross-realm-result-object.js: Added.\n(shouldBe):\n(test):\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::calleeMayBeCrossRealm):\n(JSC::DFG::ByteCodeParser::handleIntrinsicCall):\n\nCanonical link: https://commits.webkit.org/316359@main",
      "email": "sosuke@bun.sh",
      "hash": "c2ccda5823d4f9aee4736a0d7fe326040704deb6",
      "subject": "[JSC] Some DFG intrinsics should bail out when the callee comes from another realm"
    },
    "316360@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "316360@main",
      "clUrl": "https://commits.webkit.org/316360@main",
      "description": "rdar://175520451\n\nReviewed by Jean-Yves Avenard.\n\nIf WebProcess sends an IPC message to delete unit while it is running, the unit may be destroyed in the rendering thread.\nThis will cause it to unregister itself from the AudioSession observer map, which is not thread safe and supposed to only happen in main thread.\nTo prevent this, we make sure that deleting the unit will stop the unit. This will prevent the rendering thread to have the last ref of the unit.\n\nWe add an internals API to trigger deleting a unit that is playing.\n\n* LayoutTests/fast/mediastream/delete-audio-unit-expected.txt: Added.\n* LayoutTests/fast/mediastream/delete-audio-unit.html: Added.\n* Source/WebCore/platform/mediastream/cocoa/AudioMediaStreamTrackRendererInternalUnit.h:\n(WebCore::AudioMediaStreamTrackRendererInternalUnit::deleteUnitForTesting):\n* Source/WebCore/platform/mediastream/cocoa/AudioMediaStreamTrackRendererUnit.cpp:\n(WebCore::AudioMediaStreamTrackRendererUnit::deleteUnitForTesting):\n(WebCore::AudioMediaStreamTrackRendererUnit::Unit::deleteUnitForTesting):\n* Source/WebCore/platform/mediastream/cocoa/AudioMediaStreamTrackRendererUnit.h:\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::deleteAudioUnit):\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\n* Source/WebKit/GPUProcess/webrtc/RemoteAudioMediaStreamTrackRendererInternalUnitManager.cpp:\n(WebKit::RemoteAudioMediaStreamTrackRendererInternalUnitManager::deleteUnit):\n(WebKit::RemoteAudioMediaStreamTrackRendererInternalUnitManagerUnit::RemoteAudioMediaStreamTrackRendererInternalUnitManagerUnit):\n(WebKit::RemoteAudioMediaStreamTrackRendererInternalUnitManagerUnit::~RemoteAudioMediaStreamTrackRendererInternalUnitManagerUnit):\n* Source/WebKit/WebProcess/GPU/webrtc/AudioMediaStreamTrackRendererInternalUnitManager.cpp:\n(WebKit::AudioMediaStreamTrackRendererInternalUnitManagerProxy::deleteUnitForTesting):\n\nOriginally-landed-as: 305413.814@safari-7624-branch (5503234cd8cd). rdar://180436518\nCanonical link: https://commits.webkit.org/316360@main",
      "email": "youenn@apple.com",
      "hash": "a9c37a133ad499b796b891cdfed52783586bc28c",
      "subject": "[CoreIPC] [GPUP] off-main-thread ~RemoteAudioMediaStreamTrackRendererInternalUnitManagerUnit mutates unlocked AudioSession interruption-observer WeakHashSet"
    },
    "316361@main": {
      "author": "Brady Eidson",
      "avatar": "https://www.gravatar.com/avatar/31bed81d6d8ef517f93b30add03f5651?d=identicon\u0026s=64",
      "cl": "316361@main",
      "clUrl": "https://commits.webkit.org/316361@main",
      "description": "rdar://174512192\n\nReviewed by Ben Nham and Per Arne Vollan.\n\nInstead of debug-only asserting that an updated item belongs to the process, actaully message check it.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKBackForwardListTests.mm\n\n* Source/WebKit/UIProcess/WebBackForwardList.cpp:\n(WebKit::WebBackForwardList::backForwardUpdateItem):\n* Source/WebKit/UIProcess/WebBackForwardList.swift:\n(MakeAPIArray.backForwardUpdateItem(_:frameState:)):\n* Tools/TestWebKitAPI/Tests/WebKit/WKBackForwardListTests.mm:\n(ForgedFileURLItemIsRejected)):\n\nOriginally-landed-as: 305413.830@safari-7624-branch (34c25063c9cf). rdar://180436677\nCanonical link: https://commits.webkit.org/316361@main",
      "email": "beidson@apple.com",
      "hash": "074d3804f08e1882337a3307e960ca3e356b517e",
      "subject": "Compromised WebContent process can gain arbitrary file URL access by spoofing back/forward list messages"
    },
    "316362@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "316362@main",
      "clUrl": "https://commits.webkit.org/316362@main",
      "description": "rdar://176481482\n\nReviewed by Chris Dumez.\n\nWebContent process could at any time try to establish a new service worker context connection.\nIn that case, NetworkConnectionToWebProcess would destroy any existing service worker context connection without closing it.\nWhile this should not happen in practice, a compromised WebContent process can trigger this code path.\n\nTo prevent this, NetworkConnectionToWebProcess is now message checking whether service worker has a pending connection for that domain.\nThis prevents logic failures further in networking process and UI process which might not expect the creation of a new connection.\n\nAs a further defense, we are closing any existing service worker context connection that is pre-existing.\nA future patch should MESSAGE_CHECK that there is no pre-existing service worker context connection.\n\nTest: http/tests/workers/service/service-worker-download-task-uaf.https.html\n\n* LayoutTests/http/tests/workers/service/resources/service-worker-download-task-uaf-worker.js: Added.\n(event.const.stream.new.ReadableStream.start):\n* LayoutTests/http/tests/workers/service/service-worker-download-task-uaf.https-expected.txt: Added.\n* LayoutTests/http/tests/workers/service/service-worker-download-task-uaf.https.html: Added.\n* Source/WebCore/workers/service/server/SWServer.h:\n(WebCore::SWServer::hasPendingConnectionDomain const):\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:\n(WebKit::NetworkConnectionToWebProcess::establishSWContextConnection):\n(WebKit::NetworkConnectionToWebProcess::serviceWorkerServerToContextConnectionNoLongerNeeded):\n\nOriginally-landed-as: 305413.893@safari-7624-branch (e4baf2c41a05). rdar://180437431\nCanonical link: https://commits.webkit.org/316362@main",
      "email": "youenn@apple.com",
      "hash": "a3c2559f0df096e9e3b66bed4f49fbd6713b52c7",
      "subject": "[WebKit] Use-after-free in ServiceWorkerDownloadTask via stale FunctionDispatcherQueue after second EstablishSWContextConnection"
    },
    "316363@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "316363@main",
      "clUrl": "https://commits.webkit.org/316363@main",
      "description": "rdar://175673816\n\nReviewed by Chris Dumez.\n\nReadableByteStreamController::closeAndRespondToPendingPullIntos() and\nTeeDefaultReadRequest::runCloseSteps() both call close(globalObject) with\nthe default ShouldThrowOnError::Yes flag and discard the bool return value.\nWhen the first pending pull-into has bytesFilled % elementSize != 0,\nclose() calls this-\u003eerror(), then throwException(...), and returns false —\nleaving a TypeError pending on the VM with no RETURN_IF_EXCEPTION guard in\nany caller.\n\nThe sibling BYOB path (TeeBYOBReadRequest::runCloseSteps) was fixed in\nrdar://165613840 (303821@main) to use ShouldThrowOnError::No and check the\nreturn; these two callers were not updated at the same time.\n\nThis patch mirrors the rdar://165613840 pattern at both unfixed callers:\n- Pass ShouldThrowOnError::No and check return value in both callers\n- Stop processing pending pull-intos when close() fails\n\nIt also makes ShouldThrowOnError parameter non-optional to prevent future misuse.\n\nTest: streams/byob-close-exception.html\n\n* Source/WebCore/Modules/streams/ReadableByteStreamController.cpp:\n(WebCore::ReadableByteStreamController::closeForBindings):\n(WebCore::ReadableByteStreamController::closeAndRespondToPendingPullIntos):\n* Source/WebCore/Modules/streams/ReadableByteStreamController.h:\n* Source/WebCore/Modules/streams/StreamTeeUtilities.cpp:\n(WebCore::TeeDefaultReadRequest::runCloseSteps):\n\nOriginally-landed-as: 305413.819@safari-7624-branch (cbd729a317dc). rdar://180429188\nCanonical link: https://commits.webkit.org/316363@main",
      "email": "youenn@apple.com",
      "hash": "b7516bee73066d5798581e69c381fbe25aeab58c",
      "subject": "[WebCore] unchecked exception return in ReadableByteStreamController::closeAndRespondToPendingPullIntos and TeeDefaultReadRequest::runCloseSteps"
    },
    "316364@main": {
      "author": "Charlie Wolfe",
      "avatar": "https://www.gravatar.com/avatar/857b3b5ff3394c31fa2689310a93dbab?d=identicon\u0026s=64",
      "cl": "316364@main",
      "clUrl": "https://commits.webkit.org/316364@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313085\nrdar://174405888\n\nReviewed by Sihui Liu.\n\nisFilePathAllowed() accepted any path under the per-session general storage directory or custom IDB\nstorage path. This allowed a WebContent process to read any origin's persisted data via file-backed\nblob registration.\n\nReplace the directory-level allow with per-file grants: IDB result handlers now call\nallowAccessToBlobFilesForProcess() to allow only the specific blob file paths being returned to the\nWebContent process.\n\nTest: ipc/register-file-backed-blob-path-validation.html\n\n* LayoutTests/ipc/register-file-backed-blob-path-validation-expected.txt: Added.\n* LayoutTests/ipc/register-file-backed-blob-path-validation.html: Added.\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:\n(WebKit::NetworkConnectionToWebProcess::isFilePathAllowed):\n(WebKit::NetworkConnectionToWebProcess::registerInternalFileBlobURL):\n(WebKit::NetworkConnectionToWebProcess::registerInternalBlobURLOptionallyFileBacked):\n(WebKit::NetworkConnectionToWebProcess::generalStoragePathForTesting):\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.h:\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.messages.in:\n* Source/WebKit/NetworkProcess/storage/IDBStorageConnectionToClient.cpp:\n(WebKit::IDBStorageConnectionToClient::IDBStorageConnectionToClient):\n(WebKit::IDBStorageConnectionToClient::allowAccessToResultBlobFiles):\n(WebKit::IDBStorageConnectionToClient::didGetRecord):\n(WebKit::IDBStorageConnectionToClient::didGetAllRecords):\n(WebKit::IDBStorageConnectionToClient::didOpenCursor):\n(WebKit::IDBStorageConnectionToClient::didIterateCursor):\n(WebKit::IDBStorageConnectionToClient::generateIndexKeyForRecord):\n* Source/WebKit/NetworkProcess/storage/IDBStorageConnectionToClient.h:\n* Source/WebKit/NetworkProcess/storage/IDBStorageRegistry.cpp:\n(WebKit::IDBStorageRegistry::IDBStorageRegistry):\n(WebKit::IDBStorageRegistry::ensureConnectionToClient):\n* Source/WebKit/NetworkProcess/storage/IDBStorageRegistry.h:\n* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp:\n(WebKit::NetworkStorageManager::NetworkStorageManager):\n(WebKit::NetworkStorageManager::allowAccessToBlobFilesForProcess):\n* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.h:\n\nOriginally-landed-as: 305413.737@safari-7624-branch (defe0187e742). rdar://180436541\nCanonical link: https://commits.webkit.org/316364@main",
      "email": "charliew@apple.com",
      "hash": "5be1236842b36137c9c9c85453a872e029dc6b8a",
      "subject": "Remove blanket storage-root file path allow from blob access enforcement"
    },
    "316365@main": {
      "author": "Phinehas Fuachie",
      "avatar": "https://www.gravatar.com/avatar/900d85de8c325e38975f39115c36bb75?d=identicon\u0026s=64",
      "cl": "316365@main",
      "clUrl": "https://commits.webkit.org/316365@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318402\nrdar://179348738\n\nReviewed by Aditya Keerthi.\n\nEntering element fullscreen keeps the inline parent window alive but faded out, pinned to its\npre-fullscreen size. And that inflates the region UIKit uses to place the spatial context menu,\npushing the Auto Dimming menu off to the side.\n\nShrink the faded parent to the fullscreen bounds on entry, and restore its frame before the exit\ntransition so the exit animation stays smooth.\n\n* Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm:\n(-[WKFullScreenParentWindowState initWithWindow:]):\n(-[WKFullScreenWindowController _performSpatialFullScreenTransition:completionHandler:]):\n\nCanonical link: https://commits.webkit.org/316365@main",
      "email": "pfuachie2@apple.com",
      "hash": "5f669bcf4db82cda6d4eb8b9dd56aabb38f5d987",
      "subject": "[visionOS] Auto Dimming menu is mispositioned after resizing the Safari window"
    },
    "316366@main": {
      "author": "Ari Young",
      "avatar": "https://www.gravatar.com/avatar/0cd464869823d95556c74fd9f9419f92?d=identicon\u0026s=64",
      "cl": "316366@main",
      "clUrl": "https://commits.webkit.org/316366@main",
      "description": "rdar://173603894\nhttps://bugs.webkit.org/show_bug.cgi?id=318148\n\nReviewed by Timothy Hatcher.\n\nThis patch adds WebKit support for the `browser.tabs.move` WebExtension API. To that end, add\n`webExtensionController:moveTabs:toIndex:inWindow:forExtensionContext:completionHandler:` delegate\nmethod on WKWebExtensionControllerDelegate to perform the actual move. Tabs are moved in per-window\nbatches. Per the API's documentation, if a window is specified then all listed tabs are moved to\nthat window (in one delegate call). If no window is specified, tabs are moved to that index in the\nwindow where they already are (one delegate call per window).\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPITabs.mm\n\n* Source/WebKit/UIProcess/API/Cocoa/WKWebExtensionControllerDelegatePrivate.h:\n* Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPITabsCocoa.mm:\n(WebKit::WebExtensionContext::tabsMove):\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.h:\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.messages.in:\n    Drive-by: Fix indentation\n* Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPITabsCocoa.mm:\n(WebKit::parseTabIdentifiers):\n(WebKit::WebExtensionAPITabs::move):\n(WebKit::WebExtensionAPITabs::remove):\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPITabs.h:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPITabs.idl:\n* Tools/TestWebKitAPI/Helpers/cocoa/TestWebExtensionsDelegate.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/TestWebExtensionsDelegate.mm:\n(-[TestWebExtensionsDelegate _webExtensionController:moveTabs:toIndex:inWindow:forExtensionContext:completionHandler:]):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPITabs.mm:\n(TestWebKitAPI::TEST(WKWebExtensionAPITabs, MoveSingleTabInSingleWindow)):\n(TestWebKitAPI::TEST(WKWebExtensionAPITabs, MoveSingleTabToEndOfWindow)):\n(TestWebKitAPI::TEST(WKWebExtensionAPITabs, MoveOverflowIndexClampsToEnd)):\n(TestWebKitAPI::TEST(WKWebExtensionAPITabs, MoveToCurrentIndexReturnsTab)):\n(TestWebKitAPI::TEST(WKWebExtensionAPITabs, MoveMultipleTabsReturnsArray)):\n(TestWebKitAPI::TEST(WKWebExtensionAPITabs, MoveWithoutWindowIdGroupsTabsByWindow)):\n(TestWebKitAPI::TEST(WKWebExtensionAPITabs, MoveToAnotherWindow)):\n(TestWebKitAPI::TEST(WKWebExtensionAPITabs, MoveToOrFromPopupWindowFails)):\n(TestWebKitAPI::TEST(WKWebExtensionAPITabs, MoveBetweenPrivateAndNonPrivateFails)):\n(TestWebKitAPI::TEST(WKWebExtensionAPITabs, MoveDelegateErrorIsPropagated)):\n(TestWebKitAPI::TEST(WKWebExtensionAPITabs, MoveMultiWindowGroupErrorIsPropagated)):\n(TestWebKitAPI::TEST(WKWebExtensionAPITabs, MovePrivateTabsAllowed)):\n(TestWebKitAPI::TEST(WKWebExtensionAPITabs, MoveErrors)):\n\nCanonical link: https://commits.webkit.org/316366@main",
      "email": "ari_young@apple.com",
      "hash": "9d9c4e42c34d0f8ae2db0bc6f2849371e101aa85",
      "subject": "Support browser.tabs.move(...) WebExtension API"
    },
    "316367@main": {
      "author": "Anuj Panta",
      "avatar": "https://www.gravatar.com/avatar/f795b7daddea5f93c9cbb5a4a8f0db14?d=identicon\u0026s=64",
      "cl": "316367@main",
      "clUrl": "https://commits.webkit.org/316367@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316137\nrdar://178562399\n\nReviewed by Qianlang Chen.\n\nPort the JS bridge commands onto FrameDOMAgent. resolveNode wraps a\nframe node in a RemoteObject via the frame's WebInjectedScriptManager\nand main-world global. requestNode walks an objectId back to a Node\nthrough the same manager. setInspectedNode registers the node with\nthe frame's CommandLineAPIHost so $0 resolves to it inside that\nframe's console context.\n\nOn the frontend, WI.RemoteObject.resolveNode and\nWI.DOMManager.setInspectedNode route through `owningTarget ||\nWI.assumingMainTarget()` with `backendNodeId`. pushNodeToFrontend\ntakes an optional target threaded from the originating RemoteObject\nso the requestNode lookup hits the agent that owns the objectId.\n\nSelecting a cross-origin iframe node in Elements no longer logs\n\"Cannot resolve node\" errors, the Properties sidebar populates, and\n$0 in the iframe's console context resolves to the inspected node.\n\nTest: http/tests/site-isolation/inspector/dom/js-bridge-frame-target.html\n\n* LayoutTests/http/tests/site-isolation/inspector/dom/js-bridge-frame-target-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/dom/js-bridge-frame-target.html: Added.\n* Source/JavaScriptCore/inspector/protocol/DOM.json:\n* Source/WebCore/inspector/agents/frame/FrameDOMAgent.cpp:\n(WebCore::FrameDOMAgent::willDestroyFrontendAndBackend):\n(WebCore::FrameDOMAgent::setDocument):\n(WebCore::FrameDOMAgent::resolveNodeInternal):\n(WebCore::FrameDOMAgent::nodeForObjectId):\n(WebCore::FrameDOMAgent::resolveNode):\n(WebCore::FrameDOMAgent::requestNode):\n(WebCore::FrameDOMAgent::setInspectedNode):\n* Source/WebCore/inspector/agents/frame/FrameDOMAgent.h:\n* Source/WebCore/inspector/agents/frame/FrameDOMAgentStubs.cpp:\n(WebCore::FrameDOMAgent::requestNode): Deleted.\n(WebCore::FrameDOMAgent::resolveNode): Deleted.\n(WebCore::FrameDOMAgent::setInspectedNode): Deleted.\n* Source/WebInspectorUI/UserInterface/Controllers/DOMManager.js:\n(WI.DOMManager.prototype.pushNodeToFrontend):\n(WI.DOMManager.prototype.setInspectedNode):\n* Source/WebInspectorUI/UserInterface/Protocol/RemoteObject.js:\n(WI.RemoteObject.resolveNode):\n(WI.RemoteObject.prototype.pushNodeToFrontend):\n\nCanonical link: https://commits.webkit.org/316367@main",
      "email": "a_panta@apple.com",
      "hash": "d845346ddb6c21f345369b0095da6e519b3c6e8b",
      "subject": "Web Inspector: [SI] implement resolveNode / requestNode / setInspectedNode on FrameDOMAgent"
    },
    "316368@main": {
      "author": "Kimmo Kinnunen",
      "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64",
      "cl": "316368@main",
