{ "commits": { "315921@main": { "author": "Marcus Plutowski", "avatar": "https://www.gravatar.com/avatar/0dc4fa1c337348e333de44505752edb8?d=identicon\u0026s=64", "cl": "315921@main", "clUrl": "https://commits.webkit.org/315921@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=316145\nrdar://178568125\n\nReviewed by Yusuke Suzuki and Keith Miller.\n\nThis patch includes two major changes:\n 1. Add a basic-heap-config option for MTE tagging\n 2. Remove the small-medium tagging distinction\n\nLibpas does not tag objects belonging to every pas-heap. Formerly, this\ndecision was effectively made globally, with specific \"opt-outs\"; by\ndefault, every basic-heap was opted in to MTE tagging. In production,\nthe only basic-heaps in use are ones that we intend to use for MTE\nobjects; the non-MTE-tagged heaps are also non-basic heaps (JIT,\nutility). However, this is not true for testing where e.g. the iso-heap\nconfiguration should not be MTE tagged, but is. This is also something\nwe intend to run in production in the future, so it behooves us to\nprepare the ground now by cleaning this up.\nNow, instead of relying on opt-outs, each basic-heap-config has a\nparameter that indicates whether its objects are eligible for tagging.\n\nDuring the initial deployment of MTE, libpas allowed for certain\nconfigurations to only tag small objects, with medium-and-larger objects\nremaining untagged. With the introduction of guard objects, which only\nprotect objects 32k and larger, it does not make sense to leave a gap\nbetween small (\u003c~12k) and marge (\u003e32k) objects that is protected by\nneither mechanism. As such, the small-medium distinction has been\nunused, and will not be useful going forward. This patch removes it.\n\nThis was previously landed as https://commits.webkit.org/315921@main,\nbut was revereted due to sometimes triggering tag-check-on-dealloc\nfailures in debug runs. On investigation the issue is with\ntag-check-on-dealloc itself, and a proper fix will require splitting up\nthe tagged- and untagged- bmalloc heaps, which in turn depends on this\npatch - so for now we just disable that check.\n\nNo new tests since this behavior is covered by libpas' existing MTE\ntagging policy tests.\n\n* Source/bmalloc/libpas/src/libpas/bmalloc_heap_config.h:\n* Source/bmalloc/libpas/src/libpas/pas_heap_config_utils.h:\n* Source/bmalloc/libpas/src/libpas/pas_mte.h:\n* Source/bmalloc/libpas/src/libpas/pas_mte_config.c:\n(pas_mte_do_initialization):\n(pas_report_config):\n* Source/bmalloc/libpas/src/libpas/pas_mte_config.h:\n* Source/bmalloc/libpas/src/libpas/pas_runtime_config.h:\n* Source/bmalloc/libpas/src/libpas/tagged_bmalloc_heap_config.h:\n* .gitignore:\n\nCanonical link: https://commits.webkit.org/317420@main", "email": "marcus_plutowski@apple.com", "hash": "133a8c3c230164787e5316d8c50dbc1c57d5e7c4", "subject": "[libpas] Rework per-heap tagging policy logic" }, "317357@main": { "author": "Zak Ridouh", "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64", "cl": "317357@main", "clUrl": "https://commits.webkit.org/317357@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=316121\nrdar://178548327\n\nReviewed by Alex Christensen.\n\nisFullyActive only walked LocalFrame ancestors and treated a RemoteFrame\nparent as \"no LocalFrame parent, therefore top, therefore fully active\".\nA same-origin descendant of a remote iframe was thus reported fully active\neven after the iframe had been removed in the parent process.\n\nWalk the entire ancestor chain in a single pass instead. The document is\nfully active only if the chain reaches the page's main frame without a\nbreak. A RemoteFrame ancestor's document lives in another process and\ncannot be queried directly, but when its iframe is removed in the parent\nprocess the cross-process teardown severs its parent link, leaving a\nparentless RemoteFrame that is not the page's main frame; that is the\nsignal the walk uses to report the document as not fully active. Live\nancestors, including chains with multiple RemoteFrames (a -\u003e b -\u003e c\nnesting across processes), still walk through to the main frame and remain\nfully active.\n\nFixes audiocontext-not-fully-active.html under site isolation.\n\n* LayoutTests/platform/ios-site-isolation/TestExpectations:\n* LayoutTests/platform/mac-site-isolation/TestExpectations:\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::isFullyActive const):\n\nCanonical link: https://commits.webkit.org/317357@main", "email": "zakr@apple.com", "hash": "f6cdbc2a485f5a310d537186509fe9a996df390c", "subject": "[Site Isolation] Fix Document::isFullyActive ignoring RemoteFrame ancestors" }, "317358@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "317358@main", "clUrl": "https://commits.webkit.org/317358@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318628\n\nReviewed by Antti Koivisto.\n\nperformContentSizing ended by walking the flex lines to record each line's cross-axis position and\naccumulate the row container's content height. That walk is line placement, not the 9.3-9.4 content\nsizing the lambda is named for, and the height it produced was held in a flexContainerLogicalHeight\nlocal passed unconditionally to updateLogicalHeightForFlexContent even though only row flow uses it\n(the callee re-derived isColumnFlow to decide whether to apply it).\n\nHoist that loop to a plain block between performContentSizing and performContentAlignment, next to the\nwork that consumes it. Rename the accumulated height to contentLogicalHeightForRowFlow and make it a\nstd::optional engaged only for row flow, so column never seeds it. updateLogicalHeightForFlexContent\nnow takes that optional and applies it when present rather than re-checking the flow, matching how the\ninter-line gap total (0 for column) and the empty-line minimum (already optional) are handled.\n\nNo change in behavior: the loop runs at the same point (nothing executes between the old and new\nspots), and the height is still set for row flow and skipped for column flow.\n\n* Source/WebCore/rendering/RenderFlexLayout.cpp:\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n\nCanonical link: https://commits.webkit.org/317358@main", "email": "zalan@apple.com", "hash": "7067b785e06bf4d2942b1d3612a628b5525cc0ab", "subject": "[cleanup] Move flex line positioning out of content sizing and pass the row content height as an optional" }, "317359@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317359@main", "clUrl": "https://commits.webkit.org/317359@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=307790\nrdar://170309749\n\nReviewed by Antoine Quint.\n\nAn SVG subject's offset is mapped with localToContainerPoint(), which always\napplies the element's SVG transform, but its size came from the local\nbounding box and ignored that transform. The two were measured in different\nspaces, so a transformed subject (e.g. a rotated \u003cforeignObject\u003e) got a wrong\nrange. Map the local box through localToContainerQuad() so the size accounts\nfor the transform too. CSS transforms stay ignored, as the mapping omits\nMapCoordinatesMode::UseTransforms.\n\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/view-timelines/svg-graphics-element-003-expected.txt:\n* Source/WebCore/animation/ViewTimeline.cpp:\n(WebCore::ViewTimeline::cacheCurrentTime):\n\nCanonical link: https://commits.webkit.org/317359@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "7f0fc065d7d7760463a1456ae449b4057c4d3dd8", "subject": "[scroll-animations] View timeline on a transformed SVG element uses the untransformed subject size" }, "317360@main": { "author": "Nikolas Zimmermann", "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64", "cl": "317360@main", "clUrl": "https://commits.webkit.org/317360@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319611\n\nReviewed by Carlos Alberto Lopez Perez.\n\ncurl is invoked with no resilience options, so a single degraded TCP flow stalls a\nbuild indefinitely. On WPE-WK2-Tests-EWS build 136197 a 248 MB archive downloaded\nat ~30 KB/s for 95 minutes, ETA 2:21:29, while a fresh curl from the same pod\nfetched the same URL at 6.4 MB/s. Nothing terminates such a transfer: the step's\n1200s timeout is an inactivity timeout, kept alive by curl's own progress meter.\n\nGive curl a speed floor so a collapsed flow aborts and retries on a new\nconnection. All options predate curl 7.12.3 (released 2004), so macOS and Linux\nshould both be fine.\n\n* Tools/CISupport/download-built-product:\n(main): Pass --retry, --retry-delay, --speed-limit and --speed-time to curl.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) \u003cnoreply@anthropic.com\u003e\nCanonical link: https://commits.webkit.org/317360@main", "email": "nzimmermann@igalia.com", "hash": "73cb0de3225e21121063a3afb6733e9db3b4f64f", "subject": "[CISupport] download-built-product hangs for hours on a collapsed connection" }, "317361@main": { "author": "Marta Darbinyan", "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64", "cl": "317361@main", "clUrl": "https://commits.webkit.org/317361@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319273\nrdar://182115695\n\nUnreviewed test gardening\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/317361@main", "email": "darbinyan@apple.com", "hash": "6b2ebc175fb71612c671da16e83339c7500392cf", "subject": "[Gardening]: REGRESSION(316854@main): [macOS Debug] ASSERTION FAILED: !m_waitingForMessage in imported/w3c/web-platform-tests/html/cross-origin-opener-policy/resource-popup.https.html" }, "317362@main": { "author": "Zak Ridouh", "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64", "cl": "317362@main", "clUrl": "https://commits.webkit.org/317362@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317473\nrdar://180098320\n\nReviewed by Alex Christensen.\n\napplyAutocorrection sends ApplyAutocorrection / SyncApplyAutocorrection to the\nmain frame's process. When the focused text field is in a cross-origin iframe\nthat is the wrong process, so the correction is applied to the wrong frame or\ndropped entirely and accepting an autocorrection in the iframe input does nothing.\n\nRoute both overloads to the process containing the focused frame, matching\nexecuteEditCommand and insertTextAsync.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n* Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm:\n(WebKit::WebPageProxy::applyAutocorrection):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, ApplyAutocorrectionInCrossOriginIframe)):\n\nCanonical link: https://commits.webkit.org/317362@main", "email": "zakr@apple.com", "hash": "df87ca31e545b6f34a660bcaeb1951adec9f9345", "subject": "[Site Isolation][iOS] Fix autocorrection not being applied to inputs in cross-origin iframes" }, "317363@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "317363@main", "clUrl": "https://commits.webkit.org/317363@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319624\nrdar://182448235\n\nReviewed by Yijia Huang.\n\nWe were subscribing promise-watchpoint on op_async_iterator_open but not\nin op_async_iterator_next, that's not correct since we may change this\ncondition in the Generic path of op_async_iterator_open, and still we\nmay hit the fast path in the op_async_iterator_next. We align much more\nto the op_iterator_open / op_iterator_next (did a bit cleanup too). And\nnow whenever we emit IterationMode::FastAsyncGenerator fast path, we\nalways subscribe the watchpoint.\n\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::ByteCodeParser::handleIteratorOpen):\n(JSC::DFG::ByteCodeParser::handleIteratorNext):\n(JSC::DFG::ByteCodeParser::handleAsyncIteratorOpen):\n(JSC::DFG::ByteCodeParser::handleAsyncIteratorNext):\n\nCanonical link: https://commits.webkit.org/317363@main", "email": "ysuzuki@apple.com", "hash": "ee99d3c4eb6b97db2b7ab60e56186f92a332b5db", "subject": "[JSC] op_async_iterator_next DFG should also subscribe promise-watchpoint" }, "317364@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "317364@main", "clUrl": "https://commits.webkit.org/317364@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317480\nrdar://180105216\n\nReviewed by Sosuke Suzuki.\n\nx86_64 move(TrustedImm32, register) uses xor for 0 creation, which\nclobbers cflag, causing a problem if cflag is used with cmov etc.\nThis patch adds moveWithoutClobberingFlags and use it when we need to\ncare about clfag. While moveWithoutClobberingFlags with TrustedImm64 is\nnot used right now, we may need it due to the exact same reason so\nadding it.\n\nTest: JSTests/stress/string-substr-int-min-length-clamp.js\n\n* JSTests/stress/string-substr-int-min-length-clamp.js: Added.\n(shouldBe):\n* Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h:\n(JSC::MacroAssemblerX86_64::moveWithoutClobberingFlags):\n(JSC::MacroAssemblerX86_64::moveConditionally32):\n(JSC::MacroAssemblerX86_64::moveConditionallyTest32):\n\nCanonical link: https://commits.webkit.org/317364@main", "email": "ysuzuki@apple.com", "hash": "12196a032b7678f9b8f60a483ae22c01cc14af97", "subject": "[JSC][DFG][x86_64] String.prototype.substr INT_MIN length clamp miscompile creates invalid JSString length and Release abort/OOB-read evidence" }, "317365@main": { "author": "Yijia Huang", "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64", "cl": "317365@main", "clUrl": "https://commits.webkit.org/317365@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319602\nrdar://182431498\n\nReviewed by Yusuke Suzuki.\n\nAdds JSC::getTemporalCalendarIdentifierWithISODefault matching the spec AO at [1],\nincluding step 1 (Temporal internal-slot fast path for PlainDate/PlainDateTime/\nPlainMonthDay/PlainYearMonth/ZonedDateTime).\n\nCallers of PrepareCalendarFields now invoke it explicitly at the call site\nso each spec step is visible (step 2.d then step 2.e), mirroring the spec's\nown two-AO sequence. Drops the CalendarRead template parameter from\nreadCalendarFieldsFromObject and readZonedDateTimeFieldsFromObject — the\nRead branch was doing work that belongs to the caller per spec, and after\nthis refactor every caller passes an already-resolved calendarId in.\n\nPure refactoring.\n\n[1] https://tc39.es/proposal-temporal/#sec-temporal-gettemporalcalendarslotvaluewithisodefault\n\nCanonical link: https://commits.webkit.org/317365@main", "email": "yijia_huang@apple.com", "hash": "615cb1ee94e2c1fc27ca7d12fe21da824d7f8e75", "subject": "[JSC][Temporal] Extract GetTemporalCalendarIdentifierWithISODefault as a shared helper" }, "317366@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "317366@main", "clUrl": "https://commits.webkit.org/317366@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317707\n\nReviewed by Keith Miller.\n\nMemory.prototype.type and the matching methods on Table, Global, and Tag\ncome from the js-types proposal, not the core WebAssembly JS API. They\nwere always installed before. Install them only when\nOptions::useWasmJSTypes is enabled, which defaults to false.\n\nDeclare the option in UnifiedWebPreferences.yaml (jscOptionName\nuseWasmJSTypes). Layout tests enable it via status: testable; JSTests\nuse requireOptions(\"--useWasmJSTypes=true\").\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/JavaScriptCore/wasm/js/WebAssemblyMemoryPrototype.cpp:\n* Source/JavaScriptCore/wasm/js/WebAssemblyTablePrototype.cpp:\n* Source/JavaScriptCore/wasm/js/WebAssemblyTablePrototype.h:\n* Source/JavaScriptCore/wasm/js/WebAssemblyGlobalPrototype.cpp:\n* Source/JavaScriptCore/wasm/js/WebAssemblyTagPrototype.cpp:\n* Source/JavaScriptCore/wasm/js/WebAssemblyTagPrototype.h:\n* JSTests/wasm/js-api/test_memory.js:\n* JSTests/wasm/js-api/table.js:\n* JSTests/wasm/js-api/global.js:\n* JSTests/wasm/js-api/memory64-js-api.js:\n* JSTests/wasm/js-api/table64-js-api.js:\n* JSTests/wasm/gc/js-api.js:\n* JSTests/wasm/stress/create-tag-from.js:\n* JSTests/wasm/v8/exceptions-type-reflection.js:\n\nCanonical link: https://commits.webkit.org/317366@main", "email": "chi187@gmail.com", "hash": "76340acb4d382e75459d2814e31cb803eff4f4de", "subject": "[JSC] Gate WebAssembly type() methods behind useWasmJSTypes" }, "317367@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "317367@main", "clUrl": "https://commits.webkit.org/317367@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319619\nrdar://182437580\n\nReviewed by Richard Robinson.\n\nThis responds to some API review feedback.\n\n* Source/WebKit/UIProcess/API/Cocoa/WKContentWorld.swift:\n(WKContentWorld.isInspectable): Deleted.\n* Source/WebKit/UIProcess/API/Cocoa/WKContentWorldConfiguration.h:\n\nCanonical link: https://commits.webkit.org/317367@main", "email": "achristensen@apple.com", "hash": "7b208b856d9d709bd9cc1309eaaf997ad25e8c2e", "subject": "Update Swift name of WKContentWorldConfiguration.isInspectable" }, "317368@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "317368@main", "clUrl": "https://commits.webkit.org/317368@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319557\n\nReviewed by Ryosuke Niwa.