{
  "commits": {
    "316327@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "316327@main",
      "clUrl": "https://commits.webkit.org/316327@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318534\nrdar://181304464\n\nReviewed by Tadeu Zagallo.\n\nWith our recent GC throughput optimizations etc.[1], GC scalability gets\nimproved and now we are seeing the best GC thread numbers are changed\nfrom the previous static number \"4\" on Apple platforms. This patch\ntweaks the heuristics based on P0 core and P1 core counts. The best\nnumbers are selected with A/B testing with various benchmarks on various\ndevices, and summarizing the characteristics and selecting the # of\nthreads based on that with the current JSC implementation. It is\npossible that the number may be changed with the future JSC\ndevelopment, so the formula and numbers are current snapshot.\n\n[1]: https://commits.webkit.org/316327@main\n\n* Source/JavaScriptCore/assembler/CPU.cpp:\n(JSC::hwPerfLevelPhysicalCPUMax):\n(JSC::hwNumberOfP0Cores):\n(JSC::hwNumberOfP1Cores):\n(JSC::hwNumberOfP2Cores):\n* Source/JavaScriptCore/assembler/CPU.h:\n* Source/JavaScriptCore/runtime/Options.cpp:\n(JSC::overrideDefaults):\n\nCanonical link: https://commits.webkit.org/316502@main",
      "email": "ysuzuki@apple.com",
      "hash": "f0df03efe38c9dacfdb67ec002251ee110d7939f",
      "subject": "[JSC] Tweak number of GC threads for Apple platforms"
    },
    "316499@main": {
      "author": "Fady Farag",
      "avatar": "https://www.gravatar.com/avatar/0ac5127c69f90d0c57054173ae4c3108?d=identicon\u0026s=64",
      "cl": "316499@main",
      "clUrl": "https://commits.webkit.org/316499@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318393\nrdar://181179683\n\nReviewed by Darin Adler and Chris Dumez.\n\nForwarding references should be passed to std::forward() not WTF::move().\n\n* Source/WebKit/Platform/IPC/Connection.h:\n(IPC::CompletionHandler\u003cvoid):\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionCoordinatorProxy.cpp:\n(WebKit::RemoteMediaSessionCoordinatorProxy::seekSessionToTime):\n(WebKit::RemoteMediaSessionCoordinatorProxy::playSession):\n(WebKit::RemoteMediaSessionCoordinatorProxy::pauseSession):\n(WebKit::RemoteMediaSessionCoordinatorProxy::setSessionTrack):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::getSelectionOrContentsAsString):\n* Source/WebKit/WebProcess/GPU/graphics/WebGPU/RemoteBufferProxy.h:\n* Source/WebKit/WebProcess/GPU/graphics/WebGPU/RemoteDeviceProxy.h:\n* Source/WebKit/WebProcess/GPU/graphics/WebGPU/RemoteGPUProxy.h:\n* Source/WebKit/WebProcess/GPU/graphics/WebGPU/RemoteQueueProxy.h:\n* Source/WebKit/WebProcess/GPU/graphics/WebGPU/RemoteShaderModuleProxy.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::showMediaControlsContextMenu):\n\nCanonical link: https://commits.webkit.org/316499@main",
      "email": "com.webkit.iidmsa@gmail.com",
      "hash": "efbd319f18f43ed9525759ed8a6d4c294281f538",
      "subject": "Move Forwarding Reference in `IPC/Connection.h`"
    },
    "316500@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "316500@main",
      "clUrl": "https://commits.webkit.org/316500@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313606\n\nReviewed by Anne van Kesteren and Rupin Mittal.\n\nDeployed more smart pointers to fix the bug.\n\nTest: navigation-api/navigation-api-fragment-intercept-crash.html\n\n* LayoutTests/navigation-api/navigation-api-fragment-intercept-crash-expected.txt: Added.\n* LayoutTests/navigation-api/navigation-api-fragment-intercept-crash.html: Added.\n* LayoutTests/navigation-api/resources/navigation-api-fragment-intercept-crash-inner.html: Added.\n\nOriginally-landed-as: 305413.777@safari-7624-branch (0e113df3124c). rdar://180428609\nCanonical link: https://commits.webkit.org/316500@main",
      "email": "rniwa@webkit.org",
      "hash": "7b7429195b075c5c4332d5a436cf605516912c23",
      "subject": "Use-after-free in LocalFrameView::scrollToAnchorFragment via NavigateEvent:finish"
    },
    "316501@main": {
      "author": "Anuj Panta",
      "avatar": "https://www.gravatar.com/avatar/f795b7daddea5f93c9cbb5a4a8f0db14?d=identicon\u0026s=64",
      "cl": "316501@main",
