{
  "commits": {
    "317063@main": {
      "author": "Yulun Wu",
      "avatar": "https://www.gravatar.com/avatar/9e34d6632f4d926cdf6fe8dce07f9cb7?d=identicon\u0026s=64",
      "cl": "317063@main",
      "clUrl": "https://commits.webkit.org/317063@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319294\n\u003crdar://182131247\u003e\n\nReviewed by Sammy Gill.\n\nGridFormattingContext::computeIntrinsicWidths() only needs the grid's\ncolumn track sizes, but it obtained them by running the full grid layout\n(GridLayout::layout) once per intrinsic scenario. That full path also\nsizes the rows, lays out every grid item, and computes margins,\nalignment, and item rects — all of which are discarded when only the\ncolumn sizes are read.\n\nNot all of the work needs to be done for every grid layout. A grid with items\nthat do not depend on their block size when computing inline contributions\ndoes not require all of layout, and we can instead finish with just the first step\nof the grid sizing algorithm.\n\nSpec:\n\nhttps://www.w3.org/TR/css-grid-2/#algo-grid-sizing\n\nSee also:\n\nhttps://commits.webkit.org/317063@main\n\n* Source/WebCore/layout/formattingContexts/grid/GridFormattingContext.cpp:\n(WebCore::Layout::GridFormattingContext::computeIntrinsicWidths):\n* Source/WebCore/layout/formattingContexts/grid/GridLayout.cpp:\n(WebCore::Layout::GridLayout::layout):\n* Source/WebCore/layout/formattingContexts/grid/GridLayout.h:\n\nCanonical link: https://commits.webkit.org/317187@main",
      "email": "yulun_wu@apple.com",
      "hash": "ac8f2d360bbdd3aff75e5df8666ea6a4280d4576",
      "subject": "[GFC] Add a columns-only fast path for intrinsic width computation"
    },
    "317084@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317084@main",
      "clUrl": "https://commits.webkit.org/317084@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319270\nrdar://182113358\n\nReviewed by Devin Rousso.\n\nCSSManager keeps two maps: `_styleSheetIdentifierMap`, keyed by stylesheet id\n(`target:styleSheetId`), and `_styleSheetFrameURLMap`, keyed by frame+URL\n(`frame.id + \":\" + url`). `_clearStyleSheetsForResource` is meant to evict the\nframe+URL entry so the next `_lookupStyleSheet` misses and re-fetches via\n`_fetchInfoForAllStyleSheets`, but it called `delete` on\n`_styleSheetIdentifierMap` with a frame+URL key. That key can never exist in the\nid-keyed map, so the delete was a permanent no-op and a stale stylesheet could be\nreturned after a stylesheet resource was added (`_resourceAdded`) or its type\nchanged to StyleSheet (`_resourceTypeDidChange`).\n\nThis was introduced in 166259@main when the plain-object maps were converted to\n`Map`; the two `delete` lines in this method were retargeted to the wrong map\nwhile every other reference correctly stayed on `_styleSheetFrameURLMap`.\n\nDelete from `_styleSheetFrameURLMap` instead, matching the key that\n`_frameURLMapKey` produces and the map that `_lookupStyleSheet` reads.\n\nTest: inspector/css/clear-stylesheets-for-resource-invalidates-cache.html\n\n* Source/WebInspectorUI/UserInterface/Controllers/CSSManager.js:\n(WI.CSSManager.prototype._clearStyleSheetsForResource): Evict from the frame+URL\nmap so the next lookup re-fetches.\n\n* LayoutTests/inspector/css/clear-stylesheets-for-resource-invalidates-cache.html: Added.\n* LayoutTests/inspector/css/clear-stylesheets-for-resource-invalidates-cache-expected.txt: Added.\nPrimes the frame+URL cache, confirms a repeat lookup is served from the cache,\nthen confirms a lookup after Resource.Event.TypeDidChange re-fetches. The last\ncase fails without the fix.\n\nCanonical link: https://commits.webkit.org/317084@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "fe24f90cc7e7901576f3561ff7b2dee255063cee",
      "subject": "Web Inspector: stylesheet resource cache is never invalidated when a resource is added or changes type"
    },
    "317085@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "317085@main",
      "clUrl": "https://commits.webkit.org/317085@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=319249\u003e\n\u003crdar://161777392\u003e\n\nReviewed by Eric Carlson and Youenn Fablet.\n\nSkip packed-Bayer ProRes RAW formats when generating presets before\nthe resolution de-duplication since they are not currently supported.\n\n* Source/WebCore/PAL/pal/spi/cf/CoreVideoSPI.h:\n- Declare kCVPixelFormatType_96BayerPacked12_BGGR for public-SDK builds.\n* Source/WebCore/platform/mediastream/cocoa/AVVideoCaptureSource.mm:\n(WebCore::AVVideoCaptureSource::commitConfiguration):\n- Wrap -commitConfiguration in @try/@catch so a commit-time\n  exception is logged instead of aborting the GPU process.\n(WebCore::AVVideoCaptureSource::generatePresets):\n- Ignore the packed-Bayer ProRes RAW formats.\n\nCanonical link: https://commits.webkit.org/317085@main",
      "email": "ddkilzer@apple.com",
      "hash": "5d438a89c9c8bf0f021fabe4cb953656f3f8a431",
      "subject": "AVVideoCaptureSource should skip packed-Bayer ProRes RAW formats when generating capture presets"
    },
    "317086@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "317086@main",
      "clUrl": "https://commits.webkit.org/317086@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319223\nrdar://181625207\n\nReviewed by Darin Adler.\n\nisUserVisibleURL() is a fast-path guard that returns YES only when\nuserVisibleString() is guaranteed to leave a URL unchanged; callers use\nit to skip IDN / percent-escape normalization. When 286606@main\nrewrote its scanning loop from a pointer that advanced each iteration\n(`while (auto character = *characters++)`) into a range-for over a fixed\nspan, the look-ahead accesses were left as the literal indices\ncharacters[0], characters[1] and characters[2]. Those now always refer\nto the first few bytes of the string instead of the bytes following the\ncurrent character.\n\nAs a result, a percent-escape that expands to a non-ASCII byte, or an\n\"xn--\" IDN sequence, is only detected when it happens to sit at the very\nstart of the string. For any URL where the triggering sequence appears\nlater (e.g. \"http://example.com/%E2%82%AC\" or \"http://xn--nxasmq6b.com/\")\nthe function wrongly returns YES, so the required normalization is\nskipped.\n\nFix the look-ahead to be position-relative and bounds-checked, using\nindexedRange() to iterate the span with its index. The explicit\n`i + 2 \u003c size` / `i + 3 \u003c size` guards also make the accesses safe by\nconstruction rather than relying on short-circuit evaluation.\n\nTest: URLExtras.IsUserVisibleURL\n\n* Source/WTF/wtf/cocoa/NSURLExtras.mm:\n(WTF::isUserVisibleURL):\n* Tools/TestWebKitAPI/Tests/WTF/cocoa/URLExtras.mm:\n(TestWebKitAPI::TEST(URLExtras, IsUserVisibleURL)):\n\nCanonical link: https://commits.webkit.org/317086@main",
      "email": "cdumez@apple.com",
      "hash": "94eeb1642d1c7d5be84d5147bed2809641508a73",
      "subject": "isUserVisibleURL() inspects the wrong bytes for %-escapes and \"xn--\""
    },
    "317087@main": {
      "author": "Yijia Huang",
      "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64",
      "cl": "317087@main",
      "clUrl": "https://commits.webkit.org/317087@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319278\nrdar://182118211\n\nReviewed by Yusuke Suzuki.\n\nFour bugs found by cross-checking against temporal_rs and icu4x:\n\n1. Coptic / Ethiopic `am` era was mapped to ICU era 0 (before-AM); the\ncorrect value is 1 (AM). Dates constructed via era:\"am\" ended up ~5500\nyears off.\n\n2. Japanese / ROC / Buddhist year/month/leap-year accessors used ICU's\nJulian arithmetic for pre-1582 dates (ICU4C rejects\nucal_setGregorianChange on these derived calendars). Spec requires\nproleptic Gregorian; route those accessors through the base Gregorian\ncalendar via gregorianArithmeticCalendarFor().\n\n3. Buddhist year: ICU's UCAL_EXTENDED_YEAR is the Gregorian year, not the\nBE year (BE = Gregorian + 543). Read/write paths now use UCAL_YEAR\n(which ICU exposes as BE for Buddhist).\n\n4. Buddhist ecmaReferenceYear: was 1972 (Gregorian-year convention), but\npost-fix (3) the Buddhist write path expects BE, so 1972 was interpreted\nas BE and resolved to Gregorian 1429 (non-leap), regressing\nintl402/.../constrain-to-leap-day.js. Use 2515 BE (= Gregorian 1972,\nleap), matching the calendar-native-year convention already used for\nROC (61) and Indian.\n\nTests: JSTests/stress/temporal-calendar-icu-bridge-non-iso.js\n       Source/JavaScriptCore/API/tests/TemporalCoreTest.cpp\n\nCanonical link: https://commits.webkit.org/317087@main",
      "email": "yijia_huang@apple.com",
      "hash": "2fb282a825385d9f53f09b6adc07b18f19203276",
      "subject": "[JSC][Temporal] Fix non-ISO Calendar bugs in CalendarICUBridge"
    },
    "317088@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317088@main",
      "clUrl": "https://commits.webkit.org/317088@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319274\nrdar://182115866\n\nReviewed by Devin Rousso.\n\nDebuggerManager.updateProbesForBreakpoint() has two loops that walk a\nbreakpoint's probe actions to reconcile them against the known probes.\nBoth used `break` where they should have used `continue`:\n\n- The loop that creates newly-added probes bailed out entirely after\n  creating the first new probe, so any additional new probes in the same\n  pass were never created (and existing probes ordered after it never had\n  their expressions refreshed).\n\n- The loop that reaps probes no longer present stopped at the first probe\n  that was still present, leaking any missing probe ordered after it in\n  the known-identifier set (e.g. removing a middle or trailing probe left\n  a stale WI.Probe in _probesByIdentifier and in the probe set).\n\nThese are normally masked because each single action mutation dispatches\nits own ActionsDidChange event, so a pass usually sees only one changed\nprobe. The bug surfaces when a pass sees more than one change at once,\nsuch as removing a non-first probe while others survive.\n\nChanged both `break` statements to `continue`.\n\nTest: inspector/debugger/probe-manager-remove-middle-action.html\n\n* LayoutTests/inspector/debugger/probe-manager-remove-middle-action-expected.txt: Added.\n* LayoutTests/inspector/debugger/probe-manager-remove-middle-action.html: Added.\n* Source/WebInspectorUI/UserInterface/Controllers/DebuggerManager.js:\n(WI.DebuggerManager.prototype.updateProbesForBreakpoint):\n\nCanonical link: https://commits.webkit.org/317088@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "a39497ed4d9f8a3bfd65df6b07b50efe19eaac99",
      "subject": "Web Inspector: probe manager drops probes when a breakpoint has multiple probe actions added or removed at once"
    },
    "317089@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "317089@main",
      "clUrl": "https://commits.webkit.org/317089@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319229\n\nReviewed by Darin Adler and Yusuke Suzuki.\n\nparseInteger() silently accepts a single leading '+', so UUID::parse()\nguards against a '+' at the start of each segment before delegating to\nit. The five segments begin at indices 0, 9, 14, 19 and 24, but the\nguard checked only 0, 9, 19 and 24 -- the third segment (index 14) was\nomitted.\n\nAs a result a malformed string such as\n\"01234567-89ab-+def-0123-456789abcdef\" was accepted and aliased to the\ncanonical \"01234567-89ab-0def-0123-456789abcdef\", so two distinct\nstrings mapped to a single UUID identity. Add the missing index-14\ncheck.\n\nThis gap could not be caught through parseVersion4(): a leading '+' at\nindex 14 consumes a character slot, leaving only 3 hex digits, so the\nversion nibble can never be 4 and the version check rejects the input\nbefore the '+' would matter. The new test therefore exercises parse()\ndirectly.\n\nTest: WTF.UUIDParseRejectsLeadingPlusInEachSegment\n\n* Source/WTF/wtf/UUID.cpp:\n(WTF::UUID::parse):\n* Tools/TestWebKitAPI/Tests/WTF/UUID.cpp:\n(TEST(WTF, UUIDParseRejectsLeadingPlusInEachSegment)):\n\nCanonical link: https://commits.webkit.org/317089@main",
      "email": "cdumez@apple.com",
      "hash": "fac50442561859ce96263a686864803d53965d4a",
      "subject": "UUID::parse fails to reject a leading '+' in the third segment"
    },
    "317090@main": {
      "author": "Alex Christensen",
      "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64",
      "cl": "317090@main",
      "clUrl": "https://commits.webkit.org/317090@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319273\nrdar://182115695\n\nReviewed by Chris Dumez.\n\nWe sometimes hit Error::MultipleWaitingClients because WebFrameProxy::waitForCertificateInfoFromNetworkProcess\ncalls waitForAndDispatchImmediately\u003cMessages::NetworkProcessProxy::ReceivedMainResourceResponseWithCertificateInfo\u003e\nwhich re-enters WebFrameProxy::waitForCertificateInfoFromNetworkProcess and then re-calls waitForAndDispatchImmediately\non the same stack frame if it fails more than once.\n\nThe solution is basically reverting the original solution to rdar://177670634 originally landed at\nhttps://commits.webkit.org/305413.936@safari-7624.3.4-branch and doing it a better way, similar to my PR proposal in\nthat radar, but adding a new message receiver to eliminate the need for ExceptionForDispatchedFrom.  I do this\nby adding a new message receiver WebFrameProxyFromNetworkProcess and a new attribute ReceiverName to have it\nsend messages to WebFrameProxy instead of looking for a non-existing class WebFrameProxyFromNetworkProcess.\n\n* Source/WebKit/CMakeLists.txt:\n* Source/WebKit/DerivedSources-input.xcfilelist:\n* Source/WebKit/DerivedSources-output.xcfilelist:\n* Source/WebKit/DerivedSources.make:\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:\n(WebKit::NetworkResourceLoader::didReceiveMainResourceResponse):\n* Source/WebKit/Scripts/webkit/messages.py:\n(handler_function):\n(generate_message_handler):\n* Source/WebKit/Scripts/webkit/model.py:\n(MessageReceiver.__init__):\n* Source/WebKit/Scripts/webkit/parser.py:\n(parse):\n* Source/WebKit/Sources.txt:\n* Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp:\n(WebKit::NetworkProcessProxy::dispatchMessage):\n(WebKit::NetworkProcessProxy::receivedMainResourceResponseWithCertificateInfo): Deleted.\n* Source/WebKit/UIProcess/Network/NetworkProcessProxy.h:\n* Source/WebKit/UIProcess/Network/NetworkProcessProxy.messages.in:\n* Source/WebKit/UIProcess/WebFrameProxy.cpp:\n(WebKit::WebFrameProxy::waitForCertificateInfoFromNetworkProcess):\n* Source/WebKit/UIProcess/WebFrameProxy.h:\n* Source/WebKit/UIProcess/WebFrameProxyFromNetworkProcess.messages.in: Added.\n\nCanonical link: https://commits.webkit.org/317090@main",
      "email": "achristensen@apple.com",
      "hash": "d9fc643371912867bb785334877cd0a836ef67cd",
      "subject": "REGRESSION(316854@main): [macOS Debug] ASSERTION FAILED: !m_waitingForMessage in imported/w3c/web-platform-tests/html/cross-origin-opener-policy/resource-popup.https.html"
    },
    "317091@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "317091@main",
      "clUrl": "https://commits.webkit.org/317091@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319231\n\nReviewed by Darin Adler and Brent Fulgham.\n\nThe generation-time assert that verifies a value was specified for\n[EnabledByQuirk] was mistakenly checking the {DisabledByQuirk} extended\nattribute instead of {EnabledByQuirk}. As a result, an IDL declaration\nwritten as [EnabledByQuirk] with no \"=value\" would not trip the assert\n(undef eq \"VALUE_IS_MISSING\" is false); the generator would instead\nsplit on the literal \"VALUE_IS_MISSING\" and emit broken C++ such as\n-\u003equirks().VALUE_IS_MISSINGQuirk() rather than failing loudly with a\nclear diagnostic. Check the attribute's own key so the assert fires as\nintended, matching the sibling EnabledConditionallyReadWriteBySetting and\nDisabledByQuirk blocks.\n\n* Source/WebCore/bindings/scripts/CodeGeneratorJS.pm:\n(GenerateRuntimeEnableConditionalString):\n\nCanonical link: https://commits.webkit.org/317091@main",
      "email": "cdumez@apple.com",
      "hash": "6fec41aa12c4019412b33da9205cbba9aea7472d",
      "subject": "Fix EnabledByQuirk value-missing assertion checking the wrong extended attribute"
    },
    "317092@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "317092@main",
      "clUrl": "https://commits.webkit.org/317092@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319225\n\nReviewed by Darin Adler.\n\nThey were using `=` and doing an assignment instad of doing a comparison\nusing `==`.\n\n* Source/WTF/wtf/ListHashSet.h:\n(WTF::ListHashSetLink::insertAfter):\n(WTF::ListHashSetLink::insertBefore):\n\nCanonical link: https://commits.webkit.org/317092@main",
      "email": "cdumez@apple.com",
      "hash": "bbfcb3eda714c09be1ed79a150e1a437d59a15a5",
      "subject": "Fix bad assertions in ListHashSetLink::insertAfter() and ListHashSetLink::insertBefore()"
    },
    "317093@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "317093@main",
      "clUrl": "https://commits.webkit.org/317093@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319233\n\nReviewed by Darin Adler.\n\nWhen deciding whether an IDL file must be re-processed, generate-bindings-all.pl\ncompares the file's previous set of supplemental dependencies against the current\nset. The comparison was written as:\n```\n      @{$oldSupplements{$absPath}} ne @{$newSupplements{$absPath} or []}\n```\n`ne` is a string operator, so both arrays are evaluated in scalar context, i.e.\ntheir element counts. This only compares the *number* of supplemental\ndependencies, not their contents. As a result, a supplement set that changes to a\ndifferent set of the same size -- for example [A.idl] becoming [B.idl] -- is not\ndetected as a change. Because the subsequent mtime-based check only inspects the\nfiles still present in the new supplement set, the stale JS*.cpp/.h for that\ninterface is never regenerated, producing incorrect bindings until an unrelated\nchange forces a rebuild.\n\nCompare the lists by contents instead. The supplement lists are already stored\nsorted (see readSupplementalDependencyFile), so joining each with a NUL separator,\na byte that cannot appear in a filesystem path, yields an order-stable,\ncollision-free comparison that correctly detects additions, removals, and\nsame-size swaps. Also switch the deref fallback from `or []` to `|| []` for\ncorrect precedence.\n\n* Source/WebCore/bindings/scripts/generate-bindings-all.pl:\n\nCanonical link: https://commits.webkit.org/317093@main",
      "email": "cdumez@apple.com",
      "hash": "15327146e8a258e27b3315e080e9009f1bb38928",
      "subject": "generate-bindings-all.pl misses supplemental dependency changes that preserve list size"
    },
    "317094@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "317094@main",
      "clUrl": "https://commits.webkit.org/317094@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319234\n\nReviewed by Darin Adler.\n\nMergeExtendedAttributesFromSupplemental dies when a supplemental interface\n(partial or mixin via includes) supplies a duplicate, non-mergeable extended\nattribute. The diagnostic was written as:\n```\n      die \"... when merging extended attributes for ${property-\u003ename}\";\n```\nIn a double-quoted string, ${property-\u003ename} is not a method call. Perl parses\n${ ... } as a symbolic-reference/block dereference and attempts to resolve\n`name` as a method on the bareword package `property`, so instead of the\nintended message the generator dies with an unrelated:\n```\n      Can't locate object method \"name\" via package \"property\"\n```\nwhich masks the real cause (which property actually carried the conflicting\nextended attribute). Build the message with string concatenation so\n$property-\u003ename is invoked as a method.\n\nLike the message it replaces, this only fires on an error path, but that is\nprecisely when a clear diagnostic matters. All callers pass an IDLAttribute,\nIDLOperation, IDLConstant, or IDLDictionaryMember, each of which provides a\n`name` accessor.\n\n* Source/WebCore/bindings/scripts/CodeGenerator.pm:\n(MergeExtendedAttributesFromSupplemental):\n\nCanonical link: https://commits.webkit.org/317094@main",
      "email": "cdumez@apple.com",
      "hash": "2898162c8c2a3c2bbcd3538f10d5740d6b6a4e03",
      "subject": "Broken interpolation in duplicate-extended-attribute error message in CodeGenerator.pm"
    },
    "317095@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "317095@main",
      "clUrl": "https://commits.webkit.org/317095@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319230\n\nReviewed by Darin Adler and Yusuke Suzuki.\n\npairIntHash() implements the multiplicative hashing scheme from\nopendatastructures.org, whose final step folds the 2w-bit product down\nto the high w bits (w = 32, the width of unsigned). It did this with:\n```\n      product \u003e\u003e (sizeof(uint64_t) - sizeof(unsigned))\n```\nsizeof() returns a byte count, but \u003e\u003e shifts by bits, so this evaluated\nto `product \u003e\u003e 4` rather than the intended `product \u003e\u003e 32`. The result\n(named highBits) was therefore bits [4, 36) of the product -- mostly the\npoorly-mixed low bits that multiplicative hashing deliberately discards,\ninstead of the well-mixed high 32 bits [32, 64).\n\nThis does not affect correctness: the hash remains deterministic, so\nHashMap/HashSet stay correct. But it worsens bit-mixing and raises\ncollision rates for tables keyed on integer std::pair/tuple values\n(PairHash, and the DefaultHash for std::pair), which is especially\nnoticeable for clustered small-integer keys.\n\nMultiply the byte-width difference by 8 to shift by the correct number\nof bits.\n\n* Source/WTF/wtf/HashFunctions.h:\n(WTF::pairIntHash):\n\nCanonical link: https://commits.webkit.org/317095@main",
      "email": "cdumez@apple.com",
      "hash": "b420bd34107467e3dcf8e9e5c05d2a042b97cfdb",
      "subject": "pairIntHash extracts the wrong bits of the 64-bit product, degrading hash distribution"
    },
    "317096@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "317096@main",
      "clUrl": "https://commits.webkit.org/317096@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319235\n\nReviewed by Darin Adler.\n\nThe generated values/keys/entries \"...Caller\" function for an async iterable\ntakes its this-pointer as a parameter named `thisObject`. However, when the\nasync iterable declares arguments, GenerateArgumentConversions emitted their\nconversions using `*castedThis` (the hardcoded this-object reference passed to\nJSValueToNative) and `*castedThis-\u003erealm()` (the global-object reference set up\nin the async-iterable path). Neither `castedThis` exists in that scope -- only\n`thisObject` does -- so any async iterable whose argument conversion actually\nreferences the this-object or the realm would emit C++ that fails to compile.\n\nOnly certain argument types thread those references (see\nJSValueToNativeDOMConvertNeedsThisObject / NeedsGlobalObject): EventListener\nemits the this-object reference, and callback interfaces, callback functions,\nScheduledAction, and records with such value types emit the global-object\nreference. The one existing async-iterable test used `optional TestNode?\noption`, which needs neither, so the broken emission was latent and never\nexercised in-tree.\n\nFix it by threading the correct this-object reference through\nGenerateArgumentConversions. The subroutine gains a trailing $thisObjectReference\nparameter that defaults to \"*castedThis\", so the normal operation caller is\nunchanged; the async-iterable caller passes \"*thisObject\" and uses\n\"*thisObject-\u003erealm()\" for its global-object reference, matching the emitted\nparameter name.\n\nTo cover this, TestAsyncIterable.idl now declares an async iterable with a\ncallback-interface argument and an EventListener argument (plus the existing\noptional argument), which exercises both the global-object and this-object\nreference emission sites. Before this change the regenerated\nJSTestAsyncIterable.cpp referenced `*castedThis` / `*castedThis-\u003erealm()` inside\na function whose parameter is `thisObject`; after it, both correctly use\n`*thisObject` / `*thisObject-\u003erealm()`.\n\n* Source/WebCore/bindings/scripts/CodeGeneratorJS.pm:\n(GenerateArgumentConversions):\n(GenerateGenericIterableDefinition):\n* Source/WebCore/bindings/scripts/test/JS/JSTestAsyncIterable.cpp:\n(WebCore::jsTestAsyncIterablePrototypeFunction_valuesCaller):\n* Source/WebCore/bindings/scripts/test/TestAsyncIterable.idl:\n\nCanonical link: https://commits.webkit.org/317096@main",
      "email": "cdumez@apple.com",
      "hash": "06df73142fede7a42c9675c12b83ef117be6c3a6",
      "subject": "[Bindings] Async-iterable argument conversions reference a nonexistent castedThis"
    },
    "317097@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "317097@main",
      "clUrl": "https://commits.webkit.org/317097@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319232\n\nReviewed by Darin Adler.\n\nCodeGenerator::ForAllParents walks an interface's inheritance chain via a\nrecursive anonymous closure ($recurse). The closure supports pruning: if\nthe caller-supplied beforeRecursion callback returns the string 'prune',\nrecursion into that parent (and the matching afterRecursion call) is meant\nto be skipped. However, it implemented the skip with `next`:\n```\n      \u0026$beforeRecursion($parentInterface) eq 'prune' and next;\n```\n`next` is loop control, but $recurse is a plain sub invoked outside of any\nenclosing loop, so executing this path dies with \"Can't \\\"next\\\" outside a\nloop block\" rather than pruning. Use `return` instead, which exits the\nclosure and thereby skips both the recursion into that parent and its\nafterRecursion call, the intended prune semantics.\n\nThis is a latent bug: the prune feature is currently unreachable because no\nin-tree caller passes a beforeRecursion callback that returns 'prune' (all\nexisting callers either omit the callback or return other values), so the\nfatal path is never taken today. It would fire the moment any future\ncallback used the documented 'prune' sentinel, aborting code generation.\n\nNo bindings test is added because this path cannot be exercised through the\nbindings test harness.\n\n* Source/WebCore/bindings/scripts/CodeGenerator.pm:\n(ForAllParents):\n\nCanonical link: https://commits.webkit.org/317097@main",
      "email": "cdumez@apple.com",
      "hash": "81661ec627ed367308f1eea1ba5d956d7a0f09b9",
      "subject": "[Bindings] ForAllParents crashes instead of pruning when a beforeRecursion callback returns 'prune'"
    },
    "317098@main": {
      "author": "Anthony Tarbinian",
      "avatar": "https://www.gravatar.com/avatar/ef46154a1a21c6a5ef593e952ebc62f4?d=identicon\u0026s=64",
      "cl": "317098@main",
      "clUrl": "https://commits.webkit.org/317098@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319011\nrdar://181825035\n\nReviewed by Brent Fulgham.\n\ngithub.com serves Safari some JS that tries to adjust the scroll position\nwhich interferes with WebKit's scroll to fragment implementation.\nPresenting a Chrome-like UA for github.com to take the working code path.\n\n* Source/WebCore/page/Quirks.cpp:\n\nCanonical link: https://commits.webkit.org/317098@main",
      "email": "a_tarbinian@apple.com",
      "hash": "afdcc673bd1ad33a33601b2eb5b3b9d81c9a00d4",
      "subject": "github.com: Safari does not scroll to the GitHub issue comment when opening a link (worse than Chrome)"
    },
    "317099@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "317099@main",
      "clUrl": "https://commits.webkit.org/317099@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318597\n\nReviewed by Antti Koivisto.\n\nRenderFlexibleBox's flex sizing reached into the live flex item renderer even though it\nalready wraps each item in a FlexLayoutItem. Route the core sizing through that wrapper\nso it becomes the single point of access to the renderer -- a prerequisite for\neventually sizing from an up-front snapshot, and for fragmentation, where the item list\nbecomes a partial subset.\n\nRename the item list from allItems to flexItems, since \"all\" will no longer be true once\nthe list is a fragment's subset.\n\nFlexLayoutItem no longer takes the FlexBaseAndHypotheticalMainSize at construction: its\nminMaxSizes field duplicated the sizing list and was read in a single place, so it is\ndropped and the clamp becomes a file-static helper fed from the sizing list.\ncollectFlexItems now builds the item first and computes the flex base through it.\n\nThe flex-base subgraph (flexBaseAndHypotheticalMainSize, flexBaseSizeForFlexItem,\ncomputeFlexItemMinMaxMainSizes, computeUsedMaxMainSize, computeUsedNonAutoMinMainSize,\ncomputeContentBasedMinMainSize, ensureBlockAxisContentSizeForFlexItemIfNeeded,\nflexBaseSizeNeedsBlockAxisContentSize) and the cross-axis and stretch helpers\n(crossAxisIntrinsicExtentForFlexItem, applyStretchAlignmentToFlexItem,\napplyStretchMinMaxCrossSize) now take a const FlexLayoutItem\u0026. The shared aspect-ratio\nand definiteness leaf helpers, FlexLayoutUtils, and the renderer writes are left\nrenderer-based: the leaves are also called from paths that have no FlexLayoutItem, and\nthe writes mutate the live tree so they cannot come from a snapshot.\n\nNo change in behavior.\n\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n\nCanonical link: https://commits.webkit.org/317099@main",
      "email": "zalan@apple.com",
      "hash": "11b13711b10ba6ae2342bdd3dfe133831618d7f4",
      "subject": "[cleanup] Have RenderFlexibleBox's core sizing take FlexLayoutItem rather than the flex item renderer"
    },
    "317100@main": {
      "author": "Megan Gardner",
      "avatar": "https://www.gravatar.com/avatar/b466a5bcbfabf4d82a8ecc595db5a531?d=identicon\u0026s=64",
      "cl": "317100@main",
      "clUrl": "https://commits.webkit.org/317100@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319286\nrdar://182124030\n\nReviewed by Pascoe and Aditya Keerthi.\n\nUpdates based on feedback that I wasn't able\nto incorporate when I first landed to fix.\n\n* Source/WebCore/editing/cocoa/AttributedString.mm:\n(WebCore::extractValue):\n\nCanonical link: https://commits.webkit.org/317100@main",
      "email": "megan_gardner@apple.com",
      "hash": "2975df19b007fecdc3a66d71c524dc7baa929267",
      "subject": "Feedback for 316044@main."
