{ "commits": { "316428@main": { "author": "Nikolas Zimmermann", "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64", "cl": "316428@main", "clUrl": "https://commits.webkit.org/316428@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318363\n\nReviewed by Rob Buis.\n\nResolving the url(#id) fill or stroke paint server from style on every paint\nre-parses the URL string and looks the element up by id, which is not cheap.\n\nCache the resolved RenderSVGResourcePaintServer on ReferencedSVGResources, the\nSVG-only object in rare data that already tracks a renderer's fill and stroke\nreferences. It exists whenever a paint server is referenced and the weak pointer\nclears itself if the paint server is destroyed. Only the renderer's own style\nis cached. A foreign style passed by the text selection or decoration painters\npoints at a different paint server, so it resolves fresh and never reads or\nwrites the cache.\n\nDrop the cache whenever it can go stale. styleDidChange clears it when fill or\nstroke changes. resourceChanged clears it when the referenced gradient or\npattern changes. To make that work under the layer-based engine, dispatch\nidChanged to RenderSVGResourceContainer, which was previously only wired up\nfor the legacy containers, and have it notify existing clients so a renamed\nresource repaints properly.\n\nCovered by existing tests.\n\n* Source/WebCore/rendering/ReferencedSVGResources.cpp:\n(WebCore::CSSSVGResourceElementClient::resourceChanged):\n(WebCore::ReferencedSVGResources::cachedFillPaintServer const):\n(WebCore::ReferencedSVGResources::cachedStrokePaintServer const):\n(WebCore::ReferencedSVGResources::setCachedPaintServer):\n* Source/WebCore/rendering/ReferencedSVGResources.h:\n(WebCore::ReferencedSVGResources::invalidatePaintServerCache):\n* Source/WebCore/rendering/RenderElement.cpp:\n(WebCore::RenderElement::referencedSVGResources const):\n* Source/WebCore/rendering/RenderElement.h:\n* Source/WebCore/rendering/RenderLayerModelObject.cpp:\n(WebCore::RenderLayerModelObject::styleDidChange):\n(WebCore::RenderLayerModelObject::svgPaintServerResourceFromStyle const):\n(WebCore::RenderLayerModelObject::svgFillPaintServerResourceFromStyle const):\n(WebCore::RenderLayerModelObject::svgStrokePaintServerResourceFromStyle const):\n(WebCore::RenderLayerModelObject::invalidateSVGPaintServerCache const):\n* Source/WebCore/rendering/RenderLayerModelObject.h:\n* Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp:\n(WebCore::RenderSVGResourceContainer::idChanged):\n* Source/WebCore/svg/SVGElement.cpp:\n(WebCore::SVGElement::svgAttributeChanged):\n\nCanonical link: https://commits.webkit.org/316428@main", "email": "nzimmermann@igalia.com", "hash": "a36097add8b01a89a6cac53320fb09eec72f24ff", "subject": "[LBSE] Cache the resolved SVG fill and stroke paint server" }, "316429@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "316429@main", "clUrl": "https://commits.webkit.org/316429@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318409\nrdar://181198803\n\nReviewed by Devin Rousso.\n\nThe cross-axis reversal flag used identical branches\n(wasRowDirection ? isBlockFlipped : isBlockFlipped). The column case should\nuse isRightToLeftDirection, mirroring the main-axis line above (row/column\nroles swapped for the cross axis). No observable change today since the flag\nonly feeds symmetric min/max and fmin/fmax logic; this corrects the latent\nsemantics, so no new test\n\n* Source/WebCore/inspector/InspectorOverlay.cpp:\n(WebCore::InspectorOverlay::buildFlexOverlay):\n\nCanonical link: https://commits.webkit.org/316429@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "f602d7b57ed7b5ce0521d35909ef6d31af352e35", "subject": "[Web Inspector] Self-canceling ternary in flex overlay cross-axis direction calculation" }, "316430@main": { "author": "Wenson Hsieh", "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64", "cl": "316430@main", "clUrl": "https://commits.webkit.org/316430@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318407\nrdar://180538072\n\nReviewed by Abrar Rahman Protyasha.\n\nConsider the case where `TextIterator` (with the `TraversesFlatTree` option specified) traverses the\nfollowing content:\n\n```\n\u003cdetails\u003e\n \u003cdetails\u003ex\u003csummary\u003e\u003c/summary\u003e\u003c/details\u003e\n\u003c/details\u003e\n```\n\n(with DOM tree)\n\n```\n\u003cbody 0x10b3102b0\u003e\n \u003cdetails 0x10b3580b0\u003e\n \u003cdetails 0x10b358160\u003e\n \"x\" 0x10b3682a0\n \u003csummary 0x10b364220\u003e\n```\n\n...after descending into the `summary` element (`0x10b364220`), we ascend to the summary's assigned\nslot; from there, `nextSibling` gives the sibling (content) slot, whose first assigned node is the\ntext node `\"x\"`. `\"x\"`'s next sibling is the `summary` again. As a result, we bounce between the\n`summary` element, its assigned `slot`, and the containing UA shadow root under the `details`\nelement.\n\nTo fix this, align the behavior of `TraversesFlatTree` to `assignedSlotIgnoringUserAgentShadow` in\n`ComposedTreeIterator.h`, and skip slot elements in UA shadow roots when ascending the tree.\n\nTest: TextExtractionTests.NestedDetailsDoesNotHang\n\n* Source/WebCore/editing/TextIterator.cpp:\n(WebCore::parentInComposedTreeIgnoringUserAgentShadow):\n(WebCore::parentNodeOrShadowHost):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:\n(TestWebKitAPI::NestedDetailsDoesNotHang)):\n\nCanonical link: https://commits.webkit.org/316430@main", "email": "wenson_hsieh@apple.com", "hash": "31f6b383f7bee361fcdbe99b5f96f31052bc9f8b", "subject": "[iOS 27] chemicalguys.com sometimes hangs under TextExtraction::extractAllTextAndRects()" }, "316431@main": { "author": "Youenn Fablet", "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64", "cl": "316431@main", "clUrl": "https://commits.webkit.org/316431@main", "description": "rdar://175624943\n\nReviewed by Eric Carlson.\n\nWhen computing send encodings from remote SDP, we trim them according the max simulcast encodings, like done for addTransceiver.\nWe also change the debug check VideoCodecInitializer::SetupCodec in a release check as a further mitigation.\n\nTest: webrtc/addTrack-simulcast.html\n\n* LayoutTests/webrtc/addTrack-simulcast-expected.txt: Added.\n* LayoutTests/webrtc/addTrack-simulcast.html: Added.\n* Source/ThirdParty/libwebrtc/Source/webrtc/modules/video_coding/video_codec_initializer.cc:\n* Source/ThirdParty/libwebrtc/Source/webrtc/pc/sdp_offer_answer.cc:\n\nOriginally-landed-as: 305413.820@safari-7624-branch (0d8fd1ca4be9). rdar://181073924\nCanonical link: https://commits.webkit.org/316431@main", "email": "youenn@apple.com", "hash": "e8a476cd12df5fb1ea1f682f1c2381397c44ccef", "subject": "Stack buffer overflow in WebKit libwebrtc VideoCodecInitializer via remote SDP simulcast layers leads to WebContent memory corruption" }, "316432@main": { "author": "Jer Noble", "avatar": "https://www.gravatar.com/avatar/6d2cde9be23b98223ca964cb3b7813a0?d=identicon\u0026s=64", "cl": "316432@main", "clUrl": "https://commits.webkit.org/316432@main", "description": "rdar://178760948\nhttps://bugs.webkit.org/show_bug.cgi?id=318446\n\nReviewed by Eric Carlson.\n\nHistorically, WebKit has set `white-space:pre` on cues whose `snap-to-lines` flag is false,\nin order to correctly implement CEA-608 and CTA-708 captions, which require wrapping to be\ndisabled. However this affects all cues whose `snap-to-lines` flag is false, not just in-band\nclosed-captions like 608/708, and this affects real sites, including Apple.com.\n\nNarrowly scope the `white-space:pre` styles around cues who explicitly have `preventLineWrapping()`\nenabled, which will only be in-band generic cues.\n\nFor the WPT tests, split out the \"reset\" of styles to the standard-defined defaults into its own\n.css file, where `webvtt-test.css` just sets the styles under test; namely Ahem at a specific size.\n\nFor the ref tests, make the fake `.video` div a container, so container-relative size rules work.\n\nTest: imported/w3c/web-platform-tests/webvtt/rendering/cues-with-video/processing-model/snap-to-line-wrap.html\n\n* LayoutTests/imported/w3c/web-platform-tests/webvtt/rendering/cues-with-video/processing-model/basic.html:\n* LayoutTests/imported/w3c/web-platform-tests/webvtt/rendering/cues-with-video/processing-model/snap-to-line-wrap-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webvtt/rendering/cues-with-video/processing-model/snap-to-line-wrap.html:\n* LayoutTests/imported/w3c/web-platform-tests/webvtt/rendering/cues-with-video/processing-model/support/snap-to-line_long.vtt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webvtt/rendering/cues-with-video/processing-model/support/webvtt-ref.css:\n(.video):\n* LayoutTests/imported/w3c/web-platform-tests/webvtt/rendering/cues-with-video/processing-model/support/webvtt-reset.css:\n(::cue):\n* LayoutTests/imported/w3c/web-platform-tests/webvtt/rendering/cues-with-video/processing-model/support/webvtt-test.css:\n(::cue):\n* Source/WebCore/html/track/TextTrackCueGeneric.h:\n* Source/WebCore/html/track/VTTCue.cpp:\n(WebCore::VTTCueBox::applyCSSProperties):\n* Source/WebCore/html/track/VTTCue.h:\n(WebCore::VTTCue::preventLineWrapping const):\n(WebCore::VTTCue::wrapTextDuringPercentageBasedPositioning const): Deleted.\n\nCanonical link: https://commits.webkit.org/316432@main", "email": "jer.noble@apple.com", "hash": "66904a7e842df9824bd80a3f5729b0f4cddb2c15", "subject": "[WebVTT] Cues with snapToLines == false should wrap" }, "316433@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "316433@main", "clUrl": "https://commits.webkit.org/316433@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318423\nrdar://181204768\n\nReviewed by Devin Rousso.\n\nFrameCSSAgent::detectOrigin lacked the wasConstructedByJS() guard that\nInspectorCSSAgent::detectOrigin already has. A constructable stylesheet\n(`new CSSStyleSheet()` applied via `document.adoptedStyleSheets`) has no\nowner node and an empty href, so it fell into the User Agent branch of the\nownerNode/href heuristic. In the Web Inspector those author styles then\nappeared as uneditable User Agent styles.\n\nMirror the InspectorCSSAgent fix: check wasConstructedByJS() first and\nreport such stylesheets as Author, keeping the two near-duplicate\ndetectOrigin implementations in sync.\n\nFrameCSSAgent is only the active CSS backend dispatcher under Site\nIsolation (it is created by FrameInspectorController per LocalFrame and\nreached via FrameInspectorTarget), which is not enabled yet. The existing\nregression test LayoutTests/inspector/css/getMatchedStylesForNodeAdoptedStyleSheet.html\ntherefore exercises the page-level InspectorCSSAgent path, not this one,\nso this fix is currently untestable via a protocol layout test. Once Site\nIsolation is enabled that same test will cover the frame path.\n\n* Source/WebCore/inspector/agents/frame/FrameCSSAgent.cpp:\n(WebCore::FrameCSSAgent::detectOrigin):\n\nCanonical link: https://commits.webkit.org/316433@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "a942e1e61628d1a24bc8d20f3dea469a9b523aa1", "subject": "[Web Inspector] adopted (constructable) stylesheets misclassified as User Agent in the per-frame CSS agent" }, "316434@main": { "author": "Andy Estes", "avatar": "https://www.gravatar.com/avatar/643f10f01b26fd94d03482a2013b2ea0?d=identicon\u0026s=64", "cl": "316434@main", "clUrl": "https://commits.webkit.org/316434@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318481\nrdar://181273446\n\nReviewed by Jer Noble.\n\nRemoved support for AVMediaSource from MediaDeviceRoute and simplified the code now that an\nAVPlaybackControl-conforming object is the only observee.\n\nNo new tests. Covered by existing tests.\n\n* Source/WebCore/platform/audio/ios/MediaDeviceRoute.h:\n(WebCore::MediaDeviceRouteClient::errorDidChange):\n(WebCore::MediaDeviceRouteClient::playbackPositionDidChange):\n(WebCore::MediaDeviceRouteClient::playbackErrorDidChange): Deleted.\n(WebCore::MediaDeviceRouteClient::currentPlaybackPositionDidChange): Deleted.\n* Source/WebCore/platform/audio/ios/MediaDeviceRoute.mm:\n(-[WebPlaybackControlObserver setPlaybackControl:]):\n(-[WebPlaybackControlObserver observeValueForKeyPath:ofObject:change:context:]):\n(-[WebPlaybackControlObserver dealloc]):\n(WebCore::convert):\n(WebCore::MediaDeviceRoute::setPlaybackPosition):\n(-[WebMediaSourceObserver initWithRoute:]): Deleted.\n(-[WebMediaSourceObserver mediaSource]): Deleted.\n(-[WebMediaSourceObserver setMediaSource:]): Deleted.\n(-[WebMediaSourceObserver playbackControl]): Deleted.\n(-[WebMediaSourceObserver setPlaybackControl:]): Deleted.\n(-[WebMediaSourceObserver observeValueForKeyPath:ofObject:change:context:]): Deleted.\n(-[WebMediaSourceObserver dealloc]): Deleted.\n(WebCore::MediaDeviceRoute::playbackError const): Deleted.\n(WebCore::MediaDeviceRoute::currentPlaybackPosition const): Deleted.\n(WebCore::MediaDeviceRoute::setCurrentPlaybackPosition): Deleted.\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.cpp:\n(WebCore::MediaPlayerPrivateWirelessPlayback::seekToTarget):\n(WebCore::MediaPlayerPrivateWirelessPlayback::errorDidChange):\n(WebCore::MediaPlayerPrivateWirelessPlayback::playbackPositionDidChange):\n(WebCore::MediaPlayerPrivateWirelessPlayback::ensureTimebase):\n(WebCore::MediaPlayerPrivateWirelessPlayback::playbackErrorDidChange): Deleted.\n(WebCore::MediaPlayerPrivateWirelessPlayback::currentPlaybackPositionDidChange): Deleted.\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.h:\n\nCanonical link: https://commits.webkit.org/316434@main", "email": "aestes@apple.com", "hash": "2ebd30036b52f3f2999a12e54b2da051268b1895", "subject": "Take 2: [iOS] Remove support for AVMediaSource from MediaDeviceRoute" }, "316435@main": { "author": "Marcos Caceres", "avatar": "https://www.gravatar.com/avatar/d31c9c6a3b0af558a2945682020e5b90?d=identicon\u0026s=64", "cl": "316435@main", "clUrl": "https://commits.webkit.org/316435@main", "description": "rdar://168941907\nhttps://bugs.webkit.org/show_bug.cgi?id=306292\n\nReviewed by BJ Burg.\n\nAdd a WebDriver BiDi digitalCredentials module that allows automated testing\nof the Digital Credentials API by simulating wallet behavior (respond, decline,\nwait) without requiring a real credential provider.\n\nThe simulated wallet behavior is looked up for the requesting frame's browsing\ncontext, falling back to the session's default behavior, matching the Digital\nCredentials specification's \"handle virtual wallet behavior\" algorithm. To do\nthis, the requesting frame's identifier is threaded from the credential request\ncoordinator down to the UIProcess chooser entry point.\n\nA \"wait\" behavior parks the chooser completion handler so the request stays\npending. The handler is now released when the request is dismissed on abort or\ndocument teardown, not only when the session ends, so a waiting request cannot\nleak past the document that made it. The completion callback also tolerates a\nreply that arrives after the request was already aborted.\n\n* Source/WebCore/Modules/identity/CredentialRequestCoordinator.cpp:\n(WebCore::CredentialRequestCoordinator::initiateTheCredentialRequest):\n(WebCore::CredentialRequestCoordinator::processCredentialChooserResponse):\n* Source/WebCore/Modules/identity/CredentialRequestCoordinatorClient.h:\n* Source/WebCore/Modules/identity/dummy/DummyCredentialRequestCoordinatorClient.cpp:\n(WebCore::DummyCredentialRequestCoordinatorClient::showDigitalCredentialsChooser):\n* Source/WebCore/Modules/identity/dummy/DummyCredentialRequestCoordinatorClient.h:\n* Source/WebCore/loader/EmptyClients.cpp:\n* Source/WebKit/CMakeLists.txt:\n* Source/WebKit/DerivedSources-input.xcfilelist:\n* Source/WebKit/DerivedSources.make:\n* Source/WebKit/Sources.txt:\n* Source/WebKit/UIProcess/Automation/BidiDigitalCredentialsAgent.cpp: Added.\n(WebKit::toPresentationProtocol):\n(WebKit::BidiDigitalCredentialsAgent::BidiDigitalCredentialsAgent):\n(WebKit::BidiDigitalCredentialsAgent::~BidiDigitalCredentialsAgent):\n(WebKit::BidiDigitalCredentialsAgent::setVirtualWalletBehavior):\n(WebKit::BidiDigitalCredentialsAgent::behaviorForContext const):\n(WebKit::BidiDigitalCredentialsAgent::abortPendingHandler):\n(WebKit::BidiDigitalCredentialsAgent::holdPendingHandler):\n(WebKit::BidiDigitalCredentialsAgent::releasePendingHandler):\n(WebKit::BidiDigitalCredentialsAgent::cancelAllPendingRequests):\n* Source/WebKit/UIProcess/Automation/BidiDigitalCredentialsAgent.h: Added.\n* Source/WebKit/UIProcess/Automation/WebDriverBidiProcessor.cpp:\n(WebKit::WebDriverBidiProcessor::WebDriverBidiProcessor):\n* Source/WebKit/UIProcess/Automation/WebDriverBidiProcessor.h:\n* Source/WebKit/UIProcess/Automation/protocol/BidiDigitalCredentials.json: Added.\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::showDigitalCredentialsChooser):\n(WebKit::WebPageProxy::dismissDigitalCredentialsChooser):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.messages.in:\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Source/WebKit/WebProcess/DigitalCredentials/DigitalCredentialsCoordinator.cpp:\n(WebKit::DigitalCredentialsCoordinator::showDigitalCredentialsChooser):\n* Source/WebKit/WebProcess/DigitalCredentials/DigitalCredentialsCoordinator.h:\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:\n(WebKit::WebChromeClient::showDigitalCredentialsChooser):\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::showDigitalCredentialsChooser):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* WebDriverTests/imported/w3c/tools/webdriver/webdriver/bidi/client.py:\n(BidiSession.__init__):\n* WebDriverTests/imported/w3c/tools/webdriver/webdriver/bidi/modules/__init__.py:\n* WebDriverTests/imported/w3c/tools/webdriver/webdriver/bidi/modules/digital_credentials.py: Added.\n(DigitalCredentials):\n(DigitalCredentials.set_virtual_wallet_behavior):\n* WebDriverTests/imported/w3c/webdriver/tests/bidi/external/digital_credentials/__init__.py: Added.\n* WebDriverTests/imported/w3c/webdriver/tests/bidi/external/digital_credentials/set_virtual_wallet_behavior/__init__.py: Added.\n* WebDriverTests/imported/w3c/webdriver/tests/bidi/external/digital_credentials/set_virtual_wallet_behavior/set_virtual_wallet_behavior.py: Added.\n(test_set_virtual_wallet_behavior_respond):\n(test_set_virtual_wallet_behavior_decline):\n(test_set_virtual_wallet_behavior_wait):\n(test_set_virtual_wallet_behavior_clear):\n(test_set_virtual_wallet_behavior_invalid_respond_no_protocol):\n(test_set_virtual_wallet_behavior_invalid_decline_with_response):\n(test_set_virtual_wallet_behavior_respond_end_to_end):\n(test_set_virtual_wallet_behavior_wait_is_aborted):\n\nCanonical link: https://commits.webkit.org/316435@main", "email": "marcosc@apple.com", "hash": "fc22dff35d852f9e43f4d3f40924fd368b7a29e3", "subject": "[Digital Credentials] Add WebDriver BiDi digitalCredentials module for automated testing" }, "316436@main": { "author": "Cameron McCormack", "avatar": "https://www.gravatar.com/avatar/b2bb1b369be938a743e50f595bfa0798?d=identicon\u0026s=64", "cl": "316436@main", "clUrl": "https://commits.webkit.org/316436@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318305\nrdar://181100818\n\nReviewed by Tim Nguyen.\n\nThe UA @keyframes for the group animation were added directly to the style\nresolver's keyframe map, which is destroyed when the resolver is cleared by a\nstylesheet mutation during the transition. Retain them on the DocumentScope\n(like the dynamic view transition style rules) and re-establish them when the\nresolver is recreated, clearing them when the transition ends.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-view-transitions/dynamic-stylesheet-animations-timing-function-expected.txt:\n* Source/WebCore/dom/ViewTransition.cpp:\n(WebCore::ViewTransition::setupDynamicStyleSheet):\n* Source/WebCore/style/StyleDocumentScope.cpp:\n(WebCore::Style::DocumentScope::createDocumentResolver):\n(WebCore::Style::DocumentScope::clearViewTransitionStyles):\n(WebCore::Style::DocumentScope::addViewTransitionKeyframes):\n* Source/WebCore/style/StyleDocumentScope.h:\n\nCanonical link: https://commits.webkit.org/316436@main", "email": "heycam@apple.com", "hash": "39f1479785a288de9b888aff68ebd47cb71817df", "subject": "Dynamic stylesheet mutation loses running view transition group keyframes" }, "316437@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "316437@main", "clUrl": "https://commits.webkit.org/316437@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318492\n\nUnreviewed.