      "clUrl": "https://commits.webkit.org/316368@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318186\nrdar://180997507\n\nReviewed by Mike Wyrzykowski.\n\nInitial support for running dEQP (OpenGL ES CTS) tests for ANGLE.\nSupports merging the local modifications to the dEQP test files.\nCurrently changes:\n - Supports linking ANGLE statically\n - Supports saving .png results with ImageIO instead of libpng\n\nRun with:\nmake debug -C ../Internal/WebKit SCHEME=\"Tools (ANGLE)\"\nSource/ThirdParty/ANGLE/WebKit/run-angle-tests --product ANGLEDeqpGLES2Tests\n\n* Source/ThirdParty/ANGLE/.gitignore:\n* Source/ThirdParty/ANGLE/ANGLE.xcodeproj/project.pbxproj:\n* Source/ThirdParty/ANGLE/Configurations/ANGLEDeqp.xcconfig: Added.\n* Source/ThirdParty/ANGLE/Configurations/ANGLEDeqpGLES2Tests.xcconfig: Added.\n* Source/ThirdParty/ANGLE/Configurations/ANGLEDeqpGLES2TestsApp.xcconfig: Added.\n* Source/ThirdParty/ANGLE/Configurations/ANGLEDeqpGLES3Tests.xcconfig: Added.\n* Source/ThirdParty/ANGLE/Configurations/ANGLEDeqpGLES3TestsApp.xcconfig: Added.\n* Source/ThirdParty/ANGLE/Configurations/ANGLEDeqpSupport.xcconfig: Added.\n* Source/ThirdParty/ANGLE/WebKit/run-angle-tests:\n(default_paths):\n(main):\n* Source/ThirdParty/ANGLE/WebKit/tcuImageIO.mm: Added.\n(tcu::ImageIO::loadImage):\n(tcu::ImageIO::loadPNG):\n(tcu::ImageIO::savePNG):\n(tcu::ImageIO::readBigEndianShort):\n(tcu::ImageIO::loadPKM):\n* Source/ThirdParty/ANGLE/WebKit/tcuMustpassGen.cpp: Added.\n(tcu::genMustpassFromSpec):\n* Source/ThirdParty/ANGLE/src/tests/deqp_support/angle_deqp_gtest.cpp:\n* Source/ThirdParty/ANGLE/src/tests/deqp_support/tcuANGLENativeDisplayFactory.cpp:\n(tcu::ANGLENativeDisplayFactory::createDisplay const):\n* Source/ThirdParty/ANGLE/third_party/VK-GL-CTS/src/*: Added\n* Source/ThirdParty/ANGLE/util/ios/ios_main.mm:\n(-[AngleUtilAppDelegate runMain]):\n* Tools/Scripts/update-angle:\n(phase_prepare):\n(_is_text_file):\n(_iter_vendored):\n(_gclient_sync):\n(phase_sync):\n(phase_thirdparty):\n(phase_finalize):\n\nCanonical link: https://commits.webkit.org/316368@main",
      "email": "kkinnunen@apple.com",
      "hash": "aa74d31bbab3d9eeac59a3fbdffea2868ce64833",
      "subject": "ANGLE: Support ANGLE dEQP tests"
    },
    "316369@main": {
      "author": "Kimmo Kinnunen",
      "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64",
      "cl": "316369@main",
      "clUrl": "https://commits.webkit.org/316369@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317923\nrdar://180717046\n\nReviewed by Mike Wyrzykowski.\n\nThe external image texture binding point was used to support\nCGL where TEXTURE_RECTANGLEs were used. Currently ANGLE\nuses just TEXTURE_2D binding points on all platforms,\nso remove the code.\n\n* Source/WebCore/Modules/webxr/WebXROpaqueFramebuffer.cpp:\n(WebCore::WebXROpaqueFramebuffer::startFrame):\n* Source/WebCore/platform/graphics/GraphicsContextGL.cpp:\n(WebCore::GraphicsContextGL::externalImageTextureBindingPoint): Deleted.\n* Source/WebCore/platform/graphics/GraphicsContextGL.h:\n* Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.cpp:\n(WebCore::GraphicsContextGLANGLE::initialize):\n(WebCore::GraphicsContextGLANGLE::reshapeFBOs):\n(WebCore::GraphicsContextGLANGLE::drawingBufferTextureTarget): Deleted.\n(WebCore::GraphicsContextGLANGLE::drawingBufferTextureBindingPoint): Deleted.\n(WebCore::GraphicsContextGLANGLE::EGLDrawingBufferTextureTargetForDrawingTarget): Deleted.\n* Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.h:\n* Source/WebCore/platform/graphics/cocoa/GraphicsContextGLCocoa.h:\n* Source/WebCore/platform/graphics/cocoa/GraphicsContextGLCocoa.mm:\n(WebCore::GraphicsContextGLANGLE::~GraphicsContextGLANGLE):\n(WebCore::GraphicsContextGLCocoa::bindNextDrawingBuffer):\n(WebCore::GraphicsContextGLCocoa::createPbufferAndAttachIOSurface):\n(WebCore::GraphicsContextGLCocoa::readCompositedResults):\n(WebCore::GraphicsContextGLCocoa::externalImageTextureBindingPoint): Deleted.\n* Source/WebCore/platform/graphics/cv/GraphicsContextGLCVCocoa.mm:\n(WebCore::GraphicsContextGLCVCocoa::GraphicsContextGLCVCocoa):\n(WebCore::GraphicsContextGLCVCocoa::copyVideoSampleToTexture):\n* Source/WebCore/platform/graphics/gbm/GraphicsContextGLTextureMapperGBM.cpp:\n(WebCore::GraphicsContextGLTextureMapperGBM::bindNextDrawingBuffer):\n* Source/WebCore/platform/graphics/texmap/GraphicsContextGLTextureMapperANGLE.cpp:\n(WebCore::GraphicsContextGLTextureMapperANGLE::platformInitialize):\n(WebCore::GraphicsContextGLTextureMapperANGLE::swapCompositorTexture):\n(WebCore::GraphicsContextGLTextureMapperANGLE::reshapeDrawingBuffer):\n* Source/WebCore/platform/graphics/texmap/coordinated/GraphicsContextGLTextureMapperANGLECoordinated.cpp:\n(WebCore::GraphicsContextGLTextureMapperANGLE::setupCurrentTexture):\n* Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGL.cpp:\n(WebKit::RemoteGraphicsContextGL::workQueueInitialize):\n* Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGLInitializationState.h:\n* Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGLInitializationState.serialization.in:\n* Source/WebKit/WebProcess/GPU/graphics/RemoteGraphicsContextGLProxy.cpp:\n(WebKit::RemoteGraphicsContextGLProxy::initialize):\n(WebKit::RemoteGraphicsContextGLProxy::externalImageTextureBindingPoint): Deleted.\n* Source/WebKit/WebProcess/GPU/graphics/RemoteGraphicsContextGLProxy.h:\n\nCanonical link: https://commits.webkit.org/316369@main",
      "email": "kkinnunen@apple.com",
      "hash": "8621b50ea2a36f48674a00466106bffedd2c22c9",
      "subject": "WebGL: Remove code related to externalImageTextureBindingPoint()"
    },
    "316370@main": {
      "author": "Ruthvik Konda",
      "avatar": "https://www.gravatar.com/avatar/bca33cefcce93017251a8fbc1204cdc4?d=identicon\u0026s=64",
      "cl": "316370@main",
      "clUrl": "https://commits.webkit.org/316370@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317146\nrdar://179744332\n\nReviewed by Anne van Kesteren.\n\nMechanical migration from brace-initialized Ref temporaries to the protect()\nfree function in Source/WebCore/svg/animation/ and Source/WebCore/svg/graphics/,\naligning with the codebase-wide transition.\n\nAll 7 instances are function arguments. In SVGFilterPrimitiveGraph.h, the\nforward declaration of SVGFilterPrimitiveStandardAttributes is replaced with\na full include so that protect() can resolve the type.\n\nNo new tests needed (no behavioral change, style-only refactor).\n\n* Source/WebCore/svg/animation/SMILTimeContainer.cpp:\n(WebCore::SMILTimeContainer::processScheduledAnimations):\n* Source/WebCore/svg/animation/SVGSMILElement.cpp:\n(WebCore::SVGSMILElement::disconnectConditions):\n* Source/WebCore/svg/graphics/filters/SVGFilterEffectGraph.h:\n(WebCore::SVGFilterEffectGraph::SVGFilterEffectGraph):\n(WebCore::SVGFilterEffectGraph::addNamedNode):\n* Source/WebCore/svg/graphics/filters/SVGFilterPrimitiveGraph.h:\n(WebCore::SVGFilterPrimitiveGraph::addNamedNode):\n* Source/WebCore/svg/graphics/filters/SVGFilterRenderer.cpp:\n(WebCore::SVGFilterRenderer::apply):\n\nCanonical link: https://commits.webkit.org/316370@main",
      "email": "rkonda2@apple.com",
      "hash": "144a04f29f5bbd9dd230d9cd89ccfc39c467bcbd",
      "subject": "Use protect() instead of Ref { } in SVG animation and graphics code"
    },
    "316371@main": {
      "author": "Carlos Alberto Lopez Perez",
      "avatar": "https://www.gravatar.com/avatar/05326c1dbe06f486e884975e73f25179?d=identicon\u0026s=64",
      "cl": "316371@main",
      "clUrl": "https://commits.webkit.org/316371@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317208\n\nReviewed by Nikolas Zimmermann.\n\nSince 315213@main in steps.py there is \"from Shared import generate_s3_url\" which ends importing boto3.\nAlso since python \u003e= 3.13 legacy-cgi is needed because that provides the cgi module in\nnewer python versions which is needed by the twisted version used with buildbot.\n\n* Tools/CISupport/start-local-buildbot-server:\n(BuildbotTestRunner._setup_virtualenv):\n\nCanonical link: https://commits.webkit.org/316371@main",
      "email": "clopez@igalia.com",
      "hash": "2d7cd0bce564a4b8e85b5ceabc196ec4c9a656f4",
      "subject": "[Tools][CISupport] start-local-buildbot-server updates for launching with python \u003e= 3.13 and after 315213@main"
    },
    "316372@main": {
      "author": "Carlos Alberto Lopez Perez",
      "avatar": "https://www.gravatar.com/avatar/05326c1dbe06f486e884975e73f25179?d=identicon\u0026s=64",
      "cl": "316372@main",
      "clUrl": "https://commits.webkit.org/316372@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318385\n\nReviewed by Philippe Normand.\n\nThis step generates a jsc-bundle and uploads it for third party tests at\nhttps://webkitgtk.org/jsc-built-products/x86_64/release/\n\nThe problem is that since we enabled assertions on post-commit release bots\nto improve our testing coverage that meant that those built-products started\nto be generated with assertions enabled.\n\nAnd we received a notification of detected performance drops with the last\nversions of those builds. That is beause of this assertions, which make jsc\nslower because it has to check multiple assertions all the time and the overall\nperformance regresses because of a death by a thousand of cuts.\n\nWe also noticed this on the Motionmark tests that the Perf test bot runs, so that\nis the reason we had to decouple the perf test bot from the default release builder,\nso the perf bot could build its own built products without asserts. See 312685@main\n\nBut we overlooked the case of this jsc built products.\n\nSo to fix this simply move this step to the packaging bots (that is where it really\nshould be) which build without assertions and at much lower frequency (once per day).\nAs a side effect of this, there will be a much more meaningful history available on\nthe download server, with ability to download old built products as far as 100 days\nold rather than only ~two days old as maximum, because those products are automatically\ncleaned by number (last ~100) and not by date, and the previous builder was uploading\nthree per hour on average. So, hopefully this would also help users to bisect more easily.\n\n* Tools/CISupport/build-webkit-org/config.json:\n* Tools/CISupport/build-webkit-org/factories_unittest.py:\n(TestExpectedBuildSteps):\n\nCanonical link: https://commits.webkit.org/316372@main",
      "email": "clopez@igalia.com",
      "hash": "61a168ecf13c414edfcf4e29cab3903c5b8cfc39",
      "subject": "[WKCI][build.webkit.org] Move the generate-jsc-bundle step from bot GTK-Linux-64-bit-Release-Build to GTK-Linux-64bit-Release-Packaging-Nightly"
    },
    "316373@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "316373@main",
      "clUrl": "https://commits.webkit.org/316373@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313702\nrdar://175673194\n\nReviewed by Aditya Keerthi.\n\nFixed the bug by deploying a smart pointer.\n\nTest: fast/events/new-focused-document-removal-during-blur-event-handler-crash.html\n\n* LayoutTests/fast/events/new-focused-document-removal-during-blur-event-handler-crash-expected.txt: Added.\n* LayoutTests/fast/events/new-focused-document-removal-during-blur-event-handler-crash.html: Added.\n* Source/WebCore/page/FocusController.cpp:\n(WebCore::FocusController::findAndFocusElementInDocumentOrderStartingWithFrame):\n\nOriginally-landed-as: 305413.804@safari-7624-branch (f9763c9248db). rdar://180428014\nCanonical link: https://commits.webkit.org/316373@main",
      "email": "rniwa@webkit.org",
      "hash": "87fedd82a16530e11847ba929c480693992c8443",
      "subject": "Use-after-free in FocusController::findAndFocusElementInDocumentOrder"
    },
    "316374@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "316374@main",
      "clUrl": "https://commits.webkit.org/316374@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=312372\u003e\n\u003crdar://174662761\u003e\n\nReviewed by Mike Wyrzykowski.\n\nAdd `!heightForMetal` check to the three 1D early-out guards in\n`Queue::writeTexture()`, consistent with the 2D and 3D cases\nthat already check both dimensions.\n\n* Source/WebGPU/WebGPU/Queue.mm:\n(WebGPU::Queue::writeTexture):\n\nOriginally-landed-as: 305413.694@safari-7624-branch (22b1d50fc728). rdar://180437434\nCanonical link: https://commits.webkit.org/316374@main",
      "email": "ddkilzer@apple.com",
      "hash": "81aff7380e1907262e8e174dd6954d9785569b8d",
      "subject": "[CoreIPC][GPU] Queue::writeTexture() 1D replaceRegion fast-path should return early when copyExtent.height is zero"
    },
    "316375@main": {
      "author": "Alejandro G. Castro",
      "avatar": "https://www.gravatar.com/avatar/c8c6e17acbdf0549b05d6f7fc2c1c4dc?d=identicon\u0026s=64",
      "cl": "316375@main",
      "clUrl": "https://commits.webkit.org/316375@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318353\n\nReviewed by Carlos Alberto Lopez Perez.\n\nWhen an editable element becomes focused, the GLib ports activate the platform\ninput method. On a Wayland compositor that provides an on-screen keyboard, this\nraises the OSK. It currently happens for every focus change, including focus\ndriven by script (element.focus()) without any user interaction. Web content\ncommonly focuses a field programmatically, on load via autofocus, on client-\nside navigation, or when a component mounts, so the on-screen keyboard is\nraised unexpectedly, covering content, even though the user never indicated an\nintent to type.\n\nOther engines, and WebKit's own iOS port, only present the keyboard when the\nfocus is the result of a user interaction (iOS gates this in\n[WKContentView _elementDidFocus:userIsInteracting:...]). The GLib ports have no\nequivalent gate: the view forwards the focused element to the input method\nunconditionally, which activates the Wayland text-input protocol and lets the\ncompositor raise the OSK.\n\nModified the API tests checking this.\n\n* Source/WebKit/WebProcess/WebPage/glib/WebPageGLib.cpp:\n(WebKit::WebPage::setInputMethodState):\n* Tools/TestWebKitAPI/Tests/WebKit/WKPage/glib/TestInputMethodContext.cpp:\n(testWebKitInputMethodContextContentType):\n\nCanonical link: https://commits.webkit.org/316375@main",
      "email": "alex@igalia.com",
      "hash": "824d8965832ac280b6a10458cd8592217f3ce517",
      "subject": "[WPE] Do not show the on-screen keyboard when an element is focused programmatically"
    },
    "316376@main": {
      "author": "Vitaly Dyachkov",
      "avatar": "https://www.gravatar.com/avatar/ab950c52088e289585a5a01580ec66a4?d=identicon\u0026s=64",
      "cl": "316376@main",
      "clUrl": "https://commits.webkit.org/316376@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318434\n\nUnreviewed test gardening.\n\n* LayoutTests/platform/glib/TestExpectations:\n\nCanonical link: https://commits.webkit.org/316376@main",
      "email": "vitaly@igalia.com",
      "hash": "b177cfe9d2afb549c799ed887ba0b45558bd88ae",
      "subject": "[WPE][GTK] `ipc/send-gpu-GetShareableBitmap-RemoteRenderingBackend.html` is almost constant crash with assertions enabled"
    },
    "316377@main": {
      "author": "Zak Ridouh",
      "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64",
      "cl": "316377@main",
      "clUrl": "https://commits.webkit.org/316377@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=312337\u003e\n\u003crdar://174646751\u003e\n\nReviewed by David Kilzer and Ryosuke Niwa.\n\nWhen libxslt fails to compile an imported stylesheet, it frees the\nimported doc. The child XSLStyleSheet's m_stylesheetDoc becomes\ndangling. If a delayed subresource later arrives and triggers\nparseString(), it dereferences the freed pointer\n\nFix with three layers of defense:\n\n1. Call clearDocuments() on the failure path in transformToString(),\n  matching the success path, to null out dangling doc pointers.\n2. Skip dict-sharing in parseString() when the parent's doc has been\n  handed to libxslt (m_stylesheetDocTaken), since libxslt may have\n  freed it.\n3. Check isLoading() in applyPendingXSLTransformsTimerFired() to\n  avoid compiling partially-loaded import chains in the first place.\n\n* LayoutTests/http/tests/xsl/resources/xslt-import-delayed-subresource-child.xsl: Added.\n* LayoutTests/http/tests/xsl/resources/xslt-import-delayed-subresource-grandchild.py: Added.\n* LayoutTests/http/tests/xsl/resources/xslt-import-delayed-subresource-root.xsl: Added.\n* LayoutTests/http/tests/xsl/resources/xslt-import-delayed-subresource-target.xml: Added.\n* LayoutTests/http/tests/xsl/xslt-import-delayed-subresource-crash-expected.txt: Added.\n* LayoutTests/http/tests/xsl/xslt-import-delayed-subresource-crash.html: Added.\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::applyPendingXSLTransformsTimerFired):\n* Source/WebCore/xml/XSLStyleSheetLibxslt.cpp:\n(WebCore::XSLStyleSheet::parseString):\n* Source/WebCore/xml/XSLTProcessorLibxslt.cpp:\n(WebCore::XSLTProcessor::transformToString):\n\nOriginally-landed-as: 305413.786@safari-7624-branch (3d12363860e5). rdar://180438169\nCanonical link: https://commits.webkit.org/316377@main",
      "email": "zakr@apple.com",
      "hash": "a8459d453b2b90948bcfd1d8620c8a1ceb266eab",
      "subject": "Heap use-after-free of XSLStyleSheet::m_stylesheetDoc after libxslt frees imported doc on compile failure"
    },
    "316378@main": {
      "author": "Per Arne Vollan",
      "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64",
      "cl": "316378@main",
      "clUrl": "https://commits.webkit.org/316378@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314948\nrdar://176912134\n\nReviewed by Alex Christensen.\n\nCheck that sandbox extensions are not empty in FormDataReference::sandboxExtensionsAreSufficient.\nWe are checking that all extensions are successfully consumed in the FormDataReference constructor.\nThis patch is also removing the validator, since all validation is performed in the constructor.\n\n* Source/WebKit/Platform/IPC/FormDataReference.serialization.in:\n* Source/WebKit/Platform/IPC/FormDataReference.h:\n(IPC::FormDataReference::sandboxExtensionsAreSufficient):\n* Source/WebKit/Platform/IPC/FormDataReference.cpp: Added.\n(IPC::FormDataReference::FormDataReference):\n(IPC::FormDataReference::sandboxExtensionHandles const):\n* Source/WebKit/Platform/IPC/FormDataReference.h:\n(IPC::FormDataReference::sandboxExtensionsAreSufficient): Deleted.\n(IPC::FormDataReference::sandboxExtensionHandles const): Deleted.\n* Source/WebKit/Sources.txt:\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n\nOriginally-landed-as: 305413.939@safari-7624-branch (2427c3fef353). rdar://180428726\nCanonical link: https://commits.webkit.org/316378@main",