\n\n* Source/WTF/wtf/OverflowHandler.h:\n(WTF::CrashOnOverflow::crash):\n\nCanonical link: https://commits.webkit.org/317368@main", "email": "cdumez@apple.com", "hash": "44a788952a53a12c8d03b037425cd5aa4a7ba4b6", "subject": "CrashOnOverflow::overflowed() should be NODELETE" }, "317369@main": { "author": "Ronan Turner", "avatar": "https://www.gravatar.com/avatar/b0adc2e7c8739eb712598294baec9184?d=identicon\u0026s=64", "cl": "317369@main", "clUrl": "https://commits.webkit.org/317369@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319561\nrdar://182390424\n\nReviewed by Abrar Rahman Protyasha.\n\nThis adds a case to the style checker that prevents it from considering\nthe / operator within a __has_include line continuation line.\n\nNew unit tests are added that test this new behaviour.\n\nCanonical link: https://commits.webkit.org/317369@main", "email": "ronan_turner@apple.com", "hash": "451b595dfdafbc6df37f8f085a729e7fb1e3212b", "subject": "Fix __has_include line continuation false positive in C++ style checker" }, "317370@main": { "author": "Marcos Caceres", "avatar": "https://www.gravatar.com/avatar/d31c9c6a3b0af558a2945682020e5b90?d=identicon\u0026s=64", "cl": "317370@main", "clUrl": "https://commits.webkit.org/317370@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317931\nrdar://181330433\n\nReviewed by Ryosuke Niwa.\n\nanalyze-safer-cpp ignored clang's exit code, and its diagnostic regex matches\n\"error:\" but not \"fatal error:\", so a file that failed to compile was reported\nas \"OK\" with a zero exit. On a configured-but-unbuilt compile_commands tree\n(missing generated headers) every file \"passes\" without being analyzed.\n\nSurface a non-zero clang exit with no parsed diagnostic as an error, printing\nthe file and clang's output, so a compile failure fails the run instead of\npassing silently.\n\nCanonical link: https://commits.webkit.org/317370@main", "email": "marcosc@apple.com", "hash": "b008d85bb026f03ac31665a9f99536906c88bf77", "subject": "[SaferCPP] analyze-safer-cpp reports \"OK\" for files that fail to compile" }, "317371@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "317371@main", "clUrl": "https://commits.webkit.org/317371@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319585\n\nReviewed by Yusuke Suzuki.\n\n317012@main made asyncFromSyncIteratorContinueOrDone close the sync iterator\nwhen the awaited \"value\" of an iterator result is a rejected promise, but it\ndid so regardless of `done`. AsyncFromSyncIteratorContinuation[1] step 12 sets\nonRejected to undefined when done is true, since a finished iterator has\nnothing to close, so JSC ran `return` in a case where the spec (and V8) do not.\n\n let returnCount = 0;\n const it = { [Symbol.iterator]: () =\u003e ({\n next: () =\u003e ({ value: Promise.reject(new Error), done: true }),\n return() { returnCount++; return {}; }\n }) };\n (async () =\u003e { try { for await (const _ of it) {} } catch {} })();\n // JSC: returnCount === 1, expected 0\n\nOnly close the iterator on the rejected path when the microtask carries a\ndone: false result. closeOnRejection === false (%AsyncFromSyncIteratorPrototype%.return)\nis already handled by the builtin passing @undefined as the sync iterator.\n\n[1]: https://tc39.es/ecma262/#sec-asyncfromsynciteratorcontinuation\n\nTest: JSTests/stress/async-from-sync-iterator-done-rejected-no-close.js\n\n* JSTests/stress/async-from-sync-iterator-done-rejected-no-close.js: Added.\n(shouldBe):\n(makeIterable):\n(async test):\n(test.then):\n* Source/JavaScriptCore/runtime/JSMicrotask.cpp:\n(JSC::asyncFromSyncIteratorContinueOrDone):\n\nCanonical link: https://commits.webkit.org/317371@main", "email": "sosuke@bun.sh", "hash": "a6ca226ff9c3f9f4eb4d621a915aaa075ac2d221", "subject": "[JSC] `AsyncFromSyncIterator` should not close the sync iterator for a rejected value when done is true" }, "317372@main": { "author": "David Kilzer", "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64", "cl": "317372@main", "clUrl": "https://commits.webkit.org/317372@main", "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=315109\u003e\n\u003crdar://177445283\u003e\n\nReviewed by Elliott Williams.\n\nTestWebKitAPI's `TestIPC`, `TestWebKitAPI`, and `TestWebKitAPILibrary`\ntargets `#include` IPC and Shared testing headers using relative\nsearch paths from `Tools/TestWebKitAPI` back into `Source/WebKit`.\nEngineering Debug/Release builds find the headers locally in the\nsource tree, but Production builds compile against an installed SDK\nthat does not include the entire WebKit source tree, so the same\n`#include` lines fail to resolve. Install the headers from a single\nsource of truth so the `#include` style is identical for both build\ntypes.\n\n`Source/WebKit/Scripts/IPCTestingHeaders-input.xcfilelist` is the\ncanonical list of the WebKit IPC and Shared testing header paths,\nincluding the three IPC code-generator outputs (`MessageNames.h`,\n`GeneratedSerializers.h`, `PushClientConnectionMessages.h`). A new\n`Copy IPC Testing Headers` build phase copies each entry to the\npaired `IPCTestingHeaders-output.xcfilelist` destination, which\nresolves through a new `WK_IPC_TESTING_HEADERS_DEST_DIR` build\nsetting so engineering writes to `BUILT_PRODUCTS_DIR` and Production\nwrites to the SDK install location. TestWebKitAPI's\n`HEADER_SEARCH_PATHS` has the symmetric reader-side override so both\nbuilds resolve the `#include` at the same logical name. The phase\ndrives the existing `Source/WebKitLegacy/scripts/xcfilelist-copy.py`\n-- the same script the header-migration phases already use -- rather\nthan adding a new copy script.\n\nNo new tests since this change is not directly testable.\n\n* Source/WebKit/Configurations/Base.xcconfig:\n* Source/WebKit/Scripts/IPCTestingHeaders-input.xcfilelist: Add.\n* Source/WebKit/Scripts/IPCTestingHeaders-output.xcfilelist: Add.\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Configurations/Base.xcconfig:\n* Tools/TestWebKitAPI/Configurations/TestIPC.xcconfig:\n* Tools/TestWebKitAPI/Configurations/TestWebKitAPIBase.xcconfig:\n\nCanonical link: https://commits.webkit.org/317372@main", "email": "ddkilzer@apple.com", "hash": "85fdb55d1dce07e1db0f9c97ff1cdcddd95998d6", "subject": "[WebKit] Install IPC testing headers for TestWebKitAPI builds" }, "317374@main": { "author": "Megan Gardner", "avatar": "https://www.gravatar.com/avatar/b466a5bcbfabf4d82a8ecc595db5a531?d=identicon\u0026s=64", "cl": "317374@main", "clUrl": "https://commits.webkit.org/317374@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319634\nrdar://182458208\n\nReviewed by Jessica Cheung.\n\n::highlight() overlays were dropping text-shadow: computeStyleForPseudoElementStyle copied the pseudo's background, fill, and decoration styles but not its\nshadow, and even once that was set, coalesceAdjacentWithSameRanges — which merges the base and highlight segments covering the same range — carried over\neverything but textShadow, so it got thrown away before paint. Fixed both by setting style.textShadow from the pseudo style and propagating it from the frontmost\nhighlight during coalescing (gated on the highlight name so a plain unshadowed segment can't clobber a highlight's shadow).\n\ncustom-highlight-painting-text-shadow.html and\ncustom-highlight-painting-text-shadow-invalidation.html now pass\n\n* LayoutTests/TestExpectations:\n* Source/WebCore/rendering/StyledMarkedText.cpp:\n(WebCore::computeStyleForPseudoElementStyle):\n(WebCore::coalesceAdjacentWithSameRanges):\n\nCanonical link: https://commits.webkit.org/317374@main", "email": "megan_gardner@apple.com", "hash": "c00be874bede417883bba68e6fb69ef2686a4103", "subject": "[CSS Highlight API] ::highlight() does not apply text-shadow" }, "317375@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "317375@main", "clUrl": "https://commits.webkit.org/317375@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319273\nrdar://182115695\n\nReviewed by Chris Dumez.\n\n317090@main wasn't quite enough. We also need to prevent multiple calls to WebFrameProxy::waitForCertificateInfoFromNetworkProcess\nin case multiple frames are committing in fast succession.\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n* Source/WebKit/UIProcess/Network/NetworkProcessProxy.h:\n* Source/WebKit/UIProcess/WebFrameProxy.cpp:\n(WebKit::WebFrameProxy::waitForCertificateInfoFromNetworkProcess):\n(WebKit::WebFrameProxy::commitCertificateInfo):\n\nCanonical link: https://commits.webkit.org/317375@main", "email": "achristensen@apple.com", "hash": "5e99592ba2f7c5f8c8b88d05f888a08b7e21a762", "subject": "REGRESSION(316854@main): [macOS Debug] ASSERTION FAILED: !m_waitingForMessage in imported/w3c/web-platform-tests/html/cross-origin-opener-policy/resource-popup.https.html" }, "317376@main": { "author": "Antoine Quint", "avatar": "https://www.gravatar.com/avatar/9b3ef1e754f8d994f21ff67c660cbbe6?d=identicon\u0026s=64", "cl": "317376@main", "clUrl": "https://commits.webkit.org/317376@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319589\nrdar://182417407\n\nReviewed by Cameron McCormack.\n\nOnly the nearest parent with a `timeline-scope` [0] value matching the `animation-timeline`\nshould be considered as establishing a valid scope [1]. As such, we look for such an element\nin `StyleOriginatedTimelinesController::attachAnimation()` and pass it down to `determineTimelineForElement()`\nand `determineTreeOrder()` to determine what the matching timeline, if any, is.\n\n[0] https://drafts.csswg.org/scroll-animations-1/#timeline-scope\n[1] https://drafts.csswg.org/scroll-animations-1/#timeline-scoping\n\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/view-timeline-lookup-expected.txt:\n* Source/WebCore/animation/StyleOriginatedTimelinesController.cpp:\n(WebCore::StyleOriginatedTimelinesController::determineTreeOrder):\n(WebCore::StyleOriginatedTimelinesController::determineTimelineForElement):\n(WebCore::StyleOriginatedTimelinesController::attachAnimation):\n(WebCore::containsElement): Deleted.\n* Source/WebCore/animation/StyleOriginatedTimelinesController.h:\n\nCanonical link: https://commits.webkit.org/317376@main", "email": "graouts@webkit.org", "hash": "6819cd6b87a62c56a0f1ead43d286515aae65602", "subject": "[scroll-animations] only match `animation-timeline` to a timeline within the nearest `timeline-scope` element for that name" }, "317377@main": { "author": "Antoine Quint", "avatar": "https://www.gravatar.com/avatar/9b3ef1e754f8d994f21ff67c660cbbe6?d=identicon\u0026s=64", "cl": "317377@main", "clUrl": "https://commits.webkit.org/317377@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319593\nrdar://182421884\n\nReviewed by Cameron McCormack.\n\nThe CSS WG resolved [0] that deferred timelines should be represented as null through the bindings.\n\n[0] https://github.com/w3c/csswg-drafts/issues/13807#issuecomment-4390005560\n\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/animation-timeline-deferred-expected.txt:\n* Source/WebCore/animation/WebAnimation.cpp:\n(WebCore::WebAnimation::bindingsTimeline const):\n* Source/WebCore/animation/WebAnimation.h:\n(WebCore::WebAnimation::bindingsTimeline const): Deleted.\n\nCanonical link: https://commits.webkit.org/317377@main", "email": "graouts@webkit.org", "hash": "f603de5e005aee36ea1e79aa7a0b4a55ef5a07ff", "subject": "[scroll-animations] deferred timelines should be represented as null through the bindings" }, "317378@main": { "author": "Philippe Normand", "avatar": "https://www.gravatar.com/avatar/eef27203750af3510263cc29af21a16e?d=identicon\u0026s=64", "cl": "317378@main", "clUrl": "https://commits.webkit.org/317378@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319476\n\nReviewed by Xabier Rodriguez-Calvar.\n\nCheck the element factory name in addition to the element name.\n\n* Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:\n(WebCore::MediaPlayerPrivateGStreamer::configureVideoDecoder):\n\nCanonical link: https://commits.webkit.org/317378@main", "email": "philn@igalia.com", "hash": "ae7417b5d0b6b4369f21e208f2297262ee51ad20", "subject": "[GStreamer] Improve Qualcomm video decoder detection" }, "317379@main": { "author": "Alejandro G. Castro", "avatar": "https://www.gravatar.com/avatar/c8c6e17acbdf0549b05d6f7fc2c1c4dc?d=identicon\u0026s=64", "cl": "317379@main", "clUrl": "https://commits.webkit.org/317379@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319596\n\nReviewed by Fujii Hironori.\n\nThe scene state lock currently covers the compositor's entire per-layer flush\n(positions, transforms, animations, backing store and tile bookkeeping), so the\nscrolling thread's end-of-walk commit in flushPendingState() can wait for up to\na whole flush, milliseconds on layer-heavy pages, adding input latency.\n\nSplit the compositor's flush in two passes. The first pass, under the scene\nstate lock, applies only Change::Position and Change::BoundsOrigin to the\ntargets: positions are the only state committed by the scrolling thread, and\napplying them for the whole tree under a single lock hold is what keeps the\ncompositor from observing a half-committed set (bug 315185). The second pass\neverything else, runs without the scene state lock.\n\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.cpp:\n(WebCore::CoordinatedPlatformLayer::flushPositionChanges):\n(WebCore::CoordinatedPlatformLayer::flushCompositingStateOnTarget):\n(WebCore::CoordinatedPlatformLayer::flushCompositingStateOnSkiaTarget):\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.h:\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/CoordinatedSceneState.cpp:\n(WebKit::CoordinatedSceneState::flushCompositingState):\n\nCanonical link: https://commits.webkit.org/317379@main", "email": "alex@igalia.com", "hash": "a73186252db3bc5c0877e3ecb1764556efdb6dc9", "subject": "[GTK][WPE] The scrolling thread shouldn't block the compositor thread to flush compositing state" }, "317380@main": { "author": "Basuke Suzuki", "avatar": "https://www.gravatar.com/avatar/5192a1151c7575317affb7a4633f8d63?d=identicon\u0026s=64", "cl": "317380@main", "clUrl": "https://commits.webkit.org/317380@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319008\nrdar://181853035\n\nReviewed by Sam Sneddon.\n\nReland of 317331@main, which was reverted because it broke Xcode builds.\n\nThe WPT webtransport/ tests could not connect because the layout-test harness never launched the\nWPT WebTransport-over-HTTP/3 (webtransport-h3) QUIC server. The vendored aioquic-based server exists\nunder tools/webtransport/h3/ and upstream's `wpt serve` supports it, but it is opt-in and the harness\ndid not declare the port, pass the flag, check its liveness, or provision aioquic.\n\nWire the harness to launch the server and provision its dependency:\n\n- Declare a webtransport-h3 UDP port in the WPT config and pass --webtransport-h3 to `wpt serve`.\n- Provision aioquic through webkitpy's AutoInstall so a fresh checkout / CI bot needs no manual pip\n install. aioquic is the one dependency the h3 server needs that wpt does not vendor under\n tools/third_party, so it is registered alongside every other package in webkitpy/__init__.py.\n aioquic 1.2.0 needs a newer crypto stack than webkitpy pinned and AutoInstall keeps one version per\n package name, so this bumps the shared pins (pyOpenSSL -\u003e 24.3.0, cryptography -\u003e 44.0.3 -- the highest\n under pyOpenSSL's cryptography\u003c45 pin that still ships prebuilt wheels for every arch). AutoInstall only\n mutates the in-process sys.path, so WebPlatformTestServer imports aioquic to trigger provisioning and\n appends AutoInstall.directory to the `wpt serve` subprocess PYTHONPATH. The import is done inside\n WebPlatformTestServer.__init__ rather than at module scope: build scripts such as generate-xcfilelists\n import this module transitively with the autoinstaller disabled, so a top-level import would fail there\n with ModuleNotFoundError (this is what broke 317331@main).\n- Add a UDP-listener liveness check (QUIC is UDP; the inherited TCP connect() check never sees it) and\n exclude UDP ports from TCP device-forwarding. Both live in the HttpServerBase superclass, keyed off a\n per-mapping 'udp' flag, so WebPlatformTestServer no longer overrides ports_to_forward.\n\nWith the server running, un-skip the WebTransport tests that pass on Cocoa (connect, constructor,\ncongestion-control, csp, datagram-bad-chunk, incoming-multiple-streams, sendstream-bad-chunk,\nserver-certificate-hashes, in-removed-iframe) and add their expectations. The remaining tests stay\nskipped, grouped by reason. Skip the Cocoa-only suite on platform/glib (GTK/WPE have no QUIC/HTTP-3\nbackend; Windows already skips it) and on platform/mac-sequoia (the tests need the Network.framework\nQUIC SPI that ships on Tahoe but not Sequoia; open-source CI runs Tahoe).\n\nThis reland differs from 317331@main only in that aioquic is imported lazily inside\nWebPlatformTestServer.__init__ instead of at module scope, so build scripts that import this module\nwith the autoinstaller disabled no longer fail.\n\n* LayoutTests/imported/w3c/resources/config.json: Add the webtransport-h3 port.\n* LayoutTests/TestExpectations: Un-skip the passing WebTransport tests; group the remaining skips by reason.\n* LayoutTests/platform/glib/TestExpectations: Skip the Cocoa-only WebTransport suite on GTK/WPE.\n* LayoutTests/platform/mac-sequoia/TestExpectations: Skip the WebTransport suite on Sequoia (QUIC SPI is Tahoe-only).\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/*-expected.txt: Baselines for the un-skipped tests.