{
  "commits": {
    "317007@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317007@main",
      "clUrl": "https://commits.webkit.org/317007@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319202\nrdar://182056248\n\nReviewed by Taher Ali.\n\nRepeated beginElementAt()/endElementAt() with the same offset append a new\nentry to m_beginTimes/m_endTimes every call, growing the lists without bound.\nThe duplicates are inert and findInstanceTime() uses lower_bound and resolves\nthe same time regardless but waste memory and slow later inserts and scans.\n\nCollapse duplicates at insertion: rename insertSorted() to\ninsertSortedAndUnique() and skip the insert when a matching (time, origin)\npair already exists. Since the list is ordered only by time, the uniqueness\ncheck walks just the contiguous equal-time run.\n\nNo new tests since not observable through animation behavior and the lists have\nno Internals introspection.\n\n* Source/WebCore/svg/animation/SVGSMILElement.cpp:\n(WebCore::insertSortedAndUnique):\n(WebCore::SVGSMILElement::addInstanceTime):\n(WebCore::insertSorted): Deleted.\n\nCanonical link: https://commits.webkit.org/317007@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "defbb4f7ca8889021aba5a8320f44b8ded93dcee",
      "subject": "SVGSMILElement instance time lists accumulate duplicate entries from repeated beginElementAt/endElementAt calls"
    },
    "317008@main": {
      "author": "Keith Miller",
      "avatar": "https://www.gravatar.com/avatar/bddc1595b29098429a6ce7c8bf4aced2?d=identicon\u0026s=64",
      "cl": "317008@main",
      "clUrl": "https://commits.webkit.org/317008@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319192\nrdar://182042710\n\nReviewed by Yusuke Suzuki.\n\nThis patch moves the final remaining structured cloning code into JSC.\nThe object cloning code is what contains the state machine and is most\nof the logic around cloning. Fortunately there's nothing in the W3C spec\nthat requires recursive cloning so the logic can all cleanly move into\nJSC.\n\nNo new tests, no behavior change. Covered by existing tests.\n\nCanonical link: https://commits.webkit.org/317008@main",
      "email": "keith_miller@apple.com",
      "hash": "3bd19f0a328ecb8093802867eedec0b17490ce10",
      "subject": "Move object structured cloning code into JSC"
    },
    "317009@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "317009@main",
      "clUrl": "https://commits.webkit.org/317009@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319012\nrdar://181857218\n\nReviewed by Keith Miller.\n\nThis patch implements String.raw in C++, which removes builtin JS\nversion of String.raw. Since array is frozen, builtin JS iteration does\nnot offer much in fact. We can write all array types in an efficient way\nin C++.\n\n                                 ToT                     Patched\n\n    string-raw             38.3499+-0.2422     ^     33.8134+-0.3764        ^ definitely 1.1342x faster\n    string-raw-large      144.9109+-3.1563     ^    118.7783+-2.5823        ^ definitely 1.2200x faster\n\nTests: JSTests/microbenchmarks/string-raw-large.js\n       JSTests/microbenchmarks/string-raw.js\n\n* JSTests/microbenchmarks/string-raw-large.js: Added.\n(test):\n* JSTests/microbenchmarks/string-raw.js: Added.\n(test):\n* Source/JavaScriptCore/CMakeLists.txt:\n* Source/JavaScriptCore/DerivedSources.make:\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/builtins/StringConstructor.js: Removed.\n* Source/JavaScriptCore/runtime/JSString.cpp:\n(JSC::JSRopeString::RopeBuilder\u003cRecordOverflow\u003e::expand):\n* Source/JavaScriptCore/runtime/JSString.h:\n* Source/JavaScriptCore/runtime/StringConstructor.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n\nCanonical link: https://commits.webkit.org/317009@main",
      "email": "ysuzuki@apple.com",
      "hash": "5031c9001ee2e3d43e727a6d95df8d0734bc1311",
      "subject": "[JSC] Implement String.raw in C++"
    },
    "317010@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "317010@main",
      "clUrl": "https://commits.webkit.org/317010@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318558\n\nReviewed by Antti Koivisto.\n\nresolveFlexibleLengthsForLineItems drove the CSS Flexbox 9.7 resolution through\nthree separate methods -- freezeInflexibleItems, resolveFlexibleLengths, and\nfreezeViolations -- threading the same bookkeeping (the frozen flags, the running\nremainingFreeSpace, and the totalFlexGrow / totalFlexShrink / totalWeightedFlexShrink\nsums) between them by reference. FlexLayout::layout resolves the flexible lengths\ninline in a single function. Fold the three helpers into resolveFlexibleLengthsForLineItems\nto match: freezeViolations becomes a local lambda over the same locals, the\ninflexible-item freeze runs inline before the loop, and resolveFlexibleLengths\nbecomes the body of a while (true) loop.\n\nNo change in behavior: this is pure code motion. The lambda captures the same\nlocals the helpers took by reference; the inflexible freeze still runs before\ninitialFreeSpace is captured; and while (!resolveFlexibleLengths(...)) {} with its\ninternal \"if (totalViolation) freeze; else remainingFreeSpace -= usedFreeSpace;\nreturn !totalViolation\" is exactly while (true) { ...; if (!totalViolation) {\nremainingFreeSpace -= usedFreeSpace; break; } freeze; } -- same distribution, same\nclamping, same freeze order, same termination.\n\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::resolveFlexibleLengthsForLineItems):\n(WebCore::RenderFlexibleBox::freezeViolations): Deleted.\n(WebCore::RenderFlexibleBox::freezeInflexibleItems): Deleted.\n(WebCore::RenderFlexibleBox::resolveFlexibleLengths): Deleted.\n\nCanonical link: https://commits.webkit.org/317010@main",
      "email": "zalan@apple.com",
      "hash": "bb73179461ca2425ae7c0ec77e6be50f156d0550",
      "subject": "[cleanup] Inline the flex-length freeze helpers into resolveFlexibleLengthsForLineItems"
    },
    "317011@main": {
      "author": "Sabith Saheb",
      "avatar": "https://www.gravatar.com/avatar/797f235ab64c002e72b2bb8012bec6c1?d=identicon\u0026s=64",
      "cl": "317011@main",
      "clUrl": "https://commits.webkit.org/317011@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318680\n\nReviewed by Chris Dumez.\n\nKanjiCode::judge() scans response bytes to guess a Japanese encoding\nduring charset autodetection. Two branches guard the string[i + 1]\nlookahead with (string.size() - i \u003e= 1), which is always true inside the\nwhile (i \u003c string.size()) loop, so when the final byte (i == size - 1)\nfalls in 0x81..0x9f or 0xfd..0xfe the code reads string[i + 1], one past\nthe end of the span. string is a std::span and WebKit builds with\nhardened libc++, so this is caught as a safe release-assert crash, not a\nheap-buffer-overflow or a security bug. The sibling hiragana/katakana\nbranches already use the correct (string.size() - i \u003e 1) guard; this\nmakes the two SJIS/EUC lead-byte branches match. Inputs that actually\nhave a following byte take the same branch as before.\n\n* Source/WebCore/loader/TextResourceDecoder.cpp:\n(KanjiCode::judge):\n\nCanonical link: https://commits.webkit.org/317011@main",
      "email": "shabi7204192361@gmail.com",
      "hash": "94ff9f23ee9c041c4bb9b657469a327ebb79ae12",
      "subject": "Off-by-one out-of-bounds read in KanjiCode::judge()"
    },
    "317012@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "317012@main",
      "clUrl": "https://commits.webkit.org/317012@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319185\n\nReviewed by Yusuke Suzuki.\n\nPer IteratorClose[1] invoked with a throw completion, any exception thrown\nwhile getting or calling the return method must be discarded so the outer\ncompletion (the original rejection reason) is preserved. JSC was letting a\nthrowing return() propagate (leaving the promise pending with an uncaught\nexception) and letting a throwing return getter reject the promise with the\ngetter's exception instead of the original reason.\n\n    const it = {\n        [Symbol.iterator]: () =\u003e ({\n            next: () =\u003e ({ value: Promise.reject(new Error(\"original\")), done: false }),\n            return() { throw new Error(\"close error\"); }\n        })\n    };\n    (async () =\u003e { for await (const _ of it) {} })(); // never settled before\n\n[1]: https://tc39.es/ecma262/#sec-iteratorclose\n\nTest: JSTests/stress/async-from-sync-iterator-close-on-rejection-throwing-return.js\n\n* JSTests/stress/async-from-sync-iterator-close-on-rejection-throwing-return.js: Added.\n(shouldBe):\n(const.syncIterable.Symbol.iterator.return.get return):\n(throw.new.Error.async drainMicrotasks):\n(async drainMicrotasks):\n(async gen):\n(throw.new.Error):\n* Source/JavaScriptCore/runtime/JSMicrotask.cpp:\n(JSC::asyncFromSyncIteratorContinueOrDone):\n\nCanonical link: https://commits.webkit.org/317012@main",
      "email": "sosuke@bun.sh",
      "hash": "8490d02c5dcc8461ce5d8161717d292d8085a596",
      "subject": "[JSC] AsyncFromSyncIterator does not close correctly when the sync iterator yields a rejected value promise"
    },
    "317013@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "317013@main",
      "clUrl": "https://commits.webkit.org/317013@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318581\n\nReviewed by Antti Koivisto.\n\nRenderFlexibleBox had grown to mix the core flex layout algorithm with a large\nset of stateless query and geometry helpers -- flow-aware border/padding/margin,\naxis extents, main/cross size-length accessors, overflow/aspect-ratio/definiteness\nqueries, cross-size computations, and the alignment-offset math. LFC's\nFlexLayout keeps that kind of thing in a FlexFormattingUtils helper. Mirror\nthat: add rendering/FlexLayoutUtils, holding a const RenderFlexibleBox\u0026 (which\nbefriends it), and move the stateless helpers into it. The alignment-offset math\nthat took no container state moves as static methods.\n\nRenderFlexibleBox exposes a public flexLayoutUtils() accessor (mirroring\nFlexFormattingContext::formattingUtils()), and its callers -- internal and the\nhandful in RenderBlock, RenderBlockFlow, and RenderBox -- now go through it.\n\nWhat stays on RenderFlexibleBox: the performFlexLayout pipeline and its phases,\nthe layout-state and relayout helpers (canUseFlexItemForPercentageResolution,\nthe flex-base and min/max sizing that drive child layout, crossAxisIntrinsic*),\nwillStretchItem (a RenderBlock virtual override), and the positioned-layout\napply setStaticPositionForPositionedLayout (it mutates the layer). computeGap and\nthe FlexLayoutItem-typed margin-trim helpers stay because their parameter types\nare nested in RenderFlexibleBox and are not nameable from the utility header.\n\nNo change in behavior: this is pure code motion. The moved bodies are unchanged\napart from reading the flex container and its items through the FlexLayoutUtils\nreference instead of directly.\n\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/rendering/FlexLayoutUtils.h: Added.\n* Source/WebCore/rendering/FlexLayoutUtils.cpp: Added.\n(WebCore::isSVGRootWithIntrinsicAspectRatio):\n(WebCore::FlexLayoutUtils::FlexLayoutUtils):\n(WebCore::FlexLayoutUtils::flowAwareBorderStart const):\n(WebCore::FlexLayoutUtils::flowAwareBorderEnd const):\n(WebCore::FlexLayoutUtils::flowAwareBorderBefore const):\n(WebCore::FlexLayoutUtils::flowAwareBorderAfter const):\n(WebCore::FlexLayoutUtils::flowAwarePaddingStart const):\n(WebCore::FlexLayoutUtils::flowAwarePaddingEnd const):\n(WebCore::FlexLayoutUtils::flowAwarePaddingBefore const):\n(WebCore::FlexLayoutUtils::flowAwarePaddingAfter const):\n(WebCore::FlexLayoutUtils::flowAwareMarginStartForFlexItem const):\n(WebCore::FlexLayoutUtils::flowAwareMarginEndForFlexItem const):\n(WebCore::FlexLayoutUtils::flowAwareMarginBeforeForFlexItem const):\n(WebCore::FlexLayoutUtils::crossAxisExtentForFlexItem const):\n(WebCore::FlexLayoutUtils::mainAxisExtentForFlexItem const):\n(WebCore::FlexLayoutUtils::mainAxisContentExtentForFlexItemIncludingScrollbar const):\n(WebCore::FlexLayoutUtils::crossAxisExtent const):\n(WebCore::FlexLayoutUtils::mainAxisExtent const):\n(WebCore::FlexLayoutUtils::crossAxisContentExtent const):\n(WebCore::FlexLayoutUtils::mainAxisMarginExtentForFlexItem const):\n(WebCore::FlexLayoutUtils::crossAxisMarginExtentForFlexItem const):\n(WebCore::FlexLayoutUtils::crossAxisScrollbarExtent const):\n(WebCore::FlexLayoutUtils::mainAxisScrollbarExtent const):\n(WebCore::FlexLayoutUtils::preferredMainSizeLengthForFlexItem const):\n(WebCore::FlexLayoutUtils::minMainSizeLengthForFlexItem const):\n(WebCore::FlexLayoutUtils::maxMainSizeLengthForFlexItem const):\n(WebCore::FlexLayoutUtils::preferredCrossSizeLengthForFlexItem const):\n(WebCore::FlexLayoutUtils::minCrossSizeLengthForFlexItem const):\n(WebCore::FlexLayoutUtils::maxCrossSizeLengthForFlexItem const):\n(WebCore::FlexLayoutUtils::mainAxisOverflowForFlexItem const):\n(WebCore::FlexLayoutUtils::crossAxisOverflowForFlexItem const):\n(WebCore::FlexLayoutUtils::overflowAlignmentForFlexItem const):\n(WebCore::FlexLayoutUtils::hasAutoMarginsInCrossAxis const):\n(WebCore::FlexLayoutUtils::useContentBasedMinimumSize const):\n(WebCore::FlexLayoutUtils::preferredAspectRatioForFlexItem const):\n(WebCore::FlexLayoutUtils::flexItemHasAspectRatio):\n(WebCore::FlexLayoutUtils::canResolveFullyConstrainedLogicalHeight):\n(WebCore::FlexLayoutUtils::flexItemHasComputableAspectRatio const):\n(WebCore::FlexLayoutUtils::needToStretchFlexItemLogicalHeight const):\n(WebCore::FlexLayoutUtils::innerCrossSizeForFlexItem const):\n(WebCore::FlexLayoutUtils::columnInnerMainSize const):\n(WebCore::FlexLayoutUtils::crossAxisDirection const):\n(WebCore::FlexLayoutUtils::isColumnOrRowReverse const):\n(WebCore::FlexLayoutUtils::isWrapReverse const):\n(WebCore::FlexLayoutUtils::hasDefiniteLogicalWidthForAspectRatioCrossSize const):\n(WebCore::FlexLayoutUtils::leftRightAxisDirectionFromStyle):\n(WebCore::FlexLayoutUtils::computeFlexItemMarginValue const):\n(WebCore::FlexLayoutUtils::shouldTrimMainAxisMarginStart const):\n(WebCore::FlexLayoutUtils::shouldTrimMainAxisMarginEnd const):\n(WebCore::FlexLayoutUtils::shouldTrimCrossAxisMarginStart const):\n(WebCore::FlexLayoutUtils::shouldTrimCrossAxisMarginEnd const):\n(WebCore::FlexLayoutUtils::transformedBlockFlowDirection const):\n(WebCore::FlexLayoutUtils::isLeftToRightFlow const):\n(WebCore::FlexLayoutUtils::isColumnFlow const):\n(WebCore::FlexLayoutUtils::availableAlignmentSpaceForFlexItem const):\n(WebCore::FlexLayoutUtils::marginBoxAscentForFlexItem const):\n(WebCore::FlexLayoutUtils::isHorizontalFlow const):\n(WebCore::FlexLayoutUtils::mainAxisIsFlexItemInlineAxis const):\n(WebCore::FlexLayoutUtils::isMultiline const):\n(WebCore::FlexLayoutUtils::useContentBasedMinimumBlockSize const):\n(WebCore::FlexLayoutUtils::flexBasisForFlexItem const):\n(WebCore::FlexLayoutUtils::alignmentForFlexItem const):\n(WebCore::FlexLayoutUtils::hasStretchedFlexItemWithAspectRatio const):\n(WebCore::FlexLayoutUtils::hasDefiniteCrossSizeForFlexItem const):\n(WebCore::FlexLayoutUtils::contentAlignmentNormalBehavior):\n(WebCore::FlexLayoutUtils::resolveLeftRightAlignment):\n(WebCore::FlexLayoutUtils::initialJustifyContentOffset):\n(WebCore::FlexLayoutUtils::justifyContentSpaceBetweenFlexItems):\n(WebCore::FlexLayoutUtils::alignmentOffset):\n(WebCore::FlexLayoutUtils::contentAlignmentStartOverflow):\n(WebCore::FlexLayoutUtils::initialAlignContentOffset):\n(WebCore::FlexLayoutUtils::alignContentSpaceBetweenFlexItems):\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::flexContainerIsHorizontalFlow):\n(WebCore::RenderFlexibleBox::computeIntrinsicLogicalWidths const):\n(WebCore::RenderFlexibleBox::ScopedCrossAxisOverrideForFlexItem::ScopedCrossAxisOverrideForFlexItem):\n(WebCore::RenderFlexibleBox::firstLineBaseline const):\n(WebCore::RenderFlexibleBox::lastLineBaseline const):\n(WebCore::RenderFlexibleBox::distributeMainAxisFreeSpaceForMultilineColumnIfNeeded):\n(WebCore::RenderFlexibleBox::flexItemIntrinsicLogicalHeight const):\n(WebCore::RenderFlexibleBox::flexItemIntrinsicLogicalWidth):\n(WebCore::RenderFlexibleBox::crossAxisIntrinsicExtentForFlexItem):\n(WebCore::RenderFlexibleBox::mainAxisAvailableSpace):\n(WebCore::RenderFlexibleBox::computeMainAxisExtentForFlexItem):\n(WebCore::RenderFlexibleBox::initializeMarginTrimState):\n(WebCore::RenderFlexibleBox::canFitItemWithTrimmedMarginEnd const):\n(WebCore::RenderFlexibleBox::removeMarginEndFromFlexSizes const):\n(WebCore::RenderFlexibleBox::isChildEligibleForMarginTrim const):\n(WebCore::RenderFlexibleBox::trimMainAxisMarginStart):\n(WebCore::RenderFlexibleBox::trimMainAxisMarginEnd):\n(WebCore::RenderFlexibleBox::trimCrossAxisMarginStart):\n(WebCore::RenderFlexibleBox::trimCrossAxisMarginEnd):\n(WebCore::RenderFlexibleBox::computeMainSizeFromAspectRatioUsing const):\n(WebCore::RenderFlexibleBox::setFlowAwareLocationForFlexItem):\n(WebCore::RenderFlexibleBox::canComputePercentageFlexBasis):\n(WebCore::RenderFlexibleBox::flexItemMainSizeIsDefinite):\n(WebCore::RenderFlexibleBox::flexItemHasComputableAspectRatioAndCrossSizeIsConsideredDefinite):\n(WebCore::RenderFlexibleBox::flexItemCrossSizeIsDefinite):\n(WebCore::RenderFlexibleBox::flexBaseSizeForFlexItem):\n(WebCore::RenderFlexibleBox::performFlexLayout):\n(WebCore::RenderFlexibleBox::computeMainSizeForFlexItems):\n(WebCore::RenderFlexibleBox::trimCrossAxisMarginsForFlexItems):\n(WebCore::RenderFlexibleBox::handleMainAxisAlignment):\n(WebCore::RenderFlexibleBox::setFlexItemCountsForFirstAndLastLine):\n(WebCore::RenderFlexibleBox::computeNextFlexLine):\n(WebCore::RenderFlexibleBox::autoMarginOffsetInMainAxis):\n(WebCore::RenderFlexibleBox::updateAutoMarginsInMainAxis):\n(WebCore::RenderFlexibleBox::updateAutoMarginsInCrossAxis):\n(WebCore::RenderFlexibleBox::prepareOrderIteratorAndMargins):\n(WebCore::RenderFlexibleBox::computeUsedMaxMainSize):\n(WebCore::RenderFlexibleBox::computeUsedNonAutoMinMainSize):\n(WebCore::RenderFlexibleBox::computeContentBasedMinMainSize):\n(WebCore::RenderFlexibleBox::computeFlexItemMinMaxMainSizes):\n(WebCore::RenderFlexibleBox::canUseFlexItemForPercentageResolution):\n(WebCore::RenderFlexibleBox::adjustFlexItemSizeForAspectRatioCrossAxisMinAndMax):\n(WebCore::RenderFlexibleBox::ensureBlockAxisContentSizeForFlexItemIfNeeded):\n(WebCore::RenderFlexibleBox::setOverridingMainSizeForFlexItem):\n(WebCore::RenderFlexibleBox::staticMainAxisPositionForPositionedFlexItem):\n(WebCore::RenderFlexibleBox::staticCrossAxisPositionForPositionedFlexItem):\n(WebCore::RenderFlexibleBox::staticInlinePositionForPositionedFlexItem):\n(WebCore::RenderFlexibleBox::staticBlockPositionForPositionedFlexItem):\n(WebCore::RenderFlexibleBox::prepareFlexItemForPositionedLayout):\n(WebCore::RenderFlexibleBox::resetAutoMarginsAndLogicalTopInCrossAxis):\n(WebCore::RenderFlexibleBox::willStretchItem const):\n(WebCore::RenderFlexibleBox::flexBaseSizeNeedsBlockAxisContentSize):\n(WebCore::RenderFlexibleBox::crossSizeForFlexLines):\n(WebCore::RenderFlexibleBox::placeFlexItems):\n(WebCore::RenderFlexibleBox::layoutFlexItemAfterMainSizing):\n(WebCore::RenderFlexibleBox::layoutColumnReverse):\n(WebCore::RenderFlexibleBox::handleCrossAxisAlignmentForFlexLines):\n(WebCore::RenderFlexibleBox::computeCrossSizeForFlexItems):\n(WebCore::RenderFlexibleBox::handleCrossAxisAlignmentForFlexItems):\n(WebCore::RenderFlexibleBox::performBaselineAlignment):\n(WebCore::RenderFlexibleBox::applyStretchMinMaxCrossSize):\n(WebCore::RenderFlexibleBox::applyStretchAlignmentToFlexItem):\n(WebCore::RenderFlexibleBox::computeGap const):\n(WebCore::RenderFlexibleBox::firstBaselineCandidateOnLine const):\n(WebCore::RenderFlexibleBox::lastBaselineCandidateOnLine const):\n(WebCore::RenderFlexibleBox::flexItemForFirstBaseline const):\n(WebCore::RenderFlexibleBox::flexItemForLastBaseline const):\n(WebCore::contentAlignmentNormalBehavior): Deleted.