{
  "commits": {
    "316974@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "316974@main",
      "clUrl": "https://commits.webkit.org/316974@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318517\n\nReviewed by Antti Koivisto.\n\nUnlike the main size, position, and margin, a flex item's used cross size was\nnever kept by the algorithm: it lived on the renderer (the child's laid-out\nborder box, overwritten by the stretch relayout) and every consumer read it back\nvia crossAxisExtentForFlexItem. FlexLayout::layout keeps the used cross size in\nits own list. Start moving legacy the same way.\n\ncomputeCrossSizeForFlexItems still runs the stretch logic exactly as before, and\nafter each item is sized it captures the used cross size into a new crossSizeList\n(carried per line as a LineState::crossSizes slice, matching the mainSizes,\nmargins, and positions spans). The stretch relayout stays -- it is the\nrender-native boundary -- but its result now flows into the algorithm's list, and\nflipForRightToLeftColumn reads that list instead of the renderer.\n\nBehavior is unchanged: the value is captured after the stretch relayout, and\nnothing relays an item out between there and the flip (the intervening cross-axis\nalignment only moves positions and sets margins, neither of which changes the\nborder box), so the list holds exactly what flipForRightToLeftColumn read from\ncrossAxisExtentForFlexItem before. The remaining post-stretch readers go through\navailableAlignmentSpaceForFlexItem and marginBoxAscentForFlexItem, which are also\ncalled pre-stretch (line-cross sizing) and off the out-of-flow static-position\npath, so they are re-sourced per-caller in follow-ups.\n\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::LineState::LineState):\n(WebCore::RenderFlexibleBox::performFlexLayout):\n(WebCore::RenderFlexibleBox::computeCrossSizeForFlexItems):\n(WebCore::RenderFlexibleBox::flipForRightToLeftColumn):\n\nCanonical link: https://commits.webkit.org/316974@main",
      "email": "zalan@apple.com",
      "hash": "c7ab2f7dfdd5fa26f0241ff89d895c449d8918e7",
      "subject": "[cleanup] Capture each flex item's used cross size in a list from computeCrossSizeForFlexItems"
    },
    "316975@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316975@main",
      "clUrl": "https://commits.webkit.org/316975@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319156\nrdar://181977722\n\nReviewed by Jer Noble.\n\ndetermineTextDirection() declared a local `current` from paragraph[i]\nand returned early when it was falsy, then immediately re-declared an\nidentical `current = paragraph[i]` inside an `if`, shadowing the outer\nvariable. Because the earlier check already returns on a falsy value,\nthat inner condition was always true and the extra declaration was dead\ncode that only triggered a shadowing warning.\n\nUse the outer `current` directly. No change in behavior.\n\n* Source/WebCore/html/track/VTTCue.cpp:\n(WebCore::VTTCue::determineTextDirection):\n\nCanonical link: https://commits.webkit.org/316975@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "9094412c37e80ec0fb3762a6919a2e28086c9d1a",
      "subject": "Remove redundant shadowing variable in VTTCue::determineTextDirection"
    },
    "316976@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316976@main",
      "clUrl": "https://commits.webkit.org/316976@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318931\nrdar://181763736\n\nReviewed by Abrar Rahman Protyasha.\n\nPer spec [1], a text directive is only processed when the document's MIME type is a\n\"text directive allowing MIME type\" (essence \"text/html\" or \"text/plain\").\n\nWebKit ran text directives regardless of content type, so `#:~:text=` scrolled\nin application/json (and XML/CSS/JS) documents, diverging from other browsers.\nGate scrollToTextFragment() on the document's MIME type being text/html or\ntext/plain. The check must use the MIME string, not the document class, since\ntext/plain and JSON are both TextDocument.\n\n[1] https://wicg.github.io/scroll-to-text-fragment/#text-directive-allowing-mime-type\n\n* LayoutTests/imported/w3c/web-platform-tests/scroll-to-text-fragment/non-html-documents-json-expected.txt: Progression.\n* LayoutTests/imported/w3c/web-platform-tests/scroll-to-text-fragment/text-directive-mime-type-parameter.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/scroll-to-text-fragment/text-directive-mime-type-parameter-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/scroll-to-text-fragment/resources/text-html-with-charset.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/scroll-to-text-fragment/resources/text-html-with-charset.html.headers: Added.\n* Source/WebCore/page/LocalFrameView.cpp:\n(WebCore::LocalFrameView::scrollToTextFragment):\n\nCanonical link: https://commits.webkit.org/316976@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "f3abbc493107b5e67649d1dd1fc310e1c422c144",
      "subject": "Scroll To Text Fragment: text directives should only run in text/html and text/plain documents"
    },
    "316977@main": {
      "author": "Yijia Huang",
      "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64",
      "cl": "316977@main",
      "clUrl": "https://commits.webkit.org/316977@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319172\nrdar://182008627\n\nReviewed by Yusuke Suzuki.\n\nMove JS_EXPORT_PRIVATE before the return type in 83 sites across 11\ntemporal headers. Aligns with the JSC-wide convention (ArgList.h,\nArrayBuffer.h etc.). NODELETE stays after the return type.\n\nAdd WTF_MAKE_TZONE_ALLOCATED_IMPL for six ISO8601 value types\n(Duration, ExactTime, PlainTime, PlainDate, PlainYearMonth,\nPlainMonthDay). Each declared WTF_MAKE_TZONE_ALLOCATED in the header\nwith no matching IMPL in ISO8601.cpp.\n\nCanonical link: https://commits.webkit.org/316977@main",
      "email": "yijia_huang@apple.com",
      "hash": "dd433a43f84852e2050e9d9616e8a18376cd6eac",
      "subject": "[JSC][Temporal] Fix declaration style: JS_EXPORT_PRIVATE order + missing TZone IMPLs"
    },
    "316978@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316978@main",
      "clUrl": "https://commits.webkit.org/316978@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319159\nrdar://181978691\n\nReviewed by Jer Noble.\n\nBoth TextTrackList::getTrackById overloads looped `for (i = 0; i \u003c length();\n++i) item(i)`, which recomputed length() and re-did the three-way index\narithmetic (plus a downcast) in item() on every iteration. Since these\nlookups run inside SourceBuffer's per-segment-track loops, that cost\ncompounds during initialization segment processing.\n\nIterate the three member track vectors (m_elementTracks, m_addTrackTracks,\nm_inbandTracks) directly, in the same element -\u003e addTrack -\u003e inband order\nitem() uses, so the \"first matching TextTrack\" semantics are preserved.\nThis matches the existing AudioTrackList and VideoTrackList implementations.\n\nNo change in behavior, so no new tests.\n\n* Source/WebCore/html/track/TextTrackList.cpp:\n(WebCore::TextTrackList::getTrackById const):\n\nCanonical link: https://commits.webkit.org/316978@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "086bea30b60140e0fda95eef01c32fce1ce46779",
      "subject": "TextTrackList::getTrackById iterates via length()/item() instead of walking track vectors directly"
    },
    "316979@main": {
      "author": "Elliott Williams",
      "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64",
      "cl": "316979@main",
