{ "commits": { "317522@main": { "author": "Gerald Squelart", "avatar": "https://www.gravatar.com/avatar/894904f08d85651bf2a76868a4d2f1b3?d=identicon\u0026s=64", "cl": "317522@main", "clUrl": "https://commits.webkit.org/317522@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=296971\nrdar://157605644\n\nReviewed by Mike Wyrzykowski.\n\nCurrently PixelBuffer has 3 direct subclasses: ByteArrayPixelBuffer,\nFloat16ArrayPixelBuffer and ShareablePixelBuffer.\n\nByte- and Float16- have pretty much the same underlying storage: A\nJavaScriptCore typed array, which is always a subclass of\nJSC::ArrayBufferView. (But ShareablePixelBuffer is different.)\n\nIn some situations that only deal, or used to deal, with\nByteArrayPixelBuffer, we will want them to work with\nFloat16ArrayPixelBuffer as well.\nInstead of doubling the code at each site, it would be best to use a\ncommon base class that can abstract the differences in most cases, like\naccessing the data as bytes.\nBut at the same time, we can't just use the current base PixelBuffer, as\nwe don't want to have to also deal with ShareablePixelBuffer, which\nshouldn't happen in these code paths anyway.\n\nSo this introduces an intermediate abstract base class ArrayPixelBuffer\nfor these array-based concrete PixelBuffers.\nNote that this abstract class ArrayPixelBuffer has non-virtual member\nfunctions to access the data, so there is no penalty when calling them,\nand the compiler could even inline them.\n\nIn summary, the class hierarchy is now as follows:\n- PixelBuffer: Any kind of pixel buffer, this abstract base class\n stores the format, size, and a non-owning span to the data bytes.\n- ShareablePixelBuffer: Concrete subclass owning a SharedMemory,\n with non-virtual data() to access that SharedMemory.\n- ArrayPixelBuffer: Abstract subclass owning a JSC::ArrayBufferView,\n with non-virtual data() to access that JSC buffer. Useful for e.g.:\n canvas to cache putImageData pixels.\n~ TypedArrayPixelBuffer: Templated concrete subclass, which\n guarantees by construction that the underlying data() is of a\n certain concrete type.\n- ByteArrayPixelBuffer=Typed\u003cJSC::Uint8ClampedArray\u003e:\n Instantiation for byte-oriented buffers, useful for code that\n only deals with these, like BitmapImage.\n- Float16ArrayPixelBuffer=Typed\u003cJSC::Float16Array\u003e: The newer\n intantiation to be used for HDR-capable elements.\n\nOther improvements:\n- Make leaf subclasses final.\n- Make PixelBuffer member variables private for better encapsulation.\n- Make PixelBuffer member variables const because they should never change.\n- Make PixelBuffer::type() pure virtual, to ensure concrete subclasses\n override it.\n- Qualify takeData() as `\u0026\u0026` to force object to be moved-from and catch\n potential use-after-move's.\n\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/html/ImageData.cpp:\n(WebCore::ImageData::create):\n* Source/WebCore/html/ImageDataArray.cpp:\n(isType): Deleted.\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:\n(WebCore::CanvasRenderingContext2DBase::makeImageDataIfContentsCached const):\n* Source/WebCore/platform/graphics/ArrayPixelBuffer.cpp: Added.\n(WebCore::ArrayPixelBuffer::ArrayPixelBuffer):\n* Source/WebCore/platform/graphics/ArrayPixelBuffer.h: Added.\n(WebCore::ArrayPixelBuffer::takeData):\n(isType):\n* Source/WebCore/platform/graphics/PixelBuffer.cpp:\n* Source/WebCore/platform/graphics/PixelBuffer.h:\n(WebCore::PixelBuffer::type const): Deleted.\n* Source/WebCore/platform/graphics/TypedArrayPixelBuffer.cpp:\n(WebCore::\u003e::TypedArrayPixelBuffer):\n* Source/WebCore/platform/graphics/TypedArrayPixelBuffer.h:\n* Source/WebKit/GPUProcess/graphics/ShareablePixelBuffer.h:\n(WebKit::ShareablePixelBuffer::data const): Deleted.