    },
    "317101@main": {
      "author": "Charlie Wolfe",
      "avatar": "https://www.gravatar.com/avatar/857b3b5ff3394c31fa2689310a93dbab?d=identicon\u0026s=64",
      "cl": "317101@main",
      "clUrl": "https://commits.webkit.org/317101@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318271\nrdar://178108374\n\nReviewed by Alex Christensen.\n\nisQuarantinedAndNotUserApproved() took a string and re-parsed it with -[NSURL initWithString:],\nwhile its caller had already resolved the file via URL::fileSystemPath(). The two representations\ndisagreed for file names containing characters such as '#', which initWithString: interprets as the\nstart of a URL fragment: the path was truncated and the \".webarchive\" extension check no longer\nmatched, so the file's quarantine state was not evaluated against the correct path.\n\nPass the already-parsed URL through to isQuarantinedAndNotUserApproved() and derive the on-disk path\nfrom it with -[NSURL initFileURLWithPath:], so the extension check and the quarantine lookup operate\non the same file as the caller.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/mac/LoadWebArchive.mm\n\n* Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm:\n(WebKit::WebPageProxy::isQuarantinedAndNotUserApproved):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::loadFile):\n(WebKit::WebPageProxy::updateDataStoreForWebArchiveLoad):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/mac/LoadWebArchive.mm:\n(TestWebKitAPI::TEST(LoadWebArchive, QuarantinedWebArchiveWithFragmentInName)):\n\nCanonical link: https://commits.webkit.org/317101@main",
      "email": "charliew@apple.com",
      "hash": "ecb5a7bf75001294439b9cd83cbdabaac8fd9ac2",
      "subject": "isQuarantinedAndNotUserApproved() should use the parsed file URL instead of re-parsing the path"
    },
    "317102@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "317102@main",
      "clUrl": "https://commits.webkit.org/317102@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319224\n\nReviewed by David Kilzer.\n\nhasEntitlementValueInArray() may leak value returned by\nSecTaskCopyValueForEntitlement() if its type is not CFArrayRef, since\n`dynamic_cf_cast\u003cCFArrayRef\u003e()` would return nullptr in this case,\nrendering the `adoptCF()` useless.\n\nFix the issue by adopting the value returned by\nSecTaskCopyValueForEntitlement() *before* passing it to\ndynamic_cf_cast\u003c\u003e(), so that the RetainPtr\u003c\u003e\u0026\u0026 overload of\ndynamic_cf_cast\u003c\u003e() releases the value on type mismatch instead of the\n`adoptCF()` silently dropping a nullptr.\n\nAlso fixed the same bug pattern in other parts of the codebase, where a\nvalue returned by a CF \"Copy\" function (SecTrustCopyPropertyListRepresentation()\nand IOHIDServiceClientCopyProperty()) was wrapped as\nadoptCF(dynamic_cf_cast\u003c\u003e(...)) and would leak on type mismatch.\n\n* Source/WTF/wtf/cocoa/Entitlements.mm:\n(WTF::hasEntitlementValueInArray):\n* Source/WebKit/Shared/cf/CoreIPCSecTrust.mm:\n(WebKit::CoreIPCSecTrust::CoreIPCSecTrust):\n* Source/WebKit/Shared/mac/ScrollingAccelerationCurveMac.mm:\n(WebKit::fromIOHIDDevice):\n* Tools/Scripts/webkitpy/style/checkers/cpp.py:\n(check_adopt_of_dynamic_cast):\n(check_style):\n(CppChecker):\n* Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py:\n(WebKitStyleTest.test_adopt_of_dynamic_cast):\n\nCanonical link: https://commits.webkit.org/317102@main",
      "email": "cdumez@apple.com",
      "hash": "ee722e07de6f38964e138a6cc80e484f26c10238",
      "subject": "hasEntitlementValueInArray() may leak value returned by SecTaskCopyValueForEntitlement()"
    },
    "317103@main": {
      "author": "Basuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/5192a1151c7575317affb7a4633f8d63?d=identicon\u0026s=64",
      "cl": "317103@main",
      "clUrl": "https://commits.webkit.org/317103@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319002\nrdar://181851905\n\nReviewed by Sihui Liu.\n\nUnder Site Isolation, a non-back/forward main-frame navigation to a different site reused the\ncurrent WebPageProxy's BrowsingContextGroup. When the outgoing page was then placed in the\nback/forward cache, its group -- and its still-live iframe processes -- was retained by the\nSuspendedPageProxy, so the incoming, unrelated document ended up in that same group and linked\nthe suspended page's iframe processes. That is a Site Isolation boundary violation: two\nunrelated top-level browsing contexts must not share a group or its processes.\n\nGive such a navigation a fresh BrowsingContextGroup at selection time, mirroring where the COOP\nbrowsing-context-group switch already does. The new branch is gated on the single-page case\n(!hasMultiplePages()), which is exactly the condition under which the outgoing page is\nback/forward-cached and has no opener/openee that must stay reachable across the navigation, so\nopener reachability (LoadStringAfterOpen, NavigateOpenerWindowCrossSite) is preserved.\nEmpty-site targets (about:blank, data:) and the non-Site-Isolation PSON path are intentionally\nleft out of scope.\n\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::browsingContextGroupForNavigation): Start a fresh BrowsingContextGroup for\na single-page, site-changing, non-back/forward main-frame navigation under Site Isolation.\n(WebKit::WebPageProxy::swapToProvisionalPage): Point the comment at browsingContextGroupForNavigation,\nwhere the group is actually chosen.\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::SiteIsolation::NavigateToUnrelatedDomainDoesNotShareBCGWithSuspendedPage): Added.\n(TestWebKitAPI::SiteIsolation::DrawAfterNavigateToDomainAgain): Update the post-navigation\nexpectation to a lone c.com tree; the previous expectation encoded the bug.\n\nCanonical link: https://commits.webkit.org/317103@main",
      "email": "basuke@apple.com",
      "hash": "9b6cd50736f52a240fae733a9f66f8dbeb37556a",
      "subject": "[Site Isolation] A new document can share a BrowsingContextGroup with a back/forward-cached page"
    },
    "317104@main": {
      "author": "Joanne Pan",
      "avatar": "https://www.gravatar.com/avatar/5cbbf578426a0c98cb5c977ca2dd88fc?d=identicon\u0026s=64",
      "cl": "317104@main",
      "clUrl": "https://commits.webkit.org/317104@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319276\nrdar://182117859\n\nReviewed by Tim Nguyen.\n\nFollow-up to bug 317702 (random-item() computed-value resolution), addressing\nAntti's review feedback on PR #68097:\n\nhttps://github.com/WebKit/WebKit/pull/68097#discussion_r3551786137\n\nThis patch extracts substituteRandomItemArgumentGrammar(), mirroring\nsubstituteAttrArgumentGrammar():\n\n- It splits \u003crandom-item-args\u003e = random-item( \u003cdeclaration-value\u003e,\n    [ \u003cdeclaration-value\u003e? ]# ) at the literal commas, substitutes the first\n    argument (the \u003crandom-key\u003e), and returns the substituted key plus the raw\n    item ranges.\n- substituteRandomItemFunction() then resolves the base value and\n    selects/substitutes the chosen item as a distinct second step. As with\n    attr()'s fallback, the items are substituted lazily.\n\n* Source/WebCore/style/StyleSubstitutionResolver.cpp:\n(WebCore::Style::SubstitutionResolver::substituteRandomItemArgumentGrammar):\n(WebCore::Style::SubstitutionResolver::substituteRandomItemFunction):\n* Source/WebCore/style/StyleSubstitutionResolver.h:\n\nCanonical link: https://commits.webkit.org/317104@main",
      "email": "jpan0917@gmail.com",
      "hash": "a26b16470591823b5c79246d9264e3a89aa9fca9",
      "subject": "[css-values-5 random-item()] Factor random-item() argument-grammar substitution into a helper following the attr()  pattern"
    },
    "317105@main": {
      "author": "Elliott Williams",
      "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64",
      "cl": "317105@main",
      "clUrl": "https://commits.webkit.org/317105@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319146\nrdar://181964169\n\nUnreviewed. The -fpch-codegen logic is emitting code code from other\nsystem libraries into WebCore and causing build failures based on a\nmissing symbol. Link against the required library as a workaround.\n\n* Source/WebCore/PlatformCocoa.cmake:\n\nCanonical link: https://commits.webkit.org/317105@main",
      "email": "emw@apple.com",
      "hash": "564c3281c61f8a82a3be7e051020cbe0d7cec4c2",
      "subject": "Build fix for \"[CMake][Mac] Build with the internal SDK\""
    },
    "317106@main": {
      "author": "Sam Sneddon",
      "avatar": "https://www.gravatar.com/avatar/99f6b56d9db9d32920dfcc56deae86fc?d=identicon\u0026s=64",
      "cl": "317106@main",
      "clUrl": "https://commits.webkit.org/317106@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317060\nrdar://179542775\n\nReviewed by Basuke Suzuki.\n\nwpt serve fails to start on EWS's Intel macOS bots because the import\nin 314752@main flipped the serve command's commands.json entry from\n\"virtualenv\": false to true.\n\nDue to a bug, WPT includes its supposedly optional requirements,\npulling in aioquic, whose loose pyopenssl\u003e=24 constraint lets pip's\nlegacy resolver pick a pyOpenSSL release that in turn requires\ncryptography\u003e=49. This is the first release after cryptography stopped\nsupporting and publishing wheels for x86_64 macOS, causing pip to\nattempt to build it from source, which fails because cryptography has\nnative dependencies which may not be installed, and server startup\ntimes out.\n\nDependencies for wpt's own tools should come from webkitcorepy's\nAutoInstaller rather than pip, matching the rest of webkitpy. wpt\nserve doesn't actually have any real dependencies of its own so pass\n--venv \u003cpath\u003e --skip-venv-setup when invoking it, which skips venv\ncreation and the pip install entirely. wpt lint's one real dependency,\npyyaml, moves to the AutoInstaller instead, and gets the same flags\nfor the same reason.\n\nAdd integration tests that drive the real WebPlatformTestServer and\nWPTLinter classes rather than mocking the subprocess out so we get\ncoverage of our ability to actually run the imported code outside of\nrun-webkit-tests.\n\n* Tools/Scripts/webkitpy/layout_tests/servers/web_platform_test_server.py:\n(WebPlatformTestServer.__init__):\n* Tools/Scripts/webkitpy/layout_tests/servers/web_platform_test_server_integrationtest.py: Added.\n(WPTServeIntegrationTest):\n(WPTServeIntegrationTest.integration_test_serve_starts_without_pip_install):\n* Tools/Scripts/webkitpy/w3c/wpt_linter.py:\n(WPTLinter.lint):\n(WPTLinter._run_lint):\n* Tools/Scripts/webkitpy/w3c/wpt_linter_integrationtest.py: Added.\n(WPTLintIntegrationTest):\n(WPTLintIntegrationTest.integration_test_lint_runs_without_venv):\n(WPTLintIntegrationTest.integration_test_lint_reports_multiple_errors):\n\nCanonical link: https://commits.webkit.org/317106@main",
      "email": "gsnedders@apple.com",
      "hash": "ddf079fd729f2f1b4ce80b33683e79b489bd14aa",
      "subject": "REGRESSION(314752@main): [Intel] WPT server fails to start due to unbuildable dependencies"
    },
    "317107@main": {
      "author": "Andy Estes",
      "avatar": "https://www.gravatar.com/avatar/643f10f01b26fd94d03482a2013b2ea0?d=identicon\u0026s=64",
      "cl": "317107@main",
      "clUrl": "https://commits.webkit.org/317107@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319214\nrdar://182073085\n\nReviewed by Jer Noble.\n\nThe placard used for wireless playback was hardcoded to display \"AirPlay\", but when using\nAVSystemRouting the route may have a different name. Updated the placard to show the correct name\nbased on the MediaDeviceRoute.\n\nTests: media/wireless-playback-media-player/route-name-fallback.html\n       media/wireless-playback-media-player/route-name.html\n\n* LayoutTests/media/wireless-playback-media-player/route-name-expected.txt: Added.\n* LayoutTests/media/wireless-playback-media-player/route-name-fallback-expected.txt: Added.\n* LayoutTests/media/wireless-playback-media-player/route-name-fallback.html: Added.\n* LayoutTests/media/wireless-playback-media-player/route-name.html: Added.\n* Source/WebCore/Modules/mediacontrols/MediaControlsHost.cpp:\n(WebCore::MediaControlsHost::externalDeviceDisplayName const):\n(WebCore::MediaControlsHost::externalDeviceRouteName const):\n* Source/WebCore/Modules/mediacontrols/MediaControlsHost.h:\n* Source/WebCore/Modules/mediacontrols/MediaControlsHost.idl:\n* Source/WebCore/Modules/modern-media-controls/controls/placard.js:\n* Source/WebCore/Modules/modern-media-controls/media/placard-support.js:\n(PlacardSupport.prototype._updateAirPlayPlacard):\n(PlacardSupport):\n* Source/WebCore/platform/audio/ios/MediaDeviceRoute.h:\n* Source/WebCore/platform/audio/ios/MediaDeviceRoute.mm:\n(WebCore::MediaDeviceRoute::routeName const):\n* Source/WebCore/platform/graphics/MediaPlaybackTarget.h:\n* Source/WebCore/platform/graphics/MediaPlaybackTargetWirelessPlayback.cpp:\n(WebCore::MediaPlaybackTargetWirelessPlayback::routeName const):\n* Source/WebCore/platform/graphics/MediaPlaybackTargetWirelessPlayback.h:\n* Source/WebCore/platform/graphics/MediaPlayer.cpp:\n(WebCore::MediaPlayer::wirelessPlaybackRouteName const):\n* Source/WebCore/platform/graphics/MediaPlayer.h:\n* Source/WebCore/platform/graphics/MediaPlayerPrivate.h:\n(WebCore::MediaPlayerPrivateInterface::wirelessPlaybackRouteName const):\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.cpp:\n(WebCore::MediaPlayerPrivateWirelessPlayback::wirelessPlaybackRouteName const):\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.h:\n* Source/WebCore/platform/graphics/avfoundation/MediaPlaybackTargetCocoa.h:\n* Source/WebCore/platform/graphics/avfoundation/MediaPlaybackTargetCocoa.mm:\n(WebCore::MediaPlaybackTargetCocoa::routeName const):\n* Source/WebCore/platform/mock/MediaPlaybackTargetMock.h:\n* Source/WebCore/testing/cocoa/WebMockMediaDeviceRoute.h:\n* Source/WebCore/testing/cocoa/WebMockMediaDeviceRoute.mm:\n* Source/WebKit/GPUProcess/media/RemoteMediaPlayerProxy.cpp:\n(WebKit::RemoteMediaPlayerProxy::mediaPlayerCurrentPlaybackTargetIsWirelessChanged):\n* Source/WebKit/Platform/cocoa/MediaPlaybackTargetContextSerialized.h:\n(WebKit::MediaPlaybackTargetContextSerialized::routeName const):\n* Source/WebKit/Platform/cocoa/MediaPlaybackTargetContextSerialized.mm:\n(WebKit::MediaPlaybackTargetContextSerialized::MediaPlaybackTargetContextSerialized):\n* Source/WebKit/Platform/cocoa/MediaPlaybackTargetContextSerialized.serialization.in:\n* Source/WebKit/Platform/cocoa/MediaPlaybackTargetSerialized.h:\n* Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp:\n(WebKit::MediaPlayerPrivateRemote::updateCachedState):\n(WebKit::MediaPlayerPrivateRemote::wirelessPlaybackRouteName const):\n* Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.h:\n* Source/WebKit/WebProcess/GPU/media/RemoteMediaPlayerState.h:\n* Source/WebKit/WebProcess/GPU/media/RemoteMediaPlayerState.serialization.in:\n\nCanonical link: https://commits.webkit.org/317107@main",
      "email": "aestes@apple.com",
      "hash": "eb017c5dbb25ecbe522514bd2cfedf1b2a1892bb",
      "subject": "[iOS] Placard may show incorrect route name during wireless playback"
    },
    "317108@main": {
      "author": "Gerald Squelart",
      "avatar": "https://www.gravatar.com/avatar/894904f08d85651bf2a76868a4d2f1b3?d=identicon\u0026s=64",
      "cl": "317108@main",
      "clUrl": "https://commits.webkit.org/317108@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319208\nrdar://182060488\n\nReviewed by Mike Wyrzykowski.\n\nByteArrayPixelBuffer and Float16ArrayPixelBuffer had nearly identical\nimplementations that differed only in their PixelBuffer::Type tag, their\nbacking JSC typed-array type, and the set of accepted PixelFormats.\n\nReplace both with a single class template TypedArrayPixelBuffer\u003c...\u003e.\n\nThe existing type names are preserved as aliases, so callers are unchanged\napart from their include.\nThe classes can be `final`.\nAnd WEBCORE_EXPORT is not needed anymore.\n\nNo expected changes in behavior; covered by existing tests.\n\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/WebCoreJSBindingsPrefix.h:\n* Source/WebCore/bindings/js/SerializedScriptValue.cpp:\n* Source/WebCore/html/CanvasBase.cpp:\n* Source/WebCore/html/CanvasNoiseInjection.cpp:\n* Source/WebCore/html/ImageData.h:\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.h:\n* Source/WebCore/html/canvas/WebGLRenderingContextBase.h:\n* Source/WebCore/platform/graphics/ByteArrayPixelBuffer.cpp: Removed.\n* Source/WebCore/platform/graphics/ByteArrayPixelBuffer.h: Removed.\n* Source/WebCore/platform/graphics/Float16ArrayPixelBuffer.cpp: Removed.\n* Source/WebCore/platform/graphics/Float16ArrayPixelBuffer.h: Removed.\n* Source/WebCore/platform/graphics/ImageBufferAllocator.cpp:\n* Source/WebCore/platform/graphics/TypedArrayPixelBuffer.cpp: Renamed from Source/WebCore/platform/graphics/ByteArrayPixelBuffer.cpp.\n(WebCore::\u003e::create):\n(WebCore::\u003e::tryCreate):\n(WebCore::\u003e::TypedArrayPixelBuffer):\n(WebCore::\u003e::createScratchPixelBuffer const):\n* Source/WebCore/platform/graphics/TypedArrayPixelBuffer.h: Renamed from Source/WebCore/platform/graphics/ByteArrayPixelBuffer.h.\n(isType):\n* Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.cpp:\n* Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGL.cpp:\n\nCanonical link: https://commits.webkit.org/317108@main",
      "email": "g_squelart@apple.com",
      "hash": "ed9d590b465dd9512c9097a31f94904703ff5895",
      "subject": "Refactor {Byte,Float16}ArrayPixelBuffer into a TypedArrayPixelBuffer template"
    },
    "317109@main": {
      "author": "Andy Estes",
      "avatar": "https://www.gravatar.com/avatar/643f10f01b26fd94d03482a2013b2ea0?d=identicon\u0026s=64",
      "cl": "317109@main",
      "clUrl": "https://commits.webkit.org/317109@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319330\nrdar://182145800\n\nUnreviewed build fix after 317107@main. Addressed review feedback that also happens to fix the build.\n\n* LayoutTests/media/wireless-playback-media-player/route-name-fallback-expected.txt:\n* LayoutTests/media/wireless-playback-media-player/route-name-fallback.html:\n* LayoutTests/media/wireless-playback-media-player/route-name.html:\n* Source/WebCore/Modules/mediacontrols/MediaControlsHost.cpp:\n(WebCore::MediaControlsHost::externalDeviceRouteName const):\n* Source/WebCore/testing/MockMediaDeviceRoute.h:\n* Source/WebCore/testing/MockMediaDeviceRoute.idl:\n* Source/WebCore/testing/MockMediaDeviceRoute.mm:\n(WebCore::MockMediaDeviceRoute::protocolTypeIdentifier const):\n(WebCore::MockMediaDeviceRoute::setProtocolTypeIdentifier):\n(WebCore::MockMediaDeviceRoute::routeName const):\n\nCanonical link: https://commits.webkit.org/317109@main",
      "email": "aestes@apple.com",
      "hash": "8bc7c5094a3b903366a05a3de3781809f7d21149",
      "subject": "[iOS] Fix the build"
    },
    "317110@main": {
      "author": "Kristian Monsen",
      "avatar": "https://www.gravatar.com/avatar/d9b02ca94d143b7dd6118be4dbc4aa06?d=identicon\u0026s=64",
      "cl": "317110@main",
      "clUrl": "https://commits.webkit.org/317110@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319175\nrdar://181799978\n\nReviewed by Dan Glastonbury.\n\nCalculateDrawIndexRanges\u003cT\u003e passes the raw buffer byte span directly to angle::reinterpret_span\u003cconst T\u003e, which asserts that the span size is a multiple of sizeof(T). When a WebGL2\ndrawElements call is made with UNSIGNED_INT indices against a buffer whose size is not a multiple of 4, this assertion fires and aborts the GPU process.\n\nFix: truncate the span to floor(size / sizeof(T)) * sizeof(T) bytes before calling reinterpret_span. The trailing partial bytes cannot form a complete index and are correctly\nignored.\n\nTest: webgl/webgl2-draw-elements-unaligned-buffer-nocrash.html\n\n* LayoutTests/webgl/webgl2-draw-elements-unaligned-buffer-nocrash-expected.txt: Added.\n* LayoutTests/webgl/webgl2-draw-elements-unaligned-buffer-nocrash.html: Added.\n* Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/BufferMtl.mm:\n(rx::CalculateDrawIndexRanges):\n\nCanonical link: https://commits.webkit.org/317110@main",
      "email": "k_monsen@apple.com",
      "hash": "98d7962dd25c6dfa50d334389d385817308171b3",
      "subject": "WebGL2: drawElements with UNSIGNED_INT indices crashes when element array buffer size is not a multiple of 4"
    },
    "317111@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317111@main",
      "clUrl": "https://commits.webkit.org/317111@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319293\nrdar://182130776\n\nReviewed by Devin Rousso.\n\nformattedLocationString() passed this.formattedColumn, which is not a getter\n(only formattedColumnNumber exists), so the argument was undefined. Both\ncolumn-appending branches in _locationString() guard on numeric comparisons,\nand `undefined \u003e n` is always false, so the column was silently dropped.\n\nNo test: this is a typo / copy/paste fix, and I looked into the test harness\nbut couldn't find a way to make it testable.\n\n* Source/WebInspectorUI/UserInterface/Models/SourceCodeLocation.js:\n(WI.SourceCodeLocation.prototype.formattedLocationString):\n\nCanonical link: https://commits.webkit.org/317111@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "0709f86af273dea8e8e983282afa93142313b32b",
      "subject": "Web Inspector: formatted location string always drops the column number"
    },
    "317112@main": {
      "author": "Alice Tang",
      "avatar": "https://www.gravatar.com/avatar/bdf501bf22c8da1146b5fd324fd6c877?d=identicon\u0026s=64",
      "cl": "317112@main",
      "clUrl": "https://commits.webkit.org/317112@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316882\nrdar://179304860\n\nReviewed by Simon Fraser.\n\nImplements rendering and natural size computation for the CSS object-view-box\nproperty across replaced elements (img, canvas, video) and view-transition\npseudo-elements.\n\nFor replaced elements (RenderImage, RenderHTMLCanvas, RenderVideo):\n- resolveObjectViewBox() computes the view-box rect from inset/rect/xywh values\n- replacedContentRect() uses the view-box dimensions as the effective intrinsic\n  size for object-fit/object-position calculations\n- paintReplaced() draws the full image scaled/translated so the view-box region\n  maps onto the replaced content rect, clipped to the content box\n\nFor view-transition captures (RenderViewTransitionCapture):\n- paintReplaced() uses an explicit srcRect to draw only the view-box sub-region\n  of the snapshot, preventing bilinear bleed at the view-box boundary\n- image() returns null when object-view-box is set, routing rendering through\n  the software paint path (paintReplaced) rather than CA direct compositing\n- layout() computes m_viewBoxLocalContentsRect for the CA contentsRect geometry\n- canUseExistingLayers() accounts for object-view-box when deciding whether to\n  reuse existing CA layers\n\nLayout tests:\n- 36/36 css-images object-view-box WPT tests pass, plus 2 new tests added by\n  this patch (object-view-box-auto-size-relayout.html, object-view-box-zoom.html)\n- 4/4 css-view-transitions object-view-box WPT tests pass (object-view-box-old/\n  new-image use scale3d in expected refs and maxDifference=85/totalPixels=600\n  fuzzy tolerance to account for snapshot-vs-live rendering quality difference;\n  old/new-content-with-object-view-box.html are skipped on iOS due to a 1px\n  device-pixel rounding difference)\n- Adds 2 new fast/css repaint tests verifying the opaque-foreground optimization\n  still behaves correctly with subset/superset object-view-box insets\n- Removes 25 ImageOnlyFailure entries from TestExpectations\n\n* LayoutTests/TestExpectations:\n* LayoutTests/fast/css/object-view-box-subset-obscures-background-no-repaint-expected.txt: Added.\n* LayoutTests/fast/css/object-view-box-subset-obscures-background-no-repaint.html: Added.\n* LayoutTests/fast/css/object-view-box-superset-does-not-obscure-background-repaint-expected.txt: Added.\n* LayoutTests/fast/css/object-view-box-superset-does-not-obscure-background-repaint.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-images/object-view-box-auto-size-relayout-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-images/object-view-box-auto-size-relayout-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-images/object-view-box-auto-size-relayout.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-images/object-view-box-zoom-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-images/object-view-box-zoom-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-images/object-view-box-zoom.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-view-transitions/object-view-box-new-image-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-view-transitions/object-view-box-new-image.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-view-transitions/object-view-box-old-image-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-view-transitions/object-view-box-old-image.html:\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/wk2/TestExpectations:\n* Source/WebCore/platform/graphics/GeometryUtilities.cpp:\n* Source/WebCore/platform/graphics/GeometryUtilities.h:\n* Source/WebCore/rendering/RenderHTMLCanvas.cpp:\n* Source/WebCore/rendering/RenderImage.cpp:\n* Source/WebCore/rendering/RenderReplaced.cpp:\n* Source/WebCore/rendering/RenderReplaced.h:\n* Source/WebCore/rendering/RenderVideo.cpp:\n* Source/WebCore/rendering/RenderViewTransitionCapture.cpp:\n* Source/WebCore/rendering/RenderViewTransitionCapture.h:\n* Source/WebCore/rendering/updating/RenderTreeUpdaterViewTransition.cpp:\n* Source/WebCore/style/StyleDifference.cpp:\n\nCanonical link: https://commits.webkit.org/317112@main",
      "email": "tang.alice.000@gmail.com",
      "hash": "0d63417844a1f3efbec6c8cece36bf78d39c9263",
      "subject": "CSS object-view-box: implement rendering and natural sizes"
    },
    "317113@main": {
      "author": "Per Arne Vollan",
      "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64",
      "cl": "317113@main",
      "clUrl": "https://commits.webkit.org/317113@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318626\nrdar://181431723\n\nReviewed by Chris Dumez.\n\nUnless we create this sandbox extension, the Networking process will not be able to load files under the base\nURL that are referenced in the HTML data.\n\nThis change also allows us to remove a temporary workaround to allow the Networking process to load files from\nthe temp directory of the UI process on iOS, since we now provide a sandbox extension instead.\n\n* Source/WebKit/NetworkProcess/NetworkProcess.cpp:\n(WebKit::NetworkProcess::allowFileAccessFromWebProcess):\n* Source/WebKit/NetworkProcess/NetworkProcess.h:\n* Source/WebKit/NetworkProcess/NetworkProcess.messages.in:\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:\n(WebKit::NetworkResourceLoader::isLocalFileLoadAllowed):\n* Source/WebKit/Shared/WebsiteDataStoreParameters.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::maybeInitializeSandboxExtensionHandle):\n(WebKit::WebPageProxy::loadDataWithNavigationShared):\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::assumeReadAccessToBaseURL):\n* Source/WebKit/UIProcess/WebProcessProxy.h:\n\nCanonical link: https://commits.webkit.org/317113@main",
      "email": "pvollan@apple.com",
      "hash": "cc308182f637a43c2abc31b3414055ad8e991c59",
      "subject": "WebPageProxy::loadDataWithNavigationShared may fail to load files under the base URL"
    },
    "317114@main": {
      "author": "Carlos Alberto Lopez Perez",
      "avatar": "https://www.gravatar.com/avatar/05326c1dbe06f486e884975e73f25179?d=identicon\u0026s=64",
      "cl": "317114@main",
      "clUrl": "https://commits.webkit.org/317114@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319327\n\nUnreviewed gardening.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/gtk/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/317114@main",
      "email": "clopez@igalia.com",
      "hash": "bbdc33dcde8f5e5d3e3e644a4974bc0510ba00a0",
      "subject": "[WPE][GTK] Gardening of tests - 2026-07-13"
    },
    "317115@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "317115@main",