      "clUrl": "https://commits.webkit.org/316979@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319145\nrdar://181962477\n\nUnreviewed build fix.\n\nFix some issues revealed when building with the internal SDK + jumbo\nunified sources.\n\n* Source/ThirdParty/libwebrtc/Source/third_party/boringssl/src/util/fipstools/acvp/modulewrapper/proto.cc:\n* Source/WTF/wtf/SequesteredImmortalHeap.h:\n* Source/bmalloc/bmalloc/VMAllocate.h:\n\nCanonical link: https://commits.webkit.org/316979@main",
      "email": "emw@apple.com",
      "hash": "02d33c5a0208e02761c4b350205d01de84416dff",
      "subject": "[CMake][Mac] Fix miscellaneous unified build issues"
    },
    "316980@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "316980@main",
      "clUrl": "https://commits.webkit.org/316980@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318518\n\nReviewed by Antti Koivisto.\n\nFollowing 318517, which captured each flex item's used cross size into\ncomputeCrossSizeForFlexItems's list, route the remaining post-stretch cross-axis\nalignment reads through that list. availableAlignmentSpaceForFlexItem and\nmarginBoxAscentForFlexItem now take the used cross size as an argument rather than\nreading crossAxisExtentForFlexItem (the renderer's border box) themselves.\n\nTheir post-stretch callers (handleCrossAxisAlignmentForFlexItems and\nperformBaselineAlignment) pass crossSizes[itemIndex] -- the value captured in #11,\nwhich nothing relays out before these phases, so it is exactly what they read from\nthe renderer before. The two callers that run outside that window pass\ncrossAxisExtentForFlexItem directly, unchanged: crossSizeForFlexLines (#8, before\nthe stretch pass, and only for baseline items, which are never stretched) and the\nout-of-flow static-position path, whose item is not in the list. So the used\ncross size now flows through the algorithm's list for the whole post-stretch\nalignment path; the only renderer cross-size reads left are #8 and the external\nbaseline queries (firstLineBaseline / baselinePosition).\n\nNo change in behavior.\n\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::availableAlignmentSpaceForFlexItem):\n(WebCore::RenderFlexibleBox::marginBoxAscentForFlexItem):\n(WebCore::RenderFlexibleBox::staticCrossAxisPositionForPositionedFlexItem):\n(WebCore::RenderFlexibleBox::crossSizeForFlexLines):\n(WebCore::RenderFlexibleBox::handleCrossAxisAlignmentForFlexItems):\n(WebCore::RenderFlexibleBox::performBaselineAlignment):\n\nCanonical link: https://commits.webkit.org/316980@main",
      "email": "zalan@apple.com",
      "hash": "1d2267e7180f30f7c05580e5914de46e4fe33dcb",
      "subject": "[cleanup] Pass the used cross size into availableAlignmentSpaceForFlexItem and marginBoxAscentForFlexItem instead of reading the renderer"
    },
    "316981@main": {
      "author": "Elliott Williams",
      "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64",
      "cl": "316981@main",
      "clUrl": "https://commits.webkit.org/316981@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319016\nrdar://181862243\n\nReviewed by Zak Ridouh and Richard Robinson.\n\nReplace the SOFTLINK_AVKIT_FRAMEWORK() macro and single-TU soft link\ncode with a \u003cpal/cocoa/AVKitSoftLink.h\u003e header and associated sources.\n\nRevealed by the CMake build's jumbo unified sources, which compiles many\nsources in a single TU. Needed for CMake internal SDK support.\n\n* Source/WebCore/Configurations/AllowedSPI-legacy.toml: I think that\n  some of the calls to dlsym() were getting stripped out of iOS\n  binaries, but now that they are exported from PAL, they are always\n  present. Update the allowlist as this SPI usage is longstanding.\n* Source/WebCore/Configurations/AllowedSPI.toml: Ditto, with staged API.\n\n* Source/WebCore/PAL/PAL.xcodeproj/project.pbxproj:\n* Source/WebCore/PAL/pal/PlatformCocoa.cmake:\n* Source/WebCore/PAL/pal/SourcesCocoa.txt:\n* Source/WebCore/PAL/pal/cf/CoreMediaSoftLink.h:\n* Source/WebCore/PAL/pal/cocoa/AVKitSoftLink.h: Added.\n* Source/WebCore/PAL/pal/cocoa/AVKitSoftLink.mm: Added.\n* Source/WebCore/platform/cocoa/WebAVPlayerLayer.mm:\n* Source/WebCore/platform/cocoa/WebAVPlayerLayerView.mm:\n(WebCore::WebAVPlayerLayerView_playerLayer):\n(WebCore::WebAVPlayerLayerView_dealloc):\n(WebCore::allocWebAVPlayerLayerViewInstance):\n* Source/WebCore/platform/graphics/avfoundation/objc/AVOutputDeviceMenuControllerTargetPicker.mm:\n(WebCore::AVOutputDeviceMenuControllerTargetPicker::devicePicker):\n* Source/WebCore/platform/graphics/avfoundation/objc/AVRoutePickerViewTargetPicker.mm:\n(WebCore::AVRoutePickerViewTargetPicker::isAvailable):\n(WebCore::AVRoutePickerViewTargetPicker::devicePicker):\n* Source/WebCore/platform/ios/PlaybackSessionInterfaceAVKitLegacy.mm:\n(WebCore::PlaybackSessionInterfaceAVKitLegacy::currentTimeChanged):\n* Source/WebCore/platform/ios/VideoPresentationInterfaceAVKitLegacy.mm:\n(WebAVPictureInPictureContentViewController_initWithController):\n(WebAVPictureInPictureContentViewController_viewWillLayoutSubviews):\n(WebAVPictureInPictureContentViewController_dealloc):\n(allocWebAVPictureInPictureContentViewControllerInstance):\n(-[WebAVPlayerViewController initWithFullscreenInterface:]):\n(WebCore::supportsPictureInPicture):\n* Source/WebCore/platform/ios/WebAVPlayerController.mm:\n(createWebAVPlayerControllerForwarderClassSingleton):\n(-[WebAVPlayerController init]):\n(-[WebAVPlayerController hasSeekableLiveStreamingContent]):\n(-[WebAVPlayerController timeRangeSeekable]):\n(-[WebAVPlayerController timeRangeForNavigation]):\n* Source/WebCore/platform/mac/PlaybackSessionInterfaceMac.mm:\n(WebCore::PlaybackSessionInterfaceMac::setPlayBackControlsManager):\n(WebCore::PlaybackSessionInterfaceMac::updatePlaybackControlsManagerTiming):\n* Source/WebCore/platform/mac/WebPlaybackControlsManager.mm:\n(mediaSelectionOptions):\n* Source/WebKit/Platform/ios/PlaybackSessionInterfaceAVKit.mm:\n(WebKit::mediaSelectionOptionSource):\n* Source/WebKit/Platform/ios/VideoPresentationInterfaceAVKit.mm:\n(WebKit::VideoPresentationInterfaceAVKit::setupPlayerViewController):\n* Source/WebKit/Platform/ios/WKAVContentSource.mm:\n* Source/WebKit/UIProcess/ios/_WKCaptionStyleMenuControllerAVKit.mm:\n(-[_WKCaptionStyleMenuControllerAVKit init]):\n* Source/WebKit/UIProcess/ios/_WKCaptionStyleMenuControllerIOS.mm:\n(+[WKCaptionStyleMenuController menuController]):\n* Source/WebKit/UIProcess/ios/fullscreen/WKFullscreenStackView.mm:\n(-[WKFullscreenStackView init]):\n(SOFT_LINK_CLASS_OPTIONAL): Deleted.\n* Source/WebKit/UIProcess/mac/_WKCaptionStyleMenuControllerAVKitMac.mm:\n(-[_WKCaptionStyleMenuControllerAVKitMac init]):\n* Source/WebKit/UIProcess/mac/_WKCaptionStyleMenuControllerMac.mm:\n(+[WKCaptionStyleMenuController menuController]):\n* Source/WebKitLegacy/mac/WebView/WebVideoFullscreenController.mm:\n(allocWebAVPlayerViewInstance): Replace the non-optional soft-link +\n  assertion with the (shared) optional soft-link + release assertion. I\n  think the behavior is moot since AVPlayerView exists on all supported\n  macOS releases.\n\nCanonical link: https://commits.webkit.org/316981@main",
      "email": "emw@apple.com",
      "hash": "39f4250d8cda9a29aab47a8c7782783e107dfaac",
      "subject": "Consolidate AVKit soft-linking into a single source file"
    },
    "316982@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "316982@main",