\n\nIt always asserts with this stack:\nASSERTION FAILED: !isInWebKitChildProcess()\n/Users/alex/code/OpenSource/Source/WebKit/Shared/Cocoa/DefaultWebBrowserChecks.mm(306) : bool WebKit::isFullWebBrowserOrRunningTest()\n1 0x11dd18038 WebKit::isFullWebBrowserOrRunningTest()\n2 0x11dbf16f4 WebKit::defaultSearchInputResultsAttributeEnabled()\n3 0x11d9eee94 WebKit::WebPreferencesStore::defaults()\n\nThis was caught by EWS.\n\n* LayoutTests/fast/forms/box-shadow-override.html:\n* LayoutTests/fast/forms/change-input-type-and-submit-form-crash.html:\n* LayoutTests/fast/forms/disabled-search-input.html:\n* LayoutTests/fast/forms/ios/form-control-refresh/search/search-decoration-appearance-expected-mismatch.html:\n* LayoutTests/fast/forms/ios/form-control-refresh/search/search-decoration-appearance.html:\n* LayoutTests/fast/forms/placeholder-position.html:\n* LayoutTests/fast/forms/search-abs-pos-cancel-button.html:\n* LayoutTests/fast/forms/search-field-buttons-do-not-have-focus-rings-expected.html:\n* LayoutTests/fast/forms/search-field-buttons-do-not-have-focus-rings.html:\n* LayoutTests/fast/forms/search-input-rtl.html:\n* LayoutTests/fast/forms/search-rtl.html:\n* LayoutTests/fast/forms/search-styled.html:\n* LayoutTests/fast/forms/search-transformed.html:\n* LayoutTests/fast/forms/search-zoomed.html:\n* LayoutTests/fast/forms/search/search-padding-cancel-results-buttons.html:\n* LayoutTests/fast/forms/search/search-recent-searches.html:\n* LayoutTests/fast/forms/search/search-results-attribute-disabled-by-default-expected.txt: Removed.\n* LayoutTests/fast/forms/search/search-results-attribute-disabled-by-default.html: Removed.\n* LayoutTests/fast/forms/search/search-results-hidden-crash.html:\n* LayoutTests/fast/forms/search/search-size-with-decorations.html:\n* LayoutTests/fast/replaced/width100percent-searchfield.html:\n* LayoutTests/imported/blink/fast/forms/search-popup-crasher.html:\n* LayoutTests/pdf/crash-with-embed-hidden.html:\n* LayoutTests/platform/gtk/fast/css/focus-ring-exists-for-search-field-expected.txt:\n* LayoutTests/platform/gtk/fast/css/input-search-padding-expected.png:\n* LayoutTests/platform/gtk/fast/css/input-search-padding-expected.txt:\n* LayoutTests/platform/gtk/fast/css/text-input-with-webkit-border-radius-expected.png:\n* LayoutTests/platform/gtk/fast/css/text-input-with-webkit-border-radius-expected.txt:\n* LayoutTests/platform/gtk/fast/css/text-overflow-input-expected.txt:\n* LayoutTests/platform/gtk/fast/forms/control-restrict-line-height-expected.png:\n* LayoutTests/platform/gtk/fast/forms/control-restrict-line-height-expected.txt:\n* LayoutTests/platform/gtk/fast/forms/input-appearance-height-expected.png:\n* LayoutTests/platform/gtk/fast/forms/input-appearance-height-expected.txt:\n* LayoutTests/platform/gtk/fast/forms/placeholder-pseudo-style-expected.png:\n* LayoutTests/platform/gtk/fast/forms/placeholder-pseudo-style-expected.txt:\n* LayoutTests/platform/gtk/fast/forms/search-cancel-button-style-sharing-expected.png:\n* LayoutTests/platform/gtk/fast/forms/search-cancel-button-style-sharing-expected.txt:\n* LayoutTests/platform/gtk/fast/forms/search-display-none-cancel-button-expected.png:\n* LayoutTests/platform/gtk/fast/forms/search-display-none-cancel-button-expected.txt:\n* LayoutTests/platform/gtk/fast/forms/search-vertical-alignment-expected.png:\n* LayoutTests/platform/gtk/fast/forms/search-vertical-alignment-expected.txt:\n* LayoutTests/platform/gtk/fast/forms/searchfield-heights-expected.png:\n* LayoutTests/platform/gtk/fast/forms/searchfield-heights-expected.txt:\n* LayoutTests/platform/ios/fast/css/focus-ring-exists-for-search-field-expected.txt:\n* LayoutTests/platform/ios/fast/css/input-search-padding-expected.txt:\n* LayoutTests/platform/ios/fast/css/text-input-with-webkit-border-radius-expected.txt:\n* LayoutTests/platform/ios/fast/css/text-overflow-input-expected.txt:\n* LayoutTests/platform/ios/fast/forms/control-restrict-line-height-expected.txt:\n* LayoutTests/platform/ios/fast/forms/datalist/datalist-searchinput-appearance-expected.txt:\n* LayoutTests/platform/ios/fast/forms/input-appearance-height-expected.txt:\n* LayoutTests/platform/ios/fast/forms/placeholder-pseudo-style-expected.txt:\n* LayoutTests/platform/ios/fast/forms/search-cancel-button-style-sharing-expected.txt:\n* LayoutTests/platform/ios/fast/forms/search-display-none-cancel-button-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/css/focus-ring-exists-for-search-field-expected.png: Removed.\n* LayoutTests/platform/mac-sequoia-wk2/fast/css/focus-ring-exists-for-search-field-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/css/text-input-with-webkit-border-radius-expected.png: Removed.\n* LayoutTests/platform/mac-sequoia-wk2/fast/css/text-input-with-webkit-border-radius-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/css/text-overflow-input-expected.png: Removed.\n* LayoutTests/platform/mac-sequoia-wk2/fast/css/text-overflow-input-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/forms/control-restrict-line-height-expected.png: Removed.\n* LayoutTests/platform/mac-sequoia-wk2/fast/forms/control-restrict-line-height-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/forms/datalist/datalist-searchinput-appearance-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/forms/input-appearance-height-expected.png: Removed.\n* LayoutTests/platform/mac-sequoia-wk2/fast/forms/input-appearance-height-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/forms/placeholder-pseudo-style-expected.png: Removed.\n* LayoutTests/platform/mac-sequoia-wk2/fast/forms/placeholder-pseudo-style-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/forms/search-cancel-button-style-sharing-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/forms/search-display-none-cancel-button-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/forms/search-vertical-alignment-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/fast/repaint/search-field-cancel-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/css/focus-ring-exists-for-search-field-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/css/text-input-with-webkit-border-radius-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/css/text-overflow-input-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/forms/datalist/datalist-searchinput-appearance-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/forms/input-appearance-height-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/forms/placeholder-pseudo-style-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/forms/search-cancel-button-style-sharing-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/forms/search-display-none-cancel-button-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/forms/search-vertical-alignment-expected.txt:\n* LayoutTests/platform/mac-wk2/fast/repaint/search-field-cancel-expected.txt:\n* LayoutTests/platform/mac/fast/css/focus-ring-exists-for-search-field-expected.png:\n* LayoutTests/platform/mac/fast/css/text-input-with-webkit-border-radius-expected.png:\n* LayoutTests/platform/mac/fast/css/text-overflow-input-expected.png:\n* LayoutTests/platform/mac/fast/forms/control-restrict-line-height-expected.png:\n* LayoutTests/platform/mac/fast/forms/control-restrict-line-height-expected.txt:\n* LayoutTests/platform/mac/fast/forms/datalist/datalist-searchinput-appearance-expected.png:\n* LayoutTests/platform/mac/fast/forms/input-appearance-height-expected.png:\n* LayoutTests/platform/mac/fast/forms/placeholder-pseudo-style-expected.png:\n* LayoutTests/platform/mac/fast/forms/search-cancel-button-style-sharing-expected.png:\n* LayoutTests/platform/mac/fast/forms/search-display-none-cancel-button-expected.png:\n* LayoutTests/platform/mac/fast/forms/search-vertical-alignment-expected.png:\n* LayoutTests/platform/mac/fast/repaint/search-field-cancel-expected.png:\n* LayoutTests/platform/wpe/fast/css/focus-ring-exists-for-search-field-expected.png:\n* LayoutTests/platform/wpe/fast/css/focus-ring-exists-for-search-field-expected.txt:\n* LayoutTests/platform/wpe/fast/css/input-search-padding-expected.txt:\n* LayoutTests/platform/wpe/fast/css/text-input-with-webkit-border-radius-expected.txt:\n* LayoutTests/platform/wpe/fast/css/text-overflow-input-expected.png:\n* LayoutTests/platform/wpe/fast/css/text-overflow-input-expected.txt:\n* LayoutTests/platform/wpe/fast/forms/control-restrict-line-height-expected.txt:\n* LayoutTests/platform/wpe/fast/forms/input-appearance-height-expected.txt:\n* LayoutTests/platform/wpe/fast/forms/placeholder-pseudo-style-expected.txt:\n* LayoutTests/platform/wpe/fast/forms/search-cancel-button-style-sharing-expected.txt:\n* LayoutTests/platform/wpe/fast/forms/search-display-none-cancel-button-expected.txt:\n* LayoutTests/platform/wpe/fast/forms/search-vertical-alignment-expected.txt:\n* LayoutTests/platform/wpe/fast/forms/searchfield-heights-expected.txt:\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WTF/wtf/cocoa/RuntimeApplicationChecksCocoa.h:\n* Source/WebCore/html/HTMLInputElement.cpp:\n(WebCore::HTMLInputElement::attributeChanged):\n* Source/WebCore/html/SearchInputType.cpp:\n(WebCore::SearchInputType::createShadowSubtree):\n* Source/WebCore/rendering/RenderSearchField.cpp:\n(WebCore::RenderSearchField::showPopup):\n* Source/WebKit/Shared/WebPreferencesDefaultValues.cpp:\n(WebKit::defaultSearchInputResultsAttributeEnabled): Deleted.\n* Source/WebKit/Shared/WebPreferencesDefaultValues.h:\n* Source/WebKitLegacy/mac/WebView/WebPreferencesDefaultValues.h:\n* Source/WebKitLegacy/mac/WebView/WebPreferencesDefaultValues.mm:\n(WebKit::defaultSearchInputResultsAttributeEnabled): Deleted.\n\nCanonical link: https://commits.webkit.org/316437@main", "email": "achristensen@apple.com", "hash": "396590a2a5404c9a1925697cff31c0d425a3a2c9", "subject": "Revert 316422@main" }, "316438@main": { "author": "Zak Ridouh", "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64", "cl": "316438@main", "clUrl": "https://commits.webkit.org/316438@main", "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=314585\u003e\n\u003crdar://176483524\u003e\n\nReviewed by Antoine Quint.\n\nm_progressBasedTimelineRegistry was freed on the main thread by\nupdateTimelinesRegistration() while the ScrollingThread read it via\nserviceScrollAnimations -\u003e updateProgressBasedTimelinesForNode,\nproducing an ASan heap-use-after-free. The reader held m_treeLock; the\nwriter held only m_animationLock, so the two paths were not serialized.\n\nAdd a dedicated m_progressBasedTimelineRegistryLock that guards the\nregistry pointer and is acquired by every reader and writer. A separate\nlock avoids self-deadlock when scrollingTreeNodeDidScroll() reaches\nupdateProgressBasedTimelinesForNode from the commit path with\nm_treeLock already held.\n\nTest: webanimations/threaded-animations/scroll-driven-animation-registry-update-crash.html\n\n* LayoutTests/webanimations/threaded-animations/scroll-driven-animation-registry-update-crash-expected.txt: Added.\n* LayoutTests/webanimations/threaded-animations/scroll-driven-animation-registry-update-crash.html: Added.\n* Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingTree.cpp:\n(WebKit::RemoteScrollingTree::updateTimelinesRegistration):\n(WebKit::RemoteScrollingTree::timeline const):\n(WebKit::RemoteScrollingTree::updateProgressBasedTimelinesForNode):\n(WebKit::RemoteScrollingTree::timelinesForScrollingNodeIDForTesting const):\n* Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingTree.h:\n\nOriginally-landed-as: 305413.960@safari-7624-branch (3bff1cc45724). rdar://180438667\nCanonical link: https://commits.webkit.org/316438@main", "email": "zakr@apple.com", "hash": "6a97574d77c8f44a8ceca22d7a2647b1b0b99c5b", "subject": "Fix Cross-thread use-after-free in RemoteScrollingTree::m_progressBasedTimelineRegistry" }, "316439@main": { "author": "Phipson Lee", "avatar": "https://www.gravatar.com/avatar/8cbd3a1a983b7611a7c0492d86c4c610?d=identicon\u0026s=64", "cl": "316439@main", "clUrl": "https://commits.webkit.org/316439@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317160\nrdar://179733894\n\nReviewed by Abrar Rahman Protyasha.\n\nThis PR addresses an issue where at the end of the responsive live resize on visionOS,\nthe snapshot view sometimes does not get removed for ~1-2s. This happens because in this flow,\nwe rely on the 500ms endResizeTimer to fire, which triggers an updated commit to the web process.\nHowever, in this state, we rely on the user triggering a bounds update to then trigger another\nliveResize cycle, such that the snapshot gets removed when we next trigger\n`ensureLiveResizeAnimationView`.\n\nIn the case where the window has settled to a set size,\nbecause there is no new resizeAnimationView being created, we never remove the snapshot, so\nWebKit falls back to its 1s timer. In total, this means that the user\nis waiting for 1.5s-2s after the window has been resized before the snapshot gets removed,\naccounting for the time spent committing to the layer tree via the web process.\n\nThe fix here is that we assume that when endLiveResize is called with the 500ms timer\nit is safe to remove the snapshot immediately without needing to wait on the next resizeAnimationView\ncontainer to get created.\n\nWe make this change by storing didForceEndLiveResize (renamed to better reflect intent of variable)\nas a property of the LiveResizeSnapshotState associated with the specific transactionID during\nwhich it was created. To that end, we introduce an argument to `_endLiveResize` and\n`_endLiveResizeWithResponsiveRelayout` that passes that value over. Together\nwe use that to track whether to remove the snapshot immediately.\n\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewInternal.h:\nIntroduce didForceEndLiveResize in the LiveResizeSnapshotState\n\n* Source/WebKit/UIProcess/API/ios/WKWebViewIOS.h:\n* Source/WebKit/UIProcess/API/ios/WKWebViewIOS.mm:\n(-[WKWebView _didCommitLayerTree:mainFrameData:pageData:transactionID:]):\nUpdates the responsive relayout presentation update to check for the transactionID and\nwhether the liveSnapshot was created from a forceEndLiveResize or not. If not, we remove\nthe snapshot.\n\n(-[WKWebView didMoveToWindow]):\nUpdate call to endLiveResize to now pass a boolean for didForceEndLiveResize.\n\n(-[WKWebView _rescheduleEndLiveResizeTimer]):\nUpdate captures for the timer to plumb the value of didForceEndLiveResize for endLiveResize.\n\n(-[WKWebView _endLiveResizeWithResponsiveRelayout:]):\nUpdates call to now receive the didForceEndLiveResize to then pass into the next liveResizeSnapshotState\n\n(-[WKWebView _endLiveResize:]):\nUpdate the call to pass in the didForceEndLiveResize boolean to avoid transient states via the\nperProcessState\n\n(-[WKWebView _endLiveResizeWithResponsiveRelayout]):\nUpdate calls to pass didEndLiveResizeImmediately to the snapshot state. Read by didCommitLayerTree\nto skip waiting until the next resizeAnimationView gets created.\n(-[WKWebView _endLiveResize]): Deleted.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/AnimatedResize.mm:\n(TEST(AnimatedResize, MinimumEffectiveDeviceWidthChangeIsDeferredDuringLiveResize)):\n(TEST(AnimatedResize, PinScrollPositionRelativeToTopEdgeOnPageScaleChange)):\n(TEST(AnimatedResize, PinScrollPositionRelativeToTopEdgeOnPageScaleChangeAfterIncreasedSize)):\n(TEST(AnimatedResize, ChangingWebViewGeometryDuringLiveResizeDoesNotHang)):\nUpdated unit tests to account for the new call for _endLiveResize\n\nCanonical link: https://commits.webkit.org/316439@main", "email": "phipson_lee@apple.com", "hash": "e7e4231516b7817b4dc6200703d207933f828059", "subject": "Snapshot for relayout during live resize sometimes stays visible for too long on visionOS" }, "316440@main": { "author": "Marta Darbinyan", "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64", "cl": "316440@main", "clUrl": "https://commits.webkit.org/316440@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318485\nrdar://181274857\n\nUnreviewed test gardening\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/316440@main", "email": "darbinyan@apple.com", "hash": "b64b0f92a37470ea18c16eec14891cac57191a67", "subject": "[Gardening]: [macOS Release] TestWebKitAPI.WebKit.MediaBufferingPolicy is a flaky failure" }, "316441@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "316441@main", "clUrl": "https://commits.webkit.org/316441@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318496\nrdar://181280221\n\nUnreviewed.\n\nI forgot the namespace of is_trivially_default_constructible_v.\n\n* Source/ThirdParty/libwebrtc/Source/webrtc/test/fuzzers/fuzz_data_helper.h:\n\nCanonical link: https://commits.webkit.org/316441@main", "email": "achristensen@apple.com", "hash": "ee9b0d98242d946c693c042c62d27cfae0c5c4cd", "subject": "Fix asan builds after 316420@main" }, "316442@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "316442@main", "clUrl": "https://commits.webkit.org/316442@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318304\nrdar://181100516\n\nReviewed by Darin Adler.\n\nSearchBuffer::append() consumes characters from the front of the given\ntext up to the remaining buffer capacity and returns the count consumed,\nso the caller must feed it the unconsumed tail each iteration. The loop\nin containsPlainText() advanced remainingText by that count but passed\nthe full `document` to append() every time, re-appending the same head.\n\nDocuments that fit in the buffer were consumed in one pass, hiding the\nbug. Larger documents re-scanned the head forever and never examined\ntext past the first buffer fill, returning false for matches present\nlater in the string. Pass remainingText to append() instead.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/TextIterator.cpp\n\n* Source/WebCore/editing/TextIterator.cpp:\n(WebCore::containsPlainText):\n* Tools/TestWebKitAPI/CMakeLists.txt:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebCore/TextIterator.cpp: Added.\n(TestWebKitAPI::TEST(TextIteratorTest, ContainsPlainTextMatchWithinFirstBuffer)):\n(TestWebKitAPI::TEST(TextIteratorTest, ContainsPlainTextNoMatch)):\n(TestWebKitAPI::TEST(TextIteratorTest, ContainsPlainTextMatchPastFirstBufferFill)):\n\nCanonical link: https://commits.webkit.org/316442@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "e20361406fa4eff234e8bd59de694af6d82dfe72", "subject": "containsPlainText() re-scans the document head and misses matches past the first search-buffer fill" }, "316443@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "316443@main", "clUrl": "https://commits.webkit.org/316443@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318424\nrdar://181205602\n\nReviewed by Devin Rousso.\n\nInspectorDOMAgent computed a video element's power-efficient playback\nstate with `(displayCompositedVideoFrames - lastDisplayCompositedFrames) \u003e 0`.\nBoth operands are unsigned, so the subtraction wraps on any decrease and\n`(a - b) \u003e 0` is equivalent to `a != b`. When the cumulative composited\nframe count drops between samples -- which can happen across a media\nreload, source change, or pipeline reset -- the difference underflows to a\nlarge positive value and the element is reported as power-efficient\nspuriously, dispatching a bogus powerEfficientPlaybackStateChanged event\nto the frontend.\n\nCompare the frame counts directly so the check expresses \"composited\nframe count increased\" and cannot underflow. The increase and no-change\ncases are unaffected; the only altered case is a decrease, which\npreviously wrapped to a spurious power-efficient report and now correctly\nreports not-power-efficient (self-correcting on the next sample).\n\n* Source/WebCore/inspector/agents/InspectorDOMAgent.cpp:\n(WebCore::InspectorDOMAgent::mediaMetricsTimerFired):\n\nCanonical link: https://commits.webkit.org/316443@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "10dd190e17e3d86b2b948141f284f10f2c5e3c80", "subject": "[Web Inspector] Unsigned underflow in power-efficient playback heuristic spuriously reports power efficiency in the DOM agent" }, "316444@main": { "author": "Yury Semikhatsky", "avatar": "https://www.gravatar.com/avatar/d0aee26d9689e84bd1a7f0ed8f262fe1?d=identicon\u0026s=64", "cl": "316444@main", "clUrl": "https://commits.webkit.org/316444@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318478\n\nReviewed by Devin Rousso.\n\nNetwork.setExtraHTTPHeaders merged each call's headers into the previously\nstored set without clearing it first, so a header added by one call could\nnever be removed by a later call. Since each call fully specifies the extra\nheaders to send, clear the stored headers before applying the new ones.