\n* Tools/Scripts/libraries/webkitcorepy/webkitcorepy/__init__.py: Bump pyOpenSSL to 24.3.0 and collapse the\nper-Python cryptography branch into a single 44.0.3 pin to satisfy aioquic 1.2.0.\n* Tools/Scripts/libraries/resultsdbpy/resultsdbpy/__init__.py: Bump pyasn1_modules to 0.4.2 and\nservice_identity to 24.2.0 to match webkitpy's shared pins (both are imported in the same interpreter).\n* Tools/Scripts/webkitpy/__init__.py: Register aioquic 1.2.0 and its deps (pylsqpack, pyasn1,\npyasn1_modules, service_identity).\n* Tools/Scripts/webkitpy/layout_tests/servers/http_server_base.py:\n(HttpServerBase.ports_to_forward): Exclude UDP-flagged ports from TCP device forwarding.\n(HttpServerBase._is_server_running_on_all_ports): Validate UDP ports via the new listener probe.\n(HttpServerBase._is_udp_port_listening): Added.\n* Tools/Scripts/webkitpy/layout_tests/servers/http_server_base_unittest.py:\n(TestHttpServerBase.test_is_udp_port_listening): Added.\n* Tools/Scripts/webkitpy/layout_tests/servers/web_platform_test_server.py:\n(WebPlatformTestServer.__init__): Lazily import aioquic to provision it, append the autoinstall directory\nto the serve PYTHONPATH, pass --webtransport-h3, and flag the h3 mapping as UDP.\n(WebPlatformTestServer.ports_to_forward): Deleted.\n(WebPlatformTestServer._is_udp_port_listening): Deleted.\n(WebPlatformTestServer._is_server_running_on_all_ports): Deleted.\n(WebPlatformTestServer._spawn_process): Pass the aioquic-provisioned env to the wpt serve process.\n* Tools/Scripts/webkitpy/layout_tests/servers/web_platform_test_server_unittest.py:\n(TestWebPlatformTestServer.setUp): Deleted; the test harness already installs registered packages.\n\nCanonical link: https://commits.webkit.org/317380@main", "email": "basuke@apple.com", "hash": "def5811ff7a01689ac155dfdc6c619ae61778060", "subject": "[WebTransport] Run the WPT webtransport-h3 server in the layout test harness and enable the passing tests" }, "317381@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "317381@main", "clUrl": "https://commits.webkit.org/317381@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319370\n\nReviewed by Yusuke Suzuki.\n\nWhen backtracking a greedy character class that can match both BMP and\nnon-BMP characters under the unicode flag, backtrackCharacterClassGreedy\nrewinds to the start of the term and rematches count - 1 characters\nforward to recompute the index, because the width of the last matched\ncharacter is not fixed. This makes matching O(n^3) overall, while the\ninterpreter handles the same case in O(n^2):\n\n /[^\"]*X/u.test(\"\\u2014\" + \"a\".repeat(4000)) // JIT: ~9.5s, interpreter: 56ms\n\ntypescript-eslint's JSX detection regexp hits this path and makes\nprettier hang for ~10 seconds on real-world input.\n\nWe can step back in O(1) instead: since all term positions in unicode\nmode lie on code point boundaries, the last matched character occupied\ntwo code units iff the two code units preceding the current position\nform a surrogate pair. When the new match count is zero, we reload the\nbegin position from the frame instead. Also drop the storeToFrame of\nthe match count, which only existed so the rematch loop could reload it.\n\nThe example above now completes in 16ms (~600x), scaling as O(n^2).\n\nTests: JSTests/stress/regexp-unicode-greedy-charclass-backtrack-exhaustive.js\n JSTests/stress/regexp-unicode-greedy-charclass-backtrack-linear.js\n\n* JSTests/stress/regexp-unicode-greedy-charclass-backtrack-exhaustive.js: Added.\n(shouldBe):\n(checkSubject):\n(enumerate):\n* JSTests/stress/regexp-unicode-greedy-charclass-backtrack-linear.js: Added.\n(shouldBe):\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n\nCanonical link: https://commits.webkit.org/317381@main", "email": "sosuke@bun.sh", "hash": "d886174dfa9e1a4608f81260947531009eb1c31e", "subject": "[YARR] JIT backtracking of greedy variable-width character classes in unicode mode is `O(count)` per step" }, "317382@main": { "author": "Etienne Segonzac", "avatar": "https://www.gravatar.com/avatar/3566820d0ba7e035bc440dc736c17f0c?d=identicon\u0026s=64", "cl": "317382@main", "clUrl": "https://commits.webkit.org/317382@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319629\n\u003crdar://182258311\u003e\n\nReviewed by Mike Wyrzykowski.\n\nThe previous fix cleaned-up the Immersive Model's state when entering\nbfcache, causing it to stop rendering during the dismissal animation.\n\nInstead, do the clean-up when _restoring_ from the bfcache.\n\nTest: model-element/immersive/model-element-immersive-bfcache.html\n\n* LayoutTests/model-element/immersive/model-element-immersive-bfcache-expected.txt: Added.\n* LayoutTests/model-element/immersive/model-element-immersive-bfcache.html: Added.\nAdd a test covering the bfcache scenario.\n\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::setBackForwardCacheState):\n(WebCore::Document::resume):\nMove the call from the entering code path to the resume code path.\n\n* Source/WebCore/dom/DocumentImmersive.cpp:\n(WebCore::DocumentImmersive::didResumeFromBackForwardCache):\n(WebCore::DocumentImmersive::clearForBackForwardCache): Deleted.\n* Source/WebCore/dom/DocumentImmersive.h:\nRename the method to make it clearer.\n\nCanonical link: https://commits.webkit.org/317382@main", "email": "sgz@apple.com", "hash": "95a3baf67f8b4e1db929e2f9c4779fcb52d6bd67", "subject": "REGRESSION(316891@main): web env dismissal animation is jarring on navigation" }, "317383@main": { "author": "Jamie Murphy", "avatar": "https://www.gravatar.com/avatar/6b42429f4e7db820c9d55e550001567f?d=identicon\u0026s=64", "cl": "317383@main", "clUrl": "https://commits.webkit.org/317383@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=302211\n\nReviewed by Timothy Hatcher.\n\nPort the WebExtensionAPITest JavaScript API to C++. Some components, namely any that use a Promise, are still in Cocoa for now as most Promise handling is mostly platform-specific in JavaScriptCore (and thus it’s easier to just leave any promise or callback code in Cocoa). As well, this provides a way to generate the JS interfaces in C++, allowing for them to be built on more platforms besides Cocoa. This does not unify the files, as there’s only one API built at the moment.\n\n* Source/WebKit/CMakeLists.txt:\n* Source/WebKit/DerivedSources-output.xcfilelist:\n* Source/WebKit/DerivedSources.make:\n* Source/WebKit/Shared/Extensions/WebExtensionContentWorldType.h:\n(WebKit::toDebugString):\n* Source/WebKit/Shared/Extensions/WebExtensionEventListenerType.h:\n(WebKit::toAPIString):\n* Source/WebKit/Sources.txt:\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIEventCocoa.mm:\n(WebKit::WebExtensionAPIEvent::invokeListenersWithJSONArgument):\n* Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPITestCocoa.mm:\n(WebKit::WebExtensionAPITest::assertRejects):\n(WebKit::WebExtensionAPITest::assertResolves):\n(WebKit::WebExtensionAPITest::addTest):\n(WebKit::WebExtensionAPITest::startNextTest):\n(WebKit::scriptLocation): Deleted.\n(WebKit::WebExtensionAPITest::notifyFail): Deleted.\n(WebKit::WebExtensionAPITest::notifyPass): Deleted.\n(WebKit::WebExtensionAPITest::sendMessage): Deleted.\n(WebKit::WebExtensionAPITest::onMessage): Deleted.\n(WebKit::WebExtensionAPITest::onTestStarted): Deleted.\n(WebKit::WebExtensionAPITest::onTestFinished): Deleted.\n(WebKit::WebExtensionAPITest::runWithUserGesture): Deleted.\n(WebKit::WebExtensionAPITest::isProcessingUserGesture): Deleted.\n(WebKit::debugString): Deleted.\n(WebKit::WebExtensionAPITest::log): Deleted.\n(WebKit::WebExtensionAPITest::fail): Deleted.\n(WebKit::WebExtensionAPITest::succeed): Deleted.\n(WebKit::WebExtensionAPITest::assertTrue): Deleted.\n(WebKit::WebExtensionAPITest::assertFalse): Deleted.\n(WebKit::WebExtensionAPITest::assertDeepEq): Deleted.\n(WebKit::combineMessages): Deleted.\n(WebKit::WebExtensionAPITest::assertEquals): Deleted.\n(WebKit::WebExtensionAPITest::assertEq): Deleted.\n(WebKit::WebExtensionAPITest::assertThrows): Deleted.\n(WebKit::WebExtensionAPITest::assertSafe): Deleted.\n(WebKit::WebExtensionAPITest::assertSafeResolve): Deleted.\n(WebKit::WebExtensionAPITest::runTests): Deleted.\n(WebKit::WebExtensionAPITest::recordAssertionIfNeeded): Deleted.\n(WebKit::WebExtensionContextProxy::dispatchTestMessageEvent): Deleted.\n(WebKit::WebExtensionContextProxy::dispatchTestStartedEvent): Deleted.\n(WebKit::WebExtensionContextProxy::dispatchTestFinishedEvent): Deleted.\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPIEvent.h:\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPINamespace.h:\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPITest.cpp: Added.\n(WebKit::WebExtensionAPITest::scriptLocation):\n(WebKit::WebExtensionAPITest::invokeMethod):\n(WebKit::WebExtensionAPITest::notifyFail):\n(WebKit::WebExtensionAPITest::notifyPass):\n(WebKit::WebExtensionAPITest::sendMessage):\n(WebKit::WebExtensionAPITest::onMessage):\n(WebKit::WebExtensionAPITest::onTestStarted):\n(WebKit::WebExtensionAPITest::onTestFinished):\n(WebKit::WebExtensionAPITest::runWithUserGesture):\n(WebKit::WebExtensionAPITest::isProcessingUserGesture):\n(WebKit::WebExtensionAPITest::debugString):\n(WebKit::WebExtensionAPITest::log):\n(WebKit::WebExtensionAPITest::fail):\n(WebKit::WebExtensionAPITest::succeed):\n(WebKit::WebExtensionAPITest::assertTrue):\n(WebKit::WebExtensionAPITest::assertFalse):\n(WebKit::WebExtensionAPITest::assertDeepEq):\n(WebKit::WebExtensionAPITest::combineMessages):\n(WebKit::WebExtensionAPITest::assertEquals):\n(WebKit::WebExtensionAPITest::assertEq):\n(WebKit::WebExtensionAPITest::assertThrows):\n(WebKit::WebExtensionAPITest::assertSafe):\n(WebKit::WebExtensionAPITest::assertSafeResolve):\n(WebKit::WebExtensionAPITest::addTest):\n(WebKit::WebExtensionAPITest::runTests):\n(WebKit::WebExtensionAPITest::recordAssertionIfNeeded):\n(WebKit::WebExtensionContextProxy::dispatchTestMessageEvent):\n(WebKit::WebExtensionContextProxy::dispatchTestStartedEvent):\n(WebKit::WebExtensionContextProxy::dispatchTestFinishedEvent):\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPITest.h:\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPIWebPageNamespace.h:\n* Source/WebKit/WebProcess/Extensions/Bindings/JSWebExtensionWrapper.cpp:\n(WebKit::callWithArguments):\n(WebKit::toVector\u003cJSValueRef\u003e):\n(WebKit::toVector\u003cProtected\u003cJSValueRef\u003e\u003e):\n* Source/WebKit/WebProcess/Extensions/Bindings/JSWebExtensionWrapper.h:\n(WebKit::callObjectWithArguments):\n* Source/WebKit/WebProcess/Extensions/Bindings/Scripts/CodeGeneratorExtensions.pm:\n(_generateImplementationFile):\n(_installAutomaticExceptions):\n(_platformType):\n(_platformTypeConstructor):\n(_platformTypeVariableDeclaration):\n* Source/WebKit/WebProcess/Extensions/Bindings/Scripts/IDLAttributes.json:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPITest.idl:\n* Source/WebKit/WebProcess/Inspector/WasmDebuggerDispatcher.cpp:\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Tools/Scripts/webkitpy/style/checker.py:\n* Source/WebKit/Shared/Protected.h:\n(WebKit::Protected::context const):\n\nCanonical link: https://commits.webkit.org/317383@main", "email": "jmurphy@igalia.com", "hash": "1163f500e455c86ebf318d2d8db7e03310970ada", "subject": "Port WebExtensionAPITest to CPP" }, "317384@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "317384@main", "clUrl": "https://commits.webkit.org/317384@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319650\nrdar://182472828\n\nReviewed by Sosuke Suzuki.\n\nLet's have per-VM MicrotaskCallCache for async generator driver path.\nSince MicrotaskCallCache is no longer on the stack, we need to finalize\nthe MicrotaskCall when GC happens. When it is used on-stack, we do not\nneed it since everything is alive via conservative scanning. But now\nVM's one is not so we should purge invalid entries.\n\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n* Source/JavaScriptCore/heap/Heap.cpp:\n(JSC::Heap::finalizeUnconditionalFinalizers):\n* Source/JavaScriptCore/interpreter/MicrotaskCall.cpp:\n(JSC::MicrotaskCall::visitWeak):\n* Source/JavaScriptCore/interpreter/MicrotaskCall.h:\n* Source/JavaScriptCore/jit/JITCall.cpp:\n(JSC::JIT::emit_op_async_iterator_next):\n* Source/JavaScriptCore/jit/JITOperations.cpp:\n(JSC::JSC_DEFINE_JIT_OPERATION):\n* Source/JavaScriptCore/jit/JITOperations.h:\n* Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:\n(JSC::LLInt::LLINT_SLOW_PATH_DECL):\n* Source/JavaScriptCore/runtime/AsyncGeneratorPrototype.cpp:\n(JSC::asyncGeneratorNext):\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n* Source/JavaScriptCore/runtime/JSAsyncGenerator.h:\n* Source/JavaScriptCore/runtime/JSMicrotask.cpp:\n(JSC::enqueueAsyncGeneratorDriver):\n(JSC::asyncIteratorNextWithDriver):\n* Source/JavaScriptCore/runtime/JSMicrotask.h:\n* Source/JavaScriptCore/runtime/VM.cpp:\n(JSC::VM::VM):\n(JSC::VM::finalizeUnconditionally):\n* Source/JavaScriptCore/runtime/VM.h:\n(JSC::VM::syncResumeCallCache):\n\nCanonical link: https://commits.webkit.org/317384@main", "email": "ysuzuki@apple.com", "hash": "bafc1f2d7f1e8c6c2eb2ebc395c8f94af5f35c33", "subject": "[JSC] Introduce MicrotaskCallCache for async generator driver path" }, "317385@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "317385@main", "clUrl": "https://commits.webkit.org/317385@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318629\n\nReviewed by Antti Koivisto.\n\nupdateLogicalHeightForFlexContent bundled work that only row flow needs (set the container height to the\naccumulated line content extent, then add the inter-line gaps) with work both flows need (reserve a\nline's height if empty, then resolve the final height via updateLogicalHeight). Column flow passed a\nnullopt content height and a zero gap through it just to reach that shared tail.\n\nSplit it into setLogicalHeightForRowFlexContent, which the caller invokes only for row flow, and\nfinalizeFlexContainerLogicalHeight, which both flows call. The row content height now carries the\ninter-line gaps folded in, so the shared finalize is a clean tail and column flow no longer passes\nthrough the row-shaped path.\n\nThis reorders one thing for row flow: the empty-line floor now sees the content plus the inter-line gaps\nrather than the content alone, so max(content, floor) + gaps becomes max(content + gaps, floor). The two\ndiffer only when the accumulated content is shorter than a single line, which also requires the\nempty-line floor to apply, i.e. an editable root or a form control (button, select, input) flex\ncontainer that additionally wraps to multiple lines with a row-gap. That combination does not occur in\npractice, but it is not strictly a no-op, so it is called out here rather than claimed as\nbehavior-preserving. Column flow is unchanged.\n\n* Source/WebCore/rendering/RenderFlexLayout.cpp:\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n\nCanonical link: https://commits.webkit.org/317385@main", "email": "zalan@apple.com", "hash": "b08128c1727eb908c1fc248918bf17916e575d32", "subject": "[cleanup] Split the flex container logical-height update into a row content set and a shared finalize" }, "317386@main": { "author": "Anthony Tarbinian", "avatar": "https://www.gravatar.com/avatar/e2fb942081a29714985c48f402fa1788?d=identicon\u0026s=64", "cl": "317386@main", "clUrl": "https://commits.webkit.org/317386@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318459\nrdar://181257156\n\nReviewed by Sihui Liu.\n\nThe following tests are timing out with site isolation enabled:\n\nhttp/tests/security/webaudio-render-remote-audio-allowed-crossorigin-redirect.html\nhttp/tests/security/webaudio-render-remote-audio-allowed-crossorigin.html\nhttp/tests/security/webaudio-render-remote-audio-blocked-no-crossorigin-redirect.html\nhttp/tests/security/webaudio-render-remote-audio-blocked-no-crossorigin.html\n\n```\ncontext.resume().then(() =\u003e { // ← promise stays pending\n audio.play(); // ← never called\n});\n```\n\nAudioContext first asks the UIProcess if it has playback permission.\nHowever, there is a race where AudioContext asks the UIProcess about\nplayback permission before the RemoteMediaSessionState is registered with the UIProcess.\n\nIn terms of IPC messages, the UI process receives MediaSessionWillBeginPlayback\nbefore AddMediaSession (comes from setActive(true)).\n\nIf the RemoteMediaSessionState doesn't exist in MediaSessionWillBeginPlayback, then\nRemoteMediaSessionManagerProxy::mediaSessionWillBeginPlayback will call\ncompletionHandler(false). This leads to AudioContext::resumeRendering\nto be called with willBegin == false and the resume() promise is stored\nuntil some point when the context starts running again.\nThis storage of the promise is what causes the resume() promise to\nhang in the test JS.\n\nsetActive(true) ran synchronously before clientWillBeginPlayback() until\nclientWillBeginPlayback was made asynchronous. Restore that ordering by calling\nsetActive(true) before clientWillBeginPlayback(), matching\nHTMLMediaElement::playInternal(). This sends AddMediaSession ahead of\nMediaSessionWillBeginPlayback so the UI-process manager can find the session.