      "clUrl": "https://commits.webkit.org/316982@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=319176\u003e\n\u003crdar://182017171\u003e\n\nUnreviewed build fix.\n\nThe iOS 27.0 SDK marks `-[UIApplication canOpenURL:]` as deprecated,\nand WebKit's Debug configuration promotes `-Wdeprecated-declarations`\nto an error, so the sole call site fails to compile.\n\nSuppress the deprecation at the call site to keep the existing\nbehavior.\n\nNo new tests since no change in behavior.\n\n* Source/WebKit/UIProcess/ios/_WKCaptionStyleMenuControllerIOS.mm:\n(-[WKCaptionStyleMenuController systemCaptionStyleSettingsActionSelected:]):\n\nCanonical link: https://commits.webkit.org/316982@main",
      "email": "ddkilzer@apple.com",
      "hash": "1a7ffe31e2b4cbf5f52864279aacdbb67e50904d",
      "subject": "REGRESSION (Rave): WebKit fails to build for iOS with the iOS 27.0 SDK: -[UIApplication canOpenURL:] is deprecated"
    },
    "316983@main": {
      "author": "Darin Adler",
      "avatar": "https://www.gravatar.com/avatar/a8fbf829f88c5c1ea4053171594ccf2c?d=identicon\u0026s=64",
      "cl": "316983@main",
      "clUrl": "https://commits.webkit.org/316983@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318765\nrdar://181399508\n\nReviewed by Wenson Hsieh.\n\nAdded an isBitmapImage check so we won't have a Save to Photos menu item unless the\nresource data is image data. This matches what UIImageWriteToSavedPhotosAlbum can do.\n\n* Source/WebKit/Shared/Cocoa/InteractionInformationAtPosition.h: Added hasSaveableImage.\n* Source/WebKit/Shared/Cocoa/InteractionInformationAtPosition.mm: Ditto.\n(WebKit::InteractionInformationAtPosition::InteractionInformationAtPosition):\n* Source/WebKit/Shared/Cocoa/InteractionInformationAtPosition.serialization.in: Ditto.\n\n* Source/WebKit/UIProcess/API/Cocoa/_WKActivatedElementInfo.mm: Renamed _animatedImage\nto _isAnimatedImage for consistency. Moved _isImage and _isUsingAlternateURLForImage\ninside PLATFORM(IOS_FAMILY) since they are always NO otherwise. Added _hasSaveableImage.\n(-[_WKActivatedElementInfo setFromInformation:]): Added method so the two _init method\nfamilies can share code, while preserving behavior for all existing fields. Added the\ncode to set _hasSaveableImage here.\n(-[_WKActivatedElementInfo _initWithInteractionInformationAtPosition:isUsingAlternateURLForImage:userInfo:]):\nUse setForInformation.\n(-[_WKActivatedElementInfo _initWithType:URL:imageURL:image:userInfo:information:]):\nMerged the unused longer method into this one, use setForInformation.\n(-[_WKActivatedElementInfo isAnimatedImage]): Updated for the above changes.\n(-[_WKActivatedElementInfo _hasSaveableImage]): Added.\n(-[_WKActivatedElementInfo userInfo]):\n(-[_WKActivatedElementInfo _initWithType:URL:imageURL:location:title:ID:rect:image:imageMIMEType:isAnimatedImage:isAnimating:animationsUnderElement:userInfo:]): Deleted.\n\n* Source/WebKit/UIProcess/API/Cocoa/_WKActivatedElementInfoInternal.h: Put header\ninside PLATFORM(IOS_FAMILY) since it is not used on Mac. Added _hasSaveableImage.\n\n* Source/WebKit/UIProcess/ios/WKActionSheetAssistant.mm:\n(-[WKActionSheetAssistant defaultActionsForLinkSheet:]): Check _hasSaveableImage.\nAlso removed null check of imageURL since _canShowSaveImageActionForImageURL: now\nchecks for that.\n(-[WKActionSheetAssistant _canShowSaveImageActionForImageURL:]): Added a check for\na null imageURL so the caller doesn't have to do it.\n(-[WKActionSheetAssistant defaultActionsForImageSheet:]): Check _hasSaveableImage.\n\n* Source/WebKit/WebProcess/WebPage/Cocoa/PositionInformationForWebPage.mm:\n(WebKit::imagePositionInformation): Set hasSaveableImage, only true for bitmap images\nthat are not the null image.\n\n* Tools/TestWebKitAPI/Resources/cocoa/svg-image-in-link.html: Added.\n* Tools/TestWebKitAPI/Resources/cocoa/svg-image.html: Added.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ios/ActionSheetTests.mm:\n(ActionSheetTests.SVGImageSaveImageActionIsExcluded): Added.\n(ActionSheetTests.LinkedSVGImageSaveImageActionIsExcluded): Added.\n(TestWebKitAPI::TEST(ActionSheetTests, SVGImageSaveImageActionIsExcluded)):\n(TestWebKitAPI::TEST(ActionSheetTests, LinkedSVGImageSaveImageActionIsExcluded)):\n\nCanonical link: https://commits.webkit.org/316983@main",
      "email": "darin@apple.com",
      "hash": "3c5fe4025419671f8a72aa954d94925c90bdb671",
      "subject": "SVG images like the logo at singlethreadfarms.com have non-working Save to Photos menu item"
    },
    "316984@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316984@main",
      "clUrl": "https://commits.webkit.org/316984@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319179\nrdar://182021529\n\nUnreviewed - since it is just cosmetic fix.\n\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::updateShouldPlay):\n(WebCore::HTMLMediaElement::resetPlaybackSessionState):\n\nCanonical link: https://commits.webkit.org/316984@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "6dcf0a16b24e966e22f4aa475602bfd36574b631",
      "subject": "Add missing newline between updateShouldPlay() and resetPlaybackSessionState() in HTMLMediaElement.cpp"
    },
    "316985@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "316985@main",
      "clUrl": "https://commits.webkit.org/316985@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318519\n\nReviewed by Antti Koivisto.\n\nLineState bundled a flex line's per-item working data (spans into allItems and the\nmain size, margin, position, and cross size lists) with its two per-line scalars\n(cross-axis offset and extent). FlexLayout::layout has no such struct: it drives\nevery phase from a LineRanges list plus the global per-item lists and per-line\nLinesCrossSizeList / LinesCrossPositionList. Now that the earlier commits moved all\nof the per-item working data into global lists, LineState's per-item spans are just\nglobalList.subspan(lineRange) -- redundant with flexLines.ranges -- so LineState can\ngo.\n\nEach phase (handleMainAxisAlignment, distributeMainAxisFreeSpaceForMultilineColumnIfNeeded,\nthe cross-axis chain in repositionLogicalHeightDependentFlexItems, and the flips) now\ntakes flexLines plus the global lists it needs and iterates flexLines.ranges[lineIndex],\nindexing the lists by the global flex item index (or slicing them for the span-based\nleaves placeFlexItems / layoutFlexItems). The two per-line scalars become\nperformFlexLayout-scope Vector\u003cLayoutUnit\u003e lists: lineCrossSizeList (the promoted\nflexLinesCrossSizeList) and lineCrossOffsetList, still mutated in place by the\ncross-axis line alignment phase (handleCrossAxisAlignmentForFlexLines).\nLineState and FlexLineStates are gone.\n\nNo change in behavior: every former field access resolves to the same value at the\nsame point (the line's slice is the same backing store; the per-line scalar lists\ncarry the single-line-height and align-content-stretch adjustments exactly as the\nfields did; performBaselineAlignment's sharing groups now hold global item indices).\n\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::distributeMainAxisFreeSpaceForMultilineColumnIfNeeded):\n(WebCore::RenderFlexibleBox::repositionLogicalHeightDependentFlexItems):\n(WebCore::RenderFlexibleBox::performFlexLayout):\n(WebCore::RenderFlexibleBox::handleMainAxisAlignment):\n(WebCore::RenderFlexibleBox::setFlexItemCountsForFirstAndLastLine):\n(WebCore::RenderFlexibleBox::handleCrossAxisAlignmentForFlexLines):\n(WebCore::RenderFlexibleBox::computeCrossSizeForFlexItems):\n(WebCore::RenderFlexibleBox::handleCrossAxisAlignmentForFlexItems):\n(WebCore::RenderFlexibleBox::performBaselineAlignment):\n(WebCore::RenderFlexibleBox::flipForRightToLeftColumn):\n(WebCore::RenderFlexibleBox::flipForWrapReverse):\n(WebCore::RenderFlexibleBox::LineState::LineState): Deleted.\n\nCanonical link: https://commits.webkit.org/316985@main",