\n\n* LayoutTests/http/tests/inspector/network/set-extra-http-headers.html: Added.\n* LayoutTests/http/tests/inspector/network/set-extra-http-headers-expected.txt: Added.\n* Source/WebCore/inspector/agents/InspectorNetworkAgent.cpp:\n(WebCore::InspectorNetworkAgent::setExtraHTTPHeaders):\n\nCanonical link: https://commits.webkit.org/316444@main", "email": "yurys@chromium.org", "hash": "feb6c63a58b4ac76e95e02458ff696f389ef1f91", "subject": "Web Inspector: Network.setExtraHTTPHeaders should replace previously set headers instead of accumulating them" }, "316445@main": { "author": "Yury Semikhatsky", "avatar": "https://www.gravatar.com/avatar/d0aee26d9689e84bd1a7f0ed8f262fe1?d=identicon\u0026s=64", "cl": "316445@main", "clUrl": "https://commits.webkit.org/316445@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318482\n\nReviewed by Devin Rousso.\n\nUnlike Network.interceptRequestWithResponse and Network.interceptRequestWithError,\nNetwork.interceptWithRequest did not check whether the intercepted loader had\nalready reached its terminal state. If the request was aborted while the intercept\nwas still pending, continuing it operated on a terminal loader and crashed. Add the\nsame reachedTerminalState() guard the sibling commands already use.\n\n* LayoutTests/inspector/network/intercept-aborted-request-expected.txt:\n* LayoutTests/inspector/network/intercept-aborted-request.html:\n* Source/WebCore/inspector/agents/InspectorNetworkAgent.cpp:\n(WebCore::InspectorNetworkAgent::interceptWithRequest):\n\nCanonical link: https://commits.webkit.org/316445@main", "email": "yurys@chromium.org", "hash": "60dafe23e70a13d7e3489dba01050a936d6d6759", "subject": "Web Inspector: Network.interceptWithRequest crashes if the request was already aborted" }, "316446@main": { "author": "Cameron McCormack", "avatar": "https://www.gravatar.com/avatar/b2bb1b369be938a743e50f595bfa0798?d=identicon\u0026s=64", "cl": "316446@main", "clUrl": "https://commits.webkit.org/316446@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318401\nrdar://181191512\n\nReviewed by Tim Nguyen.\n\nWhen a render-blocked document is navigated away from before its first\nrendering opportunity, the pending render-blocking resource is cancelled,\nwhich unblocks rendering and lets a rendering update reveal the document\nthat is being discarded. This fired pagereveal on it and, because the\ndocument was treated as revealed, set up an outbound cross-document view\ntransition. Per CSS View Transitions 2, a document only initiates an\noutbound transition once it \"has been revealed\", and pagereveal is tied\nto the first rendering opportunity.\n\nSkip revealing a document that has an in-progress navigation replacing it,\nand don't start an outbound cross-document view transition unless the old\ndocument has been revealed.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-view-transitions/navigation/reveal-after-aborted-navigation.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-view-transitions/navigation/reveal-after-aborted-navigation-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-view-transitions/navigation/resources/abort-before-render.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-view-transitions/navigation/skip-outbound-vt-before-reveal-expected.txt:\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::reveal):\n* Source/WebCore/dom/Document.h:\n(WebCore::Document::hasBeenRevealed const):\n* Source/WebCore/loader/DocumentLoader.cpp:\n(WebCore::DocumentLoader::navigationCanTriggerCrossDocumentViewTransition):\n\nCanonical link: https://commits.webkit.org/316446@main", "email": "heycam@apple.com", "hash": "fe161c5b7ed5c56432b7683c7bccb7d3c3015c13", "subject": "Navigating away from a render-blocked document before it is revealed incorrectly reveals it and starts a cross-document view transition." }, "316447@main": { "author": "Yoel Hawa", "avatar": "https://www.gravatar.com/avatar/5c0ff3fb546dd8fd970c6b9c7e1ed557?d=identicon\u0026s=64", "cl": "316447@main", "clUrl": "https://commits.webkit.org/316447@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318473\nrdar://173910425\n\nReviewed by Abrar Rahman Protyasha.\n\nIncrease the opacity of `controls` text label and glyph, and shift label\ndown a bit.\n\n* LayoutTests/fast/images/spatial-image-controls-expected.html:\n* LayoutTests/fast/images/spatial-image-controls-rtl-expected.html:\n* Source/WebCore/html/shadow/spatialImageControls.css:\n(div#label):\n(span#spatial-glyph):\n(#if defined(ENABLE_PANORAMA_IMAGE_CONTROLS) \u0026\u0026 ENABLE_PANORAMA_IMAGE_CONTROLS):\n\nCanonical link: https://commits.webkit.org/316447@main", "email": "yoel@apple.com", "hash": "7f6cd866698b32d0ebadf962b2b5c1cb1471ad6c", "subject": "[visionOS] UI Polish for \u003cimg\u003e controls" }, "316448@main": { "author": "Keith Miller", "avatar": "https://www.gravatar.com/avatar/bddc1595b29098429a6ce7c8bf4aced2?d=identicon\u0026s=64", "cl": "316448@main", "clUrl": "https://commits.webkit.org/316448@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=314671\nrdar://176445072\n\nReviewed by Yijia Huang.\n\nDeferredWorkTimer::addPendingWork returned a raw Ticket (alias for TicketData*),\nand callers routinely captured that raw pointer into SharedTask lambdas that\nrun on background threads (Wasm worklist, etc.). If the associated\nJSGlobalObject died before the background work completed, the GC End phase\ncancelled the ticket, doWork() removed the cancelled entry from\nm_pendingTickets, and the last Ref\u003cTicketData\u003e dropped — freeing the slot. The\nbackground thread then dereferenced the dangling pointer in\nscheduleWorkSoon(stalePtr, ...). Because the TZone allocator reuses freed\nslots, m_pendingTickets.find(stalePtr) could match a fresh ticket at the same\naddress, running the stale callback against the wrong target and tripping a\njsCast / JSPromise::flags assertion in doWork.\n\n0e0b5050 fixed WasmStreamingCompiler for this pattern by storing\nThreadSafeWeakPtr\u003cTicketData\u003e and promote-and-checking at every use site.\nThis patch moves the safety requirement into the API so future callers can't\nregress:\n\n1. Rename DeferredWorkTimer::TicketData to DeferredWorkTimer::Ticket and\n remove the old `using Ticket = TicketData*` alias.\n2. Add `using WeakTicket = ThreadSafeWeakPtr\u003cTicket\u003e`. addPendingWork now\n returns WeakTicket.\n3. Replace scheduleWorkSoon(Ticket, Task\u0026\u0026) with the new\n scheduleWorkSoonIfActive(const WeakTicket\u0026, Task\u0026\u0026) which internally\n promotes the weak ticket, drops the request if it's gone or cancelled,\n and returns whether it was queued. This is the only way to enqueue work,\n so callers cannot forget the liveness check.\n4. Change m_tasks from Deque\u003cstd::tuple\u003cTicket, Task\u003e\u003e to\n Deque\u003cstd::tuple\u003cRef\u003cTicket\u003e, Task\u003e\u003e so queued work keeps the ticket\n alive until doWork() runs, closing the slot-reuse window the repro\n exploits.\n5. hasPendingWork, hasDependencyInPendingWork, cancelPendingWork take\n Ticket\u0026 so callers already holding a RefPtr can't accidentally pass a\n null / raw pointer across an async boundary.\n6. Task signature is Function\u003cvoid(Ticket\u0026)\u003e; doWork dereferences the\n stored Ref when dispatching.\n\nCall-site cleanups:\n* jsc.cpp functionSetTimeout — no more manual promote/check; the dispatch\nlambda just forwards the WeakTicket into scheduleWorkSoonIfActive.\n* WasmStreamingCompiler — m_ticket becomes ThreadSafeWeakPtr\u003cTicket\u003e; the\ndestructor, didComplete, fail, and cancel paths use the new API.\n* JSWebAssembly.cpp webAssemblyModuleValidateAsync / instantiate /\ncompileAndInstantiate — three shared-task lambdas that previously\ncaptured raw ticket / globalObject / promise pointers now capture a\nWeakTicket, recover promise / globalObject / dependencies from\nTicket::target() and Ticket::dependencies() inside the scheduled task,\nand let scheduleWorkSoonIfActive handle liveness.\n* WaiterListManager — m_ticket type rename; scheduleWorkAndClear collapses\nto a single scheduleWorkSoonIfActive that clears on success.\n* JSFinalizationRegistry — synchronous path uses scheduleWorkSoonIfActive\nand RELEASE_ASSERTs the return to match the existing contract.\n\nThe now-empty DeferredWorkTimerInlines.h is removed.\n\nTest: JSTests/stress/wasm-compile-stale-ticket.js\n\nOriginally-landed-as: 305413.892@safari-7624-branch (824ba19ea552). rdar://180437200\nCanonical link: https://commits.webkit.org/316448@main", "email": "keith_miller@apple.com", "hash": "15c117a5444a7bf7956f62facb7c0cb8008dc15c", "subject": "[JSC] DeferredWorkTimer should vend Weak references to Tickets" }, "316449@main": { "author": "Ryosuke Niwa", "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64", "cl": "316449@main", "clUrl": "https://commits.webkit.org/316449@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=313706\nrdar://174938744\n\nReviewed by Chris Dumez and Mark Lam.\n\nReplaced the use of unconditional jsCast with jsDynamicCast to fix the bug.\n\nTest: streams/readable-stream-cancel-fake-promise-crash.html\n\n* LayoutTests/streams/readable-stream-cancel-fake-promise-crash-expected.txt: Added.\n* LayoutTests/streams/readable-stream-cancel-fake-promise-crash.html: Added.\n* Source/WebCore/Modules/streams/ReadableStream.cpp:\n(WebCore::ReadableStream::cancel):\n* Source/WebCore/Modules/streams/ReadableStreamDefaultReader.cpp:\n(WebCore::ReadableStreamDefaultReader::read):\n\nOriginally-landed-as: 305413.806@safari-7624-branch (3f06c62bc271). rdar://180429254\nCanonical link: https://commits.webkit.org/316449@main", "email": "rniwa@webkit.org", "hash": "87d203651d8a2fd077eebd5d18b7dc1492fa0f6b", "subject": "Type confusion in ReadableStream.cancel() via jsCast\u003cJSPromise*\u003e" }, "316450@main": { "author": "Vitaly Dyachkov", "avatar": "https://www.gravatar.com/avatar/ab950c52088e289585a5a01580ec66a4?d=identicon\u0026s=64", "cl": "316450@main", "clUrl": "https://commits.webkit.org/316450@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318337\n\nReviewed by Simon Fraser.\n\nAfter a layout caused by one of its children's size change, an element\nwith a `drop-shadow()` filter can be not fully repainted, leaving a\nghost of the shadow.\n\nFix the issue by ensuring that the element is fully repainted after\nlayout on size change if it has a filter with outsets applied.\n\nTest: fast/repaint/drop-shadow-change-full-repaint.html\n\n* LayoutTests/fast/repaint/drop-shadow-change-full-repaint-expected.txt: Added.\n* LayoutTests/fast/repaint/drop-shadow-change-full-repaint.html: Added.\n* Source/WebCore/rendering/RenderBox.cpp:\n(WebCore::RenderBox::computeFilterOutsets const): Deleted.\n* Source/WebCore/rendering/RenderBox.h:\n* Source/WebCore/rendering/RenderElement.cpp:\n(WebCore::RenderElement::computeFilterOutsets const):\n(WebCore::RenderElement::repaintAfterLayoutIfNeeded):\n* Source/WebCore/rendering/RenderElement.h:\n\nCanonical link: https://commits.webkit.org/316450@main", "email": "vitaly@igalia.com", "hash": "f1d39ab9d6ce9378a6199cedac6be906e53cafd0", "subject": "Elements with `filter: drop-shadow()` are not fully repainted on child resize" }, "316451@main": { "author": "Dan Glastonbury", "avatar": "https://www.gravatar.com/avatar/fb7cb28bf9f1bc9fc0c3bbf65566efdc?d=identicon\u0026s=64", "cl": "316451@main", "clUrl": "https://commits.webkit.org/316451@main", "description": "rdar://175674581\n\nReviewed by Mike Wyrzykowski.\n\nWebXRSystem::ensureImmersiveXRDeviceIsSelected sends an async\nEnumerateImmersiveXRDevices IPC whose reply lambda holds protectedThis = Ref\n{ *this }, but inside that lambda a makeScopeExit re-posts the caller's callback\nvia callOnMainThread(). The reply lambda is then destroyed and protectedThis\ndrops. The callbacks supplied by isSessionSupported, obtainCurrentDevice and\nrequestSession capture only raw |this|, so the queued main-thread task holds no\nownership of the WebXRSystem. If iframe removal + GC tears down\nNavigatorWebXR::m_xr between the protectedThis drop and the pending\ncallOnMainThread task, the task reads freed memory.\n\nSeparately, the RequestPermissionOnSessionFeatures reply lambda in\nrequestSession writes m_pendingImmersiveSession through raw |this| in its\n!weakThis branch.\n\nFix by capturing protectedThis = protect(*this) in the isSessionSupported,\nobtainCurrentDevice and requestSession callbacks so they keep the WebXRSystem\nalive across the callOnMainThread re-post, and by splitting the !weakThis\nearly-return in the inner requestSession permission reply so it does not touch\nmembers after the object is gone.\n\nTest: webxr/xr-isSessionSupported-detached-iframe-crash.html\n\n* LayoutTests/webxr/xr-isSessionSupported-detached-iframe-crash-expected.txt: Added.\n* LayoutTests/webxr/xr-isSessionSupported-detached-iframe-crash.html: Added.\n* Source/WebCore/Modules/webxr/WebXRSystem.cpp:\n(WebCore::WebXRSystem::obtainCurrentDevice):\n(WebCore::WebXRSystem::isSessionSupported):\n(WebCore::WebXRSystem::requestSession):\n\nOriginally-landed-as: 305413.841@safari-7624-branch (0e75e33398b8). rdar://180429045\nCanonical link: https://commits.webkit.org/316451@main", "email": "djg@apple.com", "hash": "2b68a6816f173200ec2e6e6c87b034e8431e7d6d", "subject": "[WebXR] Use-after-free of WebXRSystem in callbacks re-posted from ensureImmersiveXRDeviceIsSelected" }, "316452@main": { "author": "Aleksei Marchenko", "avatar": "https://www.gravatar.com/avatar/9a469093291c12531caccfcaa6ab73b1?d=identicon\u0026s=64", "cl": "316452@main", "clUrl": "https://commits.webkit.org/316452@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318468\nrdar://172688994\n\nReviewed by Mike Wyrzykowski.\n\nHonor the \u003csource\u003e media attribute when selecting a \u003cmodel\u003e's source,\nmatching HTMLMediaElement (\u003cvideo\u003e) resource selection: the media query\nis evaluated at selection time only — on load and on explicit source/\nattribute changes — not dynamically on viewport changes like \u003cpicture\u003e.\nThe dynamic approach is intentionally avoided due to memory concerns.\n\n* LayoutTests/model-element/model-element-source-media-expected.txt: Added.\n* LayoutTests/model-element/model-element-source-media.html: Added.\n* Source/WebCore/Modules/model-element/HTMLModelElement.cpp:\n(WebCore::HTMLModelElement::selectModelSource const):\n* Source/WebCore/html/HTMLSourceElement.cpp:\n(WebCore::HTMLSourceElement::attributeChanged):\n\nCanonical link: https://commits.webkit.org/316452@main", "email": "aleksei@apple.com", "hash": "27f39d2af63b080177a28aab15cde66714cc1c7a", "subject": "Model does not change current src based on the media attribute" }, "316453@main": { "author": "Mike Wyrzykowski", "avatar": "https://www.gravatar.com/avatar/4b1bc9e238714f95e22d5d2454c07066?d=identicon\u0026s=64", "cl": "316453@main", "clUrl": "https://commits.webkit.org/316453@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318248\nrdar://181051202\n\nReviewed by Ruthvik Konda.\n\nEnsure model contents are re-populated during unload / reload\nbefore display the surface contents again.\n\n* Source/WebCore/Modules/model-element/HTMLModelElement.cpp:\n(WebCore::HTMLModelElement::reloadModelPlayer):\n* Source/WebCore/Modules/model-element/ModelPlayer.cpp:\n(WebCore::ModelPlayer::isWebModelPlayerInstance const):\n(WebCore::ModelPlayer::adoptContentsDisplayDelegateFrom):\n* Source/WebCore/Modules/model-element/ModelPlayer.h:\n* Source/WebKit/WebProcess/Model/WebModelPlayer.h:\n* Source/WebKit/WebProcess/Model/WebModelPlayer.mm:\n(WebKit::WebModelPlayer::load):\n(WebKit::WebModelPlayer::adoptContentsDisplayDelegateFrom):\n(WebKit::WebModelPlayer::render):\n(WebKit::WebModelPlayer::notifyClientDidFinishLoading):\n(WebKit::WebModelPlayer::visibilityStateDidChange):\n\nCanonical link: https://commits.webkit.org/316453@main", "email": "mwyrzykowski@apple.com", "hash": "ebf24e410c080df5c8e1cec49f05590a905285bd", "subject": "Flash reloading models" }, "316454@main": { "author": "Cameron McCormack", "avatar": "https://www.gravatar.com/avatar/b2bb1b369be938a743e50f595bfa0798?d=identicon\u0026s=64", "cl": "316454@main", "clUrl": "https://commits.webkit.org/316454@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318508\nrdar://problem/181287378\n\nReviewed by Pascoe.\n\n* CMakePresets.json:\n\nCanonical link: https://commits.webkit.org/316454@main", "email": "heycam@apple.com", "hash": "103846081883d873d7f37ba34ccd4d0eb9ece5e0", "subject": "Use ninja-wrapper for ios-sim presets" }, "316455@main": { "author": "Jetzel Espinal", "avatar": "https://www.gravatar.com/avatar/2edd78d5d9f2f2e2e695465277634921?d=identicon\u0026s=64", "cl": "316455@main", "clUrl": "https://commits.webkit.org/316455@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=305671\nrdar://168329911\n\nUnreviewed test gardening.\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/316455@main", "email": "jespinal23@apple.com", "hash": "3eef0cd66cc9cdf23f888aa576588dd1210225e8", "subject": "[GARDENING]3x fast/animation/* (layout-tests) are flaky failures." }, "316456@main": { "author": "Jetzel Espinal", "avatar": "https://www.gravatar.com/avatar/2edd78d5d9f2f2e2e695465277634921?d=identicon\u0026s=64", "cl": "316456@main", "clUrl": "https://commits.webkit.org/316456@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318502\nrdar://181283547\n\nUnreviewed test GARDENING.\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/316456@main", "email": "jespinal23@apple.com", "hash": "7112f9e6983cb089eba9ee52a0cdd886781a5d55", "subject": "[GARDENING] TestWebKitAPI.ParentalControlsContentFilteringTests.BlockedURL (api-test) is a constant failure on both iOS and macOS." }, "316457@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "316457@main", "clUrl": "https://commits.webkit.org/316457@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318088\n\nReviewed by Darin Adler.\n\nAssert RunLoop::Timer is stopped and destroyed on its own run loop's thread\nto help find thread safety bugs. Use ASSERT_WITH_SECURITY_IMPLICATION\nto help the fuzzers find such bugs.\n\nStarting (and re-arming) a timer from another thread is safe and supported (that is\nhow dispatch()/dispatchAfter() and cross-thread schedulers like JSRunLoopTimer work),\nso only assert thread affinity on stop() and destruction, and only when the timer is\nactive (tearing down a never-started or already-stopped timer off-thread is harmless).\nOn Cocoa, start() re-arms an already-fired one-shot by invalidating the old\nCFRunLoopTimer in place; this does so without the affinity assert (it does not free the\nTimerBase, so it cannot cause the cross-thread use-after-free stop()/the destructor\nguard against).\n\nThis immediately caught a real teardown race in MockRealtimeVideoSource,\nwhose m_emitFrameTimer fires on a dedicated \"generateFrame\" run loop but\nwas being stopped directly from the main thread (in stopProducingData()\nand setIsInterrupted()), racing CFRunLoopTimerInvalidate() against an\nin-flight timer callback. Fix it by marshaling the timer start and stop\nonto m_runLoop (matching what the destructor already does), routing both\nthrough startCaptureTimer()/stopCaptureTimer() so they stay correctly\nordered relative to each other.\n\nIt also caught a bug in RemoteLayerTreeEventDispatcher, which owns timers on two\ndifferent run loops: m_delayedRenderingUpdateDetectionTimer fires on the scrolling\nthread, while m_wheelEventActivityHysteresis's timer fires on the main run loop.\nThe object is ThreadSafeRefCounted and was destroyed on whichever thread dropped\nthe last reference, so one of the two timers was always torn down off its run\nloop's thread. Fix it by (a) destroying m_delayedRenderingUpdateDetectionTimer on\nthe scrolling thread from invalidate(), after m_scrollingTree has been cleared so\nany in-flight didRefreshDisplay() returns early and cannot recreate it, and (b)\nmaking the dispatcher DestructionThread::MainRunLoop so it (and its main-run-loop\ntimers) is always destroyed on the main run loop, even when invalidate()'s\nscrolling-thread dispatch drops the last reference. invalidate() also cancels the\nhysteresis so its timer does not fire a spurious state change during teardown.\n\nIt caught IOSurfacePool, whose m_collectionTimer fires on the main run loop but\nwhose discardAllSurfaces() can run on another thread when an ImageBuffer backend\nis destroyed in the GPU process. Stop the timer on the main run loop in that case.