\n(WebCore::RenderFlexibleBox::mainAxisIsFlexItemInlineAxis const): Deleted.\n(WebCore::RenderFlexibleBox::isColumnFlow const): Deleted.\n(WebCore::RenderFlexibleBox::isColumnOrRowReverse const): Deleted.\n(WebCore::RenderFlexibleBox::isWrapReverse const): Deleted.\n(WebCore::RenderFlexibleBox::isHorizontalFlow const): Deleted.\n(WebCore::RenderFlexibleBox::isLeftToRightFlow const): Deleted.\n(WebCore::RenderFlexibleBox::crossAxisDirection const): Deleted.\n(WebCore::RenderFlexibleBox::isMultiline const): Deleted.\n(WebCore::RenderFlexibleBox::useContentBasedMinimumSize const): Deleted.\n(WebCore::RenderFlexibleBox::useContentBasedMinimumBlockSize const): Deleted.\n(WebCore::RenderFlexibleBox::flexBasisForFlexItem const): Deleted.\n(WebCore::RenderFlexibleBox::crossAxisExtentForFlexItem const): Deleted.\n(WebCore::RenderFlexibleBox::mainAxisExtentForFlexItem const): Deleted.\n(WebCore::RenderFlexibleBox::mainAxisContentExtentForFlexItemIncludingScrollbar const): Deleted.\n(WebCore::RenderFlexibleBox::crossAxisExtent const): Deleted.\n(WebCore::RenderFlexibleBox::mainAxisExtent const): Deleted.\n(WebCore::RenderFlexibleBox::crossAxisContentExtent const): Deleted.\n(WebCore::RenderFlexibleBox::columnInnerMainSize): Deleted.\n(WebCore::isSVGRootWithIntrinsicAspectRatio): Deleted.\n(WebCore::flexItemHasAspectRatio): Deleted.\n(WebCore::RenderFlexibleBox::hasStretchedFlexItemWithAspectRatio const): Deleted.\n(WebCore::RenderFlexibleBox::transformedBlockFlowDirection const): Deleted.\n(WebCore::RenderFlexibleBox::flowAwareBorderStart const): Deleted.\n(WebCore::RenderFlexibleBox::flowAwareBorderEnd const): Deleted.\n(WebCore::RenderFlexibleBox::flowAwareBorderBefore const): Deleted.\n(WebCore::RenderFlexibleBox::flowAwareBorderAfter const): Deleted.\n(WebCore::RenderFlexibleBox::flowAwarePaddingStart const): Deleted.\n(WebCore::RenderFlexibleBox::flowAwarePaddingEnd const): Deleted.\n(WebCore::RenderFlexibleBox::flowAwarePaddingBefore const): Deleted.\n(WebCore::RenderFlexibleBox::flowAwarePaddingAfter const): Deleted.\n(WebCore::RenderFlexibleBox::flowAwareMarginStartForFlexItem const): Deleted.\n(WebCore::RenderFlexibleBox::flowAwareMarginEndForFlexItem const): Deleted.\n(WebCore::RenderFlexibleBox::flowAwareMarginBeforeForFlexItem const): Deleted.\n(WebCore::RenderFlexibleBox::mainAxisMarginExtentForFlexItem const): Deleted.\n(WebCore::RenderFlexibleBox::crossAxisMarginExtentForFlexItem const): Deleted.\n(WebCore::RenderFlexibleBox::shouldTrimMainAxisMarginStart const): Deleted.\n(WebCore::RenderFlexibleBox::shouldTrimMainAxisMarginEnd const): Deleted.\n(WebCore::RenderFlexibleBox::shouldTrimCrossAxisMarginStart const): Deleted.\n(WebCore::RenderFlexibleBox::shouldTrimCrossAxisMarginEnd const): Deleted.\n(WebCore::RenderFlexibleBox::crossAxisScrollbarExtent const): Deleted.\n(WebCore::RenderFlexibleBox::mainAxisScrollbarExtent const): Deleted.\n(WebCore::RenderFlexibleBox::preferredCrossSizeLengthForFlexItem const): Deleted.\n(WebCore::RenderFlexibleBox::minCrossSizeLengthForFlexItem const): Deleted.\n(WebCore::RenderFlexibleBox::maxCrossSizeLengthForFlexItem const): Deleted.\n(WebCore::RenderFlexibleBox::preferredMainSizeLengthForFlexItem const): Deleted.\n(WebCore::RenderFlexibleBox::minMainSizeLengthForFlexItem const): Deleted.\n(WebCore::RenderFlexibleBox::maxMainSizeLengthForFlexItem const): Deleted.\n(WebCore::RenderFlexibleBox::preferredAspectRatioForFlexItem const): Deleted.\n(WebCore::RenderFlexibleBox::flexItemHasComputableAspectRatio const): Deleted.\n(WebCore::canResolveFullyConstrainedLogicalHeight): Deleted.\n(WebCore::RenderFlexibleBox::hasDefiniteCrossSizeForFlexItem const): Deleted.\n(WebCore::RenderFlexibleBox::hasDefiniteLogicalWidthForAspectRatioCrossSize const): Deleted.\n(WebCore::RenderFlexibleBox::hasAutoMarginsInCrossAxis const): Deleted.\n(WebCore::RenderFlexibleBox::availableAlignmentSpaceForFlexItem): Deleted.\n(WebCore::RenderFlexibleBox::marginBoxAscentForFlexItem): Deleted.\n(WebCore::RenderFlexibleBox::computeFlexItemMarginValue): Deleted.\n(WebCore::resolveLeftRightAlignment): Deleted.\n(WebCore::initialJustifyContentOffset): Deleted.\n(WebCore::justifyContentSpaceBetweenFlexItems): Deleted.\n(WebCore::alignmentOffset): Deleted.\n(WebCore::RenderFlexibleBox::innerCrossSizeForFlexItem const): Deleted.\n(WebCore::RenderFlexibleBox::overflowAlignmentForFlexItem const): Deleted.\n(WebCore::RenderFlexibleBox::alignmentForFlexItem const): Deleted.\n(WebCore::RenderFlexibleBox::needToStretchFlexItemLogicalHeight const): Deleted.\n(WebCore::RenderFlexibleBox::mainAxisOverflowForFlexItem const): Deleted.\n(WebCore::RenderFlexibleBox::crossAxisOverflowForFlexItem const): Deleted.\n(WebCore::contentAlignmentStartOverflow): Deleted.\n(WebCore::initialAlignContentOffset): Deleted.\n(WebCore::alignContentSpaceBetweenFlexItems): Deleted.\n(WebCore::RenderFlexibleBox::leftRightAxisDirectionFromStyle): Deleted.\n* Source/WebCore/rendering/RenderBlock.cpp:\n(WebCore::RenderBlock::computeContentLogicalHeightForFlexItem):\n(WebCore::RenderBlock::hasDefiniteLogicalHeightForPercentageResolutionFromStyle const):\n(WebCore::RenderBlock::availableLogicalHeightForPercentageComputation const):\n* Source/WebCore/rendering/RenderBlockFlow.cpp:\n(WebCore::formattingContextRootIntrinsicLogicalWidthsDependOnOwnHeight):\n* Source/WebCore/rendering/RenderBox.cpp:\n(WebCore::RenderBox::computeSizingKeywordLogicalContentHeightUsingGeneric const):\n(WebCore::RenderBox::computeContentAndScrollbarLogicalHeightUsing const):\n(WebCore::RenderBox::isBlockSizeResolvableForStretch const):\n(WebCore::RenderBox::shouldIgnoreLogicalMinMaxWidthSizes const):\n(WebCore::RenderBox::shouldIgnoreLogicalMinMaxHeightSizes const):\n\nCanonical link: https://commits.webkit.org/317013@main",
      "email": "zalan@apple.com",
      "hash": "771900ea31d0c678704adfbc03b5e895ebe22e29",
      "subject": "[cleanup] Move RenderFlexibleBox's stateless flex queries and geometry helpers into a new FlexLayoutUtils class"
    },
    "317014@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317014@main",
      "clUrl": "https://commits.webkit.org/317014@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319207\nrdar://182059570\n\nReviewed by Taher Ali.\n\nMerge: https://chromium-review.googlesource.com/c/chromium/src/+/1937067\n\nSVGSMILElement::resolveInterval() and seekToIntervalCorrespondingToTime()\neach drive an unbounded `while (true)` loop whose termination depends\nentirely on the begin/end instance-time lists advancing on every pass.\nA malformed or non-advancing time list can therefore spin these loops\nindefinitely, pinning the main thread (see the equivalent Blink hang,\ncrbug.com/1021630).\n\nDefensively bound both walks with an iteration cap of\nmax(m_beginTimes.size() * 4, 1000000) -- matching Blink's kMaxIterations\n-- then ASSERT_NOT_REACHED() and fall out gracefully on overflow:\nresolveInterval() leaves the interval unresolved and\nseekToIntervalCorrespondingToTime() stops seeking at the current\ninterval.\n\nThe cap is deliberately loose so no valid content can ever reach it:\n  - m_beginTimes.size() * 4 scales the bound with the actual input. A\n    legitimate walk advances about one iteration per begin instance time,\n    plus a small constant multiple for the end-time refinement retries;\n    4x leaves headroom over that.\n  - 1000000 is an absolute floor. When the begin list is small or empty,\n    size * 4 would be tiny (or 0) and could false-positive on walks\n    driven by dynamically-added or event-based instance times that are\n    not reflected in m_beginTimes.size(). The 1M floor guarantees a large\n    ceiling regardless of list size.\n\nNo behavior change for valid animations; no new tests since the bound is\nunreachable by well-formed timing input.\n\n* Source/WebCore/svg/animation/SVGSMILElement.cpp:\n(WebCore::SVGSMILElement::resolveInterval):\n(WebCore::SVGSMILElement::seekToIntervalCorrespondingToTime):\n\nCanonical link: https://commits.webkit.org/317014@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "37384dc63e5df1d8d5e2a6609b3998ae351ce2b5",
      "subject": "Add iteration bounds to SVGSMILElement interval-resolution loops to prevent potential hangs"
    },
    "317015@main": {
      "author": "Ben Nham",
      "avatar": "https://www.gravatar.com/avatar/dc0914eabf69047ee3397794c2d17bf7?d=identicon\u0026s=64",
      "cl": "317015@main",
      "clUrl": "https://commits.webkit.org/317015@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319209\nrdar://182063896\n\nReviewed by Chris Dumez.\n\nWhen sending the com.apple.WebKit.logFrameTrees notifyd notification, oftentimes it takes a long\ntime (on the order of seconds) to dump the frame tree to the system log. This is because\nWebPageProxy::logFrameTree currently calls getAllFrames, which requires sending an async IPC with\nreply handler to all frames in the page, some of which might be hosted in processes running at very\nlow priority. This is unnecessary; instead, we should just walk the frame tree on the UIProcess side\ninstead and avoid the WebContent round trip.\n\nThis is important because we emit these notifications (with a timeout) as part of our memory\nbenchmarks, and without the frame tree it becomes much harder to understand how memory regressions\nare distributed to various frame processes.\n\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::logFrameTreeHelper):\n(WebKit::WebPageProxy::logFrameTree):\n(WebKit::logFrameTreeRoot): Deleted.\n\nCanonical link: https://commits.webkit.org/317015@main",
      "email": "nham@apple.com",
      "hash": "5ad829657f5f1cbec32467fb78be2fcd917a447d",
      "subject": "Avoid unnecessary WebContent IPC when logging frame trees"
    },
    "317016@main": {
      "author": "Wenson Hsieh",
      "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64",
      "cl": "317016@main",
      "clUrl": "https://commits.webkit.org/317016@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319201\nrdar://182054863\n\nReviewed by Richard Robinson.\n\nLeverage the existing `looksVisuallyClickable` heuristic to append a `clickable` token next to\nextracted elements — in particular, images and `svg` elements that might not seem immediately\ninteractive to an agent.\n\n* LayoutTests/fast/text-extraction/debug-text-extraction-basic-expected.txt:\n* LayoutTests/fast/text-extraction/debug-text-extraction-basic.html:\n* Source/WebCore/page/text-extraction/TextExtraction.cpp:\n(WebCore::TextExtraction::extractRecursive):\n* Source/WebCore/page/text-extraction/TextExtractionTypes.h:\n* Source/WebKit/Shared/TextExtractionToStringConversion.cpp:\n(WebKit::addPartsForItem):\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n\nCanonical link: https://commits.webkit.org/317016@main",
      "email": "wenson_hsieh@apple.com",
      "hash": "7c094a16ad8e0d53fcd6ad7966243f928032f540",
      "subject": "[Text Extraction] Append a `clickable` token next to images, SVGs and other containers that look visually clickable"
    },
    "317017@main": {
      "author": "Claudio Saavedra",
      "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64",
      "cl": "317017@main",
      "clUrl": "https://commits.webkit.org/317017@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319221\n\nUnreviewed test gardening.\n\n* Tools/TestWebKitAPI/glib/TestExpectations.json:\n\nCanonical link: https://commits.webkit.org/317017@main",
      "email": "csaavedra@igalia.com",
      "hash": "e1c753467571254a0d5c1918a6e5a9865e825394",
      "subject": "[GTK][WPE] WTF_GUniquePtr.Basic fails in Debug"
    },
    "317018@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317018@main",
      "clUrl": "https://commits.webkit.org/317018@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318575\nrdar://181342988\n\nReviewed by Chris Dumez.\n\nsmallestNodeGreaterThanFrom() is meant to find the interval with the\nsmallest low endpoint strictly greater than the query point. The tree is\na binary search tree keyed by low endpoint, so when the point is below a\nnode's low, the node is a candidate but a still-smaller candidate can\nonly live in its left subtree. The code recursed into node-\u003eright()\ninstead — whose lows are all \u003e= node.low and therefore never smaller —\nso it overshot and returned a farther-following interval (or none). The\nlocal was even named \"left\", confirming the intent.\n\nThis backs nextIntervalAfter(), used by HTMLMediaElement for next-text-\ntrack-cue selection, so the wrong cue could be chosen.\n\nRecurse into node-\u003eleft().\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/PODIntervalTree.cpp\n\n* Source/WebCore/platform/PODIntervalTree.h:\n* Tools/TestWebKitAPI/CMakeLists.txt:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebCore/PODIntervalTree.cpp: Added.\n(TestWebKitAPI::TEST(PODIntervalTree, NextIntervalAfterReturnsNearestFollowing)):\n(TestWebKitAPI::TEST(PODIntervalTree, NextIntervalAfterMatchesBruteForce)):\n\nCanonical link: https://commits.webkit.org/317018@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "12ad3756dfcfcd9bf05eb81f17b803b9b2a6f041",
      "subject": "PODIntervalTree::nextIntervalAfter can return a non-nearest following interval"
    },
    "317019@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317019@main",
      "clUrl": "https://commits.webkit.org/317019@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319186\nrdar://182035131\n\nReviewed by Chris Dumez.\n\nWhen cancelAndHoldAtTime() splits a SetValueCurve, it inserts a\nreplacement curve event and then a trailing SetValue event. The second\ninsertEvent() call ignored its own result and re-checked the already-\nvalidated result from the first insert, so any exception from the\nsecond insert would be silently swallowed.\n\nCapture and check the second insert's own result.\n\nNo new tests: the trailing SetValue lands exactly at the truncated\ncurve's end (a non-overlap) with all later events already removed, so\nthe second insert cannot throw today. This is a latent correctness fix,\nnot a web-observable bug.\n\n* Source/WebCore/Modules/webaudio/AudioParamTimeline.cpp:\n(WebCore::AudioParamTimeline::cancelAndHoldAtTime):\n\nCanonical link: https://commits.webkit.org/317019@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "050117b8ea1118fbd13e6fa410bbd723ec2bf972",
      "subject": "AudioParamTimeline::cancelAndHoldAtTime discards exception from second insertEvent"
    },
    "317020@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317020@main",