      "clUrl": "https://commits.webkit.org/317115@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319133\nrdar://181951971\n\nReviewed by Yijia Huang.\n\nThis is our next step in the long journey towards native microtasks and\nefficient async implementation. This patch introduces cooperative\ndriving mechanism of async generators. Let's say we have a code below.\n\n    async function* gen () {\n        yield 42;\n        yield 42;\n        yield 42;\n    }\n\n    async function main() {\n        for await (let value of gen()) {\n            ...\n        }\n    }\n\nIn the above script, we have a great syntax-guaranteed things,\n\n1. for-await-of completely hides `next()` invocation. This means that\n   the result of `next()` call is not escaped anywhere user observable space.\n   In this case, async generator's promise from next().\n2. for-await-of is awaiting for each promise result from `next()` call\n   of async generator. And this `await` is directly invoking\n   PerformPromiseThen, skipping `Promise.prototype.then` calls, so user\n   cannot insert an observable function by overriding\n   `Promise.prototype.then` when it is a native promise.\n3. When usual %AsyncGeneratorPrototype%.next function is invoked, if it is normal\n   async generator, it is guaranteed to produce a native promise.\n\nThe above 3 characteristics means that we can skip promise creation if\nan async function is cooperatively driving async generator via for-await-of.\n\n1. for-await-of is used in the async function. If gen()'s result is genuine\n   async generator and `next` function is %AsyncGeneratorPrototype%.next,\n   then the promise is not observable. Then, we do not create a promise / return\n   a promise! Instead, we return a sentinel (instead of promise) that is \"we will\n   be driven by the fast-suspension mechanism\". Then instead of enqueuing a\n   newly created promise, we enqueue this async function's generator (driver)\n   into the async generator's queue.\n2. Then async generator will execute `yield` etc., and resolve the\n   queued promise. Previously, there was a promise here. But instead, we\n   now have a async function's generator. So we drive it with a special\n   InternalMicrotask::AsyncGeneratorFastConsumerResume.\n3. InternalMicrotask::AsyncGeneratorFastConsumerResume will be driven\n   with async function generator. And we resume async function generator\n   instead.\n\nThe execution is completely aligned to the normal promise-based driving\nin terms of ticks. But it is driven significantly more efficiently: we\ndo not create a promise and schedule a resolution through a promise. We\ncapture the driver (async function generator) directly and it\ncooperatively registers itself to the driven async generator. And async\ngenerator cooperatively resolves this driver when it gets the resolution!\n\nAs a result, we no longer directly call JS %AsyncGeneratorPrototype%.next().\nSo we move it to C++ too.\n\nTests: JSTests/stress/async-iterator-completed-producer-no-double-drive.js\n       JSTests/stress/async-iterator-fast-consumer-manual-next-drive.js\n       JSTests/stress/async-iterator-fast-consumer-microtask-ticks.js\n       JSTests/stress/async-iterator-fast-consumer-reentrancy.js\n       JSTests/stress/async-iterator-fast-consumer-tampering.js\n       JSTests/stress/async-iterator-fast-consumer-vs-generic-equivalence.js\n       JSTests/stress/async-iterator-next-generic-inlined-osr-exit.js\n       JSTests/stress/async-iterator-next-osr-exit-inlined-callee.js\n       JSTests/stress/async-iterator-next-polymorphic-callee.js\n       JSTests/stress/async-iterator-open-next-loljit.js\n\n* JSTests/stress/async-iterator-completed-producer-no-double-drive.js: Added.\n(assert):\n(makeGen):\n(async reconsume):\n(async consumeAlreadyExhausted):\n(async genConsumeExhausted):\n(async main):\n(async let):\n* JSTests/stress/async-iterator-fast-consumer-manual-next-drive.js: Added.\n(assert):\n(makeProducer):\n(async makeConsumer):\n(async driveToArray):\n(async main):\n(main.then):\n* JSTests/stress/async-iterator-fast-consumer-microtask-ticks.js: Added.\n(assert):\n(async scenario):\n(const.scenarios.async gen3.async g):\n(const.scenarios.async gen3):\n(const.scenarios.async break.async g):\n(const.scenarios.async break):\n(const.scenarios.async throw.async g):\n(const.scenarios.async throw):\n(const.scenarios.async delegate.async inner):\n(const.scenarios.async delegate.async g):\n(const.scenarios.async delegate):\n(const.scenarios.async internalAwait.async g):\n(const.scenarios.async internalAwait):\n(const.scenarios.async yieldPromise.async g):\n(const.scenarios.async yieldPromise):\n(const.scenarios.async nested.async inner):\n(const.scenarios.async nested.async outer):\n(const.scenarios.async nested):\n(const.scenarios.async empty.async g):\n(const.scenarios.async empty):\n(const.scenarios.async completedReconsume.async g):\n(const.scenarios.async completedReconsume):\n(async main):\n(main.then):\n* JSTests/stress/async-iterator-fast-consumer-reentrancy.js: Added.\n(assert):\n(async interleavedNext.async prod):\n(async interleavedNext.async cons):\n(async interleavedNext):\n(async nestedFast.async inner):\n(async nestedFast.async outer):\n(async nestedFast.async src):\n(async nestedFast):\n(async reentrantProducer.async prod):\n(async reentrantProducer.async cons):\n(async reentrantProducer):\n(async reconsume.async prod):\n(async reconsume.async cons):\n(async reconsume):\n(async nextDuringAwait.async prod):\n(async nextDuringAwait.async cons):\n(async nextDuringAwait):\n(async main):\n(main.then):\n* JSTests/stress/async-iterator-fast-consumer-tampering.js: Added.\n(assert):\n(const.AsyncGeneratorPrototype.Object.getPrototypeOf.Object.getPrototypeOf):\n(async tamperNext.AsyncGeneratorPrototype.next):\n(async tamperNext.try.async g):\n(async tamperNext):\n(async tamperPromiseThen.Promise.prototype.then):\n(async tamperPromiseThen.try.async g):\n(async tamperPromiseThen):\n(async tamperObjectThen.):\n(async tamperObjectThen.try.async g):\n(async tamperObjectThen):\n(async main):\n(main.then):\n* JSTests/stress/async-iterator-fast-consumer-vs-generic-equivalence.js: Added.\n(assert):\n(async scenario):\n(const.scenarios.async gen3.async g):\n(const.scenarios.async gen3):\n(const.scenarios.async breakEarly.async g):\n(const.scenarios.async breakEarly):\n(const.scenarios.async throwInBody.async g):\n(const.scenarios.async throwInBody):\n(const.scenarios.async delegate.async inner):\n(const.scenarios.async delegate.async g):\n(const.scenarios.async delegate):\n(const.scenarios.async internalAwait.async g):\n(const.scenarios.async internalAwait):\n(const.scenarios.async yieldPromise.async g):\n(const.scenarios.async yieldPromise):\n(const.scenarios.async nested.async inner):\n(const.scenarios.async nested.async outer):\n(const.scenarios.async nested):\n(const.scenarios.async errorFromProducer.async g):\n(const.scenarios.async errorFromProducer):\n(const.scenarios.async agConsumer.async producer):\n(const.scenarios.async agConsumer.async consumer):\n(const.scenarios.async agConsumer):\n(async runAll):\n(const.asyncGenProto.Object.getPrototypeOf.Object.getPrototypeOf):\n(async main.asyncGenProto.next):\n(async main):\n(async let):\n* JSTests/stress/async-iterator-next-generic-inlined-osr-exit.js: Added.\n(assert):\n(const.iteratorProto.next):\n(makeIterable):\n(async consume):\n(async main):\n(main.then):\n* JSTests/stress/async-iterator-next-osr-exit-inlined-callee.js: Added.\n(assert):\n(makeIterable):\n(async consume):\n(async main):\n(main.then):\n* JSTests/stress/async-iterator-next-polymorphic-callee.js: Added.\n(assert):\n(next):\n(else.next):\n(async return):\n(makeIterable):\n(expectedSum):\n(async consume):\n(async main):\n(main.then):\n* JSTests/stress/async-iterator-open-abrupt-completion-tiers.js: Added.\n(assert):\n(assertSeq):\n(async breakEarly.async g):\n(async breakEarly):\n(async throwInBody.async g):\n(async throwInBody):\n(async returnFromEnclosing.async g):\n(async returnFromEnclosing.async inner):\n(async continueInBody.async g):\n(async continueInBody):\n(async nested.async inner):\n(async nested.async outer):\n(async partialThenForAwait.async g):\n(async producerThrows.async g):\n(async producerThrows):\n(async main):\n* JSTests/stress/async-iterator-open-fast-path-tiers.js: Added.\n(assert):\n(const.AGP.Object.getPrototypeOf.Object.getPrototypeOf):\n(async consume):\n(async const):\n* JSTests/stress/async-iterator-open-generic-path.js: Added.\n(assert):\n(async assertThrowsAsync):\n(async consume):\n(customIterable):\n(async main.const.iterable.Symbol.asyncIterator.get return):\n(async main):\n(main.then):\n* JSTests/stress/async-iterator-open-next-loljit.js: Added.\n(assert):\n(async genConsumer):\n(customIterable):\n(async main):\n(main.then):\n* JSTests/stress/async-iterator-open-next-side-effect-free-probe.js: Added.\n(assert):\n(const.AsyncGeneratorPrototype.Object.getPrototypeOf.Object.getPrototypeOf):\n(async proxyPrototypeNext.customNext):\n(async proxyPrototypeNext.get const.g):\n(async instanceAccessorNext.const.g):\n(async instanceAccessorNext.async Object):\n(async fastEligibleFallthrough):\n(proxyGenerator.customNext):\n(proxyGenerator.get const.g):\n(accessorGenerator.const.g):\n(accessorGenerator.async Object):\n(async main.async const):\n(async main):\n* Source/JavaScriptCore/CMakeLists.txt:\n* Source/JavaScriptCore/DerivedSources-input.xcfilelist:\n* Source/JavaScriptCore/DerivedSources.make:\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/builtins/AsyncGeneratorPrototype.js: Removed.\n* Source/JavaScriptCore/builtins/BuiltinNames.h:\n* Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.cpp:\n(JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):\n* Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h:\n* Source/JavaScriptCore/bytecode/BytecodeList.rb:\n* Source/JavaScriptCore/bytecode/BytecodeLivenessAnalysis.cpp:\n(JSC::tmpLivenessForCheckpoint):\n* Source/JavaScriptCore/bytecode/BytecodeOperandsForCheckpoint.h:\n(JSC::valueProfileOffsetFor):\n(JSC::destinationFor):\n(JSC::calleeFor):\n(JSC::argumentCountIncludingThisFor):\n(JSC::stackOffsetInRegistersForCall):\n* Source/JavaScriptCore/bytecode/BytecodeUseDef.cpp:\n(JSC::computeUsesForBytecodeIndexImpl):\n(JSC::computeDefsForBytecodeIndexImpl):\n* Source/JavaScriptCore/bytecode/CallLinkInfo.cpp:\n(JSC::CallLinkInfo::callTypeFor):\n* Source/JavaScriptCore/bytecode/CodeBlock.cpp:\n(JSC::CodeBlock::finishCreation):\n(JSC::CodeBlock::finalizeLLIntInlineCaches):\n(JSC::CodeBlock::tryGetValueProfileForBytecodeIndex):\n* Source/JavaScriptCore/bytecode/GetByStatus.cpp:\n(JSC::GetByStatus::computeFromLLInt):\n* Source/JavaScriptCore/bytecode/IterationModeMetadata.h:\n* Source/JavaScriptCore/bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp:\n(JSC::LLIntPrototypeLoadAdaptiveStructureWatchpoint::fireInternal):\n* Source/JavaScriptCore/bytecode/LinkTimeConstant.h:\n* Source/JavaScriptCore/bytecode/Opcode.h:\n* Source/JavaScriptCore/bytecode/OpcodeInlines.h:\n(JSC::isOpcodeShape):\n* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:\n(JSC::BytecodeGenerator::emitAsyncIteratorOpen):\n(JSC::BytecodeGenerator::emitAsyncIteratorNext):\n(JSC::BytecodeGenerator::emitEnumeration):\n(JSC::BytecodeGenerator::emitGenericEnumeration): Deleted.\n* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h:\n(JSC::BytecodeGenerator::emitIsIteratorHelper):\n(JSC::BytecodeGenerator::emitIsAsyncGenerator): Deleted.\n* Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:\n(JSC::FunctionNode::emitBytecode):\n(JSC::asyncGeneratorInternalFieldIndex): Deleted.\n(JSC::abstractModuleRecordInternalFieldIndex): Deleted.\n(JSC::BytecodeIntrinsicNode::emit_intrinsic_getAsyncGeneratorInternalField): Deleted.\n(JSC::BytecodeIntrinsicNode::emit_intrinsic_getAbstractModuleRecordInternalField): Deleted.\n(JSC::BytecodeIntrinsicNode::emit_intrinsic_putAsyncGeneratorInternalField): Deleted.\n* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:\n(JSC::DFG::AbstractInterpreter\u003cAbstractStateType\u003e::executeEffects):\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::ByteCodeParser::parseBlock):\n(JSC::DFG::ByteCodeParser::handleAsyncIteratorOpen):\n(JSC::DFG::ByteCodeParser::handleAsyncIteratorNext):\n* Source/JavaScriptCore/dfg/DFGClobberize.h:\n(JSC::DFG::clobberize):\n* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:\n(JSC::DFG::doesGC):\n* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:\n(JSC::DFG::FixupPhase::fixupNode):\n* Source/JavaScriptCore/dfg/DFGNodeType.h:\n* Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp:\n(JSC::DFG::callerReturnPC):\n* Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:\n* Source/JavaScriptCore/dfg/DFGSafeToExecute.h:\n(JSC::DFG::safeToExecute):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:\n(JSC::DFG::SpeculativeJIT::compile):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:\n(JSC::DFG::SpeculativeJIT::compile):\n* Source/JavaScriptCore/dfg/DFGStoreBarrierInsertionPhase.cpp:\n* Source/JavaScriptCore/ftl/FTLCapabilities.cpp:\n(JSC::FTL::canCompile):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileNode):\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n* Source/JavaScriptCore/jit/JIT.cpp:\n(JSC::JIT::privateCompileMainPass):\n(JSC::JIT::privateCompileSlowCases):\n* Source/JavaScriptCore/jit/JIT.h:\n* Source/JavaScriptCore/jit/JITCall.cpp:\n(JSC::JIT::compileOpCall):\n(JSC::JIT::emitIteratorOpenGeneric):\n(JSC::JIT::emit_op_iterator_open):\n(JSC::JIT::emitSlowIteratorOpenGeneric):\n(JSC::JIT::emitSlow_op_iterator_open):\n(JSC::JIT::emit_op_async_iterator_open):\n(JSC::JIT::emitSlow_op_async_iterator_open):\n(JSC::JIT::emit_op_async_iterator_next):\n* Source/JavaScriptCore/jit/JITOperations.cpp:\n(JSC::JSC_DEFINE_JIT_OPERATION):\n* Source/JavaScriptCore/jit/JITOperations.h:\n* Source/JavaScriptCore/llint/LLIntOpcode.h:\n* Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:\n(JSC::LLInt::LLINT_SLOW_PATH_DECL):\n(JSC::LLInt::handleAsyncIteratorOpenCheckpoint):\n(JSC::LLInt::llint_slow_path_checkpoint_osr_exit_from_inlined_call):\n(JSC::LLInt::llint_slow_path_checkpoint_osr_exit):\n* Source/JavaScriptCore/llint/LLIntSlowPaths.h:\n* Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm:\n* Source/JavaScriptCore/llint/LowLevelInterpreter64.asm:\n* Source/JavaScriptCore/lol/LOLJIT.cpp:\n(JSC::LOL::LOLJIT::privateCompileMainPass):\n(JSC::LOL::LOLJIT::privateCompileSlowCases):\n* Source/JavaScriptCore/runtime/AsyncGeneratorPrototype.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n(JSC::AsyncGeneratorPrototype::finishCreation):\n* Source/JavaScriptCore/runtime/AsyncGeneratorPrototype.h:\n* Source/JavaScriptCore/runtime/AsyncIteratorPrototype.cpp:\n(JSC::AsyncIteratorPrototype::finishCreation):\n* Source/JavaScriptCore/runtime/AsyncIteratorPrototype.h:\n* Source/JavaScriptCore/runtime/CommonSlowPaths.cpp:\n(JSC::iteratorOpenTryFastImpl):\n(JSC::asyncIteratorOpenTryFastImpl):\n(JSC::JSC_DEFINE_COMMON_SLOW_PATH):\n* Source/JavaScriptCore/runtime/CommonSlowPaths.h:\n* Source/JavaScriptCore/runtime/Gate.h:\n* Source/JavaScriptCore/runtime/JSAsyncGenerator.cpp:\n(JSC::JSAsyncGenerator::enqueue):\n(JSC::JSAsyncGenerator::dequeue):\n(): Deleted.\n* Source/JavaScriptCore/runtime/JSAsyncGenerator.h:\n* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:\n(JSC::JSGlobalObject::init):\n* Source/JavaScriptCore/runtime/JSGlobalObject.h:\n* Source/JavaScriptCore/runtime/JSGlobalObjectInlines.h:\n(JSC::JSGlobalObject::asyncGeneratorPrototypeNextFunction const):\n(JSC::JSGlobalObject::asyncIteratorPrototypeSymbolAsyncIteratorFunction const):\n* Source/JavaScriptCore/runtime/JSMicrotask.cpp:\n(JSC::asyncGeneratorCompleteStep):\n(JSC::asyncGeneratorUnwrapYieldResumption):\n(JSC::enqueueAsyncGeneratorDriver):\n(JSC::asyncGeneratorDispatchSuspend):\n(JSC::asyncFunctionArrangeAwaitResume):\n(JSC::asyncFunctionGeneratorBodyCall):\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n(JSC::resumeModeForStatus):\n(JSC::asyncGeneratorDriverResume):\n(JSC::runInternalMicrotask):\n* Source/JavaScriptCore/runtime/JSMicrotask.h:\n* Source/JavaScriptCore/runtime/Microtask.h:\n* Source/JavaScriptCore/runtime/OptionsList.h:\n* Source/JavaScriptCore/runtime/VM.cpp:\n(JSC::VM::VM):\n(JSC::VM::visitAggregateImpl):\n* Source/JavaScriptCore/runtime/VM.h:\n(JSC::VM::fastAsyncGeneratorSentinel):\n\nCanonical link: https://commits.webkit.org/317115@main",
      "email": "ysuzuki@apple.com",
      "hash": "5f65bd95a4b6fb49bed341f7fda4645f1830240b",
      "subject": "[JSC] Cooperative driving of async generators"
    },
    "317116@main": {
      "author": "Dan Hecht",
      "avatar": "https://www.gravatar.com/avatar/080f47d912b1b34d0be8293f825d132d?d=identicon\u0026s=64",
      "cl": "317116@main",
      "clUrl": "https://commits.webkit.org/317116@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319334\nrdar://182150627\n\nReviewed by Yusuke Suzuki.\n\nLargeFreeHeapTests never checked pas_zero_mode: the mock allocator and\ndeallocate path hardcoded may_have_non_zero and the free-range comparison\nignored it, leaving the conservative merge done when free ranges coalesce\nuntested. A regression there would let zeroedMalloc return non-zeroed\nmemory.\n\nThread zero_mode through the harness (Allocation, Action::deallocate, the\nnow-asserted allocation result, and Free), all defaulting to\nmay_have_non_zero so existing tests are unchanged, and add\ntestMergeZeroModeOnCoalesce: free two adjacent ranges and assert the\ncoalesced mode is pas_zero_mode_merge(left, right) across all four\ncombinations, both deallocation orders, and the simple and fast heaps.\n\nTest: Source/bmalloc/libpas/src/test/LargeFreeHeapTests.cpp\n\n* Source/bmalloc/libpas/src/test/LargeFreeHeapTests.cpp:\n(std::operator\u003c\u003c):\n(std::Action::allocate):\n(std::Action::deallocate):\n(std::Free::Free):\n(std::Free::operator== const):\n(std::Free::operator\u003c const):\n(std::Allocation::Allocation):\n(std::function\u003cpas_aligned_allocation_result):\n(std::testLargeFreeHeapImpl):\n(std::testMergeZeroModeOnCoalesce):\n(addLargeFreeHeapTests):\n\nCanonical link: https://commits.webkit.org/317116@main",
      "email": "dan.hecht@apple.com",
      "hash": "2f1aa98aafd5165aa14ab05c9e4f789968825e90",
      "subject": "[libpas] Test zero_mode merge-on-coalesce in LargeFreeHeapTests"
    },
    "317117@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "317117@main",
      "clUrl": "https://commits.webkit.org/317117@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319210\n\nReviewed by Yusuke Suzuki.\n\n284791@main added `virtual ~Handle() = default;` while introducing\nStrongRefTracker, doubling sizeof(Strong\u003cT\u003e) from 8 to 16 bytes everywhere.\nStrong\u003cT\u003e is final and the only subclass of Handle\u003cT\u003e, and nothing deletes\nthrough a Handle\u003cT\u003e*, so the virtual destructor is unnecessary.\n\nRefTracker does not rely on it either: the Vector interaction is handled by\nthe ENABLE(REFTRACKER)-guarded VectorTraits flags added in the same commit.\n\nVerified on a Debug build that JSC_enableStrongRefTracker=1 still works,\nincluding through Vector\u003cStrong\u003cJSPromise\u003e\u003e reallocations.\n\nAlso add a static_assert so Strong\u003cT\u003e stays pointer-sized.\n\n* Source/JavaScriptCore/heap/Handle.h:\n* Source/JavaScriptCore/heap/Strong.h:\n\nCanonical link: https://commits.webkit.org/317117@main",
      "email": "sosuke@bun.sh",
      "hash": "904ba517118749e7b0e97ded812b7b64d8b7d534",
      "subject": "[JSC] `Strong\u003cT\u003e` should be pointer-sized"
    },
    "317118@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "317118@main",
      "clUrl": "https://commits.webkit.org/317118@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319215\n\nReviewed by Yusuke Suzuki.\n\nA sane pointer to a T must be aligned like a T. Add a typed overload that\nchecks this on top of the existing canonical-address check. The void*\noverload keeps its old behavior for callers probing arbitrary addresses\n(e.g. the disassembler); all typed call sites pick up the stricter check\nwithout change.\n\nThis catches the value seen in a real crash: a concurrent DFG thread read\nHeapCell::zap() residue (0x21700000002) out of a freshly reused JSString and\ndereferenced it as a StringImpl*, because it passed every existing check in\nspeculationFromCell() (https://github.com/oven-sh/WebKit/pull/285). The\nreordering race itself is fixed in bug 319213; this hardens the checks that\nbug 216638 added as a mitigation for bad pointers from profiling data.\n\n* Source/JavaScriptCore/tools/Integrity.h:\n(JSC::Integrity::isSanePointer):\n\nCanonical link: https://commits.webkit.org/317118@main",
      "email": "sosuke@bun.sh",
      "hash": "7ff7d1247aaa78cc8b729f3b65f5f6b7321ad919",
      "subject": "[JSC] `Integrity::isSanePointer()` should check alignment for typed pointers"
    },
    "317119@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317119@main",
      "clUrl": "https://commits.webkit.org/317119@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319328\nrdar://182145371\n\nReviewed by Devin Rousso.\n\nCSSManager declared `get overriddenUserPreferences()` twice, at lines 291 and\n295, with identical bodies returning `this._overriddenUserPreferences`. The\nsecond declaration silently shadowed the first and was dead code. Remove the\nduplicate.\n\n* Source/WebInspectorUI/UserInterface/Controllers/CSSManager.js:\n\nCanonical link: https://commits.webkit.org/317119@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "baf52b63edcec25cd3357f821a10958ef8926f9e",
      "subject": "Web Inspector: CSSManager has a duplicate get overriddenUserPreferences() that shadows the first"
    },
    "317120@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317120@main",
      "clUrl": "https://commits.webkit.org/317120@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319279\nrdar://182119496\n\nReviewed by Devin Rousso.\n\nparseMIMEType passed a plain string to String.prototype.replace when\ntrying to trim the surrounding quotes from a charset value. A string\nfirst argument is matched literally, not as a regular expression, so the\ncall searched for the literal sequence `^\"|\"$` — which never appears in\na real value — and the quotes were never removed. As a result a header\nlike `text/html; charset=\"utf-8\"` yielded an encoding of `\"utf-8\"`\n(quotes included), which then showed up quoted in the resource details\nand headers views.\n\nUse replaceAll to strip the quote characters from the charset value.\n\n* Source/WebInspectorUI/UserInterface/Base/Utilities.js:\n(parseMIMEType):\n\n* LayoutTests/inspector/unit-tests/mimetype-utilities.html:\n* LayoutTests/inspector/unit-tests/mimetype-utilities-expected.txt:\nAdd coverage for quoted charset (and a quoted boundary, which is left\nuntrimmed as before).\n\nCanonical link: https://commits.webkit.org/317120@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "2bc447c7562b89bf6a26a52fdc9a3c9f44efde8b",
      "subject": "Web Inspector: parseMIMEType doesn't strip quotes from a quoted charset"
    },
    "317121@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "317121@main",
      "clUrl": "https://commits.webkit.org/317121@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317731\n\nReviewed by Keith Miller.\n\nThe 2-argument getIterationMode (used only by forEachInIterable) gated FastArray\non the caller realm's isOriginalArrayStructure, so cross-realm arrays always\nfell back to the generic iterator path. Switch to\nJSArray::isIteratorProtocolFastAndNonObservable(), which checks the array's own\nrealm just like the existing JSMap/JSSet fast paths.\n\nThere is no observable behavior change: the predicate guarantees the array's own\nrealm's iterator protocol is pristine, so the inlined index loop is equivalent to\nwhat GetIterator + IteratorStep would do, and the materialized iterator for\nIteratorClose now uses array-\u003erealm()-\u003earrayIteratorStructure(), matching what\nthe spec's GetIterator would have produced.\n\n                                       Baseline                  Patched\nset-constructor-cross-realm-array  18.0169+-0.1186     ^      6.0958+-0.0508    ^ definitely 2.9556x faster\n\nTests: JSTests/microbenchmarks/set-constructor-cross-realm-array.js\n       JSTests/stress/for-each-in-iterable-cross-realm-array-fast-path.js\n\n* JSTests/microbenchmarks/set-constructor-cross-realm-array.js: Added.\n(test):\n* JSTests/stress/for-each-in-iterable-cross-realm-array-fast-path.js: Added.\n(shouldBe):\n(shouldBe.ArrayIteratorPrototype.return):\n(ArrayIteratorPrototype.next):\n* Source/JavaScriptCore/runtime/IteratorOperations.cpp:\n(JSC::getIterationMode):\n* Source/JavaScriptCore/runtime/IteratorOperations.h:\n(JSC::forEachInFastArray):\n(JSC::forEachInIterable):\n* Source/JavaScriptCore/runtime/JSArray.h:\n\nCanonical link: https://commits.webkit.org/317121@main",
      "email": "sosuke@bun.sh",
      "hash": "7be57c077eda4ed04a6f77b547f01ffe214891d8",
      "subject": "[JSC] Support cross-realm Array fast path in `forEachInIterable`"
    },
    "317122@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "317122@main",
      "clUrl": "https://commits.webkit.org/317122@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319204\nrdar://182057923\n\nReviewed by Simon Fraser and Abrar Rahman Protyasha.\n\nAdd a UI-side path to determine whether a point (in web view coordinates) is over a scrollbar.\n\nUnlike the existing `_windowResizeMouseLocationIsInVisibleScrollerThumb:` path, which relies on\ncached web-content information and only considers the vertical scrollbar thumb, this works for\nboth axes and uses the UI-side scrolling tree.\n\nThe request flows from WKWebView through WebViewImpl and RemoteScrollingCoordinatorProxy into\nRemoteScrollingTreeMac, which hit-tests the scroller host layers owned by ScrollerPairMac.\n\nOverlay scrollbars whose knob has faded out are treated as not present.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebPageScrollbarTests.swift\n\n* Source/WebCore/page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.h:\n* Source/WebCore/page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:\n(WebCore::ScrollingTreeFrameScrollingNodeMac::isPointOverScrollbar const):\n* Source/WebCore/page/scrolling/mac/ScrollingTreeScrollingNodeDelegateMac.h:\n* Source/WebCore/page/scrolling/mac/ScrollingTreeScrollingNodeDelegateMac.mm:\n(WebCore::ScrollingTreeScrollingNodeDelegateMac::isPointOverScrollbar const):\n* Source/WebKit/UIProcess/API/mac/WKWebViewMac.mm:\n(-[WKWebView _windowResizeMouseLocationIsInVisibleScrollerThumb:]):\n* Source/WebKit/UIProcess/API/mac/WKWebViewPrivateForTestingMac.h:\n* Source/WebKit/UIProcess/API/mac/WKWebViewTestingMac.mm:\n(-[WKWebView isPointOverScrollbar:]):\n* Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.cpp:\n(WebKit::RemoteScrollingCoordinatorProxy::isPointOverScrollbar):\n* Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.h:\n* Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingTree.h:\n(WebKit::RemoteScrollingTree::isPointOverScrollbar):\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteScrollingTreeMac.h:\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteScrollingTreeMac.mm:\n(WebKit::RemoteScrollingTreeMac::isPointOverScrollbar):\n* Source/WebKit/UIProcess/mac/WebViewImpl.h:\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::isPointOverScrollbar):\n* Tools/TestWebKitAPI/Helpers/cocoa/WebPage+Extras.swift:\n(isPointOverScrollbar(_:)):\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebPageScrollbarTests.swift: Added.\n(ScrollbarTests.detectsVerticalScrollbarOnRight(_:expectHit:)):\n(ScrollbarTests.detectsVerticalScrollbarOnLeft(_:expectHit:)):\n(ScrollbarTests.detectsHorizontalScrollbarOnBottom(_:expectHit:)):\n\nCanonical link: https://commits.webkit.org/317122@main",
      "email": "richard_robinson2@apple.com",
      "hash": "f30c34d4ec6ef1d2c602cbc11e4fc21c1459f41e",
      "subject": "[AppKit Gestures] Add a mechanism to determine if a point is over a scrollbar"
    },
    "317123@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "317123@main",
      "clUrl": "https://commits.webkit.org/317123@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319344\nrdar://182158752\n\nReviewed by Abrar Rahman Protyasha.\n\nThis was written to but never read.\n\n* Source/WebKit/UIProcess/ios/WKContentViewInteraction.h:\n* Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm:\n(-[WKContentView _setUpImageAnalysis]):\n(-[WKContentView _tearDownImageAnalysis]):\n(-[WKContentView _cancelImageAnalysis]):\n(-[WKContentView imageAnalysisGestureDidBegin:]):\n\nCanonical link: https://commits.webkit.org/317123@main",
      "email": "richard_robinson2@apple.com",
      "hash": "ee9007de394f573573ba0fef0d468f70d5f29a7e",
      "subject": "Remove unused `_isProceedingWithTextSelectionInImage` variable"
    },
    "317124@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317124@main",
      "clUrl": "https://commits.webkit.org/317124@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319321\nrdar://182143986\n\nReviewed by Devin Rousso.\n\n_tokenTrackingControllerHighlightedMarkedExpression() iterates its markers\nwith `for (var marker of markers)` to find the outermost editableMarker. The\nsubsequent color-validity guard then tested `marker.type`, but because `var`\nis function-scoped, `marker` leaks past the loop and holds the last element of\nthe array rather than the editableMarker actually selected. The branch it\nguards is otherwise written entirely in terms of editableMarker -- it reads\nthis._editingController (built from editableMarker) and clears editableMarker\n-- so the type check was inconsistent with the code it gates.\n\nThis is a latent correctness bug rather than a user-visible regression: it can\nonly change behavior when markersAtPosition() returns two overlapping markers\nof different types where the outermost is not a color and the trailing one is,\nand in the one case where that overlap occurs in practice (a color stop on a\ncontinuation line of a multi-line gradient, whose single-line color-exclusion\nheuristic misses it) the gradient's hover editor does not present regardless,\nmasking any observable difference. No reliable manual repro exists (I tried)\nand the hover-driven path is not covered by the inspector test harness, so\nno test is added.\n\nTest the selected editableMarker's type, matching the editing controller and\nthe marker being cleared within the branch. Convert the `editableMarker` and\n`marker` declarations from `var` to `let` so the loop variable is block-scoped\nand can no longer leak past the loop, preventing this class of bug in the\nfuture.\n\n* Source/WebInspectorUI/UserInterface/Views/SourceCodeTextEditor.js:\n(WI.SourceCodeTextEditor.prototype._tokenTrackingControllerHighlightedMarkedExpression):\n\nCanonical link: https://commits.webkit.org/317124@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "c11d9781788dd0bf8fae0496ad66c65c1769afc5",
      "subject": "Web Inspector: _tokenTrackingControllerHighlightedMarkedExpression tests a leaked loop variable instead of the selected marker"
    },
    "317125@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317125@main",
      "clUrl": "https://commits.webkit.org/317125@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319342\nrdar://182154868\n\nReviewed by Devin Rousso.\n\n`WI.DataGrid.CenterResizerOverBorderAdjustment` is a static property on the\nclass constructor (assigned at the bottom of the file), so reading it off an\ninstance via `this.CenterResizerOverBorderAdjustment` in `resizerDragging()`\nevaluates to `undefined`. `dragPoint - undefined` is `NaN`, so the call\nbecomes `setProperty(\"left\", \"NaNpx\")`, which is invalid and silently ignored.\n\nThis regressed when DataGrid was converted from a prototype object (where the\nconstant lived on the prototype and `this.` resolved it correctly) to an ES6\nclass with the constant hoisted to a static. The sibling constants on the same\nlines already use the fully-qualified `WI.DataGrid.ColumnResizePadding` form;\nthis reference was missed.\n\nQualify the reference with `WI.DataGrid.` to match its siblings.\n\n* Source/WebInspectorUI/UserInterface/Views/DataGrid.js:\n(WI.DataGrid.prototype.resizerDragging):\n\nCanonical link: https://commits.webkit.org/317125@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "ca723826fa2362a6818977464d264e1092d27e6f",
      "subject": "Web Inspector: column resizer drag offset uses `this` for a static constant, producing `left: NaNpx"
    },
    "317126@main": {
      "author": "Alex Christensen",
      "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64",
      "cl": "317126@main",
      "clUrl": "https://commits.webkit.org/317126@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319136\n\nReviewed by Chris Dumez.\n\nWhen this test was written ~2 years ago there was an issue that has since been fixed.\n\nI also remove 2 FIXME comments in OpenWithNoopener.  We are checking the origin before\ncommiting the first navigation, at which point it is correct to have an empty origin.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::TEST(SiteIsolation, OpenWithNoopener)):\n(TestWebKitAPI::TEST(SiteIsolation, MultipleWebViewsWithSameOpenedConfiguration)):\n\nCanonical link: https://commits.webkit.org/317126@main",
      "email": "achristensen@apple.com",
      "hash": "4e36acb24791d2c6b2587e1ab305e6eeffe6542a",
      "subject": "Test loading with second web view in TestWebKitAPI.SiteIsolation.MultipleWebViewsWithSameOpenedConfiguration"
    },
    "317127@main": {
      "author": "Antoine Quint",
      "avatar": "https://www.gravatar.com/avatar/9b3ef1e754f8d994f21ff67c660cbbe6?d=identicon\u0026s=64",
      "cl": "317127@main",
      "clUrl": "https://commits.webkit.org/317127@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319289\nrdar://182129525\n\nReviewed by Tim Nguyen.\n\nImplement the spec change made for https://github.com/w3c/csswg-drafts/issues/14173.\n\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/scroll-timelines/play-animation-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/scroll-timelines/play-animation.html:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/scroll-timelines/reverse-animation-expected.txt:\n* Source/WebCore/animation/WebAnimation.cpp:\n(WebCore::WebAnimation::autoAlignStartTime):\n\nCanonical link: https://commits.webkit.org/317127@main",
      "email": "graouts@webkit.org",
      "hash": "b2af1be4d3fb31204052898779df0c0ee827f9d4",
      "subject": "[web-animations-2] Auto-aligning the start time should apply a pending playback rate"
    },
    "317128@main": {
      "author": "Zak Ridouh",
      "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64",
      "cl": "317128@main",