      "email": "pvollan@apple.com",
      "hash": "7e6fba53a8a624ce9d7271bbf57b0cde89238e00",
      "subject": "FormDataReference validator accepts invalid sandbox extensions"
    },
    "316379@main": {
      "author": "Ruthvik Konda",
      "avatar": "https://www.gravatar.com/avatar/bca33cefcce93017251a8fbc1204cdc4?d=identicon\u0026s=64",
      "cl": "316379@main",
      "clUrl": "https://commits.webkit.org/316379@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314835\nrdar://176482961\n\nReviewed by Mike Wyrzykowski.\n\nBuffer::m_mustTakeSlowIndexValidationPath is a single per-Buffer bool that\nguards re-validation of cache-hit drawIndexed/drawIndirect calls after the\nbuffer is invalidated via writeBuffer/copyBufferToBuffer/unmap. Queue::submit\nprocesses submitted command buffers sequentially with preCommitHandler -\u003e\ncommit -\u003e postCommitHandler per buffer. The first command buffer's\npostCommitHandler clears the per-buffer flag before the second command\nbuffer's preCommitHandler reads it, so the second command buffer skips\ntakeSlowIndexValidationPath and its pre-recorded direct\ndrawIndexedPrimitives executes against rewritten OOB indices, causing a\nGPU-side out-of-bounds vertex fetch at an attacker-controlled offset.\nReachable via the public navigator.gpu API only.\n\nThe fix gates clearMustTakeSlowIndexValidationPath() on\nm_skippedValidationCommandEncoders being empty, using the existing\ncomputeSize() helper that prunes destroyed-encoder IDs. The flag now stays\nset until every encoder that was pending at invalidation time has run its\npreCommit. This is conservative: while a finished-unsubmitted command buffer\nthat cache-hit this buffer remains alive, subsequent cache-hit draws also\ntake the slow path; this fails safe (over-validates) and is bounded by\ncommand buffer lifetime.\n\nThe two raw m_mustTakeSlowIndexValidationPath = false writes in the\ndrawIndexedIndirect and drawIndirect on-commit lambdas are routed through\nthe gated accessor for the same reason.\n\n* LayoutTests/fast/webgpu/nocrash/index-buffer-invalidation-multi-command-buffer-expected.txt: Added.\n* LayoutTests/fast/webgpu/nocrash/index-buffer-invalidation-multi-command-buffer.html: Added.\n* Source/WebGPU/WebGPU/Buffer.h:\n(WebGPU::Buffer::clearMustTakeSlowIndexValidationPath): Deleted.\n* Source/WebGPU/WebGPU/Buffer.mm:\n(WebGPU::Buffer::skippedDrawIndirectIndexedValidation):\n(WebGPU::Buffer::skippedDrawIndirectValidation):\n(WebGPU::Buffer::clearMustTakeSlowIndexValidationPath):\n\nOriginally-landed-as: 305413.907@safari-7624-branch (69246dd9556c). rdar://180437229\nCanonical link: https://commits.webkit.org/316379@main",
      "email": "rkonda2@apple.com",
      "hash": "cf0a14a0f239bd54510623530f01b1ddee0214b4",
      "subject": "[WebGPU] Per-buffer m_mustTakeSlowIndexValidationPath cleared between command buffers leads to GPU OOB vertex fetch"
    },
    "316380@main": {
      "author": "Shu-yu Guo",
      "avatar": "https://www.gravatar.com/avatar/3884544eb9e557e2ec917d32c6e12720?d=identicon\u0026s=64",
      "cl": "316380@main",
      "clUrl": "https://commits.webkit.org/316380@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314002\nrdar://176129042\n\nReviewed by Darin Adler, Yijia Huang, and Yusuke Suzuki.\n\ngetByIdMegamorphic can trigger user-defined getters, which can throw, and so\nneeds a throw scope.\n\nTest: JSTests/stress/megamorphic-get-by-id-overrides-getter-exception-check.js\n\n* JSTests/stress/megamorphic-get-by-id-overrides-getter-exception-check.js: Added.\n(megamorphicGetById.get obj):\n(megamorphicGetById):\n* Source/JavaScriptCore/jit/JITOperations.cpp:\n(JSC::getByIdMegamorphic):\n\nOriginally-landed-as: 305413.833@safari-7624-branch (6e81451ccd9a). rdar://180436734\nCanonical link: https://commits.webkit.org/316380@main",
      "email": "syg@apple.com",
      "hash": "f9e6d8b3c7e64475df6f44246055d2c86de86ba1",
      "subject": "[JSC] getByIdMegamorphic needs a throw scope"
    },
    "316381@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316381@main",
      "clUrl": "https://commits.webkit.org/316381@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318413\nrdar://181130091\n\nReviewed by Youenn Fablet.\n\n315450@main relaxed makeStoreDecision() to store any response carrying explicit\nfreshness regardless of status code, dropping the isStatusCodePotentiallyCacheable()\nallowlist. This unintentionally made 304 (Not Modified) responses storable.\n\nWhen a revalidation is driven by the memory cache, the conditional request reaches the\nnetwork process as originalRequest().isConditional(). After applying the 304 to the\nexisting entry via Cache::update(), NetworkResourceLoader clears m_cacheEntryForValidation\n(to forward the 304 to WebCore) and falls through to tryStoreAsCacheEntry(). Because the\n304 carries Cache-Control: max-age / Expires, makeStoreDecision() now returned Yes, and\nthe 304 -- which has no body -- was stored over the good entry with an empty body. The\nempty entry is fresh, so it is served on every subsequent load: pages render broken\n(e.g. stylesheets come back empty / with the wrong MIME type) and stay broken across\nreloads until the cache is cleared. Private browsing is unaffected because it does not\nuse the persistent disk cache.\n\nFix: makeStoreDecision() never stores a 304. A 304 is a validation response, not a\ncomplete representation; a successful revalidation is applied to the stored entry via\nCache::update(). Cache::store() already treats a non-Yes decision on a 304 as a\nsuccessful revalidation, so the just-updated entry is preserved rather than evicted.\n\nBecause the regression was in the tree for a while, some users already have poisoned\n304 entries in their disk cache. Add a temporary workaround to discard any 304 entry read\nback from the disk cache -- in both the normal (Cache::retrieve) and speculative\n(SpeculativeLoadManager::retrieveEntryFromStorage) retrieval paths -- so the resource is\nre-fetched and the entry heals itself. Returning false purges the poisoned record. This\nis safe because a legitimately stored entry never has a 304 status. The workaround is\nannotated with rdar://181130091 and a FIXME to remove it once affected caches age out.\n\nTest: memory-cache-revalidation-preserves-disk-cache-body.html exercises a memory-cache\nrevalidation whose 304 updates the disk cache, then clears the memory cache and asserts\nthe resource is still served intact from disk (\"Disk cache\", full body). It fails without\nthe fix (empty body); it also fails with only the workaround (served \"Network\" instead of\n\"Disk cache\"), confirming the test gates the fix and is not masked by the workaround.\n\nTest: http/tests/cache/disk-cache/memory-cache-revalidation-preserves-disk-cache-body.html\n\n* LayoutTests/http/tests/cache/disk-cache/memory-cache-revalidation-preserves-disk-cache-body-expected.txt: Added.\n* LayoutTests/http/tests/cache/disk-cache/memory-cache-revalidation-preserves-disk-cache-body.html: Added.\n* Source/WebKit/NetworkProcess/cache/NetworkCache.cpp:\n(WebKit::NetworkCache::makeStoreDecision):\n(WebKit::NetworkCache::Cache::retrieve):\n* Source/WebKit/NetworkProcess/cache/NetworkCache.h:\n* Source/WebKit/NetworkProcess/cache/NetworkCacheSpeculativeLoadManager.cpp:\n(WebKit::NetworkCache::SpeculativeLoadManager::retrieveEntryFromStorage):\n\nCanonical link: https://commits.webkit.org/316381@main",
      "email": "cdumez@apple.com",
      "hash": "ea125d52f300b8e221b6a54aa9731d45df85d36a",
      "subject": "Regression(315450@main) boingboing.net articles often load without style"
    },
    "316382@main": {
      "author": "Geoffrey Garen",
      "avatar": "https://www.gravatar.com/avatar/9f2ee1a184d00263dc68af055f15b697?d=identicon\u0026s=64",
      "cl": "316382@main",
      "clUrl": "https://commits.webkit.org/316382@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317900\nrdar://180679157\n\nReviewed by Tim Nguyen, Kiet Ho, Tim Horton, and Elliott Williams.\n\nBased on feedback by Karl Dubost.\n\n* Tools/Scripts/analyze-safer-cpp: Explain why we need such a large\ndownload, and make 'Yes' the default since 'No' will just exit the tool.\n\nCanonical link: https://commits.webkit.org/316382@main",
      "email": "ggaren@apple.com",
      "hash": "6e9465ba37080413fabdb24ace032a2a92a52690",
      "subject": "Clarify the analyze-safer-cpp download prompt"
    },
    "316383@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316383@main",
      "clUrl": "https://commits.webkit.org/316383@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312459\nrdar://174651133\n\nReviewed by Ryosuke Niwa.\n\nWhen Permissions::query() is called in a worker, we would dispatch a lambda\nto the main thread, get the information and then try to go back to the\nworker thread using ScriptExecutionContext::postTaskTo() in order to\ncall the promise with the result. However, in case of worker termination,\nScriptExecutionContext::postTaskTo() would fail and the lambda would get\ndestroyed on the main thread, without getting called. This would lead to\na security bug because the lambda was capturing the promise object which\nis a worker object and thus should not get destroyed on the main thread.\n\nTo address the issue, we now store the promise in a HashMap on the\nPermissions object. We then capture a promise identifier in the lambda\ninstead of the promise. In the ~Permissions() destructor, if there are\npending promises, we reject them.\n\nI made the following changes also:\n1. I used `Ref\u003cDeferredPromise\u003e` type for the promise instead of\n   `DOMPromiseDeferred\u003cIDLInterface\u003cPermissionStatus\u003e\u003e` so that I could\n   store the promise in a HashMap.\n2. There was a LOT of code duplication in Permissions::query() for the\n   main thread code path and the worker code path. I merged them so we\n   now have a single code path for both. This simplifies things a lot.\n\nTest: workers/permissions-query-crash.html\n\n* LayoutTests/workers/permissions-query-crash-expected.txt: Added.\n* LayoutTests/workers/permissions-query-crash.html: Added.\n* Source/WebCore/Modules/permissions/NavigatorPermissions.h:\n* Source/WebCore/Modules/permissions/Permissions.cpp:\n(WebCore::determineGeolocationPermissionState):\n(WebCore::Permissions::~Permissions):\n(WebCore::processPermissionQueryResult):\n(WebCore::Permissions::query):\n* Source/WebCore/Modules/permissions/Permissions.h:\n\nOriginally-landed-as: 305413.686@safari-7624-branch (f7d3c0785bb0). rdar://180428980\nCanonical link: https://commits.webkit.org/316383@main",
      "email": "cdumez@apple.com",
      "hash": "4aaa3c1477e296e67b03e1461479b8caf57c37dd",
      "subject": "UAF in WebContent due to Cross-thread destruction race of worker DeferredPromise via Permissions::query() + worker.terminate()"
    },
    "316384@main": {
      "author": "Basuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/5192a1151c7575317affb7a4633f8d63?d=identicon\u0026s=64",
      "cl": "316384@main",
      "clUrl": "https://commits.webkit.org/316384@main",
      "description": "rdar://174662982\n\nReviewed by Chris Dumez.\n\nA compromised WebContent process can inject arbitrary file paths in\nEncodedFileData within the HTTP body of DecidePolicyForNavigationActionAsync,\ncausing the UIProcess to mint sandbox extension tokens for those paths during\nPSON. Add MESSAGE_CHECK_COMPLETION to validate each EncodedFileData filename\nagainst hasGrantedSandboxExtensionForFile().\n\nRegister user-selected file paths via addPreviouslyApprovedFileURL() in\ndidChooseFilesForOpenPanel (3 variants) and performDragOperation (covers\nboth macOS and iOS drag-and-drop). Use URL::fileURLWithFileSystemPath()\nsince these parameters are file system paths, not file URLs.\n\nThe API test is a regression test verifying that cross-site form submission\nwith file upload succeeds after the fix — it does not test the negative\n(MESSAGE_CHECK failure) path.\n\nTest: Tools/TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::performDragOperation):\n(WebKit::WebPageProxy::decidePolicyForNavigationAction):\n(WebKit::WebPageProxy::didChooseFilesForOpenPanelWithDisplayStringAndIcon):\n(WebKit::WebPageProxy::didChooseFilesForOpenPanelWithImageTranscoding):\n(WebKit::WebPageProxy::didChooseFilesForOpenPanel):\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::hasGrantedSandboxExtensionForFile const):\n* Source/WebKit/UIProcess/WebProcessProxy.h:\n* Tools/TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm:\n(-[FileUploadPSONUIDelegate webView:runOpenPanelWithParameters:initiatedByFrame:completionHandler:]):\n((ProcessSwap, SwapOnFormSubmissionWithFileUpload)):\n\nOriginally-landed-as: 305413.699@safari-7624-branch (3dad3d258fe6). rdar://180436266\nCanonical link: https://commits.webkit.org/316384@main",
      "email": "basuke@apple.com",
      "hash": "198d4dbb7907f973cc0f697e50b425ee32506a9b",
      "subject": "Validate EncodedFileData filenames in decidePolicyForNavigationAction"
    },
    "316385@main": {
      "author": "Ruthvik Konda",
      "avatar": "https://www.gravatar.com/avatar/bca33cefcce93017251a8fbc1204cdc4?d=identicon\u0026s=64",
      "cl": "316385@main",
      "clUrl": "https://commits.webkit.org/316385@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313528\nrdar://175171873\n\nReviewed by Chris Dumez.\n\nWaveShaperProcessor::m_curve was a RefPtr\u003cFloat32Array\u003e. Float32Array inherits\nRefCounted\u003cArrayBufferView\u003e, whose refcount is non-atomic. 296577@main changed\nthe audio-thread readers in WaveShaperDSPKernel::processCurve and\nWaveShaperNode::propagatesSilence to wrap waveShaperProcessor()-\u003ecurve() in a\nlocal RefPtr; the main-thread getter WaveShaperNode::curveForBindings() already\ndid the same lockless. The concurrent non-atomic ref/deref races; a lost\nincrement leaves the count one too low; a subsequent deref frees m_curve out\nfrom under the processor; the next render quantum is a heap-use-after-free in\nprocessCurve.\n\nOn builds with ENABLE(SECURITY_ASSERTIONS), RefCountDebugger's threading\nchecker traps first; on plain Release the UAF is reachable from web content via\nOfflineAudioContext + the WaveShaperNode.curve getter.\n\nFix by storing the curve as Vector\u003cfloat\u003e instead of RefPtr\u003cFloat32Array\u003e. The\ninternal curve was already cloned on set and on get, so the Float32Array wrapper\nwas vestigial. With a Vector there is no RefCounted object on the audio-thread\npath; m_processLock continues to guard buffer replacement against audio-thread\nreads. This matches AudioParamTimeline::ParamEvent::m_curve and\nIIRProcessor::m_feedforward.\n\nTest: webaudio/WaveShaper/waveshaper-curve-getter-during-rendering-crash.html\n* LayoutTests/webaudio/WaveShaper/waveshaper-curve-getter-during-rendering-crash-expected.txt: Added.\n* LayoutTests/webaudio/WaveShaper/waveshaper-curve-getter-during-rendering-crash.html: Added.\n* Source/WebCore/Modules/webaudio/WaveShaperDSPKernel.cpp:\n(WebCore::WaveShaperDSPKernel::processCurve):\n* Source/WebCore/Modules/webaudio/WaveShaperNode.cpp:\n(WebCore::WaveShaperNode::setCurveForBindings):\n(WebCore::WaveShaperNode::curveForBindings):\n(WebCore::WaveShaperNode::propagatesSilence const):\n* Source/WebCore/Modules/webaudio/WaveShaperNode.h:\n* Source/WebCore/Modules/webaudio/WaveShaperProcessor.cpp:\n(WebCore::WaveShaperProcessor::setCurveForBindings):\n* Source/WebCore/Modules/webaudio/WaveShaperProcessor.h:\n(WebCore::WaveShaperProcessor::curveForBindings const):\n(WebCore::WaveShaperProcessor::curve const):\n(WebCore::WaveShaperProcessor::curveForBindings): Deleted.\n\nOriginally-landed-as: 305413.793@safari-7624-branch (0dcea6bac528). rdar://181076704\nCanonical link: https://commits.webkit.org/316385@main",
      "email": "rkonda2@apple.com",
      "hash": "8912cf5b00c44e5c81ba047c9b3ec32f4135d437",
      "subject": "[WebCore] Store WaveShaperProcessor curve as Vector\u003cfloat\u003e to avoid cross-thread RefCounted race"
    },
    "316386@main": {
      "author": "Per Arne Vollan",
      "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64",
      "cl": "316386@main",
      "clUrl": "https://commits.webkit.org/316386@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313250\nrdar://174408804\n\nReviewed by Chris Dumez.\n\nCheck that local paths are not in the block-list before continuing the load.\n\nTest: WebKit.FetchCookieFile\n\n* Source/WTF/wtf/PlatformEnableCocoa.h:\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:\n(WebKit::NetworkResourceLoader::isLocalFileLoadAllowed):\n(WebKit::NetworkResourceLoader::startNetworkLoad):\n(WebKit::NetworkResourceLoader::isLocalFileLoadAllowedWithoutSandboxExtension): Deleted.\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.h:\n* Tools/TestWebKitAPI/Tests/WebKit/FetchLocalFile.mm:\n(TEST(WebKit, FetchLocalFile)):\n(TEST(WebKit, FetchLocalFileInParentDirectory)):\n\nOriginally-landed-as: 305413.827@safari-7624-branch (24aaa6e88016). rdar://180437879\nCanonical link: https://commits.webkit.org/316386@main",
      "email": "pvollan@apple.com",
      "hash": "442b80b2316837ae262d862bf3726ee534f1a31f",
      "subject": "[macOS] Enable feature to block local file loads without a sandbox extension"
    },
    "316387@main": {
      "author": "Zak Ridouh",
      "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64",
      "cl": "316387@main",