\n\nCanonical link: https://commits.webkit.org/317522@main", "email": "g_squelart@apple.com", "hash": "921a80bb8d6adfbad24f3707282965b8b4080274", "subject": "ArrayPixelBuffer superclass of TypedArrayPixelBuffer" }, "317523@main": { "author": "Abrar Rahman Protyasha", "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64", "cl": "317523@main", "clUrl": "https://commits.webkit.org/317523@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319777\nrdar://182636942\n\nReviewed by Richard Robinson.\n\nThis patch migrates WebPage::handleDoubleTapForDoubleClickAtPoint(),\nalong with associated IPC support, out of iOS-only code paths into the\nshared ENABLE(TWO_PHASE_CLICKS) path, so any configuration that enables\ntwo-phase clicks can dispatch a DOM dblclick and a detail==2 click.\n\nTo achieve this, on top of just search-and-replacing platform guards,\nwe plumb the mouse event input source and synthetic click type through\nthe double click IPC message instead of hardcoding them. The iOS caller\nexplicitly passes the previous defaults UserDefault and OneFingerTap.\n\n* Source/WebKit/Scripts/webkit/messages.py:\n(headers_for_type):\n* Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm:\n(WebKit::WebPageProxy::handleDoubleTapForDoubleClickAtPoint):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm:\n(-[WKContentView _doubleTapRecognizedForDoubleClick:]):\n* Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm:\n(WebKit::WebPageProxy::handleDoubleTapForDoubleClickAtPoint): Deleted.\n* Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm:\n(WebKit::windowWithDoubleClickEventListener):\n(WebKit::WebPage::handleDoubleTapForDoubleClickAtPoint):\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::didCommitLoad):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.messages.in:\n* Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm:\n(WebKit::windowWithDoubleClickEventListener): Deleted.\n(WebKit::WebPage::handleDoubleTapForDoubleClickAtPoint): Deleted.\n\nCanonical link: https://commits.webkit.org/317523@main", "email": "a_protyasha@apple.com", "hash": "c3785b72e0af3cf6bd8db6d5c0b180484dca9011", "subject": "Synthetic click based DOM dblclick support should be available for all ENABLE_TWO_PHASE_CLICKS configurations" }, "317524@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "317524@main", "clUrl": "https://commits.webkit.org/317524@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319662\nrdar://182496956\n\nReviewed by Yijia Huang.\n\nNow UnbarrieredMonotonicTime is used in ApproximateTime if possible, so\nusing ApproximateTime for deadline representation in Opportunistic Task\nScheduler and Incremental Sweeper as it does not have precision issues.\nWhen it is not available, it is either (1) still precision is fine or\n(2) MonotonicTime is used.\n\n* Source/JavaScriptCore/heap/IncrementalSweeper.cpp:\n(JSC::IncrementalSweeper::doWorkUntil):\n(JSC::IncrementalSweeper::doWork):\n(JSC::IncrementalSweeper::doSweep):\n* Source/JavaScriptCore/heap/IncrementalSweeper.h:\n* Source/JavaScriptCore/runtime/VM.cpp:\n(JSC::VM::performOpportunisticallyScheduledTasks):\n* Source/JavaScriptCore/runtime/VM.h:\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::performOpportunisticallyScheduledTasks):\n\nCanonical link: https://commits.webkit.org/317524@main", "email": "ysuzuki@apple.com", "hash": "e1d43e57f4b1f721602480ec3bf2379e69ade3d0", "subject": "[JSC] Use ApproximateTime for deadline in Opportunistic Task Scheduler and Incremental Sweeper" }, "317525@main": { "author": "Megan Gardner", "avatar": "https://www.gravatar.com/avatar/b466a5bcbfabf4d82a8ecc595db5a531?d=identicon\u0026s=64", "cl": "317525@main", "clUrl": "https://commits.webkit.org/317525@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319794\nrdar://182671576\n\nUnreviewed Test Gardening.