      "clUrl": "https://commits.webkit.org/316501@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316800\nrdar://179249711\n\nReviewed by BJ Burg.\n\nImplement getDOMStorageItems, setDOMStorageItem, removeDOMStorageItem,\nand clearDOMStorageItems on FrameDOMStorageAgent, replacing the stubs.\n\nUnlike the page-level InspectorDOMStorageAgent, which searches the frame\ntree by security origin (and so cannot reach cross-origin out-of-process\nframes), the frame agent resolves its storage area directly from its own\nm_inspectedFrame's document via the page's StorageNamespaceProvider.\nsecurityOrigin is therefore not needed to locate the area; a mismatch\nagainst the frame's own origin is asserted (debug only) but the command\nstill proceeds on this frame's storage.\n\n* Source/WebCore/inspector/agents/frame/FrameDOMStorageAgent.cpp:\n(WebCore::FrameDOMStorageAgent::getDOMStorageItems):\n(WebCore::FrameDOMStorageAgent::setDOMStorageItem):\n(WebCore::FrameDOMStorageAgent::removeDOMStorageItem):\n(WebCore::FrameDOMStorageAgent::clearDOMStorageItems):\n(WebCore::FrameDOMStorageAgent::findStorageArea): Resolve the StorageArea\nfrom the inspected frame's document, no origin-based frame-tree lookup.\n* Source/WebCore/inspector/agents/frame/FrameDOMStorageAgent.h:\n\nCanonical link: https://commits.webkit.org/316501@main",
      "email": "a_panta@apple.com",
      "hash": "766b2065d561c89048a43428f23826a0463bd75c",
      "subject": "Web Inspector: [SI] implement DOMStorage storage commands on FrameDOMStorageAgent"
    },
    "316503@main": {
      "author": "Wenson Hsieh",
      "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64",
      "cl": "316503@main",
      "clUrl": "https://commits.webkit.org/316503@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318582\nrdar://181349810\n\nReviewed by Abrar Rahman Protyasha.\n\nAdjust the URL shortening heuristic: for links that navigate to the same URL as the current page\n(ignoring query and fragment), we currently omit the URL from the text extraction entirely. Instead,\nadd the query only if there's only one human-readable (`isProbablyHumanReadable`) key/value pair,\nand fall back to the fragment only if it's human-readable.\n\nThis prevents us from losing information about links in some cases, where the rendered text alone\ndoesn't provide enough context.\n\n* LayoutTests/fast/text-extraction/debug-text-extraction-shorten-urls-expected.txt:\n* LayoutTests/fast/text-extraction/debug-text-extraction-shorten-urls.html:\n* Source/WebCore/page/text-extraction/TextExtraction.cpp:\n(WebCore::TextExtraction::extractItemData):\n* Source/WebCore/page/text-extraction/TextExtractionTypes.h:\n* Source/WebKit/Shared/TextExtractionToStringConversion.cpp:\n(WebKit::TextExtractionAggregator::shortenedURLStringForLink):\n(WebKit::addPartsForItem):\n(WebKit::addTextRepresentationRecursive):\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n\nCanonical link: https://commits.webkit.org/316503@main",
      "email": "wenson_hsieh@apple.com",
      "hash": "732ab0a8407576cbca271ee19d278a6088ace703",
      "subject": "[Text Extraction] Include human-readable query parameters and fragments for links that navigate within the same page"
    },
    "316504@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "316504@main",
      "clUrl": "https://commits.webkit.org/316504@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318590\nrdar://181368662\n\nReviewed by Pascoe.\n\n316448@main moved DeferredWorkTimer::create() into an inline definition in\nthe class body of DeferredWorkTimer.h (the JSC-internal DeferredWorkTimerInlines.h\nwas deleted). create() calls the out-of-line, non-exported private constructor\nDeferredWorkTimer(VM\u0026).\n\nBecause create() is now inline in a header included across the JSC/WebKit dylib\nboundary, the CMake build emits a definition of create() into the shared\nprecompiled-header object (WebKitUIProcess_pch_obj.cpp.o, produced via clang's\n-building-pch-with-obj codegen mode). That definition references the constructor,\nwhich is hidden (local) in the JavaScriptCore dylib, so linking WebKitUIProcess\nfails with:\n\nUndefined symbols for architecture arm64:\n    \"JSC::DeferredWorkTimer::DeferredWorkTimer(JSC::VM\u0026)\", referenced from:\n        JSC::DeferredWorkTimer::create(JSC::VM\u0026) in WebKitUIProcess_pch_obj.cpp.o\n\nThe Xcode build is unaffected because it does not use the shared PCH-object\ncodegen mode, so create() is only emitted where it is actually used (VM.cpp,\ninside JSC).\n\nMark the constructor JS_EXPORT_PRIVATE so the exported symbol is available to\nthe header-inlined create() outside the JavaScriptCore dylib.\n\n* Source/JavaScriptCore/runtime/DeferredWorkTimer.h:\n\nCanonical link: https://commits.webkit.org/316504@main",