      "clUrl": "https://commits.webkit.org/316387@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=312336\u003e\n\u003crdar://174670323\u003e\n\nReviewed by Mike Wyrzykowski.\n\nPipelineLayout::makeInvalid() cleared the bind group layouts vector but left the\nstd::optional engaged. This caused errorValidatingBindGroupCompatibility() to see\nan engaged-but-empty vector, skip its validation loop entirely, and return success.\nA poisoned pipeline layout could then reach Metal dispatch with a structurally\nincompatible argument buffer bound, causing GPU-side out-of-bounds access.\n\nThe trigger is getBindGroupLayout(index) with an index \u003e= maxBindGroups, which\ncalls makeInvalid() on the pipeline layout. This is reachable from web content\nvia the standard WebGPU API.\n\nApplied three defense-in-depth fixes:\n\n1. PipelineLayout::makeInvalid(): reset m_bindGroupLayouts to std::nullopt\n   instead of clearing the vector, so the optional is fully disengaged.\n2. PipelineLayout::errorValidatingBindGroupCompatibility(): early-return an\n   error if !m_isValid, before inspecting the bind group layouts at all.\n3. ComputePassEncoder::executePreDispatchCommands(),\n   RenderPassEncoder::executePreDrawCommands(), and\n   RenderBundleEncoder::executePreDrawCommands(): check pipeline-\u003eisValid()\n   after the existing null check, rejecting pipelines whose layout has been\n   invalidated between setPipeline and the dispatch/draw.\n\nTests:\n- fast/webgpu/regression/pipeline-layout-make-invalid-bind-group-bypass.html\n  exercises the security fix (poisoned layout must not reach Metal).\n- fast/webgpu/regression/extra-bind-group-beyond-pipeline-layout.html guards\n  the spec-permitted case where bind groups are bound at indices beyond the\n  pipeline's numberOfBindGroupLayouts() — these must continue to be silently\n  ignored at dispatch time. (Caught a transient regression of this case\n  during development; added to prevent recurrence.)\n\n* LayoutTests/fast/webgpu/regression/extra-bind-group-beyond-pipeline-layout-expected.txt: Added.\n* LayoutTests/fast/webgpu/regression/extra-bind-group-beyond-pipeline-layout.html: Added.\n* LayoutTests/fast/webgpu/regression/pipeline-layout-make-invalid-bind-group-bypass-expected.txt: Added.\n* LayoutTests/fast/webgpu/regression/pipeline-layout-make-invalid-bind-group-bypass.html: Added.\n* Source/WebGPU/WebGPU/ComputePassEncoder.mm:\n(WebGPU::ComputePassEncoder::executePreDispatchCommands):\n* Source/WebGPU/WebGPU/PipelineLayout.mm:\n(WebGPU::PipelineLayout::makeInvalid):\n(WebGPU::PipelineLayout::errorValidatingBindGroupCompatibility const):\n* Source/WebGPU/WebGPU/RenderBundleEncoder.mm:\n(WebGPU::RenderBundleEncoder::executePreDrawCommands):\n* Source/WebGPU/WebGPU/RenderPassEncoder.mm:\n(WebGPU::RenderPassEncoder::executePreDrawCommands):\n\nOriginally-landed-as: 305413.848@safari-7624-branch (f4805607466f). rdar://180436205\nCanonical link: https://commits.webkit.org/316387@main",
      "email": "zakr@apple.com",
      "hash": "97e8c4b43c17c90c622ce09040fb40df0f2668f6",
      "subject": "[WebGPU] PipelineLayout::makeInvalid leaves m_bindGroupLayouts engaged, causing GPU OOB"
    },
    "316388@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316388@main",
      "clUrl": "https://commits.webkit.org/316388@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315167\nrdar://177367508\n\nReviewed by Per Arne Vollan.\n\nA compromised WebContent process can send WebPageProxy::CreateNewPage with\nan arbitrary file path in the request body's EncodedFileData. When the UI\nprocess re-emits that request via loadRequest(), encoding the\nLoadParameters runs FormDataReference::sandboxExtensionHandles() in the UI\nprocess, which calls SandboxExtension::createHandle() on the\nattacker-supplied path and serializes a live com.apple.app-sandbox.read\ntoken to a WebContent process — a full sandbox escape to arbitrary host\nfilesystem read.\n\nAdd a MESSAGE_CHECK_COMPLETION at the top of createNewPage() that calls\nWebProcessProxy::hasGrantedSandboxExtensionForFile() on every\nEncodedFileData filename in the request body, rejecting any path the\nsending WebContent process was never granted access to. This mirrors the\nequivalent check rdar://174662982 added to decidePolicyForNavigationAction().\n\nTest: http/tests/ipc/createnewpage-file-body-sandbox-extension.html\n\n* LayoutTests/http/tests/ipc/createnewpage-file-body-sandbox-extension-expected.txt: Added.\n* LayoutTests/http/tests/ipc/createnewpage-file-body-sandbox-extension.html: Added.\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::createNewPage):\n\nOriginally-landed-as: 305413.942@safari-7624-branch (77fa86c2ea4d). rdar://180435897\nCanonical link: https://commits.webkit.org/316388@main",
      "email": "cdumez@apple.com",
      "hash": "826d21ff7df9be21b09789edffd57dba86b3cc5e",
      "subject": "[WebKit Process Model] WebPageProxy::createNewPage missing hasGrantedSandboxExtensionForFile check on NavigationActionData.request httpBody"
    },
    "316389@main": {
      "author": "Cole Carley",
      "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64",
      "cl": "316389@main",
      "clUrl": "https://commits.webkit.org/316389@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316725\nrdar://179172629\n\nReviewed by Yusuke Suzuki.\n\nImplement the Table64 JS API.\n\nTest: JSTests/wasm/js-api/table64-js-api.js\n\n* JSTests/wasm/js-api/table.js:\n(assert.truthy):\n* JSTests/wasm/js-api/table64-js-api.js: Added.\n(assert.eq.table.type):\n(assert.eq):\n(assert.throws):\n* Source/JavaScriptCore/wasm/WasmFormat.h:\n(JSC::Wasm::TableInformation::TableInformation):\n(JSC::Wasm::TableInformation::isTable64 const):\n(JSC::Wasm::TableInformation::addressType const):\n* Source/JavaScriptCore/wasm/WasmSectionParser.cpp:\n(JSC::Wasm::SectionParser::parseTableHelper):\n* Source/JavaScriptCore/wasm/WasmTable.cpp:\n(JSC::Wasm::Table::Table):\n(JSC::Wasm::Table::tryCreate):\n(JSC::Wasm::ExternOrAnyRefTable::ExternOrAnyRefTable):\n(JSC::Wasm::FuncRefTable::FuncRefTable):\n(JSC::Wasm::FuncRefTable::createFixedSized):\n* Source/JavaScriptCore/wasm/WasmTable.h:\n(JSC::Wasm::Table::addressType const):\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyTable.cpp:\n(JSC::JSWebAssemblyTable::type):\n* Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp:\n(JSC::WebAssemblyModuleRecord::initializeExports):\n* Source/JavaScriptCore/wasm/js/WebAssemblyTableConstructor.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n\nCanonical link: https://commits.webkit.org/316389@main",
      "email": "ccarley2@apple.com",
      "hash": "1152f3717e9b65ac9c329f3966e3733d62ce27d4",
      "subject": "Implement Table64 JS API"
    },
    "316390@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316390@main",
      "clUrl": "https://commits.webkit.org/316390@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318288\nrdar://181073565\n\nReviewed by Eric Carlson.\n\nTimeLabel's `value` setter unconditionally marked the \"value\" property\ndirty, so it was re-committed on every layout even when the displayed\nvalue had not changed. Because TimeControl._performIdealLayout() writes\neach label's value on every layout, and layout runs on each timeupdate,\nthis repeatedly performed two independent formatting passes\n(Intl.DurationFormat for textContent and formattedStringForDuration for\nthe aria-label) plus a setAttribute, all producing identical output.\n\nEarly-return from the setter when the value is unchanged, treating NaN\nas equal to NaN so a loading label held at NaN also stops re-formatting.\n\nTest: media/modern-media-controls/time-label/time-label-value-dedupes.html\n\n* LayoutTests/media/modern-media-controls/time-label/time-label-value-dedupes-expected.txt: Added.\n* LayoutTests/media/modern-media-controls/time-label/time-label-value-dedupes.html: Added.\n* Source/WebCore/Modules/modern-media-controls/controls/time-label.js:\n(TimeLabel.prototype.set value):\n\nCanonical link: https://commits.webkit.org/316390@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "c8e5a371ab3ea0972719c4917b0b62757a332b90",
      "subject": "TimeLabel re-formats on every timeupdate when its value is unchanged"
    },
    "316391@main": {
      "author": "Per Arne Vollan",
      "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64",
      "cl": "316391@main",
      "clUrl": "https://commits.webkit.org/316391@main",
      "description": "rdar://178568342\nhttps://bugs.webkit.org/show_bug.cgi?id=316262\n\nReviewed by Chris Dumez\n\nIn rdar://174670487, we compiled a list of paths where the Networking process has unconditional sandbox\naccess, and blocked files from under these paths to be uploaded. In this list we also included the\nparent of the temp folder of the Networking process. This is too restrictive, since WKFileUploadPanel\nplaces files under that directory for uploads. We should only include the actual temp folder of the\nNetworking folder in this list.\n\nThe reason we used the parent folder, was that the Networking process is actually granted read access\nto the parent of its temp folder as well. This sandbox extension from the UI process should also be\nremoved, but that is out of scope for now. This is being tracked in rdar://178551436.\n\nTest: Tools/TestWebKitAPI/Tests/WebKitCocoa/UploadDirectory.mm\n\n* Source/WebKit/NetworkProcess/NetworkProcess.cpp:\n(WebKit::addPathsBlockedForSandboxExtensions):\n* Tools/TestWebKitAPI/Tests/WebKitCocoa/UploadDirectory.mm:\n(TEST(WebKit, AllowTempUploadDirectory)):\n\nOriginally-landed-as: 305413.881@safari-7624.4-branch (439d7dfd8a9e). rdar://181073758\nCanonical link: https://commits.webkit.org/316391@main",
      "email": "pvollan@apple.com",
      "hash": "e66a3f3e64dc73619754a681d54a11428e430338",
      "subject": "Unable to upload PDF file on iOS"
    },
    "316392@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "316392@main",
      "clUrl": "https://commits.webkit.org/316392@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318358\nrdar://problem/181150143\n\nReviewed by Alan Baradlay.\n\nRenderGrid cached the grid formatting context (GFC) coverage decision in\nm_hasGridFormattingContextLayout and only computed it once, when the optional\nhad no value. A positive decision was therefore never re-evaluated, so a grid\nthat qualified for the GFC path on its first layout kept using it even after its\ncontent mutated into something the GFC path does not support (for example a grid\nitem gaining a max-width). That eventually reached unfinished GFC code and\ncrashed.\n\nMatch what RenderFlexibleBox::layoutUsingFlexFormattingContext already does:\nonly make a negative decision sticky (a perf guard, since unsupported content\nstays unsupported) and re-run canUseForGridLayout whenever the grid previously\nused, or has not yet evaluated, the GFC path.\n\nRe-checking coverage exposed a second crash. At the end of a GFC layout,\nGridLayout::updateFormattingContextRootRenderer marks the legacy grid as placed\nwithout populating it, since the GFC path does not rely on the legacy grid\nstate. When we then fall back to the legacy layout, placeItemsOnGrid saw the\ngrid as already placed and returned early, leaving the track lists empty and\ncrashing in gridAreaBreadthForGridItemIncludingAlignmentOffsets. Add\nGridLayout::invalidateFormattingContextRootRenderer to revert that stale state\non fallback so the legacy path re-places the items and rebuilds its tracks.\n\nCanonical link: https://commits.webkit.org/316392@main",
      "email": "sammy.gill@apple.com",
      "hash": "0768bc0b4089e320b1132cdba41c2240bbe56f37",
      "subject": "[GFC] Modern grid layout may incorrectly run when content mutates"
    },
    "316393@main": {
      "author": "Sam Weinig",
      "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64",
      "cl": "316393@main",
      "clUrl": "https://commits.webkit.org/316393@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318231\n\nReviewed by Antoine Quint.\n\nMoves use of Style::deprecatedToStyle out of \u003ckeyframe-selector\u003e parsing and\ndown into the places where the keyframes are processed.\n\nThis allows us to better understand what code needs to change to actually\nresolve the deprecated conversion.\n\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/css/values/primitives/CSSPrimitiveNumeric+Forward.h: Added.\n    - Adds CSSPrimitiveNumeric+Forward.h, modeled on StylePrimitiveNumeric+Forward.h.\n\n* Source/WebCore/css/values/primitives/CSSPrimitiveNumeric.h:\n    - Renames CSS::dynamicRangecast to CSS::dynamicRangeNarrowingCast and restricts it to cases\n      where the range is getting narrowed (e.g. CSS::All to CSS::Nonnegative).\n    - Adds CSS::rangeExpandingCast, restricted to expanding range ranges.\n\n* Source/WebCore/css/values/primitives/CSSPrimitiveNumericRange.h:\n    - Add some helpers for use in range cast restrictions.\n\n* Source/WebCore/css/CSSKeyframeRule.cpp:\n* Source/WebCore/css/CSSKeyframeRule.h:\n    - Stores parsed offset as a CSS::Percentage\u003c\u003e instead of a double in StyleRuleKeyframe::Key.\n\n* Source/WebCore/animation/BlendingKeyframes.h:\n* Source/WebCore/animation/BlendingKeyframes.cpp:\n    - Use Style::Percentage\u003c\u003e for the specified offset value. In a followup, changing the\n      computed offset to use Markable\u003cStyle::Percentage\u003c\u003e\u003e would be a good additional improvement.\n\n* Source/WebCore/animation/KeyframeEffect.cpp:\n    - Perform the deprecated style conversion, clamping to 0-100 when appropriate.\n\n* Source/WebCore/style/StyleResolver.cpp:\n    - Perform the deprecated style conversion, clamping to 0-100 when appropriate.\n    - Remove custom traits for StyleRuleKeyframe::Key by utilizing the built in std::tuple traits\n      already being used.\n\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Animations.cpp:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Animations.h:\n    - Remove use of deprecatedToStyle(), returning CSS::Percentage\u003c\u003e instead.\n\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Grid.cpp:\n    - Update for rename to CSS::dynamicRangeNarrowingCast.\n\n* Source/WebCore/style/values/animations/StyleSingleAnimationRangeName.h:\n    - Add trivial traits for the SingleAnimationRangeName enum.\n\nCanonical link: https://commits.webkit.org/316393@main",
      "email": "sam@webkit.org",
      "hash": "f9519e7ea110c2e4e06f3a34a690b0f596a3f879",
      "subject": "Move use of deprecatedToStyle out of CSS keyframe selector parsing"
    },
    "316394@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "316394@main",
      "clUrl": "https://commits.webkit.org/316394@main",
      "description": "rdar://180505014\nhttps://bugs.webkit.org/show_bug.cgi?id=317747\n\nReviewed by Eric Carlson.\n\nMicrophone capture requires the AudioSession to stay active for the duration of the capture.\nThe WebProcess can drop the AudioSession in two cases that were not properly guarded against ongoing capture:\n1. Process suspension. MediaSessionManagerInterface::processWillSuspend() unconditionally calls maybeDeactivateAudioSession(),\n   which would teardown the AudioSession even when an audio capture source was active.\n   This is not supposed to happen as a process that capture microphone should not get suspended.\n2. Removal of the last PlatformMediaSession (e.g. a \u003cvideo\u003e ending) while capture is ongoing.\n   removeSession() called maybeDeactivateAudioSession() guarded by an inline activeAudioSessionRequired() check,\n   but the same logic was duplicated at every call site of maybeDeactivateAudioSession.\n\nIn addition, UserMediaRequest::allow() activated the AudioSession by calling AudioSession::singleton().tryToSetActive(true) directly,\nbypassing MediaSessionManagerInterface entirely. This left m_becameActive out of sync with the actual AudioSession state.\n\nThis PR centralizes the \"is capture or another session keeping the AudioSession alive?\" check inside maybeDeactivateAudioSession() itself,\nso every caller (process suspension, session removal, capture state change) is consistently protected.\nCall sites that duplicated the check are simplified.\nIn the process suspension case, we keep deactivating the audio session using ShouldCheckRequiredSession::No to keep existing tests happy,\nin particular platform/mac/media/audio-session-deactivated-when-suspended.html.\nA future PR should properly mute capture as part of process suspension which would allow to deactivate the audio session without ShouldCheckRequiredSession::No.\n\nThe PR routes UserMediaRequest::allow() through MediaSessionManagerInterface via audioCaptureSourceStateChanged(IsCaptureStarting::Yes) so capture activation is tracked by the manager and m_becameActive is correct.\nWe call MediaStreamTrack::audioCaptureSourceStateChanged() synchronously on mute/unmute (instead of in the deferred event-dispatch task) so the manager observes the new capture state right away.\nWe switch MediaStreamTrack::isCapturingAudio() and wantsToCaptureAudio() to read m_private-\u003emuted() (the live underlying state) instead of the observer-driven muted() flag, which lags behind by one event-loop turn.\nWe add a release log when process suspension happens while microphone capture is ongoing, to make follow-up diagnoses on devices easier.\n\nTests: fast/mediastream/audio-session-active-when-capture-starts-and-stops.html\n       fast/mediastream/audio-session-stays-active-during-capture.html\n       fast/mediastream/audio-session-stays-active-when-removing-session-during-capture.html\n\n* LayoutTests/fast/mediastream/audio-session-active-when-capture-starts-and-stops-expected.txt: Added.\n* LayoutTests/fast/mediastream/audio-session-active-when-capture-starts-and-stops.html: Added.\n* LayoutTests/fast/mediastream/audio-session-stays-active-during-capture-expected.txt: Added.\n* LayoutTests/fast/mediastream/audio-session-stays-active-during-capture.html: Added.\n* LayoutTests/fast/mediastream/audio-session-stays-active-when-removing-session-during-capture-expected.txt: Added.\n* LayoutTests/fast/mediastream/audio-session-stays-active-when-removing-session-during-capture.html: Added.\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebCore/Modules/mediasession/MediaSession.cpp:\n(WebCore::MediaSession::updateCaptureState):\n* Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp:\n(WebCore::MediaStreamTrack::trackMutedChanged):\n(WebCore::MediaStreamTrack::isCapturingAudio const):\n(WebCore::MediaStreamTrack::wantsToCaptureAudio const):\n* Source/WebCore/Modules/mediastream/UserMediaRequest.cpp:\n(WebCore::UserMediaRequest::allow):\n* Source/WebCore/platform/LogMessages.in:\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.cpp:\n(WebCore::MediaSessionManagerInterface::processWillSuspend):\n(WebCore::MediaSessionManagerInterface::audioCaptureSourceStateChanged):\n(WebCore::MediaSessionManagerInterface::removeSession):\n(WebCore::MediaSessionManagerInterface::maybeDeactivateAudioSession):\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.h:\n\nCanonical link: https://commits.webkit.org/316394@main",