\n\nThe text-underline-offset fix (which resolves highlight decoration offset/thickness against the painting box)\nalso made font-, container-query-, and viewport-relative decoration metrics resolve correctly in ::highlight().\n\n* LayoutTests/TestExpectations:\n\nCanonical link: https://commits.webkit.org/317525@main", "email": "megan_gardner@apple.com", "hash": "4b68256b328b7bbfbfcf19d9fb436cae4134b461", "subject": "[Custom Highlight] Unskip ::highlight() decoration metrics tests now passing after the text-underline-offset fix." }, "317526@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "317526@main", "clUrl": "https://commits.webkit.org/317526@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319606\nrdar://182434983\n\nReviewed by Sihui Liu.\n\nThe test asserted that WebPageProxy::createNewPage() rejects a hostile\nEncodedFileData request body via its hasGrantedSandboxExtensionForFile\nMESSAGE_CHECK. That check is no longer reachable for this payload:\n316378@main (bug 314948) tightened IPC::FormDataReference decoding to drop\nthe body when a file element is not accompanied by a consumable sandbox\nextension. The test supplies a null extension handle, so the body is now\ndropped at decode and createNewPage() never sees an httpBody. The test\npreviously relied on the pre-fix behavior, which vacuously treated null\nhandles as successfully consumed and let the body through to the check.\n\nWith the body dropped, control instead reaches the sender-ownership check\nadded by e9f94fd4c643 (bug 315535):\n```\n !navigationActionData.originatingPageID\n || process-\u003eisAssociatedWithPage(*navigationActionData.originatingPageID)\n```\nThe test's fabricated originatingPageID does not satisfy this check, so it\nis rejected there. Depending on whether the body survived decode (which\nvaries by build/configuration), the test observed either the expected\nhasGrantedSandboxExtensionForFile check or this unrelated originatingPageID\ncheck, which is what CI flagged as flaky.\n\nThe hostile file body is still rejected at one layer or the other, so this\nis a stale assertion, not a security regression. Make the test robust:\n\n - Move testRunner.notifyDone() into the TakeInvalidMessageStringForTesting\n reply callback so the page and frame stay alive through CreateNewPage\n dispatch.\n - Set originatingPageID to NULLOPT. It is orthogonal to what this test\n covers (the file-body check runs earlier and is unaffected); leaving it\n non-null only tripped the unrelated sender-ownership check.\n - Accept both safe outcomes as a PASS: the body being dropped at decode\n (no invalid message recorded) or the hasGrantedSandboxExtensionForFile\n MESSAGE_CHECK firing on builds where the body survives decode. Only an\n unexpected message check now fails the test.\n\nNote: createNewPage()'s file-body MESSAGE_CHECK is now shadowed by\nFormDataReference's decode-time enforcement and is effectively unreachable\nvia this IPC path. This test is consequently a defense-in-depth smoke test.\n\n* LayoutTests/http/tests/ipc/createnewpage-file-body-sandbox-extension.html:\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/317526@main", "email": "cdumez@apple.com", "hash": "a703efa383be16a62995db8621aaf3b47ac3471c", "subject": "NEW TEST(316388@main): [macOS iOS debug]: http/tests/ipc/createnewpage-file-body-sandbox-extension.html is constant failure" }, "317527@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "317527@main", "clUrl": "https://commits.webkit.org/317527@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319790\nrdar://182662714\n\nReviewed by Keith Miller.