      "clUrl": "https://commits.webkit.org/317020@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318316\nrdar://181103911\n\nReviewed by Chris Dumez.\n\nThe queued task in DocumentFullscreen::requestFullscreen already bails out\nwhen m_pendingFullscreenElement no longer matches the requested element,\nwith a dedicated error message. The hidden-document guard re-tested the\nsame condition as an OR'd disjunct, but nothing between the two checks\nmutates m_pendingFullscreenElement, so the disjunct can never be the reason\nthat branch is taken. It would also have reported the wrong error. Drop it.\n\n* Source/WebCore/dom/DocumentFullscreen.cpp:\n(WebCore::DocumentFullscreen::requestFullscreen):\n\nCanonical link: https://commits.webkit.org/317020@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "d37346b67647056a67cd1d2e00d280cd4c2ae608",
      "subject": "Remove redundant pending-fullscreen-element re-check in requestFullscreen"
    },
    "317021@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317021@main",
      "clUrl": "https://commits.webkit.org/317021@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319152\nrdar://181975594\n\nReviewed by Chris Dumez.\n\nemitToken() took its source token by const reference and copy-assigned it\ninto the result out-parameter. Every one of its call sites passes a freshly\nconstructed temporary (WebVTTToken::StringToken(), StartTag(), EndTag(),\nTimestampTag()), so the copy performed three needless atomic reference-count\nbumps per emitted token (one String plus two AtomStrings) on a value that is\nimmediately discarded.\n\nTake the token by rvalue reference and move-assign it instead. No behavior\nchange.\n\n* Source/WebCore/html/track/WebVTTTokenizer.cpp:\n(WebCore::emitToken):\n\nCanonical link: https://commits.webkit.org/317021@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "5c1e6bce7262a1717c3e33b20e3af11b24935480",
      "subject": "[WebVTT] Move WebVTTToken into the out-parameter in WebVTTTokenizer::emitToken instead of copying"
    },
    "317022@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317022@main",
      "clUrl": "https://commits.webkit.org/317022@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318203\nrdar://181006923\n\nReviewed by Chris Dumez.\n\nHTMLFrameSetElement::attributeChanged() mishandled state-clearing for three cases:\n\n- frameborder=\"yes\"/\"1\" set m_frameborderSet but never set m_frameborder back to\n  true, so toggling frameborder from \"no\" to \"yes\" left the border disabled.\n- Removing the frameborder attribute forced m_frameborder to false instead of\n  restoring the constructor default (true), so removal was not equivalent to\n  never having set the attribute.\n- The noresize case unconditionally set m_noresize to true, so removing the\n  attribute never cleared it (this had an explicit FIXME).\n\nAdditionally, neither the frameborder nor noresize cases invalidated style, so\neven corrected state was not reflected until an unrelated relayout. Invalidate\nthe subtree on these changes (matching the existing rows/cols handling), which\nalso resolves the \"Do we need to trigger repainting?\" FIXME for frameborder.\n\nTests: fast/frames/frameset-frameborder-dynamic-update.html\n       fast/frames/frameset-noresize-removal-allows-resize.html\n\n* LayoutTests/fast/frames/frameset-frameborder-dynamic-update-expected.txt: Added.\n* LayoutTests/fast/frames/frameset-frameborder-dynamic-update.html: Added.\n* LayoutTests/fast/frames/frameset-noresize-removal-allows-resize-expected.txt: Added.\n* LayoutTests/fast/frames/frameset-noresize-removal-allows-resize.html: Added.\n* Source/WebCore/html/HTMLFrameSetElement.cpp:\n(WebCore::HTMLFrameSetElement::attributeChanged):\n\n\u003e Platform Specific Expectation:\n* LayoutTests/platform/ios/TestExpectations: no resize on iOS\n\nCanonical link: https://commits.webkit.org/317022@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "dc6b015add557d1588de0ee477c8ea011871ce51",
      "subject": "HTMLFrameSetElement does not correctly update frameborder/noresize state on dynamic attribute changes"
    },
    "317023@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317023@main",
      "clUrl": "https://commits.webkit.org/317023@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319216\nrdar://182074693\n\nReviewed by Chris Dumez.\n\nReplace a hand-rolled linear-scan loop over m_info.objectStores() with\nVector::contains(), declare the `found` result next to its only use, and\ndrop the redundant `!info` check from the scoping condition (the early\nreturn above already guarantees `info` is non-null).\n\nNo behavior change.\n\n* Source/WebCore/Modules/indexeddb/IDBTransaction.cpp:\n(WebCore::IDBTransaction::objectStore):\n\nCanonical link: https://commits.webkit.org/317023@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "443548189a54f226bb364dc7a99f4bd2c256175f",
      "subject": "Simplify object-store lookup in IDBTransaction::objectStore()"
    },
    "317024@main": {
      "author": "Vitaly Dyachkov",
      "avatar": "https://www.gravatar.com/avatar/ab950c52088e289585a5a01580ec66a4?d=identicon\u0026s=64",
      "cl": "317024@main",
      "clUrl": "https://commits.webkit.org/317024@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318436\n\nReviewed by Charlie Wolfe and Rupin Mittal.\n\nAdd missing `mayBlockNetworkRequest`, `globalPrivacyControlStatus`,\n`shouldConsiderEnhancedSecurityForInsecureResponse`, and\n`shouldBlockThirdPartyStorage` to `resourceLoadParameters` object.\n\nWith all these properties present, the test was crashing in debug builds\nin `NetworkProcess::allowsFirstPartyForCookies()` at\n`ASSERT(result || terminateOrDisallow == AllowCookieAccess::Disallow);`\n\nIt seems like this assertion is triggered on the exact case this test is\ntesting and can be dropped.\n\n* LayoutTests/ipc/loadping-firstpartyforcookies-message-check.html:\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebKit/NetworkProcess/NetworkProcess.cpp:\n(WebKit::NetworkProcess::allowsFirstPartyForCookies):\n\nCanonical link: https://commits.webkit.org/317024@main",
      "email": "vitaly@igalia.com",
      "hash": "9841b6f9f3840e5dc86f5d1097b73b929953be7b",
      "subject": "`ipc/loadping-firstpartyforcookies-message-check.html` is constant failure with assertions enabled"
    },
    "317025@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317025@main",
      "clUrl": "https://commits.webkit.org/317025@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319220\nrdar://182075330\n\nReviewed by Chris Dumez.\n\npreviousChildRenderer (8-byte pointer) sat between two bools, forcing\nalignment padding that inflated Parent to 72 bytes. Hoisting it above\nboth bools packs them adjacently, shrinking Parent to 64 bytes. Parent\nis stored one-per-DOM-depth in m_parentStack. No behavior change.\n\n* Source/WebCore/rendering/updating/RenderTreeUpdater.h:\n\nCanonical link: https://commits.webkit.org/317025@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "68b87b73c9339e3ee4dc20bc7d3dee1d2e396647",
      "subject": "Reorder RenderTreeUpdater::Parent fields to eliminate struct padding"
    },
    "317026@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317026@main",
      "clUrl": "https://commits.webkit.org/317026@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319222\nrdar://182075709\n\nReviewed by Chris Dumez.\n\nSQLiteIDBBackingStore::getCount() writes the record count into a\nuint64_t out-parameter, and SQLite's COUNT(*) is a 64-bit integer,\nbut the result was read with columnInt(), which returns a 32-bit int.\nA count above INT_MAX would be truncated (and sign-extended into a\nbogus large value). Read the column with columnInt64() instead,\nmatching uncheckedGetKeyGeneratorValue() just below it.\n\nNo new tests; triggering truncation requires more than 2^31 records\nin a single object store, which is not practical to exercise in a\ntest.\n\n* Source/WebCore/Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:\n(WebCore::IDBServer::SQLiteIDBBackingStore::getCount):\n\nCanonical link: https://commits.webkit.org/317026@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "986e5185e1c1450f95dd8746a3c2a63d8cd40a86",
      "subject": "IndexedDB getCount() truncates record counts above INT_MAX"
    },
    "317027@main": {
      "author": "Antoine Quint",
      "avatar": "https://www.gravatar.com/avatar/9b3ef1e754f8d994f21ff67c660cbbe6?d=identicon\u0026s=64",
      "cl": "317027@main",
      "clUrl": "https://commits.webkit.org/317027@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319205\nrdar://182058011\n\nReviewed by Tim Nguyen.\n\nThe animation-triggers spec adds two properties: `timeline-trigger-active-range-start` and\n`timeline-trigger-active-range-end`.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/rendering/widgets/shadow-dom-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/parsing/timeline-trigger-active-range-end-valid.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/parsing/timeline-trigger-active-range-end.computed.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/parsing/timeline-trigger-active-range-shorthand.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/parsing/timeline-trigger-active-range-start-computed.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/parsing/timeline-trigger-active-range-start-valid.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/parsing/timeline-trigger-shorthand.tentative-expected.txt:\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:\n* Source/WebCore/css/CSSProperties.json:\n* Source/WebCore/style/values/animation-triggers/StyleTimelineTrigger.cpp:\n(WebCore::Style::operator\u003c\u003c):\n* Source/WebCore/style/values/animation-triggers/StyleTimelineTrigger.h:\n(WebCore::Style::TimelineTrigger::initialActiveRangeStart):\n(WebCore::Style::TimelineTrigger::initialActiveRangeEnd):\n\nCanonical link: https://commits.webkit.org/317027@main",
      "email": "graouts@webkit.org",
      "hash": "d22036590f6a0a2236769eefefcd3d14f5ff8723",
      "subject": "[animation-triggers] add parsing support for the `timeline-trigger-active-range-start` and `timeline-trigger-active-range-end` properties"
    },
    "317028@main": {
      "author": "senstella",
      "avatar": "https://www.gravatar.com/avatar/7608275e98f614de67bec58b3d4a14d3?d=identicon\u0026s=64",
      "cl": "317028@main",
      "clUrl": "https://commits.webkit.org/317028@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319167\n\nReviewed by Carlos Garcia Campos.\n\nThis ensures the BitmapTexture has the correct layout depending on the Skia colorType for Skia compositing path. I haven't added new tests since the failure seems to be driver/HW specific in compositing/patterns/direct-pattern-compositing*.html.\n\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferNativeImage.cpp:\n(WebCore::CoordinatedPlatformLayerBufferNativeImage::tryEnsureBuffer): Correctly set UseBGRALayout\n\nCanonical link: https://commits.webkit.org/317028@main",
      "email": "senstella01@gmail.com",
      "hash": "f4f99cc9a7245a263db86d0c59eb32e558ab5289",
      "subject": "[GTK][WPE] CoordinatedPlatformLayerBufferNativeImage::tryEnsureBuffer creates incorrect bitmap texture layout for Skia compositing path"
    },
    "317029@main": {
      "author": "Joanne Pan",
      "avatar": "https://www.gravatar.com/avatar/5cbbf578426a0c98cb5c977ca2dd88fc?d=identicon\u0026s=64",
      "cl": "317029@main",
      "clUrl": "https://commits.webkit.org/317029@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318886\nrdar://178843535\n\nReviewed by Wenson Hsieh and Ryosuke Niwa.\n\nThe problem:\nThis is a regression from bug 308854 (rdar://171391621), which made copy\npreserve the source page's background-color on the pasted content (matching\nChrome). Multi-paragraph copy writes it onto each \u003cp\u003e; single-paragraph copy\nwrites it onto the wrapping \u003cspan\u003e. Mail's compose view renders Dark Mode with\nthe invert-lightness color filter (plus white punch-out), so the preserved\npage surface is pasted verbatim and then bands:\n- A light page surface such as #f4f5f7 misses white punch-out (only pure white\n  is punched out) and is painted as a solid band.\n- A dark-mode page surface such as #1d2125 (rgb(29, 33, 37)) inverts into a\n  light band.\n- Design-system cells specify their fill as var(--token, #fallback), so the\n  raw inline value is an unresolved variable reference rather than a color.\nWebKit's dark-mode paste fixup left all of these alone, and it happened on both\nsingle-paragraph (background on an inline \u003cspan\u003e) and multi-paragraph pastes.\n\nThe fix:\nIn ReplaceSelectionCommand's dark-mode paste fixup (collectStylesToRemove),\nwhen pasting into an editor that punches out white backgrounds in Dark Mode,\ndrop a pasted element's background-color when it is a canvas-like page surface:\nopaque, non-semantic, and either light (lightness \u003e 0.6) or a near-black\nneutral (lightness \u003c 0.2 with low saturation). This applies regardless of\nwhether the element is block-level or inline, so the surface is shed whether\nthe caused-by placed it on a multi-paragraph \u003cp\u003e or a single-paragraph wrapping\n\u003cspan\u003e. Saturated status colors (green/red/blue lozenges) survive via the\nsaturation check; translucent and semantic colors are kept. Pure white is left\nto the editor's existing white punch-out (compositeOperatorForBackgroundColor\nreturns DestinationIn/Out), so it is not dropped here.\n\nBecause a cell's fill may be a var() reference that propertyAsColor resolves to\nan invalid color, the used color is read from the render style\n(visitedDependentBackgroundColor) when the inline value is absent or invalid.\n\nThe light threshold reuses the constant already used a few functions up for the\ninvert-lightness legibility check (isLightEnoughToTreatAsBackground), so #f4f5f7\n(lightness 0.96) is dropped while a status highlight like #ffc107 (0.51) is\nkept. The copy-serialization behavior from bug 308854 (and Chrome parity) is\nuntouched. This change is entirely on the paste side and only affects editors\nthat opt into punchOutWhiteBackgroundsInDarkMode.\n\nNote: comparing against documentBackgroundColor() does not work here because it\napplies the color filter, so in an invert-lightness editor the canvas reads\ndark while the pasted color is raw. lightness() is used (rather than luminance())\nto stay consistent with the neighboring heuristic; if we later switch from\nlightness() to luminance(), both places should change together.\n\n* Source/WebCore/editing/ReplaceSelectionCommand.cpp:\n(WebCore::isLightEnoughToTreatAsBackground): Added; shared lightness threshold.\n(WebCore::isLightOrDarkNeutralBackgroundColor): Added; light, or near-black neutral, page surface.\n(WebCore::nodeTreeHasInlineStyleWithLegibleColorForInvertLightness): Use the shared threshold.\n(WebCore::collectStylesToRemove): Drop canvas-like backgrounds when pasting into a punch-out dark editor, resolving var() fills via the render style.\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/PasteHTML.mm:\n(TEST(PasteHTML, DropsCanvasLikeBackgroundWhenPastingIntoPunchOutEditor)): Added.\n* LayoutTests/editing/pasteboard/paste-canvas-background-dark-mode.html: Added; covers light/var()/near-black surfaces on block and inline, pure-white punch-out, translucency, boundaries, and kept status colors.\n* LayoutTests/editing/pasteboard/paste-canvas-background-dark-mode-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/317029@main",
      "email": "jpan0917@gmail.com",
      "hash": "ad620275e07cc44aee2bcd5cce7855ed78808e39",
      "subject": "Pasting Confluence content is rendered incorrectly if in Dark Mode"
    },
    "317030@main": {
      "author": "Carlos Garcia Campos",
      "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64",
      "cl": "317030@main",
      "clUrl": "https://commits.webkit.org/317030@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315826\n\nReviewed by Nikolas Zimmermann.\n\nFor axis aligned, not scaled and integer translated transforms, nearest\nand linear do the same, so we can keep nearest to avoid the sampling\noptions switch that will cause a new batch.\n\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayerImageSetBatch.cpp:\n(WebCore::SkiaCompositingLayerImageSetBatch::imageRequiresLinearSampling const):\n(WebCore::SkiaCompositingLayerImageSetBatch::addImage):\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayerImageSetBatch.h:\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.cpp:\n(WebCore::SkiaCompositingLayer::paintContents):\n\nCanonical link: https://commits.webkit.org/317030@main",
      "email": "cgarcia@igalia.com",
      "hash": "3fe2ab64c405b4694829ba42aa6cf263b617e863",
      "subject": "[GTK][WPE] Skia Compositor: do not use linear interpolation when not needed"
    },
    "317031@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "317031@main",
      "clUrl": "https://commits.webkit.org/317031@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318584\n\nReviewed by Antti Koivisto.\n\nAfter the FlexLayoutUtils extraction the remaining functions in RenderFlexibleBox\nwere in no particular order -- sizing helpers, pipeline phases, margin-trim,\nstretch, and baseline code were interleaved. Reorder both the header declarations\nand the .cpp definitions into the same layout-execution grouping: nested types,\nthen constructors/overrides/public API, then the performFlexLayout pipeline in\nrun order, then flex-base and main-size sizing, cross/intrinsic sizing,\ndefiniteness/percentage resolution, margin trim, auto margins, cross-axis stretch\nand overriding sizes, geometry apply, baseline, percent-height descendants, and\npositioned-layout helpers. Groups are separated by a blank line.\n\nNo change in behavior.\n\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n\nCanonical link: https://commits.webkit.org/317031@main",