      "email": "zalan@apple.com",
      "hash": "a51f5969458168cc00d66cba2e745ce1dfcc2e42",
      "subject": "[cleanup] Replace LineState with flex line ranges and parallel per-line lists"
    },
    "316986@main": {
      "author": "Simon Lewis",
      "avatar": "https://www.gravatar.com/avatar/f354c01a964923e67771a097d7d2f084?d=identicon\u0026s=64",
      "cl": "316986@main",
      "clUrl": "https://commits.webkit.org/316986@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319117\nrdar://181936451\n\nReviewed by Elliott Williams.\n\n316852@main stages WebKit.swiftcrossimport before the WebKit Swift compile\nand adds -import-underlying-module; importing SwiftUI then fires WebKit's\nown cross-import overlay and fails with \"no such module '_WebKit_SwiftUI'\".\nPass -disable-cross-import-overlays alongside -import-underlying-module.\n\n316835@main enables ENABLE_IPC_TESTING_SWIFT on macOS \u003e=26.5, but\n_webkit_generate_platform_swift_args() never passes -fsanitize= to its\nclang -E -dM, so Swift sees ENABLE_IPC_TESTING_API=0 while C++ sees 1 and\nIPCTesterReceiver is missing from WebKit-Swift-Generated.h. Forward\nENABLED_COMPILER_SANITIZERS into that preprocess.\n\n* Source/cmake/WebKitMacros.cmake:\n\nCanonical link: https://commits.webkit.org/316986@main",
      "email": "simon.lewis@apple.com",
      "hash": "a6e6f927abb7b10979cb9f5828a05fddcf8ee02b",
      "subject": "REGRESSION(316835@main, 316852@main): [CMake][Mac][ASan] Swift module build fails"
    },
    "316987@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316987@main",
      "clUrl": "https://commits.webkit.org/316987@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318379\nrdar://181745000\n\nReviewed by Devin Rousso.\n\nSelecting an element matched by a rule inside a top-level @scope rule that\ncontains a bare (implicitly nested) declaration crashes the WebContent process.\n\nCSSParser::consumeScopeRule() emitted startRuleBody()/endRuleBody() to the\nCSSParserObserver *before* consuming the rule's nested contents, unlike every\nother group at-rule (@media, @supports, @starting-style, @layer, @container).\nendRuleBody() pops the rule off StyleSheetHandler::m_currentRuleDataStack, so a\nbare declaration then makes consumeNestedGroupRules() call\nmarkRuleBodyContainsImplicitlyNestedProperties(), which dereferences\nm_currentRuleDataStack.last() on the now-empty stack (top-level @scope) and\ncrashes when Web Inspector reparses the sheet via CSS.getMatchedStylesForNode.\n\nMove endRuleBody() to after consumeNestedGroupRules(), matching the other group\nat-rules.\n\nOther consume*Rule() functions emit endRuleBody() before consuming contents too\n(@import, @font-face, @font-feature-values, @font-palette-values, @keyframes,\n@counter-style, @view-transition, @position-try, and @layer's statement form),\nbut none need this fix: the crash is only reachable via\nmarkRuleBodyContainsImplicitlyNestedProperties(), whose sole caller is\nconsumeNestedGroupRules(), which only the group at-rules run (and all call\nendRuleBody() after it). The rest consume descriptor lists that never reach it,\nand consumeBlockContent() only drives the observer for Style/Keyframe/Page.\nAdded a regression test reparsing each of these at-rules to confirm no crash.\n\nTests: inspector/css/getMatchedStylesForNodeScopeImplicitProperties.html\n       inspector/css/getMatchedStylesForNodeAtRulesDoNotCrash.html\n\n* LayoutTests/inspector/css/getMatchedStylesForNodeScopeImplicitProperties-expected.txt: Added.\n* LayoutTests/inspector/css/getMatchedStylesForNodeScopeImplicitProperties.html: Added.\n* LayoutTests/inspector/css/getMatchedStylesForNodeAtRulesDoNotCrash-expected.txt: Added.\n* LayoutTests/inspector/css/getMatchedStylesForNodeAtRulesDoNotCrash.html: Added.\n* Source/WebCore/css/parser/CSSParser.cpp:\n(WebCore::CSSParser::consumeScopeRule):\n\nCanonical link: https://commits.webkit.org/316987@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "ac97ce8ceae40a5da3237ca72038ba2d4c9ebd14",
      "subject": "Web Inspector: crash when inspecting a top-level @scope rule with a bare declaration"
    },
    "316988@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316988@main",
      "clUrl": "https://commits.webkit.org/316988@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319157\nrdar://181977661\n\nReviewed by Jer Noble.\n\ncalculateMaximumSize() mapped the computed position alignment to its spec\nrule with a chain of if/else branches. Replace it with a switch on the\ncomputed position alignment so the mapping from each alignment value to its\nrule is explicit and exhaustive, with an ASSERT_NOT_REACHED() safety net in\nthe Auto case (which calculateComputedPositionAlignment() never returns).\n\nAs a drive-by, drop a redundant re-test in the process: the old final\ncenter branch re-checked \"positionAlignment == PositionAlignSetting::Center\"\neven though the earlier LineLeft/LineRight branches meant control could only\nreach it when the alignment was already Center, so that check could never be\nfalse. No change in behavior.\n\n* Source/WebCore/html/track/VTTCue.cpp:\n(WebCore::VTTCue::calculateMaximumSize const):\n\nCanonical link: https://commits.webkit.org/316988@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "ec30fe66cd0d5a03489ab0d144b4ea5813b116c0",
      "subject": "Use a switch in VTTCue::calculateMaximumSize"
    },
    "316989@main": {
      "author": "Claudio Saavedra",
      "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64",
      "cl": "316989@main",
      "clUrl": "https://commits.webkit.org/316989@main",
      "description": "* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/316989@main",
      "email": "csaavedra@igalia.com",
      "hash": "d37f0fad208c90dfc2dadd27d1abafc2ce3d3250",
      "subject": "[GLIB] Unreviewed gardening"
    },
    "316990@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316990@main",
      "clUrl": "https://commits.webkit.org/316990@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319182\nrdar://182030528\n\nReviewed by Anne van Kesteren.\n\nFollow-up to 316976@main. ParsedContentType::mimeType() already returns an\nASCII-lowercased essence (setContentType() calls convertToASCIILowercase()),\nso the equalLettersIgnoringASCIICase() comparisons in scrollToTextFragment()\nwere redundant. Compare the parsed MIME type directly against the lowercase\nliterals \"text/html\" and \"text/plain\", and note in a comment that the string\nis already lowercased.\n\nAlso add WPT coverage for a document served with a mixed-case Content-Type\n(\"Text/HTML; charset=UTF-8\") to pin the case-insensitive normalization.\n\n* LayoutTests/imported/w3c/web-platform-tests/scroll-to-text-fragment/resources/text-html-mixed-case.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/scroll-to-text-fragment/resources/text-html-mixed-case.html.headers: Added.\n* LayoutTests/imported/w3c/web-platform-tests/scroll-to-text-fragment/text-directive-mime-type-parameter-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-to-text-fragment/text-directive-mime-type-parameter.html:\n* Source/WebCore/page/LocalFrameView.cpp:\n(WebCore::LocalFrameView::scrollToTextFragment):\n\nCanonical link: https://commits.webkit.org/316990@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "0f1cee1acd25f51b59c7c5d529ebfbb588da465b",