\n\nIt also caught the scroll-snap timers in ScrollingEffectsController, which are\ncreated against the scrolling thread's run loop (ThreadedScrollingTreeScrollingNodeDelegate::createTimer)\nbut were stopped on the main thread from stopAllTimers() during commitTreeState().\nHand those timers to the client for destruction instead of stopping them inline,\nand have the threaded delegate destroy them on the scrolling thread. The timer's\ncallback holds a Ref to the scrolling node (and ScrollerPairMac already releases\nits main-thread resources via ensureOnMainThread()), so the node stays alive until\nthe timer is gone and a late-firing callback remains safe.\n\nIt also caught ScratchBuffer (ShadowBlur), whose m_purgeTimer fires on the main\nrun loop but was restarted from scheduleScratchBufferPurge() on a paint worker thread\n(RemoteGraphicsContext in the GPU process). Restarting an active timer off-thread is\nunsafe because start() invalidates the existing CFRunLoopTimer; schedule the purge on\nthe main run loop via ensureOnMainRunLoop() so m_purgeTimer is only ever touched there.\n\nThe assertions are not Cocoa-specific: every RunLoop backend (CF, GLib, generic,\nWindows) reaches the TimerBase via the run loop's own thread, so they all assert.\nOn GTK this caught ThreadedCompositor::m_renderTimer, which is bound to the compositor\nthread's run loop (m_workQueue) but whose start/stop was driven from the main thread\nvia suspend()/resume()/invalidate(). Route the render-timer start/stop through a new\nupdateRenderTimer() that hops to the compositor thread; the desired state stays tracked\nsynchronously under m_state.lock by m_state.isRenderTimerActive. The same suspend()/\nresume() path also reaches AcceleratedSurface::m_releaseUnusedBuffersTimer (via\nvisibilityDidChange()) and AcceleratedSurface tears it down in willDestroyCompositingRunLoop();\nthat timer is likewise bound to the compositing run loop, so confine its start/stop and\ndestruction to that run loop too.\n\nIt also caught JSC's Atomics.waitAsync timeout timer (WaiterListManager): the timeout\nis a RunLoop::dispatchAfter() timer created on the waiting agent's thread, but\nWaiter::clearTimer() stop()s it from the notifying agent's thread (Atomics.notify) or a\nGC thread. A dispatchAfter() timer is fire-and-forget -- its callback holds a self-\nreference, so it stays alive, fires once on its own thread, and tears itself down there;\nstopping it early both raced cross-thread and leaked it (the self-reference was never\nconsumed). Since the timeout handler is idempotent (the waiter's ticket is already\ncleared), clearTimer() now just drops the waiter's reference and lets the timer fire\nharmlessly on its own thread.\n\n* Source/JavaScriptCore/runtime/WaiterListManager.h:\n* Source/WTF/wtf/FunctionDispatcher.h:\n(WTF::WTF_ASSERTS_ACQUIRED_CAPABILITY):\n* Source/WTF/wtf/RunLoop.h:\n(WTF::WTF_ASSERTS_ACQUIRED_CAPABILITY):\n* Source/WTF/wtf/cf/RunLoopCF.cpp:\n(WTF::RunLoop::TimerBase::start):\n(WTF::RunLoop::TimerBase::stop):\n* Source/WTF/wtf/generic/RunLoopGeneric.cpp:\n(WTF::RunLoop::TimerBase::~TimerBase):\n(WTF::RunLoop::TimerBase::stop):\n* Source/WTF/wtf/glib/RunLoopGLib.cpp:\n(WTF::RunLoop::TimerBase::~TimerBase):\n(WTF::RunLoop::TimerBase::stop):\n* Source/WTF/wtf/win/RunLoopWin.cpp:\n(WTF::RunLoop::TimerBase::stop):\n* Source/WebCore/page/scrolling/ThreadedScrollingTreeScrollingNodeDelegate.cpp:\n(WebCore::ThreadedScrollingTreeScrollingNodeDelegate::destroyTimer):\n* Source/WebCore/page/scrolling/ThreadedScrollingTreeScrollingNodeDelegate.h:\n* Source/WebCore/platform/ScrollingEffectsController.h:\n(WebCore::ScrollingEffectsControllerClient::destroyTimer):\n* Source/WebCore/platform/graphics/ShadowBlur.cpp:\n* Source/WebCore/platform/graphics/cg/IOSurfacePool.cpp:\n(WebCore::IOSurfacePool::stopCollectionTimer):\n(WebCore::IOSurfacePool::discardAllSurfacesInternal):\n* Source/WebCore/platform/graphics/cg/IOSurfacePool.h:\n* Source/WebCore/platform/mac/ScrollingEffectsController.mm:\n(WebCore::ScrollingEffectsController::stopAllTimers):\n* Source/WebCore/platform/mock/MockRealtimeVideoSource.cpp:\n(WebCore::MockRealtimeVideoSource::applyFrameRateAndZoomWithPreset):\n(WebCore::MockRealtimeVideoSource::startCaptureTimer):\n(WebCore::MockRealtimeVideoSource::stopCaptureTimer):\n(WebCore::MockRealtimeVideoSource::stopProducingData):\n(WebCore::MockRealtimeVideoSource::setIsInterrupted):\n* Source/WebCore/platform/mock/MockRealtimeVideoSource.h:\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.h:\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.mm:\n(WebKit::RemoteLayerTreeEventDispatcher::~RemoteLayerTreeEventDispatcher):\n(WebKit::RemoteLayerTreeEventDispatcher::invalidate):\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/ThreadedCompositor.cpp:\n(WebKit::ThreadedCompositor::startRenderTimer):\n(WebKit::ThreadedCompositor::stopRenderTimer):\n(WebKit::ThreadedCompositor::updateRenderTimer):\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/AcceleratedSurface.cpp:\n(WebKit::AcceleratedSurface::visibilityDidChange):\n(WebKit::AcceleratedSurface::didCreateCompositingRunLoop):\n(WebKit::AcceleratedSurface::willDestroyCompositingRunLoop):\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/AcceleratedSurface.h:\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/ThreadedCompositor.h:\n\nCanonical link: https://commits.webkit.org/316457@main", "email": "cdumez@apple.com", "hash": "f53d1f284bc24887cb00783ef8aee9e35809b8bc", "subject": "Assert RunLoop::Timer is stopped and destroyed on its own run loop's thread" }, "316458@main": { "author": "Jer Noble", "avatar": "https://www.gravatar.com/avatar/6d2cde9be23b98223ca964cb3b7813a0?d=identicon\u0026s=64", "cl": "316458@main", "clUrl": "https://commits.webkit.org/316458@main", "description": "rdar://175674693\nhttps://bugs.webkit.org/show_bug.cgi?id=313842\n\nReviewed by Eric Carlson.\n\nIt's unsafe to return a raw reference to an inner data member (without BorrowChecker)\nas the underlying object can be mutated or freed leaving a dangling reference. Make two\nchanges to MIMETypeCache as a result:\n- Require a lock be held to access the inner data member variable\n- Return a copy of the inner member rather than a reference\n\n* Source/WebCore/platform/graphics/MIMETypeCache.cpp:\n(WebCore::MIMETypeCache::ensureSupportedTypes):\n(WebCore::MIMETypeCache::supportedTypes):\n(WebCore::MIMETypeCache::supportsContainerType):\n(WebCore::MIMETypeCache::canDecodeType):\n(WebCore::MIMETypeCache::addSupportedTypes):\n(WebCore::MIMETypeCache::getCachedResult const):\n(WebCore::MIMETypeCache::addCachedResult):\n(WebCore::MIMETypeCache::isEmpty const):\n* Source/WebCore/platform/graphics/MIMETypeCache.h:\n* Source/WebCore/platform/graphics/avfoundation/objc/AVStreamDataParserMIMETypeCache.h:\n* Source/WebCore/platform/graphics/avfoundation/objc/AVStreamDataParserMIMETypeCache.mm:\n(WebCore::AVStreamDataParserMIMETypeCache::supportedTypes):\n(WebCore::AVStreamDataParserMIMETypeCache::canDecodeExtendedType):\n\nOriginally-landed-as: 305413.822@safari-7624-branch (720a8f0b10ab). rdar://180428110\nCanonical link: https://commits.webkit.org/316458@main", "email": "jer.noble@apple.com", "hash": "576ee4a20b0e79ffd48d34c6f3b3b03bd999db94", "subject": "Data race on MIMETypeCache::m_cachedResults / m_supportedTypes in MIMETypeCache::canDecodeType" }, "316459@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "316459@main", "clUrl": "https://commits.webkit.org/316459@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318469\nrdar://181267404\n\nReviewed by BJ Burg.\n\nThis uses the same pattern we use in LegacyWebArchive::createInternal,\nwhich was needed to keep unit tests working, in cachedResource(const LocalFrame*, const URL\u0026)\nthough it is unclear what the user-facing consequence of missing the memory\ncache would be. It could be just a loading speed improvement in the web inspector.\n\n* Source/WebCore/inspector/InspectorResourceUtilities.cpp:\n(Inspector::ResourceUtilities::cachedResource):\n\nCanonical link: https://commits.webkit.org/316459@main", "email": "achristensen@apple.com", "hash": "e1130255c407a85f4499a561a150c9b3e27cd558", "subject": "Fix WebInspector's memory cache use after 315967@main" }, "316460@main": { "author": "Charlie Wolfe", "avatar": "https://www.gravatar.com/avatar/857b3b5ff3394c31fa2689310a93dbab?d=identicon\u0026s=64", "cl": "316460@main", "clUrl": "https://commits.webkit.org/316460@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318388\nrdar://181175224\n\nReviewed by Matthew Finkel.\n\nTie the blocking gated by ScriptTrackingPrivacyNetworkRequestBlockingEnabled to tracking prevention:\nwhen Resource Load Statistics is disabled on the network session, don't block requests to targeted\ndomains.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ScriptTrackingPrivacyTests.mm\n\n* Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp:\n(WebKit::NetworkLoadChecker::shouldBlockForTrackingPolicy):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ScriptTrackingPrivacyTests.mm:\n(TestWebKitAPI::setUpWebViewForFingerprintingTests):\n(TestWebKitAPI::(ScriptTrackingPrivacyTests, CrossSiteFetchBlocked)):\n(TestWebKitAPI::(ScriptTrackingPrivacyTests, CrossSiteFetchNotBlockedWhenResourceLoadStatisticsDisabled)):\n\nCanonical link: https://commits.webkit.org/316460@main", "email": "charliew@apple.com", "hash": "d4033745346df8821905ee103002aa62a28a41c8", "subject": "Gate script tracking privacy network request blocking on Resource Load Statistics" }, "316461@main": { "author": "Zak Ridouh", "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64", "cl": "316461@main", "clUrl": "https://commits.webkit.org/316461@main", "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=314461\u003e\n\u003crdar://174740239\u003e\n\nReviewed by Simon Fraser.\n\nA compromised WebContent process can send DrawFilteredImageBuffer with an\nSVGFilterRenderer that selects FilterRenderingMode::Accelerated and carries an\nFEComponentTransfer whose Table or Discrete transfer function has an empty\ntableValues vector. The CoreImage applier propagated tableLength = 0 to the\nMetal kernel, whose Table/Discrete branches computed the table index as\nmin((int)(component * n), n - 1) with no lower clamp, yielding k = -1 and\ndereferencing tableStart[-1] inside CoreImage's stitched argument buffer. The\nresult was rendered to an IOSurface readable by the WebContent process.\n\nThe software path in FEComponentTransfer::computeLookupTable() guards this with\n\"if (n \u003c 1) return;\" but the CoreImage path never adopted that guard.\n\nFix this in two places:\n- In applyOther(), treat an empty tableValues for a Table/Discrete channel as\n Identity, matching the software path.\n- In the Metal kernel, clamp the table index to [0, n - 1] / [0, n] so a\n negative input component (extended-range pixels) cannot drive a negative\n index either.\n\nTest: ipc/feComponentTransfer-empty-tableValues-accelerated.html\n\n* LayoutTests/ipc/feComponentTransfer-empty-tableValues-accelerated-expected.txt: Added.\n* LayoutTests/ipc/feComponentTransfer-empty-tableValues-accelerated.html: Added.\n* Source/WebCore/platform/graphics/coreimage/FEComponentTransferCoreImageApplier.mm:\n(WebCore::compontentTransferKernel):\n\nOriginally-landed-as: 305413.914@safari-7624-branch (b63cccc1753d). rdar://180429219\nCanonical link: https://commits.webkit.org/316461@main", "email": "zakr@apple.com", "hash": "88ab9e1efc4a43e8065a042bb666fdaf536feb51", "subject": "[CoreIPC] [GPUP] FEComponentTransfer CoreImage Metal kernel can read past bounds with empty tableValues" }, "316462@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "316462@main", "clUrl": "https://commits.webkit.org/316462@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318422\nrdar://181204053\n\nReviewed by Devin Rousso.\n\nInspectorPageAgent::parseCookieObject() read the optional \"session\"\nboolean and the optional \"expires\" double, then bailed only when *both*\nwere absent (`!session \u0026\u0026 !cookie.expires`). It unconditionally\ndereferenced the optional afterwards with `cookie.session = *session;`.\n\nWhen a client sends a cookie object with \"expires\" present but \"session\"\nomitted, the guard's condition is false, so execution falls through and\ndereferences an empty std::optional\u003cbool\u003e — undefined behavior. The\ninput is fully controlled by the inspector frontend via the\nPage.setCookie protocol command.\n\nSince reaching the code past the guard already guarantees that either\n\"session\" or \"expires\" is valid, default the session flag to false with\nsession.value_or(false) instead of dereferencing the optional. When\n\"expires\" is set but \"session\" is omitted, defaulting to false is the\nintended behavior anyway.\n\n* Source/WebCore/inspector/agents/InspectorPageAgent.cpp:\n(WebCore::parseCookieObject):\n\nCanonical link: https://commits.webkit.org/316462@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "a9de782f906f9c52c0a7e61db3625973ed9d6114", "subject": "[Web Inspector] Empty std::optional dereference in Page.setCookie when \"session\" is omitted but \"expires\" is present" }, "316463@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "316463@main", "clUrl": "https://commits.webkit.org/316463@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318513\nrdar://181175678\n\nReviewed by Sosuke Suzuki.\n\nDFG LICM is running AbstractInterpreter and safeToExecute with\nDFGAtTailAbstractState, but\n\n1. DFG LICM's safeToExecute is not correctly handling tuple children,\n while the current code is harmless, ASSERT hits.\n2. DFG LICM's AbstractInterpreter run hits ASSERT because of clearForNode\n for Tuple returning DFG node, but this clearing is necessary and legit\n as it is introduced in 264281@main.\n\nSo,\n\n1. DFGAtTailAbstractState should allow tuple returning node with clearForNode,\n as the other AbstractStates allow.\n2. Let's disable LICM for ExtractFromTuple. Realistically, it has zero\n value as tuple extraction is almost no-op hint operation.\n\nTest: JSTests/stress/dfg-licm-hoist-tuple-node.js\n\n* JSTests/stress/dfg-licm-hoist-tuple-node.js: Added.\n(f):\n(g):\n* Source/JavaScriptCore/dfg/DFGAtTailAbstractState.cpp:\n(JSC::DFG::AtTailAbstractState::forNodeImpl):\n(JSC::DFG::AtTailAbstractState::forNode): Deleted.\n* Source/JavaScriptCore/dfg/DFGAtTailAbstractState.h:\n(JSC::DFG::AtTailAbstractState::forNode):\n(JSC::DFG::AtTailAbstractState::clearForNode):\n* Source/JavaScriptCore/dfg/DFGLICMPhase.cpp:\n(JSC::DFG::LICMPhase::attemptHoist):\n\nCanonical link: https://commits.webkit.org/316463@main", "email": "ysuzuki@apple.com", "hash": "d90bb919af460a6d1e21164d745363b32e5e5d1e", "subject": "[JSC] LICM should skip tuple consumers" }, "316464@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "316464@main", "clUrl": "https://commits.webkit.org/316464@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317652\nrdar://175430748\n\nReviewed by Eric Carlson.\n\nPer CMFormatDescription documentation:\n```\nThe extension is a CFDictionary mapping CFStrings of the four-char-code atom types\nto either CFDatas containing the atom payload or (to represent multiple atoms of a\nspecific type) to CFArrays of CFData containing those payloads.\n```\n\nThe conversion from CMVideoFormatDescription to VideoTrackInfo only handled\nthe first case, leading to a crash if the latter was used.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/cocoa/CoreMediaUtilities.mm\n\n* Source/WebCore/platform/graphics/cocoa/CMUtilities.mm:\n(WebCore::parseExtensionAtomsDictionary):\n(WebCore::createExtensionAtomsDictionary):\n(WebCore::getEncryptionDataCollection):\n(WebCore::createVideoInfoFromFormatDescription):\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/CoreMediaUtilities.mm:\n(TestWebKitAPI::makeVideoFormatDescriptionWithAtoms):\n(TestWebKitAPI::TEST(CMUtilities, ExtensionAtomsCFArrayValueDoesNotCrash)):\n(TestWebKitAPI::TEST(CMUtilities, ExtensionAtomsCFDataValueIngest)):\n(TestWebKitAPI::makeVideoInfoWithAtoms):\n(TestWebKitAPI::TEST(CMUtilities, CreateFormatDescriptionEmitsCFDataForSingleAtom)):\n(TestWebKitAPI::TEST(CMUtilities, CreateFormatDescriptionEmitsCFArrayForMultipleAtomsSameFourCC)):\n(TestWebKitAPI::TEST(CMUtilities, CreateFormatDescriptionGroupsNonContiguousDuplicates)):\n(TestWebKitAPI::TEST(CMUtilities, ExtensionAtomsRoundTripPreservesMultipleSameFourCC)):\n\nCanonical link: https://commits.webkit.org/316464@main", "email": "jya@apple.com", "hash": "40f62db2b0a18f38fb7d9cd79fade5978e585fd6", "subject": "com.apple.WebKit.WebContent at com.apple.WebCore: WebCore::createVideoInfoFromFormatDescription" }, "316465@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "316465@main", "clUrl": "https://commits.webkit.org/316465@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318510\n\nReviewed by Yusuke Suzuki.\n\nThe empty-separator fast path of s.split(\"\") atomizes every resulting\ncharacter through toIdentifier / DeferGC / atomStringToJSStringMap\n.ensureValue, even though Latin-1 single characters are already\natom-backed SmallStrings cells. This patch skips that block for Latin-1\ncharacters.\n\nSkipping alone would break the Array.prototype.indexOf onlyAtomStrings\nfast path, which treats absence from atomStringToJSStringMap as absence\nfrom the array. To prevent that, indexOf now treats a single Latin-1\ncharacter search as potentially present and falls through to the\npointer-comparison scan.\n\nstring-split-empty-long 45.4817+-1.1086 ^ 14.8687+-0.3740 ^ definitely 3.0589x faster\nstring-split-empty-short 38.2363+-1.1574 ^ 16.1969+-0.1237 ^ definitely 2.3607x faster\n\nNo regression on the indexOf microbenchmarks that now always scan:\n\natom-string-array-split-empty-index-of-not-found 0.8349+-0.0327 0.8123+-0.0378 might be 1.0278x faster\natom-string-array-split-empty-index-of-found 1.0105+-0.0291 ^ 0.9138+-0.0307 ^ definitely 1.1058x faster\n\nTests: JSTests/microbenchmarks/string-split-empty-long.js\n JSTests/microbenchmarks/string-split-empty-short.js\n JSTests/stress/string-split-empty-single-character-index-of.js\n\n* JSTests/microbenchmarks/string-split-empty-long.js: Added.\n(test):\n* JSTests/microbenchmarks/string-split-empty-short.js: Added.\n(test):\n* JSTests/stress/string-split-empty-single-character-index-of.js: Added.\n(shouldBe):\n* Source/JavaScriptCore/dfg/DFGOperations.cpp:\n(JSC::DFG::JSC_DEFINE_JIT_OPERATION):\n* Source/JavaScriptCore/runtime/ArrayPrototype.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n* Source/JavaScriptCore/runtime/StringPrototype.cpp:\n(JSC::stringSplitFast):\n\nCanonical link: https://commits.webkit.org/316465@main", "email": "sosuke@bun.sh", "hash": "02b44f2ad986575436f69f51863b556cbd460180", "subject": "[JSC] Skip Latin-1 single-character atomization in `s.split('')`" }, "316466@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "316466@main", "clUrl": "https://commits.webkit.org/316466@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318515\n\nReviewed by Yusuke Suzuki.\n\nReturning a value from an async function that has no await compiles to a\nNewResolvedPromise node in the DFG and FTL.\n\nNewResolvedPromise already has a fast path that allocates and fulfills the\npromise inline, skipping the observable \"then\" property lookup, gated on its\nisResolvedValueKnownNonThenable flag.\n\nHowever, the flag is only set when constant folding converts\nPromise.resolve(object) into NewResolvedPromise; nodes created for async\nfunction returns never get it, so they call into C++ and clobber the world\non every resolution.\n\nThis patch adds a NewResolvedPromise case to constant folding that upgrades\nthe flag in place. If the resolved value is proven non-object, it cannot be\na thenable, so the flag is set immediately. Otherwise, if it has a single\nstructure, we prove \"then\" is absent from the structure and its prototype\nchain via tryEnsureAbsence and watch those conditions; adding \"then\" later\nfires the watchpoints and jettisons the code. Returning a promise keeps the\nslow path, since the absence proof fails on Promise.prototype.then.\n\n baseline patched\n\nasync-function-return-object-no-await 58.9822+-13.0567 ^ 30.9665+-1.6062 ^ definitely 1.9047x faster\nasync-function-return-number-no-await 41.0872+-2.4379 38.7943+-3.4576 might be 1.0591x faster\n\nTests: JSTests/microbenchmarks/async-function-return-number-no-await.js\n JSTests/microbenchmarks/async-function-return-object-no-await.js\n JSTests/stress/async-function-return-non-thenable-folding.js\n JSTests/stress/async-function-return-thenable.js\n\n* JSTests/microbenchmarks/async-function-return-number-no-await.js: Added.