      "email": "youenn@apple.com",
      "hash": "5801e5e98a3ec11f1bbd641dbb39d375f25f3da2",
      "subject": "WebProcess AudioSession may not always stay active when microphone capture is live"
    },
    "316395@main": {
      "author": "Justin Michaud",
      "avatar": "https://www.gravatar.com/avatar/36e0433ee725a08f7e1122a6bc584b57?d=identicon\u0026s=64",
      "cl": "316395@main",
      "clUrl": "https://commits.webkit.org/316395@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316679\n\nReviewed by Yusuke Suzuki.\n\nAdd some missing NODELETES to help with some other patches I have\nin progress; Also, fix an issue where hashes involving ArrayMode\ncan sometimes be wrong because of padding bits.\n\n* Source/JavaScriptCore/dfg/DFGArrayMode.h:\n(JSC::DFG::ArrayMode::ArrayMode):\n* Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp:\n* Source/WTF/wtf/StdLibExtras.h:\n(WTF::min):\n(WTF::max):\n* Source/WTF/wtf/module.modulemap:\n\nCanonical link: https://commits.webkit.org/316395@main",
      "email": "jmichaud@igalia.com",
      "hash": "c9022c6e5ac10b05b0eb4b98eb64843422848598",
      "subject": "Drive-by cleanups in IRO and ArrayMode"
    },
    "316396@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "316396@main",
      "clUrl": "https://commits.webkit.org/316396@main",
      "description": "rdar://181104430\nhttps://bugs.webkit.org/show_bug.cgi?id=318318\n\nReviewed by Jean-Yves Avenard.\n\nRebasing up to 6ddb6700d1e60aac3b09e53ead34dbe86db7a712.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/interfaces/webrtc-encoded-transform.idl:\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/RTCEncodedFrame-copy-construction.https-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/RTCEncodedFrame-copy-construction.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/RTCRtpScriptTransform-encoded-transform-worker.js:\n(RestoreAndWrite):\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/RTCRtpScriptTransform-encoded-transform.https.html:\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/RTCRtpScriptTransform-sender-worker-single-frame.https.html:\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/helper.js:\n(async createRTCEncodedFrameFromScratch.work.async try):\n(async createRTCEncodedFrameFromScratch.work):\n(areArrayBuffersEqual):\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/idlharness.https.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/idlharness.https.window.js:\n(async idlArray):\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/script-late-transform.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/script-late-transform.https.html:\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/script-metadata-transform.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/script-metadata-transform.https.html:\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/script-transform-generateKeyFrame.js:\n(onrtctransform.event.async generateKeyFrame):\n(onrtctransform.event.async waitForFrame):\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/script-transform-sendKeyFrameRequest.js:\n(onrtctransform.event.async sendKeyFrameRequest):\n(onrtctransform.event.async waitForFrame):\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/script-transform.https.html:\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/sframe-keys.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/sframe-keys.https.html:\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/sframe-transform-buffer-source-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/sframe-transform-buffer-source.html:\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/sframe-transform-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/sframe-transform-in-worker.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/sframe-transform-in-worker.https.html:\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/sframe-transform-readable-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/sframe-transform-readable.html:\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/sframe-transform-worker.js:\n(onrtctransform):\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/sframe-transform.html:\n* LayoutTests/imported/w3c/web-platform-tests/webrtc-encoded-transform/w3c-import.log:\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/tests-options.json:\n\nCanonical link: https://commits.webkit.org/316396@main",
      "email": "youenn@apple.com",
      "hash": "f9cedae9fb4f654e97942a35ddcf6177d01536f8",
      "subject": "Rebase WPT webrtc encoded transform tests"
    },
    "316397@main": {
      "author": "lilly",
      "avatar": "https://www.gravatar.com/avatar/6f92b711483096db0247c16946fb3f29?d=identicon\u0026s=64",
      "cl": "316397@main",
      "clUrl": "https://commits.webkit.org/316397@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318240\nrdar://181048587\n\nReviewed by Simon Fraser.\n\nImplements the borderContourPath stub for notch (superellipse(-∞)) corners. Introduces a Corner struct holding the four geometric vertices\nof a corner: start, outer, end, and center, which represent the contour traversal roles of the corner's bounding rect vertices in\nclockwise order. makeCorner maps a CornerInput into the correct vertex orientation per BoxCorner, and adjustCornerForInset offsets the\ngeometry to account for border widths. addCurvedCorner draws notch corners as two line segments through the center vertex. buildCorners\napplies these transforms across all four corners and borderContourPath traces the full contour clockwise starting from the top-right corner's\nstart vertex. Bevel, scoop, round, and the general superellipse curve are left as TODOs for follow-up patches.\n\nPasses tests that were written in previous commit 315899@main\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/gtk/TestExpectations:\n* Source/WebCore/platform/graphics/CornerShapeUtilities.cpp:\n(WebCore::borderContourPath):\n\nCanonical link: https://commits.webkit.org/316397@main",
      "email": "173393835+codedbycupidity@users.noreply.github.com",
      "hash": "b85f5f7e38c87979c82e78cdd3cfef2fc1528ce8",
      "subject": "corner-shape:  Implement borderContourPath for notch corner shapes in CornerShapeUtilities"
    },
    "316398@main": {
      "author": "Charlie Wolfe",
      "avatar": "https://www.gravatar.com/avatar/857b3b5ff3394c31fa2689310a93dbab?d=identicon\u0026s=64",
      "cl": "316398@main",
      "clUrl": "https://commits.webkit.org/316398@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318165\nrdar://180971837\n\nReviewed by Matthew Finkel.\n\nCollapse network-request blocking down to a single check: block any non-main-frame subresource whose\ndestination is a targeted domain. This removes the \"allow first load\" latch and the script taint\npath, leaving destination-based blocking via NetworkSession::isRequestBlockable.\n\n- Remove the per-page latch so all matching requests are blocked, not just subsequent ones.\n\n- Remove taint-based blocking: the ScriptTrackingPrivacyCategory::NetworkRequests category and its\n  ResourceLoader/FetchLoader/DocumentThreadableLoader enforcement, WebProcess::shouldBlockRequest,\n  ScriptTrackingPrivacyFilter::shouldBlockRequest, and the now-unused isTaintedScriptURLBlockable.\n\n- Remove the ScriptTrackingPrivacyNetworkRequestBlockingEnabled feature flag and rename\n  ScriptTrackingPrivacyNetworkRequestBlockingLatchEnabled.\n\n- Delete the obsolete latch/taint API tests.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ScriptTrackingPrivacyTests.mm\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebCore/Modules/fetch/FetchLoader.cpp:\n(WebCore::FetchLoader::start):\n* Source/WebCore/dom/ScriptExecutionContext.cpp:\n(WebCore::ScriptExecutionContext::requiresScriptTrackingPrivacyProtection):\n* Source/WebCore/loader/DocumentThreadableLoader.cpp:\n(WebCore::DocumentThreadableLoader::loadRequest):\n* Source/WebCore/loader/ResourceLoader.cpp:\n(WebCore::ResourceLoader::willSendRequestInternal):\n* Source/WebCore/page/ScriptTrackingPrivacyCategory.cpp:\n(WebCore::description):\n(WebCore::scriptCategoryAsFlag):\n(WebCore::shouldEnableScriptTrackingPrivacy):\n(WebCore::makeLogMessage):\n* Source/WebCore/page/ScriptTrackingPrivacyCategory.h:\n* Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp:\n(WebKit::NetworkLoadChecker::shouldBlockForTrackingPolicy):\n* Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.h:\n* Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.serialization.in:\n* Source/WebKit/NetworkProcess/NetworkSession.cpp:\n(WebKit::NetworkSession::shouldBlockRequestForTrackingPolicyAndUpdatePolicy): Deleted.\n* Source/WebKit/NetworkProcess/NetworkSession.h:\n* Source/WebKit/Platform/cocoa/WebPrivacyHelpers.h:\n* Source/WebKit/Platform/cocoa/WebPrivacyHelpers.mm:\n(WebKit::isRequestBlockable):\n(WebKit::allowedScriptTrackingCategories):\n(WebKit::isTaintedScriptURLBlockable): Deleted.\n* Source/WebKit/Shared/ScriptTrackingPrivacyFilter.cpp:\n(WebKit::ScriptTrackingPrivacyFilter::shouldAllowAccess):\n(WebKit::ScriptTrackingPrivacyFilter::shouldBlockRequest): Deleted.\n* Source/WebKit/Shared/ScriptTrackingPrivacyFilter.h:\n* Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp:\n(WebKit::addParametersShared):\n* Source/WebKit/WebProcess/WebProcess.cpp:\n(WebKit::WebProcess::shouldBlockRequest): Deleted.\n* Source/WebKit/WebProcess/WebProcess.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ScriptTrackingPrivacyTests.mm:\n(TestWebKitAPI::setUpWebViewForFingerprintingTests):\n(TestWebKitAPI::(ScriptTrackingPrivacyTests, SameSiteFetchNotBlocked)):\n(TestWebKitAPI::(ScriptTrackingPrivacyTests, MainFrameNavigationNotBlocked)):\n(TestWebKitAPI::(ScriptTrackingPrivacyTests, CrossSiteFetchBlocked)):\n(TestWebKitAPI::getBundleResourceAsEncodedString): Deleted.\n(TestWebKitAPI::(ScriptTrackingPrivacyTests, FetchBlocked)): Deleted.\n(TestWebKitAPI::(ScriptTrackingPrivacyTests, XHRBlocked)): Deleted.\n(TestWebKitAPI::(ScriptTrackingPrivacyTests, SyncXHRBlocked)): Deleted.\n(TestWebKitAPI::(ScriptTrackingPrivacyTests, ImgElementLoadBlocked)): Deleted.\n(TestWebKitAPI::(ScriptTrackingPrivacyTests, BlockSubsequentFetch)): Deleted.\n(TestWebKitAPI::(ScriptTrackingPrivacyTests, ScriptElementLoadBlocked)): Deleted.\n(TestWebKitAPI::(ScriptTrackingPrivacyTests, BlockSubsequentElement)): Deleted.\n(TestWebKitAPI::(ScriptTrackingPrivacyTests, BlockSubsequent2Element)): Deleted.\n\nCanonical link: https://commits.webkit.org/316398@main",
      "email": "charliew@apple.com",
      "hash": "038f53fa65bf2d41bdc7b1b6639a7fef5180db68",
      "subject": "Simplify script tracking privacy network request blocking"
    },
    "316399@main": {
      "author": "Anuj Panta",
      "avatar": "https://www.gravatar.com/avatar/f795b7daddea5f93c9cbb5a4a8f0db14?d=identicon\u0026s=64",
      "cl": "316399@main",
      "clUrl": "https://commits.webkit.org/316399@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316138\nrdar://178562336\n\nReviewed by Qianlang Chen.\n\nPort getAccessibilityPropertiesForNode onto FrameDOMAgent.\nWalks the frame's local AXObjectCache for role, label, busy, checked,\nexpanded, required, heading level, live region status,\nowned/controlled/flowed node references, and the rest of the AccessibilityProperties\nshape. Cross-frame AX references (parentNode walking up past the\niframe boundary, controlledNodeIds pointing into the parent\nprocess) resolve to 0 via pushNodePathToFrontend and are silently omitted,\nmatching the graceful-degradation behavior of the page-level path.\n\nOn the frontend, the cross-origin guard on\nDOMNode.accessibilityProperties is removed.\nThe call routes through `owningTarget ||\nWI.assumingMainTarget()` with `backendNodeId`.\n\nThe Accessibility section of the right-hand sidebar now\npopulates for nodes inside cross-origin iframes.\n\nTest: http/tests/site-isolation/inspector/dom/accessibility-frame-target.html\n\n* LayoutTests/http/tests/site-isolation/inspector/dom/accessibility-frame-target-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/dom/accessibility-frame-target.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/dom/resources/ax-frame.html: Added.\n* Source/JavaScriptCore/inspector/protocol/DOM.json:\n* Source/WebCore/inspector/agents/frame/FrameDOMAgent.cpp:\n(WebCore::FrameDOMAgent::processAccessibilityChildren):\n(WebCore::FrameDOMAgent::buildObjectForAccessibilityProperties):\n(WebCore::FrameDOMAgent::getAccessibilityPropertiesForNode):\n* Source/WebCore/inspector/agents/frame/FrameDOMAgent.h:\n* Source/WebCore/inspector/agents/frame/FrameDOMAgentStubs.cpp:\n(WebCore::FrameDOMAgent::getAccessibilityPropertiesForNode): Deleted.\n* Source/WebInspectorUI/UserInterface/Models/DOMNode.js:\n(WI.DOMNode.prototype.accessibilityProperties):\n\nCanonical link: https://commits.webkit.org/316399@main",
      "email": "a_panta@apple.com",
      "hash": "e33f7f21b67a916374d694d63fb5d6f00c59a65c",
      "subject": "Web Inspector: [SI] populate Accessibility sidebar for cross-origin iframe nodes"
    },
    "316400@main": {
      "author": "Alex Christensen",
      "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64",
      "cl": "316400@main",
      "clUrl": "https://commits.webkit.org/316400@main",
      "description": "rdar://176912453\n\nReviewed by Chris Dumez.\n\nIf a compromised web content process somehow gets the identifier of another WebPageProxy\nin the same WebProcessPool, it could send messages to that page's _WKRemoteObjectRegistry.\nThis reconfigures the registration and message dispatching so that only a page that is\nknown to be used by the current WebProcessProxy can receive IPC to its _WKRemoteObjectRegistry.\n\n* Source/WebKit/Shared/API/Cocoa/RemoteObjectRegistry.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm:\n(-[WKWebView dealloc]):\n(-[WKWebView _remoteObjectRegistry]):\n* Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm:\n(WebKit::WebPageProxy::remoteObjectRegistry):\n(WebKit::WebPageProxy::uiRemoteObjectRegistry):\n* Source/WebKit/UIProcess/PageClient.h:\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::handleRemoteObjectRegistryMessage):\n(WebKit::WebProcessProxy::dispatchMessage):\n* Source/WebKit/UIProcess/WebProcessProxy.h:\n* Source/WebKit/UIProcess/mac/PageClientImplMac.h:\n* Source/WebKit/UIProcess/mac/PageClientImplMac.mm:\n(WebKit::PageClientImpl::remoteObjectRegistry): Deleted.\n* Source/WebKit/UIProcess/mac/WebPageProxyMac.mm:\n(WebKit::WebPageProxy::remoteObjectRegistry): Deleted.\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::~WebViewImpl):\n(WebKit::WebViewImpl::remoteObjectRegistry):\n\nOriginally-landed-as: 305413.962@safari-7624-branch (dcf51f6e5ef7). rdar://180437303\nCanonical link: https://commits.webkit.org/316400@main",
      "email": "achristensen@apple.com",
      "hash": "972966afe6de9b139ab0d53809b9eb5dbcedb69b",
      "subject": "Only allow sending to _WKRemoteObjectRegistry of a page in the sending process"
    },
    "316401@main": {
      "author": "Cole Carley",
      "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64",
      "cl": "316401@main",
      "clUrl": "https://commits.webkit.org/316401@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318124\nrdar://179205821\n\nReviewed by Megan Gardner.\n\nLarge pages are causing the CachedMatchFinder's buffer to overflow. To fix this,\nI have added a check for this overflow, which sets an oversized flag on the buffer.\nThen, if CachedMatchFinder's findMatchFrom, findMatches, or countMatches tries to use\na buffer that has been overflowed, it returns an unexpected\nCachedMatchFinder::CacheUnusable, signalling they should fall back to the old implementation.\n\nTest: editing/text-iterator/find-matches-oversized-buffer-fallback.html\n\n* LayoutTests/editing/text-iterator/find-matches-oversized-buffer-fallback-expected.txt: Added.\n* LayoutTests/editing/text-iterator/find-matches-oversized-buffer-fallback.html: Added.\n* Source/WebCore/editing/CachedMatchFinder.cpp:\n(WebCore::maximumRunCountForTesting):\n(WebCore::CachedMatchFinder::setMaximumRunCountForTesting):\n(WebCore::CachedMatchFinder::findNextMatchInShadowIncludingAncestorTree):\n(WebCore::CachedMatchFinder::findMatchFrom):\n(WebCore::CachedMatchFinder::findMatches):\n(WebCore::CachedMatchFinder::countMatches):\n(WebCore::CachedMatchFinder::bufferForOptions):\n(WebCore::CachedMatchFinder::textForScope):\n* Source/WebCore/editing/CachedMatchFinder.h:\n* Source/WebCore/editing/Editor.cpp:\n(WebCore::Editor::findString):\n(WebCore::Editor::countMatchesForText):\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::resetToConsistentState):\n(WebCore::Internals::setCachedFindMatchBufferLimitForTesting):\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\n\nCanonical link: https://commits.webkit.org/316401@main",
      "email": "ccarley2@apple.com",
      "hash": "e3bc700a28feffa664c774e3347956273a3b4952",
      "subject": "Large pages can overflow the CachedMatchFinder buffer"
    },
    "316402@main": {
      "author": "Vitaly Dyachkov",
      "avatar": "https://www.gravatar.com/avatar/ab950c52088e289585a5a01580ec66a4?d=identicon\u0026s=64",
      "cl": "316402@main",
      "clUrl": "https://commits.webkit.org/316402@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318435\n\nReviewed by Charlie Wolfe.\n\nRename `RequestStorageAccess`'s `hasOrShouldIgnoreUserGesture` parameter\nto `hasUserGestureOrNoUserGestureRequired`.\n\n* LayoutTests/ipc/forged-resource-load-statistics-storage-access.html:\n\nCanonical link: https://commits.webkit.org/316402@main",
      "email": "vitaly@igalia.com",
      "hash": "60d9029b86e93d2894b34d87b115bbe39d6fac91",
      "subject": "REGRESSION(316120@main): `ipc/forged-resource-load-statistics-storage-access.html` is a constant failure with assertions enabled"
    },
    "316403@main": {
      "author": "Jetzel Espinal",
      "avatar": "https://www.gravatar.com/avatar/2edd78d5d9f2f2e2e695465277634921?d=identicon\u0026s=64",
      "cl": "316403@main",
      "clUrl": "https://commits.webkit.org/316403@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318450\nrdar://181250253\n\nUnreviewed test gardening.\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/316403@main",
      "email": "jespinal23@apple.com",
      "hash": "f979ca1b7d23eaae1e4b2e937cf5cc2e8750140c",
      "subject": "[GARDENING] accessibility/mac/input-replacevalue-userinfo.html is a constant Timeout on macOS Debug."