      "clUrl": "https://commits.webkit.org/317128@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319352\nrdar://182164452\n\nReviewed by Elliott Williams.\n\nFour independent build breaks surface when building the Mac CMake port\nagainst the internal macOS 27 SDK, where WebKitAdditions turns on feature\nflags that the CMake build wasn't fully wired up for:\n\n- OptionsCocoa.cmake: the empty AppleFeatures.h stub was placed on -isystem\n  for internal-SDK builds too, shadowing the SDK's real header and tripping\n  #warning-as-error in MediaExperience's MXFeatureFlags.h. Guard the stub with\n  NOT USE_APPLE_INTERNAL_SDK, matching the sibling availability-overlay block.\n\n- Headers.cmake: add GPUProcess/graphics/Model/ModelTypes.h to\n  WebKit_PROJECT_HEADERS so \u003cWebKit/ModelTypes.h\u003e resolves via the header map,\n  alongside its already-listed siblings Float3.h and Float4x4.h.\n\n- CMakeLists.txt: expose TextGranularity.h through the WebCore_Private Swift\n  module map so WKTextSelectionController.swift can name WebCore.TextGranularity.\n\n- PlatformMac.cmake: add the companion Swift files of the AppKit-gestures unit\n  (WebPageProxy.swift, Logger+Extras.swift, WKAppKitGestureController.swift,\n  IntRectCG.swift, FloatRectCG.swift). WKTextSelectionController.swift was added\n  without them, so the WebKit.swiftmodule emit-module failed on missing members.\n\n* Source/WebKit/CMakeLists.txt:\n* Source/WebKit/Headers.cmake:\n* Source/WebKit/PlatformMac.cmake:\n* Source/cmake/OptionsCocoa.cmake:\n\nCanonical link: https://commits.webkit.org/317128@main",
      "email": "zakr@apple.com",
      "hash": "4bcd765a466aeee9a3830da26916479348d26fb4",
      "subject": "[CMake] Fix build against recent internal SDKs"
    },
    "317129@main": {
      "author": "Anuj Panta",
      "avatar": "https://www.gravatar.com/avatar/f795b7daddea5f93c9cbb5a4a8f0db14?d=identicon\u0026s=64",
      "cl": "317129@main",
      "clUrl": "https://commits.webkit.org/317129@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=308900\nrdar://171780948\n\nReviewed by Qianlang Chen.\n\nIntroduce a new Storage domain (cookies only for this pass) that runs entirely\nUIProcess-side and talks to the authoritative store via API::HTTPCookieStore --\nthe same path BidiStorageAgent already uses. Reading the NetworkProcess-owned\nstore in one call sees cookies across every WebContent process, including those\nset inside cross-origin iframes under Site Isolation, with no per-process fan-\nout or routing. The old Page cookie commands are left untouched.\n\nInspectorStorageAgent does no WebContent IPC (all work is UIProcess-local), so\nunlike ProxyingPageAgent/ProxyingNetworkAgent it needs no MessageReceiver and\nlives in the AgentRegistry. It is created unconditionally in\nWebPageInspectorController::createLazyAgents alongside InspectorBrowserAgent,\nnot gated on siteIsolationEnabled(): the domain is useful with or without SI,\nand reading the authoritative store is the correct model in both cases. Its\nprotocol domain is declared with targetTypes [\"web-page\"] so, like Browser, it\nis owned by the UIProcess (multiplexing) target rather than the WebContent page\ntarget; Target.js gains the matching StorageAgent accessor.\n\ngetCookies reads the flat authoritative store (API::HTTPCookieStore::cookies,\nbacked by WebCookieManager::GetAllCookies). This read surfaces BOTH unpartitioned\nand partitioned (CHIPS) cookies; each cookie carries its partition in\nCookie.partitionKey, so partitioned cookies are visible and labeled (verified by\nstorage-get-partitioned-cookies.https.html). The only remaining partition work is\na documented per-URL+partition scoped lens (the storageKey PartitionDescriptor\narm), deferred to webkit.org/b/292393 -- not basic visibility.\n\nThe Storage domain exposes an explicit PartitionDescriptor parameter (context\nnow, storageKey stubbed for webkit.org/b/292393) and populates Cookie.partitionKey:\nit is emitted on getCookies and, on setCookie, written onto the WebCore::Cookie\nonly when the caller supplies an explicit partitionKey. setCookie's returned\nPartitionKey echoes where the cookie actually landed -- the explicit key if given,\notherwise empty -- rather than synthesizing the page's origin, so it never claims\nan unpartitioned cookie lives in a partition. WebCore::Cookie::partitionKey already\nexisted and already rides the IPC to NetworkProcess; BiDi simply never set it. A\nfollow-up should bring BidiStorageAgent to parity via the shared helper.\n\ndeleteCookies requires an explicit filter: a request with no filter is rejected\nrather than clearing the entire store (which, given the flat read above, would\ninclude partitioned cookies). This matches BidiStorageAgent and keeps a\ndestructive clear from being the empty-argument default of a filtered command.\n\nCookie filtering is factored out of BidiStorageAgent into a shared\nCookieStoreHelpers::cookieMatchesFilter so both frontends filter identically;\nBidiStorageAgent is refactored onto it with no behavior change.\n\nOpt-in cookie partitioning (CHIPS) is gated on HAVE(ALLOW_ONLY_PARTITIONED_COOKIES)\n(macOS 26.2+); on older OSes it is compiled out and no partitionKey is populated.\nstorage-get-partitioned-cookies.https.html asserts a populated partitionKey, so\nit is [ Skip ] by default in LayoutTests/TestExpectations and re-enabled with\n[ Tahoe+ ] [ Pass ] in platform/mac-wk2/TestExpectations -- the same two-file\nsplit as the existing CHIPS suite. The other three storage tests run everywhere.\n\nTests: http/tests/site-isolation/inspector/storage/storage-get-cookies.html\n       http/tests/site-isolation/inspector/storage/storage-get-cookies-cross-origin-iframe.html\n       http/tests/site-isolation/inspector/storage/storage-get-partitioned-cookies.https.html\n       http/tests/site-isolation/inspector/storage/storage-set-and-delete-cookies.html\n\n* LayoutTests/TestExpectations:\n* LayoutTests/http/tests/site-isolation/inspector/storage/resources/set-cookie-via-script.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/storage/resources/set-cookie.py: Added.\n* LayoutTests/http/tests/site-isolation/inspector/storage/storage-get-cookies-cross-origin-iframe-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/storage/storage-get-cookies-cross-origin-iframe.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/storage/storage-get-cookies-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/storage/storage-get-cookies.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/storage/storage-get-partitioned-cookies.https-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/storage/storage-get-partitioned-cookies.https.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/storage/storage-set-and-delete-cookies-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/storage/storage-set-and-delete-cookies.html: Added.\n* LayoutTests/platform/mac-wk2/TestExpectations:\n* Source/JavaScriptCore/CMakeLists.txt:\n* Source/JavaScriptCore/DerivedSources-input.xcfilelist:\n* Source/JavaScriptCore/DerivedSources.make:\n* Source/JavaScriptCore/inspector/protocol/Storage.json: Added.\n* Source/WebInspectorUI/UserInterface/Protocol/Target.js:\n(WI.Target.prototype.get StorageAgent): Added.\n* Source/WebKit/Sources.txt:\n* Source/WebKit/UIProcess/Automation/BidiStorageAgent.cpp:\n(WebKit::BidiStorageAgent::getCookies):\n(WebKit::BidiStorageAgent::deleteCookies):\n(WebKit::cookieMatchesFilter): Deleted.\n* Source/WebKit/UIProcess/Inspector/Agents/InspectorStorageAgent.cpp: Added.\n(WebKit::toProtocol):\n(WebKit::fromProtocol):\n(WebKit::buildObjectForCookie):\n(WebKit::buildArrayForCookies):\n(WebKit::InspectorStorageAgent::InspectorStorageAgent):\n(WebKit::InspectorStorageAgent::didCreateFrontendAndBackend):\n(WebKit::InspectorStorageAgent::willDestroyFrontendAndBackend):\n(WebKit::InspectorStorageAgent::enable):\n(WebKit::InspectorStorageAgent::disable):\n(WebKit::InspectorStorageAgent::cookieStoreForPartition):\n(WebKit::InspectorStorageAgent::makePartitionKey):\n(WebKit::InspectorStorageAgent::getCookies):\n(WebKit::InspectorStorageAgent::setCookie):\n(WebKit::deleteCookiesSequentially):\n(WebKit::InspectorStorageAgent::deleteCookies):\n* Source/WebKit/UIProcess/Inspector/Agents/InspectorStorageAgent.h: Added.\n* Source/WebKit/UIProcess/Inspector/InspectorCookieStoreHelpers.cpp: Added.\n(WebKit::CookieFilter::fromProtocol):\n(WebKit::CookieFilter::matches const):\n* Source/WebKit/UIProcess/Inspector/InspectorCookieStoreHelpers.h: Added.\n* Source/WebKit/UIProcess/Inspector/WebPageInspectorController.cpp:\n(WebKit::WebPageInspectorController::createLazyAgents):\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/317129@main",
      "email": "a_panta@apple.com",
      "hash": "74bc5de8363385d200ce43338756dcb6969bd424",
      "subject": "WIP: [SI] Add a Storage domain for cookie inspection"
    },
    "317130@main": {
      "author": "Anuj Panta",
      "avatar": "https://www.gravatar.com/avatar/f795b7daddea5f93c9cbb5a4a8f0db14?d=identicon\u0026s=64",
      "cl": "317130@main",
      "clUrl": "https://commits.webkit.org/317130@main",
      "description": "Reviewed by Qianlang Chen.\n\nWire the frontend onto the UIProcess Storage domain added in the previous\ncommit so cookie inspection sees cross-origin iframe cookies under Site\nIsolation, which the in-process Page cookie commands cannot.\n\nWI.StorageManager owns the domain's enable/disable lifecycle. Like\nBrowserManager, the Storage domain lives on the UIProcess (multiplexing)\nbackend target, so MultiplexingBackendTarget.initialize() calls\nstorageManager.initializeTarget() directly -- that target is added without\ndispatching TargetAdded and its initialize() does not iterate WI.managers,\nso an explicit call is required for the enable to actually reach the backend\n(the same reason browserManager is wired there). The manager exposes the gate\nWI.storageManager.shouldUseStorageDomain: true only when Site Isolation is\nactive (a WI.FrameTarget exists) and the backend declares the Storage domain.\nWI.isSiteIsolationEnabled is promoted from the test harness into Base/Main.js\n(kept in Test.js, matching the other duplicated target utilities) so\nproduction can read it.\n\nWI.CookieStorageObject (the represented object) owns cookie get/set/delete\nand the choice of backend: under Site Isolation it routes through\nWI.backendTarget.StorageAgent (which reads the authoritative NetworkProcess\nstore and so sees out-of-process cross-origin iframe cookies), otherwise it\nkeeps the exact legacy Page path -- non-Site-Isolation sessions are unchanged.\nThe model also exposes canGetCookies / canSetCookie / canDeleteCookie in place\nof the hardcoded Page.* command checks. Storage.deleteCookies is filter-based,\nso a single-cookie delete targets it by (name, domain, path).\nCookieStorageContentView only asks the represented object for cookies and for\nwhich operations are available; it no longer knows which backend serves them.\nThe view refreshes on TargetAdded (gated by the model's\nreloadsCookiesOnTargetAdded) so a cookie set by a cross-origin iframe appears\nonce that frame becomes its own target.\n\nsetCookie no longer files a session cookie as epoch-expired: getCookies\nserializes a session cookie's absent expiry as 0 (Cookie::expires is\noptional), and echoing that back set expires to the 1970 epoch. Honor\n`session` (and reject a non-positive timestamp) so the set/get round-trip\npreserves session cookies, matching WI.Cookie's own (!session \u0026\u0026 expires)\nrule.\n\nThe two tests that require an out-of-process frame target skip on the\nSite-Isolation-off bot (they await a TargetAdded that never fires) and pass\non mac-site-isolation, matching the sibling frame-target tests.\n\nTest: http/tests/site-isolation/inspector/storage/storage-frontend-gate.html\n\n* LayoutTests/http/tests/site-isolation/inspector/storage/storage-frontend-gate-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/storage/storage-frontend-gate.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/storage/storage-set-and-delete-cookies-expected.txt:\n* LayoutTests/http/tests/site-isolation/inspector/storage/storage-set-and-delete-cookies.html:\n* LayoutTests/platform/mac-site-isolation/TestExpectations:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n* Source/WebInspectorUI/UserInterface/Base/Main.js:\n(WI.loaded):\n* Source/WebInspectorUI/UserInterface/Controllers/StorageManager.js: Added.\n(WI.StorageManager):\n(WI.StorageManager.prototype.get domains):\n(WI.StorageManager.prototype.activateExtraDomain):\n(WI.StorageManager.prototype.initializeTarget):\n(WI.StorageManager.prototype.get shouldUseStorageDomain):\n(WI.StorageManager.prototype.get hasStorageDomain):\n(WI.StorageManager.prototype.enable):\n(WI.StorageManager.prototype.disable):\n* Source/WebInspectorUI/UserInterface/Main.html:\n* Source/WebInspectorUI/UserInterface/Models/CookieStorageObject.js:\n(WI.CookieStorageObject.prototype.get canGetCookies):\n(WI.CookieStorageObject.prototype.get canSetCookie):\n(WI.CookieStorageObject.prototype.get canDeleteCookie):\n(WI.CookieStorageObject.prototype.get reloadsCookiesOnTargetAdded):\n(WI.CookieStorageObject.prototype.getCookies):\n(WI.CookieStorageObject.prototype.setCookie):\n(WI.CookieStorageObject.prototype.deleteCookie):\n(WI.CookieStorageObject.prototype.get _useStorageDomain):\n* Source/WebInspectorUI/UserInterface/Protocol/MultiplexingBackendTarget.js:\n(WI.MultiplexingBackendTarget.prototype.initialize):\n* Source/WebInspectorUI/UserInterface/Test.html:\n* Source/WebInspectorUI/UserInterface/Test/Test.js:\n(WI.loaded):\n* Source/WebInspectorUI/UserInterface/Views/CookieStorageContentView.js:\n(WI.CookieStorageContentView):\n(WI.CookieStorageContentView.prototype.closed):\n(WI.CookieStorageContentView.prototype.tableCellContextMenuClicked):\n(WI.CookieStorageContentView.prototype.tableDidRemoveRows):\n(WI.CookieStorageContentView.prototype.get _canGetCookies):\n(WI.CookieStorageContentView.prototype.get _canSetCookie):\n(WI.CookieStorageContentView.prototype.get _canDeleteCookie):\n(WI.CookieStorageContentView.prototype._getCookies):\n(WI.CookieStorageContentView.prototype._setCookie):\n(WI.CookieStorageContentView.prototype._deleteCookie):\n(WI.CookieStorageContentView.prototype._handleTargetAdded):\n(WI.CookieStorageContentView.prototype.async _willDismissCookiePopover):\n(WI.CookieStorageContentView.prototype._handleClearNavigationItemClicked):\n(WI.CookieStorageContentView.prototype._reloadCookies):\n(WI.CookieStorageContentView.prototype._handleTableKeyDown):\n* Source/WebKit/UIProcess/Inspector/Agents/InspectorStorageAgent.cpp:\n(WebKit::InspectorStorageAgent::setCookie):\n\nCanonical link: https://commits.webkit.org/317130@main",
      "email": "a_panta@apple.com",
      "hash": "0e40cc1ed3a51283798297dad6918ae54f132285",
      "subject": "Web Inspector: [SI] wire the frontend cookie UI onto the UIProcess Storage domain https://bugs.webkit.org/show_bug.cgi?id=318789 rdar://181612724"
    },
    "317131@main": {
      "author": "Adrian Perez de Castro",
      "avatar": "https://www.gravatar.com/avatar/30ffea8cf404586741a8f5f7110c0914?d=identicon\u0026s=64",
      "cl": "317131@main",
      "clUrl": "https://commits.webkit.org/317131@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319282\n\nUnreviewed.\n\n* Source/WebCore/platform/gtk/po/pt_BR.po:\n\nCanonical link: https://commits.webkit.org/317131@main",
      "email": "aperez@igalia.com",
      "hash": "c0766599368656a43f9b38cf345d54e5829f9afe",
      "subject": "[GTK] Update Brazilian Portuguese (pt_BR.po) translation"
    },
    "317132@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "317132@main",
      "clUrl": "https://commits.webkit.org/317132@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313564\n\nReviewed by Yusuke Suzuki.\n\nA warm dynamic import() (same specifier from the same referrer) currently\nre-runs the host's moduleLoaderResolve hook even though the result is\nalready known. The hook can be expensive depending on the embedder, and\nthe spec already provides the cache to avoid it: HostLoadImportedModule\n[1] is required to be idempotent for the same (referrer, moduleRequest)\npair, and FinishLoadingImportedModule [2] populates\nreferrer.[[LoadedModules]] for that purpose. InnerModuleLoading already\nconsults that cache before calling the host hook, but the top-level\nloadModule() path used by dynamic import() does not.\n\nConsult referrer.[[LoadedModules]] (the module's, or the Realm's\nm_loadedModules) at the top of hostLoadImportedModule and short-circuit\nto FinishLoadingImportedModule with the cached record on hit, returning\nthe existing registry entry's loadPromise. [[LoadedModules]] is populated\nonly on normal completion, so fetch / resolution failures fall through to\nthe existing slow path unchanged. Per the idempotency requirement, this\nis unobservable.\n\nIn a local microbenchmark of 100,000 warm dynamic imports of one cached\nmodule, per-import time drops from ~28 us to ~0.68 us. Cold loads are\nunaffected since [[LoadedModules]] is empty on first call.\n\n[1]: https://tc39.es/ecma262/#sec-HostLoadImportedModule\n[2]: https://tc39.es/ecma262/#sec-FinishLoadingImportedModule\n\nTests: JSTests/modules/dynamic-import-loaded-modules-cache.js\n       JSTests/modules/dynamic-import-loaded-modules-cache/leaf.js\n       JSTests/modules/dynamic-import-loaded-modules-cache/re-importer.js\n\n* JSTests/modules/dynamic-import-loaded-modules-cache.js: Added.\n* JSTests/modules/dynamic-import-loaded-modules-cache/leaf.js: Added.\n* JSTests/modules/dynamic-import-loaded-modules-cache/re-importer.js: Added.\n* Source/JavaScriptCore/runtime/JSModuleLoader.cpp:\n(JSC::JSModuleLoader::hostLoadImportedModule):\n\nCanonical link: https://commits.webkit.org/317132@main",
      "email": "sosuke@bun.sh",
      "hash": "aeefbc27b80ad1c5c8ce432931b3b0da211b7ed6",
      "subject": "[JSC] Skip redundant `resolve()` in `HostLoadImportedModule` for repeat dynamic imports"
    },
    "317133@main": {
      "author": "Keith Miller",
      "avatar": "https://www.gravatar.com/avatar/bddc1595b29098429a6ce7c8bf4aced2?d=identicon\u0026s=64",
      "cl": "317133@main",
      "clUrl": "https://commits.webkit.org/317133@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319174\nrdar://182009951\n\nReviewed by Elliott Williams.\n\nAdd a new preset: mac-performance that enables PGO/LTO. The goal of this\nmode is to reflect any future shipping CMake build as much as possible.\nI didn't enable PGO by default for release builds with the internal SDK\nbecause it does seem to noticeably slow down the build (1:50-2:00\nwithout PGO vs 2:10-2:20 with for `--target jsc` builds).\n\nWhen PGO is enabled for internal SDK builds it uses an OptionsPGO.cmake\nto configure PGO data and disables the OSS PGO CMake logic.\n\nCanonical link: https://commits.webkit.org/317133@main",
      "email": "keith_miller@apple.com",
      "hash": "de6c371b533d07f008e81f12ecca4d638435ffa4",
      "subject": "[CMake] Add mac-performance preset with PGO/LTO support"
    },
    "317134@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "317134@main",
      "clUrl": "https://commits.webkit.org/317134@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319280\nrdar://182119576\n\nReviewed by Richard Robinson.\n\nThere are two copies of WKBackForwardListTests.mm in the repository\ncurrently, when there should be one.\n\n- Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKBackForwardListTests.mm:\n    Where things should be post-310630@main.\n- Tools/TestWebKitAPI/Tests/WebKit/WKBackForwardListTests.mm:\n    It was resurrected because of a merge back in 316143@main.\n\nThe latter is not building in the tree anyway, so let's migrate all its\nunique content into the former.\n\nCanonical link: https://commits.webkit.org/317134@main",
      "email": "a_protyasha@apple.com",
      "hash": "19260e3c5688ca5dd206e4e7ea9045efb3e0f17f",
      "subject": "Merge the two copies of WKBackForwardListTests.mm into one"
    },
    "317135@main": {
      "author": "Anne van Kesteren",
      "avatar": "https://www.gravatar.com/avatar/09bb44ac3625a121017cd98d0a7dc52c?d=identicon\u0026s=64",
      "cl": "317135@main",
      "clUrl": "https://commits.webkit.org/317135@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319251\n\nReviewed by Tim Nguyen and Sihui Liu.\n\nThis allows for serializing and storing of FileSystemHandle objects. It\nis only enabled for Cocoa to match FileSystemEnabled.\n\nCanonical link: https://commits.webkit.org/317135@main",
      "email": "annevk@annevk.nl",
      "hash": "6ff71b62be8cd6b66a8278c6f5ae3eecf789981d",
      "subject": "Mark FileSystemHandleSerializationEnabled stable for Cocoa"
    },
    "317136@main": {
      "author": "Brent Fulgham",
      "avatar": "https://www.gravatar.com/avatar/c6989a65afef0d015b55c65406e37ccc?d=identicon\u0026s=64",
      "cl": "317136@main",
      "clUrl": "https://commits.webkit.org/317136@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318289\n\u003crdar://problem/171019322\u003e\n\nReviewed by Dan Glastonbury and Simon Fraser.\n\nThe Spotify queue pane showed a \"jump\" when animating open: as it approached the top it\nwould overscroll and then snap back into position.\n\nA transform contributes to its scroll container's scrollable overflow (see\nRenderBox::applyPaintGeometryTransformToRect): a translated descendant extends the\ncontainer's scrollable area. An accelerated transform animation, however, runs on the\ncompositor and does not trigger layout, so while it is running the scroll container's\nscrollable overflow is never recomputed. When such an animation settles (e.g. the queue\npanel sliding in from a translateY toward 0), the scrollable overflow -- and any scroll\noffset that was only reachable because of the animated transform -- is left stale, so\nthe container stays over-scrolled until some later layout happens to re-clamp it. That\nlate re-clamp is the visible \"hop\".\n\nFix this by recomputing overflow when an accelerated transform-related animation\nfinishes. KeyframeEffect::animationDidFinish() now calls setNeedsLayoutForOverflowChange()\non the target when the effect animates a transform-related property. At completion the\ntransform has settled, so the scroll container's scrollable overflow is recomputed and\nthe scroll offset is clamped back into the valid range in the same update -- no visible\nhop.\n\nThis is intentionally scoped to animation completion rather than to every transform\nchange since forcing an overflow recomputation on all transform changes regresses\nanimations inside form controls.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/cssom-view/scroll-clamp-after-transform-shrinks-overflow-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/cssom-view/scroll-clamp-after-transform-shrinks-overflow.html: Added.\n* Source/WebCore/animation/KeyframeEffect.cpp:\n(WebCore::KeyframeEffect::animationDidFinish):\n\nCanonical link: https://commits.webkit.org/317136@main",
      "email": "bfulgham@apple.com",
      "hash": "1891c25bbb1c59cb0ed2b00f4adddf06bebbd0a4",
      "subject": "spotify.com: Queue pane animation has weird jump when entering screen"
    },
    "317137@main": {
      "author": "Nikolas Zimmermann",
      "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64",
      "cl": "317137@main",
      "clUrl": "https://commits.webkit.org/317137@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319360\n\nReviewed by Carlos Garcia Campos.\n\nAdd Damage::rectsForPainting(), which returns rects that never overlap, unlike\nrects(), and that never outnumber the damage grid's cells. A caller that draws\neach rect separately needs both: overlapping rects would composite translucent\ncontent twice, and an unbounded rect count would turn one draw into arbitrarily\nmany. Overlapping rects are split at the cell borders and united per cell, which\nleaves at most one rect per cell. Rects that overlap nothing are left whole,\nbecause splitting them would only make more work for the caller that draws them.\n\nAlso fix add(const Damage\u0026). Its fast path for two damages that are already united\nonto the same grid unites the per-cell rects, but leaves the indices that iteration\nwalks unset and the bounding rectangle stale, so a cell damaged in the other damage\nbut not yet here is stored and then never returned by rects(). It was unreachable\nuntil now, because no two damages shared a grid.\n\nThe new API has no callers yet. Cover it with an API test.\n\n* Source/WebCore/platform/graphics/Damage.h:\n(WebCore::Damage::rectsForPainting const):\n(WebCore::Damage::add):\n(WebCore::Damage::hasOverlappingRects):\n* Tools/TestWebKitAPI/Tests/WebCore/glib/Damage.cpp:\n(TestWebKitAPI::TEST(Damage, RectsForPainting)):\n\nCanonical link: https://commits.webkit.org/317137@main",
      "email": "nzimmermann@igalia.com",
      "hash": "9cc587ef6ae8f7e1ddc0d47cda5de2564d295728",
      "subject": "[Damage] Add rectsForPainting() and fix uniting two damages that share a grid"
    },
    "317138@main": {
      "author": "Anne van Kesteren",
      "avatar": "https://www.gravatar.com/avatar/09bb44ac3625a121017cd98d0a7dc52c?d=identicon\u0026s=64",
      "cl": "317138@main",
      "clUrl": "https://commits.webkit.org/317138@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319247\n\nReviewed by Tim Nguyen.\n\nEnable support for HTML's headingoffset \u0026 headingreset attributes.\n\nCanonical link: https://commits.webkit.org/317138@main",
      "email": "annevk@annevk.nl",
      "hash": "9c25f0bcb297c48d8ef126dfad4ca9840731e440",
      "subject": "Mark HeadingOffsetEnabled stable"
    },
    "317139@main": {
      "author": "Anne van Kesteren",
      "avatar": "https://www.gravatar.com/avatar/09bb44ac3625a121017cd98d0a7dc52c?d=identicon\u0026s=64",
      "cl": "317139@main",
      "clUrl": "https://commits.webkit.org/317139@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319250\n\nReviewed by Tim Nguyen.\n\nEnable dedicated workers in shared workers.\n\nCanonical link: https://commits.webkit.org/317139@main",
      "email": "annevk@annevk.nl",
      "hash": "29910bc456aab4520f00dbbacf13ca4cb7fee099",
      "subject": "Mark WorkerInSharedWorkerEnabled stable"
    },
    "317140@main": {
      "author": "Fujii Hironori",
      "avatar": "https://www.gravatar.com/avatar/ef99cb23f5e5d27977968ca097d9a85f?d=identicon\u0026s=64",
      "cl": "317140@main",
      "clUrl": "https://commits.webkit.org/317140@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319307\n\nReviewed by Carlos Garcia Campos.\n\nAdded the following asynchronous touch event methods to EventSender.\n\n- asyncTouchStart()\n- asyncTouchMove()\n- asyncTouchEnd()\n- asyncTouchCancel()\n\nSee also 309000@main which added eventSender.asyncMouse* methods.\n\nRewrote some layout tests with them. They were blocking bug#318938.\n\n* LayoutTests/fast/events/touch/multi-touch-inside-iframes.html:\n* LayoutTests/fast/events/touch/text-node-touch-target.html:\n* LayoutTests/fast/events/touch/textarea-touch-target.html:\n* LayoutTests/fast/events/touch/touch-coords-in-zoom-and-scroll.html:\n* LayoutTests/fast/events/touch/touch-slider-no-js-touch-listener.html:\n* LayoutTests/fast/events/touch/touch-slider.html:\n* Source/WebKit/UIProcess/API/C/WKPage.cpp:\n(WKPageDoAfterProcessingAllPendingWheelEvents):\n(WKPageDoAfterProcessingAllPendingTouchEvents):\n* Source/WebKit/UIProcess/API/C/WKPagePrivate.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::doAfterProcessingAllPendingWheelEvents):\n(WebKit::WebPageProxy::didFinishProcessingAllPendingWheelEvents):\n(WebKit::WebPageProxy::flushPendingWheelEventCallbacks):\n(WebKit::WebPageProxy::isProcessingTouchEvents const):\n(WebKit::WebPageProxy::doAfterProcessingAllPendingTouchEvents):\n(WebKit::WebPageProxy::didFinishProcessingAllPendingTouchEvents):\n(WebKit::WebPageProxy::flushPendingTouchEventCallbacks):\n(WebKit::WebPageProxy::wheelEventHandlingCompleted):\n(WebKit::WebPageProxy::touchEventHandlingCompleted):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxyInternals.h:\n* Tools/WebKitTestRunner/EventSenderProxy.h:\n* Tools/WebKitTestRunner/InjectedBundle/ios/EventSenderProxyIOS.mm:\n(WTR::EventSenderProxy::touchStart):\n(WTR::EventSenderProxy::touchMove):\n(WTR::EventSenderProxy::touchEnd):\n(WTR::EventSenderProxy::touchCancel):\n* Tools/WebKitTestRunner/TestController.cpp:\n(WTR::if):\n* Tools/WebKitTestRunner/TestController.h:\n* Tools/WebKitTestRunner/gtk/EventSenderProxyGtk.cpp:\n(WTR::EventSenderProxy::touchStart):\n(WTR::EventSenderProxy::touchMove):\n(WTR::EventSenderProxy::touchEnd):\n(WTR::EventSenderProxy::touchCancel):\n* Tools/WebKitTestRunner/libwpe/EventSenderProxyLibWPE.cpp:\n(WTR::EventSenderProxy::touchStart):\n(WTR::EventSenderProxy::touchMove):\n(WTR::EventSenderProxy::touchEnd):\n(WTR::EventSenderProxy::touchCancel):\n\nCanonical link: https://commits.webkit.org/317140@main",
      "email": "fujii@igalia.com",
      "hash": "590cc045e1331238e245b8a909afcdbaf55f7169",
      "subject": "[WPE][WebKitTestRunner] Add EventSender.asyncTouch* methods"
    },
    "317141@main": {
      "author": "Claudio Saavedra",
      "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64",
      "cl": "317141@main",
      "clUrl": "https://commits.webkit.org/317141@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319255\n\nReviewed by Carlos Garcia Campos.\n\nBefore 315356@main, m_layers was only used from the main thread, so it was\naccessed without a lock. That change started iterating it in flushPendingState(),\nwhich can also run on the scrolling thread: when the main thread's rendering\nupdate overruns the scrolling tree's synchronization timeout, the scrolling\nthread commits layer positions concurrently and its iteration races the\nmain-thread mutations in addLayer(), removeLayer() and invalidate(), corrupting\nthe hash table.\n\nProtect m_layers with a dedicated lock, taken by the mutators and by\nflushPendingState(). The state lock keeps guarding only the pending and\ncompositing state flushes, so adding or removing layers on the main thread does\nnot block the compositor thread.\n\nTest: compositing/scrolling/layer-churn-during-async-scroll-crash.html\n\n* LayoutTests/compositing/scrolling/layer-churn-during-async-scroll-crash-expected.txt: Added.\n* LayoutTests/compositing/scrolling/layer-churn-during-async-scroll-crash.html: Added.\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/CoordinatedSceneState.cpp:\n(WebKit::CoordinatedSceneState::addLayer):\n(WebKit::CoordinatedSceneState::removeLayer):\n(WebKit::CoordinatedSceneState::flush):\n(WebKit::CoordinatedSceneState::flushPendingState):\n(WebKit::CoordinatedSceneState::invalidate):\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/CoordinatedSceneState.h:\n\nCanonical link: https://commits.webkit.org/317141@main",
      "email": "csaavedra@igalia.com",
      "hash": "6c291d01ba2f455787d406fc7dfb584172bdcd57",
      "subject": "REGRESSION(315356@main): Data race on CoordinatedSceneState::m_layers between the main and scrolling threads"
    },
    "317142@main": {
      "author": "Nikolas Zimmermann",
      "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64",
      "cl": "317142@main",