\n\nThe this fixes the following tests with site isolation enabled:\n\nhttp/tests/security/webaudio-render-remote-audio-allowed-crossorigin-redirect.html\nhttp/tests/security/webaudio-render-remote-audio-allowed-crossorigin.html\nhttp/tests/security/webaudio-render-remote-audio-blocked-no-crossorigin-redirect.html\nhttp/tests/security/webaudio-render-remote-audio-blocked-no-crossorigin.html\n\n* LayoutTests/platform/ios-site-isolation/TestExpectations:\n* Source/WebCore/Modules/webaudio/AudioContext.cpp:\n(WebCore::AudioContext::willBeginPlayback):\n\nCanonical link: https://commits.webkit.org/317386@main", "email": "atar137h@gmail.com", "hash": "e9850528706fa288a2c8d085abb961faf81a2872", "subject": "[Site Isolation] cross-origin tests in http/tests/security/webaudio-render-remote-audio-* are failing" }, "317387@main": { "author": "Nikolas Zimmermann", "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64", "cl": "317387@main", "clUrl": "https://commits.webkit.org/317387@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319615\n\nReviewed by Alejandro G. Castro.\n\nTake a damage region in paint() and limit the draws to it. No region paints\neverything, as before. An empty region paints nothing, because the target already\nholds the frame. Otherwise every content draw limits itself to the region's rects:\nthe backing store's tiles and the contents image split by rect and stay batched,\nthe solid color, the hole punch and the tiled shader draw once per rect, and the\ncomposite of a filtered or masked layer's intermediate surface is limited the same\nway.\n\nThe walk deliberately does not clip the canvas to the damage, because a clip of more\nthan one rect cannot be a scissor, so Skia would build a mask for it and break the\nbatching. Each draw limits itself instead, which is a convention every content type\nadded here has to follow. The subtree of a filtered layer keeps painting in full,\nbecause the filter samples outside the damage, and only the composite of its result\nis limited.\n\nA region that covers the whole surface is dropped for a full repaint. The region\nitself decides that, not its bounding box: two rects in opposite corners span a box\nthat covers the surface while the rects cover almost none of it.\n\nThe compositor still passes no region, so nothing is restricted yet.\nAdded a new API test to cover damaging + HiDPI.\n\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.cpp:\n(WebCore::SkiaCompositingLayer::paint):\n(WebCore::SkiaCompositingLayer::paintContents):\n(WebCore::SkiaCompositingLayer::paintWithIntermediateSurface):\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.h:\n* Source/WebCore/platform/graphics/skia/SkiaDamageRegion.h:\n(WebCore::SkiaDamageRegion::create):\n(WebCore::SkiaDamageRegion::SkiaDamageRegion):\n(WebCore::SkiaDamageRegion::operator=):\n(WebCore::SkiaDamageRegion::forEachDamagedSubRect const):\n(WebCore::SkiaDamageRegion::restrictDraw const):\n(WebCore::drawRectRestricted):\n(WebCore::drawImageRectRestricted):\n* Tools/TestWebKitAPI/Tests/WebCore/glib/SkiaCompositingLayerDamage.cpp:\n(TestWebKitAPI::TEST(SkiaCompositingLayerDamage, PartialRepaintRegionUnderHiDPIRestrictsToTheDamageRect)):\n\nCanonical link: https://commits.webkit.org/317387@main", "email": "nzimmermann@igalia.com", "hash": "be7c8392af688ba6d450a87ceeafbd63a7d70c20", "subject": "[Damage][Skia] Limit every content draw to the target's repaint region" }, "317388@main": { "author": "Sammy Gill", "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64", "cl": "317388@main", "clUrl": "https://commits.webkit.org/317388@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319626\nrdar://problem/182450492\n\nReviewed by Alan Baradlay.\n\nhttps://drafts.csswg.org/css-grid-1/#extra-space\n\nThis is the very first implementation and focuses the new function on\nspecifically distributing space to the base sizes of the tracks. The\nbasic idea is that we just through each item and the track is spans,\nthen add extra space to the tracks so that the total size of the area is\nenough to fit its contribution.\n\nSteps 2.3 and 2.4 (distribute to non-affected tracks / distribute beyond limits) are left as\nnotImplemented() lambdas since neither can fire for the reachable cases today: only items spanning\na single track are supported, and the affected flexible tracks that reach this step still have\ninfinite growth limits, so step 2.2 absorbs the entire space.\n\nCanonical link: https://commits.webkit.org/317388@main", "email": "sammy.gill@apple.com", "hash": "51ce0edf7d809f538fcd20dbf03b58c89bd473aa", "subject": "[GFC] Initial implementation of logic to disbribute extra space." }, "317389@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "317389@main", "clUrl": "https://commits.webkit.org/317389@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319576\nrdar://182407431\n\nReviewed by Youenn Fablet.\n\n315066@main made an incorrect assumption and skip on why removeCodedFramesInternal\ncan be called with an invalid end time.\nThe test added was skipped on debug when it shouldn't have been.\n\nIt is possible for the SourceBuffer's tracks to not overlap, as such the\nbuffered range after currentTime could be empty. This would have caused\nbuffered.maximumBufferedTime(); to return MediaTime::invalidTime and would\nhave caused the problem 315066@main attempted to fix.\n\nWe avoid the condition altogether by exiting the loop early if the buffered\nintersection is empty, this was likely the primary root cause for 315066@main.\n\nAdditionally, we optimised the loop by calculating the intersected range\nfrom the currentTime, so there's no need to skip unnecessarily the segments\nprior currentTime later.\n\nCovered by existing tests.\n\n* LayoutTests/TestExpectations:\n* Source/WebCore/platform/graphics/SourceBufferPrivate.cpp:\n(WebCore::SourceBufferPrivate::evictFrames):\n\nCanonical link: https://commits.webkit.org/317389@main", "email": "jya@apple.com", "hash": "281431c36b192d11bd39f636fcbe01988ddabde1", "subject": "[Debug] media/media-source/media-source-evict-invalid-time-crash.html is a permanent crash" }, "317390@main": { "author": "Dan Hecht", "avatar": "https://www.gravatar.com/avatar/080f47d912b1b34d0be8293f825d132d?d=identicon\u0026s=64", "cl": "317390@main", "clUrl": "https://commits.webkit.org/317390@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319621\nrdar://182446375\n\nReviewed by Keith Miller.\n\nThe \u003e= 1 MB zeroed path leaves pages zero-fill-on-demand (madvise(MADV_ZERO)\nor the mmap fallback), so a page is only observed zero when first faulted.\nThe other tests read and write ascending, so they only ever fault pages in\nascending order -- but a hashtable, the workload where this matters, reads\nits buckets in hash order, i.e. effectively at random.\n\nAdd a test that puts dirty data under a large region (allocate, dirty,\nfree), reallocates the same size so the zeroed path runs over that dirty\nbacking, then verifies the buffer reads zero while first-faulting its pages\nin ascending, descending, and deterministically shuffled orders, under both\nimmediate free-list reuse and forced decommit/recommit, across the\nthreshold and a multi-megabyte size. The reused-buffer check and the shared\nreuse case gain an optional FaultOrder parameter; the generic runs keep the\ndefault ascending scan.\n\n* Source/bmalloc/libpas/src/test/AllocationZeroingTests.cpp:\n(addAllocationZeroingTests):\n\nCanonical link: https://commits.webkit.org/317390@main", "email": "dan.hecht@apple.com", "hash": "da8482b85ac12c72d6c7c08d8c7e791db6d8642e", "subject": "[libpas] Verify large zeroed allocations under out-of-order page faults" }, "317391@main": { "author": "Dana Estra", "avatar": "https://www.gravatar.com/avatar/bb57a3e383fc407cd4b341aeef87d877?d=identicon\u0026s=64", "cl": "317391@main", "clUrl": "https://commits.webkit.org/317391@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319433\nrdar://182250995\n\nReviewed by Eric Carlson.\n\nCurrently, WebKit fails WebVTT WPT 2_cues_overlapping_partially_move_up.html\nand 2_cues_overlapping_partially_move_down.html. These tests check that when\na VTT file uses the line setting to position cues such that they overlap,\nthe browser moves the second cue as minimally as possible so that they do not overlap.\n\nThe rendered cues' top and bottom edges should be flush with each other, since the spec\nexpects the cue to be moved minimally and makes no indication that we should be\nrounding to the nearest integer. However, WebKit's rendering of these vtt files\nputs a gap between the two cues. This is caused by our use of integers in RenderVTTCue.\nWe should instead use floats.\n\nNo new test expectations due to bugs in the wpt tests that cause us to still fail them.\nOne a future patch fixes the tests the expectations will be updated.\n\n* Source/WebCore/rendering/RenderVTTCue.cpp:\n(WebCore::RenderVTTCue::unroundedAbsoluteBoundingBoxRect):\n(WebCore::RenderVTTCue::isOutside const):\n(WebCore::RenderVTTCue::rectIsWithinContainer const):\n(WebCore::RenderVTTCue::overlappingObject const):\n(WebCore::RenderVTTCue::overlappingObjectForRect const):\n(WebCore::RenderVTTCue::moveIfNecessaryToKeepWithinContainer):\n(WebCore::RenderVTTCue::findNonOverlappingPosition const):\n(WebCore::RenderVTTCue::repositionCueSnapToLinesNotSet):\n* Source/WebCore/rendering/RenderVTTCue.h:\n\nCanonical link: https://commits.webkit.org/317391@main", "email": "destra@apple.com", "hash": "41e9a94793ef26fa41fd5eaee3da722803f4d3ed", "subject": "VTT cue positioning algorithm should use floats instead of ints" }, "317392@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "317392@main", "clUrl": "https://commits.webkit.org/317392@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319594\n\nReviewed by Yusuke Suzuki.\n\nDataView.prototype.getBigInt64 / getBigUint64 / setBigInt64 / setBigUint64\nwere the only DataView accessors without JIT intrinsics, so every call was\na C++ host call.\n\nThis handles them as the byteSize == 8 integer case of the existing\nDataViewGetInt / DataViewSet nodes. Gets do the 64-bit load and byte swap\ninline and box the result via operationInt64ToBigInt / newly added\noperationUInt64ToBigInt. Sets speculate the value as HeapBigInt and store its\nlow 64 bits (toBigInt64), which is exactly the ToBigInt64 / ToBigUint64\nwrapping the spec requires.\n\n Baseline Patched\n\ndata-view-bigint64-byte-swap 146.5305+-4.5918 ^ 30.7756+-0.1811 ^ definitely 4.7613x faster\ndata-view-set-bigint64 127.1115+-1.1375 ^ 15.5786+-1.0692 ^ definitely 8.1593x faster\ndata-view-get-bigint64 135.3561+-0.8063 ^ 56.3917+-0.4440 ^ definitely 2.4003x faster\n\nTests: JSTests/microbenchmarks/data-view-bigint64-byte-swap.js\n JSTests/microbenchmarks/data-view-get-bigint64.js\n JSTests/microbenchmarks/data-view-set-bigint64.js\n JSTests/stress/dataview-jit-bigint64-byte-offset.js\n JSTests/stress/dataview-jit-bigint64-cse-and-aliasing.js\n JSTests/stress/dataview-jit-bigint64-type-check-failures.js\n JSTests/stress/dataview-jit-bigint64.js\n\n* JSTests/microbenchmarks/data-view-bigint64-byte-swap.js: Added.\n(byteSwap64):\n* JSTests/microbenchmarks/data-view-get-bigint64.js: Added.\n(getInt64):\n(getUint64):\n* JSTests/microbenchmarks/data-view-set-bigint64.js: Added.\n(setInt64):\n(setUint64):\n* JSTests/stress/dataview-jit-bigint64-byte-offset.js: Added.\n(shouldBe):\n(shouldThrow):\n(get dv):\n(set dv):\n* JSTests/stress/dataview-jit-bigint64-cse-and-aliasing.js: Added.\n(shouldBe):\n(getSetGet):\n(getTwice):\n(getArrayStoreGet):\n* JSTests/stress/dataview-jit-bigint64-type-check-failures.js: Added.\n(shouldBe):\n(shouldThrow):\n(get dv):\n(set dv):\n(shouldBe.get dv):\n* JSTests/stress/dataview-jit-bigint64.js: Added.\n(shouldBe):\n(shouldThrow):\n(toUint64):\n(toInt64):\n(refSetBigUint64):\n(getBE):\n(getDefault):\n(getVar):\n(setLE):\n(setBE):\n(setDefault):\n(setVar):\n(oobGet):\n(oobSet):\n(setAny):\n(shouldBe.view.getBigUint64):\n(shouldThrow.rget):\n(shouldThrow.rset):\n(gcGet):\n(view.setBigUint64):\n(setZero):\n* Source/JavaScriptCore/b3/B3AbstractHeapRepository.h:\n* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:\n(JSC::DFG::AbstractInterpreter\u003cAbstractStateType\u003e::executeEffects):\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::ByteCodeParser::handleIntrinsicCall):\n* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:\n(JSC::DFG::doesGC):\n* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:\n(JSC::DFG::FixupPhase::fixupNode):\n* Source/JavaScriptCore/dfg/DFGOperations.cpp:\n(JSC::DFG::JSC_DEFINE_JIT_OPERATION):\n* Source/JavaScriptCore/dfg/DFGOperations.h:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:\n(JSC::DFG::SpeculativeJIT::compile):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n* Source/JavaScriptCore/runtime/Intrinsic.h:\n* Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp:\n\nCanonical link: https://commits.webkit.org/317392@main", "email": "sosuke@bun.sh", "hash": "e164bce2e8884f242389930d9c0551d4b1f4ebb4", "subject": "[JSC] Handle `DataView` BigInt64 accessors in DFG / FTL" }, "317393@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "317393@main", "clUrl": "https://commits.webkit.org/317393@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319613\n\nReviewed by Keith Miller.\n\nAdd \"//@ skip if not $jitTests\" for skipping stress tests using\n`numberOfDFGComples` when JIT is unavailable to fix ARMv7 EWS.\n\n* JSTests/stress/promise-prototype-catch-on-non-promise.js:\n* JSTests/stress/regexp-prototype-symbol-search-on-non-regexp.js:\n* JSTests/stress/regexp-prototype-test-on-non-regexp.js:\n* JSTests/stress/string-replace-regexp-with-own-property.js:\n\nCanonical link: https://commits.webkit.org/317393@main", "email": "sosuke@bun.sh", "hash": "5b2603cac2fb410d3b8262f84b6daee4be199f7a", "subject": "[JSC] Skip stress tests using `numberOfDFGCompiles` when JIT is unavailable" }, "317394@main": { "author": "Shu-yu Guo", "avatar": "https://www.gravatar.com/avatar/3884544eb9e557e2ec917d32c6e12720?d=identicon\u0026s=64", "cl": "317394@main", "clUrl": "https://commits.webkit.org/317394@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319635\nrdar://182030086\n\nReviewed by Keith Miller.\n\nIn MacroAssemblerARM64, ldrb's signature is (RegisterID dest, RegisterID rn,\nRegisterID rm), where rn is the offset register and rm is the memory base\nregister.\n\nbranchTest{8,16} currently passes them in the opposite order, and this PR swaps\nit for clarity.\n\nThere is no test for this codegen.\n\n* Source/JavaScriptCore/assembler/MacroAssemblerARM64.h:\n(JSC::MacroAssemblerARM64::branchTest8):\n(JSC::MacroAssemblerARM64::branchTest16):\n\nCanonical link: https://commits.webkit.org/317394@main", "email": "syg@apple.com", "hash": "3fd024ddb79ba481ebe6a2e5d5c9a977f8c69e8e", "subject": "[JSC] Swap base and offset registers in branchTest{8,16}" }, "317395@main": { "author": "Antoine Quint", "avatar": "https://www.gravatar.com/avatar/9b3ef1e754f8d994f21ff67c660cbbe6?d=identicon\u0026s=64", "cl": "317395@main", "clUrl": "https://commits.webkit.org/317395@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319670\nrdar://182514341\n\nReviewed by Simon Fraser.\n\n* Source/WTF/wtf/SystemTracing.h:\n* Source/WTF/wtf/glib/SysprofAnnotator.h:\n* Source/WebKit/Resources/Signposts/SystemTracePoints.plist:\n* Source/WebKit/UIProcess/RemoteLayerTree/ios/RemoteScrollingCoordinatorProxyIOS.mm:\n(WebKit::RemoteScrollingCoordinatorProxyIOS::updateAnimationStacks):\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.mm:\n(WebKit::RemoteLayerTreeEventDispatcher::updateAnimations):\n\nCanonical link: https://commits.webkit.org/317395@main", "email": "graouts@webkit.org", "hash": "2603e9eb41f0328d1950d416bf9dea421e43f0df", "subject": "[threaded-animations] add tracing signposts for remote layer tree animation updates" }, "317396@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "317396@main", "clUrl": "https://commits.webkit.org/317396@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318989\nrdar://181841900\n\nReviewed by Jean-Yves Avenard.\n\nBefore this PR, RemoteMediaSessionManagerProxy was owned by the WebPageProxy\nand communicated with the RemoteMediaSessionManager in the main frame's process,\nand it had a bunch of RemotePageMediaSessionManagerProxy that forwarded messages\nfrom other frame's processes with site isolation enabled. This pattern works\nwell for many other objects owned by RemotePageProxy, but it doesn't work well\nfor RemoteMediaSessionManagerProxy because RemoteMediaSessionManagerProxy inherits\nfrom WebCore::AudioSession, which needs to have a singleton. This matches the\ndesign of AVAudioSession, and needs to stay that way because of the global nature\nof audio management on devices.\n\nIn RemoteMediaSessionManagerProxy's constructor, we call AudioSession::setSharedSession.\nBefore this PR, that set the RemoteMediaSessionManagerProxy of the most recently\ncreated WebPageProxy to be the effective singleton, which works if there's only\none WebPageProxy, but it caused issues like the crashes in rdar://180128876\nwhich I covered up with 316744@main but it needs a better fix. This is that fix.