      "email": "zalan@apple.com",
      "hash": "292c46f1ebf1737a2a7e779bc5650d96aa647158",
      "subject": "[cleanup] Group RenderFlexibleBox's member functions by layout phase"
    },
    "317032@main": {
      "author": "Adrian Perez de Castro",
      "avatar": "https://www.gravatar.com/avatar/30ffea8cf404586741a8f5f7110c0914?d=identicon\u0026s=64",
      "cl": "317032@main",
      "clUrl": "https://commits.webkit.org/317032@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317094\n\nUnreviewed.\n\n* Source/WebCore/platform/gtk/po/sl.po:\n\nCanonical link: https://commits.webkit.org/317032@main",
      "email": "aperez@igalia.com",
      "hash": "fae65f4a62029b350901558b3832a7f43a398e16",
      "subject": "[GTK] Update Slovenian (sl.po) translation"
    },
    "317033@main": {
      "author": "Philippe Normand",
      "avatar": "https://www.gravatar.com/avatar/eef27203750af3510263cc29af21a16e?d=identicon\u0026s=64",
      "cl": "317033@main",
      "clUrl": "https://commits.webkit.org/317033@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319236\n\nReviewed by Adrian Perez de Castro.\n\ngetifaddrs() allocates its result with malloc(), so freeifaddrs() should be used to release that\nmemory, not the default delete operator.\n\n* Source/WebKit/NetworkProcess/webrtc/NetworkRTCMonitor.cpp:\n(WebKit::NetworkRTCMonitor::gatherNetworkMap):\n\nCanonical link: https://commits.webkit.org/317033@main",
      "email": "philn@igalia.com",
      "hash": "a77e361a749099c015ac249d65e357b7ddd6fd49",
      "subject": "[LibWebRTC] alloc-dealloc-mismatch in NetworkRTCMonitor"
    },
    "317034@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "317034@main",
      "clUrl": "https://commits.webkit.org/317034@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319226\n\nReviewed by Keith Miller.\n\nWTFReportBacktraceWithPrefixAndStackDepth() allocates an uninitialized\nVector\u003cvoid*\u003e sized to the requested depth, then asks WTFGetBacktrace()\nto fill it. WTFGetBacktrace() writes the *actual* number of captured\nframes back into the `frames` variable, which may be smaller than the\nrequest when the real stack is shallow.\n\nThe subsequent subspan() used the originally-requested `framesToShow`\nas its length rather than the actual captured count, so when the stack\nwas shallower than requested it spanned into the uninitialized tail of\nthe Vector and printed garbage pointers as stack frames. The span stayed\nwithin the allocation, so this was an uninitialized read rather than an\nout-of-bounds access.\n\nUse `frames - kDefaultFramesToSkip` for the span length, matching the\nsibling functions WTFReportBacktraceWithPrefixAndPrintStream() and\nWTFReportBacktrace().\n\n* Source/WTF/wtf/Assertions.cpp:\n\nCanonical link: https://commits.webkit.org/317034@main",
      "email": "cdumez@apple.com",
      "hash": "340be14e845960e5700085d3baa01659ae57a31c",
      "subject": "WTFReportBacktraceWithStackDepth may print uninitialized stack frames when the captured stack is shallower than requested"
    },
    "317035@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "317035@main",
      "clUrl": "https://commits.webkit.org/317035@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319218\n\nReviewed by Carlos Garcia Campos.\n\nTurn debug threading assertions added in 316457@main for RunLoop::Timer\ninto release assertions, now that they've had some bake time. A\nviolation of these assertions in release builds could lead to security\nvulnerabilities so it is important to enforce them in release builds.\n\n* Source/WTF/wtf/RunLoop.h:\n(WTF::WTF_ASSERTS_ACQUIRED_CAPABILITY):\n* Source/WTF/wtf/cf/RunLoopCF.cpp:\n(WTF::RunLoop::TimerBase::stop):\n* Source/WTF/wtf/generic/RunLoopGeneric.cpp:\n(WTF::RunLoop::TimerBase::~TimerBase):\n(WTF::RunLoop::TimerBase::stop):\n* Source/WTF/wtf/glib/RunLoopGLib.cpp:\n(WTF::RunLoop::TimerBase::~TimerBase):\n(WTF::RunLoop::TimerBase::stop):\n* Source/WTF/wtf/win/RunLoopWin.cpp:\n(WTF::RunLoop::TimerBase::stop):\n\nCanonical link: https://commits.webkit.org/317035@main",
      "email": "cdumez@apple.com",
      "hash": "e4059d5d496e64f790a095462e087bb5594ac850",
      "subject": "Turn debug threading assertions added in 316457@main into release assertions"
    },
    "317036@main": {
      "author": "Nikolas Zimmermann",
      "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64",
      "cl": "317036@main",
      "clUrl": "https://commits.webkit.org/317036@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319203\n\nReviewed by Rob Buis.\n\nWhen painting SVG, paintChildrenInDOMOrderForSVG() set up a clip rectangle\nfor every child shape before drawing it. Each shape did its own save, clip,\nand restore, even though the clip rectangle was the same for all of them.\n\nWhen there is only one region to clip to and no child draws on its own\nlayer, we now set that clip up a single time and let every child share it.\nBoth transformed and non-transformed children use the shared clip, so the\nextra per-shape save and clip are gone.\n\nCovered by existing tests under LBSE.\n\n* Source/WebCore/rendering/RenderLayer.h:\n* Source/WebCore/rendering/RenderLayerSVGAdditions.cpp:\n(WebCore::RenderLayer::paintNonLayerChildForFragmentsForSVG):\n(WebCore::RenderLayer::paintChildrenInDOMOrderForSVG):\n\nCanonical link: https://commits.webkit.org/317036@main",
      "email": "nzimmermann@igalia.com",
      "hash": "4f7f297bd72c384b62959578b03b62182ef4a130",
      "subject": "[LBSE] Clip the SVG child-paint loop once per container instead of once per shape"
    },
    "317037@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "317037@main",
      "clUrl": "https://commits.webkit.org/317037@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319219\n\nReviewed by David Kilzer.\n\nDisable the WebThread again for iOS WebKitLegacy, now that 303102@main\nhas been fixed.\n\n* Source/WTF/wtf/PlatformEnableCocoa.h:\n\nCanonical link: https://commits.webkit.org/317037@main",
      "email": "cdumez@apple.com",
      "hash": "8acfcfaf9146d0f6c9b2a95aae28140ae3734ad6",
      "subject": "Disable the WebThread again for iOS WebKitLegacy"
    },
    "317038@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "317038@main",
      "clUrl": "https://commits.webkit.org/317038@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318587\n\nReviewed by Antti Koivisto.\n\nperformFlexLayout built each flex item's final cross-axis coordinate from three\nplaces: the position list (seeded during main-axis placement), a per-line\nlineAlignContentOffsetList, and a per-item crossItemOffsetList, summing the two\noffset arrays into the position in the final placement loop.\n\nThose arrays only existed because the position list was seeded before align-content\nand align-self were known. Have the two cross-axis alignment phases add their offsets\nstraight into the position list instead, so it becomes the single carrier of each\nitem's final in-container position (like FlexLayout's PositionAndMargins.position) and\nthe final loop just reads it.\n\nNo change in behavior: the same three addends are accumulated in the same order, and\nlineCrossOffsetList still receives its align-content fold so the wrap-reverse and\nrtl-column flips are unchanged.\n\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::performFlexLayout):\n(WebCore::RenderFlexibleBox::handleCrossAxisAlignmentForFlexLines):\n(WebCore::RenderFlexibleBox::handleCrossAxisAlignmentForFlexItems):\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n\nCanonical link: https://commits.webkit.org/317038@main",
      "email": "zalan@apple.com",
      "hash": "09a7b7874ba2ee8d29d59dbaed0df9fd398aa614",
      "subject": "[cleanup] Fold RenderFlexibleBox's cross-axis alignment offsets into the position list"
    },
    "317039@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "317039@main",
      "clUrl": "https://commits.webkit.org/317039@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319252\n\nUnreviewed. Update safer C++ expectations.\n\n* Source/WebCore/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/NoUncheckedPtrMemberCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/UncheckedCallArgsCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/UncheckedLocalVarsCheckerExpectations:\n\nCanonical link: https://commits.webkit.org/317039@main",
      "email": "rniwa@webkit.org",
      "hash": "8985b4e30671c65cad527e178d00fe2d53e702aa",
      "subject": "Update safer C++ expectations after 317013@main"
    },
    "317040@main": {
      "author": "Claudio Saavedra",
      "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64",
      "cl": "317040@main",
      "clUrl": "https://commits.webkit.org/317040@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319242\n\nReviewed by Carlos Garcia Campos.\n\nCrossfadeGeneratedImage computed its scale factor with an unguarded\nFloatSize / FloatSize division. When a cross-fade source image has an\nempty size, the divisor is zero and the resulting non-finite scale\npoisons the CTM, so every image drawn afterwards is recorded under a\nNaN/inf transform.\n\nThis was harmless until the recording started using an SkBBHFactory,\nwhose bounds pass maps each op's transform and aborts in Skia's\ncomputeFastBounds() when the rectangle is not sorted.\n\nSkip the scale when the source image or srcRect is empty, keeping the\ntransform finite.\n\nCovered by imported/blink/fast/backgrounds/bug420029.html\n\n* Source/WebCore/platform/graphics/CrossfadeGeneratedImage.cpp:\n(WebCore::drawCrossfadeSubimage):\n(WebCore::CrossfadeGeneratedImage::draw):\n\nCanonical link: https://commits.webkit.org/317040@main",
      "email": "csaavedra@igalia.com",
      "hash": "e9ba1c28e0567333b945e857e56c451268661409",
      "subject": "REGRESSION(316802@main) : imported/blink/fast/backgrounds/bug420029.html constantly crashing in Debug"
    },
    "317041@main": {
      "author": "Adrian Perez de Castro",
      "avatar": "https://www.gravatar.com/avatar/30ffea8cf404586741a8f5f7110c0914?d=identicon\u0026s=64",
      "cl": "317041@main",
      "clUrl": "https://commits.webkit.org/317041@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319245\n\nReviewed by Claudio Saavedra.\n\n* Source/ThirdParty/xdgmime/src/xdgmime.c:\n(xdg_mime_media_type_equal): The \"sep\" variable is only used for\nreading, so mark it \"const\", which is correct and also makes the\nwarning go away.\n\nCanonical link: https://commits.webkit.org/317041@main",
      "email": "aperez@igalia.com",
      "hash": "63611954a14e1aaeb06790c3d608e8031a1be8cd",
      "subject": "[GTK][WPE] GCC 15.x warns about discarded qualifier in xdgmime.c"
    },
    "317042@main": {
      "author": "Tyler Wilcock",
      "avatar": "https://www.gravatar.com/avatar/9545082e6bed96158a9f52dac6e4b869?d=identicon\u0026s=64",
      "cl": "317042@main",
      "clUrl": "https://commits.webkit.org/317042@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319170\nrdar://181036467\n\nReviewed by Chris Fleizach and Dominic Mazzoni.\n\nOn desktop-width pages that don't opt into mobile layout, Safari auto-fits the\ncontent to the device width, so the page scale is \u003c 1 on load (e.g. ~0.39) with\nno user zooming. In that state Voice Control \"show numbers\" only labelled elements\nin the top-left of the web view (e.g. BitBucket, The Verge -- not mobile-optimized\nsites like Wikipedia, whose page scale is 1).\n\nVoice Control and other ATs clip candidates to each element's visible frame, intersected\nagainst the web page's root scroll view frame. convertFrameToSpace() maps a\nframe to screen space via screenTransform, the content-to-screen page-scale --\ncorrect for element rects (content space), but the top page scroll view's own\nframe from AccessibilityScrollView::elementRect() is already view/device space\n(the viewport). Applying screenTransform double-scales it to viewport * pageScale\n(e.g. 154x334 instead of 393x852), so on-screen elements outside that shrunken\nrect were pruned.\n\nSkip screenTransform for the top page scroll view's own frame.\n\n* LayoutTests/accessibility/ios-simulator/root-scroll-view-frame-not-scaled-by-page-scale-expected.txt: Added.\n* LayoutTests/accessibility/ios-simulator/root-scroll-view-frame-not-scaled-by-page-scale.html: Added.\n* Source/WebCore/accessibility/AccessibilityObject.cpp:\n(WebCore::AccessibilityObject::convertFrameToSpace const):\n\nCanonical link: https://commits.webkit.org/317042@main",
      "email": "tyler_w@apple.com",
      "hash": "6e24445681b2ec7c2594f591da532f9c22b5617c",
      "subject": "AX: REGRESSION(308698@main): Voice Control only labels top-left web elements when the page scale isn't 1 (e.g. on desktop-width pages)"
    },
    "317043@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317043@main",
      "clUrl": "https://commits.webkit.org/317043@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=250279\nrdar://104265673\n\nReviewed by Jean-Yves Avenard.\n\nMerge: https://github.com/chromium/chromium/commit/5c31073f086be3f8c226c01d7954ea8f4d7eddaf\n\nThe computed index for negative elevations was off by one. When the\nelevation is -45 deg, the selected response corresponded to the entry\nfor 90 deg, not 315 deg, so sources below the horizon collapsed onto\nthe overhead response.\n\nTo simplify things, we use a short table to map the (positive) elevation\nangle to its index in the concatenated database.\n\nTest: imported/w3c/web-platform-tests/webaudio/the-audio-api/the-pannernode-interface/panner-hrtf-negative-elevation.html\n\n* LayoutTests/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-pannernode-interface/panner-hrtf-negative-elevation-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-pannernode-interface/panner-hrtf-negative-elevation.html: Added.\n* Source/WebCore/platform/audio/HRTFElevation.cpp:\n(WebCore::HRTFElevation::calculateKernelsForAzimuthElevation):\n\nCanonical link: https://commits.webkit.org/317043@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "963830df3d69a3a517d66705200ad497b00311bd",
      "subject": "Use correct HRTF elevation response for negative elevations"
    },
    "317044@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317044@main",
      "clUrl": "https://commits.webkit.org/317044@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318701\nrdar://181516418\n\nReviewed by Chris Dumez.\n\nWhen appending a header, appendToHeaderMap() called HTTPHeaderMap::contains(name)\nand then HTTPHeaderMap::get(name) to build the combined value. Both calls perform\nthe same resolution work -- findHTTPHeaderName() followed by a common-header probe\nor a linear scan of the uncommon headers -- so every appended header paid for two\nidentical lookups.\n\nHTTPHeaderMap::get() already returns a null String when the header is absent, and\na present header always stores a non-null value, so a single get() plus an\nisNull() check is equivalent to the contains()/get() pair. Collapse the two\nlookups into one.\n\nThe optimization relies on the invariant that a header present in the map never\nstores a null value. To guard against that invariant silently breaking, assert\nit in debug builds before relying on the isNull() check.\n\nNo change in behavior; covered by existing fetch tests.\n\n* Source/WebCore/Modules/fetch/FetchHeaders.cpp:\n(WebCore::appendToHeaderMap):\n\nCanonical link: https://commits.webkit.org/317044@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "b0d52573ef1d019347c8f3ef4d5fc95866106572",
      "subject": "FetchHeaders::appendToHeaderMap does a redundant header-map lookup on every append"
    },
    "317045@main": {
      "author": "lilly",
      "avatar": "https://www.gravatar.com/avatar/d0533d52eeb271270df480f37629a407?d=identicon\u0026s=64",
      "cl": "317045@main",
      "clUrl": "https://commits.webkit.org/317045@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318969\nrdar://181824343\n\nReviewed by Alan Baradlay.\n\nTests shapes with mixed corners and border shapes including square and notch\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-square-notch-mixed-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-square-notch-mixed-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-square-notch-mixed.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-square-notch-superellipse-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-square-notch-superellipse-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-square-notch-superellipse.html: Added.\n* LayoutTests/TestExpectations:\n\nCanonical link: https://commits.webkit.org/317045@main",
      "email": "173393835+cupidsity@users.noreply.github.com",
      "hash": "97ff5d5a62bc6ed494cd58608bdf420b7beab2ff",
      "subject": "corner-shape: Add square reftests"
    },
    "317046@main": {
      "author": "lilly",
      "avatar": "https://www.gravatar.com/avatar/d0533d52eeb271270df480f37629a407?d=identicon\u0026s=64",
      "cl": "317046@main",
      "clUrl": "https://commits.webkit.org/317046@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318968\nrdar://181822940\n\nReviewed by Simon Fraser.\n\nSpec defines square as superellipse(inf) so to account for when not all\ncorners are square, corner-shape has square special cased to return a shape\nfor that corner\n\nTests written in another commit\n\n* Source/WebCore/platform/graphics/CornerShapeUtilities.cpp:\n\nCanonical link: https://commits.webkit.org/317046@main",