      "clUrl": "https://commits.webkit.org/317142@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319375\n\nReviewed by Carlos Garcia Campos.\n\nA layer records damage when its backing store re-renders and when a new contents\nbuffer arrives, and the compositor layers damage the whole layer themselves when\nit is resized or its opacity or transform changes. Nothing records damage for the\nrest of the state the compositor applies while drawing the layer: the contents\nrect, the contents tiling, filters, masks, the clip path, the blend mode and\ncontents visibility. Changing any of those changes the pixels the compositor\nproduces for the layer, but none of them dirties a tile, so the backing store is\nnever re-rendered and no damage is recorded on their behalf.\n\nA compositor that draws just the damaged rects therefore leaves the previous\nframe's pixels on screen. e.g. An animated background-position on a directly\ncomposited image only changes the contents tile phase, so the frame currently\ncarries no damage at all and the animation freezes.\n\nTherefore damage the whole layer from those setters.\n\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.cpp:\n(WebCore::CoordinatedPlatformLayer::setMasksToBounds):\n(WebCore::CoordinatedPlatformLayer::setBlendMode):\n(WebCore::CoordinatedPlatformLayer::setContentsVisible):\n(WebCore::CoordinatedPlatformLayer::setContentsOpaque):\n(WebCore::CoordinatedPlatformLayer::setContentsRect):\n(WebCore::CoordinatedPlatformLayer::setContentsRectClipsDescendants):\n(WebCore::CoordinatedPlatformLayer::setContentsClippingRect):\n(WebCore::CoordinatedPlatformLayer::setContentsBuffer):\n(WebCore::CoordinatedPlatformLayer::setContentsImage):\n(WebCore::CoordinatedPlatformLayer::setContentsTileSize):\n(WebCore::CoordinatedPlatformLayer::setContentsTilePhase):\n(WebCore::CoordinatedPlatformLayer::damageWholeLayer):\n(WebCore::CoordinatedPlatformLayer::setFilters):\n(WebCore::CoordinatedPlatformLayer::setMask):\n(WebCore::CoordinatedPlatformLayer::setReplica):\n(WebCore::CoordinatedPlatformLayer::notifyBackdropFiltersChanged):\n(WebCore::CoordinatedPlatformLayer::setBackdropRect):\n(WebCore::CoordinatedPlatformLayer::setClipPath):\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.h:\n\nCanonical link: https://commits.webkit.org/317142@main",
      "email": "nzimmermann@igalia.com",
      "hash": "b825954ee089fbe3cbc58dabc71e132e14d45c12",
      "subject": "[Coordinated] Damage a layer when its state changes the composited result"
    },
    "317143@main": {
      "author": "Nikolas Zimmermann",
      "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64",
      "cl": "317143@main",
      "clUrl": "https://commits.webkit.org/317143@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319371\n\nReviewed by Rob Buis.\n\nRenderSVGResourceClipper::applyPathClipping() rebuilt the clip geometry for every clipped shape\non every frame: computeClipPath() -\u003e pathFromGraphicsElement() re-parses the clip child's\nattributes into a new Path, and context.clipPath() then converts it to a CGPath via\nPath::platformPath() -\u003e PathCG::create(). The geometry is constant for a given clip-path,\nonly the per-target transform differs and is applied separately via the CTM.\n\nOn MotionMark/Suits half the shapes carry a clip-path, so this rebuilt thousands of\nidentical clip paths per frame. Sampling at fixed, high complexity showed setupClipPathForRenderer\nat ~12% of the WebProcess main thread (PathCG::create alone ~5%) - caching drops it to ~3% and\nPathCG::create disappears.\n\nTherefore cache the geometry as a Path on the clipper, flushed via a new clearCachesForLayout()\nhook on RenderSVGResourceContainer, called from layout(). Only a relayout of the clip subtree\ncan change the clip geometry. Split computeClipPath() into computeClipPathGeometry() (cacheable) and\ncomputeClipContentTransform(): the content transform is recomputed live every frame rather\nthan cached, because it can animate via the SVG/CSS transform fast path, which repaints the\nclipper's clients without relaying out the \u003cclipPath\u003e.\n\nTest: svg/clip-path/clip-path-child-transform-change.html\n\n* LayoutTests/svg/clip-path/clip-path-child-transform-change-expected.html: Added.\n* LayoutTests/svg/clip-path/clip-path-child-transform-change.html: Added.\n* Source/WebCore/rendering/svg/RenderSVGModelObject.cpp:\n(WebCore::RenderSVGModelObject::computeClipContentTransform const):\n(WebCore::RenderSVGModelObject::computeClipPathGeometry const):\n(WebCore::RenderSVGModelObject::computeClipPath const): Deleted.\n* Source/WebCore/rendering/svg/RenderSVGModelObject.h:\n* Source/WebCore/rendering/svg/RenderSVGResourceClipper.cpp:\n(WebCore::RenderSVGResourceClipper::applyPathClipping):\n(WebCore::RenderSVGResourceClipper::clearCacheBeforeLayout):\n* Source/WebCore/rendering/svg/RenderSVGResourceClipper.h:\n* Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp:\n(WebCore::RenderSVGResourceContainer::layout):\n* Source/WebCore/rendering/svg/RenderSVGResourceContainer.h:\n(WebCore::RenderSVGResourceContainer::clearCacheBeforeLayout):\n\nCanonical link: https://commits.webkit.org/317143@main",
      "email": "nzimmermann@igalia.com",
      "hash": "6574b387998abad57a67aa53491eef8ab2bc384c",
      "subject": "[LBSE] Cache the clip-path geometry instead of rebuilding it per clipped shape per frame"
    },
    "317144@main": {
      "author": "Mike Wyrzykowski",
      "avatar": "https://www.gravatar.com/avatar/4b1bc9e238714f95e22d5d2454c07066?d=identicon\u0026s=64",
      "cl": "317144@main",
      "clUrl": "https://commits.webkit.org/317144@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319261\nrdar://182108828\n\nReviewed by Tadeu Zagallo.\n\nTreat VMs are fully qualified as other devices for WebGPU.\n\n* Source/WebGPU/WebGPU/HardwareCapabilities.mm:\n(WebGPU::isPhysicalHardware):\n\nCanonical link: https://commits.webkit.org/317144@main",
      "email": "mwyrzykowski@apple.com",
      "hash": "53351731e18b3aa983e69f2c607547da9515decd",
      "subject": "Default WebGPU to enabled on VMs"
    },
    "317145@main": {
      "author": "Mike Wyrzykowski",
      "avatar": "https://www.gravatar.com/avatar/4b1bc9e238714f95e22d5d2454c07066?d=identicon\u0026s=64",
      "cl": "317145@main",
      "clUrl": "https://commits.webkit.org/317145@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=295343\nrdar://154874391\n\nReviewed by Dan Glastonbury.\n\nImplement subgroups and related builtins as specified in the WGSL specification.\n\nTest: uniformity.html\n\n* LayoutTests/http/tests/webgpu/webgpu/shader/validation/uniformity/uniformity-expected.txt:\n* Source/WebCore/Modules/WebGPU/GPUAdapter.cpp:\n(WebCore::GPUAdapter::GPUAdapter):\n(WebCore::convertFeatureNameToEnum):\n(WebCore::GPUAdapter::requestDevice):\n* Source/WebCore/Modules/WebGPU/GPUAdapterInfo.h:\n(WebCore::GPUAdapterInfo::create):\n(WebCore::GPUAdapterInfo::subgroupMinSize const):\n(WebCore::GPUAdapterInfo::subgroupMaxSize const):\n(WebCore::GPUAdapterInfo::GPUAdapterInfo):\n* Source/WebCore/Modules/WebGPU/GPUAdapterInfo.idl:\n* Source/WebCore/Modules/WebGPU/GPUFeatureName.h:\n(WebCore::convertToBacking):\n* Source/WebCore/Modules/WebGPU/GPUFeatureName.idl:\n* Source/WebCore/Modules/WebGPU/Implementation/WebGPUAdapterImpl.cpp:\n(WebCore::WebGPU::subgroupMinSize):\n(WebCore::WebGPU::subgroupMaxSize):\n(WebCore::WebGPU::AdapterImpl::AdapterImpl):\n* Source/WebCore/Modules/WebGPU/Implementation/WebGPUConvertToBackingContext.cpp:\n(WebCore::WebGPU::ConvertToBackingContext::convertToBacking):\n* Source/WebCore/Modules/WebGPU/InternalAPI/WebGPUAdapter.h:\n(WebCore::WebGPU::Adapter::subgroupMinSize const):\n(WebCore::WebGPU::Adapter::subgroupMaxSize const):\n(WebCore::WebGPU::Adapter::Adapter):\n* Source/WebCore/Modules/WebGPU/InternalAPI/WebGPUFeatureName.h:\n* Source/WebCore/Modules/WebGPU/WGSLLanguageFeatures.cpp:\n(WebCore::WGSLLanguageFeatures::initializeSetLike const):\n* Source/WebGPU/WGSL/ConstantFunctions.h:\n(WGSL::VALIDATION_FUNCTION):\n* Source/WebGPU/WGSL/Constraints.h:\n* Source/WebGPU/WGSL/IOValidator.cpp:\n(WGSL::IOValidator::validateBuiltinIO):\n* Source/WebGPU/WGSL/Metal/MetalFunctionWriter.cpp:\n(WGSL::Metal::FunctionDefinitionWriter::visit):\n(WGSL::Metal::emitSubgroupBallot):\n(WGSL::Metal::emitQuadSwap):\n(WGSL::Metal::emitQuadSwapDiagonal):\n(WGSL::Metal::emitQuadSwapX):\n(WGSL::Metal::emitQuadSwapY):\n* Source/WebGPU/WGSL/Parser.cpp:\n(WGSL::Parser\u003cLexer\u003e::parseEnableDirective):\n(WGSL::Parser\u003cLexer\u003e::parseRequireDirective):\n* Source/WebGPU/WGSL/TypeCheck.cpp:\n(WGSL::TypeChecker::visit):\n* Source/WebGPU/WGSL/TypeDeclarations.rb:\n* Source/WebGPU/WGSL/UniformityAnalysis.cpp:\n* Source/WebGPU/WGSL/WGSL.cpp:\n(WGSL::wgslExtensionToWebGPUFeatureName):\n* Source/WebGPU/WGSL/WGSLEnums.h:\n* Source/WebGPU/WGSL/WGSLShaderModule.h:\n(WGSL::ShaderModule::requiredFeatures): Deleted.\n* Source/WebGPU/WGSL/generator/main.rb:\n* Source/WebGPU/WGSL/wgslc.cpp:\n(runWGSL):\n* Source/WebGPU/WebGPU/Adapter.mm:\n(WebGPU::Adapter::getProperties):\n* Source/WebGPU/WebGPU/HardwareCapabilities.mm:\n(WebGPU::baseFeatures):\n* Source/WebGPU/WebGPU/RenderPipeline.mm:\n(WebGPU::errorValidatingInterstageShaderInterfaces):\n* Source/WebGPU/WebGPU/ShaderModule.h:\n* Source/WebGPU/WebGPU/ShaderModule.mm:\n(WebGPU::ShaderModule::usesSubgroupInvocationIdInInput const):\n(WebGPU::ShaderModule::usesSubgroupSizeInInput const):\n(WebGPU::ShaderModule::populateFragmentInputs):\n(wgpuAdapterFeatureName):\n* Source/WebGPU/WebGPU/WebGPU.h:\n* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteGPU.cpp:\n(WebKit::RemoteGPU::requestAdapter):\n* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteGPURequestAdapterResponse.h:\n* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteGPURequestAdapterResponse.serialization.in:\n* Source/WebKit/Shared/WebGPU/WebGPUFeatureName.serialization.in:\n* Source/WebKit/WebProcess/GPU/graphics/WebGPU/RemoteAdapterProxy.cpp:\n(WebKit::WebGPU::RemoteAdapterProxy::RemoteAdapterProxy):\n* Source/WebKit/WebProcess/GPU/graphics/WebGPU/RemoteAdapterProxy.h:\n* Source/WebKit/WebProcess/GPU/graphics/WebGPU/RemoteGPUProxy.cpp:\n(WebKit::RemoteGPUProxy::requestAdapter):\n\nCanonical link: https://commits.webkit.org/317145@main",
      "email": "mwyrzykowski@apple.com",
      "hash": "ab0a2da91f2a99faf20e88c51b33b2c064a75a12",
      "subject": "[WebGPU] Subgroups"
    },
    "317146@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "317146@main",
      "clUrl": "https://commits.webkit.org/317146@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319367\n\nReviewed by Tadeu Zagallo.\n\nFunctionNode::emitBytecode only recognized an explicit trailing return when\nthe function body was a single BlockNode ending with a ReturnNode. An arrow\nfunction expression body is parsed as a bare ReturnNode without a wrapping\nblock, so it was not recognized and we emitted an unreachable `ret undefined`\n(plus a constant table entry for `undefined`) after the real return.\n\nThis change also accepts a bare ReturnNode as the function's single statement,\nso the implicit return is skipped when the body already ends with one.\n\nFor example, `() =\u003e 1` shrinks from 3 instructions / 5 bytes (enter, ret,\nunreachable ret) to 2 instructions / 3 bytes (enter, ret), and drops the\nnow-unused `undefined` constant. This applies to every expression-body arrow\nfunction, which minifiers emit pervasively.\n\n* Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:\n(JSC::FunctionNode::emitBytecode):\n\nCanonical link: https://commits.webkit.org/317146@main",
      "email": "sosuke@bun.sh",
      "hash": "1994bc0cc3e2c0f4389ba0a29df813e1b34374d7",
      "subject": "[JSC] Do not emit unreachable implicit return for arrow function expression bodies"
    },
    "317147@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "317147@main",
      "clUrl": "https://commits.webkit.org/317147@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319363\n\nReviewed by Keith Miller.\n\nUnlike the baseline JIT, the LLInt's generic branches of op_iterator_next and\nop_async_iterator_next do not record IterationMode::Generic, so the DFG sees\nseenModes == 0 for LLInt-only generic sites and plants ForceOSRExit there.\nRecord the Generic bit in the LLInt generic branches, matching the baseline JIT.\nThis removes the OSR exit + recompile cycle for such sites.\n\n* Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm:\n* Source/JavaScriptCore/llint/LowLevelInterpreter64.asm:\n\nCanonical link: https://commits.webkit.org/317147@main",
      "email": "sosuke@bun.sh",
      "hash": "c0e48d007a10a46cdffaf60b81fd90cf8c287357",
      "subject": "[JSC] LLInt should record `IterationMode::Generic` in `op_iterator_next` and `op_async_iterator_next`"
    },
    "317148@main": {
      "author": "Fady Farag",
      "avatar": "https://www.gravatar.com/avatar/0ac5127c69f90d0c57054173ae4c3108?d=identicon\u0026s=64",
      "cl": "317148@main",
      "clUrl": "https://commits.webkit.org/317148@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319329\nrdar://182145798\n\nReviewed by Keith Miller.\n\nThis lets the compiler see the constant values for better optimization.\n\n* Source/JavaScriptCore/b3/B3Common.cpp:\n* Source/JavaScriptCore/b3/B3Common.h:\n* Source/JavaScriptCore/b3/air/AirCode.cpp:\n* Source/JavaScriptCore/b3/air/AirCode.h:\n* Source/JavaScriptCore/dfg/DFGCommon.cpp:\n* Source/JavaScriptCore/dfg/DFGCommon.h:\n* Source/JavaScriptCore/ftl/FTLCompile.cpp:\n* Source/JavaScriptCore/ftl/FTLCompile.h:\n* Source/JavaScriptCore/runtime/ArrayPrototype.cpp:\n(): Deleted.\n* Source/JavaScriptCore/runtime/ArrayPrototype.h:\n* Source/JavaScriptCore/runtime/JSCJSValue.cpp:\n* Source/JavaScriptCore/runtime/NumberPrototype.cpp:\n(JSC::int52ToStringWithRadix):\n(JSC::toStringWithRadixInternal):\n* Source/JavaScriptCore/runtime/ParseInt.h:\n* Source/JavaScriptCore/runtime/TemporalObject.cpp:\n* Source/JavaScriptCore/runtime/temporal/core/TemporalEnums.h:\n(JSC::WTF::toArray\u003cTemporalUnit\u003e):\n\nCanonical link: https://commits.webkit.org/317148@main",
      "email": "com.webkit.iidmsa@gmail.com",
      "hash": "2bd239bf12a80e3451870af6cd495d8c3715f4f9",
      "subject": "Use C++17 `inline constexpr` variables instead of `extern const` in JavaScriptCore"
    },
    "317149@main": {
      "author": "Carlos Garcia Campos",
      "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64",
      "cl": "317149@main",
      "clUrl": "https://commits.webkit.org/317149@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319083\n\nReviewed by Alejandro G. Castro.\n\nThe Skia compositor imported the shared scanout dma-buf as a\nGL_TEXTURE_2D and wrapped it in a Skia texture surface\n(SkSurfaces::WrapBackendTexture), so the frame was rendered into a\nsampleable texture. The web process never samples this buffer. Import it\nas a GL renderbuffer and render into it with a wrapped backend render\ntarget (SkSurfaces::WrapBackendRenderTarget) instead. This matches the\nTextureMapper compositor and keeps the scanout buffer a pure render\ntarget, so drivers might optimize for the fact that it is not sampleable.\n\nRenderTargetShareableBuffer owns the framebuffer and its depth and\nstencil buffer. They are now created always in the constructor when the\nsurface is using GL. The skia surface is now created in initializeColorBuffer()\nthat receives an optional EGLImage so that it can be shared with SHM\ntargets. It leaves the Skia surface unset when the framebuffer is not\ncomplete, so a broken buffer is skipped instead of rendered into.\ncreateSkiaSurfaceForTexture() has been replaced by createSkiaSurfaceForFramebuffer().\n\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/AcceleratedSurface.cpp:\n(WebKit::AcceleratedSurface::RenderTarget::RenderTarget):\n(WebKit::AcceleratedSurface::RenderTarget::createSkiaSurfaceForFramebuffer):\n(WebKit::AcceleratedSurface::RenderTargetShareableBuffer::RenderTargetShareableBuffer):\n(WebKit::AcceleratedSurface::RenderTargetShareableBuffer::~RenderTargetShareableBuffer):\n(WebKit::AcceleratedSurface::RenderTargetShareableBuffer::initializeColorBuffer):\n(WebKit::AcceleratedSurface::RenderTargetEGLImage::RenderTargetEGLImage):\n(WebKit::AcceleratedSurface::RenderTargetEGLImage::~RenderTargetEGLImage):\n(WebKit::AcceleratedSurface::RenderTargetSHMImage::RenderTargetSHMImage):\n(WebKit::AcceleratedSurface::RenderTargetTexture::RenderTargetTexture):\n(WebKit::AcceleratedSurface::RenderTargetWPEBackend::RenderTargetWPEBackend):\n(WebKit::AcceleratedSurface::RenderTargetWPEBackend::willRenderFrame):\n(WebKit::AcceleratedSurface::RenderTarget::createSkiaSurfaceForTexture): Deleted.\n(WebKit::AcceleratedSurface::RenderTargetEGLImage::initializeColorBuffer): Deleted.\n(WebKit::AcceleratedSurface::RenderTargetSHMImage::~RenderTargetSHMImage): Deleted.\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/AcceleratedSurface.h:\n\nCo-authored-by: Nikolas Zimmermann \u003cnzimmermann@igalia.com\u003e\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/ThreadedCompositor.cpp:\n(WebKit::m_renderTimer):\n\nCanonical link: https://commits.webkit.org/317149@main",
      "email": "cgarcia@igalia.com",
      "hash": "441a3adb238e19682d95df52241bf97e9971ecba",
      "subject": "[GTK][WPE][Skia] Render the compositor output into a renderbuffer instead of a texture"
    },
    "317150@main": {
      "author": "Wenson Hsieh",
      "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64",
      "cl": "317150@main",
      "clUrl": "https://commits.webkit.org/317150@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319290\nrdar://182129589\n\nReviewed by Abrar Rahman Protyasha.\n\nOn macOS only, we failed to pass the frame ID where pasteboard access was requested when calling\ninto `grantAccessToCurrentPasteboardData`; this causes pastes to fail with `NotAllowedError`, even\nafter the user selects 'Paste' in the programmatic paste menu.\n\nFix this by taking `requestFrame` from the `m_domPasteState`, and passing it in.\n\nTest: SiteIsolation.DOMPasteAccessGrantedInCrossOriginFrame\n\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::handleDOMPasteRequestForCategoryWithResult):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, DOMPasteAccessGrantedInCrossOriginFrame)):\n\nCanonical link: https://commits.webkit.org/317150@main",
      "email": "wenson_hsieh@apple.com",
      "hash": "aacd4aca2a766c8ab056f0ebab3acd4fe3051e5f",
      "subject": "[Site Isolation] [macOS] DOM paste access fails to actually allow pasteboard access in cross-origin subframes"
    },
    "317151@main": {
      "author": "Dan Hecht",
      "avatar": "https://www.gravatar.com/avatar/080f47d912b1b34d0be8293f825d132d?d=identicon\u0026s=64",
      "cl": "317151@main",
      "clUrl": "https://commits.webkit.org/317151@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319338\nrdar://182153719\n\nReviewed by Yusuke Suzuki.\n\nAllocating a sub-range from a free region splits it (pas_large_free_split),\nwhich must copy the region's zero_mode to both leftover halves and to the\nallocation result. Add testSplitPreservesZeroMode (region seeded via\ndeallocate) and testSplitPreservesZeroModeFromSource (region returned fresh\nby the memory source, also exercising the aligned-allocation zero_mode\npath), each asserting both leftovers and the result keep the seed mode,\nfor is_all_zero and may_have_non_zero, on the simple and fast heaps.\n\nTest: Source/bmalloc/libpas/src/test/LargeFreeHeapTests.cpp\n\n* Source/bmalloc/libpas/src/test/LargeFreeHeapTests.cpp:\n(std::testSplitPreservesZeroMode):\n(std::testSplitPreservesZeroModeFromSource):\n(addLargeFreeHeapTests):\n\nCanonical link: https://commits.webkit.org/317151@main",
      "email": "dan.hecht@apple.com",
      "hash": "d720aa247974bae1aab08eeb7951115b32da5c36",
      "subject": "[libpas] Test zero_mode split preservation in LargeFreeHeapTests"
    },
    "317152@main": {
      "author": "Sam Weinig",
      "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64",
      "cl": "317152@main",
      "clUrl": "https://commits.webkit.org/317152@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319277\n\nReviewed by Alan Baradlay.\n\nAdds a new unzoomedLengthIfEvaluationTimeZoomEnabled helper and adopts it.\n\n* Source/WebCore/style/StyleExtractorCustom.h:\n* Source/WebCore/svg/SVGLengthContext.h:\n\nCanonical link: https://commits.webkit.org/317152@main",
      "email": "sam@webkit.org",
      "hash": "d197cc3e7f9f05584f59ca881256002c0ab41994",
      "subject": "[EvaluationTimeZoom] Convert remaining style extractor uses to use unzoomed lengths"
    },
    "317153@main": {
      "author": "Jer Noble",
      "avatar": "https://www.gravatar.com/avatar/6d2cde9be23b98223ca964cb3b7813a0?d=identicon\u0026s=64",
      "cl": "317153@main",
      "clUrl": "https://commits.webkit.org/317153@main",
      "description": "rdar://181539181\nhttps://bugs.webkit.org/show_bug.cgi?id=318924\n\nReviewed by Ryosuke Niwa.\n\nRestore the behavior of the previous ASSERT by adding a new method,\ncanCurrentThreadIDAccessThreadLocalData(), which has similar behavior to the existing\ncanCurrentThreadAccessThreadLocalData() method, which can be implemented in terms of the\ncanCurrentThreadIDAccessThreadLocalData() method. Partially revert the changes to Timer and\nActiveDOMObject by re-adopting the ID-based version of canCurrentThreadAccessThreadLocalData().\n\n* Source/WTF/wtf/MainThread.cpp:\n(WTF::canCurrentThreadIDAccessThreadLocalData):\n* Source/WTF/wtf/MainThread.h:\n* Source/WTF/wtf/cocoa/MainThreadCocoa.mm:\n(WTF::initializeApplicationUIThread):\n(WTF::initializeWebThread):\n(WTF::canCurrentThreadAccessThreadLocalData):\n(WTF::canCurrentThreadIDAccessThreadLocalData):\n* Source/WebCore/dom/ActiveDOMObject.cpp:\n(WebCore::ActiveDOMObject::~ActiveDOMObject):\n* Source/WebCore/platform/Supplementable.h:\n(WebCore::Supplementable::provideSupplement):\n(WebCore::Supplementable::requireSupplement):\n* Source/WebCore/platform/Timer.cpp:\n(WebCore::TimerBase::~TimerBase):\n(WebCore::TimerBase::start):\n(WebCore::TimerBase::stopSlowCase):\n(WebCore::TimerBase::setNextFireTime):\n(WebCore::TimerBase::canAccessOnCurrentThread const): Deleted.\n* Source/WebCore/platform/Timer.h:\n(WebCore::TimerBase::isActive const):\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/317153@main",
      "email": "jer.noble@apple.com",
      "hash": "702cd85ba0a2e9acaaf2dc8a73b645f36428f198",
      "subject": "REGRESSION(312759@main): Multiple TestWebKitAPI.WebKitLegacy.* fail with debug assert"
    },
    "317154@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317154@main",
      "clUrl": "https://commits.webkit.org/317154@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319353\nrdar://182164511\n\nReviewed by Devin Rousso.\n\nTwo boundary bugs in Table:\n\n- `_isRowVisible` compared against `_visibleRowIndexEnd` with `\u003c=`, but that\n  index is an exclusive bound everywhere else (rows are created only for\n  `i \u003c _visibleRowIndexEnd`), so it reported one non-rendered row as visible.\n  `cellForRowAndColumn` would then pass the visibility gate and return a cache\n  miss (or a stale row). Use `\u003c`.\n\n- `_indexToInsertColumn` dereferenced `_visibleColumns[currentVisibleColumnIndex]`\n  without a bounds check. `showColumn` calls it before inserting the column, so\n  when the shown column is about to become the only visible one (empty\n  `_visibleColumns`) and it isn't first in `_columnOrder`, the deref threw\n  `undefined is not an object`. Guard the index against `_visibleColumns.length`.\n\n* Source/WebInspectorUI/UserInterface/Views/Table.js:\n(WI.Table.prototype._isRowVisible):\n(WI.Table.prototype._indexToInsertColumn):\n* LayoutTests/inspector/table/table-column-and-row-boundaries-expected.txt: Added.\n* LayoutTests/inspector/table/table-column-and-row-boundaries.html: Added.\n\nCanonical link: https://commits.webkit.org/317154@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "5e9140c0c7ed63b49ac8cbbee2ee8f392adf024c",
      "subject": "Web Inspector: Table._isRowVisible off-by-one and showColumn throws when the shown column is the only visible column"
    },
    "317155@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317155@main",
      "clUrl": "https://commits.webkit.org/317155@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319366\nrdar://182171465\n\nReviewed by Devin Rousso.\n\nWI.HARBuilder.port() guarded its \"no port present\" case with `if (!index)`\nafter `remoteAddress.lastIndexOf(\":\")`. That guard only fires when the colon\nis at index 0 (a leading-colon address); it never fires for the not-found\ncase, because lastIndexOf() returns -1, which is truthy. As a result, an\naddress with no trailing \":port\" fell through to substring(-1 + 1) ==\nsubstring(0) and parsed the entire string, e.g. parseInt(\"12.34.56.78\")\nyields 12, so the HAR entry recorded a nonsensical serverPort.\n\nFix the guard to test `index === -1` so an address without a port correctly\nreturns undefined.\n\nTest: http/tests/inspector/network/har/har-remote-address-port.html\n\n* Source/WebInspectorUI/UserInterface/Controllers/HARBuilder.js:\n(WI.HARBuilder.port):\n* LayoutTests/http/tests/inspector/network/har/har-remote-address-port.html: Added.\n* LayoutTests/http/tests/inspector/network/har/har-remote-address-port-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/317155@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "a26f36bbc1ecbb91308959a32095b57bc33ed265",
      "subject": "Web Inspector: HAR export reports a bogus port for remote addresses that have no port"
    },
    "317156@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317156@main",
      "clUrl": "https://commits.webkit.org/317156@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319347\nrdar://182161230\n\nReviewed by Devin Rousso.\n\nHeapSnapshot.updateDeadNodesAndGatherCollectionData() walked\npreviousSnapshot._nodes but strided by this._nodeFieldCount, the current\nsnapshot's field count. _nodeFieldCount is per-instance (4 for an\n\"Inspector\" snapshot, 7 for a \"GCDebugging\" one), so when the two\nsnapshots had different layouts the loop read node identifiers from\nmisaligned offsets and produced a garbage collected-nodes set.\n\nStride the previous snapshot's node list by its own field count instead.\n\nTest: inspector/heap/collection-diff-across-node-layouts.html\n\n* LayoutTests/inspector/heap/collection-diff-across-node-layouts-expected.txt: Added.\n* LayoutTests/inspector/heap/collection-diff-across-node-layouts.html: Added.\n* Source/WebInspectorUI/UserInterface/Workers/HeapSnapshot/HeapSnapshot.js:\n(HeapSnapshot.prototype.updateDeadNodesAndGatherCollectionData):\n\nCanonical link: https://commits.webkit.org/317156@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "bdd8ad2d8ad91441e12753da6dbb79c487de1b15",
      "subject": "[Web Inspector] Heap snapshot collection diff strides previous snapshot by wrong node field count"
    },
    "317157@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317157@main",
      "clUrl": "https://commits.webkit.org/317157@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319365\nrdar://182171240\n\nReviewed by Devin Rousso.\n\nHTMLTreeBuilderFormatter.TagNamesWithoutChildren lists the HTML void\nelements: tags that can never have children, so the tree builder does\nnot push them onto the stack of open elements. \"canvas\" was included in\nthis set since the formatter was first added, but \u003ccanvas\u003e is not a void\nelement -- it has a transparent content model and legitimately contains\nfallback content (e.g. \u003cp\u003e or \u003ca\u003e shown when canvas is unsupported).\n\nBecause \"canvas\" was in the set, _isEmptyNode() returned true for it, so\nits fallback content was attached as siblings instead of children and\nits closing tag went unmatched. Pretty-printing HTML that used canvas\nfallback content therefore produced incorrectly-nested, non-indented\noutput.\n\nRemove \"canvas\" from TagNamesWithoutChildren so it is treated as a\nnormal container element.\n\n* LayoutTests/inspector/formatting/formatting-html-expected.txt:\n* LayoutTests/inspector/formatting/formatting-html.html:\n* LayoutTests/inspector/formatting/resources/html-tests/canvas-expected.html: Added.\n* LayoutTests/inspector/formatting/resources/html-tests/canvas.html: Added.\n* Source/WebInspectorUI/UserInterface/Workers/Formatter/HTMLTreeBuilderFormatter.js:\n\nCanonical link: https://commits.webkit.org/317157@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "2e738f0fc7c762980cc151c3263d46208924e6a4",
      "subject": "Web Inspector: HTML pretty-printer mis-nests \u003ccanvas\u003e fallback content because \"canvas\" is wrongly treated as a void element"
    },
    "317158@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "317158@main",
      "clUrl": "https://commits.webkit.org/317158@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319295\n\nReviewed by Anne van Kesteren.\n\nThe failure was caused by usesNullCustomElementRegistry not getting propagated to a node during\nfragment parsing because the tree scope of a node during a fragment parsing is document, which\ndoes not have usesNullCustomElementRegistry flag set like its context element. Propagate the flag\nfrom the context element to the document fragment we use for parsing to fix the bug.\n\nAlso add a test case for constructing an element using setHTMLUnsafe inside a declarative shadow DOM\nwith null custom element registry, which was not tested by any existing test cases.\n\nTests: imported/w3c/web-platform-tests/custom-elements/registries/CustomElementRegistry-initialize.html\n       imported/w3c/web-platform-tests/custom-elements/registries/ShadowRoot-init-declarative.html\n\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/registries/CustomElementRegistry-initialize-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/registries/Element-innerHTML-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/registries/ShadowRoot-init-declarative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/registries/ShadowRoot-init-declarative.html:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/registries/scoped-custom-element-registry-customelementregistry-attribute-expected.txt:\n* Source/WebCore/dom/DocumentFragment.cpp:\n(WebCore::DocumentFragment::parseHTML):\n* Source/WebCore/dom/Element.cpp:\n(WebCore::Element::replaceChildrenWithMarkup):\n(WebCore::Element::setOuterHTML):\n(WebCore::Element::insertAdjacentHTML):\n* Source/WebCore/dom/ShadowRoot.cpp:\n(WebCore::ShadowRoot::replaceChildrenWithMarkup):\n* Source/WebCore/editing/markup.cpp:\n(WebCore::createFragmentForMarkup):\n(WebCore::createFragmentForInnerOuterHTML):\n(WebCore::createContextualFragment):\n* Source/WebCore/editing/markup.h:\n* Source/WebCore/html/parser/HTMLConstructionSite.cpp:\n(WebCore::HTMLConstructionSite::containerForCurrentNode):\n(WebCore::HTMLConstructionSite::createHTMLElementOrFindCustomElementInterface):\n* Source/WebCore/html/parser/HTMLConstructionSite.h:\n\nCanonical link: https://commits.webkit.org/317158@main",
      "email": "rniwa@webkit.org",
      "hash": "4700ae410c741d6fa2d1656ded65e85bbfe34ca8",
      "subject": "The last test case in custom-elements/registries/CustomElementRegistry-initialize.html fails"
    },
    "317159@main": {
      "author": "Jean-Yves Avenard",
      "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64",
      "cl": "317159@main",