      "subject": "Scroll To Text Fragment: simplify MIME-type gate and add mixed-case coverage"
    },
    "316991@main": {
      "author": "Adrian Taylor",
      "avatar": "https://www.gravatar.com/avatar/d2acb8ad2e2670ff74ae0d65fb27014c?d=identicon\u0026s=64",
      "cl": "316991@main",
      "clUrl": "https://commits.webkit.org/316991@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317389\nrdar://180013095\n\nReviewed by Elliott Williams and Richard Robinson.\n\nThis enables the Back Forward List on the most recent public SDKs. It has been\nenabled on internal SDKs for some time, and was already enabled on OSX, so this\nadds other Apple public SDKs.\n\nCanonical link: https://commits.webkit.org/316991@main",
      "email": "adrian_taylor@apple.com",
      "hash": "08160f69fe42888f56875888e97d6946837c88a8",
      "subject": "Enable Back Forward List Swift on recent SDKs"
    },
    "316992@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "316992@main",
      "clUrl": "https://commits.webkit.org/316992@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318550\n\nReviewed by Antti Koivisto.\n\ncomputeCrossSizeForFlexItems stretched each item and then read the result back off\nthe renderer with crossAxisExtentForFlexItem to fill crossSizeList. For the\nstretched items that read is redundant: applyStretchAlignmentToFlexItem already\nknows the used cross size -- it is the value it sets via setOverridingBorderBox and\nlays the child out to. Return it instead.\n\napplyStretchAlignmentToFlexItem and applyStretchMinMaxCrossSize now return the used\ncross size (desiredLogicalHeight / flexItemWidth / newSize, or the item's unchanged\nlaid-out extent on the no-stretch-min/max early return), and computeCrossSizeForFlexItems\nstores that for stretched items while non-stretch items still read\ncrossAxisExtentForFlexItem. No change in behavior: the returned value is the\nborder-box size the override forces, which is exactly what crossAxisExtentForFlexItem\nread back before.\n\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::computeCrossSizeForFlexItems):\n(WebCore::RenderFlexibleBox::applyStretchMinMaxCrossSize):\n(WebCore::RenderFlexibleBox::applyStretchAlignmentToFlexItem):\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n\nCanonical link: https://commits.webkit.org/316992@main",
      "email": "zalan@apple.com",
      "hash": "02cba0bd216fcd5faffa47521a95180d814374b6",
      "subject": "[cleanup] Return the used cross size from applyStretchAlignmentToFlexItem"
    },
    "316993@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "316993@main",
      "clUrl": "https://commits.webkit.org/316993@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318552\n\nReviewed by Antti Koivisto.\n\nrepositionLogicalHeightDependentFlexItems was a wrapper named for when it runs\n(after the logical height is known) rather than what it does; FlexLayout::layout\nhas no such function -- its performContentAlignment calls the cross-axis alignment\nphases directly under the \"Cross-Axis Alignment\" comment. Legacy put that same\ncomment above the wrapper. Inline the wrapper so performContentAlignment calls\nhandleCrossAxisAlignmentForFlexLines, computeCrossSizeForFlexItems,\nhandleCrossAxisAlignmentForFlexItems, and the flips directly.\n\nPure code motion: the body runs at the same point the call did, and the lambda\ncaptures the same lists the function took as arguments.\n\nNo change in behavior.\n\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::performFlexLayout):\n(WebCore::RenderFlexibleBox::repositionLogicalHeightDependentFlexItems): Deleted.\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n\nCanonical link: https://commits.webkit.org/316993@main",
      "email": "zalan@apple.com",
      "hash": "60c9df371dd2c01a7fbce516d8d1954334d9437b",
      "subject": "[cleanup] Remove repositionLogicalHeightDependentFlexItems, calling the cross-axis alignment phases directly"
    },
    "316994@main": {
      "author": "Keith Miller",
      "avatar": "https://www.gravatar.com/avatar/bddc1595b29098429a6ce7c8bf4aced2?d=identicon\u0026s=64",
      "cl": "316994@main",
      "clUrl": "https://commits.webkit.org/316994@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318142\nrdar://180958970\n\nReviewed by Yusuke Suzuki.\n\nSpecObjectOther type filtering is too wide for the assumptions of the\noperationRegExpStringIteratorNext operation. Since DFG/FTL_TYPE_CHECK\nuse the speculated type as equivalent to the runtime check this causes\nus to skip a type check. This allows any object to flow into the\noperationRegExpStringIteratorNext call.\n\nTest: JSTests/stress/regexp-string-iterator-next-wrong-receiver.js\nCanonical link: https://commits.webkit.org/316994@main",
      "email": "keith_miller@apple.com",
      "hash": "e6fd50a3da8403cf38fa2d44745fd770783cff38",
      "subject": "RegExpStringIterator next can't use SpecObjectOther type check filtering"
    },
    "316995@main": {
      "author": "Philippe Normand",
      "avatar": "https://www.gravatar.com/avatar/eef27203750af3510263cc29af21a16e?d=identicon\u0026s=64",
      "cl": "316995@main",
      "clUrl": "https://commits.webkit.org/316995@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319193\n\nUnreviewed, restore a test expectation removed in 316971@main.\n\n* LayoutTests/platform/glib/TestExpectations:\n\nCanonical link: https://commits.webkit.org/316995@main",
      "email": "philn@igalia.com",
      "hash": "b2903948e93fb8c8e638accac8427ef1b2867246",
      "subject": "[GStreamer] gardening"
    },
    "316996@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "316996@main",
      "clUrl": "https://commits.webkit.org/316996@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318553\n\nReviewed by Antti Koivisto.\n\nLegacy finalized flex item positions in three steps at the end of layout: a\nflipForWrapReverse pass, a flipForRightToLeftColumn pass, and then a loop writing\neach item's flow-aware location to its renderer. FlexLayout::layout instead\nfinalizes position (including axis reversal) in a single computeFlexItemRects\nstep. Match that: fold both flips into the final apply loop, now a\ncomputeFlexItemRects lambda that, per item, applies the wrap-reverse line flip and\nthe rtl-column item flip and writes the location via setFlexItemGeometry.\nflipForWrapReverse and flipForRightToLeftColumn are gone.\n\nNo change in behavior: the flip formulas are unchanged, the order is preserved\n(wrap-reverse then rtl-column, so the rtl flip sees the moved cross position -- and\nsince each flip only touches its own item, applying both per item equals the old\npass-then-pass), and the ranges cover exactly the items the apply loop did. The\nwrap-reverse input crossAxisStartEdge must be read before align-content\n(handleCrossAxisAlignmentForFlexLines) shifts the line offsets, so it is now\ncaptured into a performFlexLayout-scope local there and read by computeFlexItemRects.\n\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::performFlexLayout):\n(WebCore::RenderFlexibleBox::updateAutoMarginsInCrossAxis):\n(WebCore::RenderFlexibleBox::placeFlexItems):\n(WebCore::RenderFlexibleBox::flipForRightToLeftColumn): Deleted.\n(WebCore::RenderFlexibleBox::flipForWrapReverse): Deleted.\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n\nCanonical link: https://commits.webkit.org/316996@main",
      "email": "zalan@apple.com",
      "hash": "ff96979676ebd0882487b97aa108a2c052b41935",
      "subject": "Fold the wrap-reverse and RTL-column flips into a computeFlexItemRects pass"