      "email": "173393835+cupidsity@users.noreply.github.com",
      "hash": "ceeeec9a56272c939dad65a4e6543cec456499fa",
      "subject": "corner-shape: Add square special case"
    },
    "317047@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317047@main",
      "clUrl": "https://commits.webkit.org/317047@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319241\nrdar://182090064\n\nReviewed by Abrar Rahman Protyasha and Devin Rousso.\n\nThe `crimson` keyword was mapped to [237, 164, 61] (a dull orange)\ninstead of its correct value #DC143C ([220, 20, 60]).\n\n* Source/WebInspectorUI/UserInterface/Models/Color.js:\n\nCanonical link: https://commits.webkit.org/317047@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "aa596b0d59eba2bceb3860a9fa39207005c2caa6",
      "subject": "Web Inspector: crimson named color maps to wrong RGB value"
    },
    "317048@main": {
      "author": "Pascoe",
      "avatar": "https://www.gravatar.com/avatar/7a6e50b09dba6a185f45250268683d71?d=identicon\u0026s=64",
      "cl": "317048@main",
      "clUrl": "https://commits.webkit.org/317048@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318986\nrdar://181831723\n\nReviewed by Richard Robinson.\n\nASCredentialUpdater has been replaced by ASCredentialDataManager in\nAuthenticationServices. This updates CredentialUpdaterShim to use\nthe new class, fixing a build failure in certain configurations.\n\n* Source/WebKit/WebKitSwift/CredentialUpdaterShim.swift:\n(CredentialUpdaterShim.signalUnknownCredential(withRelyingPartyIdentifier:credentialID:)):\n(CredentialUpdaterShim.signalAllAcceptedCredentials(withRelyingPartyIdentifier:userHandle:acceptedCredentialIDs:)):\n(CredentialUpdaterShim.signalCurrentUserDetails(withRelyingPartyIdentifier:userHandle:newName:)):\n\nCanonical link: https://commits.webkit.org/317048@main",
      "email": "pascoe@apple.com",
      "hash": "c889af2828d678eb11e555ef843fec3c961597ea",
      "subject": "Migrate ASCredentialUpdater to ASCredentialDataManager"
    },
    "317049@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317049@main",
      "clUrl": "https://commits.webkit.org/317049@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318766\nrdar://problem/181625114\n\nReviewed by Chris Dumez.\n\nThe PaddingSpecification and Indentation StringTypeAdapters both filled\ntheir characters with std::fill_n(destination.data(), ...). Calling\ndata() strips the bounds off the span and hands the fill a raw pointer,\nwhich defeats the memory-safety the span provides (and is the pattern\nthe unsafe-buffer warning targets).\n\nSwitch both to std::ranges::fill over a bounded subspan\n(destination.first(count)) so the fills read as a single clear statement\nand stay memory-safe: the span carries its length, so we never hand a\nraw pointer to the fill.\n\n* Source/WTF/wtf/text/StringConcatenate.h:\n(WTF::StringTypeAdapter\u003cPaddingSpecification\u003cUnderlyingElementType\u003e\u003e::writeTo const):\n(WTF::StringTypeAdapter\u003cIndentation\u003cN\u003e\u003e::writeTo const):\n\nCanonical link: https://commits.webkit.org/317049@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "61ef996f296e2d18a6a671bdaa08c06430f50b2f",
      "subject": "[WTF] Use std::ranges::fill for the fill loops in StringConcatenate padding/indentation adapters"
    },
    "317050@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317050@main",
      "clUrl": "https://commits.webkit.org/317050@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319184\nrdar://182031444\n\nReviewed by Jean-Yves Avenard and Chris Dumez.\n\nhasAvailableVideoFrame() called player() three times and wrapped the\nresult in protect() twice. Hoist the player into a single local RefPtr\nand fold the null check into the returned expression, so the pointer is\nnull-checked once and kept alive across both member accesses.\n\nNo change in behavior.\n\n* Source/WebCore/html/HTMLVideoElement.cpp:\n(WebCore::HTMLVideoElement::hasAvailableVideoFrame const):\n\nCanonical link: https://commits.webkit.org/317050@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "29fc076372d066625d380ac350a0263c126c0351",
      "subject": "Simplify HTMLVideoElement::hasAvailableVideoFrame to avoid redundant player() and protect() calls"
    },
    "317051@main": {
      "author": "Ronan Turner",
      "avatar": "https://www.gravatar.com/avatar/b0adc2e7c8739eb712598294baec9184?d=identicon\u0026s=64",
      "cl": "317051@main",
      "clUrl": "https://commits.webkit.org/317051@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319244\nrdar://182092602\n\nReviewed by Mark Lam and Ryosuke Niwa.\n\nPrevious changes have removed the need for the Network process to\nuse JSC - we can ensure this is disabled via a call at initialization\ntime similar to Model and GPU processes.\n\n* Source/WebKit/NetworkProcess/EntryPoint/Cocoa/XPCService/NetworkServiceEntryPoint.mm:\n(WebKit::NETWORK_SERVICE_INITIALIZER):\n\nCanonical link: https://commits.webkit.org/317051@main",
      "email": "ronan_turner@apple.com",
      "hash": "7e926b3bd33bb9774598a9f6539cd0cc1a1ceb28",
      "subject": "Disable JSC within the Network process"
    },
    "317052@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317052@main",
      "clUrl": "https://commits.webkit.org/317052@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319160\nrdar://181980648\n\nReviewed by Chris Dumez.\n\nReplace open-coded `!(x \u0026 (x - 1))` power-of-two/single-bit checks with\nstd::has_single_bit(), matching the sibling OptionSet::hasExactlyOneBitSet().\n\n* Source/WTF/wtf/EnumSet.h:\n(WTF::EnumSet::hasExactlyOneBitSet const):\n* Source/WTF/wtf/SmallSet.h:\n\nCanonical link: https://commits.webkit.org/317052@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "4c450a7daaf8c2acf3935116f63147049729ab8b",
      "subject": "[WTF] Use std::has_single_bit() instead of open-coded single-bit checks in EnumSet and SmallSet"
    },
    "317053@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317053@main",
      "clUrl": "https://commits.webkit.org/317053@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319217\nrdar://182074760\n\nReviewed by Alan Baradlay.\n\nattachToRenderElement() declared `RenderTable* table;` uninitialized and\nassigned it in both branches of an if/else. Fold this into a single\ninitialized declaration by inverting the guard with dynamicDowncast(),\nwhich also removes the misleadingly-named `afterChild` local (it referred\nto the previous sibling / last child, not an \"after child\").\n\nNo behavior change, just clean-up.\n\n* Source/WebCore/rendering/updating/RenderTreeBuilder.cpp:\n(WebCore::RenderTreeBuilder::attachToRenderElement):\n\nCanonical link: https://commits.webkit.org/317053@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "bc564ecb10b0693e2dc32333a6ebc1ca76ede886",
      "subject": "Fold uninitialized RenderTable local in RenderTreeBuilder::attachToRenderElement"
    },
    "317054@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317054@main",
      "clUrl": "https://commits.webkit.org/317054@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319243\nrdar://182090330\n\nReviewed by Devin Rousso.\n\n`_domBreakpointURLMap` is a `Multimap` keyed by frame URL, so every DOM\nbreakpoint on a page is stored under the same key. `removeDOMBreakpoint`\ncalled `_domBreakpointURLMap.delete(breakpoint.url)` with a single\nargument, which `Multimap.delete` treats as \"remove the entire key\" —\nevicting every sibling breakpoint sharing that URL from the map.\n\nThe surviving breakpoints stayed attached for the current page, but the\nURL map is what re-resolves breakpoints to nodes on navigation (via\n`_speculativelyResolveDOMBreakpointsForURL` and `_nodeInserted`), so\nafter a reload the siblings silently failed to re-resolve and stopped\nbreaking.\n\nPass the breakpoint as the second argument so only that value is\nremoved, matching the two-arg `_domBreakpointFrameIdentifierMap.delete`\nform used just below.\n\n* LayoutTests/inspector/dom-debugger/dom-breakpoints-expected.txt:\n* LayoutTests/inspector/dom-debugger/dom-breakpoints.html:\n* Source/WebInspectorUI/UserInterface/Controllers/DOMDebuggerManager.js:\n(WI.DOMDebuggerManager.prototype.removeDOMBreakpoint):\n\nCanonical link: https://commits.webkit.org/317054@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "16b731767043e9593b5a3589cc716612547a5c17",
      "subject": "Web Inspector: removing a DOM breakpoint deletes sibling breakpoints that share the same URL"
    },
    "317055@main": {
      "author": "Elliott Williams",
      "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64",
      "cl": "317055@main",
      "clUrl": "https://commits.webkit.org/317055@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319146\nrdar://181964169\n\nReviewed by Zak Ridouh and Richard Robinson.\n\nMake adjustments to the build config to support the internal macOS SDK.\nIt will be used by default when available (same behavior as iOS).\n\nTo force a build with the public SDK, run cmake with\n`-DCMAKE_OSX_SYSROOT=macosx`.\n\n* Source/WebCore/PlatformCocoa.cmake: Read from\n  SourcesCocoaInternalSDK.txt\n* Source/WebCore/SourcesCMakeCocoa.txt: These sources come from the\n  above internal SDK source list; they don't belong here.\n* Source/WebKit/CMakeLists.txt:\n* Source/WebKit/PlatformCocoa.cmake:\n* Source/WebKit/PlatformMac.cmake: The command for generating log\n  sources needs to pass FEATURE_DEFINES_WITH_SPACE_SEPARATOR unquoted.\n  Otherwise the list of defines is passed as one big argument and\n  ignored by the script.\n* Source/WebKit/SwiftPrewarmMac.swift:\n* Source/cmake/OptionsIOS.cmake: Define some build options which are\n  always enabled in the Xcode build, and deeded by internal-only code.\n* Source/cmake/OptionsMac.cmake: Ditto.\n* Source/cmake/WebKitFeatures.cmake: Ditto.\n* Source/cmake/WebKitXcodeSDK.cmake: For Mac and JSCOnly ports, pick\n  macosx.internal by default.\n\nCanonical link: https://commits.webkit.org/317055@main",
      "email": "emw@apple.com",
      "hash": "b6ce147079ec6cc0e825b1dfa7ed7d0a3db3b6f6",
      "subject": "[CMake][Mac] Build with the internal SDK"
    },
    "317056@main": {
      "author": "Anne van Kesteren",
      "avatar": "https://www.gravatar.com/avatar/09bb44ac3625a121017cd98d0a7dc52c?d=identicon\u0026s=64",
      "cl": "317056@main",
      "clUrl": "https://commits.webkit.org/317056@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319248\n\nReviewed by Tim Nguyen.\n\nHandle exceptions in workers correctly.\n\nCanonical link: https://commits.webkit.org/317056@main",
      "email": "annevk@annevk.nl",
      "hash": "94bcbeefd2594d1bb625351adb42c2b690911091",
      "subject": "Mark WorkerParseErrorReportingEnabled stable"
    },
    "317057@main": {
      "author": "Anne van Kesteren",
      "avatar": "https://www.gravatar.com/avatar/09bb44ac3625a121017cd98d0a7dc52c?d=identicon\u0026s=64",
      "cl": "317057@main",
      "clUrl": "https://commits.webkit.org/317057@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319246\n\nReviewed by Tim Nguyen.\n\nEnable support for the Origin-Agent-Cluster header. Note that our\ndefault value for this header is false so document.domain remains\naccessible. The header can be used to disable document.domain support.\nIn the future we might flip the default.\n\nCanonical link: https://commits.webkit.org/317057@main",
      "email": "annevk@annevk.nl",
      "hash": "4a44d6a545a58f93a3a182f522df34a0d24e0443",
      "subject": "Mark OriginAgentClusterEnabled stable"
    },
    "317058@main": {
      "author": "Anne van Kesteren",
      "avatar": "https://www.gravatar.com/avatar/09bb44ac3625a121017cd98d0a7dc52c?d=identicon\u0026s=64",
      "cl": "317058@main",
      "clUrl": "https://commits.webkit.org/317058@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319253\n\nReviewed by Tim Nguyen.\n\nHas been stable for over a year.\n\nCanonical link: https://commits.webkit.org/317058@main",
      "email": "annevk@annevk.nl",
      "hash": "ac9259875493c0566c89376e1d49e5150a056030",
      "subject": "Remove DevolvableWidgetsEnabled preference"
    },
    "317059@main": {
      "author": "Elika Etemad",
      "avatar": "https://www.gravatar.com/avatar/55e113d03e0552e6df90ecbc15acd9b8?d=identicon\u0026s=64",
      "cl": "317059@main",
      "clUrl": "https://commits.webkit.org/317059@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319132\nrdar://182108081\n\nReviewed by Alan Baradlay.\n\nWe're investigating a hard-to-reproduce bug where we are using the glyphIDs\nof one system-ui font to render text using a different system-ui font. Since\nthis is a lookup error, the main thing to check is if the lookups on both\nsides of IPC (CPU layout vs GPU draw) are using the same data. The bug is\nsensitive to locale and hardware, which means paying special attention to\nlocale and sizing information.\n\nSince six of the core lookup data parameters are duplicated in three (!)\ndifferent data structs, it's easy for these to get out of sync. And in fact,\nthey are out of sync, so this patch aims to clean this up, on the theory\nthat this might be causing the lookup mismatch.\n\nA. Makes FontPlatformData, FontPlatformDataAttributes, and InstalledFont etc.\n   all use the same FontMetadata struct, ensuring a consistent representation\n   and streamlining parameter passing and data copying.\n\nB. Aligns this FontMetadata struct with all other representations of font\n   data in WebKit to use `float` rather than `double` for the size. This\n   ensures that any numeric type conversions are consistent for all lookups.\n\nC. Corrects Font::toSerializableInstalledFont() and Font::toSerializableFont()\n   to use WebKit's size data rather than pulling it off the CT font object.\n   These values are not guaranteed to match, so we should be consistent about\n   which one we use for lookups.\n\nD. Removes FontPlatformData::toIPCData() from CoreText which we would need to\n   update also, except it's dead code that should have been removed already.\n\nE. Adds logging to an error condition in InstalledFont::PostScriptFont::toCTFont\n   in case we are somehow landing in this case. (We should log this error\n   regardless.)\n\nF. Adds a missing locale parameter to the -apple-system-monospaced-numbers font\n   lookup, which seems unlikely to be the problem but fixing it just in case.\n\n* Source/WebCore/platform/graphics/FontPlatformData.cpp:\n(WebCore::FontPlatformData::FontPlatformData):\n(WebCore::m_customPlatformData):\n(WebCore::FontPlatformData::cloneWithOrientation):\n(WebCore::FontPlatformData::updateSize):\n* Source/WebCore/platform/graphics/FontPlatformData.h:\n(WebCore::FontPlatformDataAttributes::FontPlatformDataAttributes):\n(WebCore::FontPlatformData::size const):\n(WebCore::FontPlatformData::syntheticBold const):\n(WebCore::FontPlatformData::syntheticOblique const):\n(WebCore::FontPlatformData::orientation const):\n(WebCore::FontPlatformData::widthVariant const):\n(WebCore::FontPlatformData::textRenderingMode const):\n(WebCore::FontPlatformData::metadata const):\n(WebCore::FontPlatformData::operator== const):\n* Source/WebCore/platform/graphics/cocoa/FontCacheCoreText.cpp:\n(WebCore::fontDescriptorWithFamilySpecialCase):\n* Source/WebCore/platform/graphics/cocoa/FontPlatformDataCocoa.mm:\n(WebCore::FontPlatformData::hash const):\n* Source/WebCore/platform/graphics/coretext/FontCoreText.cpp:\n(WebCore::Font::fromIPCData):\n(WebCore::Font::toSerializableInstalledFont const):\n(WebCore::Font::toSerializableFont const):\n* Source/WebCore/platform/graphics/coretext/FontPlatformDataCoreText.cpp:\n(WebCore::FontPlatformDataAttributes::FontPlatformDataAttributes):\n(WebCore::FontPlatformData::FontPlatformData):\n(WebCore::FontPlatformData::create):\n(WebCore::FontPlatformData::description const):\n(WebCore::FontPlatformData::updateSize):\n(WebCore::FontPlatformData::attributes const):\n(WebCore::InstalledFont::SystemUIFont::toCTFont const):\n(WebCore::InstalledFont::PostScriptFont::toCTFont const):\n(WebCore::InstalledFont::toFont const):\n(WebCore::FontPlatformData::toIPCData const): Deleted.\n* Source/WebCore/platform/graphics/freetype/FontPlatformDataFreeType.cpp:\n(WebCore::FontPlatformData::cloneWithOrientation):\n(WebCore::FontPlatformData::updateSize):\n(WebCore::FontPlatformData::buildScaledFont):\n(WebCore::FontPlatformData::create):\n(WebCore::FontPlatformData::attributes const):\n(WebCore::FontPlatformData::fromIPCData):\n* Source/WebCore/platform/graphics/skia/FontPlatformDataSkia.cpp:\n(WebCore::FontPlatformData::FontPlatformData):\n(WebCore::FontPlatformData::platformDataInit):\n(WebCore::FontPlatformData::fromIPCData):\n(WebCore::FontPlatformData::hash const):\n(WebCore::FontPlatformData::create):\n(WebCore::FontPlatformData::attributes const):\n(WebCore::FontPlatformData::updateSize):\n* Source/WebCore/platform/graphics/win/FontPlatformDataWin.cpp:\n(WebCore::FontPlatformData::create):\n(WebCore::FontPlatformData::attributes const):\n(WebCore::FontPlatformData::fromIPCData):\n* Source/WebKit/Shared/WebCoreFont.serialization.in:\n\nCanonical link: https://commits.webkit.org/317059@main",
      "email": "fantasai.bugs@inkedblade.net",
      "hash": "a5831b78ade6e207c0cab878d354e6798b06e993",
      "subject": "Synchronize Font metadata representation (size, orientation, etc.)"