      "email": "richard_robinson2@apple.com",
      "hash": "dd186f5a3502de386ee96ceba7dfd3202d5c3466",
      "subject": "[CMake] Fix the CMake build after 316448@main"
    },
    "316505@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316505@main",
      "clUrl": "https://commits.webkit.org/316505@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318541\nrdar://181312162\n\nReviewed by Devin Rousso.\n\nInspectorStyleSheet::selectorsForCSSStyleRule() called\ncssStyleRulesSplitFromSameRule() into a local `rules` vector that was\nnever read, then called it a second time in the range-for header,\nrecomputing the identical result. Each call runs ensureFlatRules() plus\na find() and two scans over m_flatRules, so the split was done twice for\nno benefit. The loop variable also shadowed the `rule` parameter.\n\nCall cssStyleRulesSplitFromSameRule() once directly in the range-for\nheader so its result is bound to the loop rather than kept alive for the\nwhole function,. No change in behavior.\n\n* Source/WebCore/inspector/InspectorStyleSheet.cpp:\n(WebCore::InspectorStyleSheet::selectorsForCSSStyleRule):\n\nCanonical link: https://commits.webkit.org/316505@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "c9187f7abc1eadd352b2107727aa043ea4134b7e",
      "subject": "[Web Inspector] selectorsForCSSStyleRule computes the split-rule list twice"
    },
    "316506@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316506@main",
      "clUrl": "https://commits.webkit.org/316506@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318573\nrdar://181341300\n\nReviewed by Abrar Rahman Protyasha and Wenson Hsieh.\n\nThe \"{\" entry in nonAlphaNumericKeys() was keyed under \"{ \" (trailing\nspace) in both the map key and the text field, unlike every neighboring\npunctuation entry. As a result, a \"{\" lookup missed the table, fell\nthrough the alphanumeric branches, and returned nullopt, so the key\ncould never be synthesized (this is the only client of the table, used\nby the TextExtraction key-press interaction).\n\nDrop the stray space so the key and inserted text are both \"{\".\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm\n\n* Source/WebCore/platform/PlatformKeyboardEvent.cpp:\n(WebCore::nonAlphaNumericKeys):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:\n(TestWebKitAPI::(TextExtractionTests, KeyPressInsertsCharactersInOrder)):\n(TestWebKitAPI::(TextExtractionTests, KeyPressInsertsBracketCharacters)):\n\nCanonical link: https://commits.webkit.org/316506@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "44975cdcef67f525328f49e337221201f6c3148b",
      "subject": "PlatformKeyboardEvent::syntheticEventFromText fails to synthesize \"{\" due to trailing space in lookup table key"
    },
    "316507@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316507@main",
      "clUrl": "https://commits.webkit.org/316507@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318284\nrdar://problem/181072571\n\nReviewed by Jean-Yves Avenard.\n\nThe buffered, played, and seekable getters of MediaController.NullMedia\nreturn a bare `EmptyRanges`, which is not in scope inside the object literal\n-- the field is the static MediaController.EmptyRanges -- so accessing them\nthrows \"ReferenceError: Can't find variable: EmptyRanges\". Latent because\nNullMedia is only returned once the media weak reference is collected.\n\n* Source/WebCore/Modules/modern-media-controls/media/media-controller.js:\n(MediaController.NullMedia.prototype.get buffered):\n(MediaController.NullMedia.prototype.get played):\n(MediaController.NullMedia.prototype.get seekable):\n* LayoutTests/media/modern-media-controls/media-controller/media-controller-null-media-ranges-expected.txt: Added.\n* LayoutTests/media/modern-media-controls/media-controller/media-controller-null-media-ranges.html: Added.\n\nCanonical link: https://commits.webkit.org/316507@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "b13f9879ad3ca87db952d919932d0f31e52b38ea",
      "subject": "NullMedia.buffered/played/seekable throw ReferenceError due to unqualified EmptyRanges reference"
    },
    "316508@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316508@main",