    },
    "316997@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316997@main",
      "clUrl": "https://commits.webkit.org/316997@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319183\nrdar://182031085\n\nReviewed by Eric Carlson.\n\nRenderMedia::styleDidChange() called protect(mediaElement()) up to three\ntimes, each ref-counting the same element. Hoist a single Ref instead.\n\n* Source/WebCore/rendering/RenderMedia.cpp:\n(WebCore::RenderMedia::styleDidChange):\n\nCanonical link: https://commits.webkit.org/316997@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "8e9cd8114229720023ef53617e8c49335c13ae8c",
      "subject": "Avoid repeated protect(mediaElement()) in RenderMedia::styleDidChange"
    },
    "316998@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "316998@main",
      "clUrl": "https://commits.webkit.org/316998@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318555\n\nReviewed by Antti Koivisto.\n\nThe cross-axis alignment phases mutated a shared positionList by reference:\nhandleCrossAxisAlignmentForFlexLines moved every item by its line's align-content\noffset, and handleCrossAxisAlignmentForFlexItems (and performBaselineAlignment)\nmoved each item by its align-self / auto-margin / baseline offset.\nFlexLayout::layout instead has these phases return lists, which computeFlexItemRects\ncombines. Match that shape: handleCrossAxisAlignmentForFlexItems returns a per-item\ncrossItemOffsetList and handleCrossAxisAlignmentForFlexLines returns a per-line\nlineAlignContentOffsetList, and computeFlexItemRects adds both to the base position\nplaceFlexItems set before applying the flips.\n\nThe adjustAlignmentForFlexItem helper (which moved a position's cross component)\nbecomes a plain accumulation onto the offset list; updateAutoMarginsInCrossAxis\ntakes a LayoutUnit\u0026 cross-offset accumulator rather than a LayoutPoint\u0026, and still\nwrites the renderer margins.\n\nNo change in behavior: the final cross position is the same sum -- placeFlexItems'\nbase (line cross offset + margin) plus the align-content offset plus the item\noffset -- only assembled in returned lists and summed at the end instead of moved\nin place; the additions are commutative so the align-lines-before-align-items order\nis irrelevant; lineCrossOffsetList is still updated for the wrap-reverse flip; and\nplaceFlexItems still applies the base position to the renderer. The main-axis\nplacement stays as-is (it applies to the renderer for the multi-line-column\nrelayout's repaint).\n\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::performFlexLayout):\n(WebCore::RenderFlexibleBox::updateAutoMarginsInCrossAxis):\n(WebCore::RenderFlexibleBox::handleCrossAxisAlignmentForFlexLines):\n(WebCore::RenderFlexibleBox::handleCrossAxisAlignmentForFlexItems):\n(WebCore::RenderFlexibleBox::performBaselineAlignment):\n(WebCore::RenderFlexibleBox::adjustAlignmentForFlexItem): Deleted.\n\nCanonical link: https://commits.webkit.org/316998@main",
      "email": "zalan@apple.com",
      "hash": "89732c6e12ca706b2227f6fbfe22f521e20e6a42",
      "subject": "[cleanup] Return cross-axis alignment offsets from the cross-axis phases instead of mutating the position list"
    },
    "316999@main": {
      "author": "Sam Weinig",
      "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64",
      "cl": "316999@main",
      "clUrl": "https://commits.webkit.org/316999@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319195\n\nReviewed by Alan Baradlay.\n\nIntersection observers don't participate in the normal style resolution process for processing\ntheir length values and were already not factoring zoom into that early conversion. This removes\nthe ZoomNeeded usage in place of explicit ZoomFactor::none().\n\n* Source/WebCore/page/IntersectionObserver.cpp:\n* Source/WebCore/page/IntersectionObserverMarginBox.h:\n* Source/WebCore/rendering/RenderBox.cpp:\n\nCanonical link: https://commits.webkit.org/316999@main",
      "email": "sam@webkit.org",
      "hash": "a91d06576aafc90ed13588a45c9157e8bc2829b6",
      "subject": "[EvaluationTimeZoom] Convert intersection observers to use unzoomed lengths"
    },
    "317000@main": {
      "author": "Sam Weinig",
      "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64",
      "cl": "317000@main",
      "clUrl": "https://commits.webkit.org/317000@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319194\n\nReviewed by Alan Baradlay.\n\nMakes custom properties work with evaluation time zoom by using the appropriate\nunzoomed range modifier.\n\nThis also fixes an issue with zoom being doubly applied when using custom properties.\n\nTests: imported/w3c/web-platform-tests/css/css-viewport/zoom/custom-property.html\n* LayoutTests/imported/w3c/web-platform-tests/css/css-viewport/zoom/custom-property-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-viewport/zoom/custom-property.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-viewport/zoom/reference/custom-property-ref.html: Added.\n* Source/WebCore/css/parser/CSSPropertyParser.cpp:\n* Source/WebCore/style/StyleCustomProperty.h:\n* Source/WebCore/style/StyleInterpolation.cpp:\n\nCanonical link: https://commits.webkit.org/317000@main",
      "email": "sam@webkit.org",
      "hash": "02fc1f62790178b79ac3ea22f439cf83ca686ec1",
      "subject": "[EvaluationTimeZoom] Convert custom properties to use evaluation time zoom"
    },
    "317001@main": {
      "author": "Anne van Kesteren",
      "avatar": "https://www.gravatar.com/avatar/09bb44ac3625a121017cd98d0a7dc52c?d=identicon\u0026s=64",
      "cl": "317001@main",
      "clUrl": "https://commits.webkit.org/317001@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319089\n\nReviewed by Tim Nguyen.\n\nThis includes https://github.com/web-platform-tests/wpt/pull/61212 and\nexcludes some changes to moveBefore() tests that ended up clashing with\nlocal changes.\n\nCanonical link: https://commits.webkit.org/317001@main",
      "email": "annevk@annevk.nl",
      "hash": "18fcb9f346562d67657f68bd58f54c3e736e5841",
      "subject": "Synchronize WPT dom/nodes partially"
    },
    "317002@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "317002@main",
      "clUrl": "https://commits.webkit.org/317002@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=308938\u003e\n\u003crdar://171479344\u003e\n\nReviewed by Ryosuke Niwa.\n\nThis is a merge-back of the safari-7624-branch fix.  The\n`-availableVoicesDidChange` main-thread hop and null-check that the\noriginal fix added already landed independently on `main` in\n312522@main (Bug 313950, rdar://173555693) via `ensureOnMainThread`.\nThis merge-back therefore preserves `main`'s existing\n`-availableVoicesDidChange` and applies only the remaining `-dealloc`\nchange from the original fix.\n\n`WebSpeechSynthesisWrapper` registers as an observer for\n`AVSpeechSynthesisAvailableVoicesDidChangeNotification` but never\nremoved itself.  Add `-dealloc` to call `-removeObserver:name:object:`\non `NSNotificationCenter`.  While Foundation stores observers as\nzeroing weak references that auto-invalidate when the observer is\ndeallocated, it is best practice to remove the registration promptly.\n\nNo new tests since no change in behavior.\n\n* Source/WebCore/platform/cocoa/PlatformSpeechSynthesizerCocoa.mm:\n(-[WebSpeechSynthesisWrapper dealloc]): Add.\n\nOriginally-landed-as: 305413.387@safari-7624-branch (4627c5152694). rdar://171479344\nCanonical link: https://commits.webkit.org/317002@main",