\n\nI made RemoteMediaSessionManagerProxy a global singleton that owns a map of\nRemoteMediaSessionProxy objects, each of which knows what process its\nRemoteMediaSessionManager lives in. RemoteMediaSessionProxy is now the message\nsender instead of RemoteMediaSessionManagerProxy, and each one sends to the\ncorrect process that initially sent RemoteMediaSessionManagerProxy::AddMediaSession.\n\nRemoteMediaSessionManagerProxy inherits from MediaSessionManagerCocoa which\nuses a WebCore::PageIdentifier to find a WebCore::Page to call\nhasActiveNowPlayingSessionChanged, and that abstraction doesn't work well\nwith RemoteMediaSessionManagerProxy being in the UI process where there is\nno WebCore::Page, so I made the PageIdentifier optional to skip that piece\nfor now, but a better abstraction is needed in a followup PR to use a client\nof some sort to call hasActiveNowPlayingSessionChanged.\n\nBefore and after this PR, RemoteMediaSessionManagerProxy sends 3 IPC messages.\nRemoteMediaSessionManager::SetCurrentMediaSession is sent to each process with\nnullopt indicating the current media session is in another process or the\nidentifier indicating it's in the receiving process. That is kept with this PR.\nSetAudioSessionCategory and SetAudioSessionPreferredBufferSize, though, are\nchanged from only sending to the main frame's process to sending to all\nRemoteMediaSessionManagers currently in the map.\n\nSince the key of m_sessionProxies comes from multiple processes and the\nMediaSessionIdentifier could collide, I make the key ProcessQualified and\nupdate all uses and findAndUpdateSession to use the process identifier of the\nprocess that sent IPC to prevent collisions and keep process scope to prevent\nprocesses from manipulating each other's media sessions.\n\nThis change should only affect browsing with site isolation or remote media session\nmanager enabled. This can be seen in the caller of RemoteMediaSessionManager::create\nwhich is protected by such checks.\n\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.cpp:\n(WebCore::MediaSessionManagerInterface::MediaSessionManagerInterface):\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.h:\n* Source/WebCore/platform/audio/PlatformMediaSessionManager.cpp:\n(WebCore::PlatformMediaSessionManager::PlatformMediaSessionManager):\n* Source/WebCore/platform/audio/PlatformMediaSessionManager.h:\n* Source/WebCore/platform/audio/cocoa/MediaSessionManagerCocoa.h:\n* Source/WebCore/platform/audio/cocoa/MediaSessionManagerCocoa.mm:\n(WebCore::MediaSessionManagerCocoa::MediaSessionManagerCocoa):\n(WebCore::MediaSessionManagerCocoa::removeSession):\n(WebCore::MediaSessionManagerCocoa::updateActiveNowPlayingSession):\n* Source/WebCore/platform/audio/ios/MediaSessionManagerIOS.h:\n* Source/WebCore/platform/audio/ios/MediaSessionManagerIOS.mm:\n(WebCore::MediaSessionManageriOS::MediaSessionManageriOS):\n* Source/WebKit/Sources.txt:\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionClientProxy.cpp:\n(WebKit::RemoteMediaSessionClientProxy::RemoteMediaSessionClientProxy):\n(WebKit::RemoteMediaSessionClientProxy::attachToSession):\n(WebKit::RemoteMediaSessionClientProxy::resumeAutoplaying):\n(WebKit::RemoteMediaSessionClientProxy::mayResumePlayback):\n(WebKit::RemoteMediaSessionClientProxy::suspendPlayback):\n(WebKit::RemoteMediaSessionClientProxy::setShouldPlayToPlaybackTarget):\n(WebKit::RemoteMediaSessionClientProxy::sessionManager const):\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionClientProxy.h:\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.cpp:\n(WebKit::RemoteMediaSessionManagerProxy::singleton):\n(WebKit::RemoteMediaSessionManagerProxy::RemoteMediaSessionManagerProxy):\n(WebKit::RemoteMediaSessionManagerProxy::~RemoteMediaSessionManagerProxy):\n(WebKit::RemoteMediaSessionManagerProxy::addMediaSession):\n(WebKit::RemoteMediaSessionManagerProxy::removeMediaSession):\n(WebKit::RemoteMediaSessionManagerProxy::setCurrentMediaSession):\n(WebKit::RemoteMediaSessionManagerProxy::mediaSessionStateChanged):\n(WebKit::RemoteMediaSessionManagerProxy::setCurrentSession):\n(WebKit::RemoteMediaSessionManagerProxy::mediaSessionWillBeginPlayback):\n(WebKit::RemoteMediaSessionManagerProxy::setCategory):\n(WebKit::RemoteMediaSessionManagerProxy::setPreferredBufferSize):\n(WebKit::RemoteMediaSessionManagerProxy::findAndUpdateSession):\n(WebKit::RemoteMediaSessionManagerProxy::sharedPreferencesForWebProcess const):\n(WebKit::RemoteMediaSessionManagerProxy::create): Deleted.\n(WebKit::RemoteMediaSessionManagerProxy::messageSenderConnection const): Deleted.\n(WebKit::RemoteMediaSessionManagerProxy::messageSenderDestinationID const): Deleted.\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.h:\n(WebKit::RemoteMediaSessionManagerProxy::process const): Deleted.\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.messages.in:\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionProxy.cpp:\n(WebKit::RemoteMediaSessionProxy::create):\n(WebKit::RemoteMediaSessionProxy::RemoteMediaSessionProxy):\n(WebKit::RemoteMediaSessionProxy::setShouldPlayToPlaybackTarget):\n(WebKit::RemoteMediaSessionProxy::messageSenderConnection const):\n(WebKit::RemoteMediaSessionProxy::messageSenderDestinationID const):\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionProxy.h:\n* Source/WebKit/UIProcess/RemotePageMediaSessionManagerProxy.cpp: Removed.\n* Source/WebKit/UIProcess/RemotePageMediaSessionManagerProxy.h: Removed.\n* Source/WebKit/UIProcess/RemotePageProxy.cpp:\n(WebKit::RemotePageProxy::disconnect):\n(WebKit::RemotePageProxy::injectPageIntoNewProcess):\n* Source/WebKit/UIProcess/RemotePageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::didAttachToRunningProcess):\n(WebKit::WebPageProxy::resetState):\n(WebKit::WebPageProxy::remoteMediaSessionManagerProxy): Deleted.\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::dispatchMessage):\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Source/WebKit/WebProcess/Media/RemoteMediaSessionManager.cpp:\n(WebKit::RemoteMediaSessionManager::create):\n* Source/WebKit/WebProcess/Media/RemoteMediaSessionManager.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::m_allowsImmersiveEnvironments):\n\nCanonical link: https://commits.webkit.org/317396@main", "email": "achristensen@apple.com", "hash": "e7b146fa58fb419bc30b75c26d988444564c3cc8", "subject": "Make RemoteMediaSessionManagerProxy a singleton" }, "317397@main": { "author": "Simon Fraser", "avatar": "https://www.gravatar.com/avatar/3763324aa0cdfa93be751c6081b8006a?d=identicon\u0026s=64", "cl": "317397@main", "clUrl": "https://commits.webkit.org/317397@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319616\nrdar://182443333\n\nReviewed by Alan Baradlay.\n\nThis test had arcs with a single radius, requiring us to implement the single-radius\nlogic \u003chttps://drafts.csswg.org/css-shapes-1/#typedef-shape-arc-command\u003e.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-masking/clip-path/clip-path-shape-011.html:\n* Source/WebCore/style/values/shapes/StyleShapeFunction.cpp:\n(WebCore::Style::resolveArcCommandRadius):\n(WebCore::Style::AcceleratedEffectShapeFunction::ArcCommand\u003e::operator):\n\nCanonical link: https://commits.webkit.org/317397@main", "email": "simon.fraser@apple.com", "hash": "feca486c220ec1dc5ea637cd00bb8f023777fcc1", "subject": "css/css-masking/clip-path/clip-path-shape-011.html fails" }, "317398@main": { "author": "Yury Semikhatsky", "avatar": "https://www.gravatar.com/avatar/d0aee26d9689e84bd1a7f0ed8f262fe1?d=identicon\u0026s=64", "cl": "317398@main", "clUrl": "https://commits.webkit.org/317398@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319632\n\nReviewed by Claudio Saavedra.\n\nBump libwpe to 1.16.0, wpebackend-fdo to 1.14.3 and libsoup to 3.6.5.\n\n* Tools/jhbuild/jhbuild-minimal.modules:\n\nCanonical link: https://commits.webkit.org/317398@main", "email": "yurys@chromium.org", "hash": "c702426da5335191121953b0f1691d828986b00b", "subject": "[JHBuild] Update libwpe, wpebackend-fdo and libsoup in the minimal moduleset" }, "317399@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "317399@main", "clUrl": "https://commits.webkit.org/317399@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319651\nrdar://182474262\n\nReviewed by Yijia Huang.\n\nWe are checking the surrogates like this.\n\n jit.load32(Address(...), resultReg);\n jit.and32AndSetFlags(surrogateTagMask, resultReg, temp);\n isBMP.append(jit.branch(Zero));\n slowCases.append(jit.branch32(NotEqual, temp, surrogatePairTags));\n\nPreviously, the surrogateTagMask was 0xdc00/0xdc00. Then 0xf800 etc. can\npass the above filter and incorrectly recognized as a surrogate. This\npatch fixes it by making surrogateTagMask 0xfc00/0xfc00 so we can correctly\nfilter out surrogates.\n\nTest: JSTests/stress/regexp-unicode-surrogate-mask.js\n\n* JSTests/stress/regexp-unicode-surrogate-mask.js: Added.\n(shouldBe):\n(i.cps.of.cases.a.toString):\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n(JSC::Yarr::tryReadUnicodeCharSlowImpl):\n\nCanonical link: https://commits.webkit.org/317399@main", "email": "ysuzuki@apple.com", "hash": "28426f73148a87823f5a1ffa0b2ef1bd9f658d2b", "subject": "[YARR] surrogateTagMask should be 0xfc00/0xfc00 instead of 0xdc00/0xdc00" }, "317400@main": { "author": "Nikolas Zimmermann", "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64", "cl": "317400@main", "clUrl": "https://commits.webkit.org/317400@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=315990\n\nReviewed by Alejandro G. Castro.\n\nWire the pieces together and start painting from the damage, if the feature\n'UseDamagingInformationForCompositing' is turned on (not yet on by default).\n\nEach frame's damage is recorded for the platform and into every swap-chain target,\nand the target, the frame is drawn into, brings its own record of what changed since\nit was last current. The two together are the region the frame is painted against:\neverything when there is no record or it covers the surface, nothing when the target\nalready holds the frame, and otherwise the clear and every draw are limited to its rects.\n\npaint() collects and draws in one call, so the compositor reads the target's record\nbefore painting and passes it as priorTargetDamage, to be folded there with this\nframe's freshly collected damage. Recording into the swap chain happens after paint()\nreturns, which is the same as recording before it, since paint() only reads the target\nit draws into.\n\nDebug borders and repaint counters are painted by the layer tree, but their setters\nstored the new state without damaging, unlike every other layer setter. Nothing\nrepainted them when they appeared or changed, and the frame that switched them off\nreported no damage for them at all, so they stayed on the targets. They now damage the\nlayer like any other state change, on both the Skia and the TextureMapper side, which\nis what lets a frame stay restricted to its damage while they show.\n\nThe FPS counter is drawn on top of the layer tree, so no layer damages it either, but\nit is a fixed box in the corner rather than something that can be anywhere. It damages\nits own box on the frames the count changes, together with the box drawn before, which\nis larger when the count gets shorter. Its geometry therefore has to be computed before\nthe frame is painted rather than while it is drawn. A counter that repainted more than\nits box would hide the cost it is there to measure - so we need to avoid that.\n\nThe damage visualizer and the overlay below cannot do the same, because they draw over\nthe damage itself: damaging what they drew would feed their own rects back into what\nthey show next, until it covers the surface. They repaint the frame in full instead,\nand the platform is told the whole surface changed - that's okay, since it's debug-only.\n\nWEBKIT_SHOW_DAMAGE keeps its name on the Skia path, so one variable shows the damage\nwhichever compositor is in use. It now draws a target's whole accumulated damage as a\ntranslucent green overlay, rather than the frame damage the compositor no longer paints\nfrom. Since it repaints in full, it shows what the damage is, not the compositor\nhonouring it.\n\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.cpp:\n(WebCore::SkiaCompositingLayer::paintedLayerRect const):\n(WebCore::SkiaCompositingLayer::setDebugIndicators):\n(WebCore::SkiaCompositingLayer::paint):\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.h:\n* Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp:\n(WebCore::TextureMapperLayer::setShowDebugBorder):\n(WebCore::TextureMapperLayer::setDebugBorderColor):\n(WebCore::TextureMapperLayer::setDebugBorderWidth):\n(WebCore::TextureMapperLayer::setShowRepaintCounter):\n(WebCore::TextureMapperLayer::setRepaintCount):\n* Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h:\n(WebCore::TextureMapperLayer::setShowDebugBorder): Deleted.\n(WebCore::TextureMapperLayer::setDebugBorderColor): Deleted.\n(WebCore::TextureMapperLayer::setDebugBorderWidth): Deleted.\n(WebCore::TextureMapperLayer::setShowRepaintCounter): Deleted.\n(WebCore::TextureMapperLayer::setRepaintCount): Deleted.\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/AcceleratedSurface.cpp:\n(WebKit::AcceleratedSurface::SwapChainDamageTracker::didPresent):\n(WebKit::AcceleratedSurface::backgroundColor):\n(WebKit::AcceleratedSurface::skiaClearColor):\n(WebKit::AcceleratedSurface::clear):\n(WebKit::clearCanvas): Deleted.\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/AcceleratedSurface.h:\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/LayerTreeHost.cpp:\n(WebKit::damageOverlayForcesPropagation):\n(WebKit::LayerTreeHost::LayerTreeHost):\n(WebKit::LayerTreeHost::attachLayer):\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/ThreadedCompositor.cpp:\n(WebKit::m_renderTimer):\n(WebKit::ThreadedCompositor::setDamagePropagationSettings):\n(WebKit::ThreadedCompositor::damageUsedForCompositing const):\n(WebKit::ThreadedCompositor::drawsOverlay const):\n(WebKit::ThreadedCompositor::paintToCurrentGLContext):\n(WebKit::ThreadedCompositor::paintToTextureMapper):\n(WebKit::ThreadedCompositor::recordFrameDamage):\n(WebKit::drawDamageOverlay):\n(WebKit::ThreadedCompositor::paintToSkiaCanvas):\n(WebKit::ThreadedCompositor::renderLayerTree):\n(WebKit::fpsCounterFont):\n(WebKit::fpsCounterPadding):\n(WebKit::ThreadedCompositor::fpsCounterRect const):\n(WebKit::ThreadedCompositor::updateFPSCounterGeometry):\n(WebKit::ThreadedCompositor::takeFPSCounterDamage):\n(WebKit::ThreadedCompositor::drawFPSCounter):\n(WebKit::ThreadedCompositor::drawSkiaDamage): Deleted.\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/ThreadedCompositor.h:\n\nCanonical link: https://commits.webkit.org/317400@main", "email": "nzimmermann@igalia.com", "hash": "48a050966d899df1be64b7b2d1860267742769cf", "subject": "[Damage][Skia] Composite only the damage" }, "317401@main": { "author": "Richard Robinson", "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64", "cl": "317401@main", "clUrl": "https://commits.webkit.org/317401@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319631\nrdar://182455133\n\nReviewed by Megan Gardner and Abrar Rahman Protyasha.\n\nThis logic was originally changed to use a range-based for loop instead of an index-based one since\nit was non-obvious that there could be functional differences between the two.\n\n`invokeAndRemovePendingHandlers()` iterates m_pendingHandlers with a range-based for loop, which caches\nthe Vector's begin/end raw pointers. The invoked callback can synchronously re-enter doAfterUpdate()\n(the design explicitly supports reentrancy via m_callbackDepth and tombstone slots), and doAfterUpdate()\ncalls m_pendingHandlers.constructAndAppend(), which reallocates the backing buffer once capacity is\nexceeded. That reallocation invalidates the cached loop iterators and the live slot reference, causing\na use-after-free read/write as the loop continues over freed memory.\n\nFix by restoring the index-based loop since it re-reads size() and re-indexes each iteration to survive reallocation.\n\n* Source/WebKit/UIProcess/mac/PositionInformationManager.cpp:\n(WebKit::PositionInformationManager::invokeAndRemovePendingHandlers):\n* Source/WebKit/UIProcess/mac/PositionInformationManager.h:\n\nCanonical link: https://commits.webkit.org/317401@main", "email": "richard_robinson2@apple.com", "hash": "94c5f976f8554fe62e2a274e713c22031507a0bf", "subject": "[AppKit Gestures] Fix incorrect logic in `PositionInformationManager::invokeAndRemovePendingHandlers` that could result in a reentrancy UAF" }, "317402@main": { "author": "Brent Fulgham", "avatar": "https://www.gravatar.com/avatar/c6989a65afef0d015b55c65406e37ccc?d=identicon\u0026s=64", "cl": "317402@main", "clUrl": "https://commits.webkit.org/317402@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=275048\nrdar://129495028\n\nReviewed by Anne van Kesteren and Ryosuke Niwa.\n\nThis change implements the popover='hint' feature. This is a small addition to the\nexisting popover feature added in a previous cycle. The implementation matches the\ncurrent specification and existing WPT expectations.\n\nhttps://github.com/whatwg/html/pull/9778\nhttps://open-ui.org/components/popover-hint.research.explainer/\n\nTested by existing imported/w3c/web-platform-tests/html/semantics/popovers test suite.