\n(async compute):\n(kernel):\n(last.then):\n* JSTests/microbenchmarks/async-function-return-object-no-await.js: Added.\n(async toDTO):\n(kernel):\n(last.then):\n* JSTests/stress/async-function-return-non-thenable-folding.js: Added.\n(shouldBe):\n(async toDTO):\n* JSTests/stress/async-function-return-thenable.js: Added.\n(shouldBe):\n(async makeOwnThenable):\n(i.makeOwnThenable.i.then):\n(ProtoThenable):\n(ProtoThenable.prototype.then):\n(async makeProtoThenable):\n(i.makeProtoThenable.i.then):\n(string_appeared_here.async makeDeepThenable):\n(string_appeared_here):\n(GetterThenable):\n(GetterThenable.prototype.get then):\n(async makeGetterThenable):\n(i.makeGetterThenable.i.then):\n(string_appeared_here.o.then):\n(string_appeared_here.async maybeThenable):\n(shouldBe.LateProto):\n(shouldBe.async makeLateProto):\n(shouldBe.LateProto.prototype.then):\n(shouldBe.NonCallableThen):\n(shouldBe.async makeNonCallable):\n* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:\n(JSC::DFG::ConstantFoldingPhase::foldConstants):\n* Source/JavaScriptCore/dfg/DFGNode.h:\n(JSC::DFG::Node::setResolvedValueKnownNonThenable):\n\nCanonical link: https://commits.webkit.org/316466@main", "email": "sosuke@bun.sh", "hash": "7f538702bc4e7b6abe58e723004d216beac074c3", "subject": "[JSC] Prove resolved values non-thenable for `NewResolvedPromise` in DFG constant folding" }, "316467@main": { "author": "Kiet Ho", "avatar": "https://www.gravatar.com/avatar/d9058b37006dce1f55f91b8ccc82f9a3?d=identicon\u0026s=64", "cl": "316467@main", "clUrl": "https://commits.webkit.org/316467@main", "description": "rdar://179177141\nhttps://bugs.webkit.org/show_bug.cgi?id=316738\n\nReviewed by Antti Koivisto.\n\nThe value of color-scheme property on an \u003ciframe\u003e element affects the used color\nscheme of the embedded document, which has various consequences that must be\naccounted for. 309567@main invalidates the FrameView of the embedded document,\nso the iframe background gets repainted (background is transparent or opaque\ndepending on the color scheme of the \u003ciframe\u003e vs embedded document). But we miss\none thing: the evaluation result of style features like light-dark, system color\nand @prefers-color-scheme also changes, so we need to invalidate the style too.\n\nTests: imported/w3c/web-platform-tests/css/css-color-adjust/rendering/dark-color-scheme/color-scheme-iframe-preferred-change-cross-origin.sub.html\n imported/w3c/web-platform-tests/css/css-color-adjust/rendering/dark-color-scheme/color-scheme-iframe-preferred-change-same-origin.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-color-adjust/rendering/dark-color-scheme/color-scheme-iframe-preferred-change-cross-origin-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-color-adjust/rendering/dark-color-scheme/color-scheme-iframe-preferred-change-cross-origin.sub-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-color-adjust/rendering/dark-color-scheme/color-scheme-iframe-preferred-change-cross-origin.sub.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-color-adjust/rendering/dark-color-scheme/color-scheme-iframe-preferred-change-expected.txt: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-color-adjust/rendering/dark-color-scheme/color-scheme-iframe-preferred-change-same-origin-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-color-adjust/rendering/dark-color-scheme/color-scheme-iframe-preferred-change-same-origin.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/css/css-color-adjust/rendering/dark-color-scheme/color-scheme-iframe-preferred-change.html.\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::appearanceDidChange):\n - Move code that originally was in Page::appearanceDidChange to here, so we could\n use it in LocalFrameView::invalidateForPreferredColorSchemeChange.\n\n* Source/WebCore/page/Frame.cpp:\n(WebCore::Frame::updateFrameTreeSyncData):\n* Source/WebCore/page/LocalFrameView.cpp:\n(WebCore::LocalFrameView::invalidateForFrameOwnerColorSchemeChange):\n - New method that calls invalidateForBaseBackgroundChange and appearanceDidChange.\n\n(WebCore::LocalFrameView::invalidateForBaseBackgroundChange):\n - Renamed from invalidateForBaseBackgroundOrColorSchemeChange. Turns out\n color scheme changes requires more invalidation.\n\n(WebCore::LocalFrameView::setBaseBackgroundColor):\n(WebCore::LocalFrameView::invalidateForBaseBackgroundOrColorSchemeChange): Deleted.\n* Source/WebCore/page/LocalFrameView.h:\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::appearanceDidChange):\n - Move all code into Document::appearanceDidChange instead.\n\n* Source/WebCore/rendering/RenderFrameBase.cpp:\n(WebCore::RenderFrameBase::styleDidChange):\n\nCanonical link: https://commits.webkit.org/316467@main", "email": "kiet.ho@apple.com", "hash": "acfa8b8be70ce57a15f18042de84c21197a674d1", "subject": "Changing color-scheme of iframe does not invalidate appearance of embedded document" }, "316468@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "316468@main", "clUrl": "https://commits.webkit.org/316468@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318066\n\nReviewed by Said Abou-Hallawa.\n\nPer the SMIL Animation specification [1]:\n\n \"If any values (i.e., the argument-values for from, to, by or\n values attributes) are not legal, the animation will have no\n effect.\"\n\nThe bool-returning plumbing through SVGAnimationFunction,\nSVGAttributeAnimator and the animator wrappers, which lets a parse\nfailure propagate up to SVGAnimationElement::m_animationValid and drop\nthe animation, landed in 315549@main (bug 311817), and rejection of\ninvalid scalar color/length values followed for SVGAnimateElementBase::\nsetFromAndToValues(). The remaining scalar animators still coerced an\ninvalid value to zero (or an empty path) and animated to it, instead of\nleaving the underlying value untouched.\n\nThis propagates parse validity for the rest of the scalar value\nfunctions, routing the parsing through the property traits and a new\nSVGPathByteStream factory so the fallible parse lives in one place:\n\n - SVGPropertyTraits\u003cfloat\u003e, SVGPropertyTraits\u003cstd::pair\u003cint, int\u003e\u003e and\n SVGPropertyTraits\u003cstd::pair\u003cfloat, float\u003e\u003e gain a parse() overload\n that returns std::nullopt on failure; fromString() is now a thin\n wrapper over parse(). SVGAnimationNumberFunction,\n SVGAnimatedIntegerPairAnimator and SVGAnimatedNumberPairAnimator call\n parse() and reject a 'from'/'to'/'by'/toAtEndOfDuration that fails.\n - SVGPathByteStream::create() builds a byte stream and returns\n std::nullopt for a malformed path; SVGAnimationPathSegListFunction\n uses it and rejects a malformed 'from'/'to'/toAtEndOfDuration.\n\nAn empty string is not handled inside parse()/create(): it is a legal\nvalue in some contexts but not others, so each caller decides. An empty\n'from' is accepted for to-animation mode (the start value is resolved at\nruntime); a number/integer 'to' or 'by' must parse, so an empty value is\nrejected there because \"\" is not a legal number. An empty path, by\ncontrast, is a legal (empty) path, so buildSVGPathByteStreamFromString()\naccepting it is correct and the path animator does not reject it; empty\n'd' animation behaviour is tracked separately by the tentative\nanimate-path-*-empty-* tests.\n\n[1] https://www.w3.org/TR/2001/REC-smil-animation-20010904/#AnimFuncValues\n\n* Source/WebCore/svg/SVGPathByteStream.h:\n* Source/WebCore/svg/properties/SVGAnimatedPropertyPairAnimatorImpl.h:\n* Source/WebCore/svg/properties/SVGAnimationAdditiveValueFunctionImpl.h:\n* Source/WebCore/svg/properties/SVGPropertyTraits.h:\n(WebCore::SVGPropertyTraits\u003cfloat\u003e::parse):\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/svgnumber-animation-invalid-value-1-expected.txt: Progression\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/svgnumberoptionalnumber-animation-invalid-value-1-expected.txt: Ditto\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/svgintegeroptionalinteger-animation-invalid-value-1-expected.txt: Ditto\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/svgpath-animation-invalid-value-1-expected.txt: Ditto\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/svgnumber-animation-invalid-value-2.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/svgnumber-animation-invalid-value-2-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/svgnumberoptionalnumber-animation-invalid-value-2.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/svgnumberoptionalnumber-animation-invalid-value-2-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/svgintegeroptionalinteger-animation-invalid-value-2.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/svgintegeroptionalinteger-animation-invalid-value-2-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/svgpath-animation-invalid-value-2.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/svgpath-animation-invalid-value-2-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/svgnumber-to-animation-valid-value-1.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/svgnumber-to-animation-valid-value-1-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/316468@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "17c96be1faad0998f6b6acac840ad7f39637d9f1", "subject": "SVG SMIL number, integer-optional-integer, number-optional-number and path animations should not apply when from/to/by values fail to parse" }, "316469@main": { "author": "Sammy Gill", "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64", "cl": "316469@main", "clUrl": "https://commits.webkit.org/316469@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318406\nrdar://problem/181195816\n\nReviewed by Alan Baradlay.\n\nDuring the row sizing portion of the track sizing algorithm, the\nalgorithm may query a grid item for at least three different types of\nsizes:\n\n- min-content height\n- min-content height contribution\n- max-content height contribution\n\nWe already have three existing APIs for these within GridLayoutUtils,\nbut they were not really doing the right thing. All three were\nultimately calling layoutWithFormattingContextForBox with some sort if\ninline constraint. This inline constraint was getting set as the\noverriding border box size on the renderer associated with the grid item\nbefore calling layout on it. Instead, what should have been happening is\nthat this constraint should have been setting the *grid area content\nwidth* which was computed from the previous step in the algorithm since\nthe grid area is the containing block for the item.\n\nWe can fix this by doing a couple of main things:\n\n1.) Adding a dedicated API into IntegrationUtils for the min/max content\nheight contributions and renaming the minContentHeight API to\nminContentHeightForGridItem.\n\nThis first makes the grid layout much more clear since instead of mixing\nintegration level code with grid layout code we just call into the\nintegration API with the same name. Instead of grid layout being\nresponsible for determining how to compute this size it moves to the\nintegration code where it does whatever is needed to get the right value\nback from the render tree.\n\n2.) Set the grid area content width on the renderer before calling into\nlayoutWithFormattingContextForBox. Note we do not pass in any\nconstraints to layoutWithFormattingContextForBox since we do not want\nit to set any overriding sizes on the renderer. This matches what\nGridTrackSizingAlgorithm currently does to compute these sizes.\n\nAll three of these functions call into a helper function that switches\non the type of height the caller is interested in. Currently all three\ncases do the same thing but this may change over time as we continue the\nimplementation.\n\nCanonical link: https://commits.webkit.org/316469@main", "email": "sammy.gill@apple.com", "hash": "561f5f0b1b232b530daee0a07dfbeee0c17d28fd", "subject": "[GFC] Incorrect block axis sizes during sizing of intrinsic rows." }, "316470@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "316470@main", "clUrl": "https://commits.webkit.org/316470@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318501\nrdar://181283194\n\nReviewed by Devin Rousso.\n\nbuildObjectForKeyframes() in InspectorAnimationAgent.cpp iterates over\nblendingKeyframes.size() but indexes parsedKeyframes[i] guarded only by\n!parsedKeyframes.isEmpty(). KeyframeEffect stores these as two independent\nvectors populated by separate paths: m_parsedKeyframes is set via the Web\nAnimations API (setKeyframes), while m_blendingKeyframes is recomputed from\nthe CSS rule (computeCSSAnimationBlendingKeyframes). For a style-originated\n(CSS) animation whose keyframes were re-set through the Web Animations API\nand later recomputed from the CSS rule, parsedKeyframes.size() can be smaller\nthan blendingKeyframes.size(). Inspecting such an animation in the Web\nInspector Animations panel then reads past the end of parsedKeyframes.\n\nGuard the access with a bounds check (i \u003c parsedKeyframes.size()) instead of\nthe emptiness check, matching the pattern already used by\nKeyframeEffect::timingFunctionForKeyframeAtIndex(). When the index is out of\nrange the code falls through to the existing blendingKeyframe.timingFunction()\nand backing-animation fallbacks, so well-sized keyframes are unaffected.\n\n* Source/WebCore/inspector/agents/InspectorAnimationAgent.cpp:\n(WebCore::buildObjectForKeyframes):\n\nCanonical link: https://commits.webkit.org/316470@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "122493b27e92dedc613240fe169122d2896624c1", "subject": "Out-of-bounds read in InspectorAnimationAgent when parsedKeyframes is shorter than blendingKeyframes" }, "316471@main": { "author": "Richard Robinson", "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64", "cl": "316471@main", "clUrl": "https://commits.webkit.org/316471@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318498\nrdar://181282476\n\nReviewed by Abrar Rahman Protyasha and Pascoe.\n\n* Tools/SwiftBrowser/Resources/mac/Info.plist:\n* Tools/SwiftBrowser/Source/ViewModel/BrowserViewModel.swift:\n(BrowserViewModel.openURL(_:)):\n\nCanonical link: https://commits.webkit.org/316471@main", "email": "richard_robinson2@apple.com", "hash": "dcf11244b1aa5ee5336e11e9fe139605d3690e4b", "subject": "[SwiftBrowser] Allow opening .webarchive documents in SwiftBrowser" }, "316472@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "316472@main", "clUrl": "https://commits.webkit.org/316472@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=314873\nrdar://176912820\n\nReviewed by Ryosuke Niwa.\n\nWebPageProxy::didFailLoadForFrame accepts a WebCore::ResourceError from the WebContent\nprocess and forwards it to the embedding client without validating error.failingURL()\nagainst the sending process's allowed URL set. The sibling handler\ndidFailProvisionalLoadForFrameShared already performs this check. On iOS, MobileSafari\nfeeds the unchecked failingURL back into\n`-[WKWebView _loadAlternateHTMLString:baseURL:forUnreachableURL:]`, which causes\nWebPageProxy::loadAlternateHTML to grant the sending WebContent process read access to\nan attacker-chosen file:// directory in both the UI process and the Network process.\n\nAdd MESSAGE_CHECK_URL(process, error.failingURL()) to WebPageProxy::didFailLoadForFrame,\nmirroring didFailProvisionalLoadForFrameShared, so a compromised WebContent process that\nforges a file:// failingURL is terminated before the error reaches the navigation client.\n\nTest: http/tests/ipc/webpageproxy-didfailload-failingurl-message-check.html\n\n* LayoutTests/http/tests/ipc/webpageproxy-didfailload-failingurl-message-check-expected.txt: Added.\n* LayoutTests/http/tests/ipc/webpageproxy-didfailload-failingurl-message-check.html: Added.\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::didFailLoadForFrame):\n\nOriginally-landed-as: 305413.916@safari-7624-branch (e6341887dd92). rdar://180438310\nCanonical link: https://commits.webkit.org/316472@main", "email": "cdumez@apple.com", "hash": "248f89aa4518e99734efa4e0b897a7def9f2bcfa", "subject": "[WebKit Process Model] missing MESSAGE_CHECK_URL on error.failingURL() in WebPageProxy::didFailLoadForFrame" }, "316473@main": { "author": "Carlos Alberto Lopez Perez", "avatar": "https://www.gravatar.com/avatar/05326c1dbe06f486e884975e73f25179?d=identicon\u0026s=64", "cl": "316473@main", "clUrl": "https://commits.webkit.org/316473@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318542\n\nReviewed by Nikolas Zimmermann.\n\nIt seems currently the last version of rapidfuzz available for Linux ARM32\nas wheel is 3.14.3.\n\nThis is causing problems with the step `show-identifier` on the ARM32 bots,\nso downgrade the version.\n\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/__init__.py:\n\nCanonical link: https://commits.webkit.org/316473@main", "email": "clopez@igalia.com", "hash": "c34e92621c3edd9afe3db98038b6caeb2387979c", "subject": "REGRESSION(315890@main): [Tools] rapidfuzz 3.14.5 is not available as wheel for Linux ARM32" }, "316474@main": { "author": "Brent Fulgham", "avatar": "https://www.gravatar.com/avatar/c6989a65afef0d015b55c65406e37ccc?d=identicon\u0026s=64", "cl": "316474@main", "clUrl": "https://commits.webkit.org/316474@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=220190\n\u003crdar://problem/72817121\u003e\n\nReviewed by Matthew Finkel.\n\nThis is a rebase of 232788@main, which was reverted due to a build issue.\n\nConsider the presence of the NSCrossWebsiteTrackingUsageDescription key as an indication\nto disable ITP for WKWebView until the Settings app on macOS provides a UI to allow users\nto disabling it for a specific app, like we do for iOS.\n\n* Source/WTF/wtf/PlatformUse.h:\n* Source/WebKit/Shared/Cocoa/DefaultWebBrowserChecks.mm:\n(WebKit::determineTrackingPreventionStateInternal):\n(WebKit::doesParentProcessHaveTrackingPreventionEnabled):\n\nCanonical link: https://commits.webkit.org/316474@main", "email": "bfulgham@apple.com", "hash": "30f40ca4af988af84766e91c57cf130164412ef4", "subject": "NSCrossWebsiteTrackingUsageDescription is not working on Mac, ITP is always enabled" }, "316475@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "316475@main", "clUrl": "https://commits.webkit.org/316475@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318545\nrdar://181284337\n\nReviewed by Youenn Fablet.\n\n315963@main always made the MediaSourcePrivateAVFObjC use a secondary\nworkqueue. This configuration should only be used with WK2, not WK1.\n\nCovered by existing tests.\n\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaSourcePrivateAVFObjC.mm:\n(WebCore::MediaSourcePrivateAVFObjC::queueSingleton):\n\nCanonical link: https://commits.webkit.org/316475@main", "email": "jya@apple.com", "hash": "eee8a7a07957b3b8d55087bf6148b360bacac667", "subject": "(315963@main) DumpRenderTree at com.apple.WebCore: WebCore::AudioVideoRendererAVFObjC::updateSharedTimebase" }, "316476@main": { "author": "Adrian Taylor", "avatar": "https://www.gravatar.com/avatar/d2acb8ad2e2670ff74ae0d65fb27014c?d=identicon\u0026s=64", "cl": "316476@main", "clUrl": "https://commits.webkit.org/316476@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318438\nrdar://181226917\n\nReviewed by Richard Robinson.\n\nThis reorders existing command-line flags to enusre that\n-Werror StrictMemorySafety applies even to PAL.\n\nThere were two problems:\n- cmake rules were applying '-no-warnings-as-errors' _after_\n that option was applied. Swift handles these things left-to-right.\n- '-Xfrontend -no-warnings-as-errors' was moving this argument\n even further to the right within the resulting swiftc command\n line.\n\nThis also adds two more fatal classes of errors to match Xcode.\n\nCanonical link: https://commits.webkit.org/316476@main", "email": "adrian_taylor@apple.com", "hash": "c552c05c2823a41b05e1da96ec691bcaeaaaf8d6", "subject": "Make StrictMemorySafety fatal for cmake PAL" }, "316477@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "316477@main", "clUrl": "https://commits.webkit.org/316477@main", "description": "rdar://178567852\n\nReviewed by Alex Christensen.\n\nThe injected bundle's -webProcessPlugIn:willDestroyBrowserContextController:\nhook fires synchronously from WebPage::close() in the WebProcess, and bundle\nclients are allowed to invoke a UIProcess-side _WKRemoteObjectRegistry method\nfrom that hook. The resulting RemoteObjectRegistry::InvokeMethod IPC arrives\nat the UIProcess after WebPageProxy::close() has synchronously called\nWebProcessProxy::removeWebPage(), so the page is no longer in m_pageMap (or\nm_remotePages / m_provisionalPages / m_suspendedPages).