    },
    "316404@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316404@main",
      "clUrl": "https://commits.webkit.org/316404@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318397\nrdar://181183016\n\nReviewed by Taher Ali.\n\nSVGAnimatedPropertyPairAccessor::detach() called propertyProperty1() and\npropertyProperty2(), which each return a Ref\u003cAnimatedProperty\u003e by value.\nThat constructs a temporary Ref just to call detach() on the pointee,\nincurring a ref/deref pair on each call for no reason.\n\nCall property1(owner) and property2(owner) instead, which return\nconst Ref\u003cAnimatedProperty\u003e\u0026 by reference, avoiding the refcount traffic.\nThe propertyProperty1()/propertyProperty2() helpers had no other callers,\nso remove them.\n\nNo change in behavior.\n\n* Source/WebCore/svg/properties/SVGAnimatedPropertyPairAccessor.h:\n(WebCore::SVGAnimatedPropertyPairAccessor::propertyProperty1 const): Deleted.\n(WebCore::SVGAnimatedPropertyPairAccessor::propertyProperty2 const): Deleted.\n\nCanonical link: https://commits.webkit.org/316404@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "b9927430aa6d68ef76529be30df020cd611646a2",
      "subject": "SVGAnimatedPropertyPairAccessor::detach() causes needless refcount churn by calling Ref-returning helpers"
    },
    "316405@main": {
      "author": "Said Abou-Hallawa",
      "avatar": "https://www.gravatar.com/avatar/ae80a929a378a055822829ae63903296?d=identicon\u0026s=64",
      "cl": "316405@main",
      "clUrl": "https://commits.webkit.org/316405@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318395\nrdar://181180757\n\nReviewed by Simon Fraser.\n\nCheck whether targetAttributes dictionary has an entry for kCVPixelBufferPixelFormatTypeKey\nor not. Make sure CFNumberGetValue() succeeds parsing the return CFNumber. If anything went\nwrong, we should fall back to the default pixel format.\n\n* Source/WebCore/platform/graphics/cocoa/ShareableGainMap.cpp:\n(WebCore::ShareableGainMap::applyGainMapToBaseImage const):\n\nCanonical link: https://commits.webkit.org/316405@main",
      "email": "said@apple.com",
      "hash": "cb497b2e07be89676f93a3e8ce0960b578c3a6af",
      "subject": "[HDR] Ensure that parsing the gain-map target pixelFormat is handled correctly"
    },
    "316406@main": {
      "author": "Marta Darbinyan",
      "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64",
      "cl": "316406@main",
      "clUrl": "https://commits.webkit.org/316406@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318452\nrdar://181251988\n\nUnreviewed test gardening\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/316406@main",
      "email": "darbinyan@apple.com",
      "hash": "609a6fbeaa4ea5fe88c5ce7e899d5960b79226d7",
      "subject": "[ Gardening]: REGRESSION(316303@main): [macOS Release] platform/mac/media/audio-session-deactivated-when-suspended.html is flaky failure"
    },
    "316407@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "316407@main",
      "clUrl": "https://commits.webkit.org/316407@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318412\nrdar://181199699\n\nReviewed by Sosuke Suzuki.\n\nunit/ skeleton is encouraged in the modern ICU (ICU 67~), let's use them\ninstead of measure-unit / per-measure-unit. Also removing type field\nfrom MeasureUnit, as type-subtype form is no longer used and it is\nkind-of deprecate status in ICU.\n\nAlso the reason of the failure in JSTests/microbenchmarks/intl-number-format-unit-to-parts.js\nwas because of this legacy format. Now it should work.\n\nhttps://github.com/unicode-org/icu/blob/main/docs/userguide/format_parse/numbers/skeletons.md#unit\n\n* JSTests/microbenchmarks/intl-number-format-unit-to-parts.js:\n* Source/JavaScriptCore/runtime/IntlNumberFormat.cpp:\n(JSC::IntlNumberFormat::initializeNumberFormat):\n* Source/JavaScriptCore/runtime/IntlObject.cpp:\n* Source/JavaScriptCore/runtime/IntlObject.h:\n\nCanonical link: https://commits.webkit.org/316407@main",
      "email": "ysuzuki@apple.com",
      "hash": "824d2b29e233c469c079a02ca4c8e24108db69c7",
      "subject": "[JSC] Use modern unit/ skeleton in Intl.NumberFormat"
    },
    "316408@main": {
      "author": "Lauro Moura",
      "avatar": "https://www.gravatar.com/avatar/6157f52d61e04c2c63fe7ff668ba69b3?d=identicon\u0026s=64",
      "cl": "316408@main",
      "clUrl": "https://commits.webkit.org/316408@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318444\n\nReviewed by Carlos Alberto Lopez Perez.\n\nSince 311718, when *_UNIFIED_SOURCE_EXCLUDES is set, the macro\nWEBKIT_COMPUTE_SOURCES reads the Sources.txt with file(STRINGS), which\ndoes not register the original file as a dependency. So, in incremental\nbuilds, changes to source-tree Sources.txt can go unnoticed, leading to\nissues like undefined references for symbols in the new files, etc.\n\nThis commit adds the original source-tree source list to\nCMAKE_CONFIGURE_DEPENDS, ensuring we reconfigure after changes to it.\n\n* Source/cmake/WebKitMacros.cmake:\n\nCanonical link: https://commits.webkit.org/316408@main",
      "email": "lmoura@igalia.com",
      "hash": "637501a7277548ee728ab1a313c05f473acb8ca4",
      "subject": "REGRESSION(311718@main) [CMake] Ensure cmake is run after changes to Sources.txt"
    },
    "316409@main": {
      "author": "Robert Jenner",
      "avatar": "https://www.gravatar.com/avatar/05a1bd874251a1f64c7b6a0ed8120640?d=identicon\u0026s=64",
      "cl": "316409@main",
      "clUrl": "https://commits.webkit.org/316409@main",
      "description": "rdar://156615182\n\nUnreviewed test rebaseline.\n\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/ios/compositing/layer-creation/sticky-overlap-extent-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/316409@main",
      "email": "jenner@apple.com",
      "hash": "14193221b67c7984790245709b68de1cfd74ce9d",
      "subject": "[REBASELINE][ New-Test ] [ iOS26 ]compositing/layer-creation/sticky-overlap-extent.html  is a constant text failure"
    },
    "316410@main": {
      "author": "Per Arne Vollan",
      "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64",
      "cl": "316410@main",
      "clUrl": "https://commits.webkit.org/316410@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314867\nrdar://176186724\n\nReviewed by Sihui Liu.\n\nSome 3rd party apps rely on the ability to load files from it's temp directory with the JS fetch API\nor -[WKWebView loadHTMLString:baseURL:]. In order to not break these apps we allow these loads. We\ncan restrict this by blocking this for MobileSafari.\n\nThe case where the app is using -[WKWebView loadHTMLString:baseURL] to load local files in the temp\ndirectory, can be addressed by creating a sandbox extension for the base URL in\nWebPageProxy::loadDataWithNavigationShared. However, this is a larger change, we rely on this\nexemption for now.\n\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:\n(WebKit::shouldAllowLocalFileLoad):\n\nOriginally-landed-as: 305413.918@safari-7624-branch (9970ddd13f0b). rdar://180437181\nCanonical link: https://commits.webkit.org/316410@main",
      "email": "pvollan@apple.com",
      "hash": "74d0c628ff2d82e9dfcc57cfc3e6e1f361e9b521",
      "subject": "Restrict ability for Network process to load files from temp directory"
    },
    "316411@main": {
      "author": "Rupin Mittal",
      "avatar": "https://www.gravatar.com/avatar/3e3de9845931d2dc844afb00056ec94e?d=identicon\u0026s=64",
      "cl": "316411@main",
      "clUrl": "https://commits.webkit.org/316411@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318360\nrdar://181151216\n\nReviewed by Brady Eidson.\n\nWe shouldn't need to construct a new httpNavigationWithHTTPSOnlyError just to\ncheck if the error we have is the of the same type. We instead add a new function\nthat checks this for us (similar to isBlockedError()).\n\n* Source/WebCore/loader/DocumentLoader.cpp:\n(WebCore::DocumentLoader::loadMainResource):\n* Source/WebCore/loader/LoaderStrategy.h:\n* Source/WebKit/Shared/WebErrors.cpp:\n(WebKit::isHttpNavigationWithHTTPSOnlyError):\n* Source/WebKit/Shared/WebErrors.h:\n* Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp:\n(WebKit::WebLoaderStrategy::isHttpNavigationWithHTTPSOnlyError const):\n* Source/WebKit/WebProcess/Network/WebLoaderStrategy.h:\n* Source/WebKitLegacy/WebCoreSupport/WebResourceLoadScheduler.h:\n* Source/WebKitLegacy/WebCoreSupport/WebResourceLoadScheduler.mm:\n(WebResourceLoadScheduler::isHttpNavigationWithHTTPSOnlyError const):\n\nCanonical link: https://commits.webkit.org/316411@main",
      "email": "rupin@apple.com",
      "hash": "a1a55949c63662f939521a257dd897030d473a0a",
      "subject": "Check httpNavigationWithHTTPSOnlyError without constructing a new one"
    },
    "316412@main": {
      "author": "Jessica Cheung",
      "avatar": "https://www.gravatar.com/avatar/5c102f093ce6bc01424466a4cfdf1d1f?d=identicon\u0026s=64",
      "cl": "316412@main",
      "clUrl": "https://commits.webkit.org/316412@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318273\nrdar://177363383\n\nReviewed by Richard Robinson.\n\nCurrently, if the user does any of these three cases, smart lists will trigger:\nCase 1: \"1. apple\u003cbr\u003e2. cherrybanana\" --\u003e \"1. apple\u003cbr\u003e2. cherryban ana\" (mid-space)\n    * Note that case 1 will yield \"1.apple\u003cbr\u003e2. ana\"\nCase 2: \"1. apple\u003cbr\u003e2. cherrybanana\" --\u003e \"1. apple\u003cbr\u003e2. cherrybanana \" (trailing-space)\nCase 3: \"1. apple\u003cbr\u003e2. cherrybanana\" --\u003e \"1. apple\u003cbr\u003e2.  cherrybanana\" (leading-space)\n\nThis causes a jarring effect when a user has pasted plain text that looks like a \"list\",\nbut is actually a combination of \u003cdiv\u003e, \u003cp\u003e, or \u003cspan\u003e and there is no \u003col\u003e or \u003cul\u003e present.\nThe effect is typing a space in anywhere in a \"list\" item that is after the first item,\ntriggers smart list formatting. Then, the entire line of text leading up to the cursor is deleted,\nand the list marker is added. This produces the \"erases the line in the process\" effect.\n\nTo fix this issue, tighten the criteria to `applySmartListsIfNeeded` so it has to be the second list item,\nhave the list marker only and nothing past the marker.\n\n* LayoutTests/editing/smart-lists/smart-list-trigger-requires-marker-only-line-expected.txt: Added.\n* LayoutTests/editing/smart-lists/smart-list-trigger-requires-marker-only-line.html: Added.\n* Source/WebCore/editing/InsertTextCommand.cpp:\n(WebCore::InsertTextCommand::applySmartListsIfNeeded):\n\nCanonical link: https://commits.webkit.org/316412@main",
      "email": "jcheung23@apple.com",
      "hash": "ff5472ad4fd43e4db15fcd014e675020d381ac78",
      "subject": "[Smart Lists] Typing space attempts to convert my line to a bullet but erases the line in the process"
    },
    "316413@main": {
      "author": "Elliott Williams",
      "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64",
      "cl": "316413@main",
      "clUrl": "https://commits.webkit.org/316413@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317876\nrdar://177493372\n\nReviewed by Richard Robinson.\n\nOur `AvailabilityProhibitedInternal.h` injected header does not work\nwhen building with modules. Modules are by design self-contained, and\nthe `os_availability` modulemap in the SDK compiles without finding and\nincluding our injected header.\n\nWe need to silence availability errors in the public build in order to\nbind to SPI on the platform that is otherwise marked API_UNAVAILABLE.\n\nInstead, replace the technique with a new approach based on stubbing out\nthe entire Availability library, replacing \u003cAvailability.h\u003e and\n\u003cos/availability.h\u003e with our own versions of the headers.\n\nThe OS modulemap containing the availability project has other headers\nin it too, so we can't just ship our own modulemap referencing the\nstubs. Instead, generate a VFS overlay which maps our headers onto the\ncorrect SDK paths.\n\nAlso clean up conditional logic for SDK versions that we no longer\nsupport.\n\n* Configurations/CommonBase.xcconfig:\n* Configurations/SDKAdditions.xcconfig:\n* Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig:\n\nIn third-party code, add \"Setup\" targets to Xcode projects which depend\non the overlay YAML bring produced. These gate compilation of any of the\nthird-party libraries until bmalloc has run and WTF has staged public\nSDK headers.\n\n(In CMake, we're able to generate the overlay at configure time without\ndisturbing the dependency graph, so this issue does not exist.)\n\n* Source/ThirdParty/ANGLE/ANGLE.xcodeproj/project.pbxproj:\n* Source/ThirdParty/libwebrtc/libwebrtc.xcodeproj/project.pbxproj:\n* Source/WTF/Configurations/WTF.xcconfig:\n* Source/WebCore/Configurations/WebCore.xcconfig:\n* Source/WebCore/PAL/Configurations/PAL.xcconfig:\n* Source/WebCore/PAL/ThirdParty/dav1d/Configurations/Base.xcconfig:\n* Source/WebGPU/Configurations/WebGPU.xcconfig:\n* Source/WebKit/Configurations/WebKit.xcconfig:\n* Source/bmalloc/Configurations/bmalloc.xcconfig:\n* Source/bmalloc/bmalloc.xcodeproj/project.pbxproj: Call\n  generate-overlay before bmalloc builds. It needs to happen very early\n  in the build, before any target that includes CommonBase.xcconfig\n  starts compiling.\n* Source/cmake/OptionsCocoa.cmake:\n* WebKitLibraries/AvailabilityOverlay/generate-overlay.py: Added.\n* WebKitLibraries/AvailabilityOverlay/usr/include/Availability.h: Added.\n* WebKitLibraries/AvailabilityOverlay/usr/include/os/availability.h: Added.\n\nDelete all the old AvailabilityProhibitedInternal.h headers:\n\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/appletvos26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/appletvsimulator18.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/appletvsimulator26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/iphoneos26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/iphonesimulator26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/macosx14.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/macosx15.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/macosx26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/watchos26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/watchsimulator26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/xros26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/xrsimulator26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n\nCanonical link: https://commits.webkit.org/316413@main",
      "email": "emw@apple.com",
      "hash": "fabdb6ba5e169cb8bfb647f7565f1abdb6918991",
      "subject": "[Build] Reenable JSC and WebCore module verifier on public SDK builds"
    },
    "316414@main": {
      "author": "Jetzel Espinal",
      "avatar": "https://www.gravatar.com/avatar/2edd78d5d9f2f2e2e695465277634921?d=identicon\u0026s=64",
      "cl": "316414@main",
      "clUrl": "https://commits.webkit.org/316414@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318460\nrdar://181257484\n\nUnreviewed test gardening.\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/316414@main",
      "email": "jespinal23@apple.com",
      "hash": "aa6e40d1d8f16f9e4702ec1099a7c8e4d43ed1cc",
      "subject": "[GARDENING] TestWebKitAPI.WebKit.BlockedUploadDirectory is constant Fail."
    },
    "316415@main": {
      "author": "Kiet Ho",
      "avatar": "https://www.gravatar.com/avatar/d9058b37006dce1f55f91b8ccc82f9a3?d=identicon\u0026s=64",
      "cl": "316415@main",
      "clUrl": "https://commits.webkit.org/316415@main",
      "description": "rdar://177975964\nhttps://bugs.webkit.org/show_bug.cgi?id=315512\n\nReviewed by Simon Fraser and Alan Baradlay.\n\nPer CSS Backgrounds spec [1], the background of \u003cbody\u003e is used as the background of the root\nelement (e.g \u003chtml\u003e). When the background of \u003cbody\u003e changes, RenderBox::styleWillChange handles\nthis by repainting the RenderView:\n\nvoid RenderBox::styleWillChange(Style::Difference diff, const Style::ComputedStyle\u0026 newStyle)\n{\n    s_hadNonVisibleOverflow = hasNonVisibleOverflow();\n\n    const Style::ComputedStyle* oldStyle = hasInitializedStyle() ? \u0026style() : nullptr;\n    if (oldStyle) {\n        if (diff \u003e= Style::DifferenceResult::Repaint \u0026\u0026 (isDocumentElementRenderer() || isBody())) {\n----\u003e       view().repaintRootContents();\n            if (Style::hasEntirelyFixedBackground(oldStyle-\u003ebackgroundLayers()) != Style::hasEntirelyFixedBackground(newStyle.backgroundLayers()))\n                view().compositor().rootLayerConfigurationChanged();\n        }\n        [...]\n}\n\nBut this only repaints the RenderView, not the root. It might just so happen to re-paint\nits contents because the repaint region of RenderView covers it. BUT, if it's composited\n(e.g an element is fixed-positioned and has negative z-index, forcing creation of background\nand content layers), then its layers doesn't get repainted. This may include the background\nlayer, which is the document's background.\n\nFix this by making RenderView::repaintRootContents repaint the root layer too if\nit's composited.\n\n[1]: https://drafts.csswg.org/css-backgrounds/#body-background\n\nTests: fast/body-propagation/background-color/009.html\n       fast/body-propagation/background-color/010.html\n\n* LayoutTests/fast/body-propagation/background-color/009-expected.html: Added.\n* LayoutTests/fast/body-propagation/background-color/009.html: Added.\n* LayoutTests/fast/body-propagation/background-color/010-expected.html: Added.\n* LayoutTests/fast/body-propagation/background-color/010.html: Added.\n    - Add tests that change the background color of \u003cbody\u003e in two ways: by modifying the\n      style directly, and by changing the light/dark appearance. Unfortunately the tests\n      rely on testRunner.dontForceRepaint(), so they can't be upstreamed to WPT.\n\n* Source/WebCore/rendering/BackgroundPainter.cpp:\n(WebCore::BackgroundPainter::paintsOwnBackground):\n* Source/WebCore/rendering/RenderView.cpp:\n(WebCore::RenderView::repaintRootContents):\n\nCanonical link: https://commits.webkit.org/316415@main",
      "email": "kiet.ho@apple.com",
      "hash": "0637bedae75eb3bea1f33827d6a576c193134371",
      "subject": "Background of composited root element is not re-painted when background of \u003cbody\u003e changes"
    },
    "316416@main": {
      "author": "Elliott Williams",
      "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64",
      "cl": "316416@main",
      "clUrl": "https://commits.webkit.org/316416@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317876\nrdar://177493372\n\nUnreviewed build fix.\n\nWebCore's module verifier task must still be disabled in internal builds\nfor Mac.\n\n* Source/WebCore/Configurations/WebCore.xcconfig:\n\nCanonical link: https://commits.webkit.org/316416@main",
      "email": "emw@apple.com",
      "hash": "45907503776ed9c8a5ef6b8966b9fade84009d67",
      "subject": "Build fix for \"[Build] Reenable JSC and WebCore module verifier on public SDK builds\""
    },
    "316417@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316417@main",
      "clUrl": "https://commits.webkit.org/316417@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=284430\nrdar://141255575\n\nReviewed by Taher Ali.\n\nMerge: https://source.chromium.org/chromium/chromium/src/+/6bfac6ae76afebd09ad6f141205b22643d7566a1\n\nThis patch is to make these two tests reftest.\n\nThanks Taher for helping in fixing `fuzziness` issue.\n\n* LayoutTests/platform/gtk/svg/custom/uri-reference-handling-expected.png: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/filters/feImage-remove-target-expected.txt: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/custom/uri-reference-handling-expected.png: Removed.\n* LayoutTests/platform/mac/imported/w3c/web-platform-tests/IndexedDB/idbcursor-advance-continue-async-expected.png: Removed.\n* LayoutTests/platform/mac/svg/custom/external-paintserver-reference-expected.png: Removed.\n* LayoutTests/platform/mac/svg/custom/uri-reference-handling-expected.png: Removed.\n* LayoutTests/svg/custom/external-paintserver-reference-expected.svg: Added.\n* LayoutTests/svg/custom/external-paintserver-reference-expected.txt: Removed.\n* LayoutTests/svg/custom/uri-reference-handling-expected.png: Removed.\n* LayoutTests/svg/custom/uri-reference-handling-expected.svg: Added.\n* LayoutTests/svg/custom/uri-reference-handling-expected.txt: Removed.\n* LayoutTests/svg/custom/uri-reference-handling.svg:\n\nCanonical link: https://commits.webkit.org/316417@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "f8806ab8f6fe38ff0025e8ea27fceba22ff25715",
      "subject": "Convert two external paintserver tests in svg/custom/ to reftests"
    },
    "316418@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316418@main",