      "email": "ddkilzer@apple.com",
      "hash": "1b953e1a0f16b1bd079b1e48cdc348ce42eaadc9",
      "subject": "WebSpeechSynthesisWrapper crashes on voice change notification"
    },
    "317003@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "317003@main",
      "clUrl": "https://commits.webkit.org/317003@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318557\n\nReviewed by Antti Koivisto.\n\nFlexLayoutItem carried flexBaseContentSize and hypotheticalMainContentSize as\nmembers. FlexLayout::layout keeps these in a per-item FlexBaseAndHypotheticalMainSizeList\n(its step-3 output) and passes it to the sizing phases, leaving LogicalFlexItem\nwithout them. Match that: collectFlexItems now fills a\nFlexBaseAndHypotheticalMainSizeList (reusing the existing FlexBaseAndHypotheticalMainSize\nstruct) alongside the items, and the flex-line collection and flexible-length\nresolution read the two sizes from that list instead of the item.\n\ncomputeFlexLines/computeNextFlexLine, computeMainSizeForFlexItems/\nresolveFlexibleLengthsForLineItems, and the freeze helpers take the list (sliced\nper line for the resolution); the flexBaseMarginBoxSize / hypotheticalMainAxisMarginBoxSize\nhelpers and canFitItemWithTrimmedMarginEnd take the content size as an argument.\nFlexLayoutItem no longer stores flexBaseContentSize or hypotheticalMainContentSize.\nminMaxSizes stays on the item (FFC's list holds only the two sizes; min/max is\nsourced separately), so constrainSizeByMinMax is unchanged.\n\nNo change in behavior: the list is filled from the same flexBaseAndHypotheticalMainSize\ncomputation, in the same per-item order as allItems, so every reader gets the same\nvalue it read off the item before. This is the input FlexLayout::computeMainSizeForFlexItems\ntakes, so its resolution body can be ported to match FFC's next.\n\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::FlexLayoutItem::FlexLayoutItem):\n(WebCore::RenderFlexibleBox::FlexLayoutItem::hypotheticalMainAxisMarginBoxSize):\n(WebCore::RenderFlexibleBox::FlexLayoutItem::flexBaseMarginBoxSize):\n(WebCore::RenderFlexibleBox::resolveFlexibleLengthsForLineItems):\n(WebCore::RenderFlexibleBox::distributeMainAxisFreeSpaceForMultilineColumnIfNeeded):\n(WebCore::RenderFlexibleBox::canFitItemWithTrimmedMarginEnd):\n(WebCore::RenderFlexibleBox::performFlexLayout):\n(WebCore::RenderFlexibleBox::collectFlexItems):\n(WebCore::RenderFlexibleBox::computeFlexLines):\n(WebCore::RenderFlexibleBox::computeMainSizeForFlexItems):\n(WebCore::RenderFlexibleBox::computeNextFlexLine):\n(WebCore::RenderFlexibleBox::freezeViolations):\n(WebCore::RenderFlexibleBox::freezeInflexibleItems):\n(WebCore::RenderFlexibleBox::resolveFlexibleLengths):\n\nCanonical link: https://commits.webkit.org/317003@main",
      "email": "zalan@apple.com",
      "hash": "732527a143f6cd48ba2962c781dfb3ef779434bf",
      "subject": "[cleanup] Move flex base and hypothetical main size off FlexLayoutItem into a per-item list"
    },
    "317004@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317004@main",
      "clUrl": "https://commits.webkit.org/317004@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318852\nrdar://181677854\n\nReviewed by Taher Ali.\n\nSVGLengthContext::removeZoomFromFontOrRootFontRelativeLength() dereferenced\nDocument::documentElement() without a null check when resolving a\nroot-font-relative unit (e.g. rem/rlh). documentElement() can return null\n(document without a root element, or one being torn down), so this could\ncrash during length/style resolution.\n\nThe sibling helper rootRenderStyleForLengthResolving() already guards this\nexact access with `if (!rootElement || !rootElement-\u003erenderer())`. Guard\ndocumentElement() before reading its renderer, mirroring the sibling helper.\n\n* Source/WebCore/svg/SVGLengthContext.cpp:\n(WebCore::SVGLengthContext::removeZoomFromFontOrRootFontRelativeLength const):\n\nCanonical link: https://commits.webkit.org/317004@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "8256a3cb6c19ae63a9cb946a7179450883e1d04b",
      "subject": "Null-deref of documentElement() when resolving root-font-relative SVG lengths"
    },
    "317005@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317005@main",
      "clUrl": "https://commits.webkit.org/317005@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318325\nrdar://181109552\n\nReviewed by Taher Ali.\n\nWhen feConvolveMatrix parses an invalid order (e.g. order=\"0\"), it sets\nm_hasInvalidOrderAttribute so createFilterEffect() bails out and the filtered\nelement is not displayed. Removing the order attribute produces an empty value,\nwhich parseNumberOptionalNumber() rejects, so the code took the parse-failure\npath and kept m_hasInvalidOrderAttribute set. The filter therefore stayed\ndisabled even though a missing order attribute is valid and defaults to 3x3.\n\nTreat an empty/absent order value as the valid 3x3 default: reset orderX/orderY\nto the initial value and clear m_hasInvalidOrderAttribute, distinct from a\npresent-but-malformed value which continues to invalidate the primitive.\n\nTests: imported/w3c/web-platform-tests/css/filter-effects/feconvolvematrix-order-removal.html\n imported/w3c/web-platform-tests/css/filter-effects/reference/feconvolvematrix-order-removal-ref.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/filter-effects/feconvolvematrix-order-removal-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/filter-effects/feconvolvematrix-order-removal.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/filter-effects/reference/feconvolvematrix-order-removal-ref.html: Added.\n* Source/WebCore/svg/SVGFEConvolveMatrixElement.cpp:\n(WebCore::SVGFEConvolveMatrixElement::attributeChanged):\n\nCanonical link: https://commits.webkit.org/317005@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "3ec2988be5d6d7bc4fcf584274e086a8911870a8",
      "subject": "feConvolveMatrix: removing an invalid order attribute leaves the filter permanently disabled"
    },
    "317006@main": {
      "author": "Antoine Quint",
      "avatar": "https://www.gravatar.com/avatar/9b3ef1e754f8d994f21ff67c660cbbe6?d=identicon\u0026s=64",
      "cl": "317006@main",
      "clUrl": "https://commits.webkit.org/317006@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318979\nrdar://181836552\n\nReviewed by Sam Weinig and Tim Nguyen.\n\nThe animation-triggers spec adds two properties: `timeline-trigger-activation-range-start` and\n`timeline-trigger-activation-range-end`.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/rendering/widgets/shadow-dom-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/parsing/timeline-trigger-entry-range-end-computed.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/parsing/timeline-trigger-entry-range-end-valid.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/parsing/timeline-trigger-entry-range-shorthand.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/parsing/timeline-trigger-entry-range-start-computed.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/parsing/timeline-trigger-entry-range-start-valid.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/parsing/timeline-trigger-shorthand.tentative-expected.txt:\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:\n* Source/WebCore/css/CSSProperties.json:\n* Source/WebCore/style/values/animation-triggers/StyleTimelineTrigger.cpp:\n(WebCore::Style::operator\u003c\u003c):\n* Source/WebCore/style/values/animation-triggers/StyleTimelineTrigger.h:\n(WebCore::Style::TimelineTrigger::initialActivationRangeStart):\n(WebCore::Style::TimelineTrigger::initialActivationRangeEnd):\n\nCanonical link: https://commits.webkit.org/317006@main",