      "clUrl": "https://commits.webkit.org/317159@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319271\nrdar://179910591\n\nReviewed by Jer Noble.\n\nSpotify start several audio elements at once when navigating within the page\n(e.g. returning to a landing view). Each play() is authorized by the transient\nuser activation produced by the navigation click: that activation is\ndocument-scoped and stays valid for several seconds, so every play() issued\nduring the window is permitted no matter how many elements are involved. The\nresult is several tracks playing on top of each other.\n\nAdd a site quirk, ShouldBlockAudiblePlaybackWhileAudioIsPlaying, that denies an\naudible element from starting while another element in the same document is\nalready playing audio, unless a user gesture is being directly processed (so\ndeliberately choosing a track is unaffected). Enable it for open.spotify.com.\n\nTo distinguish a directly-processed gesture from transient activation, add\nDocument::mediaUserGestureReason(), reporting which branch of\nprocessingUserGestureForMedia() authorized playback; the latter is refactored to\nuse it and is otherwise unchanged.\n\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::processingUserGestureForMedia const):\n(WebCore::Document::mediaUserGestureReason const):\n* Source/WebCore/dom/Document.h:\n* Source/WebCore/html/MediaElementSession.cpp:\n(WebCore::mediaGestureReasonString):\n(WebCore::MediaElementSession::playbackStateChangePermitted const):\n* Source/WebCore/page/Quirks.cpp:\n(WebCore::Quirks::shouldBlockAudiblePlaybackWhileAudioIsPlaying const):\n(WebCore::handleSpotifyQuirks):\n* Source/WebCore/page/Quirks.h:\n* Source/WebCore/page/QuirksData.h:\n\nCanonical link: https://commits.webkit.org/317159@main",
      "email": "jya@apple.com",
      "hash": "0aac2890d97a1df4cdd532d02b415d4f7cadc7f6",
      "subject": "open.spotify.com: returning to Home auto-plays multiple song previews / overlapping audio in Safari"
    },
    "317160@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317160@main",
      "clUrl": "https://commits.webkit.org/317160@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319238\nrdar://182085034\n\nReviewed by Chris Dumez.\n\nNotificationData::direction had no default member initializer, so when\nNotificationPayload::toNotificationData() runs with no options, it stays\nindeterminate and is then serialized over IPC (undefined behavior, and\npossibly an out-of-range NotificationDirection).\n\nInitialize it explicitly to NotificationDirection::Auto, and drop the\nredundant WebCore:: qualifier since the struct is already in the WebCore\nnamespace.\n\nSince the initializer now references the NotificationDirection::Auto\nenumerator, the enum can no longer be an incomplete forward declaration.\nInclude \u003cWebCore/NotificationDirection.h\u003e and remove the forward\ndeclaration so the enumerator is visible.\n\n* Source/WebCore/Modules/notifications/NotificationData.h:\n\nCanonical link: https://commits.webkit.org/317160@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "5fc32e9843cb1070e514c2d27ce40142269c169d",
      "subject": "NotificationData::direction is serialized uninitialized when a NotificationPayload has no options"
    },
    "317161@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317161@main",
      "clUrl": "https://commits.webkit.org/317161@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319362\nrdar://182169640\n\nReviewed by Devin Rousso.\n\nWI.BoxShadow.parseNumberComponent() split a length component into value and\nunit by calling `string.replace(value, \"\")`, passing the parsed Number as the\nsearch argument. String.prototype.replace coerces that Number to a string via\nString(value) and removes only the first literal occurrence, so it only worked\nwhen String(parseFloat(s)) reproduced the exact numeric prefix of the source\ntext. It did not for several valid CSS length forms:\n\n- \"1.50px\": String(1.5) is \"1.5\", so \"1.5\" was stripped leaving \"0px\", which\n  is not a valid unit, so the whole box-shadow failed to parse.\n- \"1e2px\": String(100) is \"100\", which is not a substring of \"1e2px\", so the\n  number was left in place leaving unit \"1e2px\".\n- \".5px\": String(0.5) is \"0.5\", which is not a substring of \".5px\".\n\nStrip the leading number positionally with a regular expression instead, so the\nremaining text is always the unit regardless of how the number is spelled. The\nexponent group requires a trailing digit, so units that begin with \"e\" (em, ex)\nare preserved rather than mistaken for scientific notation.\n\nWhile here, also fix two related issues at the same time:\n\n- Non-finite values: a literal that overflows to Infinity (e.g. \"1e400px\")\n  passed the previous isNaN() guard and, with the regex now yielding a valid\n  \"px\" unit, would serialize as \"Infinitypx\". Guard with isFinite() so NaN,\n  Infinity, and -Infinity are all rejected.\n\n- Case-insensitive units: CSS units are case-insensitive, but the unit was\n  matched against a lowercase Set, so \"1PX\" was rejected. Lowercase the unit\n  before the membership check, which also canonicalizes serialization.\n\n* LayoutTests/inspector/model/boxShadow-expected.txt:\n* LayoutTests/inspector/model/boxShadow.html:\n* Source/WebInspectorUI/UserInterface/Models/BoxShadow.js:\n(WI.BoxShadow.parseNumberComponent):\n\nCanonical link: https://commits.webkit.org/317161@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "5958b2c58e6a3bc0fe998a100be1e03d8d7e75bb",
      "subject": "Web Inspector: BoxShadow fails to parse valid lengths like \"1.50px\", \"1e2px\", and uppercase units"
    },
    "317162@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "317162@main",
      "clUrl": "https://commits.webkit.org/317162@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319332\nrdar://182148177\n\nReviewed by Sosuke Suzuki.\n\nThis patch moves TypedArray.of from builtin JS to C++.\nThis is trivially convertible as it is not involving callbacks etc.\nWe have a fast path for normal TypedArray constructors and we store\narguments quickly by using type-specialized path.\n\n* Source/JavaScriptCore/builtins/TypedArrayConstructor.js:\n(of): Deleted.\n* Source/JavaScriptCore/runtime/JSGlobalObject.h:\n* Source/JavaScriptCore/runtime/JSGlobalObjectInlines.h:\n(JSC::JSGlobalObject::typedArrayConstructorConcurrently const):\n* Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp:\n(JSC::JSTypedArrayViewConstructor::finishCreation):\n(JSC::typedArrayOfSetElements):\n(JSC::typedArrayOfFast):\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n\nCanonical link: https://commits.webkit.org/317162@main",
      "email": "ysuzuki@apple.com",
      "hash": "d4e7e6dacaa86556d56b6ae87a39479d9c126e0e",
      "subject": "[JSC] Move TypedArray.of from builtin JS to C++"
    },
    "317163@main": {
      "author": "Franco Vieira de Souza",
      "avatar": "https://www.gravatar.com/avatar/14ed77684c1591a07649be8495cc0ddb?d=identicon\u0026s=64",
      "cl": "317163@main",
      "clUrl": "https://commits.webkit.org/317163@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318695\nrdar://181510590\n\nReviewed by Sihui Liu.\n\nEnsure `window.sessionStorage` is cleared between test iterations by\nadding WebKit::WebsiteDataType::SessionStorage to the data types in\nWKWebsiteDataStoreClearStorage().\n\nThe previous workaround, clearSessionStorage.js, is now unnecessary and\nwas removed. One test, however, included it as a random script to be\nblocked for policy reasons (sessionstorage/blocked-file-access.html).\nFor that, a new script, `should-not-be-allowed-to-load.js`, was\nintroduced.\n\nChange: Source/WebKit/UIProcess/API/C/WKWebsiteDataStoreRef.cpp:\n(WKWebsiteDataStoreClearStorage):\n\nTest added: LayoutTests/fast/harness/sessionstorage-cleared-between-iterations.html\n\nTest adjustment:\n* LayoutTests/storage/domstorage/sessionstorage/resources/clearSessionStorage.js: Removed.\n* LayoutTests/storage/domstorage/sessionstorage/resources/should-not-be-allowed-to-load.js: Added.\n* LayoutTests/storage/domstorage/sessionstorage/resources/blocked-example.html:\n* LayoutTests/storage/domstorage/sessionstorage/blocked-file-access-expected.txt:\n* LayoutTests/storage/domstorage/sessionstorage/delete-removal.html:\n* LayoutTests/storage/domstorage/sessionstorage/enumerate-storage.html:\n* LayoutTests/storage/domstorage/sessionstorage/enumerate-with-length-and-key.html:\n* LayoutTests/storage/domstorage/sessionstorage/index-get-and-set.html:\n* LayoutTests/storage/domstorage/sessionstorage/set-item-synchronous-keydown.html:\n* LayoutTests/storage/domstorage/sessionstorage/simple-usage.html:\n* LayoutTests/storage/domstorage/sessionstorage/string-conversion.html:\n* LayoutTests/storage/domstorage/sessionstorage/window-open.html:\n\nCanonical link: https://commits.webkit.org/317163@main",
      "email": "franco_vieira@apple.com",
      "hash": "7b52d17627d8cdcc2187e8b45c499967ec0ab611",
      "subject": "Clear sessionStorage between test iterations"
    },
    "317164@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "317164@main",
      "clUrl": "https://commits.webkit.org/317164@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318599\n\nReviewed by Antti Koivisto.\n\nperformFlexLayout kept each flex item's main-axis margin extent in a parallel array\n(marginsList) computed up front and threaded through the main-size pipeline. Snapshot it\nonto FlexLayoutItem instead, as the first of the geometry the core reads off the renderer.\n\nFlexLayoutItem gains a mainAxisMargin field, populated in collectFlexItems from the flow-aware\nmargin extent right after the item's flexBaseAndHypotheticalMainSize is computed. That timing\nmatters: an orthogonal flex item only resolves its physical margins when it is laid out for its\nflex base size, so the snapshot has to happen after that layout -- reading the margin at\nFlexLayoutItem construction would capture stale, pre-layout values and throw off margin-trim.\nThis is the same point the old marginsList was filled (after collectFlexItems returned). The\nfield is mutable because margin-trim reduces it during line collection, so\ntrimMainAxisMarginStart/End now take a FlexLayoutItem\u0026 and adjust the field. The margin-box\nhelpers (flexBaseMarginBoxSize, hypotheticalMainAxisMarginBoxSize, flexedMarginBoxSize) and\ncanFitItemWithTrimmedMarginEnd read the field, and the marginsList array plus the margin\nparameter to computeFlexLines, computeMainSizeForFlexItems, resolveFlexibleLengthsForLineItems,\nhandleMainAxisAlignment, and distributeMainAxisFreeSpaceForMultilineColumnIfNeeded are gone.\n\nNo change in behavior: the margin is computed the same way, snapshotted at the same point, and\nfollows the same trim. Covered by existing tests (e.g.\nimported/w3c/web-platform-tests/css/css-box/margin-trim/flex-row-orthogonal-item.html).\n\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n\nCanonical link: https://commits.webkit.org/317164@main",
      "email": "zalan@apple.com",
      "hash": "82fcfccdb7e29d4a1ab2de181d15d9067e33ad24",
      "subject": "[cleanup] Snapshot the flex item main-axis margin on FlexLayoutItem instead of a parallel array"
    },
    "317165@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "317165@main",
      "clUrl": "https://commits.webkit.org/317165@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319281\nrdar://182120327\n\nReviewed by Alan Baradlay.\n\nIn 317067@main we had RenderGrid store its resolved track listing as a\nspecific output of layout instead of trying to reverse engineer it from\nthe positions vector, gap sizes, etc.\n\nIn this patch we adopt the new behavior and make sure that any content\nthat runs through GFC can still report its resolved track listing\ncorrectly in the same way. This is done by just having the integration\nlogic set the value in the same way legacy grid layout does on the end\nof layout.\n\n* Source/WebCore/rendering/RenderGrid.cpp:\n(WebCore::RenderGrid::layoutGrid):\nNow that GFC also writes to the same structure we can have legacy grid\nlayout invalidate it even earlier.\n\nCanonical link: https://commits.webkit.org/317165@main",
      "email": "sammy.gill@apple.com",
      "hash": "0906e08508debe46c7e89f44a688675085c43eff",
      "subject": "[GFC][Integration] Resolved track listing should be properly reflected"
    },
    "317166@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "317166@main",
      "clUrl": "https://commits.webkit.org/317166@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319322\nrdar://182144347\n\nReviewed by Alan Baradlay.\n\nWhen computing the block min/max content contributions for a grid item,\nGFC will call into the respective integration function to to get this\nvalue. What these two end up doing is calling into layoutWithFormattingContextForBox\nin order to get that size. This function optionally takes in a width and\nheight constraint for the renderer that is sets as the overriding size\non it. Unfortunately, it does not clear the overriding height like it does\nwith the width so this can result in that size staying on the renderer\nafter the function returns. With respect to the described bug what ends\nup happening is:\n\nLayout frame 1:\n- Compute the block min/max contributions\n- Perform a final layout on the grid item which uses the same\n  integration API *and does pass an overriding width/height*\n\n** Some mutation occurs that causes us to do layout again **\n\nLayout frame 2:\n- Compute the block min/max contributions\nNow we have the wrong values because the overriding sizes were not\ncleared so we use those values again\n\nSo the fix is to clear the overriding block size because we do not want\nthese things living around longer than they need to.\n\nCanonical link: https://commits.webkit.org/317166@main",
      "email": "sammy.gill@apple.com",
      "hash": "b744c179aab45dc545771adfc4a10c5f44611830",
      "subject": "[GFC] Stale grid item block sizes on subsequent layout"
    },
    "317167@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317167@main",
      "clUrl": "https://commits.webkit.org/317167@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319374\nrdar://182178871\n\nReviewed by Devin Rousso.\n\nTyping a hyphen-prefixed CSS value such as `-apple-system` or `-webkit-flex`\nin the Elements \u003e Styles sidebar and then picking a completion produced a\nduplicated prefix like `-apple--apple-system`, which is invalid and gets\ndropped until the page is reloaded.\n\nThe CodeMirror CSS-mode tokenizer splits a hyphen-prefixed identifier in two\ndifferent ways: a value like `-name` becomes a bare `-` token followed by\n`name`, while a value like `-apple-system` becomes a `-apple-` meta token\nfollowed by `system`. `forPartialPropertyValue` only rejoined the preceding\ntoken when it was exactly `-`, so once the second hyphen was typed the prefix\nwas computed as just the trailing segment (`system`). Applying the completion\nthen removed only that segment and inserted the full value on top of the\nleftover `-apple-`, yielding `-apple--apple-system`.\n\nRejoin any hyphen-terminated preceding token (covering both the bare `-` and\nthe `-vendor-` meta token) so the whole identifier is used as the prefix.\n\n* Source/WebInspectorUI/UserInterface/Models/CSSKeywordCompletions.js:\n(WI.CSSKeywordCompletions.forPartialPropertyValue): Rejoin the preceding\ntoken when it ends with `-`, not only when it is exactly `-`.\n\n* LayoutTests/inspector/unit-tests/css-keyword-completions-expected.txt:\n* LayoutTests/inspector/unit-tests/css-keyword-completions.html:\n* Source/WebInspectorUI/UserInterface/Models/CSSKeywordCompletions.js:\n\nCanonical link: https://commits.webkit.org/317167@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "4460daca377eee69fecc02563f3ed7023fc57ef2",
      "subject": "Web Inspector: autocompleting a vendor/-apple- prefixed value in Styles duplicates the prefix (e.g. -apple--apple-system)"
    },
    "317168@main": {
      "author": "Josh Hernandez",
      "avatar": "https://www.gravatar.com/avatar/e268e9ba8d96006649c1745a48db2f73?d=identicon\u0026s=64",
      "cl": "317168@main",
      "clUrl": "https://commits.webkit.org/317168@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319163\nrdar://182001231\n\nReviewed by Andy Estes.\n\nWhen a find starts from a selection, all of a video's matching cues\nshare the media element's document position, so the closest match\nalways resolved to the run's first/last cue.\nInstead, pick the cue nearest the video's playhead in the search direction.\n\nAdded additional find-in-video navigation coverage on macOS, covering\nboth the new behavior and stepping through interleaved page text and\ncaption cues.\n\n* Source/WebKit/WebProcess/WebPage/FindController.cpp:\n(WebKit::cueIndexNearestPlayhead):\n(WebKit::indexClosestToSelection):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/FindInPage.mm:\n(configurationWithFindInVideoEnabled):\n(waitForVideoCurrentTimeNear):\n(TEST(WebKit, FindInPageVideoCaptionStepThroughCues)):\n(TEST(WebKit, FindInPageVideoCaptionCueInSubframe)):\n(seekAndPlaceCaretBeforeVideo):\n(seekAndPlaceCaretAfterVideo):\n(TEST(WebKit, FindInPageVideoCaptionNearestCueForward)):\n(TEST(WebKit, FindInPageVideoCaptionNearestCueBackward)):\n(TEST(WebKit, FindInPageVideoCaptionNearestCuePastAllForward)):\n(TEST(WebKit, FindInPageVideoCaptionNearestCueBeforeAllBackward)):\n(currentTimeAfterHighlighting):\n\nCanonical link: https://commits.webkit.org/317168@main",
      "email": "jhernandez89@apple.com",
      "hash": "462ce69479bd73f3f956d26e627dfc494d2aa2f9",
      "subject": "Find the caption cue nearest video's playhead from selection"
    },
    "317169@main": {
      "author": "Simon Fraser",
      "avatar": "https://www.gravatar.com/avatar/3763324aa0cdfa93be751c6081b8006a?d=identicon\u0026s=64",
      "cl": "317169@main",
      "clUrl": "https://commits.webkit.org/317169@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319308\nrdar://181007316\n\nReviewed by Abrar Rahman Protyasha.\n\nScroll anchoring on apple.com/retail causes jumpy scrolling near the top of the page.\nThe React-based content changes an element from `position: static` to `position: fixed`\nwhich correctly suppresses anchoring, but in a subsequent update changes `padding`, which\ntriggers anchoring. This anchoring happens via WebKit's zero-delay layout timer, so escapes\nthe earlier suppression; other browsers see both as happening in the same suppression window,\nalthough the behavior is poorly specified and browser behavior differs[1], as shown by a\nnew tentative WPT[2].\n\nBecause of differences between browsers, and real fix (removing the zero-delay layout\ntimer) being a very risky change, for now quirk scroll anchoring off for apple.com/retail\n(and the equivalent sites like apple.com.cn/retail and apple.com/uk/retail).\n\n[1] https://github.com/w3c/csswg-drafts/issues/14177\n[2] https://github.com/web-platform-tests/wpt/pull/61263\n\n* Source/WebCore/page/Quirks.cpp:\n* Source/WebCore/page/QuirksData.h:\n\nCanonical link: https://commits.webkit.org/317169@main",
      "email": "simon.fraser@apple.com",
      "hash": "7dc5e35fab8ba1567abe5e5611b35accad2dc096",
      "subject": "[Scroll anchoring] Scroll jumping on apple.com/retail"
    },
    "317170@main": {
      "author": "Simon Fraser",
      "avatar": "https://www.gravatar.com/avatar/3763324aa0cdfa93be751c6081b8006a?d=identicon\u0026s=64",
      "cl": "317170@main",
      "clUrl": "https://commits.webkit.org/317170@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319341\nrdar://182154374\n\nReviewed by Sammy Gill.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/96f79771e28940bebe2a260e23e4d8b55137b508\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/input/paged.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-snap-stop-002-nested.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/scroll-snap-stop-002.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/snap-after-relayout/multiple-aligned-targets/nested-supercedes-common-to-both-axes.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/snap-after-relayout/multiple-aligned-targets/prefer-common-to-both-axes-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/snap-after-relayout/multiple-aligned-targets/re-snap-focused-target-after-scrollBy-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/snap-after-relayout/multiple-aligned-targets/re-snap-focused-target-after-scrollBy.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/snap-after-relayout/multiple-aligned-targets/resources/common.js:\n(async runScrollSnapSelectionVerificationTest):\n* LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/snap-after-relayout/multiple-aligned-targets/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/unreachable-snap-positions-003-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/unreachable-snap-positions-003.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/unreachable-snap-positions-004-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/unreachable-snap-positions-004.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/unrelated-gesture-scroll-during-snap.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/w3c-import.log:\n\nCanonical link: https://commits.webkit.org/317170@main",
      "email": "simon.fraser@apple.com",
      "hash": "8c935ca7d697da2dff9db99fe3630112b638cd3e",
      "subject": "Resync `css-scroll-snap` from WPT Upstream"
    },
    "317171@main": {
      "author": "Dan Hecht",
      "avatar": "https://www.gravatar.com/avatar/080f47d912b1b34d0be8293f825d132d?d=identicon\u0026s=64",
      "cl": "317171@main",
      "clUrl": "https://commits.webkit.org/317171@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319382\nrdar://182204529\n\nReviewed by Marcus Plutowski.\n\nAdd two fragmentation sequences on the simple and fast heaps.\ntestFragmentationSplitRecoalescePreservesZero seeds an is_all_zero region,\nsplits it into sub-ranges, and frees them back is_all_zero -- the recoalesced\nregion must stay is_all_zero. testFragmentationSplitRecoalesceContaminatedByNonZero\ndoes the same but frees the pieces back may_have_non_zero; the recoalesced whole\nmust then be may_have_non_zero (pas_zero_mode_merge), since a later zeroedMalloc\ntrusting is_all_zero would otherwise skip zeroing and return stale bytes.\n\nTest: Source/bmalloc/libpas/src/test/LargeFreeHeapTests.cpp\n\n* Source/bmalloc/libpas/src/test/LargeFreeHeapTests.cpp:\n(std::testFragmentationSplitRecoalescePreservesZero):\n(std::testFragmentationSplitRecoalesceContaminatedByNonZero):\n(addLargeFreeHeapTests):\n\nCanonical link: https://commits.webkit.org/317171@main",
      "email": "dan.hecht@apple.com",
      "hash": "5abeb7534df8542262f9b5101cbd1c7f2323a521",
      "subject": "[libpas] Test zero_mode through split-then-recoalesce in LargeFreeHeapTests"
    },
    "317172@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "317172@main",
      "clUrl": "https://commits.webkit.org/317172@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319169\nrdar://182007943\n\nReviewed by Antti Koivisto.\n\nImplement the 'discard-before' and 'discard-after' values of the CSS Text 4\n'white-space-trim' property (https://drafts.csswg.org/css-text-4/#white-space-trim)\nin the modern inline layout path, behind the CSSWhiteSpaceTrimEnabled setting\n(off by default).\n\n'discard-before' / 'discard-after' remove the collapsible white space\nimmediately before the start / after the end of an element. We do this at\ninline-item building time: InlineItemsBuilder::adjustInlineItemsForWhiteSpaceTrim\ndiscards the corresponding InlineTextItems in a single forward pass before line\nbuilding, bidi resolution and intrinsic sizing run, so the removed white space\nis kept out of every downstream computation (rendering, soft-wrap opportunities\nand min/max-content) at once. The property applies to inline boxes and block\ncontainers, so an inline box or a non-replaced inline-block carries it. Inline\nbox boundaries -- and floats / out-of-flow boxes -- are transparent to this\nadjacency, matching white space collapsing, while other atomic inlines, replaced\ncontent, iframes and block-in-inline boxes are real content that ends it.\n\nBecause the property changes which inline items are generated, a value change\ninvalidates the cached inline item list (InlineInvalidation) and requires layout\n(StyleDifference). Since the discard depends on cross-box adjacency that a\npartial rebuild starting mid-content cannot resolve, the inline formatting\ncontext re-collects all inline items whenever the content carries\nwhite-space-trim rather than doing an incremental rebuild.\n\n'discard-inner' parses and computes to a value but has no layout effect yet.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-cascade/all-prop-revert-layer-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/parsing/white-space-trim-computed-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/parsing/white-space-trim-computed.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/parsing/white-space-trim-invalid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/parsing/white-space-trim-invalid.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/parsing/white-space-trim-valid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/parsing/white-space-trim-valid.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/reference/white-space-trim-atomic-inline-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/reference/white-space-trim-block-in-inline-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/reference/white-space-trim-break-spaces-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/reference/white-space-trim-content-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/reference/white-space-trim-discard-after-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/reference/white-space-trim-discard-before-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/reference/white-space-trim-discard-before-after-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/reference/white-space-trim-dynamic-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/reference/white-space-trim-generated-content-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/reference/white-space-trim-inline-block-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/reference/white-space-trim-inline-block-dynamic-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/reference/white-space-trim-interaction-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/reference/white-space-trim-nested-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/reference/white-space-trim-rtl-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/reference/white-space-trim-white-space-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/reference/white-space-trim-wrap-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-atomic-inline-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-atomic-inline.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-block-in-inline-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-block-in-inline.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-break-spaces-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-break-spaces.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-content-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-content.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-discard-after-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-discard-after.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-discard-before-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-discard-before.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-discard-before-after-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-discard-before-after.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-dynamic-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-dynamic.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-generated-content-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-generated-content.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-inline-block-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-inline-block.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-inline-block-dynamic-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-inline-block-dynamic.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-interaction-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-interaction.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-intrinsic-width-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-intrinsic-width.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-nested-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-nested.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-rtl-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-rtl.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-white-space-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-white-space.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-wrap-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/white-space/white-space-trim-wrap.html: Added.\n  (each with its reference/*-ref.html and byte-copy *-expected.html; intrinsic-width is a\n  testharness test with *-expected.txt. inline-block, inline-block-dynamic and block-in-inline\n  cover the inline-block carrier, its dynamic invalidation and the block-in-inline construct.)\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-typed-om/the-stylepropertymap/properties/white-space-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/rendering/widgets/shadow-dom-expected.txt:\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml: Add the CSSWhiteSpaceTrimEnabled\n  setting (testable, off by default).\n\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj: Build the new files.\n\n* Source/WebCore/css/CSSProperties.json: Add the white-space-trim longhand.\n* Source/WebCore/css/CSSValueKeywords.in: Add discard-before / discard-after / discard-inner.\n* Source/WebCore/layout/formattingContexts/inline/InlineContentCache.h: Carry a hasWhiteSpaceTrim\ncontent attribute.\n(WebCore::Layout::InlineContentCache::InlineItems::hasWhiteSpaceTrim const):\n* Source/WebCore/layout/formattingContexts/inline/InlineFormattingContext.cpp:\n(WebCore::Layout::InlineFormattingContext::rebuildInlineItemListIfNeeded): Force a full inline-item\nre-collection when the content has white-space-trim.\n* Source/WebCore/layout/formattingContexts/inline/InlineItemsBuilder.cpp:\n(WebCore::Layout::isNonReplacedInlineBlock): The inline-level block container that white-space-trim\ncan carry; excludes replaced content and iframes.\n(WebCore::Layout::InlineItemsBuilder::build):\n(WebCore::Layout::InlineItemsBuilder::adjustInlineItemsForWhiteSpaceTrim): Discard the collapsible\nwhite space items before/after the boxes that carry white-space-trim (inline boxes and non-replaced\ninline-blocks) in a single forward pass; treat inline box boundaries, floats and out-of-flow boxes as\ntransparent, and other atomic and block-in-inline boxes as real content. Record hasWhiteSpaceTrim on\nthe content cache attributes.\n(WebCore::Layout::InlineItemsBuilder::handleInlineBoxStart): Track whether any inline box carries\nwhite-space-trim.\n(WebCore::Layout::InlineItemsBuilder::handleInlineLevelBox): Track whether any inline-block carries\nwhite-space-trim.\n* Source/WebCore/layout/formattingContexts/inline/InlineItemsBuilder.h:\n* Source/WebCore/layout/formattingContexts/inline/IntrinsicWidthHandler.cpp:\n(WebCore::Layout::isBoxEligibleForNonLineBuilderMinimumWidth):\n* Source/WebCore/layout/formattingContexts/inline/TextOnlySimpleLineBuilder.cpp: Disqualify the\nsimplified min-content / text-only fast paths when white-space-trim is present.\n(WebCore::Layout::TextOnlySimpleLineBuilder::isEligibleForSimplifiedInlineLayoutByStyle):\n* Source/WebCore/layout/formattingContexts/inline/invalidation/InlineInvalidation.cpp:\n(WebCore::Layout::InlineInvalidation::rootStyleWillChange):\n(WebCore::Layout::InlineInvalidation::styleWillChange): Mark the inline item list dirty when\nwhite-space-trim changes on the root, an inline box or an inline-block.\n* Source/WebCore/layout/formattingContexts/inline/text/TextUtil.cpp:\n(WebCore::Layout::TextUtil::mayBreakInBetween): Use the next item's own leading content when it does\nnot start at the beginning of its text box (its leading white space may have been discarded), while\navoiding a substring allocation on the common path.\n* Source/WebCore/style/StyleDifference.cpp:\n* Source/WebCore/style/computed/StyleComputedStyleBase.h:\n* Source/WebCore/style/computed/data/StyleNonInheritedRareData.cpp: Store white-space-trim in\n  non-inherited rare data.\n(WebCore::Style::whiteSpaceTrim):\n(WebCore::Style::NonInheritedRareData::NonInheritedRareData):\n(WebCore::Style::NonInheritedRareData::operator== const):\n(WebCore::Style::NonInheritedRareData::dumpDifferences const):\n(WebCore::Style::scrollSnapStop): Deleted.\n* Source/WebCore/style/computed/data/StyleNonInheritedRareData.h:\n* Source/WebCore/style/values/primitives/StyleKeyword+Mappings.h: Map the new keywords.\n* Source/WebCore/style/values/text/StyleWhiteSpaceTrim.cpp: Added.\n(WebCore::Style::CSSValueConversion\u003cWhiteSpaceTrim\u003e::operator):\n* Source/WebCore/style/values/text/StyleWhiteSpaceTrim.h: Added.\n(WebCore::Style::WhiteSpaceTrim::WhiteSpaceTrim):\n(WebCore::Style::WhiteSpaceTrim::fromRaw):\n(WebCore::Style::WhiteSpaceTrim::toRaw const):\n(WebCore::Style::WhiteSpaceTrim::contains const):\n(WebCore::Style::WhiteSpaceTrim::containsAny const):\n(WebCore::Style::WhiteSpaceTrim::containsAll const):\n(WebCore::Style::WhiteSpaceTrim::containsOnly const):\n(WebCore::Style::WhiteSpaceTrim::isNone const):\n(WebCore::Style::WhiteSpaceTrim::switchOn const):\n\nCanonical link: https://commits.webkit.org/317172@main",