\n\nWebProcessProxy::handleRemoteObjectRegistryMessage then returned false, which\ncaused the generated didReceiveMessage to mark the decoder invalid and the\nIPC layer to call WebProcessProxy::didReceiveInvalidMessage, terminating an\notherwise well-behaved WebProcess.\n\nTo fix this, mark every content process for the page as pending-close before\ndispatching Messages::WebPage::Close, and only clear the marker once the\nasync reply arrives. WebProcessProxy::isAssociatedWithPage already consults\nm_pagesPendingClose, so a late-arriving InvokeMethod is now recognized and\ndelivered to the registry. m_pagesPendingClose is changed from HashSet to\nHashCountedSet so the regular close path and the provisional-page-swap close\npath compose correctly when both target the same page.\n\nhandleRemoteObjectRegistryMessage is reworked to consult isAssociatedWithPage\nand look the page up via the global WebPageProxy::fromIdentifier, replacing\nthe four sequential map walks.\n\nNote that this commit makes the branch more in-line with main after 314178@main.\n314178@main already takes care of adding the page to m_pagesPendingClose while\nwe're sending the WebPage::Close IPC. Also include the fix from 314426@main,\nsince it fixed a crash introduced by 314178@main.\n\nTLDR: this PR is essentially a merge for 314178@main \u0026 314178@main from\nmain so that WebProcessProxy::m_pagesPendingClose gets properly populated.\nThen WebProcessProxy::handleRemoteObjectRegistryMessage() is updated to\ncall WebProcessProxy::isAssociatedWithPage() instead of duplicating its\nlogic. WebProcessProxy::isAssociatedWithPage also has the benefit of\nchecking m_pagesPendingClose already.\n\nUpdate WKWebView.EvaluateJavaScriptBlockCrash test expectation to match\n313673@main: now that Messages::WebPage::Close is an async-reply message,\nthe WebProcess is kept alive (via the shutdownPreventingScope held in the\nClose reply handler) long enough for the pending evaluateJavaScript IPC to\nbe processed and reply with a successful empty result, instead of being\ncancelled by Connection::cancelAsyncReplyHandlers when the connection is\ninvalidated. The completion handler is therefore invoked with a nil error,\nmatching the same test expectation update made in 313673@main.\n\nTests: RemoteObjectRegistry.InvokeMethodFromBundleDuringPageClose\n\n* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:\n(WebKit::ProvisionalPageProxy::~ProvisionalPageProxy):\n* Source/WebKit/UIProcess/RemotePageProxy.cpp:\n(WebKit::RemotePageProxy::disconnect):\n* Source/WebKit/UIProcess/SuspendedPageProxy.cpp:\n(WebKit::SuspendedPageProxy::close):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::close):\n(WebKit::WebPageProxy::commitProvisionalPage):\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::~WebProcessProxy):\n(WebKit::WebProcessProxy::sendPageCloseMessage):\n(WebKit::WebProcessProxy::handleRemoteObjectRegistryMessage):\n* Source/WebKit/UIProcess/WebProcessProxy.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::close):\n(WebKit::WebPage::closeWithReply): Deleted.\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.messages.in:\n* Tools/TestWebKitAPI/Tests/WebKitCocoa/RemoteObjectRegistry.h:\n* Tools/TestWebKitAPI/Tests/WebKitCocoa/RemoteObjectRegistry.mm:\n(TEST(RemoteObjectRegistry, InvokeMethodFromBundleDuringPageClose)):\n* Tools/TestWebKitAPI/Tests/WebKitCocoa/RemoteObjectRegistryPlugIn.mm:\n(-[RemoteObjectRegistryPlugIn triggerCallToUIProcessOnClose]):\n(-[RemoteObjectRegistryPlugIn webProcessPlugIn:willDestroyBrowserContextController:]):\n* Tools/TestWebKitAPI/Tests/WebKitCocoa/WKWebViewEvaluateJavaScript.mm:\n(TEST(WKWebView, EvaluateJavaScriptBlockCrash)):\n\nOriginally-landed-as: 305413.880@safari-7624.4-branch (d0f2013438ba). rdar://181073656\nCanonical link: https://commits.webkit.org/316477@main", "email": "cdumez@apple.com", "hash": "d06f9c09279f01de58eb0d9202d9b8a1ad92d679", "subject": "Sign in with Apple unsuccessful and causes reload due to problem - Received an invalid message 'RemoteObjectRegistry_InvokeMethod'" }, "316478@main": { "author": "Antti Koivisto", "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64", "cl": "316478@main", "clUrl": "https://commits.webkit.org/316478@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318548\nrdar://181322776\n\nReviewed by Alan Baradlay.\n\nMinor WPT fixes and code cleanups.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/dashed-function-cycles-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/dashed-function-eval-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-invalidation-expected.txt:\n* Source/WebCore/css/parser/CSSParser.cpp:\n(WebCore::CSSParser::consumeFunctionRule):\n\nDon't validate default value eagerly if it contains substitution functions like var().\n\n* Source/WebCore/style/StyleBuilder.cpp:\n(WebCore::Style::Builder::resolveFunctionResult):\n\nApply function body properties eagerly to detect cycles through unreferenced local variables.\nRemove the unnecessary result value argument.\n\n(WebCore::Style::Builder::resolveCustomPropertyValue):\n\nAllow CSS-wide keywords after substitution on registered properties too.\n\n* Source/WebCore/style/StyleBuilder.h:\n* Source/WebCore/style/StyleSubstitutionResolver.cpp:\n(WebCore::Style::SubstitutionResolver::substituteDashedFunction):\n\n* Source/WebCore/style/RuleSetBuilder.cpp:\n(WebCore::Style::RuleSetBuilder::addMutatingRulesToResolver):\n\nInvalidate the matched declarations cache when registering a function. The cache keys on\nmatched properties, not on the function registry, so an unchanged declaration like width: --f()\nwould keep a stale value after the function is added or removed. Mirrors @property registration.\n\nCanonical link: https://commits.webkit.org/316478@main", "email": "antti@apple.com", "hash": "9e267886b98d77c1c8e0247c7db29b9f6b3f81cb", "subject": "[css-mixins-1] Fix minor @function issues" }, "316479@main": { "author": "Justin Michaud", "avatar": "https://www.gravatar.com/avatar/36e0433ee725a08f7e1122a6bc584b57?d=identicon\u0026s=64", "cl": "316479@main", "clUrl": "https://commits.webkit.org/316479@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318505\n\nReviewed by Yusuke Suzuki.\n\narm64 and riscv64 have arch identifiers that don't look like ascii.\nLet's compare them as bytes instead to avoid string encoding headaches.\n\nCanonical link: https://commits.webkit.org/316479@main", "email": "jmichaud@igalia.com", "hash": "7d6af3d9a4c32f222156e42195fbd60af85d61d6", "subject": "Update arch detection in run-jsc-stress-tests" }, "316480@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "316480@main", "clUrl": "https://commits.webkit.org/316480@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318531\n\nReviewed by Nikolas Zimmermann.\n\nImprove performance in SVGURIReference::fragmentIdentifierFromIRIString by using\nDocument::encodingParseURL to resolve the URL in a single pass. This avoids manual\nslicing of URLs and multiple URL object constructions, reducing heap allocations\nand duplicate parsing.\n\n* Source/WebCore/svg/SVGURIReference.cpp:\n(WebCore::SVGURIReference::fragmentIdentifierFromIRIString):\n\nCanonical link: https://commits.webkit.org/316480@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "52256fbd159a84cdf834a19b4f4c7f8a6946c777", "subject": "Optimize SVGURIReference::fragmentIdentifierFromIRIString to avoid redundant URL parsing and string allocations" }, "316481@main": { "author": "Anthony Tarbinian", "avatar": "https://www.gravatar.com/avatar/ef46154a1a21c6a5ef593e952ebc62f4?d=identicon\u0026s=64", "cl": "316481@main", "clUrl": "https://commits.webkit.org/316481@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=313857\nrdar://174651279\n\nReviewed by Chris Dumez.\n\nWhen a page tries to write an ArrayBuffer of audio data to an audio node\n(writing to node.buffer), the page can free the ArrayBuffer's backing\nstore and leave the audio node to read the freed memory through a cached\npointer.\n\nAn AudioBufferSourceNode caches raw pointers into an AudioBuffer's channel\ndata when you set node.buffer. This happens in AudioBufferSourceNode::setBufferForBindings\nwhere a pointer from a span is cached in m_sourceChannels[i].\nThose pointers point into ArrayBuffer backing stores managed by JSC.\nIf the memory is not pinned, or detachable, then\nthe page can force the ArrayBuffer's backing store to be freed by\ndropping the reference to the result of structuredClone on the original buffer\nand kicking off a GC.\n\nTwo previous commits (one was a re-land), fixed this same bug by pinning\nthe memory (making it non-detachable), so that the backing store can't\nbe detached and leave a copy to be freed. In fact, pinning the memory\nwill cause structuredClone to fail with a TypeError.\n1. rdar://123510096, https://bugs.webkit.org/show_bug.cgi?id=270007\n2. rdar://126326144, https://bugs.webkit.org/show_bug.cgi?id=272607\n\nThose patches are supposed to pin those ArrayBuffers (make them non-detachable)\nto keep the memory alive, but it only pins if the node is already playing.\nIf you set the buffer before calling start() (i.e. when the node is in UNSCHEDULED_STATE),\nthe pin is skipped (since isPlayingOrScheduled() is false).\n\nAn attacker exploits this by:\n1. Setting the buffer (spans cached, no pin)\n2. Transferring the channel ArrayBuffer via structuredClone (detaches it)\n3. Dropping the copy and triggering GC (backing store freed)\n4. Starting playback with loop=true and playbackRate=0\n\nThe audio node then reads from freed memory through the dangling spans\nduring AudioBufferSourceNode::renderFromBuffer() when it reads\nm_sourceChannels.\n\nThis patch removes the condition to pin the audio buffer\n(mark it as non-detachable). Previously, the audio buffer was only\npinned when isPlayingOrScheduled() was true, however, this patch\npins the memory unconditionally. This way if the page tries\nto call structuredClone, it will now throw a TypeError and\navoid the opportunity to free the backing store.\n\nIn addition, this patch adds the following defensive hardenings\nin case the same exploit is triggered via another path:\n1. Early return if bufferLength == 0 in AudioBufferSourceNode::renderFromBuffer()\n before the freed m_sourceChannels is read. bufferLength would be 0\n if the memory was detached (not pinned)\n2. Fix the following code that calculates the index into\n the audio buffer in AudioBufferSourceNode::renderFromBuffer():\n\n m_virtualReadIndex = std::min(m_virtualReadIndex, static_cast\u003cdouble\u003e( bufferLength - 1));\n\n This patch changes the static cast from\n static_cast\u003cdouble\u003e(bufferLength - 1)\n to\n static_cast\u003cdouble\u003e(bufferLength) - 1\n since bufferLength is unsigned (size_t) so when\n bufferLength is 0, it previously could cause the unsigned\n (size_t) to underflow making the upper limit of the std::min\n bounds check effectively useless.\n3. Add a guard to bounds check readIndex in the case where !pitchRate.\n This happens where the attacker sets node.playbackRate.value = 0;\n Every other branch already bounds-checks readIndex. This was the\n one path that didn't.\n\nAs a side note, an alternative approach to fix this bug, could be to\nacquire an internal copy of the audio data which is not accessible from JS.\nThis is described in the webaudio spec and was attempted to be implemented\nin a previous fix but caused increased memory usage and the tradeoff to\ndetach the memory was chosen instead.\nSee the message and FIXME from https://commits.webkit.org/272448.925@safari-7618-branch\n\nThis also updates an ASSERT in ArrayBuffer::errorMessageForTransfer\nfrom ASSERT(buffer-\u003eisLocked()) to ASSERT(!buffer-\u003eisDetachable())\nsince the regression test is hitting this path and not keeping the buffer\nalive via locking, but instead is pinning it (which isDetachable()\nis aware of, unlike isLocked()).\n\nTest: webaudio/audiobuffersource-detached-buffer-crash.html\n\n* LayoutTests/webaudio/audiobuffersource-detached-buffer-crash-expected.txt: Added.\n* LayoutTests/webaudio/audiobuffersource-detached-buffer-crash.html: Added.\n* Source/JavaScriptCore/runtime/ArrayBuffer.cpp:\n(JSC::errorMessageForTransfer):\n* Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp:\n(WebCore::AudioBufferSourceNode::renderFromBuffer):\n(WebCore::AudioBufferSourceNode::setBufferForBindings):\n\nOriginally-landed-as: 305413.815@safari-7624-branch (7aaeec1bad67). rdar://180436186\nCanonical link: https://commits.webkit.org/316481@main", "email": "a_tarbinian@apple.com", "hash": "a7e4fdb9545042aef190cd469efb633e442fb43c", "subject": "[WebCore] Unconditionally pin AudioBuffer data in AudioBufferSourceNode::setBufferForBindings" }, "316482@main": { "author": "Ryosuke Niwa", "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64", "cl": "316482@main", "clUrl": "https://commits.webkit.org/316482@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=313577\nrdar://175766724\n\nReviewed by Anne van Kesteren.\n\nFixed the bug by deploying a smart pointer.\n\nTest: fonts/font-face-load-crash.html\n\n* LayoutTests/fonts/font-face-load-crash-expected.txt: Added.\n* LayoutTests/fonts/font-face-load-crash.html: Added.\n* Source/WebCore/css/FontFace.cpp:\n(WebCore::FontFace::loadForBindings):\n\nOriginally-landed-as: 305413.775@safari-7624-branch (d90247302507). rdar://180438594\nCanonical link: https://commits.webkit.org/316482@main", "email": "rniwa@webkit.org", "hash": "5aedb82710ba578f61501106e78f6b25b7f7a558", "subject": "Use-after-free in CSSFontFace::setStatus via CSSFontFace::load" }, "316483@main": { "author": "Eric Carlson", "avatar": "https://www.gravatar.com/avatar/e227ff07cc6d645fc1c69fd56c2c8cb8?d=identicon\u0026s=64", "cl": "316483@main", "clUrl": "https://commits.webkit.org/316483@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=314134\nrdar://175519844\n\nReviewed by Jean-Yves Avenard.\n\nCDMSessionAVContentKeySession is ThreadSafeRefCountedAndCanMakeThreadSafeWeakPtr\nwith the default DestructionThread::Any. Its WebCDMSessionAVContentKeySessionDelegate\nruns on a per-session background WorkQueue and holds a strong RefPtr to the session\nfor the duration of -contentKeySession:didProvideContentKeyRequest:. If the main\nthread drops its last Ref while that background RefPtr is live, the destructor runs\non the background queue.\n\n~CDMSessionAVContentKeySession then resolves a non-thread-safe\nWeakPtr\u003cLegacyCDMPrivateAVFObjC\u003e and calls invalidateSession(this) -\u003e\nm_sessions.removeAll(this) on the unlocked Vector\u003cCDMSessionAVContentKeySession*\u003e,\nracing main-thread createSession() -\u003e m_sessions.append(). Under ASan this surfaces\nas container-overflow in Vector::reserveCapacity. Taking RefPtr cdm = m_cdm.get()\noff-main also performs non-atomic ref()/deref() on LegacyCDM via\nLegacyCDMPrivateAVFObjC::ref().\n\nPin destruction to the main thread with WTF::DestructionThread::Main so the\ndestructor (and therefore the WeakPtr resolution, the LegacyCDM ref/deref, and\ninvalidateSession) always run on the main thread. Add main-thread asserts to the\ndestructor and to LegacyCDMPrivateAVFObjC::createSession/invalidateSession to\ndocument and enforce the invariant.\n\nTest: ipc/legacy-cdm-session-avcontentkeysession-destruction-race.html\n\n* LayoutTests/ipc/legacy-cdm-session-avcontentkeysession-destruction-race-expected.txt: Added.\n* LayoutTests/ipc/legacy-cdm-session-avcontentkeysession-destruction-race.html: Added.\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebCore/platform/graphics/avfoundation/LegacyCDMPrivateAVFObjC.mm:\n(WebCore::LegacyCDMPrivateAVFObjC::createSession):\n(WebCore::LegacyCDMPrivateAVFObjC::invalidateSession):\n* Source/WebCore/platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.h:\n* Source/WebCore/platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.mm:\n(WebCore::CDMSessionAVContentKeySession::~CDMSessionAVContentKeySession):\n\nOriginally-landed-as: 305413.856@safari-7624-branch (190b07df83bc). rdar://180429393\nCanonical link: https://commits.webkit.org/316483@main", "email": "eric.carlson@apple.com", "hash": "e5439f454fea7c3e56f167b4e55d66c8289b7024", "subject": "[CoreIPC] [GPUP] off-main-thread ~CDMSessionAVContentKeySession mutates unlocked LegacyCDMPrivateAVFObjC::m_sessions Vector" }, "316484@main": { "author": "Youenn Fablet", "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64", "cl": "316484@main", "clUrl": "https://commits.webkit.org/316484@main", "description": "rdar://176482856\n\nReviewed by Jean-Yves Avenard.\n\nLocalSampleBufferDisplayLayer::flushAndRemoveImage() dispatches onto m_processingQueue,\nand the @catch branch called layerErrorDidChange() directly on that background queue.\nlayerErrorDidChange() dereferences the non-thread-safe WeakPtr\u003cSampleBufferDisplayLayerClient\u003e m_client\nand invokes virtual methods on its RemoteSampleBufferDisplayLayer client,\nwhile RemoteSampleBufferDisplayLayerManager::releaseLayer() is dropping the last Ref on the main runloop.\n\nBounce the @catch handler to the main runloop via callOnMainThread so layerErrorDidChange() runs on the expected thread.\n\n* LayoutTests/ipc/LocalSampleBufferDisplayLayer-flushAndRemoveImage-cross-thread-uaf-expected.txt: Added.\n\nPatch mostly done by Simon Lewis.\n* LayoutTests/ipc/LocalSampleBufferDisplayLayer-flushAndRemoveImage-cross-thread-uaf.html: Added.\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebCore/platform/graphics/avfoundation/objc/LocalSampleBufferDisplayLayer.mm:\n(WebCore::LocalSampleBufferDisplayLayer::flushAndRemoveImage):\nHop to the main thread before calling layerErrorDidChange().\n\nOriginally-landed-as: 305413.884@safari-7624-branch (150ce323b07b). rdar://180437609\nCanonical link: https://commits.webkit.org/316484@main", "email": "youenn@apple.com", "hash": "d4b40e10edf70074195fa76e9ffdc52962a3f04b", "subject": "[WebKit] Cross-thread use-after-free in RemoteSampleBufferDisplayLayer via off-main layerErrorDidChange() from FlushAndRemoveImage @catch" }, "316485@main": { "author": "Ryosuke Niwa", "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64", "cl": "316485@main", "clUrl": "https://commits.webkit.org/316485@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=312540\nrdar://174207086\n\nReviewed by Antti Koivisto.\n\nJSStyleSheet::visitAdditionalChildren is called by the JSC garbage collector on a GC thread.\nIt calls addWebCoreOpaqueRoot(visitor, wrapped()) with root(StyleSheet*), which reads\nstyleSheet-\u003eownerNode() and styleSheet-\u003eownerRule(). Both are WeakPtr member variables on\nCSSStyleSheet or XSLStyleSheet with .get() returning a raw pointer with no ref count increment,\nand the backing WeakPtrImpl can be freed by the main thread between the read and the subsequent\ndereference, causing a heap use-after-free.\n\nThe same root(StyleSheet*) function is the convergence point for JSCSSRule's\nvisitAdditionalChildren and JSCSSStyleDeclaration's visitAdditionalChildren, so all three GC\nvisitor paths are affected.\n\nTo address this bug, this PR adds a pure virtual opaqueRootForGCThread() to so root(StyleSheet*)\nbecomes a single virtual dispatch, eliminating the unsafe inline chain traversal. This function\nthen uses a newly added lock (m_opaqueRootLockForGC in CSSStyleSheet and XSLStyleSheet) to\nguard against m_ownerNode being modified while the main thread is mutating it.\n\nIn addition, we had a GC correctness bug that @import child stylesheets (which have m_ownerRule\nbut no m_ownerNode) would not keep its parent stylesheet's JS wrapper alive even though it's\naccessible via parentStyleSheet property.\n\nTo implement these changes and to avoid thread safety issues, this PR changes the type of\nm_ownerNode and m_ownerRule in CSSStyleSheet and XSLStyleSheet from WeakPtr to CheckedPtr since\nWeakPtr loads the pointee address via WeakPtrImpl, which may be concurrently free'ed in the main\nthread while we're accessing it in a GC thread. Note that all owner element destructors\n(HTMLStyleElement, HTMLLinkElement, SVGStyleElement, ProcessingInstruction) call clearOwnerNode()\nbefore the Node base-class destructor, so the CheckedPtr count reaches zero in time. Similarly,\nlearOwnerRule() is called from the CSSImportRule and StyleRuleImport destructors before\nCSSImportRule is freed so CheckedPtr's assertion should not fire.