      "clUrl": "https://commits.webkit.org/316418@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318419\nrdar://181203080\n\nReviewed by Devin Rousso.\n\nInspectorStyleSheet::buildArrayForComputedStyle's handling of a\nnon-parsed property overriding a previous same-named non-parsed\nproperty was dead code. getBoolean() returns std::optional\u003cbool\u003e, so\nthe guard `previousParsedOk \u0026\u0026 !previousParsedOk` evaluated to\n`has_value() \u0026\u0026 !has_value()`, which is always false. As a result the\n\"non-parsed property overrides previous non-parsed property\" path never\nran, and two duplicate invalid declarations of the same property both\nrendered as Active in the Styles sidebar instead of inactivating the\nearlier one.\n\nDereference the optional so the value is actually read:\n`previousParsedOk \u0026\u0026 !*previousParsedOk`.\n\n* Source/WebCore/inspector/InspectorStyleSheet.cpp:\n(WebCore::InspectorStyle::styleWithProperties):\n\nCanonical link: https://commits.webkit.org/316418@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "1240c24cc6c34462b69d9778250b03635123c978",
      "subject": "[Web Inspector] Duplicate invalid CSS declarations both show as Active due to dead has_value() \u0026\u0026 !has_value() check"
    },
    "316419@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316419@main",
      "clUrl": "https://commits.webkit.org/316419@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318415\nrdar://181201503\n\nReviewed by Devin Rousso.\n\nThe lossy-conversion guard in pickColorFromScreen() used || instead of \u0026\u0026.\nA color can't be both SRGB and DisplayP3, so the check was always true and\nevery picked color went through toColorTypeLossy\u003cDisplayP3\u003cfloat\u003e\u003e(), leaving\nthe lossless serializationForCSS(*color) branch dead. Use \u0026\u0026 so only colors\nthat are neither sRGB nor DisplayP3 are converted.\n\n* Source/WebCore/inspector/InspectorFrontendHost.cpp:\n(WebCore::InspectorFrontendHost::pickColorFromScreen):\n\nCanonical link: https://commits.webkit.org/316419@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "fe7b490a81f6cfe6c9cb502acc71ed2ce479cceb",
      "subject": "[Web Inspector] Inspector color picker always force-converts picked colors to DisplayP3"
    },
    "316420@main": {
      "author": "Alex Christensen",
      "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64",
      "cl": "316420@main",
      "clUrl": "https://commits.webkit.org/316420@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318456\nrdar://181254230\n\nReviewed by Abrar Rahman Protyasha.\n\nThis PR adapts to a few changes in C++26, making WebKit compile without warnings or errors.\nThe changes needed are as follows:\n\n1. std::is_trivial and std::is_trivial_v have been deprecated, and the compiler suggested I replace\n   their use with std::is_trivially_copyable_v\u003cT\u003e \u0026\u0026 std::is_trivially_default_constructible_v\u003cT\u003e.\n2. Something subtle changed with the std::span constructor with initializer lists, especially with\n   std::span\u003cconst bool\u003e.  A web search pointed me to wg21.link/p4144 though I can't say I've\n   followed along closely enough to know if that's the change. In any case, our Vector::span and\n   Vector::mutableSpan need explicit std::span\u003cconst T\u003e() and std::span\u003cT\u003e now to continue compiling.\n3. std::make_optional with an initializer list and no additional args no longer compiles as used in\n   markedTextForTextDecorationLineSpellingError and markedTextForTextDecorationLineGrammarError.\n   I did not find the change that caused this to happen, but std::make_optional without an initializer\n   list works before and after C++26, so I switch to that.\n\n* Source/JavaScriptCore/b3/B3Type.cpp:\n* Source/JavaScriptCore/jit/OperationResult.h:\n* Source/JavaScriptCore/runtime/MarkedVector.h:\n* Source/ThirdParty/libwebrtc/Source/webrtc/modules/video_coding/include/video_codec_interface.h:\n* Source/ThirdParty/libwebrtc/Source/webrtc/rtc_base/bounded_inline_vector_impl.h:\n(webrtc::bounded_inline_vector_impl::=):\n* Source/ThirdParty/libwebrtc/Source/webrtc/rtc_base/buffer.h:\n* Source/ThirdParty/libwebrtc/Source/webrtc/rtc_base/logging.h:\n* Source/ThirdParty/libwebrtc/Source/webrtc/rtc_base/zero_memory.h:\n* Source/ThirdParty/libwebrtc/Source/webrtc/test/fuzzers/fuzz_data_helper.h:\n* Source/WTF/wtf/IndexMap.h:\n(WTF::IndexMap::resize):\n* Source/WTF/wtf/Vector.h:\n(WTF::VectorCopier::uninitializedCopy):\n* Source/WTF/wtf/VectorTraits.h:\n* Source/WTF/wtf/unicode/icu/ICUHelpers.h:\n(WTF::CallBufferProducingFunction::argumentTuple):\n* Source/WebCore/rendering/TextBoxPainter.cpp:\n(WebCore::markedTextForTextDecorationLineSpellingError):\n(WebCore::markedTextForTextDecorationLineGrammarError):\n\nCanonical link: https://commits.webkit.org/316420@main",
      "email": "achristensen@apple.com",
      "hash": "d89c8f0325bb0bf8639e8759ff24f67e646eb70f",
      "subject": "Fix C++26 build"
    },
    "316421@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316421@main",
      "clUrl": "https://commits.webkit.org/316421@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318417\nrdar://181202027\n\nReviewed by Devin Rousso.\n\nInspectorNetworkAgent::searchOtherRequests() resolves textContentForResourceData(),\nwhich decodes content for cache-backed resources, but then counted matches against\nresourceData-\u003econtent() instead. For a cache-backed resource with no inline buffer,\ncontent() is null, so countRegularExpressionMatches() returned 0 and the resource\nwas silently omitted from Page.searchInResources results, even when it contained\nmatches.\n\nCount matches against the resolved *textContent instead.\n\n* Source/WebCore/inspector/agents/InspectorNetworkAgent.cpp:\n(WebCore::InspectorNetworkAgent::searchOtherRequests):\n\nCanonical link: https://commits.webkit.org/316421@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "50b261edfb66d41a824366be112eca53789859c4",
      "subject": "[Web Inspector] Page.searchInResources silently drops cache-backed resources from search results"
    },
    "316422@main": {
      "author": "Brent Fulgham",
      "avatar": "https://www.gravatar.com/avatar/c6989a65afef0d015b55c65406e37ccc?d=identicon\u0026s=64",
      "cl": "316422@main",
      "clUrl": "https://commits.webkit.org/316422@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317437\n\u003crdar://problem/179949639\u003e\n\nReviewed by Tim Nguyen.\n\nThe Roland support site (static.roland.com) shows two magnifying glass icons in Safari's\nsearch field where Chrome shows only one.\n\nThe HTML is:\n\n  \u003cinput class=\"form-control\" type=\"search\" name=\"q\" results=\"10\" ...\u003e\n\nwith CSS `appearance: none` and a `background-image: url(search.svg)` that paints the\nsite's own magnifying glass. The legacy WebKit-only `results=N` attribute opts the input\ninto ::-webkit-search-results-button, which caused WebKit to paint a search icon.\n\nThe fix is to match Chrome and Firefox behavior by removing the `results=N` feature\nwhen WebKit is used for web browsing. We retain it for backwards compatibility with\napps that may depend on it.\n\nWe gate the deprecation on a Linked-On-Or-After check so we avoid changing behavior\nunexpectedly. Developers can re-enable the feature using the new feature flag.\n\nI have also rebaselined the tests that were not specifically testing this deprecated\nfeature, but had layout impact now that the deprecated decoration is no longer automatically\nadded to search fields.\n\nTests: fast/forms/search/search-decorations-suppressed-with-appearance-none.html\n       fast/forms/search/search-results-button-suppressed-with-appearance-none.html\n\n* LayoutTests/fast/forms/box-shadow-override.html:\n* LayoutTests/fast/forms/change-input-type-and-submit-form-crash.html:\n* LayoutTests/fast/forms/disabled-search-input.html:\n* LayoutTests/fast/forms/ios/form-control-refresh/search/search-decoration-appearance-expected-mismatch.html:\n* LayoutTests/fast/forms/ios/form-control-refresh/search/search-decoration-appearance.html:\n* LayoutTests/fast/forms/placeholder-position.html:\n* LayoutTests/fast/forms/search-abs-pos-cancel-button.html:\n* LayoutTests/fast/forms/search-field-buttons-do-not-have-focus-rings-expected.html:\n* LayoutTests/fast/forms/search-field-buttons-do-not-have-focus-rings.html:\n* LayoutTests/fast/forms/search-input-rtl.html:\n* LayoutTests/fast/forms/search-rtl.html:\n* LayoutTests/fast/forms/search-styled.html:\n* LayoutTests/fast/forms/search-transformed.html:\n* LayoutTests/fast/forms/search-zoomed.html:\n* LayoutTests/fast/forms/search/search-padding-cancel-results-buttons.html:\n* LayoutTests/fast/forms/search/search-recent-searches.html:\n* LayoutTests/fast/forms/search/search-results-attribute-disabled-by-default-expected.txt: Added.\n* LayoutTests/fast/forms/search/search-results-attribute-disabled-by-default.html: Added.\n* LayoutTests/fast/forms/search/search-results-hidden-crash.html:\n* LayoutTests/fast/forms/search/search-size-with-decorations.html:\n* LayoutTests/fast/replaced/width100percent-searchfield.html:\n* LayoutTests/imported/blink/fast/forms/search-popup-crasher.html:\n* LayoutTests/pdf/crash-with-embed-hidden.html:\n* LayoutTests/platform/gtk/fast/css/focus-ring-exists-for-search-field-expected.txt:\n* LayoutTests/platform/gtk/fast/css/input-search-padding-expected.png:\n* LayoutTests/platform/gtk/fast/css/input-search-padding-expected.txt:\n* LayoutTests/platform/gtk/fast/css/text-input-with-webkit-border-radius-expected.png:\n* LayoutTests/platform/gtk/fast/css/text-input-with-webkit-border-radius-expected.txt:\n* LayoutTests/platform/gtk/fast/css/text-overflow-input-expected.txt:\n* LayoutTests/platform/gtk/fast/forms/control-restrict-line-height-expected.png:\n* LayoutTests/platform/gtk/fast/forms/control-restrict-line-height-expected.txt:\n* LayoutTests/platform/gtk/fast/forms/input-appearance-height-expected.png:\n* LayoutTests/platform/gtk/fast/forms/input-appearance-height-expected.txt:\n* LayoutTests/platform/gtk/fast/forms/placeholder-pseudo-style-expected.png:\n* LayoutTests/platform/gtk/fast/forms/placeholder-pseudo-style-expected.txt:\n* LayoutTests/platform/gtk/fast/forms/search-cancel-button-style-sharing-expected.png:\n* LayoutTests/platform/gtk/fast/forms/search-cancel-button-style-sharing-expected.txt:\n* LayoutTests/platform/gtk/fast/forms/search-display-none-cancel-button-expected.png:\n* LayoutTests/platform/gtk/fast/forms/search-display-none-cancel-button-expected.txt:\n* LayoutTests/platform/gtk/fast/forms/search-vertical-alignment-expected.png:\n* LayoutTests/platform/gtk/fast/forms/search-vertical-alignment-expected.txt:\n* LayoutTests/platform/gtk/fast/forms/searchfield-heights-expected.png:\n* LayoutTests/platform/gtk/fast/forms/searchfield-heights-expected.txt:\n* LayoutTests/platform/ios/fast/css/focus-ring-exists-for-search-field-expected.txt:\n* LayoutTests/platform/ios/fast/css/input-search-padding-expected.txt:\n* LayoutTests/platform/ios/fast/css/text-input-with-webkit-border-radius-expected.txt:\n* LayoutTests/platform/ios/fast/css/text-overflow-input-expected.txt:\n* LayoutTests/platform/ios/fast/forms/control-restrict-line-height-expected.txt:\n* LayoutTests/platform/ios/fast/forms/datalist/datalist-searchinput-appearance-expected.txt:\n* LayoutTests/platform/ios/fast/forms/input-appearance-height-expected.txt:\n* LayoutTests/platform/ios/fast/forms/placeholder-pseudo-style-expected.txt:\n* LayoutTests/platform/ios/fast/forms/search-cancel-button-style-sharing-expected.txt:\n* LayoutTests/platform/ios/fast/forms/search-display-none-cancel-button-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/css/focus-ring-exists-for-search-field-expected.png: Added.\n* LayoutTests/platform/mac-sequoia-wk2/fast/css/focus-ring-exists-for-search-field-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/css/text-input-with-webkit-border-radius-expected.png: Added.\n* LayoutTests/platform/mac-sequoia-wk2/fast/css/text-input-with-webkit-border-radius-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/css/text-overflow-input-expected.png: Added.\n* LayoutTests/platform/mac-sequoia-wk2/fast/css/text-overflow-input-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/forms/control-restrict-line-height-expected.png: Added.\n* LayoutTests/platform/mac-sequoia-wk2/fast/forms/control-restrict-line-height-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/forms/datalist/datalist-searchinput-appearance-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/forms/input-appearance-height-expected.png: Added.\n* LayoutTests/platform/mac-sequoia-wk2/fast/forms/input-appearance-height-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/forms/placeholder-pseudo-style-expected.png: Added.\n* LayoutTests/platform/mac-sequoia-wk2/fast/forms/placeholder-pseudo-style-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/forms/search-cancel-button-style-sharing-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/forms/search-display-none-cancel-button-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/forms/search-vertical-alignment-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/repaint/search-field-cancel-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/css/focus-ring-exists-for-search-field-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/css/text-input-with-webkit-border-radius-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/css/text-overflow-input-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/forms/datalist/datalist-searchinput-appearance-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/forms/input-appearance-height-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/forms/placeholder-pseudo-style-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/forms/search-cancel-button-style-sharing-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/forms/search-display-none-cancel-button-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/forms/search-vertical-alignment-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/repaint/search-field-cancel-expected.txt:\n* LayoutTests/platform/mac/fast/css/focus-ring-exists-for-search-field-expected.png:\n* LayoutTests/platform/mac/fast/css/text-input-with-webkit-border-radius-expected.png:\n* LayoutTests/platform/mac/fast/css/text-overflow-input-expected.png:\n* LayoutTests/platform/mac/fast/forms/control-restrict-line-height-expected.png:\n* LayoutTests/platform/mac/fast/forms/control-restrict-line-height-expected.txt:\n* LayoutTests/platform/mac/fast/forms/datalist/datalist-searchinput-appearance-expected.png:\n* LayoutTests/platform/mac/fast/forms/input-appearance-height-expected.png:\n* LayoutTests/platform/mac/fast/forms/placeholder-pseudo-style-expected.png:\n* LayoutTests/platform/mac/fast/forms/search-cancel-button-style-sharing-expected.png:\n* LayoutTests/platform/mac/fast/forms/search-display-none-cancel-button-expected.png:\n* LayoutTests/platform/mac/fast/forms/search-vertical-alignment-expected.png:\n* LayoutTests/platform/mac/fast/repaint/search-field-cancel-expected.png:\n* LayoutTests/platform/wpe/fast/css/focus-ring-exists-for-search-field-expected.png:\n* LayoutTests/platform/wpe/fast/css/focus-ring-exists-for-search-field-expected.txt:\n* LayoutTests/platform/wpe/fast/css/input-search-padding-expected.txt:\n* LayoutTests/platform/wpe/fast/css/text-input-with-webkit-border-radius-expected.txt:\n* LayoutTests/platform/wpe/fast/css/text-overflow-input-expected.png:\n* LayoutTests/platform/wpe/fast/css/text-overflow-input-expected.txt:\n* LayoutTests/platform/wpe/fast/forms/control-restrict-line-height-expected.txt:\n* LayoutTests/platform/wpe/fast/forms/input-appearance-height-expected.txt:\n* LayoutTests/platform/wpe/fast/forms/placeholder-pseudo-style-expected.txt:\n* LayoutTests/platform/wpe/fast/forms/search-cancel-button-style-sharing-expected.txt:\n* LayoutTests/platform/wpe/fast/forms/search-display-none-cancel-button-expected.txt:\n* LayoutTests/platform/wpe/fast/forms/search-vertical-alignment-expected.txt:\n* LayoutTests/platform/wpe/fast/forms/searchfield-heights-expected.txt:\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WTF/wtf/cocoa/RuntimeApplicationChecksCocoa.h:\n* Source/WebCore/html/HTMLInputElement.cpp:\n(WebCore::HTMLInputElement::attributeChanged):\n* Source/WebCore/html/SearchInputType.cpp:\n(WebCore::SearchInputType::createShadowSubtree):\n* Source/WebCore/rendering/RenderSearchField.cpp:\n(WebCore::RenderSearchField::showPopup):\n* Source/WebKit/Shared/WebPreferencesDefaultValues.cpp:\n(WebKit::defaultSearchInputResultsAttributeEnabled):\n* Source/WebKit/Shared/WebPreferencesDefaultValues.h:\n* Source/WebKitLegacy/mac/WebView/WebPreferencesDefaultValues.h:\n* Source/WebKitLegacy/mac/WebView/WebPreferencesDefaultValues.mm:\n(WebKit::defaultSearchInputResultsAttributeEnabled):\n\nCanonical link: https://commits.webkit.org/316422@main",
      "email": "bfulgham@apple.com",
      "hash": "08460408523d325ada0ba27a5e9022c4665e4b10",
      "subject": "roland.com: Double search icon in search field (works in Chrome)"
    },
    "316423@main": {
      "author": "Brady Eidson",
      "avatar": "https://www.gravatar.com/avatar/31bed81d6d8ef517f93b30add03f5651?d=identicon\u0026s=64",
      "cl": "316423@main",
      "clUrl": "https://commits.webkit.org/316423@main",
      "description": "rdar://175679886\n\nReviewed by Alex Christensen.\n\nThe Networking process is in charge of transferring message port ownership between web processes,\nas well as sending/fetching messages for web processes.\n\nThis patch teaches it to keep track of web ports are being transferred to and from, which enables\nmuch more thorough message checking of message port operations based on where they currently belong.\n\nCovered by new API tests.\n\n* Source/WebCore/dom/messageports/MessagePortChannel.h:\n* Source/WebCore/dom/messageports/MessagePortChannelRegistry.cpp:\n(WebCore::MessagePortChannelRegistry::messagePortChannelDestroyed):\n(WebCore::MessagePortChannelRegistry::recordPendingTransferOrigin):\n(WebCore::MessagePortChannelRegistry::claimPendingTransferOrigin):\n(WebCore::MessagePortChannelRegistry::recordPendingTransferDestination):\n(WebCore::MessagePortChannelRegistry::claimPendingTransferDestination):\n* Source/WebCore/dom/messageports/MessagePortChannelRegistry.h:\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:\n(WebKit::NetworkConnectionToWebProcess::createNewMessagePortChannel):\n(WebKit::NetworkConnectionToWebProcess::entangleLocalPortInThisProcessToRemote):\n(WebKit::NetworkConnectionToWebProcess::messagePortDisentangled):\n(WebKit::NetworkConnectionToWebProcess::messagePortClosed):\n(WebKit::NetworkConnectionToWebProcess::takeAllMessagesForPort):\n(WebKit::NetworkConnectionToWebProcess::postMessageToRemote):\n* Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerConnection.cpp:\n(WebKit::WebSWServerConnection::resolveUnregistrationJobInClient):\n* Source/WebKit/NetworkProcess/SharedWorker/WebSharedWorkerServerToContextConnection.cpp:\n(WebKit::WebSharedWorkerServerToContextConnection::postConnectEvent):\n* Source/WebKit/WebProcess/WebCoreSupport/WebMessagePortChannelProvider.cpp:\n(WebKit::WebMessagePortChannelProvider::messagePortClosed):\n* Tools/TestWebKitAPI/Resources/cocoa/MessagePortSecurity.mm:\n((MessagePortSecurity, CrossProcessForcedCloseViaUnauthenticatedMessagePortIdentifier)):\n((MessagePortSecurity, CrossProcessForcedDisentangleViaUnauthenticatedMessagePortIdentifier)):\n((MessagePortSecurity, CrossProcessForcedEntangleViaUnauthenticatedMessagePortIdentifier)):\n((MessagePortSecurity, CrossProcessChannelCreationWithForgedProcessIdentifier)):\n\nCanonical link: https://commits.webkit.org/316423@main",
      "email": "beidson@apple.com",
      "hash": "899dd99924a82b239242807fe962e5e526dcb294",
      "subject": "Guard against MessagePort confusion in the Network Process"
    },
    "316424@main": {
      "author": "Lily Spiniolas",
      "avatar": "https://www.gravatar.com/avatar/b65cfeb51301399bd50e338bb2d7613e?d=identicon\u0026s=64",
      "cl": "316424@main",
      "clUrl": "https://commits.webkit.org/316424@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318442\nrdar://181228601\n\nReviewed by Abrar Rahman Protyasha.\n\nIf the user scrolls down and then scrolls up with enough velocity to trigger top\nscroll stretching, the scroll view will rubberband, and synthetic momentum scrolling\nevents will fire. After doing this, if the user attempts to scroll up before the\nrubberband animation has completed, `interruptMomentumIfNeeded` is called, which sets\n`_suppressNextPanScrollDelta` to true, and the scroll delta is zeroed as a result. This\nstops any top scroll stretch from occuring, and thus pull-to-refresh cannot be triggered\neither.\n\nFix by calling `_resetCaughtDeceleratingScroll` in `didEndSyntheticMomentumScrolling`\nwhich sets `_suppressNextPanScrollDelta` to false.\n\n* Source/WebKit/UIProcess/mac/WKAppKitGestureController.mm:\n(-[WKAppKitGestureController didEndSyntheticMomentumScrolling]):\n\nCanonical link: https://commits.webkit.org/316424@main",
      "email": "lily_spiniolas@apple.com",
      "hash": "923b0c360c9544f0b150d1dfe3a92f193cc86af0",
      "subject": "REGRESSION (315351@main): [macOS] Pull to refresh and top scroll stretching often fail to activate"
    },
    "316426@main": {
      "author": "Basuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/5192a1151c7575317affb7a4633f8d63?d=identicon\u0026s=64",
      "cl": "316426@main",