\n\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-attribute-basic-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-events-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-hint-dialog-dismisses-unrelated-auto-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-hint-dialog-dismisses-unrelated-auto.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-hint-hierarchy-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-invoking-attribute-hint-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-light-dismiss-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-light-dismiss-hint-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-manual-hide-does-not-close-auto-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-manual-hide-does-not-close-auto.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-open-in-beforetoggle-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-remove-attribute-during-focusing-steps-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-top-layer-nesting-hints-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-types-with-hints-expected.txt:\n* LayoutTests/platform/gtk/imported/w3c/web-platform-tests/html/semantics/popovers/popover-light-dismiss-expected.txt:\n* LayoutTests/platform/ios-18/imported/w3c/web-platform-tests/html/semantics/popovers/popover-attribute-basic-expected.txt:\n* LayoutTests/platform/ios/imported/w3c/web-platform-tests/html/semantics/popovers/popover-attribute-basic-expected.txt:\n* LayoutTests/platform/ios/imported/w3c/web-platform-tests/html/semantics/popovers/popover-hint-hierarchy-expected.txt:\n* LayoutTests/platform/wpe/imported/w3c/web-platform-tests/html/semantics/popovers/popover-light-dismiss-expected.txt:\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::addPopoverToList):\n(WebCore::Document::removePopoverFromList):\n(WebCore::Document::addTopLayerElement):\n(WebCore::Document::removeTopLayerElement):\n(WebCore::Document::topmostHintPopover const):\n(WebCore::Document::nearestOpenHintAncestor const):\n(WebCore::Document::closeAllHintPopovers):\n(WebCore::Document::closeHintPopoversUntil):\n(WebCore::Document::hidePopoversForTopLayerElement):\n(WebCore::Document::hideAutoPopoversUntil):\n(WebCore::Document::handlePopoverLightDismiss):\n(WebCore::Document::hideAllPopoversUntil):\n* Source/WebCore/dom/Document.h:\n(WebCore::Document::needsPointerEventHandlingForPopoverOrDialog const):\n(WebCore::Document::isRunningPopoverShowOrHide const):\n(WebCore::Document::PopoverShowOrHideScope::PopoverShowOrHideScope):\n(WebCore::Document::PopoverShowOrHideScope::~PopoverShowOrHideScope):\n* Source/WebCore/dom/DocumentFullscreen.cpp:\n(WebCore::DocumentFullscreen::elementEnterFullscreen):\n* Source/WebCore/dom/Element.cpp:\n(WebCore::Element::topmostPopoverAncestor):\n* Source/WebCore/dom/Element.h:\n* Source/WebCore/dom/PopoverData.h:\n(WebCore::PopoverData::showingAsHint const):\n(WebCore::PopoverData::setShowingAsHint):\n(WebCore::PopoverData::hintStackParent const):\n(WebCore::PopoverData::setHintStackParent):\n* Source/WebCore/html/HTMLDialogElement.cpp:\n(WebCore::HTMLDialogElement::show):\n(WebCore::HTMLDialogElement::showModal):\n* Source/WebCore/html/HTMLElement.cpp:\n(WebCore::HTMLElement::queuePopoverToggleEventTask):\n(WebCore::HTMLElement::showPopover):\n(WebCore::HTMLElement::showPopoverInternal):\n(WebCore::HTMLElement::hidePopoverInternal):\n(WebCore::HTMLElement::togglePopover):\n(WebCore::HTMLElement::popoverAttributeChanged):\n(WebCore::HTMLElement::popover const):\n* Source/WebCore/platform/CommonAtomStrings.h:\n\nCanonical link: https://commits.webkit.org/317402@main", "email": "bfulgham@apple.com", "hash": "f6eeb78cca650f29dd2649798fa25cb2a554928c", "subject": "Implement popover=hint" }, "317403@main": { "author": "Richard Robinson", "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64", "cl": "317403@main", "clUrl": "https://commits.webkit.org/317403@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319609\nrdar://182436885\n\nReviewed by Megan Gardner and Abrar Rahman Protyasha.\n\nAdd some testing infrastructure to make mocking image analysis functionality in Swift tests\nsuper easy.\n\nAlso adds a (currently disabled) test that uses this new functionality.\n\n* Tools/TestWebKitAPI/Helpers/cocoa/ImageAnalysisTestingUtilities.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/ImageAnalysisTestingUtilities.mm:\n(TestWebKitAPI::getImageAnalyzerClass):\n* Tools/TestWebKitAPI/Helpers/cocoa/ImageAnalysisTestingUtilities.swift: Added.\n(TestVKImageAnalysis.hasResults(forAnalysisTypes:)):\n* Tools/TestWebKitAPI/Resources/cocoa/love-and-coffee-analysis.json: Added.\n* Tools/TestWebKitAPI/Resources/cocoa/love-and-coffee.jpeg: Added.\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift:\n(AppKitGesturesTests.scrollInputSourceUpdatesRubberbandHyperbolicCoefficient):\n(AppKitGesturesTests.scrollInputSourceUpdatesrubberbandHyperbolicCoefficient): Deleted.\n\nCanonical link: https://commits.webkit.org/317403@main", "email": "richard_robinson2@apple.com", "hash": "a1cec771ae1224ec14f7ce9668ac3cf70dd178a0", "subject": "[AppKit Gestures] Add Vision Live Text image analysis testing infrastructure support" }, "317404@main": { "author": "Ryan Reno", "avatar": "https://www.gravatar.com/avatar/16a1357ff2718b0348bedeec44d58812?d=identicon\u0026s=64", "cl": "317404@main", "clUrl": "https://commits.webkit.org/317404@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319523\nrdar://179479959\n\nReviewed by Simon Fraser and Antoine Quint.\n\nUnaccelerated scroll-driven animations must do layout on the main frame for every frame of scrolling. When\nwe are upadating obscured insets interactively, we throttle visible content rect updates and thus throttle\nupdates that the scroll-driven animation needs to compute the next frame of the animation. When we finally do\nsend an update, the animated layer jumps ahead causing a visible jitter.\n\nTo avoid this we skip the power optimization and send unthrottled visible content rect updates to the WebContent\nprocess. The iOS power benchmark measures a neutral result so we still get the power benefit on content that does\nnot contain unaccelerated scroll-driven animations.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ios/WKScrollViewTests.mm\n\n* Source/WebCore/animation/AnimationTimelinesController.cpp:\n(WebCore::AnimationTimelinesController::hasProgressBasedScrollDrivenAnimation const):\n* Source/WebCore/animation/AnimationTimelinesController.h:\n* Source/WebCore/animation/KeyframeEffect.h:\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::hasProgressBasedScrollDrivenAnimation const):\n* Source/WebCore/dom/Document.h:\n* Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTree.serialization.in:\n* Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTreeCommitBundle.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewInternal.h:\n* Source/WebKit/UIProcess/API/ios/WKWebViewIOS.mm:\n(-[WKWebView _didCommitLayerTree:mainFrameData:pageData:transactionID:]):\n(-[WKWebView _updateVisibleContentRects]):\n* Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm:\n(WebKit::WebPage::willCommitMainFrameData):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ios/WKScrollViewTests.mm:\n(TestWebKitAPI::(WKScrollViewTests, VisibleContentRectUpdatesDuringInteractiveObscuredInsetsChangeAreNotThrottledForMainThreadScrollDrivenAnimation)):\n(TestWebKitAPI::(WKScrollViewTests, ScrollDrivenAnimationTracksScrollDuringInteractiveObscuredInsetsChange)):\n\nCanonical link: https://commits.webkit.org/317404@main", "email": "rreno@apple.com", "hash": "b07ce30ae0052f005a29fb74c470e2f63f3a1144", "subject": "REGRESSION(308209@main): okaymay.be scroll-driven animation is jittery" }, "317405@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "317405@main", "clUrl": "https://commits.webkit.org/317405@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319622\nrdar://182372719\n\nReviewed by Richard Robinson.\n\nThis mirrors the WKWebpagePreferences property.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebPageTests.swift\n\n* Source/WebKit/UIProcess/API/Cocoa/WKWebpagePreferences+Extras.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage+NavigationPreferences.swift:\n(allowsJSHandleCreationInPageWorld):\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebPageTests.swift:\n(WebPageTests.allowsJSHandleCreationInPageWorld(_:)):\n\nCanonical link: https://commits.webkit.org/317405@main", "email": "achristensen@apple.com", "hash": "65b70880778549ab974f4a722411129dcbf8fda6", "subject": "Add API WebPage.NavigationPreferences.allowsJSHandleCreationInPageWorld" }, "317406@main": { "author": "Alexey Proskuryakov", "avatar": "https://www.gravatar.com/avatar/c66a0fa7958ae738ab34d596994091a4?d=identicon\u0026s=64", "cl": "317406@main", "clUrl": "https://commits.webkit.org/317406@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319654\nrdar://182460158\n\nReviewed by BJ Burg.\n\nWebDriver doesn't expect that all completion handlers in WebContent process are called.\nFirst, create_dialog() async script in fixtures_http.py code never invokes the callback in\nthe first place. Second, another teardown code path (willDestroyGlobalObjectForFrame)\nalready cleans up all outstanding callbacks.\n\nSo, mirror this behavior in session teardown.\n\n* Source/WebKit/WebProcess/Automation/WebAutomationSessionProxy.cpp:\n(WebKit::WebAutomationSessionProxy::cancelPendingEvaluateJavaScriptCallbacks):\n* Source/WebKit/WebProcess/Automation/WebAutomationSessionProxy.h:\n* Source/WebKit/WebProcess/WebProcess.cpp:\n(WebKit::WebProcess::destroyAutomationSessionProxy):\n\nCanonical link: https://commits.webkit.org/317406@main", "email": "ap@apple.com", "hash": "06770f9707f593227e9665625b6aacef6da9a5d1", "subject": "Multiple \"Completion handler should always be called\" assertion failures when running WebDriver tests" }, "317407@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "317407@main", "clUrl": "https://commits.webkit.org/317407@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318630\n\nReviewed by Antti Koivsito.\n\nThe final placement step of the flex pipeline -- position each item at its final flow-aware location,\napplying the wrap-reverse and rtl-column cross-axis flips, then write it to the renderer -- was a\nlambda captured inside performFlexLayout, unlike the other pipeline steps which are FlexLayout member\nfunctions.\n\nLift it into a computeFlexItemRects member function alongside the others, turning the seven captured\nlocals into parameters (the flex lines and items, the item positions, the two per-line cross lists,\nthe per-item cross sizes, and the cross-axis start edge, which is snapshotted before align-content\nshifts the positions). The name matches the counterpart in the LFC Layout::FlexLayout the legacy path\nis converging on.\n\nNo change in behavior: the body is unchanged, only relocated and parameterized.\n\n* Source/WebCore/rendering/RenderFlexLayout.cpp:\n* Source/WebCore/rendering/RenderFlexLayout.h:\n\nCanonical link: https://commits.webkit.org/317407@main", "email": "zalan@apple.com", "hash": "65eacbe9735daecfe614c69284e50b1fcf384e95", "subject": "[cleanup] Move computeFlexItemRects out of performFlexLayout into a dedicated FlexLayout member function" }, "317408@main": { "author": "Yury Semikhatsky", "avatar": "https://www.gravatar.com/avatar/d0aee26d9689e84bd1a7f0ed8f262fe1?d=identicon\u0026s=64", "cl": "317408@main", "clUrl": "https://commits.webkit.org/317408@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319633\n\nReviewed by Devin Rousso.\n\nlibcurl defaults to CURLHEADER_SEPARATE, so headers set via\nCURLOPT_HTTPHEADER only go to the origin inside the TLS tunnel and are\nstripped from the proxy CONNECT. Route request headers whose name starts\nwith \"Proxy-\" through CURLOPT_PROXYHEADER instead, so e.g.\nProxy-Authorization reaches an authenticating proxy on HTTPS navigations.\n\n* Source/WebCore/platform/network/curl/CurlContext.cpp:\n(WebCore::CurlHandle::removeRequestHeader):\n(WebCore::CurlHandle::appendRequestHeader):\n(WebCore::CurlHandle::enableProxyRequestHeaders):\n* Source/WebCore/platform/network/curl/CurlContext.h:\n\nCanonical link: https://commits.webkit.org/317408@main", "email": "yurys@chromium.org", "hash": "2790de3979ba9d5e3f08376627a19945a75f25ef", "subject": "[Curl] Route Proxy- request headers to the proxy CONNECT" }, "317409@main": { "author": "Zak Ridouh", "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64", "cl": "317409@main", "clUrl": "https://commits.webkit.org/317409@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317781\nrdar://180548257\n\nReviewed by Alex Christensen.\n\nWhen an \u003ca target=\"_top\"\u003e link with attribution attributes is clicked\ninside a cross-origin iframe, the main frame lives in another process\nand is a RemoteFrame. FrameLoader::loadURL parsed the Private Click\nMeasurement correctly but then handed the load to the RemoteFrameClient,\nwhich never received the data: WebRemoteFrameClient::changeLocation built\na NavigationAction without it and nothing was stored. The local-frame\npath attaches the data at the main frame (FrameLoader::loadURL's\nframe-\u003eisMainFrame() check), but that path is never reached when the\ntarget frame is remote.\n\nAdd an explicit Private Click Measurement parameter to\nRemoteFrameClient::changeLocation and pass it from loadURL's RemoteFrame\nbranch (gated on isMainFrame() to match the local path) so\nWebRemoteFrameClient::changeLocation can re-attach it to the\nNavigationAction sent to the UI process. The UI-process storage path was\nalready measurement-aware, so no changes were needed there.\n\n* LayoutTests/platform/ios-site-isolation/TestExpectations:\n* LayoutTests/platform/mac-site-isolation/TestExpectations:\n* Source/WebCore/loader/FrameLoader.cpp:\n(WebCore::FrameLoader::loadURL):\n* Source/WebKit/WebProcess/WebCoreSupport/WebRemoteFrameClient.cpp:\n(WebKit::WebRemoteFrameClient::changeLocation):\n* Source/WebCore/page/RemoteFrame.cpp:\n(WebCore::RemoteFrame::changeLocation):\n(WebCore::RemoteFrame::loadFrameRequest):\n* Source/WebCore/page/RemoteFrameClient.h:\n* Source/WebKit/WebProcess/WebCoreSupport/WebRemoteFrameClient.h:\n\nCanonical link: https://commits.webkit.org/317409@main", "email": "zakr@apple.com", "hash": "221e657b4111aac908f10f176e4889f3766724a2", "subject": "[Site Isolation] Preserve Private Click Measurement across cross-process top-frame navigations" }, "317410@main": { "author": "Zhuo Ying Jiang Li", "avatar": "https://www.gravatar.com/avatar/324e2791871d8411876b6bcbd3c4f2b5?d=identicon\u0026s=64", "cl": "317410@main", "clUrl": "https://commits.webkit.org/317410@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319679\n\nReviewed by Keith Miller.\n\nAdded myself to contributors.json.\n\n* metadata/contributors.json:\n\nCanonical link: https://commits.webkit.org/317410@main", "email": "z_jiangli@apple.com", "hash": "baf206c024270ac22280e07e90ef6ae34c4104d4", "subject": "Add Zhuo Ying Jiang Li to contributors list" }, "317411@main": { "author": "Claudio Saavedra", "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64", "cl": "317411@main", "clUrl": "https://commits.webkit.org/317411@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319510\n\nReviewed by Patrick Griffis.\n\nReplace the placeholder page with a complete walkthrough: a portable\ndefault-display browser and a Wayland-pinned variant, the pkg-config\nmodules and build/run steps, and the WPEView/WPEToplevel lifecycle\nincluding clean shutdown on the view's \"closed\" signal.\n\n* Source/WebKit/WPEPlatform/docs/tutorial-browser.md:\n\nCanonical link: https://commits.webkit.org/317411@main", "email": "csaavedra@igalia.com", "hash": "b22a0e1e6c3fe020f56b67d9e631e17ca732cc2b", "subject": "[WPE] Add a tutorial on how to create a browser with the WPE Platform" }, "317412@main": { "author": "Megan Gardner", "avatar": "https://www.gravatar.com/avatar/b466a5bcbfabf4d82a8ecc595db5a531?d=identicon\u0026s=64", "cl": "317412@main", "clUrl": "https://commits.webkit.org/317412@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319612\nrdar://182439644\n\nReviewed by Wenson Hsieh.\n\nReworked the closest-match resolution in validatedRangeForSuggestionMarker so re-anchoring only commits when it's\nconfident. It now bails on an ambiguous tie (two occurrences equidistant from the stale offset) and when the\nre-anchored range overlaps a different suggestion's marker, instead of silently taking the nearest one. A lone\nnon-overlapping wrong match can still slip through — inherent to a text search — but the two detectable cases are\ncovered now.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WritingTools.mm\n\n* Source/WebCore/page/writing-tools/WritingToolsController.mm:\n(WebCore::WritingToolsController::validatedRangeForSuggestionMarker const):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WritingTools.mm:\n(TEST(WritingTools, ProofreadingReviewBailsOnAmbiguousDriftedMarker)):\n\nCanonical link: https://commits.webkit.org/317412@main", "email": "megan_gardner@apple.com", "hash": "262e8c14578baaa683bc124f2f0fcc90f6671bb0", "subject": "Cover more cases for correcting issues with AOP inserts on sites with rich text editors." }, "317413@main": { "author": "Ryan Haddad", "avatar": "https://www.gravatar.com/avatar/b7d8cd2dec546cac2524e4b58181f9d5?d=identicon\u0026s=64", "cl": "317413@main", "clUrl": "https://commits.webkit.org/317413@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317898\nrdar://problem/180677371\n\nReviewed by Aakash Jain.