    },
    "317060@main": {
      "author": "Jessica Cheung",
      "avatar": "https://www.gravatar.com/avatar/5c102f093ce6bc01424466a4cfdf1d1f?d=identicon\u0026s=64",
      "cl": "317060@main",
      "clUrl": "https://commits.webkit.org/317060@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319181\nrdar://181955233\n\nReviewed by Richard Robinson.\n\nAfter 316922@main, this is one of the tests that needed\nto use the new helper activateAndWaitForInputSessionStartAt\nto fix the timeout issue.\n\nIn this case, use activateElementAndWaitForInputSessionStart\nwhich calls activateAndWaitForInputSessionStartAt.\n\n* LayoutTests/editing/selection/ios/select-text-by-long-press-with-hardware-keyboard.html:\n\nCanonical link: https://commits.webkit.org/317060@main",
      "email": "jcheung23@apple.com",
      "hash": "5049e8b1e79709e2588926ab14a70d1968bfbbae",
      "subject": "[iOS] debug editing/selection/ios/select-text-by-long-press-with-hardware-keyboard.html is timing out"
    },
    "317061@main": {
      "author": "Yoav Weiss",
      "avatar": "https://www.gravatar.com/avatar/228600d5a1cfae576e64ee92e46f6a1e?d=identicon\u0026s=64",
      "cl": "317061@main",
      "clUrl": "https://commits.webkit.org/317061@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316647\n\nReviewed by Alex Christensen.\n\nThis PR aligns the WebKit implementation with https://github.com/whatwg/fetch/pull/1931 and https://github.com/whatwg/html/pull/12513,\nand ensures that TAO opt-ins for navigation timing take the destination origin into account.\n\nNew iframe tests, plus test progressions.\n\n* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/redirect-tao-expected.txt: Progression.\n* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/redirect-tao.html:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/resources/redirect-tao-helper.js:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/resources/report-navigation-redirect-timing.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/response-start-after-coop-bcg-switch.https-expected.txt: Expectation change.\n* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/unload-event-same-origin-check-expected.txt: Progression.\n* Source/WebCore/loader/DocumentLoader.cpp:\n(WebCore::hideRedirectTimingForNoReferrerNavigation): Resets redirect count if noreferrer.\n(WebCore::DocumentLoader::notifyFinished): Calls hideRedirectTimingForNoReferrerNavigation.\n(WebCore::DocumentLoader::commitData): Calls hideRedirectTimingForNoReferrerNavigation.\n* Source/WebCore/page/PerformanceNavigationTiming.cpp:\n(WebCore::PerformanceNavigationTiming::shouldExposeRedirectTiming const): Only exposes redirect timing if redirectCount is not zero.\n(WebCore::PerformanceNavigationTiming::redirectCount const): TAO check.\n* Source/WebCore/page/PerformanceNavigationTiming.h:\n* Source/WebCore/page/PerformanceResourceTiming.cpp:\n(WebCore::fetchStart): Pass exposeRedirectTiming.\n(WebCore::entryStartTime): Use shouldExposeRedirectTiming().\n(WebCore::PerformanceResourceTiming::shouldExposeRedirectTiming const): A virtual fun that enables NavigationTiming to override the default RT behavior.\n(WebCore::PerformanceResourceTiming::redirectStart const): Use shouldExposeRedirectTiming().\n(WebCore::PerformanceResourceTiming::redirectEnd const): Use shouldExposeRedirectTiming().\n(WebCore::PerformanceResourceTiming::fetchStart const): Use shouldExposeRedirectTiming().\n* Source/WebCore/page/PerformanceResourceTiming.h:\n* Source/WebCore/platform/network/TimingAllowOrigin.cpp:\n(WebCore::passesNavigationTAOCheck):\n* Source/WebCore/platform/network/TimingAllowOrigin.h:\n* Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp:\n(WebKit::NetworkLoadChecker::checkRedirection): Append TAO values.\n(WebKit::NetworkLoadChecker::validateResponse): Set TAO values on the response.\n(WebKit::NetworkLoadChecker::appendToNavigationTimingAllowValuesList): Accumulate TAO values.\n* Source/WebKit/NetworkProcess/NetworkLoadChecker.h:\n(WebKit::NetworkLoadChecker::navigationTAOCheckPassed const): Getter.\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:\n(WebKit::NetworkResourceLoader::didFinishLoading):\n\nCanonical link: https://commits.webkit.org/317061@main",
      "email": "yoav.weiss@shopify.com",
      "hash": "0df60f4248ef6652c95599d295cc4b0367f85911",
      "subject": "Navigation Timing: cross-origin redirect opt-in should be based on destination origin."
    },
    "317062@main": {
      "author": "Yury Semikhatsky",
      "avatar": "https://www.gravatar.com/avatar/d0aee26d9689e84bd1a7f0ed8f262fe1?d=identicon\u0026s=64",
      "cl": "317062@main",
      "clUrl": "https://commits.webkit.org/317062@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318270\n\nReviewed by Devin Rousso.\n\nWeb Inspector can only override a fixed set of page Settings via\nPage.overrideSetting. Extend that set with seven additional boolean settings:\nFixedBackgroundsPaintRelativeToDocument, FullScreenEnabled,\nInputTypeMonthEnabled, InputTypeWeekEnabled, NotificationsEnabled,\nPointerLockEnabled and PushAPIEnabled.\n\nFixedBackgroundsPaintRelativeToDocument, InputTypeMonthEnabled and\nInputTypeWeekEnabled are consumed through their Settings getters, so they use\nthe existing inspectorOverride mechanism: the generated\nset\u003cName\u003eInspectorOverride accessor, reset in disable() when the frontend\ndisconnects.\n\nFullScreenEnabled, NotificationsEnabled, PointerLockEnabled and PushAPIEnabled\ngate DOM API exposure through [EnabledBySetting], whose generated bindings read\nthe raw Settings value via settingsValues() rather than the getter. The\nset\u003cName\u003eInspectorOverride accessor does not affect that value, so overriding\nthose settings has no effect. Override them by writing the setting value\ndirectly instead, remembering the original value so it can be restored when the\noverride is cleared or the agent is disabled. Settings gated by a feature flag\nkeep their #if guard inside the switch branch so the Page.Setting enum stays\nexhaustive on ports where the feature is disabled.\n\nSettings whose DOM API is gated behind a feature flag are covered by their own\nlayout tests so each can be skipped on ports where the feature is compiled out\n(PointerLock on WPE); the rest are exercised by overrideSetting.html.\n\n* Source/JavaScriptCore/inspector/protocol/Page.json:\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebCore/inspector/agents/InspectorPageAgent.cpp:\n(WebCore::InspectorPageAgent::disable):\n(WebCore::InspectorPageAgent::overrideSettingByModifyingValue):\n(WebCore::InspectorPageAgent::overrideSetting):\n* Source/WebCore/inspector/agents/InspectorPageAgent.h:\n* Source/WebCore/page/Settings.yaml:\n* LayoutTests/inspector/page/overrideSetting.html:\n* LayoutTests/inspector/page/overrideSetting-expected.txt:\n* LayoutTests/inspector/page/overrideSetting-FullScreenEnabled.html: Added.\n* LayoutTests/inspector/page/overrideSetting-FullScreenEnabled-expected.txt: Added.\n* LayoutTests/inspector/page/overrideSetting-NotificationsEnabled.html: Added.\n* LayoutTests/inspector/page/overrideSetting-NotificationsEnabled-expected.txt: Added.\n* LayoutTests/inspector/page/overrideSetting-PointerLockEnabled.html: Added.\n* LayoutTests/inspector/page/overrideSetting-PointerLockEnabled-expected.txt: Added.\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/317062@main",
      "email": "yurys@chromium.org",
      "hash": "5e67bf829346a5749941af115204310fe331e256",
      "subject": "Web Inspector: support overriding more page settings via Page.overrideSetting"
    },
    "317063@main": {
      "author": "Yulun Wu",
      "avatar": "https://www.gravatar.com/avatar/9e34d6632f4d926cdf6fe8dce07f9cb7?d=identicon\u0026s=64",
      "cl": "317063@main",
      "clUrl": "https://commits.webkit.org/317063@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316591\n\u003crdar://179042344\u003e\n\nReviewed by Sammy Gill.\n\nThis PR adds scaffolding in GridFormattingContext for an intrinsic-width\nfast-path classifier. GridFormattingContext now tracks IntrinsicWidthSizingPath\n(ColumnsOnly | NeedsFullSizing) to improve intrinsic sizing performance.\n\nThis PR adds the first triggers for detecting block size dependent grid items.\n\nOrthogonal grid items' inline axis contribution is determined by its block size,\nmeaning that we need to run the full layout path to determine the intrinsic width\nof a grid with orthogonal grid items.\n\nGrid items with preferred aspect ratio and grid items that depend on their containing\nblock size may also require the full layout path for intrinsic width calcualations.\n\nNo behavior change in this PR.\n\n* Source/WebCore/layout/formattingContexts/grid/GridFormattingContext.cpp:\n(WebCore::Layout::GridFormattingContext::GridFormattingContext):\n(WebCore::Layout::GridFormattingContext::classifyIntrinsicWidthSizingPath const):\n(WebCore::Layout::GridFormattingContext::computeIntrinsicWidths):\n* Source/WebCore/layout/formattingContexts/grid/GridFormattingContext.h:\n(WebCore::Layout::GridFormattingContext::intrinsicWidthSizingPath const):\n* Source/WebCore/layout/formattingContexts/grid/GridLayoutUtils.cpp:\n(WebCore::Layout::GridLayoutUtils::inlineContributionMayRequireFullSizingAlgorithmForIntrinsicWidth):\n(WebCore::Layout::GridLayoutUtils::preferredSizeDependsOnContainingBlockSize): Deleted.\n* Source/WebCore/layout/formattingContexts/grid/GridLayoutUtils.h:\n(WebCore::Layout::GridLayoutUtils::sizeDependsOnContainingBlockSize):\n* Source/WebCore/layout/formattingContexts/grid/TrackSizingAlgorithm.cpp:\n(WebCore::Layout::minimumContributions):\n\nCanonical link: https://commits.webkit.org/317063@main",
      "email": "yulun_wu@apple.com",
      "hash": "dbf4f545d85696c4067e1c566e17c60fd44505fa",
      "subject": "[GFC] Add scaffolding to classify intrinsic-width sizing path"
    },
    "317064@main": {
      "author": "Issac Roy",
      "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64",
      "cl": "317064@main",
      "clUrl": "https://commits.webkit.org/317064@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318795\nrdar://XXXXXXX\n\nReviewed by Elliott Williams.\n\nWhen auto-updating the associated Radar on a draft pull-request, move\nit to Analyze/Fix rather than Analyze/Review, since the change is not\nyet ready for review.\n\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/pull_request.py:\n(PullRequest.create_pull_request): Use Analyze/Fix for draft PRs,\nAnalyze/Review for non-draft PRs.\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/test/pull_request_unittest.py:\n(TestPullRequest.test_update_radar): Added draft PR case.\n\nCanonical link: https://commits.webkit.org/317064@main",
      "email": "issacroy05@gmail.com",
      "hash": "a05c31a21f60bcb2cb207d41d56fe7fc8bfa2b91",
      "subject": "Set Radar to Analyze/Fix for draft PRs when radar auto update"
    },
    "317065@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "317065@main",
      "clUrl": "https://commits.webkit.org/317065@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319257\n\u003crdar://problem/182105989\u003e\n\nReviewed by Antti Koivisto.\n\n* Source/WebCore/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/NoUncheckedPtrMemberCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/UncheckedCallArgsCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/UncheckedLocalVarsCheckerExpectations:\n* Source/WebCore/rendering/FlexLayoutUtils.cpp:\n(WebCore::FlexLayoutUtils::overflowAlignmentForFlexItem const):\n(WebCore::FlexLayoutUtils::canResolveFullyConstrainedLogicalHeight):\n(WebCore::FlexLayoutUtils::alignmentForFlexItem const):\n(WebCore::FlexLayoutUtils::hasStretchedFlexItemWithAspectRatio const):\n* Source/WebCore/rendering/FlexLayoutUtils.h:\n\nCanonical link: https://commits.webkit.org/317065@main",
      "email": "zalan@apple.com",
      "hash": "8ce5104a519df1e3c748d78d5fbcf29ec3feed48",
      "subject": "Fix Safer CPP warnings in FlexLayoutUtils"
    },
    "317066@main": {
      "author": "Kiet Ho",
      "avatar": "https://www.gravatar.com/avatar/d9058b37006dce1f55f91b8ccc82f9a3?d=identicon\u0026s=64",
      "cl": "317066@main",
      "clUrl": "https://commits.webkit.org/317066@main",
      "description": "rdar://181641524\nhttps://bugs.webkit.org/show_bug.cgi?id=318827\n\nReviewed by Abrar Rahman Protyasha.\n\nIn a page with nested iframes (e.g main frame \u003c= iframe 1 \u003c= iframe 2),\nand there's an implicit root intersection observer in iframe 2, when iframe\n1 scrolls, the observer in iframe 2 should be updated too, as scrolling\nmay have scrolled the intersection target out of view.\n\nIn Site Isolation mode, Document::updateIntersectionObservers (called when\nPage updates rendering) has code to trigger intersection observers in other\nprocesses to update, but only when the Document is in the main frame. When\niframe 1 scrolls, the Page object in its process updates rendering, but\nit's not the main frame, hence it doesn't update the observer in iframe 2.\n\nFix this by updating remote intersection observers when any frames update\nits rendering. Since this is only needed in Site Isolation mode, don't\nupdate if Site Isolation is not enabled.\n\nNo tests - I tried multiple ways to simulate scrolling, but they all\nmakes the main frame update its rendering, which would not reproduce\nthe issue.\n\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::updateIntersectionObservers):\n\nCanonical link: https://commits.webkit.org/317066@main",
      "email": "kiet.ho@apple.com",
      "hash": "e562a996c9cecf90a2d938878d51177265cc57ac",
      "subject": "[Site Isolation] [intersection-observer] Update remote intersection observers in all frames, not just the main frame"
    },
    "317067@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "317067@main",
      "clUrl": "https://commits.webkit.org/317067@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319134\nrdar://problem/181952698\n\nReviewed by Alan Baradlay.\n\nThe resolved value of grid-template-columns / grid-template-rows for a grid\ncontainer is its used value: every track listed individually with its size\nserialized as a length in pixels:\nhttps://drafts.csswg.org/css-grid-2/#resolved-track-list.\n\nWe currently reverse engineer this value from the positions that were\ncomputed during layout and then return it.\n\nInstead, at the end of grid layout we can compute the values and store\nthem in a dedicated ResolvedTrackList struct that lives on the renderer.\n\nOne thing we also do is add an extra bit to keep track of whether this\nvalue is stale or not. We mark this bit dirty at the beginning of layout\nand assert that it is not stale whenever callers ask for it. One small\nexception is that GFC does not set these values so we have to make sure\nthat we do not accidentally assert if we ran GFC. This will be fixed in\na follow up patch.\n\n* Source/WebCore/inspector/InspectorOverlay.cpp:\n(WebCore::InspectorOverlay::buildGridOverlay):\n* Source/WebCore/style/StyleExtractorCustom.h:\n(WebCore::Style::extractGridTemplateValue):\nSome changes to make sure we get the value by reference in the above\nfunctions so we don't make a copy when we don't need to.\n\nCanonical link: https://commits.webkit.org/317067@main",
      "email": "sammy.gill@apple.com",
      "hash": "b1286c345d237f025d733fae0bd38a4b4bdec004",
      "subject": "[Grid][Cleanup] Store resolved track listings separate from positions"
    },
    "317068@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "317068@main",
      "clUrl": "https://commits.webkit.org/317068@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318588\n\nReviewed by Antti Koivisto.\n\nperformFlexLayout declared positionList and crossSizeList up front, sized to the\nitem count, and passed them by reference into handleMainAxisAlignment and\ncomputeCrossSizeForFlexItems to be filled. Each phase is the sole producer of its\nlist -- handleMainAxisAlignment places every item, computeCrossSizeForFlexItems sets\nevery item's used cross size -- so have them build and return the list instead,\nmatching the other sizing phases (computeMainSizeForFlexItems, crossSizeForFlexLines)\nand FlexLayout's handleMainAxisAlignment. The two locals are now declared empty next\nto their first use; the later cross-axis phases still take positionList by reference\nbecause they accumulate into it.\n\nNo change in behavior.\n\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::performFlexLayout):\n(WebCore::RenderFlexibleBox::handleMainAxisAlignment):\n(WebCore::RenderFlexibleBox::computeCrossSizeForFlexItems):\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n\nCanonical link: https://commits.webkit.org/317068@main",
      "email": "zalan@apple.com",
      "hash": "82118689bb135d81efee369c00cbdb749d2284ec",
      "subject": "[cleanup] Return positionList and crossSizeList from their producing phases in RenderFlexibleBox"
    },
    "317069@main": {
      "author": "Sam Weinig",
      "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64",
      "cl": "317069@main",
      "clUrl": "https://commits.webkit.org/317069@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319197\n\nReviewed by Alan Baradlay.\n\nSwitch media/container queries to use unzoomed lengths and simplify using\nexisting unzooming helpers.\n\n* Source/WebCore/css/query/ContainerQueryFeatures.cpp:\n* Source/WebCore/css/query/GenericMediaQueryEvaluator.cpp:\n* Source/WebCore/css/query/GenericMediaQueryParser.cpp:\n* Source/WebCore/css/query/GenericMediaQueryTypes.h:\n\nCanonical link: https://commits.webkit.org/317069@main",