\n\nNo new tests for the data race issue itself since there is no reliable way of testing it.\n\nTest: fast/dom/StyleSheet/gc-import-rule-stylesheet.html\n\n* LayoutTests/fast/dom/StyleSheet/gc-import-rule-stylesheet-expected.txt: Added.\n* LayoutTests/fast/dom/StyleSheet/gc-import-rule-stylesheet.html: Added.\n* Source/WebCore/bindings/js/JSStyleSheetCustom.h:\n(WebCore::root):\n* Source/WebCore/css/CSSImportRule.cpp:\n(WebCore::CSSImportRule::~CSSImportRule):\n* Source/WebCore/css/CSSImportRule.h:\n* Source/WebCore/css/CSSStyleSheet.cpp:\n(WebCore::CSSStyleSheet::clearOwnerNode):\n(WebCore::CSSStyleSheet::opaqueRootForGCThread):\n(WebCore::CSSStyleSheet::clearOwnerRule):\n* Source/WebCore/css/CSSStyleSheet.h:\n* Source/WebCore/css/StyleSheet.h:\n* Source/WebCore/xml/XSLStyleSheet.h:\n* Source/WebCore/xml/XSLStyleSheetLibxslt.cpp:\n(WebCore::XSLStyleSheet::XSLStyleSheet):\n(WebCore::XSLStyleSheet::clearOwnerNode):\n(WebCore::XSLStyleSheet::opaqueRootForGCThread):\n* Source/WebKitLegacy/mac/DOM/DOMCSSImportRule.mm:\n(-[DOMCSSImportRule media]):\n(-[DOMCSSImportRule styleSheet]):\n\nOriginally-landed-as: 305413.691@safari-7624-branch (f41030176464). rdar://180436921\nCanonical link: https://commits.webkit.org/316485@main", "email": "rniwa@webkit.org", "hash": "b1a42efa6ce00e8d6cabcf8faff005e734a54190", "subject": "Data race in JSStyleSheet::visitAdditionalChildren during GC leading to use-after-free" }, "316486@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "316486@main", "clUrl": "https://commits.webkit.org/316486@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318495\nrdar://181280080\n\nReviewed by Justin Michaud.\n\nI came across an interesting and simple build failure. We use std::vector\nbut we don't include \u003cvector\u003e in a certain build configuration.\n\n* Source/WTF/wtf/RefTrackerMixin.cpp:\n\nCanonical link: https://commits.webkit.org/316486@main", "email": "achristensen@apple.com", "hash": "1664fa80ae9d3be41518ad14952f4bb72d7912a5", "subject": "Include vector header for its use in RefTrackerMixin.cpp" }, "316487@main": { "author": "Anuj Panta", "avatar": "https://www.gravatar.com/avatar/f795b7daddea5f93c9cbb5a4a8f0db14?d=identicon\u0026s=64", "cl": "316487@main", "clUrl": "https://commits.webkit.org/316487@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=316416\nrdar://178830496\n\nReviewed by Qianlang Chen.\n\n_frameTargetInlineStyleInvalidated fired one DOM.getAttributes command per\ninvalidated node, every tick. Mirror the page-target _inlineStyleInvalidated:\naccumulate the node IDs and flush once per tick via a deferred callback.\n\nThe page target keeps this state on the manager; frame targets need it\nper-target since node IDs are scoped (targetId:nodeId) and each frame has its\nown DOMAgent, so attributeLoadNodeIds/loadNodeAttributesTimeout live on the\nper-target record. Unlike the page target, a frame can be torn down mid-tick,\nso _cleanupFrameTarget cancels any pending flush.\n\n* Source/WebInspectorUI/UserInterface/Controllers/DOMManager.js:\n(WI.DOMManager.prototype._initializeFrameTarget):\n(WI.DOMManager.prototype._cleanupFrameTarget):\n(WI.DOMManager.prototype._frameTargetInlineStyleInvalidated):\n(WI.DOMManager.prototype._loadFrameTargetNodeAttributes):\n\nCanonical link: https://commits.webkit.org/316487@main", "email": "a_panta@apple.com", "hash": "e39ba8bbd23c8b2d6c0166ce1ec6eb3ac4dd9b7a", "subject": "Web Inspector: FrameDOMAgent inline style invalidation issues one DOM.getAttributes command per node instead of batching per tick" }, "316488@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "316488@main", "clUrl": "https://commits.webkit.org/316488@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318540\nrdar://181311759\n\nReviewed by Devin Rousso.\n\ndidClearWindowObjectInWorld called identifierRegistry().frameId() before\nchecking m_ignoreDidClearWindowObject. frameId() is not a pure getter: it\nregisters the frame in the identifier map (BackendIdentifierRegistry), and\nlazily mints a stable identifier (LegacyIdentifierRegistry). On the\nreentrant path where frameNavigated() has set m_ignoreDidClearWindowObject\nto suppress the duplicate context-created notification, we still performed\nthat map insertion before bailing out.\n\nThe resulting identifier is stable/deterministic either way, so this had no\nobservable protocol effect, but the ignore check should short-circuit first\nto avoid the needless work on the suppressed path.\n\n* Source/WebCore/inspector/agents/page/PageRuntimeAgent.cpp:\n(WebCore::PageRuntimeAgent::didClearWindowObjectInWorld):\n\nCanonical link: https://commits.webkit.org/316488@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "d313f1ef4857987ba09d96600d5d0bcd10b64101", "subject": "PageRuntimeAgent::didClearWindowObjectInWorld should check m_ignoreDidClearWindowObject before minting a frame identifier" }, "316489@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "316489@main", "clUrl": "https://commits.webkit.org/316489@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318559\nrdar://181331996\n\nReviewed by Devin Rousso.\n\nInspectorCanvasAgent::didChangeCanvasSize() and didChangeCanvasMemory()\neach declared a null RefPtr\u003cInspectorCanvas\u003e and then guarded the\nfindInspectorCanvas() lookup behind `if (!inspectorCanvas)`, which is\nunconditionally true since the variable was just default-constructed to\nnull. Assign the lookup result directly, matching the surrounding\ncanvasChanged() and canvasDestroyed() methods. No change in behavior.\n\n* Source/WebCore/inspector/agents/InspectorCanvasAgent.cpp:\n(WebCore::InspectorCanvasAgent::didChangeCanvasSize):\n(WebCore::InspectorCanvasAgent::didChangeCanvasMemory):\n\nCanonical link: https://commits.webkit.org/316489@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "34c12d7629562b966ace148545471e3c3a696e51", "subject": "[Web Inspector] didChangeCanvasSize/didChangeCanvasMemory have a vestigial always-true null check on inspectorCanvas" }, "316490@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "316490@main", "clUrl": "https://commits.webkit.org/316490@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318537\nrdar://181307890\n\nReviewed by Devin Rousso.\n\nWhen processing removed stylesheets, InspectorCSSAgent dereferenced the\nresult of m_cssStyleSheetToInspectorStyleSheet.get() without a null check\nto read id(), unlike its twin FrameCSSAgent::setActiveStyleSheetsForDocument\nwhich guards the same access. Add the missing null check to match.\n\n* Source/WebCore/inspector/agents/InspectorCSSAgent.cpp:\n(WebCore::InspectorCSSAgent::setActiveStyleSheetsForDocument):\n\nCanonical link: https://commits.webkit.org/316490@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "30dcf5d1c9402dea5a26158e103f7e4333a7eac2", "subject": "[Web Inspector] Null InspectorStyleSheet dereference in InspectorCSSAgent::setActiveStyleSheetsForDocument when removing a stylesheet" }, "316491@main": { "author": "Anuj Panta", "avatar": "https://www.gravatar.com/avatar/f795b7daddea5f93c9cbb5a4a8f0db14?d=identicon\u0026s=64", "cl": "316491@main", "clUrl": "https://commits.webkit.org/316491@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=316799\nrdar://179249922\n\nReviewed by BJ Burg.\n\nIntroduce FrameDOMStorageAgent, the per-frame DOMStorage agent for Site\nIsolation. Each LocalFrame's FrameInspectorController creates one, and\nit registers itself as the enabled per-frame DOMStorage agent on its\nframe's InstrumentingAgents.\n\nThis patch is enablement only: enable/disable are functional, and the\nDOMStorage domain now advertises the \"frame\" target type so a frame\ntarget exposes DOMStorageAgent to the frontend. The storage commands are\npresent as \"Not supported on frame targets\" stubs and are implemented in\na follow-up.\n\nenable() is idempotent: unlike the page-level InspectorDOMStorageAgent\n(which errors on a redundant enable), a repeat enable for the same agent\nis treated as a no-op, matching the sibling Frame* agents (e.g.\nFrameCSSAgent).\n\n* Source/JavaScriptCore/inspector/protocol/DOMStorage.json:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/inspector/FrameInspectorController.cpp:\n(WebCore::FrameInspectorController::createLazyAgents):\n* Source/WebCore/inspector/InstrumentingAgents.h:\n* Source/WebCore/inspector/agents/frame/FrameDOMStorageAgent.cpp: Added.\n(WebCore::FrameDOMStorageAgent::FrameDOMStorageAgent):\n(WebCore::m_inspectedFrame):\n(WebCore::FrameDOMStorageAgent::didCreateFrontendAndBackend):\n(WebCore::FrameDOMStorageAgent::willDestroyFrontendAndBackend):\n(WebCore::FrameDOMStorageAgent::enable):\n(WebCore::FrameDOMStorageAgent::disable):\n(WebCore::FrameDOMStorageAgent::getDOMStorageItems):\n(WebCore::FrameDOMStorageAgent::setDOMStorageItem):\n(WebCore::FrameDOMStorageAgent::removeDOMStorageItem):\n(WebCore::FrameDOMStorageAgent::clearDOMStorageItems):\n* Source/WebCore/inspector/agents/frame/FrameDOMStorageAgent.h: Added.\n\nCanonical link: https://commits.webkit.org/316491@main", "email": "a_panta@apple.com", "hash": "e1679b539c6174f7b2628eda2b25fb21cba830be", "subject": "Web Inspector: [SI] add per-frame FrameDOMStorageAgent (enable/disable)" }, "316492@main": { "author": "Lauro Moura", "avatar": "https://www.gravatar.com/avatar/6157f52d61e04c2c63fe7ff668ba69b3?d=identicon\u0026s=64", "cl": "316492@main", "clUrl": "https://commits.webkit.org/316492@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318463\n\nReviewed by Patrick Griffis.\n\nSafely ignore a given host if it's not found in m_cookieChangeObservers,\navoiding a potential null deref. This mirrors the Cocoa port's release\nbehavior. For debug builds, as the ASSERT_UNUSED(removed, removed) in\nNetworkConnectionToWebProcess::unsubscribeFromCookieChangeNotifications\nwould have triggered earlier, we're also removing the redundant ASSERT.\n\nThis scenario can happen after a previous NetworkProcess with cookie\nlisteners crashes. As currently the WebCookieJar is not notified of such\ncrashes, it does not tell the replacement process's NetworkStorageSession\nabout the existing listeners. Then, when the WebCookieJar sends an\nunsubscribe request, we hit the assertion or trigger the null deref on\nthe empty map on the storage session.\n\n* Source/WebCore/platform/network/soup/NetworkStorageSessionSoup.cpp:\n(WebCore::NetworkStorageSession::stopListeningForCookieChangeNotifications):\n\nCanonical link: https://commits.webkit.org/316492@main", "email": "lmoura@igalia.com", "hash": "86ec57b01ddf525c5efdaf84479a6df1af9f258a", "subject": "[Soup] Null deref in NetworkStorageSession::stopListeningForCookieChangeNotifications when a host is absent from m_cookieChangeObservers" }, "316493@main": { "author": "Elliott Williams", "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64", "cl": "316493@main", "clUrl": "https://commits.webkit.org/316493@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317876\nrdar://177493372\n\nReviewed by Richard Robinson.\n\nReland of 316413@main with a fix for the SaferCPP EWS build, which still\nuses Xcode 26.2.\n\nOur `AvailabilityProhibitedInternal.h` injected header does not work\nwhen building with modules. Modules are by design self-contained, and\nthe `os_availability` modulemap in the SDK compiles without finding and\nincluding our injected header.\n\nWe need to silence availability errors in the public build in order to\nbind to SPI on the platform that is otherwise marked API_UNAVAILABLE.\n\nInstead, replace the technique with a new approach based on stubbing out\nthe entire Availability library, replacing \u003cAvailability.h\u003e and\n\u003cos/availability.h\u003e with our own versions of the headers.\n\nThe OS modulemap containing the availability project has other headers\nin it too, so we can't just ship our own modulemap referencing the\nstubs. Instead, generate a VFS overlay which maps our headers onto the\ncorrect SDK paths.\n\n* Configurations/CommonBase.xcconfig:\n* Configurations/SDKAdditions.xcconfig:\n* Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig:\n\nIn third-party code, add \"Setup\" targets to Xcode projects which depend\non the overlay YAML bring produced. These gate compilation of any of the\nthird-party libraries until bmalloc has run and WTF has staged public\nSDK headers.\n\n(In CMake, we're able to generate the overlay at configure time without\ndisturbing the dependency graph, so this issue does not exist.)\n\n* Source/ThirdParty/ANGLE/ANGLE.xcodeproj/project.pbxproj:\n* Source/ThirdParty/gmock/gmock.xcodeproj/project.pbxproj:\n* Source/ThirdParty/gtest/xcode/gtest.xcodeproj/project.pbxproj:\n* Source/ThirdParty/libwebrtc/libwebrtc.xcodeproj/project.pbxproj:\n* Source/WTF/Configurations/WTF.xcconfig:\n* Source/WebCore/Configurations/WebCore.xcconfig:\n* Source/WebCore/PAL/Configurations/PAL.xcconfig:\n* Source/WebCore/inspector/agents/frame/FrameCSSAgent.cpp:\n(WebCore::FrameCSSAgent::detectOrigin):\n* Source/WebGPU/Configurations/WebGPU.xcconfig:\n* Source/WebKit/Configurations/WebKit.xcconfig:\n* Source/bmalloc/Configurations/bmalloc.xcconfig:\n* Source/bmalloc/bmalloc.xcodeproj/project.pbxproj: Call\n generate-overlay before bmalloc builds. It needs to happen very early\n in the build, before any target that includes CommonBase.xcconfig\n starts compiling.\n* Source/cmake/OptionsCocoa.cmake:\n* WebKitLibraries/AvailabilityOverlay/generate-overlay.py: Added.\n* WebKitLibraries/AvailabilityOverlay/usr/include/Availability.h: Added.\n* WebKitLibraries/AvailabilityOverlay/usr/include/os/availability.h: Added.\n\nDelete all the old AvailabilityProhibitedInternal.h headers:\n\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/appletvos26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/appletvsimulator18.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/appletvsimulator26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/iphoneos26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/iphonesimulator26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/macosx14.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/macosx15.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/macosx26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/watchos26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/watchsimulator26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/xros26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n* WebKitLibraries/SDKs/xrsimulator26.0-additions.sdk/usr/local/include/AvailabilityProhibitedInternal.h: Removed.\n\nCanonical link: https://commits.webkit.org/316493@main", "email": "emw@apple.com", "hash": "7768ef95fbb7da97cc764fa81978681994ce8c74", "subject": "[Build] Reenable JSC and WebCore module verifier on public SDK builds" }, "316494@main": { "author": "Marcos Caceres", "avatar": "https://www.gravatar.com/avatar/d31c9c6a3b0af558a2945682020e5b90?d=identicon\u0026s=64", "cl": "316494@main", "clUrl": "https://commits.webkit.org/316494@main", "description": "rdar://180812397\nhttps://bugs.webkit.org/show_bug.cgi?id=318013\n\nReviewed by Abrar Rahman Protyasha.\n\nWKIdentityDocumentPresentmentController.cancelRequest() only cancelled\nperformRequestTask. When the abort arrived before the asynchronous\nperform(request:) had assigned performRequestTask, the optional-chained\ncancel was a no-op, so Identity Document Services was never told to dismiss\nand the picker stayed on screen.\n\nTrack cancellation in an isCancelled flag set by cancelRequest().\nperform(request:) throws without presenting when cancellation was already\nrequested; a cancel that arrives once the request is in flight is delivered\nthrough performRequestTask as before. Map a CancellationError to .cancelled\nso the request rejects with AbortError rather than UnknownError.\n\nThe controller is single-use: the picker creates a fresh instance per\nrequest and discards it on dismiss, so isCancelled is terminal and never\nreset. A hasStartedRequest guard makes that contract explicit, rejecting\nreuse with requestInProgress rather than a stale cancelled state.\n\nThe repeated get()/abort path is exercised by the \"Aborted Digital\nCredentials get() requests do not leave a subsequent request stuck in an\ninvalid state\" subtest in get-non-fully-active.https.html; a hermetic\nregression test depends on the digital-credentials test automation in\nbug 306292.\n\n* Source/WebKit/WebKitSwift/IdentityDocumentServices/WKIdentityDocumentPresentmentController.swift:\n(Base.perform(_:)): Throw before presenting if cancellation was already\nrequested, reject reuse of a single-use controller, and map a\nCancellationError to a cancelled error.\n(Base.cancelRequest): Record that cancellation was requested.\n\nCanonical link: https://commits.webkit.org/316494@main", "email": "marcosc@apple.com", "hash": "bab1bc1f7610146c5ae0ad963cbcd3b743ab0a11", "subject": "Digital Credentials: aborting navigator.credentials.get() can leave the document picker stuck on screen" }, "316495@main": { "author": "Anne van Kesteren", "avatar": "https://www.gravatar.com/avatar/09bb44ac3625a121017cd98d0a7dc52c?d=identicon\u0026s=64", "cl": "316495@main", "clUrl": "https://commits.webkit.org/316495@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=315904\n\nReviewed by Antti Koivisto.\n\nSelectorChecker and the selector JIT forced :last-child, :last-of-type,\n:only-child, :only-of-type, :nth-last-child, and :nth-last-of-type to\nreturn false whenever the candidate's parent had not yet finished\nparsing children. While matching Chromium as an optimization for\nstyle-resolution, it does not for querySelector().\n\nThis is the real reason a subtest in\nimported/w3c/web-platform-tests/shadow-dom/untriaged/shadow-trees/upper-boundary-encapsulation/test-009.html\nfails. Bug 315847 also addresses it by fixing a different bug, but does\nnot fix the root cause.\n\nTest: imported/w3c/web-platform-tests/css/selectors/child-indexed-during-parse.html\n\nUpstream: https://github.com/web-platform-tests/wpt/pull/60294\nCanonical link: https://commits.webkit.org/316495@main", "email": "annevk@annevk.nl", "hash": "748f060a3b77ae67930d9c71ff5c3f159ab51c9a", "subject": ":last-child and friends should not gate on parser state outside style resolution" }, "316496@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "316496@main", "clUrl": "https://commits.webkit.org/316496@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318421\nrdar://181203630\n\nReviewed by Yijia Huang.\n\nIntlLegacyConstructedSymbol symbol should be per-realm[1].\n\n\u003e The Intl object has an internal slot, [[FallbackSymbol]],\n\u003e which is a new %Symbol% in the current realm with the\n\u003e [[Description]] \"IntlLegacyConstructedSymbol\".\n\n[1]: https://tc39.es/proposal-intl-enumeration/#intl-object\n\n* JSTests/test262/expectations.yaml:\n* Source/JavaScriptCore/builtins/BuiltinNames.cpp:\n(JSC::BuiltinNames::BuiltinNames):\n* Source/JavaScriptCore/builtins/BuiltinNames.h:\n(JSC::BuiltinNames::polyProtoName const):\n(JSC::BuiltinNames::intlLegacyConstructedSymbol const): Deleted.\n* Source/JavaScriptCore/runtime/CommonIdentifiers.h:\n* Source/JavaScriptCore/runtime/IntlObjectInlines.h:\n(JSC::constructIntlInstanceWithWorkaroundForLegacyIntlConstructor):\n(JSC::unwrapForLegacyIntlConstructor):\n* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:\n(JSC::JSGlobalObject::JSGlobalObject):\n* Source/JavaScriptCore/runtime/JSGlobalObject.h:\n(JSC::JSGlobalObject::intlLegacyConstructedSymbol const):\n\nCanonical link: https://commits.webkit.org/316496@main", "email": "ysuzuki@apple.com", "hash": "ba9b3ab164f77b23b1dbfa862f7b498b2b3f4a0f", "subject": "[JSC] IntlLegacyConstructedSymbol should be per-realm" }, "316497@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "316497@main", "clUrl": "https://commits.webkit.org/316497@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=314984\nrdar://177291111\n\nReviewed by Yijia Huang and Dan Hecht.\n\nThis code is extremely hot when we have large function (e.g. Air).\nThis patch avoids three independent profile.numberOfSamples(),\nprofile.isSampledBefore(), profile.computeUpdatedPrediction() calls\nand combine them into one computeUpdatedPrediction.\n\n* Source/JavaScriptCore/bytecode/CodeBlock.cpp:\n(JSC::CodeBlock::updateAllNonLazyValueProfilePredictionsAndCountLiveness):\n\nCanonical link: https://commits.webkit.org/316497@main", "email": "ysuzuki@apple.com", "hash": "b9008f390e5fac6686348939a08b8d265f265fce", "subject": "[JSC] Make CodeBlock::updateAllNonLazyValueProfilePredictionsAndCountLiveness tight" }, "316498@main": { "author": "Yijia Huang", "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64", "cl": "316498@main", "clUrl": "https://commits.webkit.org/316498@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318454\nrdar://181253131\n\nReviewed by Yusuke Suzuki.