\n\nRegister one ForceScheduler per archive builder that exposes the builder's \"triggers\" array\nas a multi-select ChoiceStringParameter. Buildbot admins can use this to retry a parent\narchive build with a chosen subset of testers, instead of always re-triggering the full\nset of configured triggerables.\n\nThe new schedulers ride on the existing \"triggers\" build property, so the choices are sourced\nlive from config.json, keeping it as the single source of truth. Archive builders are dropped\nfrom the shared try_build scheduler so each builder page still shows exactly one \"Try Build\"\nbutton.\n\n* Tools/CISupport/ews-build/loadConfig.py: Filter archive builders out of try_build and\nregister a per-builder force-retry ForceScheduler for each of them, both gated on\nsetup_force_schedulers.\n* Tools/CISupport/ews-build/loadConfig_unittest.py:\n(ConfigDotJSONTest.test_force_retry_schedulers): Add unit test.\n\nCanonical link: https://commits.webkit.org/317413@main", "email": "ryanhaddad@apple.com", "hash": "39462e4e89b8bf125e13f8bc8bf868d34ccc7c70", "subject": "[EWS] Add selective-retry force schedulers for archive builders" }, "317414@main": { "author": "Ruthvik Konda", "avatar": "https://www.gravatar.com/avatar/bca33cefcce93017251a8fbc1204cdc4?d=identicon\u0026s=64", "cl": "317414@main", "clUrl": "https://commits.webkit.org/317414@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319598\nrdar://182423899\n\nReviewed by Mike Wyrzykowski.\n\nWebGPUCreateImpl.cpp includes WebGPUAdapterImpl.h but never references AdapterImpl. No change in behavior.\n\n* Source/WebCore/Modules/WebGPU/Implementation/WebGPUCreateImpl.cpp:\n\nCanonical link: https://commits.webkit.org/317414@main", "email": "rkonda2@apple.com", "hash": "dad21ac55d3ea4b9ee73216e4f161e0d60a63a0c", "subject": "[WebGPU] Remove unused WebGPUAdapterImpl.h include in WebGPUCreateImpl" }, "317415@main": { "author": "Yijia Huang", "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64", "cl": "317415@main", "clUrl": "https://commits.webkit.org/317415@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319656\nrdar://182481524\n\nReviewed by Yusuke Suzuki.\n\nPlainMonthDay.from({calendar:\"chinese\", year:1651, monthCode:\"M01L\",\nday:29}) returned 1651-02-19[u-ca=chinese] instead of the canonical\n1972-02-14 required by CalendarMonthDayToISOReferenceDate. The\nsecond-pass re-resolve in monthDayFromFields propagated\necmaReferenceYear's INT32_MIN UseRegularIfConstrain sentinel as if it\nwere a real year, calendarDateFromFields failed, and the fallback\nreturned the first-pass result — silently dropping canonicalization.\n\nRoot cause: ecmaReferenceYear's sentinel-in-int32_t API. Change it\nto Expected\u003cint32_t, EcmaReferenceYearError\u003e, matching icu4x's\nResult\u003ci32, EcmaReferenceYearError\u003e. Silent misuse now fails to\ncompile. While migrating, align every calendar's table with icu4x\nline-for-line — Chinese/Dangi/Islamic/Hebrew reject out-of-range\nmonthNumber; Coptic/Ethiopic/Ethioaa/Persian/Indian reject any leap\nmonthCode.\n\nCanonical link: https://commits.webkit.org/317415@main", "email": "yijia_huang@apple.com", "hash": "b7d86046792af67a49c7f8f2a8c94af0270b759a", "subject": "[JSC][Temporal] Fix PMD reference-year drop for Chinese leap months" }, "317416@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "317416@main", "clUrl": "https://commits.webkit.org/317416@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319299\n\nReviewed by Youenn Fablet.\n\nwpt/webtransport/streams-echo.https.any.html fails after 316945@main\nis reapplied because this line of JS is throwing a TypeError:\n\nconst reader = bidi_stream.readable.getReader({mode: 'byob'});\n\nIt is throwing in ReadableStream::getReader with the string \"Invalid mode is specified\".\nI keep WebTransportReceiveStream to be the source of stream streams (WebTransport's\nincomingBidirectionalStreams and incomingUnidirectionalStreams)\n\nWebTransportReceiveStreamByteSource is introduced. It actually receives the bytes\nfrom the network and gives them to JS as array buffers, and it supports byob buffers.\n\nAI definitely helped me out with this one.\n\n* Source/WebCore/Modules/streams/ReadableStream.cpp:\n(WebCore::ReadableStream::createInternalReadableStream): Deleted.\n* Source/WebCore/Modules/streams/ReadableStream.h:\n* Source/WebCore/Modules/webtransport/WebTransport.cpp:\n(WebCore::WebTransport::receiveIncomingUnidirectionalStream):\n(WebCore::createBidirectionalStream):\n(WebCore::WebTransport::receiveBidirectionalStream):\n(WebCore::WebTransport::createBidirectionalStream):\n* Source/WebCore/Modules/webtransport/WebTransport.h:\n* Source/WebCore/Modules/webtransport/WebTransportReceiveStream.cpp:\n(WebCore::WebTransportReceiveStream::create):\n(WebCore::WebTransportReceiveStream::WebTransportReceiveStream):\n* Source/WebCore/Modules/webtransport/WebTransportReceiveStream.h:\n* Source/WebCore/Modules/webtransport/WebTransportReceiveStreamByteSource.cpp: Copied from Source/WebCore/Modules/webtransport/WebTransportReceiveStreamSource.cpp.\n(WebCore::WebTransportReceiveStreamByteSource::pull):\n(WebCore::WebTransportReceiveStreamByteSource::WebTransportReceiveStreamByteSource):\n(WebCore::WebTransportReceiveStreamByteSource::receiveBytes):\n(WebCore::WebTransportReceiveStreamByteSource::receiveError):\n(WebCore::WebTransportReceiveStreamByteSource::cancel):\n* Source/WebCore/Modules/webtransport/WebTransportReceiveStreamByteSource.h: Copied from Source/WebCore/Modules/webtransport/WebTransportReceiveStreamSource.h.\n* Source/WebCore/Modules/webtransport/WebTransportReceiveStreamSource.cpp:\n(WebCore::WebTransportReceiveStreamSource::receiveIncomingStream):\n(WebCore::WebTransportReceiveStreamSource::doCancel):\n(WebCore::WebTransportReceiveStreamSource::WebTransportReceiveStreamSource): Deleted.\n(WebCore::WebTransportReceiveStreamSource::receiveBytes): Deleted.\n(WebCore::WebTransportReceiveStreamSource::receiveError): Deleted.\n* Source/WebCore/Modules/webtransport/WebTransportReceiveStreamSource.h:\n(WebCore::WebTransportReceiveStreamSource::createIncomingStreamsSource):\n(WebCore::WebTransportReceiveStreamSource::createIncomingDataSource): Deleted.\n(WebCore::WebTransportReceiveStreamSource::setStream): Deleted.\n(WebCore::WebTransportReceiveStreamSource::stream const): Deleted.\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebTransport.mm:\n(TestWebKitAPI::TEST(WebTransport, ClientBidirectionalBYOB)):\n\nCanonical link: https://commits.webkit.org/317416@main", "email": "achristensen@apple.com", "hash": "e67a8c3c5b57de098125f98fa7c2238bf173dc98", "subject": "Fix WebTransport reading with byob streams" }, "317417@main": { "author": "Abrar Rahman Protyasha", "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64", "cl": "317417@main", "clUrl": "https://commits.webkit.org/317417@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319661\nrdar://182496998\n\nReviewed by Richard Robinson.\n\nWKDeferringGR currently does _not_ override -locationInView:, mainly\nbecause it does not make sense for the deferring GR to _have_ an\nassociated location.\n\nNSGestureRecognizer emits error logging for subclasses like this, while\nUIGestureRecognizer simply returns the centroid of active touches (for\nthat gesture).\n\nA first instinct to just return (0, 0) may be incompatible on iOS, so\ninstead we should simply avoid calling into\n`-[WKDeferringGestureRecognizer locationInView:]` from\nAppKitGestureController. -gestureRecognizerShouldBegin: always falls\nthrough to return YES for deferring GRs regardless, so we shortcircuit\nthat earlier, avoiding the `-locationInView:` call.\n\n* Source/WebKit/UIProcess/mac/WKAppKitGestureController.mm:\n(-[WKAppKitGestureController gestureRecognizerShouldBegin:]):\n\nCanonical link: https://commits.webkit.org/317417@main", "email": "a_protyasha@apple.com", "hash": "a802589bbc38ecb2dccee0a1605d620ca7ec808d", "subject": "[AppKit Gestures] Occasionally getting AppKit error logging in -gestureRecognizerShouldBegin: (\"WKDeferringGestureRecognizer is responsible for implementing locationInView:\")" }, "317418@main": { "author": "Dan Hecht", "avatar": "https://www.gravatar.com/avatar/080f47d912b1b34d0be8293f825d132d?d=identicon\u0026s=64", "cl": "317418@main", "clUrl": "https://commits.webkit.org/317418@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319697\nrdar://182541235\n\nReviewed by Yusuke Suzuki.\n\nThe existing zeroing tests reuse one buffer at a time, leaving two gaps:\nborn-dirty memory that only surfaces once the large heap has split and\ncoalesced fragmented free regions, and double-handout -- the allocator\nreturning an address still owned by a live allocation.\n\nAdd a single-threaded case that keeps many mixed-size, mixed-alignment\nbuffers live under a fragmented heap, checking both: every allocation is\nverified zero, and a per-buffer stamp catches any overlap with a live\nbuffer. The multi-threaded case will be covered by a later chaos test.\n\n* Source/bmalloc/libpas/src/test/AllocationZeroingTests.cpp:\n(addAllocationZeroingTests):\n\nCanonical link: https://commits.webkit.org/317418@main", "email": "dan.hecht@apple.com", "hash": "ac2f235d63c0dead89627c283358301e2ac5939b", "subject": "[libpas] Add fragmentation and aliasing coverage to AllocationZeroingTest" }, "317419@main": { "author": "Jetzel Espinal", "avatar": "https://www.gravatar.com/avatar/2edd78d5d9f2f2e2e695465277634921?d=identicon\u0026s=64", "cl": "317419@main", "clUrl": "https://commits.webkit.org/317419@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319643\nrdar://182463018\n\nUnreviewed test gardening.\n\n* LayoutTests/TestExpectations:\n\nCanonical link: https://commits.webkit.org/317419@main", "email": "jespinal23@apple.com", "hash": "6f050142c688e09187976c4eb6ba3a20599a286a", "subject": "[GARDENING][macOS arm64] http/tests/inspector/target/pause-on-inline-debugger-statement.html (layout-tests) is a flaky timeout/crash." }, "317421@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "317421@main", "clUrl": "https://commits.webkit.org/317421@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318631\n\nReviewed by Antti Koivisto.\n\nperformFlexLayout recorded each flex line's cross-axis position and grew the row container's logical\nheight in a bare block between the performContentSizing and performContentAlignment lambdas, and then\ncommitted that height partway through performContentAlignment even though, for row flow, it is fully\nknown beforehand (main-axis alignment, which does not touch the row height, sat in between only because\ncolumn flow's height is produced there while placing the items).\n\nFactor that block into a positionFlexLines lambda that grows the row container's logical height to fit\nthe lines plus the inter-line gaps as it records the line positions, so the row height is set before\nalignment, next to where it is computed. Column flow's height is still its main size, set while placing\nthe items; both flows resolve their final height through updateFlexContainerLogicalHeight, called once\nin performContentAlignment.\n\nupdateFlexContainerLogicalHeight no longer takes the empty-line minimum as an argument; it reserves it\nvia the existing adjustLogicalHeightForLineIfEmpty before updateLogicalHeight, so\nminimumHeightForLineIfEmpty stays on RenderFlexibleBox and leaves FlexLayoutConstraints. The value is\nunchanged: the empty-items path already recomputes it at the same layout point, and this call runs\nbefore the container's scrollbar and overflow are finalized. The empty-items path now calls\nupdateFlexContainerLogicalHeight too, since it is exactly those two lines.\n\nNo change in behavior.\n\n* Source/WebCore/rendering/RenderFlexLayout.cpp:\n* Source/WebCore/rendering/RenderFlexLayout.h:\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n\nCanonical link: https://commits.webkit.org/317421@main", "email": "zalan@apple.com", "hash": "4bac687a7d6904fa60e899d2fc0dd7ef2a1c6206", "subject": "[cleanup] Commit the row flex container height before alignment and factor flex line positioning into a lambda" }, "317422@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317422@main", "clUrl": "https://commits.webkit.org/317422@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319604\nrdar://182433929\n\nReviewed by Alan Baradlay.\n\ncollectFallbackFonts() fetched the per-inline-box fallback font set with\nHashMap::get() (which returns the SingleThreadWeakHashSet by value, copying\nit), mutated the copy, then wrote it back with HashMap::set() when the size\nchanged. That is two hash lookups and two copies of the weak set on the line\nlayout path.\n\nUse HashMap::ensure() to obtain a reference to the value in place and mutate\nit directly, eliminating both the copies and the second lookup. This is not a\nbehavior change: the entry is only reached after the fallback font list is\nknown to be non-empty, and both read sites gate on\nisEmptyIgnoringNullReferences(), so the (at most empty) entry ensure() may\ncreate reads identically to a missing one.\n\n* Source/WebCore/layout/formattingContexts/inline/InlineLineBoxBuilder.cpp:\n(WebCore::Layout::LineBoxBuilder::collectFallbackFonts):\n\nCanonical link: https://commits.webkit.org/317422@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "d36ee39e96fea5b6118b75cbc7a3a1597d605f8a", "subject": "Avoid redundant copy and double hash lookup in LineBoxBuilder::collectFallbackFonts()" }, "317423@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "317423@main", "clUrl": "https://commits.webkit.org/317423@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319690\nrdar://182535047\n\nReviewed by Yijia Huang.\n\nWhen I search for git conflict markers \"\u003c\u003c\u003c\u003c\u003c\u003c\u003c\" and \"\u003e\u003e\u003e\u003e\u003e\u003e\u003e\" these always show up.\nAdd some = characters to make the search for merge conflicts not show these test markers.\n\n* Source/JavaScriptCore/wasm/debugger/tests/ExecutionHandlerIdleStopTest.cpp:\n(ExecutionHandlerIdleStopTest::testOrderingVMEnterInterruptContinue):\n(ExecutionHandlerIdleStopTest::testOrderingInterruptVMEnterContinue):\n(ExecutionHandlerIdleStopTest::testOrderingInterruptContinueVMEnter):\n(ExecutionHandlerIdleStopTest::testIdleVMInterruptResumeLoops):\n(ExecutionHandlerIdleStopTest::testIdleVMWithActiveVM):\n\nCanonical link: https://commits.webkit.org/317423@main", "email": "achristensen@apple.com", "hash": "fcd9a87c22d4f285d0f4cafc8bf3096a65b7d26d", "subject": "Replace start and stop markers in ExecutionHandlerIdleStopTest.cpp" }, "317424@main": { "author": "Dan Hecht", "avatar": "https://www.gravatar.com/avatar/080f47d912b1b34d0be8293f825d132d?d=identicon\u0026s=64", "cl": "317424@main", "clUrl": "https://commits.webkit.org/317424@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319699\nrdar://182542964\n\nReviewed by Yusuke Suzuki.\n\nThe tests so far only allocate through the non-compact primitive heap (the\npas_non_compact_allocation_mode path fastMalloc uses). fastCompactZeroedMalloc's\nalways_compact mode routes to a separate compact primitive heap -- its own\nregions and reuse/decommit bookkeeping -- which nothing here exercised.\n\nAdd Compact as a third HeapVariant so the reuse, page-batching, and\nfragmentation sweeps also run against the compact heap. Compact is\nuntagged-only: the tagged API takes no allocation mode.\n\n* Source/bmalloc/libpas/src/test/AllocationZeroingTests.cpp:\n\nCanonical link: https://commits.webkit.org/317424@main", "email": "dan.hecht@apple.com", "hash": "b93c112f86d1abbe2cef8abed63c8124b10419c5", "subject": "[libpas] Add compact-heap coverage to AllocationZeroingTests" }, "317425@main": { "author": "Rob Buis", "avatar": "https://www.gravatar.com/avatar/74fb5af173895d2a7814b0aed1238a39?d=identicon\u0026s=64", "cl": "317425@main", "clUrl": "https://commits.webkit.org/317425@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319171\n\nReviewed by Alan Baradlay.