      "clUrl": "https://commits.webkit.org/316508@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318536\nrdar://181307120\n\nReviewed by Devin Rousso.\n\nThe Highlight/Grid/Flex Config structs declared bool members without\ndefault initializers. They are always assigned before use today, so this\nis latent, but give each a { false } default to match the existing idiom.\nNo behavior change.\n\n* Source/WebCore/inspector/InspectorOverlay.h:\n\nCanonical link: https://commits.webkit.org/316508@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "6d2dd05162ce464e5eb67856fc65964a65a907f0",
      "subject": "[Web Inspector] Uninitialized bool members in InspectorOverlay Config structs"
    },
    "316509@main": {
      "author": "Alex Christensen",
      "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64",
      "cl": "316509@main",
      "clUrl": "https://commits.webkit.org/316509@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318479\nrdar://181271876\n\nReviewed by Richard Robinson.\n\n* Source/WTF/wtf/PlatformHave.h:\n\nCanonical link: https://commits.webkit.org/316509@main",
      "email": "achristensen@apple.com",
      "hash": "2e5d042491f325b2df778dbba97c48d66bf2d395",
      "subject": "Upstream some internal PlatformHave macros"
    },
    "316510@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "316510@main",
      "clUrl": "https://commits.webkit.org/316510@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318411\n\nReviewed by Yusuke Suzuki.\n\nWhen a function body fails validation during streaming compilation,\nPlan::fail moves the plan to Completed on the worklist thread. The last\nStreamingPlan's completion callback then unconditionally moved the plan\nback to Compiled, breaking the monotonic state machine and hitting\n\"ASSERTION FAILED: state \u003e= m_state\" on assertion-enabled builds. Guard\nthe transition with hasWork(), as the non-streaming path already does.\n\n* JSTests/wasm/stress/streaming-compile-invalid-function-body.js: Added.\n* Source/JavaScriptCore/wasm/WasmIPIntPlan.cpp:\n(JSC::Wasm::IPIntPlan::didCompileFunctionInStreaming):\n\nCanonical link: https://commits.webkit.org/316510@main",
      "email": "sosuke@bun.sh",
      "hash": "95b9bdf57cef88c958a1182e8a6a687e7ae8ccfa",
      "subject": "[Wasm] Don't move a failed streaming Wasm plan back to Compiled"
    },
    "316511@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "316511@main",
      "clUrl": "https://commits.webkit.org/316511@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318292\n\nReviewed by Yusuke Suzuki.\n\nI noticed that JSC is significantly slower than V8 at unwinding when an\nexception is thrown from a deep call stack. Profiling shows that most of\nthe time is spent in per-frame callee-save bookkeeping during\nInterpreter::unwind.\n\nThis patch applies three independent optimizations:\n\n1. Make StackVisitor::Frame::calleeSaveRegistersForUnwinding() return\n   const RegisterAtOffsetList* instead of std::optional\u003cRegisterAtOffsetList\u003e.\n   Every list it returns is a long-lived object, so there is no need to\n   heap-allocate and free a copy for every unwound frame.\n\n2. Add an m_vmEntryRecord field to UnwindFunctorBase, computed once in the\n   constructor, instead of calling vmEntryRecord() on every call to\n   copyCalleeSavesToEntryFrameCalleeSavesBuffer.\n\n3. Use a prebuilt table (RegisterSet::vmCalleeSaveBufferSlotsByRegIndex())\n   that maps Reg::index() to the register's slot in the entry frame\n   callee-save buffer, instead of doing a binary search per register.\n   This turns each lookup from O(log n) into O(1).\n\n                                                   Baseline                  Patched\n\nthrow-new-error-from-deep-frames              176.5424+-0.9251     ^    129.7769+-1.6492        ^ definitely 1.3604x faster\nthrow-preallocated-error-from-deep-frames\n                                              265.7363+-2.6056     ^    175.6531+-2.0253        ^ definitely 1.5128x faster\nthrow-sentinel-from-deep-frames               266.3385+-1.5604     ^    176.2640+-1.5277        ^ definitely 1.5110x faster\n\nTests: JSTests/microbenchmarks/throw-new-error-from-deep-frames.js\n       JSTests/microbenchmarks/throw-preallocated-error-from-deep-frames.js\n       JSTests/microbenchmarks/throw-sentinel-from-deep-frames.js\n\n* JSTests/microbenchmarks/throw-new-error-from-deep-frames.js: Added.\n(thrower):\n(i.catch):\n* JSTests/microbenchmarks/throw-preallocated-error-from-deep-frames.js: Added.\n(thrower):\n(i.catch):\n* JSTests/microbenchmarks/throw-sentinel-from-deep-frames.js: Added.