\n\nFix two spec-conformance bugs, remove dead code, and align spec-step\ncomments across Temporal.PlainDateTime.\n\nThe constructor previously accepted NaN on time args (silently coercing\nto 0) and skipped trailing arguments; ToIntegerWithTruncation now\nthrows RangeError on any non-finite value per spec.\n\nTemporal.PlainDateTime.prototype.round dropped a non-ISO calendar\nbecause tryCreateIfValid couldn't carry one. create() and\ntryCreateIfValid() now take an optional CalendarID and every\n\"tryCreateIfValid + setCalendarID\" callsite is collapsed accordingly.\n\nDead code removed: the never-called TemporalPlainDateTime::with()\nimpl, unreachable inherits\u003cTPDT/PD/ZDT\u003e branches inside fromImpl, the\nundefined String\u0026\u0026 constructor, the setCalendarID/setCalendarId\naccessors, and the duplicated inherits\u003cTPDT\u003e fast-path in\ntemporalPlainDateTimeConstructorFuncFrom.\n\nTests:\nJSTests/stress/temporal-plain-datetime-ctor-nan-infinity.js\nJSTests/stress/temporal-plain-datetime-round.js\n\nCanonical link: https://commits.webkit.org/316498@main", "email": "yijia_huang@apple.com", "hash": "a0433cfeb9ab17a6b63150f4eec507b660541b7b", "subject": "[JSC][Temporal] Polish Temporal.PlainDateTime: spec alignment, constructor and round() fixes" } }, "date": "2026-07-03", "days": 1, "generatedAt": "2026-07-03T22:06:36Z", "markdown": "## Highlights\n- **Security** WebKit fixed a stack buffer overflow in libwebrtc video codec setup triggered by remote SDP simulcast layers, closing a serious memory corruption path in WebContent. [commit 316431@main](https://commits.webkit.org/316431@main)\n- **Security** Multiple use-after-free and race fixes landed across CSS, streams, WebXR, GPU process media, and remote layers, cutting into a broad class of exploitable lifetime bugs. [commit 316485@main](https://commits.webkit.org/316485@main) [commit 316484@main](https://commits.webkit.org/316484@main) [commit 316483@main](https://commits.webkit.org/316483@main) [commit 316482@main](https://commits.webkit.org/316482@main) [commit 316451@main](https://commits.webkit.org/316451@main) [commit 316449@main](https://commits.webkit.org/316449@main) [commit 316438@main](https://commits.webkit.org/316438@main)\n- **Web Platform** JSC tightened Temporal.PlainDateTime behavior with spec-aligned constructor and round() fixes, plus an Intl per-realm correctness fix. [commit 316498@main](https://commits.webkit.org/316498@main) [commit 316496@main](https://commits.webkit.org/316496@main)\n- **Privacy** Tracking protection got a meaningful behavior change: script tracking request blocking is now gated on Resource Load Statistics, and a long-standing macOS ITP usage description issue was fixed. [commit 316460@main](https://commits.webkit.org/316460@main) [commit 316474@main](https://commits.webkit.org/316474@main)\n- **DevTools** Web Inspector had a dense cleanup day with crash fixes, per-frame DOM storage plumbing, better header replacement semantics, and less chatty style invalidation. [commit 316491@main](https://commits.webkit.org/316491@main) [commit 316487@main](https://commits.webkit.org/316487@main) [commit 316445@main](https://commits.webkit.org/316445@main) [commit 316444@main](https://commits.webkit.org/316444@main)\n- **Rendering** Style and rendering correctness moved forward with fixes for :last-child style gating, iframe color-scheme invalidation, drop-shadow repainting, view transitions, and grid intrinsic sizing. [commit 316495@main](https://commits.webkit.org/316495@main) [commit 316467@main](https://commits.webkit.org/316467@main) [commit 316450@main](https://commits.webkit.org/316450@main) [commit 316446@main](https://commits.webkit.org/316446@main) [commit 316469@main](https://commits.webkit.org/316469@main)\n- **Mobile** Digital Credentials got both a user-visible abort-flow fix for a stuck picker and new WebDriver BiDi coverage for automation. [commit 316494@main](https://commits.webkit.org/316494@main) [commit 316435@main](https://commits.webkit.org/316435@main)\n- **Media** Media stack hardening covered MIME type decode races, AudioBuffer pinning, WebVTT wrapping, AVFoundation crash fixes, and iOS route cleanup. [commit 316458@main](https://commits.webkit.org/316458@main) [commit 316481@main](https://commits.webkit.org/316481@main) [commit 316432@main](https://commits.webkit.org/316432@main) [commit 316464@main](https://commits.webkit.org/316464@main) [commit 316434@main](https://commits.webkit.org/316434@main)\n\n## What landed by area\n\n### JavaScriptCore and Web Platform\n- **Web Platform** Temporal.PlainDateTime got spec-aligned constructor and round() behavior fixes. [commit 316498@main](https://commits.webkit.org/316498@main) [bug 318454](https://bugs.webkit.org/show_bug.cgi?id=318454)\n- **Perf** CodeBlock::updateAllNonLazyValueProfilePredictionsAndCountLiveness was tightened up. [commit 316497@main](https://commits.webkit.org/316497@main) [bug 314984](https://bugs.webkit.org/show_bug.cgi?id=314984)\n- **Web Platform** IntlLegacyConstructedSymbol is now per-realm, fixing realm isolation correctness. [commit 316496@main](https://commits.webkit.org/316496@main) [bug 318421](https://bugs.webkit.org/show_bug.cgi?id=318421)\n- **V8** DFG constant folding now proves resolved values are non-thenable for NewResolvedPromise. [commit 316466@main](https://commits.webkit.org/316466@main) [bug 318515](https://bugs.webkit.org/show_bug.cgi?id=318515)\n- **Perf** JSC skips Latin-1 single-character atomization in s.split(''), shaving overhead from a common string path. [commit 316465@main](https://commits.webkit.org/316465@main) [bug 318510](https://bugs.webkit.org/show_bug.cgi?id=318510)\n- **V8** LICM now skips tuple consumers, avoiding an invalid optimization path. [commit 316463@main](https://commits.webkit.org/316463@main) [bug 318513](https://bugs.webkit.org/show_bug.cgi?id=318513)\n- **Refactor** DeferredWorkTimer now vends weak references to tickets, improving lifetime safety in deferred work scheduling. [commit 316448@main](https://commits.webkit.org/316448@main) [bug 314671](https://bugs.webkit.org/show_bug.cgi?id=314671)\n\n### Security and memory safety\n- **Security** JSStyleSheet GC visitation had a data race leading to use-after-free, now fixed. [commit 316485@main](https://commits.webkit.org/316485@main) [bug 312540](https://bugs.webkit.org/show_bug.cgi?id=312540)\n- **Security** RemoteSampleBufferDisplayLayer no longer risks cross-thread use-after-free from off-main layerErrorDidChange(). [commit 316484@main](https://commits.webkit.org/316484@main)\n- **Security** CDMSessionAVContentKeySession teardown no longer mutates an unlocked session vector off the main thread. [commit 316483@main](https://commits.webkit.org/316483@main) [bug 314134](https://bugs.webkit.org/show_bug.cgi?id=314134)\n- **Security** CSSFontFace::setStatus via CSSFontFace::load had a use-after-free fix. [commit 316482@main](https://commits.webkit.org/316482@main) [bug 313577](https://bugs.webkit.org/show_bug.cgi?id=313577)\n- **Security** FEComponentTransfer's CoreImage Metal kernel no longer reads past bounds with empty tableValues. [commit 316461@main](https://commits.webkit.org/316461@main) [bug 314461](https://bugs.webkit.org/show_bug.cgi?id=314461)\n- **Security** RemoteScrollingTree timeline registry lifetime was fixed to prevent cross-thread use-after-free. [commit 316438@main](https://commits.webkit.org/316438@main) [bug 314585](https://bugs.webkit.org/show_bug.cgi?id=314585)\n- **Security** WebXRSystem callback reposting no longer risks use-after-free during immersive device selection. [commit 316451@main](https://commits.webkit.org/316451@main)\n- **Security** ReadableStream.cancel() no longer type-confuses via jsCast\u003cJSPromise*\u003e. [commit 316449@main](https://commits.webkit.org/316449@main) [bug 313706](https://bugs.webkit.org/show_bug.cgi?id=313706)\n- **Security** Soup fixed a null deref in cookie change notification teardown when the host is absent from observers. [commit 316492@main](https://commits.webkit.org/316492@main) [bug 318463](https://bugs.webkit.org/show_bug.cgi?id=318463)\n- **Security** WebPageProxy::didFailLoadForFrame now has a missing MESSAGE_CHECK_URL on error.failingURL(). [commit 316472@main](https://commits.webkit.org/316472@main) [bug 314873](https://bugs.webkit.org/show_bug.cgi?id=314873)\n\n### Web Inspector and tooling\n- **DevTools** Web Inspector added per-frame FrameDOMStorageAgent enable and disable support. [commit 316491@main](https://commits.webkit.org/316491@main) [bug 316799](https://bugs.webkit.org/show_bug.cgi?id=316799)\n- **Security** InspectorCSSAgent no longer null-dereferences InspectorStyleSheet while removing a stylesheet. [commit 316490@main](https://commits.webkit.org/316490@main) [bug 318537](https://bugs.webkit.org/show_bug.cgi?id=318537)\n- **Refactor** didChangeCanvasSize and didChangeCanvasMemory dropped a vestigial always-true null check. [commit 316489@main](https://commits.webkit.org/316489@main) [bug 318559](https://bugs.webkit.org/show_bug.cgi?id=318559)\n- **Security** PageRuntimeAgent now checks m_ignoreDidClearWindowObject before minting a frame identifier. [commit 316488@main](https://commits.webkit.org/316488@main) [bug 318540](https://bugs.webkit.org/show_bug.cgi?id=318540)\n- **Perf** FrameDOMAgent now batches inline style invalidation work instead of issuing one DOM.getAttributes per node. [commit 316487@main](https://commits.webkit.org/316487@main) [bug 316416](https://bugs.webkit.org/show_bug.cgi?id=316416)\n- **Security** InspectorAnimationAgent fixed an out-of-bounds read when parsedKeyframes is shorter than blendingKeyframes. [commit 316470@main](https://commits.webkit.org/316470@main) [bug 318501](https://bugs.webkit.org/show_bug.cgi?id=318501)\n- **Security** Page.setCookie no longer dereferences an empty std::optional when session is omitted and expires is present. [commit 316462@main](https://commits.webkit.org/316462@main) [bug 318422](https://bugs.webkit.org/show_bug.cgi?id=318422)\n- **Refactor** WebInspector memory cache usage was fixed after an earlier change. [commit 316459@main](https://commits.webkit.org/316459@main) [bug 318469](https://bugs.webkit.org/show_bug.cgi?id=318469)\n- **DevTools** Network.interceptWithRequest no longer crashes when the request was already aborted. [commit 316445@main](https://commits.webkit.org/316445@main) [bug 318482](https://bugs.webkit.org/show_bug.cgi?id=318482)\n- **DevTools** Network.setExtraHTTPHeaders now replaces prior headers instead of accumulating them. [commit 316444@main](https://commits.webkit.org/316444@main) [bug 318478](https://bugs.webkit.org/show_bug.cgi?id=318478)\n- **Security** A power-efficient playback heuristic underflow was fixed in the DOM agent. [commit 316443@main](https://commits.webkit.org/316443@main) [bug 318424](https://bugs.webkit.org/show_bug.cgi?id=318424)\n- **DevTools** Adopted constructable stylesheets are no longer misclassified as User Agent in the per-frame CSS agent. [commit 316433@main](https://commits.webkit.org/316433@main) [bug 318423](https://bugs.webkit.org/show_bug.cgi?id=318423)\n- **Refactor** Flex overlay cross-axis direction calculation dropped a self-canceling ternary. [commit 316429@main](https://commits.webkit.org/316429@main) [bug 318409](https://bugs.webkit.org/show_bug.cgi?id=318409)\n\n### Rendering, layout, CSS, and SVG\n- **Rendering** :last-child and related selectors no longer gate on parser state outside style resolution. [commit 316495@main](https://commits.webkit.org/316495@main) [bug 315904](https://bugs.webkit.org/show_bug.cgi?id=315904)\n- **Perf** SVGURIReference::fragmentIdentifierFromIRIString avoids redundant URL parsing and string allocations. [commit 316480@main](https://commits.webkit.org/316480@main) [bug 318531](https://bugs.webkit.org/show_bug.cgi?id=318531)\n- **Web Platform** css-mixins-1 got minor @function fixes. [commit 316478@main](https://commits.webkit.org/316478@main) [bug 318548](https://bugs.webkit.org/show_bug.cgi?id=318548)\n- **Rendering** Grid formatting context fixed incorrect block-axis sizing for intrinsic rows. [commit 316469@main](https://commits.webkit.org/316469@main) [bug 318406](https://bugs.webkit.org/show_bug.cgi?id=318406)\n- **Web Platform** SVG SMIL animations now correctly refuse to apply when from, to, or by values fail to parse. [commit 316468@main](https://commits.webkit.org/316468@main) [bug 318066](https://bugs.webkit.org/show_bug.cgi?id=318066)\n- **Rendering** Changing an iframe color-scheme now invalidates the embedded document appearance correctly. [commit 316467@main](https://commits.webkit.org/316467@main) [bug 316738](https://bugs.webkit.org/show_bug.cgi?id=316738)\n- **Rendering** filter: drop-shadow() now repaints fully when a child resize changes the effect bounds. [commit 316450@main](https://commits.webkit.org/316450@main) [bug 318337](https://bugs.webkit.org/show_bug.cgi?id=318337)\n- **Rendering** Navigating away from a render-blocked document no longer incorrectly reveals it and starts a cross-document view transition. [commit 316446@main](https://commits.webkit.org/316446@main) [bug 318401](https://bugs.webkit.org/show_bug.cgi?id=318401)\n- **Rendering** Dynamic stylesheet mutation no longer loses running view transition group keyframes. [commit 316436@main](https://commits.webkit.org/316436@main) [bug 318305](https://bugs.webkit.org/show_bug.cgi?id=318305)\n- **Perf** LBSE now caches resolved SVG fill and stroke paint servers. [commit 316428@main](https://commits.webkit.org/316428@main) [bug 318363](https://bugs.webkit.org/show_bug.cgi?id=318363)\n\n### Media, graphics, and GPU\n- **Media** AudioBufferSourceNode now unconditionally pins AudioBuffer data for bindings safety. [commit 316481@main](https://commits.webkit.org/316481@main) [bug 313857](https://bugs.webkit.org/show_bug.cgi?id=313857)\n- **Media** AVFoundation crash work landed for AudioVideoRendererAVFObjC::updateSharedTimebase. [commit 316475@main](https://commits.webkit.org/316475@main) [bug 318545](https://bugs.webkit.org/show_bug.cgi?id=318545)\n- **Media** createVideoInfoFromFormatDescription crash handling was fixed in WebContent. [commit 316464@main](https://commits.webkit.org/316464@main) [bug 317652](https://bugs.webkit.org/show_bug.cgi?id=317652)\n- **Media** MIMETypeCache decode capability checks are now race-free. [commit 316458@main](https://commits.webkit.org/316458@main) [bug 313842](https://bugs.webkit.org/show_bug.cgi?id=313842)\n- **Media** Models no longer flash while reloading. [commit 316453@main](https://commits.webkit.org/316453@main) [bug 318248](https://bugs.webkit.org/show_bug.cgi?id=318248)\n- **Media** The current model src now updates correctly in response to media attribute changes. [commit 316452@main](https://commits.webkit.org/316452@main) [bug 318468](https://bugs.webkit.org/show_bug.cgi?id=318468)\n- **Media** WebVTT cues with snapToLines == false now wrap as expected. [commit 316432@main](https://commits.webkit.org/316432@main) [bug 318446](https://bugs.webkit.org/show_bug.cgi?id=318446)\n- **GPU** iOS media routing cleanup continued with a second pass removing AVMediaSource support from MediaDeviceRoute. [commit 316434@main](https://commits.webkit.org/316434@main) [bug 318481](https://bugs.webkit.org/show_bug.cgi?id=318481)\n\n### Networking, privacy, and browser integration\n- **Privacy** macOS now respects NSCrossWebsiteTrackingUsageDescription instead of always enabling ITP. [commit 316474@main](https://commits.webkit.org/316474@main) [bug 220190](https://bugs.webkit.org/show_bug.cgi?id=220190)\n- **Privacy** Script tracking network request blocking is now gated on Resource Load Statistics. [commit 316460@main](https://commits.webkit.org/316460@main) [bug 318388](https://bugs.webkit.org/show_bug.cgi?id=318388)\n- **UI** Sign in with Apple reload failures caused by an invalid RemoteObjectRegistry_InvokeMethod message were fixed. [commit 316477@main](https://commits.webkit.org/316477@main)\n- **Perf** containsPlainText() no longer re-scans the head and miss matches after the first search buffer fill. [commit 316442@main](https://commits.webkit.org/316442@main) [bug 318304](https://bugs.webkit.org/show_bug.cgi?id=318304)\n- **Refactor** RunLoop::Timer now asserts that destruction happens stopped and on its own run loop thread. [commit 316457@main](https://commits.webkit.org/316457@main) [bug 318088](https://bugs.webkit.org/show_bug.cgi?id=318088)\n\n### Platform UI, apps, and testing infrastructure\n- **Build** JSC and WebCore module verifier checks were reenabled on public SDK builds. [commit 316493@main](https://commits.webkit.org/316493@main) [bug 317876](https://bugs.webkit.org/show_bug.cgi?id=317876)\n- **Build** RefTrackerMixin.cpp now includes the vector header it uses. [commit 316486@main](https://commits.webkit.org/316486@main) [bug 318495](https://bugs.webkit.org/show_bug.cgi?id=318495)\n- **Build** run-jsc-stress-tests got updated architecture detection. [commit 316479@main](https://commits.webkit.org/316479@main) [bug 318505](https://bugs.webkit.org/show_bug.cgi?id=318505)\n- **Build** StrictMemorySafety is now fatal for cmake PAL builds. [commit 316476@main](https://commits.webkit.org/316476@main) [bug 318438](https://bugs.webkit.org/show_bug.cgi?id=318438)\n- **Build** rapidfuzz wheel availability regression on Linux ARM32 was fixed in Tools. [commit 316473@main](https://commits.webkit.org/316473@main) [bug 318542](https://bugs.webkit.org/show_bug.cgi?id=318542)\n- **UI** SwiftBrowser can now open .webarchive documents. [commit 316471@main](https://commits.webkit.org/316471@main) [bug 318498](https://bugs.webkit.org/show_bug.cgi?id=318498)\n- **Build** ios-sim presets now use ninja-wrapper. [commit 316454@main](https://commits.webkit.org/316454@main) [bug 318508](https://bugs.webkit.org/show_bug.cgi?id=318508)\n- **Mobile** visionOS polished the built-in controls for \u003cimg\u003e. [commit 316447@main](https://commits.webkit.org/316447@main) [bug 318473](https://bugs.webkit.org/show_bug.cgi?id=318473)\n- **Mobile** visionOS live-resize snapshots no longer linger too long after relayout. [commit 316439@main](https://commits.webkit.org/316439@main) [bug 317160](https://bugs.webkit.org/show_bug.cgi?id=317160)\n- **Mobile** chemicalguys.com hang reports under TextExtraction::extractAllTextAndRects() were addressed on iOS 27. [commit 316430@main](https://commits.webkit.org/316430@main) [bug 318407](https://bugs.webkit.org/show_bug.cgi?id=318407)\n- **Build** ASan builds were repaired after 316420@main. [commit 316441@main](https://commits.webkit.org/316441@main) [bug 318496](https://bugs.webkit.org/show_bug.cgi?id=318496)\n\n### Credentials, automation, and test gardening\n- **Mobile** Aborting navigator.credentials.get() no longer leaves the Digital Credentials document picker stuck on screen. [commit 316494@main](https://commits.webkit.org/316494@main) [bug 318013](https://bugs.webkit.org/show_bug.cgi?id=318013)\n- **DevTools** Digital Credentials gained a WebDriver BiDi module for automated testing. [commit 316435@main](https://commits.webkit.org/316435@main) [bug 306292](https://bugs.webkit.org/show_bug.cgi?id=306292)\n- **Build** A constant failure in ParentalControlsContentFilteringTests.BlockedURL was gardened out. [commit 316456@main](https://commits.webkit.org/316456@main) [bug 318502](https://bugs.webkit.org/show_bug.cgi?id=318502)\n- **Build** Three flaky fast/animation layout tests were gardened. [commit 316455@main](https://commits.webkit.org/316455@main) [bug 305671](https://bugs.webkit.org/show_bug.cgi?id=305671)\n- **Build** A flaky WebKit.MediaBufferingPolicy API test on macOS Release was cleaned up. [commit 316440@main](https://commits.webkit.org/316440@main) [bug 318485](https://bugs.webkit.org/show_bug.cgi?id=318485)\n\n## Reverts \u0026 Reapplies\n- **Refactor** Revert of an earlier change, likely to unblock fallout from the prior landing. [commit 316437@main](https://commits.webkit.org/316437@main) [bug 318492](https://bugs.webkit.org/show_bug.cgi?id=318492)", "repo": "webkit", "repoDisplay": "WebKit", "rollGroups": [], "since": "2026-07-03", "totals": { "commits": 71, "features": 71, "rolls": 0 }, "until": "2026-07-03" }