      "email": "graouts@webkit.org",
      "hash": "1c716f126ccb4ecd4609abaf8f02bc00e62b8e53",
      "subject": "[animation-triggers] add parsing support for the `timeline-trigger-activation-range-start` and `timeline-trigger-activation-range-end` properties"
    }
  },
  "date": "2026-07-12",
  "days": 1,
  "generatedAt": "2026-07-12T22:05:32Z",
  "markdown": "## Highlights\n- **Rendering** Animation trigger parsing landed for `timeline-trigger-activation-range-start` and `timeline-trigger-activation-range-end`, moving scroll-driven animation plumbing forward. [commit 317006@main](https://commits.webkit.org/317006@main)\n- **Security** WebKit fixed a null dereference while resolving root-font-relative SVG lengths, closing a crash path in SVG layout code. [commit 317004@main](https://commits.webkit.org/317004@main)\n- **A11y** A crash in WebSpeech synthesis on voice change notifications is fixed, making speech output more stable during runtime voice updates. [commit 317002@main](https://commits.webkit.org/317002@main)\n- **Web Platform** Scroll To Text Fragment now only runs text directives for `text/html` and `text/plain`, tightening spec-aligned behavior and reducing surprising activation. [commit 316976@main](https://commits.webkit.org/316976@main)\n- **DevTools** Web Inspector no longer crashes when inspecting a top-level `@scope` rule that contains a bare declaration. [commit 316987@main](https://commits.webkit.org/317987@main)\n- **Mobile** Back Forward List Swift is enabled on recent SDKs, continuing the platform-side migration on Apple OS builds. [commit 316991@main](https://commits.webkit.org/316991@main)\n- **Build** Recent SDK and sanitizer build breakages were addressed across CMake, Swift modules, and iOS 27 deprecations, keeping tip-of-tree usable. [commit 316986@main](https://commits.webkit.org/316986@main)\n- **Rendering** Custom properties and intersection observers were moved onto EvaluationTimeZoom-friendly code paths, reducing zoom-related inconsistency in style and geometry evaluation. [commit 317000@main](https://commits.webkit.org/317000@main)\n\n## What landed by area\n\n### Rendering and layout\n- **Rendering** `feConvolveMatrix` now recovers correctly when an invalid `order` attribute is removed instead of leaving the filter permanently disabled. [commit 317005@main](https://commits.webkit.org/317005@main)\n- **Rendering** Intersection observers now use unzoomed lengths under EvaluationTimeZoom, improving consistency between observed geometry and page zoom behavior. [commit 316999@main](https://commits.webkit.org/316999@main)\n- **Rendering** Flex layout now keeps flex base and hypothetical main size in a per-item list instead of on `FlexLayoutItem`, continuing a larger cleanup of flex state management. [commit 317003@main](https://commits.webkit.org/317003@main)\n- **Refactor** Cross-axis alignment offsets are now returned from cross-axis phases instead of mutating a position list in place. [commit 316998@main](https://commits.webkit.org/316998@main)\n- **Refactor** Wrap-reverse and RTL-column flips were folded into `computeFlexItemRects`, simplifying flex item rect computation. [commit 316996@main](https://commits.webkit.org/316996@main)\n- **Refactor** `repositionLogicalHeightDependentFlexItems` was removed in favor of calling cross-axis alignment phases directly. [commit 316993@main](https://commits.webkit.org/316993@main)\n- **Refactor** `applyStretchAlignmentToFlexItem` now returns the used cross size directly. [commit 316992@main](https://commits.webkit.org/316992@main)\n- **Refactor** `LineState` was replaced with flex line ranges and parallel per-line lists, another structural cleanup in flex layout internals. [commit 316985@main](https://commits.webkit.org/316985@main)\n- **Refactor** Used cross size is now passed into alignment helpers instead of being reread from the renderer. [commit 316980@main](https://commits.webkit.org/316980@main)\n- **Refactor** `computeCrossSizeForFlexItems` now captures each flex item's used cross size in a list for later phases. [commit 316974@main](https://commits.webkit.org/316974@main)\n\n### Web Platform and standards\n- **Web Platform** WPT `dom/nodes` synchronization pulled in more upstream coverage and behavior alignment. [commit 317001@main](https://commits.webkit.org/317001@main)\n- **Web Platform** Scroll To Text Fragment got a simplified MIME-type gate plus mixed-case coverage, tightening behavior and tests together. [commit 316990@main](https://commits.webkit.org/316990@main)\n\n### JavaScriptCore\n- **V8** `RegExpStringIterator.prototype.next` can no longer rely on `SpecObjectOther` type-check filtering, fixing a JSC correctness issue in iterator behavior. [commit 316994@main](https://commits.webkit.org/316994@main)\n- **V8** Temporal declaration cleanup fixed `JS_EXPORT_PRIVATE` ordering and missing `TZone` implementations. [commit 316977@main](https://commits.webkit.org/316977@main)\n\n### Media, captions, and speech\n- **Media** `RenderMedia::styleDidChange` avoids repeated `protect(mediaElement())`, trimming unnecessary retain-style churn in media style updates. [commit 316997@main](https://commits.webkit.org/316997@main)\n- **Media** GStreamer gardening landed with backend maintenance work. [commit 316995@main](https://commits.webkit.org/316995@main)\n- **Media** `VTTCue::calculateMaximumSize` now uses a switch, cleaning up cue sizing logic. [commit 316988@main](https://commits.webkit.org/316988@main)\n- **Media** AVKit soft-linking was consolidated into a single source file, reducing platform glue sprawl. [commit 316981@main](https://commits.webkit.org/316981@main)\n- **Media** `TextTrackList::getTrackById` now iterates via `length()` and `item()` rather than walking internal vectors directly. [commit 316978@main](https://commits.webkit.org/316978@main)\n- **Media** A redundant shadowing variable was removed from `VTTCue::determineTextDirection`. [commit 316975@main](https://commits.webkit.org/316975@main)\n- **A11y** `HTMLMediaElement.cpp` got a missing newline between `updateShouldPlay()` and `resetPlaybackSessionState()`, a tiny cleanup with no product impact. [commit 316984@main](https://commits.webkit.org/316984@main)\n\n### Apple platform integration\n- **UI** SVG images such as the logo on singlethreadfarms.com now correctly enable the Save to Photos menu item. [commit 316983@main](https://commits.webkit.org/316983@main)\n- **Mobile** WebKit now builds again for iOS 27 SDKs after updating code around the deprecated `-[UIApplication canOpenURL:]` path. [commit 316982@main](https://commits.webkit.org/316982@main)\n\n### Build and toolchain\n- **Build** A regression in Mac ASan Swift module builds was fixed after recent changes broke CMake-based sanitizer builds. [commit 316986@main](https://commits.webkit.org/316986@main)\n- **Build** Miscellaneous unified build issues on Mac CMake builds were fixed. [commit 316979@main](https://commits.webkit.org/316979@main)\n\n### GLib and general maintenance\n- **Build** GLib unreviewed gardening landed with general maintenance updates. [commit 316989@main](https://commits.webkit.org/316989@main)\n\n## Reverts \u0026 Reapplies",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [],
  "since": "2026-07-12",
  "totals": {
    "commits": 33,
    "features": 33,
    "rolls": 0
  },
  "until": "2026-07-12"
}