\n(thrower):\n(i.catch):\n* Source/JavaScriptCore/interpreter/Interpreter.h:\n(JSC::UnwindFunctorBase::UnwindFunctorBase): Deleted.\n* Source/JavaScriptCore/interpreter/InterpreterInlines.h:\n(JSC::UnwindFunctorBase::UnwindFunctorBase):\n(JSC::UnwindFunctorBase::copyCalleeSavesToEntryFrameCalleeSavesBuffer const):\n* Source/JavaScriptCore/interpreter/StackVisitor.cpp:\n(JSC::StackVisitor::Frame::calleeSaveRegistersForUnwinding):\n* Source/JavaScriptCore/interpreter/StackVisitor.h:\n* Source/JavaScriptCore/jit/RegisterSet.cpp:\n(JSC::RegisterSet::vmCalleeSaveBufferSlotsByRegIndex):\n* Source/JavaScriptCore/jit/RegisterSet.h:\n\nCanonical link: https://commits.webkit.org/316511@main",
      "email": "sosuke@bun.sh",
      "hash": "8e15aeeee3bc2d5257fec145a08f5532ae7447d7",
      "subject": "[JSC] Improve exception unwinding performance"
    },
    "316512@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316512@main",
      "clUrl": "https://commits.webkit.org/316512@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318594\nrdar://181378579\n\nReviewed by Alan Baradlay.\n\nSeveral source files include the same header twice: once unconditionally\nand again inside a platform/feature #if block that is already covered by\nthe unconditional include. Remove the redundant copies, and drop the\nnow-empty #if/#endif guards where the duplicate was the only entry.\n\nNo change in behavior.\n\n* Source/WebCore/Modules/webaudio/AudioScheduledSourceNode.cpp:\n* Source/WebCore/dom/Document.cpp:\n* Source/WebCore/editing/InsertIntoTextNodeCommand.cpp:\n* Source/WebCore/html/HTMLCanvasElement.cpp:\n* Source/WebCore/html/HTMLMediaElement.cpp:\n* Source/WebCore/page/LocalFrameView.cpp:\n* Source/WebCore/page/Page.cpp:\n* Source/WebCore/platform/network/NetworkStorageSession.h:\n* Source/WebCore/rendering/RenderImage.cpp:\n\nCanonical link: https://commits.webkit.org/316512@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "f10517f502fc202bebdd637ceab9a3cf92315201",
      "subject": "Remove duplicate #include directives in Source/WebCore"
    },
    "316513@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "316513@main",
      "clUrl": "https://commits.webkit.org/316513@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=318543\u003e\n\u003crdar://181315666\u003e\n\nReviewed by Yusuke Suzuki.\n\nThe clang static analyzer's `core.FixedAddressDereference` checker\nreports a dereference of a fixed address wherever an assertion-failure\npath reaches `BCRASH()` because the macro's deliberate\n`*(int*)0xbbadbeef = 0;` fail-fast store writes through a literal\naddress.\n\nMark the store as an intentional false positive with a leading\n`[[clang::suppress]]` attribute inside `BCRASH()` itself.\n\nNo new tests since this change is not directly testable.\n\n* Source/bmalloc/bmalloc/BAssert.h:\n* Source/bmalloc/bmalloc/BCompiler.h:\n\nCanonical link: https://commits.webkit.org/316513@main",
      "email": "ddkilzer@apple.com",
      "hash": "4ae295c2bf8b7d67a86067e5b24be9faa3346548",
      "subject": "Suppress core.FixedAddressDereference static analyzer warnings in bmalloc's BCRASH() macro"
    },
    "316514@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "316514@main",
      "clUrl": "https://commits.webkit.org/316514@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=318544\u003e\n\u003crdar://181316388\u003e\n\nUnreviewed build fix.\n\nFollow-on to 315261@main, which fixed this failure for the\n`TestWebKitAPI` target by adding the \"Embed Testing.framework\" phase.\n\n`TestWebKitAPIBundle` fails intermittently in the same way, so it\nneeds to depend on the same workaround:\n\nerror: Unable to resolve module dependency: '_Testing_CoreTransferable' (in target 'TestWebKitAPIBundle' from project 'TestWebKitAPI')\n  note: A dependency of main module '_TestWebKitAPIBundle-CrossImportOverlays'\n\nMove the phase to a new \"Testing.framework Overlays\" aggregate target\nthat both `TestWebKitAPI` and `TestWebKitAPIBundle` depend on, so the\noverlays are always dittoed before either target's Swift scan.\n\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/316514@main",
      "email": "ddkilzer@apple.com",
      "hash": "a4734252959df8cd532e70b8f6afbe7009ab2035",
      "subject": "TestWebKitAPIBundle visionOS build intermittently fails to resolve _Testing_CoreTransferable cross-import overlay"
    },
    "316515@main": {
      "author": "Devin Rousso",