\n\nWhen set to the empty string value, block-ellipsis is identical to the no-ellipsis value. [1]\n\n[1] https://drafts.csswg.org/css-overflow-4/#block-ellipsis\n\n* LayoutTests/TestExpectations:\n* Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayLineBuilder.cpp:\n(WebCore::Layout::InlineDisplayLineBuilder::applyEllipsisIfNeeded):\n\nCanonical link: https://commits.webkit.org/317425@main", "email": "rbuis@igalia.com", "hash": "916302c299bd4ff9e0631491c795119be5f083b7", "subject": "Fix css/css-overflow/line-clamp/block-ellipsis-024.html" } }, "date": "2026-07-17", "days": 1, "generatedAt": "2026-07-17T22:06:26Z", "markdown": "## Highlights\n- **Security** Fixed a reentrancy use-after-free risk in AppKit gesture position handler cleanup, tightening a nasty UI process edge case. [commit 317401@main](https://commits.webkit.org/317401@main) [bug 319631](https://bugs.webkit.org/show_bug.cgi?id=319631)\n- **Privacy** Private Click Measurement now survives cross-process top-frame navigations under Site Isolation, preserving attribution state in the cases that matter. [commit 317409@main](https://commits.webkit.org/317409@main) [bug 317781](https://bugs.webkit.org/show_bug.cgi?id=317781)\n- **Web Platform** WebKit landed `popover=hint`, filling in a notable piece of the popover model for lighter-weight transient UI. [commit 317402@main](https://commits.webkit.org/317402@main) [bug 275048](https://bugs.webkit.org/show_bug.cgi?id=275048)\n- **Networking** WebTransport BYOB stream reads were fixed, and test infrastructure now runs the H3 WPT server so more of the stack is exercised for real. [commit 317416@main](https://commits.webkit.org/317416@main) [bug 319299](https://bugs.webkit.org/show_bug.cgi?id=319299)\n- **Perf** Skia damage tracking got sharper: compositing and content drawing are now constrained to actual repaint regions, cutting wasted work. [commit 317400@main](https://commits.webkit.org/317400@main) [bug 315990](https://bugs.webkit.org/show_bug.cgi?id=315990)\n- **V8** JSC fixed a DFG x86_64 miscompile that could produce invalid `JSString` lengths and lead to abort or out-of-bounds read evidence. [commit 317364@main](https://commits.webkit.org/317364@main) [bug 317480](https://bugs.webkit.org/show_bug.cgi?id=317480)\n- **Mobile** iOS cross-origin iframe editing got a real usability fix: autocorrection now applies correctly under Site Isolation. [commit 317362@main](https://commits.webkit.org/317362@main) [bug 317473](https://bugs.webkit.org/show_bug.cgi?id=317473)\n- **Rendering** Scroll and view timeline work continued with fixes for jitter, timeline scoping, binding nullability, and transformed SVG sizing. [commit 317404@main](https://commits.webkit.org/317404@main) [bug 319523](https://bugs.webkit.org/show_bug.cgi?id=319523)\n- **Media** WebVTT cue positioning moved from ints to floats, which should improve subtitle placement accuracy instead of snapping to coarse geometry. [commit 317391@main](https://commits.webkit.org/317391@main) [bug 319433](https://bugs.webkit.org/show_bug.cgi?id=319433)\n\n## What landed by area\n\n### JavaScriptCore and regex\n- **V8** JSC taught DFG and FTL about `DataView` BigInt64 accessors, closing a correctness gap in optimized execution. [commit 317392@main](https://commits.webkit.org/317392@main) [bug 319594](https://bugs.webkit.org/show_bug.cgi?id=319594)\n- **V8** Async generator driving now uses `MicrotaskCallCache`, shaving overhead from a hot async path. [commit 317384@main](https://commits.webkit.org/317384@main) [bug 319650](https://bugs.webkit.org/show_bug.cgi?id=319650)\n- **V8** `AsyncFromSyncIterator` no longer closes the sync iterator for a rejected value when `done` is true, matching spec behavior more closely. [commit 317371@main](https://commits.webkit.org/317371@main) [bug 319585](https://bugs.webkit.org/show_bug.cgi?id=319585)\n- **V8** `op_async_iterator_next` in DFG now also subscribes the promise watchpoint, fixing an optimization bookkeeping hole. [commit 317363@main](https://commits.webkit.org/317363@main) [bug 319624](https://bugs.webkit.org/show_bug.cgi?id=319624)\n- **V8** WebAssembly `type()` methods are now gated behind `useWasmJSTypes`, tightening exposure of in-progress JS types support. [commit 317366@main](https://commits.webkit.org/317366@main) [bug 317707](https://bugs.webkit.org/show_bug.cgi?id=317707)\n- **V8** The low-level `branchTest8` and `branchTest16` helpers swapped base and offset registers, a backend cleanup in JSC codegen plumbing. [commit 317394@main](https://commits.webkit.org/317394@main) [bug 319635](https://bugs.webkit.org/show_bug.cgi?id=319635)\n- **V8** Stress tests that rely on `numberOfDFGCompiles` are now skipped when JIT is unavailable, reducing false failures on constrained configs. [commit 317393@main](https://commits.webkit.org/317393@main) [bug 319613](https://bugs.webkit.org/show_bug.cgi?id=319613)\n- **V8** Temporal fixed PMD reference-year handling for Chinese leap months, another deep calendar correctness patch. [commit 317415@main](https://commits.webkit.org/317415@main) [bug 319656](https://bugs.webkit.org/show_bug.cgi?id=319656)\n- **V8** Temporal extracted `GetTemporalCalendarIdentifierWithISODefault` into a shared helper, reducing duplicate logic in the calendar pipeline. [commit 317365@main](https://commits.webkit.org/317365@main) [bug 319602](https://bugs.webkit.org/show_bug.cgi?id=319602)\n- **V8** YARR fixed `surrogateTagMask` constants to `0xfc00`, correcting surrogate handling logic. [commit 317399@main](https://commits.webkit.org/317399@main) [bug 319651](https://bugs.webkit.org/show_bug.cgi?id=319651)\n- **Perf** YARR improved JIT backtracking for greedy variable-width character classes in unicode mode from per-step `O(count)` pain toward something saner. [commit 317381@main](https://commits.webkit.org/317381@main) [bug 319370](https://bugs.webkit.org/show_bug.cgi?id=319370)\n\n### Rendering, CSS, and layout\n- **Rendering** `line-clamp` block ellipsis test expectations were fixed, keeping overflow behavior aligned with reality. [commit 317425@main](https://commits.webkit.org/317425@main) [bug 319171](https://bugs.webkit.org/show_bug.cgi?id=319171)\n- **Perf** `LineBoxBuilder::collectFallbackFonts()` now avoids a redundant copy and double hash lookup, trimming work in text layout fallback. [commit 317422@main](https://commits.webkit.org/317422@main) [bug 319604](https://bugs.webkit.org/show_bug.cgi?id=319604)\n- **Rendering** Flex layout cleanup continued with row flex container height being committed before alignment and flex line positioning being factored out. [commit 317421@main](https://commits.webkit.org/317421@main) [bug 318631](https://bugs.webkit.org/show_bug.cgi?id=318631)\n- **Refactor** `computeFlexItemRects` moved out of `performFlexLayout` into a dedicated `FlexLayout` member, making the pipeline easier to reason about. [commit 317407@main](https://commits.webkit.org/317407@main) [bug 318630](https://bugs.webkit.org/show_bug.cgi?id=318630)\n- **Rendering** A clip-path masking test failure was fixed in `clip-path-shape-011.html`. [commit 317397@main](https://commits.webkit.org/317397@main) [bug 319616](https://bugs.webkit.org/show_bug.cgi?id=319616)\n- **Rendering** The initial logic for distributing extra space landed for GFC, pushing the next-generation formatting codepath forward. [commit 317388@main](https://commits.webkit.org/317388@main) [bug 319626](https://bugs.webkit.org/show_bug.cgi?id=319626)\n- **Refactor** Flex container logical-height updates were split into a row content set and a shared finalize step. [commit 317385@main](https://commits.webkit.org/317385@main) [bug 318629](https://bugs.webkit.org/show_bug.cgi?id=318629)\n- **Web Platform** CSS Highlight API now applies `text-shadow` through `::highlight()`, fixing a visible styling omission. [commit 317374@main](https://commits.webkit.org/317374@main) [bug 319634](https://bugs.webkit.org/show_bug.cgi?id=319634)\n- **Refactor** Flex line positioning moved out of content sizing, with row content height passed optionally. [commit 317358@main](https://commits.webkit.org/317358@main) [bug 318628](https://bugs.webkit.org/show_bug.cgi?id=318628)\n\n### Scroll animations and animation infrastructure\n- **Rendering** A regression that made scroll-driven animation jittery on okaymay.be was fixed. [commit 317404@main](https://commits.webkit.org/317404@main) [bug 319523](https://bugs.webkit.org/show_bug.cgi?id=319523)\n- **Perf** Threaded animations now emit tracing signposts for remote layer tree animation updates, which should help chase animation pipeline stalls. [commit 317395@main](https://commits.webkit.org/317395@main) [bug 319670](https://bugs.webkit.org/show_bug.cgi?id=319670)\n- **Web Platform** Deferred scroll timelines are now represented as null through bindings, aligning observable API behavior with the model. [commit 317377@main](https://commits.webkit.org/317377@main) [bug 319593](https://bugs.webkit.org/show_bug.cgi?id=319593)\n- **Web Platform** `animation-timeline` name resolution now only matches within the nearest `timeline-scope`, fixing scoping semantics. [commit 317376@main](https://commits.webkit.org/317376@main) [bug 319589](https://bugs.webkit.org/show_bug.cgi?id=319589)\n- **Rendering** View timelines on transformed SVG elements now use the transformed subject sizing rules correctly instead of raw untransformed size. [commit 317359@main](https://commits.webkit.org/317359@main) [bug 307790](https://bugs.webkit.org/show_bug.cgi?id=307790)\n\n### Networking, transport, and process model\n- **Networking** Curl now routes `Proxy-` request headers to the proxy CONNECT path, fixing proxy behavior where those headers actually matter. [commit 317408@main](https://commits.webkit.org/317408@main) [bug 319633](https://bugs.webkit.org/show_bug.cgi?id=319633)\n- **Networking** WebDriver assertion failures around completion handlers were fixed, stabilizing async control flow in automation paths. [commit 317406@main](https://commits.webkit.org/317406@main) [bug 319654](https://bugs.webkit.org/show_bug.cgi?id=319654)\n- **Web Platform** `WebPage.NavigationPreferences.allowsJSHandleCreationInPageWorld` was added to API, giving embedders finer control over handle creation behavior. [commit 317405@main](https://commits.webkit.org/317405@main) [bug 319622](https://bugs.webkit.org/show_bug.cgi?id=319622)\n- **Networking** The WebTransport H3 WPT server now runs inside the layout test harness and passing tests were enabled. [commit 317380@main](https://commits.webkit.org/317380@main) [bug 319008](https://bugs.webkit.org/show_bug.cgi?id=319008)\n- **Security** `Document::isFullyActive` now accounts for RemoteFrame ancestors, plugging a Site Isolation correctness hole. [commit 317357@main](https://commits.webkit.org/317357@main) [bug 316121](https://bugs.webkit.org/show_bug.cgi?id=316121)\n- **Security** Cross-origin WebAudio remote-audio test failures under Site Isolation were fixed, keeping coverage intact in a sensitive area. [commit 317386@main](https://commits.webkit.org/317386@main) [bug 318459](https://bugs.webkit.org/show_bug.cgi?id=318459)\n- **Mobile** A debug assertion around COOP popup tests on macOS was fixed in the messaging path. [commit 317375@main](https://commits.webkit.org/317375@main) [bug 319273](https://bugs.webkit.org/show_bug.cgi?id=319273)\n\n### UI, editing, and platform behavior\n- **UI** AppKit gesture recognizers no longer occasionally emit the `locationInView:` responsibility error log during begin checks. [commit 317417@main](https://commits.webkit.org/317417@main) [bug 319661](https://bugs.webkit.org/show_bug.cgi?id=319661)\n- **UI** Vision Live Text image analysis test infrastructure support landed for AppKit gestures, opening the door to better coverage for that integration. [commit 317403@main](https://commits.webkit.org/317403@main) [bug 319609](https://bugs.webkit.org/show_bug.cgi?id=319609)\n- **UI** AutoFill/assistance logic now covers more bad AOP insert cases on sites with rich text editors. [commit 317412@main](https://commits.webkit.org/317412@main) [bug 319612](https://bugs.webkit.org/show_bug.cgi?id=319612)\n- **UI** A navigation regression that made the web environment dismissal animation feel jarring was fixed. [commit 317382@main](https://commits.webkit.org/317382@main) [bug 319629](https://bugs.webkit.org/show_bug.cgi?id=319629)\n- **UI** The Swift name for `WKContentWorldConfiguration.isInspectable` was updated, smoothing API ergonomics for Swift clients. [commit 317367@main](https://commits.webkit.org/317367@main) [bug 319619](https://bugs.webkit.org/show_bug.cgi?id=319619)\n\n### Media, graphics, and GPU-adjacent work\n- **Media** `RemoteMediaSessionManagerProxy` became a singleton, simplifying remote media session ownership and coordination. [commit 317396@main](https://commits.webkit.org/317396@main) [bug 318989](https://bugs.webkit.org/show_bug.cgi?id=318989)\n- **Media** A permanent crash expectation for `media-source-evict-invalid-time-crash.html` was marked in debug, keeping bots honest about a known bad case. [commit 317389@main](https://commits.webkit.org/317389@main) [bug 319576](https://bugs.webkit.org/show_bug.cgi?id=319576)\n- **Media** GStreamer improved Qualcomm video decoder detection, which should reduce misclassification on affected hardware. [commit 317378@main](https://commits.webkit.org/317378@main) [bug 319476](https://bugs.webkit.org/show_bug.cgi?id=319476)\n- **GPU** WebGPU dropped an unused `WebGPUAdapterImpl.h` include in creation plumbing, small but clean. [commit 317414@main](https://commits.webkit.org/317414@main) [bug 319598](https://bugs.webkit.org/show_bug.cgi?id=319598)\n\n### Memory allocation, build, and infrastructure\n- **Security** libpas added compact-heap coverage to `AllocationZeroingTests`, strengthening allocator validation in a bug-prone area. [commit 317424@main](https://commits.webkit.org/317424@main) [bug 319699](https://bugs.webkit.org/show_bug.cgi?id=319699)\n- **Security** libpas added fragmentation and aliasing coverage to `AllocationZeroingTest`, expanding stress on zeroing guarantees. [commit 317418@main](https://commits.webkit.org/317418@main) [bug 319697](https://bugs.webkit.org/show_bug.cgi?id=319697)\n- **Refactor** libpas reworked per-heap tagging policy logic, a structural allocator change with security and diagnostics implications. [commit 315921@main](https://commits.webkit.org/315921@main) [bug 316145](https://bugs.webkit.org/show_bug.cgi?id=316145)\n- **Security** libpas now verifies large zeroed allocations under out-of-order page faults, exercising a subtle allocator correctness case. [commit 317390@main](https://commits.webkit.org/317390@main) [bug 319621](https://bugs.webkit.org/show_bug.cgi?id=319621)\n- **Build** EWS gained selective-retry force schedulers for archive builders, which should make infrastructure retries less blunt. [commit 317413@main](https://commits.webkit.org/317413@main) [bug 317898](https://bugs.webkit.org/show_bug.cgi?id=317898)\n- **Build** JHBuild updated libwpe, wpebackend-fdo, and libsoup in the minimal moduleset. [commit 317398@main](https://commits.webkit.org/317398@main) [bug 319632](https://bugs.webkit.org/show_bug.cgi?id=319632)\n- **Build** IPC testing headers are now installed for TestWebKitAPI builds, helping downstream test targets compile cleanly. [commit 317372@main](https://commits.webkit.org/317372@main) [bug 315109](https://bugs.webkit.org/show_bug.cgi?id=315109)\n- **Build** `analyze-safer-cpp` no longer reports \"OK\" for files that fail to compile, making the tool's output less misleading. [commit 317370@main](https://commits.webkit.org/317370@main) [bug 317931](https://bugs.webkit.org/show_bug.cgi?id=317931)\n- **Build** The C++ style checker fixed a false positive around `__has_include` line continuations. [commit 317369@main](https://commits.webkit.org/317369@main) [bug 319561](https://bugs.webkit.org/show_bug.cgi?id=319561)\n- **Build** `download-built-product` now avoids hanging for hours on a collapsed connection in CI support flows. [commit 317360@main](https://commits.webkit.org/317360@main) [bug 319611](https://bugs.webkit.org/show_bug.cgi?id=319611)\n- **Refactor** `CrashOnOverflow::overflowed()` was marked `NODELETE`, tightening object lifetime assumptions in low-level overflow handling. [commit 317368@main](https://commits.webkit.org/317368@main) [bug 319557](https://bugs.webkit.org/show_bug.cgi?id=319557)\n\n### Testing, ports, and project maintenance\n- **Refactor** `ExecutionHandlerIdleStopTest.cpp` replaced start and stop markers, a test cleanup in idle execution handling. [commit 317423@main](https://commits.webkit.org/317423@main) [bug 319690](https://bugs.webkit.org/show_bug.cgi?id=319690)\n- **DevTools** A flaky inspector target test on macOS arm64 was gardened for timeout and crash behavior. [commit 317419@main](https://commits.webkit.org/317419@main) [bug 319643](https://bugs.webkit.org/show_bug.cgi?id=319643)\n- **Build** WPE got a new tutorial for creating a browser with the WPE Platform, a nice quality-of-life win for embedders. [commit 317411@main](https://commits.webkit.org/317411@main) [bug 319510](https://bugs.webkit.org/show_bug.cgi?id=319510)\n- **Refactor** `WebExtensionAPITest` was ported to C++, continuing the long migration away from older harness patterns. [commit 317383@main](https://commits.webkit.org/317383@main) [bug 302211](https://bugs.webkit.org/show_bug.cgi?id=302211)\n- **Build** A regression fix for the COOP popup assertion was also gardened separately in test expectations. [commit 317361@main](https://commits.webkit.org/317361@main) [bug 319273](https://bugs.webkit.org/show_bug.cgi?id=319273)\n- **Build** The contributors list picked up Zhuo Ying Jiang Li. [commit 317410@main](https://commits.webkit.org/317410@main) [bug 319679](https://bugs.webkit.org/show_bug.cgi?id=319679)\n\n## Reverts \u0026 Reapplies", "repo": "webkit", "repoDisplay": "WebKit", "rollGroups": [ { "name": "Unreviewed", "count": 1 } ], "since": "2026-07-17", "totals": { "commits": 69, "features": 68, "rolls": 1 }, "until": "2026-07-17" }