      "email": "sam@webkit.org",
      "hash": "8fb376678408a7822702039d48e4948b5dfc4ea5",
      "subject": "[EvaluationTimeZoom] Convert media/container queries to use unzoomed lengths"
    },
    "317070@main": {
      "author": "Jer Noble",
      "avatar": "https://www.gravatar.com/avatar/6d2cde9be23b98223ca964cb3b7813a0?d=identicon\u0026s=64",
      "cl": "317070@main",
      "clUrl": "https://commits.webkit.org/317070@main",
      "description": "rdar://181518068\nhttps://bugs.webkit.org/show_bug.cgi?id=318704\n\nReviewed by Andy Estes.\n\nAdd tests covering previously untested areas of the Fullscreen API\nspecification, driven by an audit against the spec's testable-behavior\nextraction. No new WebKit bugs surfaced this batch — WebKit's Fullscreen\nimplementation is spec-conformant across everything tested.\n\nfullscreen-change-event-shape.html verifies fullscreenchange event\nproperties: bubbles=true and composed=true (both spec-required per\n\"run the fullscreen steps\"); target is the element when connected and\nin-document, falling back to the document when the fullscreen element\nwas disconnected before exit-fullscreen ran; and that a single\nrequest/exit cycle produces exactly one fullscreenchange event per\ntransition (the pending events list is drained per invocation).\n\nfullscreen-idl-getters.html verifies Document.fullscreen (the deprecated\nboolean getter) and Document.fullscreenElement (the current element or\nnull) across enter and exit transitions; also asserts the simple-\nfullscreen-document invariant that the top layer contains exactly one\nfullscreen element while entered.\n\nfullscreen-ua-stylesheet.html verifies the UA default stylesheet rules\napplied to :not(:root):fullscreen elements via getComputedStyle:\nmargin:0!important, box-sizing:border-box!important, and non-important\nobject-fit:contain (the non-important object-fit rule is properly\noverridable by author !important rules).\n\nfullscreen-exit-errors-and-async.html verifies that requestFullscreen\nand exitFullscreen both return a Promise synchronously (their state\ntransitions happen in parallel), and that exitFullscreen rejects with\na TypeError when the document is not fully active (tested via a\ndetached iframe's contentDocument).\n\nfullscreen-request-preconditions.html verifies the fullscreen-element-\nready-check preconditions: an element in an iframe whose allow\nattribute denies fullscreen cannot enter fullscreen; and an HTML element\nwhose popover visibility state is \"showing\" cannot enter fullscreen\n(the ready-check's \"namespace is not HTML OR popover visibility state\nis hidden\" clause fails for showing HTML popovers), while a hidden\npopover (element with popover attribute but not shown) IS eligible.\n\nfullscreen-exit-edges.html verifies that when the fullscreen element is\ndisconnected from its document, the exit-fullscreen algorithm still\nunfullscreens it — fullscreenElement returns to null after the\ndisconnection-triggered fullscreenchange fires.\n\nfullscreen-hides-popovers.html verifies steps 1-2 of the fullscreen-an-\nelement algorithm (compute hideUntil via topmost-popover-ancestor; run\nhide-popovers-until): when a non-popover element is fullscreened, all\ncurrently-open auto popovers are hidden. Manual popovers stay open\nbecause the hide-popovers-until algorithm only iterates the auto and\nhint popover stacks.\n\n* LayoutTests/fullscreen/full-screen-test.js:\n* LayoutTests/imported/w3c/web-platform-tests/fullscreen/api/fullscreen-change-event-shape-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fullscreen/api/fullscreen-change-event-shape.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fullscreen/api/fullscreen-exit-errors-and-async-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fullscreen/api/fullscreen-exit-errors-and-async.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fullscreen/api/fullscreen-hides-popovers-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fullscreen/api/fullscreen-hides-popovers.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fullscreen/api/fullscreen-idl-getters-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fullscreen/api/fullscreen-idl-getters.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fullscreen/api/fullscreen-request-preconditions-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fullscreen/api/fullscreen-request-preconditions.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fullscreen/model/fullscreen-exit-edges-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fullscreen/model/fullscreen-exit-edges.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fullscreen/rendering/fullscreen-ua-stylesheet-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fullscreen/rendering/fullscreen-ua-stylesheet.html: Added.\n\nCanonical link: https://commits.webkit.org/317070@main",
      "email": "jer.noble@apple.com",
      "hash": "bdc93974d59a8126af66a76abd48bb6264dbcaf9",
      "subject": "[Fullscreen] Add tests for untested areas of the Fullscreen API specification"
    },
    "317071@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "317071@main",
      "clUrl": "https://commits.webkit.org/317071@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319256\nrdar://182105612\n\nReviewed by Tim Horton.\n\nThis patch simply adds coverage for the titled test case.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift:\n\nCanonical link: https://commits.webkit.org/317071@main",
      "email": "a_protyasha@apple.com",
      "hash": "733571c4c9cbfc1cb7982b6b7a51a3f1d3332776",
      "subject": "[AppKit Gestures] Trackpad swiping between spaces should not trigger back navigation"
    },
    "317072@main": {
      "author": "Jetzel Espinal",
      "avatar": "https://www.gravatar.com/avatar/2edd78d5d9f2f2e2e695465277634921?d=identicon\u0026s=64",
      "cl": "317072@main",
      "clUrl": "https://commits.webkit.org/317072@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319130\nrdar://181950443\n\nUnreviewed test gardening.\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/317072@main",
      "email": "jespinal23@apple.com",
      "hash": "c8cd94e033ca962cdba2fd021d0a537920d7af35",
      "subject": "[GARDENING][iOS] TestWebKitAPI.TextManipulation.CompleteTextManipulationAvoidExtractingManipulatedTextAfterManipulation (api-test) is a flaky timeout."
    },
    "317073@main": {
      "author": "Jetzel Espinal",
      "avatar": "https://www.gravatar.com/avatar/2edd78d5d9f2f2e2e695465277634921?d=identicon\u0026s=64",
      "cl": "317073@main",
      "clUrl": "https://commits.webkit.org/317073@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319115\nrdar://181934576\n\nUnreviewed test gardening.\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/317073@main",
      "email": "jespinal23@apple.com",
      "hash": "1ebfe72b650052a755e23bf67cab4791d9e73ff2",
      "subject": "[GARDENING][iOS] TestWebKitAPI.AppPrivacyReport.AppInitiatedRequestWithServiceWorker (api-test) is a flaky timeout."
    },
    "317074@main": {
      "author": "Jetzel Espinal",
      "avatar": "https://www.gravatar.com/avatar/2edd78d5d9f2f2e2e695465277634921?d=identicon\u0026s=64",
      "cl": "317074@main",
      "clUrl": "https://commits.webkit.org/317074@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319125\nrdar://181944540\n\nUnreviewed test gardening.\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/317074@main",
      "email": "jespinal23@apple.com",
      "hash": "807e3cb9fd5ba764afab6f32ccd1df7e79408cac",
      "subject": "[GARDENING][iOS] TestWebKitAPI.WKDownload.BlobDownload (api-test) is a flaky timeout."
    },
    "317075@main": {
      "author": "Jetzel Espinal",
      "avatar": "https://www.gravatar.com/avatar/2edd78d5d9f2f2e2e695465277634921?d=identicon\u0026s=64",
      "cl": "317075@main",
      "clUrl": "https://commits.webkit.org/317075@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318265\nrdar://181059634\n\nUnreviewed test gardening.\n\n* TestExpectations/apitests:\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/317075@main",
      "email": "jespinal23@apple.com",
      "hash": "b6141c389ec8790d2baf218f87078c70ee15847d",
      "subject": "[GARDENING][iOS] TestWebKitAPI.WKWebExtensionAPIDeclarativeNetRequest.BlockedLoadTest (api-test) is a flaky timeout."
    },
    "317076@main": {
      "author": "Patrick Griffis",
      "avatar": "https://www.gravatar.com/avatar/2233c3a857004b126158572af9fe36f7?d=identicon\u0026s=64",
      "cl": "317076@main",
      "clUrl": "https://commits.webkit.org/317076@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319254\n\nReviewed by Tim Nguyen.\n\nUpstream commit:\n\nhttps://github.com/web-platform-tests/wpt/commit/7bb1b509c04fa2be55cb50b66d95488534bd97d6\nCanonical link: https://commits.webkit.org/317076@main",
      "email": "pgriffis@igalia.com",
      "hash": "faa143ae082031be8cfed8921e1692e3f4b7883b",
      "subject": "Sync URLPattern tests from WPT"
    },
    "317077@main": {
      "author": "Nikolas Zimmermann",
      "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64",
      "cl": "317077@main",
      "clUrl": "https://commits.webkit.org/317077@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319228\n\nReviewed by Rob Buis.\n\napplySVGTransform() calls computeTransformOrigin() for every non-layered SVG shape on every\ntransform flush. The origin only depends on the transform-origin style and the transform\nreference box, so it stays the same as long as those do not change. Sampling MotionMark/Suits\nat high, fixed complexity showed computeTransformOrigin costs ~1% of the WebProcess main thread.\n\nCache the origin on RenderSVGModelObject keyed on the reference box. A different box forces a\nrecompute, and styleDidChange() drops the cache for transform-origin or transform-box changes,\nwhere the box is the same but the origin differs. The cache is only used on the plain SVG\ntransform path (no CSS transform and no pre, post or supplemental matrix). Viewport containers\nand CSS-transformed renderers keep computing it directly. The optimization scope could be expanded\nin future.\n\nAdded a new test to cover an edge case caused by a missing cache invalidation during development,\nthat lacked test coverage so far. The rest of the change is covered by existing tests.\n\nTest: svg/transforms/change-transform-origin-with-transform-attribute.html\n\n* LayoutTests/svg/transforms/change-transform-origin-with-transform-attribute-expected.html: Added.\n* LayoutTests/svg/transforms/change-transform-origin-with-transform-attribute.html: Added.\n* Source/WebCore/rendering/RenderLayerModelObject.cpp:\n(WebCore::RenderLayerModelObject::applySVGTransform const):\n* Source/WebCore/rendering/RenderLayerModelObject.h:\n(WebCore::RenderLayerModelObject::cachedTransformOriginForReferenceBox const):\n* Source/WebCore/rendering/svg/RenderSVGModelObject.cpp:\n(WebCore::RenderSVGModelObject::styleDidChange):\n(WebCore::RenderSVGModelObject::cachedTransformOriginForReferenceBox const):\n* Source/WebCore/rendering/svg/RenderSVGModelObject.h:\n(WebCore::RenderSVGModelObject::invalidateCachedTransformOrigin const):\n\nCanonical link: https://commits.webkit.org/317077@main",
      "email": "nzimmermann@igalia.com",
      "hash": "a61f5be9e63a0e2a62a436809340e1950f1b9b04",
      "subject": "[LBSE] Cache the SVG transform origin on RenderSVGModelObject"
    },
    "317078@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "317078@main",
      "clUrl": "https://commits.webkit.org/317078@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318595\n\nReviewed by Antti Koivisto.\n\ncomputeFlexLines drove a per-line helper, computeNextFlexLine, that returned a\nFlexingLineData bundle. Only the per-line hypothetical main size was ever read back;\nthe flex-factor sums it also computed (totalFlexGrow, totalFlexShrink,\ntotalWeightedFlexShrink) were dead -- resolveFlexibleLengthsForLineItems recomputes\nthem. Inline the helper into the computeFlexLines loop, matching\nFlexLayout::computeFlexLines, and compute the main-axis gap there instead of passing\nit in. Drop the now-unused FlexingLineData struct and the always-true item-count guard\n(the first uncollected item is always collected).\n\nNo change in behavior: the main-axis margin trim and the per-line hypothetical main\nsize that columnInnerMainSize needs are preserved.\n\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::computeFlexLines):\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n\nCanonical link: https://commits.webkit.org/317078@main",
      "email": "zalan@apple.com",
      "hash": "e3ed02f433684992f8a9a77b473cd4794d4a1f4b",
      "subject": "[cleanup] Fold computeNextFlexLine into computeFlexLines and compute the main-axis gap there"
    },
    "317079@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "317079@main",
      "clUrl": "https://commits.webkit.org/317079@main",
      "description": "rdar://181481071\nhttps://bugs.webkit.org/show_bug.cgi?id=318940\n\nReviewed by Ryosuke Niwa.\n\nSeveral methods on InternalReadableStream and InternalWritableStream invoke JS builtins and can leave a pending exception on the VM.\nWhen these methods are reached from a non-JS entry (e.g. an AbortSignal.timeout callback, WebTransport, fetch),\nthe pending exception survives back to the runloop and is observed by the next microtask reaction as scope.assertNoException(), crashing the process.\n\nWe fix this by auditing every InternalReadableStream / InternalWritableStream method and clearing pending exceptions at the C++/JS boundary when the caller cannot own an exception scope.\n\nWe make InternalReadableStream::cancel return an ExceptionOr\u003cJSC::JSValue\u003e so that callers need to explictly handle an existing exception, typically by wrapping the exception as a rejected promise. We do the same for InternalWritableStream::abort.\nThis allows to be more spec compliant by forwarding the JS error to the web page instead of dropping it.\n\nWe use more top scopes in internal stream functions to better isolate C++ code from potential JS exceptions.\n\n* LayoutTests/streams/handle-exceptions-expected.txt: Added.\n* LayoutTests/streams/handle-exceptions.html: Added.\n* Source/WebCore/Modules/streams/ReadableStream.cpp:\n(WebCore::ReadableStream::cancel):\n* Source/WebCore/Modules/streams/StreamPipeToUtilities.cpp:\n(WebCore::cancelReadableStream):\n(WebCore::StreamPipeToState::handleSignal):\n(WebCore::StreamPipeToState::errorsMustBePropagatedForward):\n(WebCore::StreamPipeToState::errorsMustBePropagatedBackward):\n(WebCore::StreamPipeToState::closingMustBePropagatedBackward):\n* Source/WebCore/bindings/js/InternalReadableStream.cpp:\n(WebCore::InternalReadableStream::state const):\n(WebCore::InternalReadableStream::storedError const):\n(WebCore::InternalReadableStream::cancel):\n* Source/WebCore/bindings/js/InternalReadableStream.h:\n* Source/WebCore/bindings/js/InternalWritableStream.cpp:\n(WebCore::InternalWritableStream::abort):\n(WebCore::InternalWritableStream::errorIfPossible):\n(WebCore::InternalWritableStream::state const):\n(WebCore::InternalWritableStream::storedError const):\n(WebCore::InternalWritableStream::closeQueuedOrInFlight):\n* Source/WebCore/bindings/js/InternalWritableStream.h:\n\nCanonical link: https://commits.webkit.org/317079@main",
      "email": "youenn@apple.com",
      "hash": "d3fcf235bf5d29ac3ad7c97c8c5fdc67e7105e1b",
      "subject": "InternalReadableStream/InternalWritableStream methods should catch JS exceptions for non JS code paths"
    },
    "317080@main": {
      "author": "Taher Ali",
      "avatar": "https://www.gravatar.com/avatar/e104800647d8c98b8c9dbe736b5e1751?d=identicon\u0026s=64",
      "cl": "317080@main",
      "clUrl": "https://commits.webkit.org/317080@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=306014\nrdar://169167365\n\nReviewed by Simon Fraser.\n\nAn inset box-shadow used as a 1px rule (e.g. `box-shadow: inset 0 0 0 1px`)\nrendered thicker on some sides than others at fractional zoom, because the\nouter border box and the inner hole were snapped to device pixels\nindependently and a fractional-width spread rounded up on one side and down\non the other.\n\nDerive the snapped inner rect from the already-snapped outer rect, insetting\neach side by the width rounded to whole device pixels, so the thickness is\nuniform on all four sides regardless of sub-pixel position.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-viewport/zoom/box-shadow-inset-spread-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-viewport/zoom/box-shadow-inset-spread.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-viewport/zoom/reference/box-shadow-inset-spread-ref.html: Added.\n* Source/WebCore/rendering/BorderShape.cpp:\n(WebCore::BorderShape::fillRectWithInnerHoleShape const):\n(WebCore::BorderShape::snappedInnerEdgeRectForPainting const):\n* Source/WebCore/rendering/BorderShape.h:\n\nCanonical link: https://commits.webkit.org/317080@main",
      "email": "taher_ali@apple.com",
      "hash": "cbf44125e63ae2079d99d27f049cd7b70a3b3f89",
      "subject": "Inset box-shadow spread renders uneven thickness at fractional zoom"
    },
    "317081@main": {
      "author": "Ryan Haddad",
      "avatar": "https://www.gravatar.com/avatar/b7d8cd2dec546cac2524e4b58181f9d5?d=identicon\u0026s=64",
      "cl": "317081@main",