      "avatar": "https://www.gravatar.com/avatar/c9e757d973342c773f107a94b70cb9cd?d=identicon\u0026s=64",
      "cl": "316515@main",
      "clUrl": "https://commits.webkit.org/316515@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=121208\n\u003crdar://problem/14972198\u003e\n\nReviewed by Keith Miller.\n\n* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:\n(JSC::BytecodeGenerator::BytecodeGenerator):\nForce `arguments` to be created even if it's not used when the debugger is enabled.\n\n* LayoutTests/inspector/debugger/breakpoint-scope-expected.txt:\n* LayoutTests/inspector/debugger/paused-scopes-expected.txt:\n* LayoutTests/inspector/debugger/tail-deleted-frames/tail-deleted-frames-scopes-expected.txt:\n* LayoutTests/inspector/debugger/tail-deleted-frames/tail-deleted-frames-vm-entry-expected.txt:\n* LayoutTests/inspector/model/scope-chain-node-expected.txt:\n\nCanonical link: https://commits.webkit.org/316515@main",
      "email": "hi@devinrousso.com",
      "hash": "080d15ac450c9264e900ac141810ce8e71f39cca",
      "subject": "Web Inspector: 'arguments' should be accessible from the console"
    },
    "316516@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "316516@main",
      "clUrl": "https://commits.webkit.org/316516@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318591\nrdar://181374997\n\nReviewed by Pascoe.\n\nThis allows Swift code to actually consume WebKit, for example:\n\n```\necho 'import WebKit' | xcrun swiftc -typecheck -target arm64-apple-macosx27.0 -F WebKitBuild/cmake-mac/Debug -\n```\n\nby actually producing the WebKit Swift module and its Swift interface and copying\nit to the right location, mirroring what Xcode does.\n\nThis also produces the WebKit's public and private Clang module, and its SwiftUI\ncross-import overlay file, like Xcode.\n\nAlso, add support for WebKit's custom Swift availability attributes.\n\nAll of this is a prerequisite for adding support for building `_WebKit_SwiftUI`\nand consequently TestWebKitAPI's Swift support, and SwiftBrowser.\n\nCurrently, most of WebKit's Swift files still aren't compiled. This won't be possible\nuntil the CMake build moves to having actual proper framework directories so that\nit's possible for Swift files to import WebKit's public and private clang modules.\n\n* Source/WebKit/PlatformCocoa.cmake:\n\n* Source/WebKit/PlatformMac.cmake:\n\n- Build WebKit's Swift with library evolution and emit module interfaces\n- Give the generated -define-availability flags to swiftc\n- Add the WebKit_StageModules target that reproduces Xcode's Modules/ layout after WebKit is linked\n- Creates the top-level WebKit.framework/Modules symlink.\n\n* Source/cmake/OptionsMac.cmake:\n\n- Add WEBKIT_SWIFT_MODULE_TRIPLE beside CMAKE_Swift_COMPILER_TARGET\n\nCanonical link: https://commits.webkit.org/316516@main",
      "email": "richard_robinson2@apple.com",
      "hash": "26455eaa4d9bc90285fc2d78d95f45f65f78d8c2",
      "subject": "[CMake] Produce the Swift module and interface for WebKit.framework"
    },
    "316517@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "316517@main",
      "clUrl": "https://commits.webkit.org/316517@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318585\nrdar://181352028\n\nReviewed by Abrar Rahman Protyasha.\n\nPreviously, such tests could only be ran manually since TestWebKitAPIBundle used a real\nNSApplication, but TestWebKitAPI didn't. Fix by imbuing the latter with an NSApplication\nand an AppKit event loop to allow these tests to run in EWS.\n\n* Tools/TestWebKitAPI/Helpers/cocoa/AppKit+Extras.swift:\n(NSApplication.waitForActivation):\n* Tools/TestWebKitAPI/Runner/TestWebKitAPI.swift:\n(TestWebKitAPI.run):\n(TestWebKitAPI.main):\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift:\n(AppKitGesturesTests.singleClickFiresPointerMouseAndClickEvents(_:)):\n(AppKitGesturesTests.updatingTextRangeSelectionByUserInteractionUpdatesEditorState(_:)):\n(AppKitGesturesTests.draggingSelectionToWindowEdgeAutoscrolls(_:)):\n(AppKitGesturesTests.holdingSelectionDragNearEdgeKeepsScrolling):\n(AppKitGesturesTests.holdingSelectionDragMidContentDoesNotAutoscroll):\n(AppKitGesturesTests.selectionAutoscrollStopsAfterGestureEnds):\n(AppKitGesturesTests.draggingSelectionToTopEdgeScrollsUp):\n(AppKitGesturesTests.selectionOriginatingNearEdgeWithShortDragDoesNotAutoscroll):\n(AppKitGesturesTests.selectionOriginatingNearEdgeAutoscrollsAfterDraggingPastThreshold):\n(AppKitGesturesTests.clickingOnSelectedWordOpensContextMenu(_:)):\n(AppKitGesturesTests.clickingAndHoldingOnEmptyContentOpensContextMenu(_:)):\n(AppKitGesturesTests.longPressOverTextSelectsWordAndDoesNotOpenContextMenu):\n(AppKitGesturesTests.scrollingDoesNotRemoveTextSelection):\n(AppKitGesturesTests.doubleClickingInWordSelectsWord(_:clickHandler:)):\n(AppKitGesturesTests.tripleClickingInPDFSelectsLine):\n(AppKitGesturesTests.clickingInWordChangesSelection(_:)):\n(AppKitGesturesTests.scrollingChangesScrollPosition(_:)):\n(AppKitGesturesTests.interruptingDeceleratingScrollDoesNotFollowLink):\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/EmbeddedAppKitGesturesTests.swift:\n(AppKitGesturesTests.scrollOverNonScrollableWebViewPropagatesToEnclosingScrollView):\n(AppKitGesturesTests.pressDragOverTextInWebViewInsideEnclosingScrollViewCreatesSelection):\n(AppKitGesturesTests.quickDragOverTextInWebViewInsideEnclosingScrollViewScrolls):\n(AppKitGesturesTests.doubleClickingSelectsWordWhenScrolledToTopWithObscuredContentInset):\n\nCanonical link: https://commits.webkit.org/316517@main",
      "email": "richard_robinson2@apple.com",
      "hash": "c973837a1ce5afd395dda139c3c8e4fb5fcdca20",
      "subject": "[Swift Testing] Allow tests that require NSApplications to be run in automation"
    }
  },
  "date": "2026-07-04",
  "days": 1,
  "generatedAt": "2026-07-04T22:05:35Z",
  "markdown": "## Highlights\n- **Security** Fixed a use-after-free in anchor scrolling triggered through `NavigateEvent:finish`, closing a real memory safety hole in frame navigation. [commit 316500@main](https://commits.webkit.org/316500@main) [bug 313606](https://bugs.webkit.org/show_bug.cgi?id=313606)\n- **V8** JavaScriptCore speeds up exception unwinding, trimming overhead on throw-heavy paths and improving worst-case runtime behavior. [commit 316511@main](https://commits.webkit.org/316511@main) [bug 318292](https://bugs.webkit.org/show_bug.cgi?id=318292)\n- **Perf** JavaScriptCore retuned GC thread counts on Apple platforms, a low-level runtime change with potential impact across real workloads. [commit 316327@main](https://commits.webkit.org/316327@main) [bug 318534](https://bugs.webkit.org/show_bug.cgi?id=318534)\n- **DevTools** Web Inspector console now exposes `arguments`, fixing a long-standing debugging gap for function-scope inspection. [commit 316515@main](https://commits.webkit.org/316515@main) [bug 121208](https://bugs.webkit.org/show_bug.cgi?id=121208)\n- **DevTools** Web Inspector added DOM Storage commands on `FrameDOMStorageAgent`, expanding Storage Inspector protocol coverage. [commit 316501@main](https://commits.webkit.org/316501@main) [bug 316800](https://bugs.webkit.org/show_bug.cgi?id=316800)\n- **Web Platform** `NullMedia.buffered`, `played`, and `seekable` no longer blow up with a `ReferenceError`, restoring expected media range behavior. [commit 316507@main](https://commits.webkit.org/316507@main) [bug 318284](https://bugs.webkit.org/show_bug.cgi?id=318284)\n- **Build** CMake now produces the Swift module and interface for `WebKit.framework`, a meaningful step for Swift-facing framework consumers. [commit 316516@main](https://commits.webkit.org/316516@main) [bug 318591](https://bugs.webkit.org/show_bug.cgi?id=318591)\n- **A11y** Text Extraction now keeps human-readable same-page query strings and fragments in links, improving output fidelity for downstream consumers. [commit 316503@main](https://commits.webkit.org/316503@main) [bug 318582](https://bugs.webkit.org/show_bug.cgi?id=318582)\n\n## What landed by area\n\n### JavaScriptCore and Wasm\n- **V8** JavaScriptCore improved exception unwinding performance, reducing cost in exceptional control flow. [commit 316511@main](https://commits.webkit.org/316511@main) [bug 318292](https://bugs.webkit.org/show_bug.cgi?id=318292)\n- **Perf** JavaScriptCore adjusted GC thread counts on Apple platforms, tuning collector parallelism for platform reality. [commit 316327@main](https://commits.webkit.org/316327@main) [bug 318534](https://bugs.webkit.org/show_bug.cgi?id=318534)\n- **Web Platform** Wasm no longer transitions a failed streaming compilation plan back to `Compiled`, tightening state handling after streaming failures. [commit 316510@main](https://commits.webkit.org/316510@main) [bug 318411](https://bugs.webkit.org/show_bug.cgi?id=318411)\n\n### Web Inspector\n- **DevTools** Web Inspector console now makes `arguments` accessible, bringing console evaluation closer to developer expectations. [commit 316515@main](https://commits.webkit.org/316515@main) [bug 121208](https://bugs.webkit.org/show_bug.cgi?id=121208)\n- **DevTools** Storage Inspector gained DOM Storage commands on `FrameDOMStorageAgent`, filling in backend support for storage operations. [commit 316501@main](https://commits.webkit.org/316501@main) [bug 316800](https://bugs.webkit.org/show_bug.cgi?id=316800)\n- **Refactor** Inspector overlay config structs now initialize bool members, eliminating undefined state in Web Inspector internals. [commit 316508@main](https://commits.webkit.org/316508@main) [bug 318536](https://bugs.webkit.org/show_bug.cgi?id=318536)\n- **Perf** `selectorsForCSSStyleRule` stopped computing the split-rule list twice, shaving duplicate work in Inspector CSS processing. [commit 316505@main](https://commits.webkit.org/316505@main) [bug 318541](https://bugs.webkit.org/show_bug.cgi?id=318541)\n\n### Media, input, and text extraction\n- **Web Platform** `NullMedia.buffered`, `played`, and `seekable` now resolve correctly instead of throwing due to an unqualified `EmptyRanges` reference. [commit 316507@main](https://commits.webkit.org/316507@main) [bug 318284](https://bugs.webkit.org/show_bug.cgi?id=318284)\n- **UI** Synthetic keyboard text events can now generate `{` correctly after fixing a bad lookup-table key with a trailing space. [commit 316506@main](https://commits.webkit.org/316506@main) [bug 318573](https://bugs.webkit.org/show_bug.cgi?id=318573)\n- **A11y** Text Extraction now includes human-readable query parameters and fragments for same-page navigations, preserving more useful link text context. [commit 316503@main](https://commits.webkit.org/316503@main) [bug 318582](https://bugs.webkit.org/show_bug.cgi?id=318582)\n\n### Security and core runtime\n- **Security** Fixed a use-after-free in `LocalFrameView::scrollToAnchorFragment` reachable via `NavigateEvent:finish`, hardening document navigation. [commit 316500@main](https://commits.webkit.org/316500@main) [bug 313606](https://bugs.webkit.org/show_bug.cgi?id=313606)\n- **Build** bmalloc now suppresses `core.FixedAddressDereference` static analyzer warnings in `BCRASH()`, reducing noise around intentional crash machinery. [commit 316513@main](https://commits.webkit.org/316513@main) [bug 318543](https://bugs.webkit.org/show_bug.cgi?id=318543)\n- **Refactor** `IPC/Connection.h` moved a forwarding reference, a small cleanup in IPC header structure. [commit 316499@main](https://commits.webkit.org/316499@main) [bug 318393](https://bugs.webkit.org/show_bug.cgi?id=318393)\n\n### Build and platform plumbing\n- **Build** CMake now emits the Swift module and interface for `WebKit.framework`, improving generated Swift surface for framework consumers. [commit 316516@main](https://commits.webkit.org/316516@main) [bug 318591](https://bugs.webkit.org/show_bug.cgi?id=318591)\n- **Build** Follow-up CMake fix repaired the build after an earlier landing, keeping that Swift module work green. [commit 316504@main](https://commits.webkit.org/316504@main) [bug 318590](https://bugs.webkit.org/show_bug.cgi?id=318590)\n- **Build** Internal `PlatformHave` macros were upstreamed, reducing local divergence in platform capability checks. [commit 316509@main](https://commits.webkit.org/316509@main) [bug 318479](https://bugs.webkit.org/show_bug.cgi?id=318479)\n- **Refactor** Duplicate `#include` directives were removed in `Source/WebCore`, a straightforward cleanup with small compile hygiene benefits. [commit 316512@main](https://commits.webkit.org/316512@main) [bug 318594](https://bugs.webkit.org/show_bug.cgi?id=318594)\n\n### Testing and infrastructure\n- **Build** Swift Testing now allows tests that require `NSApplication` to run in automation, unlocking better coverage for app-bound test cases. [commit 316517@main](https://commits.webkit.org/316517@main) [bug 318585](https://bugs.webkit.org/show_bug.cgi?id=318585)\n- **Mobile** A visionOS intermittent in `TestWebKitAPIBundle` was fixed by addressing `_Testing_CoreTransferable` cross-import overlay resolution. [commit 316514@main](https://commits.webkit.org/316514@main) [bug 318544](https://bugs.webkit.org/show_bug.cgi?id=318544)",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [],
  "since": "2026-07-04",
  "totals": {
    "commits": 19,
    "features": 19,
    "rolls": 0
  },
  "until": "2026-07-04"
}