      "email": "zalan@apple.com",
      "hash": "348f90db48a564e65253e5801cc8cbf8d86437d7",
      "subject": "[CSS] Support the white-space-trim property (discard-before / discard-after)"
    },
    "317173@main": {
      "author": "Andy Estes",
      "avatar": "https://www.gravatar.com/avatar/643f10f01b26fd94d03482a2013b2ea0?d=identicon\u0026s=64",
      "cl": "317173@main",
      "clUrl": "https://commits.webkit.org/317173@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319361\nrdar://182168974\n\nUnreviewed build fix. Marked WebContentAnalysis selectors as legacy SPI.\n\n* Source/WebCore/Configurations/AllowedSPI-legacy.toml:\n\nCanonical link: https://commits.webkit.org/317173@main",
      "email": "aestes@apple.com",
      "hash": "f1e2c8591bdc99535b06439f16a5d421c05ccf2a",
      "subject": "WebContentAnalysis selectors are flagged as unrecognized by Audit SPI Use"
    },
    "317174@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "317174@main",
      "clUrl": "https://commits.webkit.org/317174@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319359\nrdar://182168302\n\nReviewed by Abrar Rahman Protyasha.\n\nThey have the same value now.\n\nTests: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/FullscreenVideoTextRecognition.mm\n       Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ImageAnalysisTests.mm\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WTF/wtf/PlatformEnable.h:\n* Source/WTF/wtf/PlatformEnableCocoa.h:\n* Source/WebCore/PAL/pal/cocoa/VisionKitCoreSoftLink.h:\n* Source/WebCore/PAL/pal/cocoa/VisionKitCoreSoftLink.mm:\n* Source/WebCore/PAL/pal/spi/cocoa/VisionKitCoreSPI.h:\n* Source/WebCore/editing/cocoa/EditorCocoa.mm:\n(WebCore::selectionInImageOverlayAsAttributedString):\n* Source/WebCore/loader/EmptyClients.cpp:\n* Source/WebCore/page/ContextMenuClient.h:\n* Source/WebCore/page/ContextMenuController.cpp:\n(WebCore::ContextMenuController::populate):\n* Source/WebCore/platform/LocalizedStrings.h:\n* Source/WebCore/platform/TextRecognitionResult.h:\n* Source/WebCore/platform/cocoa/LocalizedStringsCocoa.mm:\n* Source/WebCore/platform/cocoa/TextRecognitionResultCocoa.mm:\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::installImageOverlay):\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.mm:\n* Source/WebKit/Platform/cocoa/ImageAnalysisUtilities.h:\n* Source/WebKit/Platform/cocoa/ImageAnalysisUtilities.mm:\n(WebKit::createImageAnalyzer):\n(WebKit::createImageAnalyzerRequest):\n(WebKit::makeTextRecognitionResult):\n(WebKit::languageIdentifierSupportsLiveText):\n* Source/WebKit/Shared/Cocoa/WebPreferencesDefaultValuesCocoa.mm:\n(WebKit::defaultTextRecognitionInVideosEnabled):\n(WebKit::defaultVisualTranslationEnabled):\n(WebKit::defaultRemoveBackgroundEnabled):\n* Source/WebKit/Shared/TextRecognitionResult.serialization.in:\n* Source/WebKit/UIProcess/API/Cocoa/_WKElementAction.mm:\n(+[_WKElementAction _elementActionWithType:customTitle:assistant:disabled:]):\n* Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm:\n* Source/WebKit/UIProcess/WebContextMenuProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::contextMenuItemSelected):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/ios/WKActionSheetAssistant.h:\n* Source/WebKit/UIProcess/ios/WKActionSheetAssistant.mm:\n(-[WKActionSheetAssistant defaultActionsForLinkSheet:]):\n(-[WKActionSheetAssistant defaultActionsForImageSheet:]):\n(-[WKActionSheetAssistant handleElementActionWithType:element:needsInteraction:]):\n* Source/WebKit/UIProcess/ios/WKContentViewInteraction.h:\n* Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm:\n(-[WKContentView hasSelectablePositionAtPoint:]):\n(-[WKContentView pointIsNearMarkedText:]):\n(-[WKContentView textInteractionGesture:shouldBeginAtPoint:]):\n(-[WKContentView _singleTapRecognized:]):\n(-[WKContentView requestPreferredArrowDirectionForEditMenuWithCompletionHandler:]):\n(-[WKContentView _handleTapOverInteractiveControl:]):\n(-[WKContentView _didCommitLoadForMainFrame]):\n(-[WKContentView _internalSelectTextForContextMenuWithLocationInView:completionHandler:]):\n(-[WKContentView _shouldIgnoreTouchEvent:]):\n(-[WKContentView deferringGestureRecognizer:shouldDeferGesturesForEventThatWillBeginAction:]):\n(-[WKContentView buildMenuForWebViewWithBuilder:]):\n(-[WKContentView _setUpImageAnalysis]):\n(-[WKContentView _tearDownImageAnalysis]):\n(-[WKContentView requestTextRecognition:imageData:sourceLanguageIdentifier:targetLanguageIdentifier:completionHandler:]):\n(-[WKContentView _completeImageAnalysisRequestForContextMenu:requestIdentifier:hasTextResults:]):\n(-[WKContentView beginTextRecognitionForFullscreenVideo:playerViewController:]):\n(-[WKContentView cancelTextRecognitionForFullscreenVideo:]):\n(-[WKContentView isTextRecognitionInFullscreenVideoEnabled]):\n(-[WKContentView beginTextRecognitionForVideoInElementFullscreen:bounds:]):\n(-[WKContentView cancelTextRecognitionForVideoInElementFullscreen]):\n(-[WKContentView _shouldAvoidSecurityHeuristicScoreUpdates]):\n* Source/WebKit/UIProcess/mac/WebContextMenuProxyMac.h:\n* Source/WebKit/UIProcess/mac/WebContextMenuProxyMac.mm:\n(WebKit::WebContextMenuProxyMac::appendRemoveBackgroundItemToControlledImageMenuIfNeeded):\n(WebKit::WebContextMenuProxyMac::removeBackgroundFromControlledImage):\n(WebKit::WebContextMenuProxyMac::getContextMenuFromItems):\n* Source/WebKit/UIProcess/mac/WebPageProxyMac.mm:\n* Source/WebKit/UIProcess/mac/WebViewImpl.h:\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::mouseUp):\n(WebKit::WebViewImpl::requestTextRecognition):\n(WebKit::WebViewImpl::imageAnalysisOverlayViewHasCursorAtPoint const):\n(WebKit::WebViewImpl::beginTextRecognitionForVideoInElementFullscreen):\n(WebKit::WebViewImpl::cancelTextRecognitionForVideoInElementFullscreen):\n* Source/WebKit/WebProcess/WebCoreSupport/WebContextMenuClient.h:\n* Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::didCommitLoad):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.messages.in:\n* Source/WebKitLegacy/mac/WebCoreSupport/WebContextMenuClient.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/ImageAnalysisTestingUtilities.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/ImageAnalysisTestingUtilities.mm:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/FullscreenVideoTextRecognition.mm:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ImageAnalysisTests.mm:\n\nCanonical link: https://commits.webkit.org/317174@main",
      "email": "richard_robinson2@apple.com",
      "hash": "33a88e318eedd4ad6069b1833594c777b3e4ccb0",
      "subject": "Unify IMAGE_ANALYSIS_ENHANCEMENTS and IMAGE_ANALYSIS flags"
    },
    "317175@main": {
      "author": "Kiet Ho",
      "avatar": "https://www.gravatar.com/avatar/d9058b37006dce1f55f91b8ccc82f9a3?d=identicon\u0026s=64",
      "cl": "317175@main",
      "clUrl": "https://commits.webkit.org/317175@main",
      "description": "rdar://182125983\nhttps://bugs.webkit.org/show_bug.cgi?id=319287\n\nReviewed by Tim Nguyen.\n\n/resize-observer/observe.html contains 20 different subtests which are run\nsequentially, so one test timing out will block subsequent tests from running.\nFix this by splitting it into 20 different test files.\n\nThe motivation of this change is from https://github.com/WebKit/WebKit/pull/69080,\nwhich fixes test 15. Turns out, /resize-observer/observe.html has been marked as\nskipped because it times out. On further investigation, we do pass most of the\nsubtests, but because of test 15 timing out, we don't have visibility into whether\nsubsequent tests also pass or not.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-001-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-002-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-002.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-003-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-003.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-004-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-004.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-005-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-005.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-006-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-006.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-007-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-007.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-008-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-008.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-009-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-009.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-010-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-010.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-011-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-011.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-012-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-012.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-013-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-013.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-014-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-014.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-015-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-015.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-016-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-016.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-017-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-017.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-018-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-018.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-019-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-019.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-020-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-020.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe-expected.txt: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/resize-observer/observe.html: Removed.\n\nCanonical link: https://commits.webkit.org/317175@main",
      "email": "kiet.ho@apple.com",
      "hash": "729b75a86f4b1c8e42f2400fcf6b5e22760a114c",
      "subject": "[resize-observer] Split WPT /resize-observer/observe.html into separate tests"
    },
    "317176@main": {
      "author": "Roberto Rodriguez",
      "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64",
      "cl": "317176@main",
      "clUrl": "https://commits.webkit.org/317176@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319298\nrdar://181719662\n\nReviewed by Mike Wyrzykowski.\n\nANGLE translates GLSL out and inout function parameters into Metal using small\nhelper structs whose conversion operator returns a reference into the struct.\nOlder Metal compilers placed that reference in the thread address space by\ndefault, but a recent Metal compiler change defaults unlabeled references to the\ngeneric address space instead. The returned reference no longer matches the\ndeclared thread reference, so the shader fails to compile and WebGL pages that\npass out/inout parameters render nothing, producing many console errors.\n\nFix by adding a trailing thread qualifier to the conversion operator of each\nhelper struct (ANGLE_Out, ANGLE_InOut, ANGLE_VectorElemRef, and\nANGLE_SwizzleRef), which keeps both the object and the reference it returns in\nthe thread address space and restores the previous behavior.\n\n* Source/ThirdParty/ANGLE/src/compiler/translator/msl/ProgramPrelude.cpp:\n\nCanonical link: https://commits.webkit.org/317176@main",
      "email": "roberto_rodriguez2@apple.com",
      "hash": "4d4a69df0d2109f7d125e634a24c5d58bcab930e",
      "subject": "[ANGLE] Fix WebGL out/inout shaders failing to compile on newer Metal"
    },
    "317177@main": {
      "author": "Jessica Lee",
      "avatar": "https://www.gravatar.com/avatar/fc717c99321d09f31fb9187418a8ffc5?d=identicon\u0026s=64",
      "cl": "317177@main",
      "clUrl": "https://commits.webkit.org/317177@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319138\nrdar://181954984\n\nReviewed by Ryosuke Niwa.\n\nWe should ensures that the window's updated activity state always propogates to the\ntest / UI Process.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WindowBlurInputChangeEvent.mm:\n(TEST(WKWebView, InputChangeFiresOnWindowBlur)):\n\nCanonical link: https://commits.webkit.org/317177@main",
      "email": "jlee53@apple.com",
      "hash": "bccd327ae8fa248866778f6eece944139795b69d",
      "subject": "WKWebView.InputChangeFiresOnWindowBlur should wait for activity state to update"
    },
    "317178@main": {
      "author": "Tyler Wilcock",
      "avatar": "https://www.gravatar.com/avatar/9545082e6bed96158a9f52dac6e4b869?d=identicon\u0026s=64",
      "cl": "317178@main",
      "clUrl": "https://commits.webkit.org/317178@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319267\nrdar://180455904\n\nReviewed by Dominic Mazzoni.\n\n294788@main (bc34242b2e93) moved hierarchicalLevel() to AXCoreObject and, in doing\nso, changed the tree-level ancestor walk from the authored ARIA role\n(ariaRoleAttribute()) to the computed role(). A plain \u003cul\u003e whose only child is a\nrole=\"treeitem\" is demoted to a generic Group role by the list heuristic, so the\nwalk began counting it as a grouping level, reporting level 2 instead of 1.\n\nPer the ARIA tree pattern, only an explicitly-authored role=\"group\" establishes a\ngrouping level. Introduce AXCoreObject::hasExplicitGroupRole() (cached on the\nisolated tree) and count only those ancestors, matching the pre-294788 behavior\nand other browsers.\n\n* LayoutTests/accessibility/treeitem-hierarchical-level-in-plain-list-expected.txt: Added.\n* LayoutTests/accessibility/treeitem-hierarchical-level-in-plain-list.html: Added.\n* Source/WebCore/accessibility/AXCoreObject.cpp:\n(WebCore::AXCoreObject::hierarchicalLevel const):\n* Source/WebCore/accessibility/AXCoreObject.h:\n* Source/WebCore/accessibility/AXLogger.cpp:\n(WebCore::operator\u003c\u003c):\n* Source/WebCore/accessibility/AccessibilityObject.h:\n* Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.h:\n* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp:\n(WebCore::createIsolatedObjectData):\n* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.h:\n\nCanonical link: https://commits.webkit.org/317178@main",
      "email": "tyler_w@apple.com",
      "hash": "da85a3bfd71bd13873ae8a43a09774ed89c23d62",
      "subject": "AX: REGRESSION(294788@main): Voice Control/inspector report the wrong tree-item level for a treeitem nested in a plain \u003cul\u003e"
    },
    "317179@main": {
      "author": "Ruthvik Konda",
      "avatar": "https://www.gravatar.com/avatar/bca33cefcce93017251a8fbc1204cdc4?d=identicon\u0026s=64",
      "cl": "317179@main",
      "clUrl": "https://commits.webkit.org/317179@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319300\nrdar://182135437\n\nReviewed by Dan Glastonbury.\n\nWebXRGamepad.cpp includes Gamepad.h but never references the Gamepad class. No change in behavior.\n\n* Source/WebCore/Modules/webxr/WebXRGamepad.cpp:\n\nCanonical link: https://commits.webkit.org/317179@main",
      "email": "rkonda2@apple.com",
      "hash": "4c7ed8a8be73e2762005429100956e2b00a412af",
      "subject": "[WebXR] Remove unused Gamepad.h include in WebXRGamepad"
    },
    "317180@main": {
      "author": "Jessica Lee",
      "avatar": "https://www.gravatar.com/avatar/fc717c99321d09f31fb9187418a8ffc5?d=identicon\u0026s=64",
      "cl": "317180@main",
      "clUrl": "https://commits.webkit.org/317180@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319343\nrdar://176493823\n\nReviewed by Sihui Liu.\n\nAdd flag that allows users to override default SiteIsolationEnabled value for testing\n\nManual testing detailed in ticket.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/317180@main",
      "email": "jlee53@apple.com",
      "hash": "b4d05a5bb4f3e63069c6b5967f6347a77aa12f1e",
      "subject": "Add Site Isolation opt-in/out flag"
    },
    "317181@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "317181@main",
      "clUrl": "https://commits.webkit.org/317181@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319393\nrdar://182224083\n\nReviewed by Keith Miller.\n\nWe can stop using JSFullPromiseReaction and use JSSlimPromiseReaction if\nwe apply the following changes in JSAsyncGenerator.\n\n1. We can just use circular singly-linked-list for queueing. Since\n   queueing is always just enqueue and dequeue, we do not need to have\n   doubly-linked-list.\n2. Pack resumeMode into JSSlimPromiseReaction's payload.\n\n* Source/JavaScriptCore/runtime/JSAsyncGenerator.cpp:\n(JSC::JSAsyncGenerator::enqueue):\n(JSC::JSAsyncGenerator::dequeue):\n* Source/JavaScriptCore/runtime/JSPromiseReaction.cpp:\n(JSC::JSSlimPromiseReaction::create):\n(JSC::JSSlimPromiseReaction::createAsyncGeneratorRequest):\n* Source/JavaScriptCore/runtime/JSPromiseReaction.h:\n(JSC::JSPromiseReaction::JSPromiseReaction):\n\nCanonical link: https://commits.webkit.org/317181@main",
      "email": "ysuzuki@apple.com",
      "hash": "74cc52330394d1cad391692a951228eb6db5e8d4",
      "subject": "[JSC] Use JSSlimPromiseReaction for JSAsyncGenerator queue"
    },
    "317182@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "317182@main",
      "clUrl": "https://commits.webkit.org/317182@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318918\nrdar://181751564\n\nReviewed by Antti Koivisto.\n\nAdd the CSS Text Level 4 'wrap-inside' property (auto | avoid), gated behind the\ncssWrapInsideEnabled setting.\n\n'wrap-inside: avoid' suppresses soft wrap opportunities within an inline box: the\nline breaks before the box - keeping it together - rather than inside it, and\nbreaks inside the box only as a last resort when there is no other break\nopportunity on the line. A 'wrap-inside: auto' box nested inside an 'avoid' box\ndoes not re-enable breaking, and breaks between sibling avoid boxes are preferred\nover breaks inside them.\n\nWhether content is inside an avoid box (the box's own value or inherited from an\nancestor avoid box) is precomputed during style resolution as\neffectiveWrapInsideAvoid(), so inline layout reads a flat flag and never walks\nthe box tree. It propagates only through inline boxes, so it does not cross into\na block, inline-block or other independent formatting context child. The break\ndecision is made by InlineContentBreaker: when the\noverflowing content is inside an avoid box and there is an earlier wrap\nopportunity, it asks the line builder to revert to the last wrap opportunity. The\nline builder records all wrap opportunities and, on such a revert, prefers the\nlast one outside any avoid box; when every opportunity is inside an avoid box it\nreverts to the outermost such box - a break in an outer box is used before a\nbreak within an inner one - breaking inside the box only as a last resort when it\nis the only content on the line.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-auto-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-auto-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-auto.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-break-before-then-inside-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-break-before-then-inside-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-break-before-then-inside.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-forced-break-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-forced-break-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-forced-break.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-keeps-box-together-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-keeps-box-together-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-keeps-box-together.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-last-resort-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-last-resort-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-last-resort.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-nested-auto-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-nested-auto-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-nested-auto.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-nested-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-nested-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-nested.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-nowrap-child-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-nowrap-child-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-nowrap-child.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-nowrap-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-nowrap-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-nowrap.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-siblings-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-siblings-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-siblings.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-single-word-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-single-word-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-single-word.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-computed-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-computed.html: Added.\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml: Add cssWrapInsideEnabled.\n* Source/WebCore/css/CSSProperties.json: Add the wrap-inside property.\n* Source/WebCore/layout/formattingContexts/inline/AbstractLineBuilder.h: Add the WrapOpportunityList alias.\n* Source/WebCore/layout/formattingContexts/inline/InlineContentBreaker.cpp:\n(WebCore::Layout::InlineContentBreaker::processOverflowingContent const): Revert to the\n(WebCore::Layout::shouldRevertToEarlierWrapOpportunity):\nlast wrap opportunity when overflowing content is inside a wrap-inside: avoid box.\n* Source/WebCore/layout/formattingContexts/inline/InlineLineBuilder.cpp:\n(WebCore::Layout::enclosingBoxForWrapOpportunity):\n(WebCore::Layout::wrapOpportunityToRevertTo): Prefer a wrap opportunity outside any avoid box; when\nall opportunities are inside avoid boxes, revert to the outermost one.\n(WebCore::Layout::LineBuilder::processLineBreakingResult):\n* Source/WebCore/rendering/style/RenderStyleConstants.cpp:\n(WebCore::operator\u003c\u003c):\n* Source/WebCore/rendering/style/RenderStyleConstants.h: Add the WrapInside enum.\n* Source/WebCore/style/StyleAdjuster.cpp:\n(WebCore::Style::Adjuster::adjust const): Compute effectiveWrapInsideAvoid.\n* Source/WebCore/style/computed/StyleComputedStyleBase+GettersInlines.h:\n(WebCore::Style::ComputedStyleBase::effectiveWrapInsideAvoid const):\n* Source/WebCore/style/computed/StyleComputedStyleBase+SettersInlines.h:\n(WebCore::Style::ComputedStyleBase::setEffectiveWrapInsideAvoid):\n* Source/WebCore/style/computed/StyleComputedStyleBase.h:\n* Source/WebCore/style/computed/data/StyleInheritedRareData.cpp:\n(WebCore::Style::InheritedRareData::InheritedRareData):\n(WebCore::Style::InheritedRareData::operator== const):\n(WebCore::Style::InheritedRareData::dumpDifferences const):\n* Source/WebCore/style/computed/data/StyleInheritedRareData.h: Store effectiveWrapInsideAvoid.\n* Source/WebCore/style/computed/data/StyleNonInheritedRareData.cpp:\n(WebCore::Style::NonInheritedRareData::NonInheritedRareData):\n(WebCore::Style::NonInheritedRareData::operator== const):\n(WebCore::Style::NonInheritedRareData::dumpDifferences const):\n* Source/WebCore/style/computed/data/StyleNonInheritedRareData.h: Store wrap-inside.\n* Source/WebCore/style/values/primitives/StyleKeyword+Mappings.h: Map the wrap-inside keywords.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-break-all-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-break-all-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-break-all.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-line-break-anywhere-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-line-break-anywhere-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-line-break-anywhere.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-overflow-wrap-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-overflow-wrap-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-overflow-wrap.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-block-child-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-block-child-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-block-child.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-inline-block-child-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-inline-block-child-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-inline-block-child.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-inline-flex-child-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-inline-flex-child-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-inline-flex-child.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-inline-grid-child-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-inline-grid-child-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-inline-grid-child.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-inline-table-child-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-inline-table-child-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-inline-table-child.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-nested-deep-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-nested-deep-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-nested-deep.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-nested-only-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-nested-only-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-nested-only.html: Added.\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-dynamic-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-dynamic-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-dynamic.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-removed-dynamic-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-removed-dynamic-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text/wrap-inside/wrap-inside-avoid-removed-dynamic.html: Added.\n* Source/WebCore/style/StyleDifference.cpp:\n* LayoutTests/imported/w3c/web-platform-tests/html/rendering/widgets/shadow-dom-expected.txt:\n\nCanonical link: https://commits.webkit.org/317182@main",
      "email": "zalan@apple.com",
      "hash": "1a1a49beb8b8029667b4f6be7d5573c0561c5a01",
      "subject": "[css-text-4] Implement the wrap-inside property"
    },
    "317183@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "317183@main",
      "clUrl": "https://commits.webkit.org/317183@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318600\n\nReviewed by Antti Koivsito.\n\nSnapshot the flex item's cross-axis border+padding onto FlexLayoutItem, mirroring the\nexisting mainAxisBorderAndPadding field. It is populated at construction from the\nflow-aware border+padding extent.\n\nThe only flow-based cross-axis border+padding read is in computeMainSizeFromAspectRatioUsing,\nso that helper and its caller adjustFlexItemSizeForAspectRatioCrossAxisMinAndMax now take a\nconst FlexLayoutItem\u0026 (both are only ever reached from the item-having flex-base subgraph) and\nthe read comes from the field. The read already ran during flex-base sizing, so the\nconstruction-time snapshot is the same value. The item-logical border+padding reads in the\nstretch path are left as-is: those are the item's own logical-height border+padding, which\ndiffers from the flow-based cross-axis value for orthogonal flows.\n\nNo change in behavior.\n\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n\nCo-Authored-By: Claude Opus 4.7 (1M context) \u003cnoreply@anthropic.com\u003e\nCanonical link: https://commits.webkit.org/317183@main",
      "email": "zalan@apple.com",
      "hash": "feecb29345df6e4857553174e997c4b90054c8da",
      "subject": "[cleanup] Snapshot the flex item cross-axis border+padding on FlexLayoutItem"
    },
    "317184@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "317184@main",
      "clUrl": "https://commits.webkit.org/317184@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319394\nrdar://182224827\n\nReviewed by Aditya Keerthi.\n\nFollow up to 317174@main\n\n* Source/WebKit/Platform/cocoa/ImageAnalysisUtilities.h:\n* Source/WebKit/Platform/cocoa/ImageAnalysisUtilities.mm:\n(WebKit::createImageAnalyzer):\n(WebKit::createImageAnalyzerRequest):\n(WebKit::makeTextRecognitionResult):\n(WebKit::requestVisualTranslation):\n* Source/WebKit/UIProcess/ios/WKContentViewInteraction.h:\n* Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm:\n(-[WKContentView imageAnalyzer]):\n(-[WKContentView createImageAnalyzerRequest:image:imageURL:]):\n(-[WKContentView createImageAnalyzerRequest:image:]):\n(-[WKContentView updateImageAnalysisForContextMenuPresentation:elementBounds:]):\n(-[WKContentView requestTextRecognition:imageData:sourceLanguageIdentifier:targetLanguageIdentifier:completionHandler:]):\n(-[WKContentView imageAnalysisGestureDidBegin:]):\n(shouldUseMachineReadableCodeMenuFromImageAnalysisResult):\n(-[WKContentView _completeImageAnalysisRequestForContextMenu:requestIdentifier:hasTextResults:]):\n(-[WKContentView beginTextRecognitionForFullscreenVideo:playerViewController:]):\n(-[WKContentView beginTextRecognitionForVideoInElementFullscreen:bounds:]):\n* Source/WebKit/UIProcess/mac/WebViewImpl.h:\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::ensureImageAnalyzer):\n(WebKit::WebViewImpl::processImageAnalyzerRequest):\n(WebKit::createImageAnalyzerRequest):\n(WebKit::WebViewImpl::requestTextRecognition):\n(WebKit::WebViewImpl::computeHasVisualSearchResults):\n(WebKit::WebViewImpl::beginTextRecognitionForVideoInElementFullscreen):\n\nCanonical link: https://commits.webkit.org/317184@main",
      "email": "richard_robinson2@apple.com",
      "hash": "80e039adfd653daf95540446824b996c73509838",
      "subject": "Remove `CocoaImage*` using declarations which now are no longer needed"
    },
    "317185@main": {
      "author": "Claudio Saavedra",
      "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64",
      "cl": "317185@main",
      "clUrl": "https://commits.webkit.org/317185@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319385\n\nReviewed by Adrian Perez de Castro.\n\nThis will be referenced from the tutorial section.\n\n* Source/WebKit/WPEPlatform/docs/compiling.md: Added.\n* Source/WebKit/WPEPlatform/docs/wpeplatform.toml.in:\n\nCanonical link: https://commits.webkit.org/317185@main",