      "clUrl": "https://commits.webkit.org/317081@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319119\nrdar://problem/181936856\n\nReviewed by Aakash Jain.\n\nPass --no-checks to the revert invocation to skip the local pre-PR checks on the webkitbot\nserver since we don't have any SDKs installed there. Style EWS will still run on the commit.\n\n* Tools/WebKitBot/src/WebKitBot.mjs: Add `--no-check`.\n* Tools/WebKitBot/tests/WebKitBot.test.mjs: Add coverage for the revert command builder.\n\nCanonical link: https://commits.webkit.org/317081@main",
      "email": "ryanhaddad@apple.com",
      "hash": "c3b0e52db623f0dea86b977f08a9ba766770cf8d",
      "subject": "[webkitbot] Revert runs style checks, fails trying to call swift"
    },
    "317082@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "317082@main",
      "clUrl": "https://commits.webkit.org/317082@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319258\n\nReviewed by Tim Nguyen.\n\nUpdate custom elements tests as of ca2cd19351859f7a15e536d0cf655fcaefe8e4d2.\n\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/element-internals-aria-element-reflection-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/element-internals-aria-element-reflection.html:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/form-associated/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/htmlconstructor/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/parser/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/perform-microtask-checkpoint-before-construction.html:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/reactions/customized-builtins/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/reactions/resources/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/reactions/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/registries/Element-innerHTML-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/registries/Element-innerHTML.html:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/registries/element-mutation-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/registries/element-mutation.html:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/registries/scoped-registry-append-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/custom-elements/registries/scoped-registry-append-does-not-upgrade-expected.txt.\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/registries/scoped-registry-append.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/custom-elements/registries/scoped-registry-append-does-not-upgrade.html.\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/registries/scoped-registry-effective-global-registry-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/registries/scoped-registry-effective-global-registry.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/registries/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/resources/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/state/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/upgrading/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/w3c-import.log:\n\nCanonical link: https://commits.webkit.org/317082@main",
      "email": "rniwa@webkit.org",
      "hash": "5cda5f6c19bd6a8c06890885867c0a032cb80e1e",
      "subject": "Sync custom elements tests"
    },
    "317083@main": {
      "author": "Sam Weinig",
      "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64",
      "cl": "317083@main",
      "clUrl": "https://commits.webkit.org/317083@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319268\n\nReviewed by Alan Baradlay.\n\n- Replaces `forwardInheritedValue` overloads with a single generic version.\n- Removes macro for forward declaring custom function sets.\n- Removes forward declaration of functions that don't exist.\n\n* Source/WebCore/style/StyleBuilderCustom.h:\n\nCanonical link: https://commits.webkit.org/317083@main",
      "email": "sam@webkit.org",
      "hash": "9100d1e997f262cad49c831df7c479d98ced8062",
      "subject": "Cleanup StyleBuilderCustom.h a bit"
    }
  },
  "date": "2026-07-13",
  "days": 1,
  "generatedAt": "2026-07-13T22:06:03Z",
  "markdown": "## Highlights\n- **Rendering** Fractional-zoom inset box shadows now keep even spread thickness, fixing a visible zoom artifact in CSS effects. [commit 317080@main](https://commits.webkit.org/317080@main)\n- **Web Platform** Media and container queries now evaluate against unzoomed lengths, aligning zoom behavior more closely with spec expectations. [commit 317069@main](https://commits.webkit.org/317069@main)\n- **Security** SVG SMIL interval resolution now has iteration bounds to prevent potential hangs from pathological animation state. [commit 317014@main](https://commits.webkit.org/317014@main)\n- **Networking** The Network process now runs with JSC disabled, shrinking attack surface and process complexity. [commit 317051@main](https://commits.webkit.org/317051@main)\n- **A11y** Voice Control labels now track page scale correctly instead of clustering on top-left elements when zoomed layouts are used. [commit 317042@main](https://commits.webkit.org/317042@main)\n- **DevTools** Web Inspector can now override more page settings through `Page.overrideSetting`, expanding automation and debugging coverage. [commit 317062@main](https://commits.webkit.org/317062@main)\n- **Privacy** Navigation Timing now bases cross-origin redirect opt-in on the destination origin, tightening redirect exposure semantics. [commit 317061@main](https://commits.webkit.org/317061@main)\n- **Web Platform** `String.raw` is now implemented in C++, and structured cloning logic moved deeper into JSC, continuing runtime and standards plumbing work. [commit 317009@main](https://commits.webkit.org/317009@main) [commit 317008@main](https://commits.webkit.org/317008@main)\n- **UI** Trackpad swiping between macOS spaces no longer accidentally triggers back navigation in AppKit gesture handling. [commit 317071@main](https://commits.webkit.org/317071@main)\n\n## What landed by area\n\n### CSS and layout\n- **Rendering** `corner-shape` now treats `square` as a special case, tightening shape rendering behavior. [commit 317046@main](https://commits.webkit.org/317046@main)\n- **Rendering** Added `corner-shape: square` reftests to lock in the new behavior. [commit 317045@main](https://commits.webkit.org/317045@main)\n- **Rendering** Grid cleanup now stores resolved track listings separately from positions, making track data flow clearer. [commit 317067@main](https://commits.webkit.org/317067@main)\n- **Rendering** Flex layout now returns position and cross-size lists directly from producing phases, reducing state threading. [commit 317068@main](https://commits.webkit.org/317068@main)\n- **Rendering** Flex line computation was folded together with main-axis gap handling, simplifying line construction. [commit 317078@main](https://commits.webkit.org/317078@main)\n- **Rendering** Cross-axis alignment offsets in flex layout are now folded into the position list, trimming separate bookkeeping. [commit 317038@main](https://commits.webkit.org/317038@main)\n- **Refactor** RenderFlexibleBox member functions were regrouped by layout phase to make the code easier to follow. [commit 317031@main](https://commits.webkit.org/317031@main)\n- **Refactor** Stateless flex queries and geometry helpers moved into a new `FlexLayoutUtils` helper class. [commit 317013@main](https://commits.webkit.org/317013@main)\n- **Refactor** Flex length freeze helpers were inlined into `resolveFlexibleLengthsForLineItems`, further flattening the flex algorithm. [commit 317010@main](https://commits.webkit.org/317010@main)\n- **Build** Safer C++ warnings in `FlexLayoutUtils` were fixed after the refactor. [commit 317065@main](https://commits.webkit.org/317065@main)\n- **Rendering** GFC added scaffolding to classify the intrinsic-width sizing path, paving the way for more granular sizing behavior work. [commit 317063@main](https://commits.webkit.org/317063@main)\n- **Refactor** `StyleBuilderCustom.h` got a cleanup pass to reduce local complexity. [commit 317083@main](https://commits.webkit.org/317083@main)\n- **Rendering** Font metadata representation was synchronized across size, orientation, and related attributes for more consistent internal handling. [commit 317059@main](https://commits.webkit.org/317059@main)\n\n### SVG, animation, and graphics\n- **Rendering** LBSE now caches SVG transform origin on `RenderSVGModelObject`, reducing repeated computation. [commit 317077@main](https://commits.webkit.org/317077@main)\n- **Perf** SVG child painting now clips once per container instead of once per shape in LBSE, cutting repeated clip work. [commit 317036@main](https://commits.webkit.org/317036@main)\n- **Rendering** `SVGSMILElement` no longer accumulates duplicate instance times from repeated `beginElementAt` and `endElementAt` calls. [commit 317007@main](https://commits.webkit.org/317007@main)\n- **Web Platform** Animation triggers gained parsing support for `timeline-trigger-active-range-start` and `timeline-trigger-active-range-end`. [commit 317027@main](https://commits.webkit.org/317027@main)\n- **Media** Negative elevations now use the correct HRTF elevation response in audio spatialization. [commit 317043@main](https://commits.webkit.org/317043@main)\n- **Media** `AudioParamTimeline::cancelAndHoldAtTime` now preserves exceptions from the second `insertEvent` call. [commit 317019@main](https://commits.webkit.org/317019@main)\n\n### JavaScriptCore and platform APIs\n- **V8** `AsyncFromSyncIterator` now closes correctly when the sync iterator yields a rejected promise value. [commit 317012@main](https://commits.webkit.org/317012@main)\n- **V8** Internal readable and writable stream methods now catch JS exceptions on non-JS code paths, hardening stream embedding behavior. [commit 317079@main](https://commits.webkit.org/317079@main)\n- **V8** Object structured cloning code moved into JSC, consolidating serialization machinery lower in the stack. [commit 317008@main](https://commits.webkit.org/317008@main)\n- **Web Platform** Fullscreen API coverage expanded with tests for previously untested spec areas. [commit 317070@main](https://commits.webkit.org/317070@main)\n- **Web Platform** `requestFullscreen` no longer redundantly re-checks the pending fullscreen element. [commit 317020@main](https://commits.webkit.org/317020@main)\n- **Web Platform** `OriginAgentClusterEnabled` was marked stable. [commit 317057@main](https://commits.webkit.org/317057@main)\n- **Web Platform** `WorkerParseErrorReportingEnabled` was marked stable. [commit 317056@main](https://commits.webkit.org/317056@main)\n- **Web Platform** The `DevolvableWidgetsEnabled` preference was removed. [commit 317058@main](https://commits.webkit.org/317058@main)\n- **Web Platform** Custom elements tests were synced with upstream expectations. [commit 317082@main](https://commits.webkit.org/317082@main)\n- **Web Platform** URLPattern tests were synced from WPT. [commit 317076@main](https://commits.webkit.org/317076@main)\n\n### Networking, storage, and process model\n- **Networking** `FetchHeaders::appendToHeaderMap` no longer performs a redundant lookup on every append. [commit 317044@main](https://commits.webkit.org/317044@main)\n- **Networking** Frame tree logging now avoids unnecessary WebContent IPC, trimming diagnostic overhead. [commit 317015@main](https://commits.webkit.org/317015@main)\n- **Networking** Remote intersection observers now update across all frames under site isolation, not just the main frame. [commit 317066@main](https://commits.webkit.org/317066@main)\n- **Networking** `ipc/loadping-firstpartyforcookies-message-check.html` assertion failures were fixed. [commit 317024@main](https://commits.webkit.org/317024@main)\n- **Privacy** App privacy plumbing had an iOS flaky timeout test quarantined around service worker initiated requests. [commit 317073@main](https://commits.webkit.org/317073@main)\n- **Web Platform** IndexedDB `getCount()` no longer truncates record counts above `INT_MAX`. [commit 317026@main](https://commits.webkit.org/317026@main)\n- **Web Platform** `IDBTransaction::objectStore()` got a simpler object-store lookup path. [commit 317023@main](https://commits.webkit.org/317023@main)\n\n### Editing, DOM, and content handling\n- **UI** Pasting Confluence content in Dark Mode now renders correctly instead of producing bad themed output. [commit 317029@main](https://commits.webkit.org/317029@main)\n- **Web Platform** `HTMLFrameSetElement` now updates `frameborder` and `noresize` correctly after dynamic attribute changes. [commit 317022@main](https://commits.webkit.org/317022@main)\n- **A11y** Text extraction now emits a `clickable` token for images, SVGs, and other containers that visually behave like controls. [commit 317016@main](https://commits.webkit.org/317016@main)\n- **Mobile** An iOS text selection timeout around long press with a hardware keyboard was debugged and addressed in testing. [commit 317060@main](https://commits.webkit.org/317060@main)\n\n### Web Inspector and developer workflow\n- **DevTools** Removing a DOM breakpoint no longer deletes sibling breakpoints that share the same URL. [commit 317054@main](https://commits.webkit.org/317054@main)\n- **DevTools** The named color `crimson` now maps to the correct RGB value in Web Inspector. [commit 317047@main](https://commits.webkit.org/317047@main)\n- **Build** CMake on Mac now builds with the internal SDK. [commit 317055@main](https://commits.webkit.org/317055@main)\n- **Build** Radar auto-update now marks draft PRs as Analyze/Fix. [commit 317064@main](https://commits.webkit.org/317064@main)\n- **Build** Safer C++ expectations were updated after earlier refactoring. [commit 317039@main](https://commits.webkit.org/317039@main)\n- **Build** A style-checking revert bot issue involving Swift invocation was reverted to unblock the tree. [commit 317081@main](https://commits.webkit.org/317081@main)\n\n### Platform, ports, and runtime stability\n- **Mobile** The WebThread was disabled again for iOS WebKitLegacy. [commit 317037@main](https://commits.webkit.org/317037@main)\n- **Security** Debug threading assertions added earlier were promoted to release assertions, strengthening failure detection in production builds. [commit 317035@main](https://commits.webkit.org/317035@main)\n- **Security** `WTFReportBacktraceWithStackDepth` no longer prints uninitialized stack frames when the captured stack is shallower than requested. [commit 317034@main](https://commits.webkit.org/317034@main)\n- **Media** LibWebRTC fixed an alloc/dealloc mismatch in `NetworkRTCMonitor`. [commit 317033@main](https://commits.webkit.org/317033@main)\n- **Build** GTK and WPE fixed a GCC 15 discarded-qualifier warning in `xdgmime.c`. [commit 317041@main](https://commits.webkit.org/317041@main)\n- **GPU** GTK and WPE Skia compositor paths now avoid linear interpolation when it is not needed. [commit 317030@main](https://commits.webkit.org/317030@main)\n- **GPU** `CoordinatedPlatformLayerBufferNativeImage::tryEnsureBuffer` now creates the correct bitmap texture layout for the Skia compositing path. [commit 317028@main](https://commits.webkit.org/317028@main)\n- **Build** `WTF_GUniquePtr.Basic` debug failures on GTK and WPE were fixed. [commit 317017@main](https://commits.webkit.org/317017@main)\n- **Build** Slovenian GTK translations were updated. [commit 317032@main](https://commits.webkit.org/317032@main)\n- **Security** An off-by-one out-of-bounds read in `KanjiCode::judge()` was fixed. [commit 317011@main](https://commits.webkit.org/317011@main)\n- **Rendering** A debug crash regression in `imported/blink/fast/backgrounds/bug420029.html` was fixed. [commit 317040@main](https://commits.webkit.org/317040@main)\n\n### Core cleanup and low-level fixes\n- **Refactor** `RenderTreeBuilder::attachToRenderElement` no longer carries an uninitialized `RenderTable` local. [commit 317053@main](https://commits.webkit.org/317053@main)\n- **Refactor** `EnumSet` and `SmallSet` now use `std::has_single_bit()` instead of open-coded checks. [commit 317052@main](https://commits.webkit.org/317052@main)\n- **Refactor** `StringConcatenate` padding and indentation adapters now use `std::ranges::fill`. [commit 317049@main](https://commits.webkit.org/317049@main)\n- **Refactor** `HTMLVideoElement::hasAvailableVideoFrame` was simplified to avoid redundant `player()` and `protect()` calls. [commit 317050@main](https://commits.webkit.org/317050@main)\n- **UI** `ASCredentialUpdater` was migrated to `ASCredentialDataManager`. [commit 317048@main](https://commits.webkit.org/317048@main)\n- **Perf** `RenderTreeUpdater::Parent` fields were reordered to remove struct padding. [commit 317025@main](https://commits.webkit.org/317025@main)\n- **Perf** `WebVTTTokenizer::emitToken` now moves `WebVTTToken` through the out-parameter instead of copying it. [commit 317021@main](https://commits.webkit.org/317021@main)\n- **Perf** `PODIntervalTree::nextIntervalAfter` now returns the nearest following interval correctly. [commit 317018@main](https://commits.webkit.org/317018@main)\n\n## Reverts \u0026 Reapplies\n- **Build** Reverted a style-check path that was failing when trying to call Swift during bot runs. [commit 317081@main](https://commits.webkit.org/317081@main)",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [],
  "since": "2026-07-13",
  "totals": {
    "commits": 77,
    "features": 77,
    "rolls": 0
  },
  "until": "2026-07-13"
}