      "clUrl": "https://commits.webkit.org/316426@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317229\nrdar://179857636\n\nReviewed by Charlie Wolfe.\n\nFollow-up to https://bugs.webkit.org/show_bug.cgi?id=317077.\n\nPer HTML's \"traverse the history by a delta\" algorithm, history.back/\nforward/go(n) appends a task to the top-level traversable's session\nhistory traversal queue. The previous fix (bug 317077) implemented\nper-WebProcess coalescing by forwarding to the top frame's\nNavigationScheduler when reachable in this WebProcess. Under Site\nIsolation, when the top frame is a RemoteFrame (a cross-site iframe\ninitiates the traversal), the queue lives above any single WebProcess\nand the originating scheduler can't see traversals from other\nprocesses targeting the same traversable.\n\nSymptom: two cross-site iframes in different WebProcesses each call\nhistory.back() in the same task; both navigations execute and the\nuser sees an extra intermediate document load that the spec says\nshould not occur.\n\nIntroduce SessionHistoryTraversalQueue (defined in its own\nUIProcess/SessionHistoryTraversalQueue.{h,cpp} rather than nested in\nWebPageProxy), owned by WebPageProxy (top-level traversable proxy).\nThe queue accumulates pending delta\nacross all WebProcesses targeting this page and flushes on a 0-delay\ntimer, calling goToBackForwardItemAtIndex with the net delta (no-op\nwhen delta == 0, matching \"going nowhere\"). NavigationScheduler's\nexisting per-WebProcess aggregation in scheduleHistoryNavigation now\ngains a second branch: when the top frame is in another process\n(top frame downcasts to RemoteFrame), forward via a new\nLocalFrameLoaderClient hook (dispatchEnqueueHistoryTraversalDelta)\nthat posts WebPageProxy::EnqueueHistoryTraversalDelta to the\nUIProcess. The originating frame's pending m_redirect and\nin-progress load are completed/cancelled the same way the LocalFrame\ntop branch does in 317077, so an iframe's pending\nScheduledLocationChange doesn't race the queued traversal.\n\nTrust model note: EnqueueHistoryTraversalDelta accepts an int32_t\ndelta from any WebProcess and forwards it to\ngoToBackForwardItemAtIndex on flush. This is the same trust boundary\nas the existing GoToBackForwardItemAtIndex IPC; Site Isolation does\nnot introduce a new attack vector here. The eventual\nWebBackForwardList lookup clamps to the available range, so an\nout-of-range delta degrades to a no-op rather than memory unsafety.\n\nThis is the observable-coalescing approximation; the spec-faithful\n\"sequential apply + synchronous queue jumping\" is left for a future\nepic. The class name (SessionHistoryTraversalQueue) leaves room for\nthat evolution.\n\nOut of scope here: spec-correct top-level reload semantics for\nhistory.go(0), which remains implemented as a per-frame reload —\ntracked alongside bug 317077.\n\nDrive-by cleanup carried in this follow-up: drop the unused\nFrameLoadType parameter from both this new IPC and the sibling\nGoToBackForwardItemAtIndex IPC (introduced for 317077). Both call\nsites in NavigationScheduler always pass IndexedBackForward and the\nUIProcess methods always forward the same constant; the parameter\nwas dead weight. The FrameLoaderClient hooks\n(dispatchGoToBackForwardItemAtIndex, dispatchEnqueueHistoryTraversalDelta)\nare simplified to match.\n\nTest plan: SiteIsolation.CrossProcessHistoryTraversalCoalesce builds\na 3-entry main-frame history (a, b, c) where each page hosts two\ncross-site iframes (webkit.org and apple.com) in distinct\nWebProcesses. main-frame postMessage triggers both iframes to call\nhistory.back() in the same JS turn; the two\nEnqueueHistoryTraversalDelta IPCs land in the same UIProcess flush\nwindow and combine into one goToBackForwardItem(-2), so main goes\nc-\u003ea in a single navigation (BFList: backList=0, forwardList=2). The\ntest is sensitive: temporarily disabling the new RemoteFrame branch\nin NavigationScheduler causes the BFList state assertions to fail.\nThe bug 317077 API tests (WKBackForwardList.* synchronous coalescing\nsuite) and the SI history regression set under SiteIsolation.* do\nnot regress.\n\n* Source/WebCore/loader/EmptyClients.cpp:\n(WebCore::EmptyFrameLoaderClient::dispatchEnqueueHistoryTraversalDelta):\n* Source/WebCore/loader/EmptyFrameLoaderClient.h:\n* Source/WebCore/loader/LocalFrameLoaderClient.h:\n* Source/WebCore/loader/NavigationScheduler.cpp:\n(WebCore::NavigationScheduler::scheduleHistoryNavigation):\n* Source/WebKit/Platform/Curl.cmake: Touch to force a CMake re-run so Win/PlayStation incremental builds pick up new Sources.txt files.\n* Source/WebKit/Sources.txt:\n* Source/WebKit/UIProcess/SessionHistoryTraversalQueue.cpp: Added.\n(WebKit::SessionHistoryTraversalQueue::SessionHistoryTraversalQueue):\n(WebKit::SessionHistoryTraversalQueue::~SessionHistoryTraversalQueue):\n(WebKit::SessionHistoryTraversalQueue::enqueueDelta):\n(WebKit::SessionHistoryTraversalQueue::cancel):\n(WebKit::SessionHistoryTraversalQueue::flush):\n* Source/WebKit/UIProcess/SessionHistoryTraversalQueue.h: Added.\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::WebPageProxy):\n(WebKit::WebPageProxy::close):\n(WebKit::WebPageProxy::enqueueHistoryTraversalDelta):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.messages.in:\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp:\n(WebKit::WebLocalFrameLoaderClient::dispatchEnqueueHistoryTraversalDelta):\n* Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.h:\n* Source/WebKitLegacy/mac/WebCoreSupport/WebFrameLoaderClient.h:\n* Source/WebKitLegacy/mac/WebCoreSupport/WebFrameLoaderClient.mm:\n(WebFrameLoaderClient::dispatchEnqueueHistoryTraversalDelta):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TEST(SiteIsolation, CrossProcessHistoryTraversalCoalesce)):\n\nCanonical link: https://commits.webkit.org/316426@main",
      "email": "basuke@apple.com",
      "hash": "7a422d312c3cce60bdee0963a7cb205bb9a72e1f",
      "subject": "[NavigationScheduler] history.back/forward/go(n) coalescing across processes via UIProcess session history traversal queue"
    }
  },
  "date": "2026-07-02",
  "days": 1,
  "generatedAt": "2026-07-02T22:06:14Z",
  "markdown": "## Highlights\n\n- **Security** Locked down session history IPC so a compromised WebContent process can no longer spoof back/forward list messages to gain arbitrary file URL access. [commit 316361@main](https://commits.webkit.org/316361@main)\n- **Security** Closed a cross-origin clipboard leak where a child iframe could read clipboard data via top-level user interaction. [commit 316338@main](https://commits.webkit.org/316338@main)\n- **Security** Fixed a worker-side UAF in Permissions::query() plus worker.terminate() that could destroy a DeferredPromise across threads. [commit 316383@main](https://commits.webkit.org/316383@main)\n- **Security** Fixed multiple WebGPU out-of-bounds paths in invalid pipeline layouts and per-buffer index validation state. [commit 316387@main](https://commits.webkit.org/316387@main)\n- **Web Platform** history.back(), history.forward(), and history.go(n) now coalesce across processes through a UIProcess session history traversal queue, tightening multi-process navigation behavior. [commit 316426@main](https://commits.webkit.org/316426@main)\n- **Mobile** iOS file upload got a real fix for PDF attachments, removing a painful regression in common form flows. [commit 316391@main](https://commits.webkit.org/316391@main)\n- **V8** JavaScriptCore landed the Table64 JS API, a notable capability addition for large table-style binary data use cases. [commit 316389@main](https://commits.webkit.org/316389@main)\n- **Rendering** WebKit fixed a root compositing repaint bug where changing the body's background could fail to repaint the composited root element. [commit 316415@main](https://commits.webkit.org/316415@main)\n- **Privacy** Local file access rules tightened again, with sandbox-extension validation and temp-directory restrictions closing off several file loading paths. [commit 316410@main](https://commits.webkit.org/316410@main)\n\n## What landed by area\n\n### Security and process isolation\n\n- **Security** Guarded against MessagePort confusion in the Network Process to harden cross-process message handling. [commit 316423@main](https://commits.webkit.org/316423@main)\n- **Security** Restricted the Network process from loading files out of temp directories. [commit 316410@main](https://commits.webkit.org/316410@main)\n- **Security** WebPageProxy now checks hasGrantedSandboxExtensionForFile on NavigationActionData.request httpBody when creating a new page. [commit 316388@main](https://commits.webkit.org/316388@main)\n- **Security** EncodedFileData filenames are now validated during decidePolicyForNavigationAction. [commit 316384@main](https://commits.webkit.org/316384@main)\n- **Security** FormDataReference validation no longer accepts invalid sandbox extensions. [commit 316378@main](https://commits.webkit.org/316378@main)\n- **Security** Only pages in the sending process may talk to _WKRemoteObjectRegistry now. [commit 316400@main](https://commits.webkit.org/316400@main)\n- **Privacy** Removed a blanket storage-root file path allow from blob access enforcement. [commit 316364@main](https://commits.webkit.org/316364@main)\n- **Security** Blocked a data: URL write-to-disk path where compromised Web Content could abuse download policy to persist attacker-controlled bytes. [commit 316344@main](https://commits.webkit.org/316344@main)\n- **Security** Fixed type confusion from a raw Exception cell escaping to script when throwVMError bypassed a sentinel check. [commit 316332@main](https://commits.webkit.org/316332@main)\n- **Security** HTTPS-only error checks now reuse the existing object instead of constructing a new one. [commit 316411@main](https://commits.webkit.org/316411@main)\n- **Mobile** macOS now enables the feature that blocks local file loads without a sandbox extension. [commit 316386@main](https://commits.webkit.org/316386@main)\n\n### JavaScriptCore and runtime\n\n- **V8** Intl.NumberFormat was moved onto the modern unit and skeleton path. [commit 316407@main](https://commits.webkit.org/316407@main)\n- **Refactor** IRO and ArrayMode got small cleanup work. [commit 316395@main](https://commits.webkit.org/316395@main)\n- **V8** getByIdMegamorphic now uses a throw scope in the right places. [commit 316380@main](https://commits.webkit.org/316380@main)\n- **V8** Some DFG intrinsics now bail out when the callee comes from another realm. [commit 316359@main](https://commits.webkit.org/316359@main)\n- **Build** WTF Int128 now falls back to Int128Impl when the standard library lacks __int128_t support. [commit 316358@main](https://commits.webkit.org/316358@main)\n- **V8** YARR fixed incorrect multiline matches caused by its EOL string list optimization. [commit 316345@main](https://commits.webkit.org/316345@main)\n- **Perf** JSC encode() now uses a direct 3-character append for \"%XY\" escapes. [commit 316343@main](https://commits.webkit.org/316343@main)\n- **V8** B3 CSE extras adjustment was fixed. [commit 316339@main](https://commits.webkit.org/316339@main)\n\n### Rendering, CSS, SVG, and layout\n\n- **Rendering** corner-shape added borderContourPath support for notch corner shapes. [commit 316397@main](https://commits.webkit.org/316397@main)\n- **Rendering** Modern grid layout fixed a case where mutation could incorrectly rerun layout behavior. [commit 316392@main](https://commits.webkit.org/316392@main)\n- **Refactor** deprecatedToStyle use was moved out of CSS keyframe selector parsing. [commit 316393@main](https://commits.webkit.org/316393@main)\n- **Perf** SVGAnimatedPropertyPairAccessor::detach() no longer churns refcounts through Ref-returning helpers. [commit 316404@main](https://commits.webkit.org/316404@main)\n- **Rendering** Dynamic orient and markerUnits changes on SVGMarkerElement now repaint the referencing element correctly. [commit 316350@main](https://commits.webkit.org/316350@main)\n- **Rendering** ContentVisibilityDocumentState::updateViewportProximity avoids a redundant hash lookup. [commit 316353@main](https://commits.webkit.org/316353@main)\n- **Rendering** View transition transform tests were stabilized around float versus double blending precision. [commit 316352@main](https://commits.webkit.org/316352@main)\n- **Refactor** UIEvent::initUIEvent now actually moves its WindowProxy instead of copying a RefPtr rvalue. [commit 316347@main](https://commits.webkit.org/316347@main)\n- **UI** PopoverData had two uninitialized state fields fixed before they could bite rendering and visibility behavior. [commit 316348@main](https://commits.webkit.org/316348@main)\n- **Rendering** Two SVG external paintserver tests were converted to reftests. [commit 316417@main](https://commits.webkit.org/316417@main)\n- **Refactor** SVG animation and graphics code now uses protect() instead of Ref { } in more places. [commit 316370@main](https://commits.webkit.org/316370@main)\n\n### Web Inspector and developer tooling\n\n- **DevTools** Page.searchInResources now includes cache-backed resources instead of silently dropping them. [commit 316421@main](https://commits.webkit.org/316421@main)\n- **DevTools** The Inspector color picker no longer force-converts picked colors to DisplayP3. [commit 316419@main](https://commits.webkit.org/316419@main)\n- **DevTools** Duplicate invalid CSS declarations no longer both show up as Active due to a dead condition. [commit 316418@main](https://commits.webkit.org/316418@main)\n- **DevTools** The Accessibility sidebar now populates for cross-origin iframe nodes. [commit 316399@main](https://commits.webkit.org/316399@main)\n- **DevTools** FrameDOMAgent gained resolveNode, requestNode, and setInspectedNode support for Site Isolation flows. [commit 316367@main](https://commits.webkit.org/316367@main)\n- **Build** The analyze-safer-cpp download prompt got clearer. [commit 316382@main](https://commits.webkit.org/316382@main)\n\n### Media, WebRTC, audio, and graphics\n\n- **Media** HDR gain-map parsing now handles the target pixelFormat correctly. [commit 316405@main](https://commits.webkit.org/316405@main)\n- **Media** WebProcess AudioSession is kept active more reliably during live microphone capture. [commit 316394@main](https://commits.webkit.org/316394@main)\n- **UI** TimeLabel no longer reformats on every timeupdate when the value did not change. [commit 316390@main](https://commits.webkit.org/316390@main)\n- **Media** WebCore now stores WaveShaperProcessor curves as Vector\u003cfloat\u003e to avoid a cross-thread RefCounted race. [commit 316385@main](https://commits.webkit.org/316385@main)\n- **Media** Fixed unchecked exception returns in ReadableByteStreamController close handling and TeeDefaultReadRequest close steps. [commit 316363@main](https://commits.webkit.org/316363@main)\n- **Media** Fixed a ServiceWorkerDownloadTask UAF caused by a stale FunctionDispatcherQueue after a second EstablishSWContextConnection. [commit 316362@main](https://commits.webkit.org/316362@main)\n- **Media** Fixed an off-main-thread RemoteAudioMediaStreamTrackRenderer teardown path that mutated AudioSession interruption observers without locking. [commit 316360@main](https://commits.webkit.org/316360@main)\n- **Media** Fixed a libwebrtc RtpTransceiver codec-state UAF reachable through setCodecPreferences after RTCPeerConnection GC. [commit 316356@main](https://commits.webkit.org/316356@main)\n- **Media** Rebased WPT coverage for webrtc encoded transform tests. [commit 316396@main](https://commits.webkit.org/316396@main)\n- **Security** Fixed a GC-thread data race in JSTextTrackCue child visiting that could turn into UAF. [commit 316337@main](https://commits.webkit.org/316337@main)\n\n### GPU, WebGPU, and WebGL\n\n- **GPU** Queue::writeTexture() now returns early on the 1D fast path when copyExtent.height is zero. [commit 316374@main](https://commits.webkit.org/316374@main)\n- **GPU** WebGL dropped code tied to externalImageTextureBindingPoint(). [commit 316369@main](https://commits.webkit.org/316369@main)\n- **GPU** ANGLE dEQP test support landed, improving graphics conformance coverage. [commit 316368@main](https://commits.webkit.org/316368@main)\n\n### Platform behavior, UI, and site compatibility\n\n- **UI** macOS pull to refresh and top-scroll stretching were fixed after a regression made activation unreliable. [commit 316424@main](https://commits.webkit.org/316424@main)\n- **UI** roland.com no longer shows a duplicate search icon in the search field. [commit 316422@main](https://commits.webkit.org/316422@main)\n- **UI** Smart Lists fixed a nasty case where typing space tried to create a bullet and erased the line. [commit 316412@main](https://commits.webkit.org/316412@main)\n- **Networking** boingboing.net article loads no longer intermittently lose styling after a regression. [commit 316381@main](https://commits.webkit.org/316381@main)\n- **Web Platform** Windows now enables DataTransferItems by default. [commit 316351@main](https://commits.webkit.org/316351@main)\n- **UI** mms.pinduoduo.com no longer shows Safari users a fake \"your browser is not Chrome\" interstitial. [commit 316336@main](https://commits.webkit.org/316336@main)\n- **Mobile** WPE no longer pops the on-screen keyboard when focus is set programmatically. [commit 316375@main](https://commits.webkit.org/316375@main)\n- **UI** visionOS fixed Auto Dimming menu positioning after Safari window resize. [commit 316365@main](https://commits.webkit.org/316365@main)\n- **Web Platform** WebExtensions gained browser.tabs.move(...). [commit 316366@main](https://commits.webkit.org/316366@main)\n- **Networking** DataTransferItemList::didSetStringData now reuses cached lowercase conversion instead of recomputing it. [commit 316349@main](https://commits.webkit.org/316349@main)\n\n### Accessibility\n\n- **A11y** iOS accessibility wrappers now expose the line number for a given character index. [commit 316355@main](https://commits.webkit.org/316355@main)\n- **A11y** VoiceOver no longer reads stale geometry after a frame scrolls its own content following ACCESSIBILITY_LOCAL_FRAME changes. [commit 316341@main](https://commits.webkit.org/316341@main)\n\n### Build, infra, and test garden\n\n- **Build** Fixed the C++26 build. [commit 316420@main](https://commits.webkit.org/316420@main)\n- **Build** Reenabled the JSC and WebCore module verifier on public SDK builds. [commit 316413@main](https://commits.webkit.org/316413@main)\n- **Build** Follow-up build fix for the module verifier reenablement. [commit 316416@main](https://commits.webkit.org/316416@main)\n- **Build** CMake now reruns after Sources.txt changes, fixing a regression. [commit 316408@main](https://commits.webkit.org/316408@main)\n- **Build** CMake build failures were fixed. [commit 316346@main](https://commits.webkit.org/316346@main)\n- **Build** GTK and WPE cross-builds no longer auto-enable Swift. [commit 316335@main](https://commits.webkit.org/316335@main)\n- **Build** WKCI moved generate-jsc-bundle from the GTK release build bot to the packaging nightly bot. [commit 316372@main](https://commits.webkit.org/316372@main)\n- **Build** CISupport's start-local-buildbot-server was updated for Python 3.13 and post-315213 behavior. [commit 316371@main](https://commits.webkit.org/316371@main)\n- **Build** Upstreamed the HAVE_MODEL_MEMORY_ATTRIBUTION feature flag. [commit 316354@main](https://commits.webkit.org/316354@main)\n- **Build** Fixed a constant api-test crash in TestWebKitAPI.JSBuffer.Data. [commit 316340@main](https://commits.webkit.org/316340@main)\n- **Build** Marked TestWebKitAPI.JSBuffer.Data as a constant crash in gardening while the fix moved through. [commit 316333@main](https://commits.webkit.org/316333@main)\n- **Build** Marked TestWebKitAPI.WebKit.BlockedUploadDirectory as a constant failure in gardening. [commit 316414@main](https://commits.webkit.org/316414@main)\n- **Build** Marked platform/mac/media/audio-session-deactivated-when-suspended.html as flaky on macOS Release. [commit 316406@main](https://commits.webkit.org/316406@main)\n- **Build** Marked accessibility/mac/input-replacevalue-userinfo.html as a constant timeout on macOS Debug. [commit 316403@main](https://commits.webkit.org/316403@main)\n- **Build** Fixed an assertions-enabled failure in forged-resource-load-statistics-storage-access.html. [commit 316402@main](https://commits.webkit.org/316402@main)\n- **Build** Rebaselined a constant iOS26 text failure in sticky-overlap-extent.html. [commit 316409@main](https://commits.webkit.org/316409@main)\n- **Build** Marked a near-constant WPE and GTK crash in send-gpu-GetShareableBitmap-RemoteRenderingBackend.html. [commit 316376@main](https://commits.webkit.org/316376@main)\n\n### Memory safety and correctness fixes\n\n- **Security** Large pages no longer overflow the CachedMatchFinder buffer. [commit 316401@main](https://commits.webkit.org/316401@main)\n- **Security** Fixed a heap UAF in XSLStyleSheet after libxslt freed an imported doc on compile failure. [commit 316377@main](https://commits.webkit.org/316377@main)\n- **Security** Fixed a UAF in FocusController::findAndFocusElementInDocumentOrder. [commit 316373@main](https://commits.webkit.org/316373@main)",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [
    {
      "name": "Unreviewed",
      "count": 3
    },
    {
      "name": "Cherry-pick",
      "count": 1
    }
  ],
  "since": "2026-07-02",
  "totals": {
    "commits": 96,
    "features": 92,
    "rolls": 4
  },
  "until": "2026-07-02"
}