      "email": "csaavedra@igalia.com",
      "hash": "0a59594c2eb08f97ed562c60e559b53060f2580d",
      "subject": "[WPE] Add a documentation section about compiling against the WPE platform"
    },
    "317186@main": {
      "author": "Andy Estes",
      "avatar": "https://www.gravatar.com/avatar/643f10f01b26fd94d03482a2013b2ea0?d=identicon\u0026s=64",
      "cl": "317186@main",
      "clUrl": "https://commits.webkit.org/317186@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319358\nrdar://182168097\n\nReviewed by Jer Noble.\n\nWhen a MediaDeviceRoute loads a video URL, that video will play on the wireless device represented\nby the route until WebKit calls -stop on its underlying route session. MediaDeviceRoute called\n-stop in its destructor, however, the route remains alive as long as it is selected in the system's\nroute picker. This selection is system-global and can outlive a navigation.\n\nThe route's underlying session's lifetime should match that of the\nMediaPlayerPrivateWirelessPlayback that started the session. Made that so by introducing\nMediaDeviceRoute::disconnectFromSession(), which clears the playback control observer's observed\nobject, calls -stop on the route session, and removes the route session from the route.\nMediaPlayerPrivateWirelessPlayback calls disconnectSession() in cancelLoad and its destructor.\n\nTests: media/wireless-playback-media-player/route-disconnects-when-player-destroyed.html\n       media/wireless-playback-media-player/route-reconnects-after-reload.html\n\n* LayoutTests/media/wireless-playback-media-player/route-disconnects-when-player-destroyed-expected.txt: Added.\n* LayoutTests/media/wireless-playback-media-player/route-disconnects-when-player-destroyed.html: Added.\n* LayoutTests/media/wireless-playback-media-player/route-reconnects-after-reload-expected.txt: Added.\n* LayoutTests/media/wireless-playback-media-player/route-reconnects-after-reload.html: Added.\n* Source/WebCore/platform/audio/ios/MediaDeviceRoute.h:\n* Source/WebCore/platform/audio/ios/MediaDeviceRoute.mm:\n(WebCore::MediaDeviceRoute::disconnectFromSession):\n(WebCore::MediaDeviceRoute::~MediaDeviceRoute):\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.cpp:\n(WebCore::MediaPlayerPrivateWirelessPlayback::~MediaPlayerPrivateWirelessPlayback):\n(WebCore::MediaPlayerPrivateWirelessPlayback::cancelLoad):\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.h:\n* Source/WebCore/testing/MockMediaDeviceRoute.h:\n* Source/WebCore/testing/MockMediaDeviceRoute.idl:\n* Source/WebCore/testing/MockMediaDeviceRoute.mm:\n(WebCore::MockMediaDeviceRoute::connected const):\n* Source/WebCore/testing/cocoa/WebMockMediaDeviceRoute.h:\n* Source/WebCore/testing/cocoa/WebMockMediaDeviceRoute.mm:\n(-[WebMockMediaDeviceRoute isConnected]):\n(-[WebMockMediaDeviceRoute startWithURL:completionHandler:]):\n(-[WebMockMediaDeviceRoute stop]):\n\nCanonical link: https://commits.webkit.org/317186@main",
      "email": "aestes@apple.com",
      "hash": "29e6190b2cd7afe4e1d13b6a6cbbff9f5d820416",
      "subject": "[iOS] Video continues playing on wireless device after navigating to a new webpage"
    },
    "317188@main": {
      "author": "Dan Hecht",
      "avatar": "https://www.gravatar.com/avatar/080f47d912b1b34d0be8293f825d132d?d=identicon\u0026s=64",
      "cl": "317188@main",
      "clUrl": "https://commits.webkit.org/317188@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319401\nrdar://182229562\n\nReviewed by Marcus Plutowski and Yusuke Suzuki.\n\nExtend the zero_mode coverage to branches that were only ever exercised with\na single zero_mode (so they would pass even if the field were mishandled),\non both the simple and fast heaps:\n\n- a fresh source chunk coalescing (find_by_end -\u003e pas_large_free_create_merged)\n  with an adjacent existing free of a differing mode, feeding the result and\n  the leftover;\n- best-fit selecting among candidate frees of differing modes (the winner's\n  mode flows to the result and its leftover; the unchosen free is untouched);\n- a free coalescing with two neighbors at once (all eight three-way mode\n  combinations, across both heaps' differing fold orders);\n- a zero-size allocation returning is_all_zero.\n\nTests: Source/bmalloc/libpas/src/test/LargeFreeHeapTests.cpp:\n\n* Source/bmalloc/libpas/src/test/LargeFreeHeapTests.cpp:\n(std::testFreshChunkCoalesceZeroMode):\n(std::testBestFitCandidateZeroMode):\n(std::testThreeWayCoalesceZeroMode):\n(std::testZeroSizeAllocationIsAllZero):\n(addLargeFreeHeapTests):\n\nCanonical link: https://commits.webkit.org/317188@main",
      "email": "dan.hecht@apple.com",
      "hash": "1ebad5b591a41ffa838ca3b6a63aea19e8587799",
      "subject": "[libpas] Test zero_mode edge cases in LargeFreeHeapTests"
    },
    "317189@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "317189@main",
      "clUrl": "https://commits.webkit.org/317189@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319386\nrdar://182215726\n\nReviewed by Vitor Roriz.\n\nThe grid formatting context integration does not yet know how to resolve\nintrinsic (min-content/max-content/fit-content) sizing on the grid\ncontainer itself. When such a value reaches the constraint resolution in\nminimumSizeConstraint()/maximumSizeConstraint(), it falls into the\nunimplemented branch and hits ASSERT_NOT_IMPLEMENTED_YET().\n\nTo avoid this let's not run GFC if we the grid falls into this category\nof content.\n\nCanonical link: https://commits.webkit.org/317189@main",
      "email": "sammy.gill@apple.com",
      "hash": "3c7bab6db8614242d5c6c6068b7081ef9dd9f2d7",
      "subject": "[GFC][Integration] Disable GFC when grid has content based min/max sizes"
    },
    "317190@main": {
      "author": "Sergey Rubanov",
      "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64",
      "cl": "317190@main",
      "clUrl": "https://commits.webkit.org/317190@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=270257\n\nReviewed by Yusuke Suzuki.\n\nWhen both operands of a shift are constants, BBQ folded with a raw C++\nshift. Shift counts outside [0, 31] / [0, 63] are C++ undefined behavior,\nso BBQ could disagree with OMG/IPInt (e.g. 0x7fffffff \u003e\u003e 536870909\nproduced 0 in BBQ vs 3 elsewhere). WebAssembly defines shift amounts\nmodulo the bit width; B3 already masks when folding.\n\nMask constant shift counts in BBQ folding: i32 \u0026 31, i64 \u0026 63.\n\n* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:\n(BBQJIT::addI32Shl):\n(BBQJIT::addI32ShrS):\n(BBQJIT::addI32ShrU):\n* Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp:\n(BBQJIT::addI64Shl):\n(BBQJIT::addI64ShrS):\n(BBQJIT::addI64ShrU):\n* JSTests/wasm/stress/bbq-const-fold-shift-mask.js: Added. Covers the bug\nPoC (i32) and an i64 analog.\n\nCanonical link: https://commits.webkit.org/317190@main",
      "email": "chi187@gmail.com",
      "hash": "f854abcc8468cc480403e228da57b42ccbbee009",
      "subject": "[WASM] BBQ JIT omits mask before shr operation"
    },
    "317191@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317191@main",
      "clUrl": "https://commits.webkit.org/317191@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319333\nrdar://182148993\n\nReviewed by Devin Rousso.\n\nWI.RemoteObject.prototype.getCollectionEntries ignored the `error`\nargument in its RuntimeAgent.getCollectionEntries reply handler and\nunconditionally called `entries.map(...)`. When the backend returns an\nerror (e.g. the collection's object was released or the target\nnavigated, so its objectId is stale), `entries` is undefined and the\nhandler throws \"TypeError: undefined is not an object\", which is\nswallowed by the backend dispatcher and leaves the callback never\ninvoked.\n\nThat crash also masks the intended error path: both ObjectTreeView and\nObjectTreePropertyTreeElement wrap the callback with an `if (!list)`\ncheck that shows \"Could not fetch properties. Object may no longer\nexist.\", but the exception fires before that handler ever runs.\n\nGuard on `error` and pass null to the callback, matching the existing\n_getPropertyDescriptorsResolver pattern and the callers' `!list` error\nhandling. Null (rather than an empty array) is required so the tree\nviews surface the error instead of silently rendering \"No Entries\".\n\nSince the callback can now receive null, also harden the collection\nentry node-preview path, which previously assumed a non-null array:\nObjectPreviewView's remoteObjectAccessor dereferenced `entries[0]`\nunconditionally, and FormattedValue's node-highlight consumer called\npushNodeToFrontend() on the resulting remote object. Both now bail out\non a null result instead of throwing.\n\nWithout fix, we timeout on the attached test case.\n\nTest: inspector/model/remote-object-get-collection-entries-error.html\n\n* LayoutTests/inspector/model/remote-object-get-collection-entries-error-expected.txt: Added.\n* LayoutTests/inspector/model/remote-object-get-collection-entries-error.html: Added.\n* Source/WebInspectorUI/UserInterface/Protocol/RemoteObject.js:\n(WI.RemoteObject.prototype.getCollectionEntries):\n* Source/WebInspectorUI/UserInterface/Views/ObjectPreviewView.js:\n(WI.ObjectPreviewView.prototype._appendCollectionEntryNodePreview):\n* Source/WebInspectorUI/UserInterface/Views/FormattedValue.js:\n(WI.FormattedValue.createElementForNodePreview):\n\nCanonical link: https://commits.webkit.org/317191@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "ee7a441e1017219ba935cc967cf7dc0734d93526",
      "subject": "Web Inspector: RemoteObject.getCollectionEntries crashes on protocol error instead of reporting it"
    },
    "317192@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "317192@main",
      "clUrl": "https://commits.webkit.org/317192@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319368\nrdar://182172439\n\nReviewed by Devin Rousso.\n\nWI.Gradient parsing had two related defects that caused gradient strings\nto round-trip incorrectly through the gradient editor:\n\n1. stopsWithComponents() used `if (!stop.offset)` to detect a missing\n offset, which also matched a legitimate parsed offset of 0. Any\n explicit `0%` stop that was not first was silently discarded and\n recomputed as an evenly-spaced offset.\n\n2. RadialGradient.fromComponents() detected the optional sizing prefix by\n testing `WI.Color.fromString(components[0].join(\" \"))`. When the first\n color stop carried an offset (e.g. `red 50%`), the joined string was\n not a valid color, so the first stop was wrongly consumed as sizing.\n\nOnly default the offset when it is missing (using `??=`), and detect\nradial sizing from only the first token (sizing keywords such as\n`circle`, `ellipse`, and `at` are never colors).\n\n* LayoutTests/inspector/model/gradient-expected.txt:\n* LayoutTests/inspector/model/gradient.html: Added linear, radial, and\nconic round-trip cases covering an explicit 0% stop.\n* Source/WebInspectorUI/UserInterface/Models/Gradient.js:\n(WI.Gradient.stopsWithComponents):\n(WI.RadialGradient.fromComponents):\n\nCanonical link: https://commits.webkit.org/317192@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "464c1e3bad1c026c8afab9ddb63a4774f0655f43",
      "subject": "Web Inspector: gradient editor drops explicit 0% color stops and mis-parses leading radial color stops"
    },
    "317193@main": {
      "author": "Marta Darbinyan",
      "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64",
      "cl": "317193@main",
      "clUrl": "https://commits.webkit.org/317193@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319410\nrdar://182236368\n\nUnreviewed test Gardening\n\nUpdating test expectation\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/317193@main",
      "email": "darbinyan@apple.com",
      "hash": "917682ebaab5b55935d33cfdae0901564df21bee",
      "subject": "[Gardening]: NEW TEST(316740@main): [macOS] TestWebKitAPI.PasteImage.PasteFileWhileNetworkProcessIsLaunching is a constant failure"
    }
  },
  "date": "2026-07-14",
  "days": 1,
  "generatedAt": "2026-07-14T22:06:38Z",
  "markdown": "## Highlights\n- **GPU** WebGPU subgroups landed, unlocking shader-level parallel primitives and moving WebKit closer to modern compute workloads. [commit 317145@main](https://commits.webkit.org/317145@main)\n- **Web Platform** `wrap-inside` and `white-space-trim` both landed, expanding CSS Text 4 control over line breaking and whitespace handling. [commit 317182@main](https://commits.webkit.org/317182@main) [commit 317172@main](https://commits.webkit.org/317172@main)\n- **Rendering** Grid and flexbox work was dense: intrinsic width fast paths, stale-size fixes, resolved track listing fixes, and content-based sizing safeguards should make layout both faster and less surprising. [commit 317063@main](https://commits.webkit.org/317063@main) [commit 317166@main](https://commits.webkit.org/317166@main) [commit 317165@main](https://commits.webkit.org/317165@main) [commit 317189@main](https://commits.webkit.org/317189@main)\n- **Security** Site Isolation picked up a real product knob and a pasteboard fix for cross-origin subframes on macOS, tightening both rollout control and isolation correctness. [commit 317180@main](https://commits.webkit.org/317180@main) [commit 317150@main](https://commits.webkit.org/317150@main)\n- **Perf** Large rendering wins landed in LBSE and Coordinated graphics, cutting repeated clip-path rebuilds and improving damage tracking. [commit 317143@main](https://commits.webkit.org/317143@main) [commit 317137@main](https://commits.webkit.org/317137@main) [commit 317142@main](https://commits.webkit.org/317142@main)\n- **Media** Safari media behavior got noticeably saner on Apple platforms, with fixes for wireless playback persistence, wrong route names, overlapping Spotify previews, and better caption cue selection. [commit 317186@main](https://commits.webkit.org/317186@main) [commit 317107@main](https://commits.webkit.org/317107@main) [commit 317159@main](https://commits.webkit.org/317159@main) [commit 317168@main](https://commits.webkit.org/317168@main)\n- **DevTools** Web Inspector had a big cleanup pass across CSS parsing, formatting, storage, HAR export, tables, probes, and heap snapshots, with a lot of papercuts disappearing in one day. [commit 317192@main](https://commits.webkit.org/317192@main) [commit 317167@main](https://commits.webkit.org/317167@main) [commit 317161@main](https://commits.webkit.org/317161@main) [commit 317130@main](https://commits.webkit.org/317130@main)\n- **V8** JavaScriptCore kept pushing on async iteration, dynamic import, TypedArray plumbing, and Temporal correctness, with a mix of throughput and conformance work. [commit 317115@main](https://commits.webkit.org/317115@main) [commit 317132@main](https://commits.webkit.org/317132@main) [commit 317162@main](https://commits.webkit.org/317162@main) [commit 317087@main](https://commits.webkit.org/317087@main)\n\n## What landed by area\n\n### Web Inspector\n- **DevTools** Gradient editor now preserves explicit `0%` stops and correctly parses leading radial stops. [commit 317192@main](https://commits.webkit.org/317192@main)\n- **DevTools** `RemoteObject.getCollectionEntries` now reports protocol errors instead of crashing. [commit 317191@main](https://commits.webkit.org/317191@main)\n- **DevTools** Autocomplete no longer doubles vendor prefixes like `-apple--apple-system`. [commit 317167@main](https://commits.webkit.org/317167@main)\n- **DevTools** Box shadow parsing now accepts valid fractional, scientific-notation, and uppercase-unit lengths. [commit 317161@main](https://commits.webkit.org/317161@main)\n- **DevTools** HTML pretty-printing no longer mis-treats `\u003ccanvas\u003e` as a void element and scramble fallback nesting. [commit 317157@main](https://commits.webkit.org/317157@main)\n- **DevTools** Heap snapshot diffs now stride node fields correctly instead of comparing against the wrong layout. [commit 317156@main](https://commits.webkit.org/317156@main)\n- **DevTools** HAR export stops inventing a bogus remote port when none exists. [commit 317155@main](https://commits.webkit.org/317155@main)\n- **DevTools** Table visibility logic lost an off-by-one and `showColumn` no longer throws on the last hidden column case. [commit 317154@main](https://commits.webkit.org/317154@main)\n- **DevTools** Cookie inspection for Site Isolation is now wired to the UIProcess Storage domain. [commit 317130@main](https://commits.webkit.org/317130@main)\n- **DevTools** The Storage domain work for cookie inspection moved forward in the backend. [commit 317129@main](https://commits.webkit.org/317129@main)\n- **DevTools** Column resizer dragging no longer computes `left: NaNpx`. [commit 317125@main](https://commits.webkit.org/317125@main)\n- **DevTools** A token tracking test now checks the selected marker instead of a leaked loop variable. [commit 317124@main](https://commits.webkit.org/317124@main)\n- **DevTools** MIME type parsing now strips quotes from quoted charset values. [commit 317120@main](https://commits.webkit.org/317120@main)\n- **DevTools** Duplicate `get overriddenUserPreferences()` shadowing in `CSSManager` was removed. [commit 317119@main](https://commits.webkit.org/317119@main)\n- **DevTools** Formatted source locations now keep the column number. [commit 317111@main](https://commits.webkit.org/317111@main)\n- **DevTools** Probe manager no longer drops probes when several probe actions change at once. [commit 317088@main](https://commits.webkit.org/317088@main)\n- **DevTools** Stylesheet resource cache now invalidates when resources are added or change type. [commit 317084@main](https://commits.webkit.org/317084@main)\n\n### Rendering and CSS\n- **Rendering** GFC gained a columns-only fast path for intrinsic width computation. [commit 317063@main](https://commits.webkit.org/317063@main)\n- **Web Platform** `wrap-inside` from CSS Text 4 is now implemented. [commit 317182@main](https://commits.webkit.org/317182@main)\n- **Refactor** Flex layout now snapshots cross-axis border and padding on `FlexLayoutItem`. [commit 317183@main](https://commits.webkit.org/317183@main)\n- **Web Platform** `white-space-trim` support landed for `discard-before` and `discard-after`. [commit 317172@main](https://commits.webkit.org/317172@main)\n- **Rendering** Scroll anchoring fixes should stop jumpy scrolling on apple.com/retail. [commit 317169@main](https://commits.webkit.org/317169@main)\n- **Rendering** Grid item block sizes now stay fresh across subsequent layouts. [commit 317166@main](https://commits.webkit.org/317166@main)\n- **Rendering** Resolved grid track listings now reflect the right values. [commit 317165@main](https://commits.webkit.org/317165@main)\n- **Refactor** Flex layout now snapshots main-axis margins on `FlexLayoutItem` instead of a side array. [commit 317164@main](https://commits.webkit.org/317164@main)\n- **Rendering** EvaluationTimeZoom cleanup finished converting remaining style extractor users to unzoomed lengths. [commit 317152@main](https://commits.webkit.org/317152@main)\n- **Perf** LBSE now caches clip-path geometry instead of rebuilding it for every clipped shape on every frame. [commit 317143@main](https://commits.webkit.org/317143@main)\n- **Rendering** Damage unification got a fix for rectangles sharing a grid, plus a new `rectsForPainting()` helper. [commit 317137@main](https://commits.webkit.org/317137@main)\n- **UI** Spotify's queue pane animation no longer jumps when entering the screen. [commit 317136@main](https://commits.webkit.org/317136@main)\n- **Web Platform** `object-view-box` now affects rendering and natural sizes. [commit 317112@main](https://commits.webkit.org/317112@main)\n- **Web Platform** `random-item()` grammar substitution logic was factored into a shared helper following the `attr()` pattern. [commit 317104@main](https://commits.webkit.org/317104@main)\n- **Refactor** Flexible box core sizing now takes `FlexLayoutItem` directly. [commit 317099@main](https://commits.webkit.org/317099@main)\n- **UI** Safari now scrolls to linked GitHub issue comments correctly. [commit 317098@main](https://commits.webkit.org/317098@main)\n\n### JavaScriptCore, WASM, and bindings\n- **V8** BBQ JIT now masks before shift-right, fixing a WASM codegen bug. [commit 317190@main](https://commits.webkit.org/317190@main)\n- **V8** Async generator queues now use `JSSlimPromiseReaction`. [commit 317181@main](https://commits.webkit.org/317181@main)\n- **V8** `TypedArray.of` moved from builtin JS into C++. [commit 317162@main](https://commits.webkit.org/317162@main)\n- **Build** JSC constants were modernized from `extern const` to C++17 `inline constexpr`. [commit 317148@main](https://commits.webkit.org/317148@main)\n- **V8** LLInt now records `IterationMode::Generic` for iterator next ops. [commit 317147@main](https://commits.webkit.org/317147@main)\n- **V8** Arrow function expression bodies no longer emit unreachable implicit returns. [commit 317146@main](https://commits.webkit.org/317146@main)\n- **V8** Repeated dynamic imports now skip a redundant `resolve()` in `HostLoadImportedModule`. [commit 317132@main](https://commits.webkit.org/317132@main)\n- **V8** `forEachInIterable` gained a cross-realm `Array` fast path. [commit 317121@main](https://commits.webkit.org/317121@main)\n- **Security** `Integrity::isSanePointer()` now checks alignment for typed pointers. [commit 317118@main](https://commits.webkit.org/317118@main)\n- **Perf** `Strong\u003cT\u003e` was tightened to stay pointer-sized. [commit 317117@main](https://commits.webkit.org/317117@main)\n- **V8** Async generators got cooperative driving support. [commit 317115@main](https://commits.webkit.org/317115@main)\n- **Bindings** `ForAllParents` now prunes cleanly when `beforeRecursion` asks for it instead of crashing. [commit 317097@main](https://commits.webkit.org/317097@main)\n- **Bindings** Async-iterable argument conversion no longer references a nonexistent `castedThis`. [commit 317096@main](https://commits.webkit.org/317096@main)\n- **Perf** `pairIntHash` now extracts the correct bits from its 64-bit product, improving distribution. [commit 317095@main](https://commits.webkit.org/317095@main)\n- **Build** `CodeGenerator.pm` now formats duplicate-extended-attribute errors correctly. [commit 317094@main](https://commits.webkit.org/317094@main)\n- **Build** `generate-bindings-all.pl` now notices supplemental dependency changes even when list size stays the same. [commit 317093@main](https://commits.webkit.org/317093@main)\n- **Refactor** `ListHashSetLink` assertions in `insertAfter()` and `insertBefore()` were corrected. [commit 317092@main](https://commits.webkit.org/317092@main)\n- **Build** EnabledByQuirk assertion checking now looks at the right extended attribute. [commit 317091@main](https://commits.webkit.org/317091@main)\n- **V8** Temporal fixed non-ISO calendar bugs in `CalendarICUBridge`. [commit 317087@main](https://commits.webkit.org/317087@main)\n\n### GPU, graphics, and WebGL\n- **GPU** WebGPU subgroups landed. [commit 317145@main](https://commits.webkit.org/317145@main)\n- **GPU** WebGPU is now enabled by default on VMs. [commit 317144@main](https://commits.webkit.org/317144@main)\n- **Rendering** Coordinated compositing now damages layers when state changes alter composited output. [commit 317142@main](https://commits.webkit.org/317142@main)\n- **Security** A data race between main and scrolling threads in `CoordinatedSceneState::m_layers` was fixed. [commit 317141@main](https://commits.webkit.org/317141@main)\n- **GPU** ANGLE fixed WebGL shader compilation for `out` and `inout` on newer Metal. [commit 317176@main](https://commits.webkit.org/317176@main)\n- **GPU** GTK and WPE Skia compositing now renders into a renderbuffer instead of a texture. [commit 317149@main](https://commits.webkit.org/317149@main)\n- **GPU** WebGL2 no longer crashes on `drawElements` with `UNSIGNED_INT` indices and mis-sized element array buffers. [commit 317110@main](https://commits.webkit.org/317110@main)\n- **Refactor** Pixel buffer code was unified into a `TypedArrayPixelBuffer` template. [commit 317108@main](https://commits.webkit.org/317108@main)\n\n### Media, WebRTC, and platform UX\n- **Mobile** On iOS, video no longer keeps playing on a wireless device after navigation. [commit 317186@main](https://commits.webkit.org/317186@main)\n- **Media** Caption selection can now find the cue nearest the video's playhead. [commit 317168@main](https://commits.webkit.org/317168@main)\n- **Media** Notifications stop serializing an uninitialized `direction` when options are absent. [commit 317160@main](https://commits.webkit.org/317160@main)\n- **Media** Safari no longer auto-plays overlapping song previews when returning Home on Spotify. [commit 317159@main](https://commits.webkit.org/317159@main)\n- **Mobile** iOS got a build fix. [commit 317109@main](https://commits.webkit.org/317109@main)\n- **Mobile** Wireless playback placards now show the correct route name more reliably. [commit 317107@main](https://commits.webkit.org/317107@main)\n- **Media** AV video capture now skips packed-Bayer ProRes RAW formats when generating capture presets. [commit 317085@main](https://commits.webkit.org/317085@main)\n- **UI** AppKit gestures gained a way to detect whether a point is over a scrollbar. [commit 317122@main](https://commits.webkit.org/317122@main)\n\n### Site Isolation, page loading, storage, and security\n- **Security** WebKit now has a Site Isolation opt-in and opt-out flag. [commit 317180@main](https://commits.webkit.org/317180@main)\n- **Security** DOM paste access in cross-origin subframes on macOS now actually grants pasteboard access when intended. [commit 317150@main](https://commits.webkit.org/317150@main)\n- **Web Platform** `sessionStorage` now gets cleared between test iterations to stop state bleed. [commit 317163@main](https://commits.webkit.org/317163@main)\n- **Security** `loadDataWithNavigationShared` can now load files under the base URL reliably. [commit 317113@main](https://commits.webkit.org/317113@main)\n- **Security** A new document can no longer incorrectly share a `BrowsingContextGroup` with a back/forward-cached page. [commit 317103@main](https://commits.webkit.org/317103@main)\n- **Security** `hasEntitlementValueInArray()` no longer leaks values returned by `SecTaskCopyValueForEntitlement()`. [commit 317102@main](https://commits.webkit.org/317102@main)\n- **Security** Quarantine checks now use the parsed file URL instead of reparsing the path. [commit 317101@main](https://commits.webkit.org/317101@main)\n- **Security** `UUID::parse` now rejects a leading `+` in the third segment. [commit 317089@main](https://commits.webkit.org/317089@main)\n- **Security** `isUserVisibleURL()` now inspects the correct bytes for percent escapes and `xn--`. [commit 317086@main](https://commits.webkit.org/317086@main)\n\n### Platform features, standards, and flags\n- **Web Platform** `WorkerInSharedWorkerEnabled` is now marked stable. [commit 317139@main](https://commits.webkit.org/317139@main)\n- **Web Platform** `HeadingOffsetEnabled` is now marked stable. [commit 317138@main](https://commits.webkit.org/317138@main)\n- **Web Platform** `FileSystemHandleSerializationEnabled` is now marked stable on Cocoa. [commit 317135@main](https://commits.webkit.org/317135@main)\n- **Web Platform** Web Animations now applies a pending playback rate when auto-aligning start time. [commit 317127@main](https://commits.webkit.org/317127@main)\n- **Web Platform** A flaky custom elements registry WPT case was fixed up. [commit 317158@main](https://commits.webkit.org/317158@main)\n- **Web Platform** Resize Observer coverage improved by splitting a broad WPT into separate tests. [commit 317175@main](https://commits.webkit.org/317175@main)\n- **Rendering** Scroll snap tests were resynced from upstream WPT. [commit 317170@main](https://commits.webkit.org/317170@main)\n\n### Build, testing, ports, and infrastructure\n- **Build** WPE docs now include compiling against the WPE platform. [commit 317185@main](https://commits.webkit.org/317185@main)\n- **Refactor** Unneeded `CocoaImage*` using declarations were removed. [commit 317184@main](https://commits.webkit.org/317184@main)\n- **Build** Image analysis feature flags were unified. [commit 317174@main](https://commits.webkit.org/317174@main)\n- **Build** WebContentAnalysis selectors were updated to avoid Audit SPI Use warnings. [commit 317173@main](https://commits.webkit.org/317173@main)\n- **Build** `WKWebView.InputChangeFiresOnWindowBlur` now waits for activity state updates. [commit 317177@main](https://commits.webkit.org/317177@main)\n- **Build** libpas got another batch of `zero_mode` edge-case coverage. [commit 317188@main](https://commits.webkit.org/317188@main)\n- **Build** libpas added split-then-recoalesce `zero_mode` coverage. [commit 317171@main](https://commits.webkit.org/317171@main)\n- **Build** libpas added split preservation `zero_mode` coverage. [commit 317151@main](https://commits.webkit.org/317151@main)\n- **Build** WPE WebKitTestRunner gained `EventSender.asyncTouch*` helpers. [commit 317140@main](https://commits.webkit.org/317140@main)\n- **Build** `WKBackForwardListTests.mm` duplicates were merged into one file. [commit 317134@main](https://commits.webkit.org/317134@main)\n- **Perf** CMake gained a `mac-performance` preset with PGO and LTO support. [commit 317133@main](https://commits.webkit.org/317133@main)\n- **Build** Recent internal SDK build issues were fixed in CMake. [commit 317128@main](https://commits.webkit.org/317128@main)\n- **Refactor** An unused image text-selection variable was removed. [commit 317123@main](https://commits.webkit.org/317123@main)\n- **Build** GTK Brazilian Portuguese translations were updated. [commit 317131@main](https://commits.webkit.org/317131@main)\n- **Build** WPE and GTK test gardening landed for 2026-07-13. [commit 317114@main](https://commits.webkit.org/317114@main)\n- **Build** Intel WPT server startup was repaired after dependency breakage. [commit 317106@main](https://commits.webkit.org/317106@main)\n- **Build** A follow-up fixed the internal SDK CMake build. [commit 317105@main](https://commits.webkit.org/317105@main)\n- **Build** Feedback-driven follow-up work landed for [commit 316044@main](https://commits.webkit.org/316044@main). [commit 317100@main](https://commits.webkit.org/317100@main)\n\n### Accessibility and test stability\n- **A11y** Voice Control and Inspector now report the correct tree-item level for nested `treeitem` content inside a plain `\u003cul\u003e`. [commit 317178@main](https://commits.webkit.org/317178@main)\n- **Build** A persistent PasteImage API test failure on macOS was marked with a new test while it is investigated in [bug 319410](https://bugs.webkit.org/show_bug.cgi?id=319410). [commit 317193@main](https://commits.webkit.org/317193@main)\n- **Build** Several `WebKitLegacy` debug-assert regressions were fixed. [commit 317153@main](https://commits.webkit.org/317153@main)\n- **Build** Site Isolation multi-webview loading coverage improved with a second-webview test path. [commit 317126@main](https://commits.webkit.org/317126@main)\n- **Build** A macOS Debug assertion in a cross-origin opener policy WPT was fixed. [commit 317090@main](https://commits.webkit.org/317090@main)\n\n## Reverts \u0026 Reapplies\n\nNone.",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [],
  "since": "2026-07-14",
  "totals": {
    "commits": 110,
    "features": 110,
    "rolls": 0
  },
  "until": "2026-07-14"
}