\n\nConverting Double -\u003e Boolean can be done with branchless JIT code\n(compareDouble). This patch applies it. FTL is already doing so, so we\ndo not need to have additional change in FTL.\n\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:\n(JSC::DFG::SpeculativeJIT::compileToBoolean):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:\n(JSC::DFG::SpeculativeJIT::compileToBoolean):\n* Source/JavaScriptCore/jit/AssemblyHelpers.cpp:\n(JSC::AssemblyHelpers::emitConvertValueToBoolean):\n\nCanonical link: https://commits.webkit.org/317527@main", "email": "ysuzuki@apple.com", "hash": "56453fdfe0b0ca6258c23e6453b34f70b885d13f", "subject": "[JSC] Converting Double -\u003e Bool should be branchless" }, "317528@main": { "author": "Cole Carley", "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64", "cl": "317528@main", "clUrl": "https://commits.webkit.org/317528@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318829\nrdar://137553836\n\nReviewed by Wenson Hsieh.\n\nThe clipboard (navigator.clipboard) did not support image/svg+xml.\nSVG could not simply be allowed through like other image types because\nit can carry scripts, event handlers, javascript: URLs, and external\nreferences.\n\nThis patch adds image/svg+xml as a supported clipboard type and sanitizes\nit on both the write and read paths, modeled on the sanitization baseline\nin the Sanitizer API (https://wicg.github.io/sanitizer-api/).\n\nI also removed content hidden with display: none. To do this, I added a\nnew callback to sanitizeMarkup that get's run post-layout, so we have\naccess to the computed style of each element.\n\n* LayoutTests/editing/async-clipboard/sanitize-when-reading-and-writing-svg-expected.txt: Added.\n* LayoutTests/editing/async-clipboard/sanitize-when-reading-and-writing-svg.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/clipboard-apis/clipboard-item.https-expected.txt:\n* Source/WebCore/Modules/async-clipboard/Clipboard.cpp:\n(WebCore::Clipboard::getType):\n* Source/WebCore/Modules/async-clipboard/ClipboardImageReader.cpp:\n(WebCore::ClipboardImageReader::readBuffer):\n(WebCore::ClipboardImageReader::readSVG):\n* Source/WebCore/Modules/async-clipboard/ClipboardImageReader.h:\n* Source/WebCore/Modules/async-clipboard/ClipboardItem.cpp:\n(WebCore::ClipboardItem::supports):\n* Source/WebCore/Modules/async-clipboard/ClipboardItemBindingsDataSource.cpp:\n(WebCore::ClipboardItemBindingsDataSource::ClipboardItemTypeLoader::sanitizeDataIfNeeded):\n* Source/WebCore/Modules/async-clipboard/ios/ClipboardImageReaderIOS.mm:\n(WebCore::ClipboardImageReader::readBuffer):\n* Source/WebCore/Modules/async-clipboard/mac/ClipboardImageReaderMac.mm:\n(WebCore::ClipboardImageReader::readBuffer):\n* Source/WebCore/editing/markup.cpp:\n(WebCore::sanitizeMarkup):\n(WebCore::sanitizeSVG):\n(WebCore::sanitizedMarkupForFragmentInDocument):\n* Source/WebCore/editing/markup.h:\n* Source/WebCore/platform/cocoa/PasteboardCocoa.mm:\n(WebCore::cocoaTypeToImageType):\n(WebCore::imageTypeToMIMEType):\n(WebCore::imageTypeToFakeFilename):\n* Source/WebCore/platform/glib/PasteboardGLib.cpp:\n(WebCore::Pasteboard::read):\n* Source/WebCore/platform/ios/PlatformPasteboardIOS.mm:\n(WebCore::safeTypeForDOMToReadAndWriteForPlatformType):\n(WebCore::PlatformPasteboard::platformPasteboardTypeForSafeTypeForDOMToReadAndWrite):\n* Source/WebCore/platform/mac/PlatformPasteboardMac.mm:\n(WebCore::PlatformPasteboard::platformPasteboardTypeForSafeTypeForDOMToReadAndWrite):\n(WebCore::webSafeMIMETypeForModernPasteboardType):\n* Source/WebKit/UIProcess/gtk/WebPasteboardProxyGtk.cpp:\n(WebKit::WebPasteboardProxy::writeCustomData):\n(WebKit::pasteboardItemInfoFromFormats):\n* Source/WebKit/UIProcess/wpe/WebPasteboardProxyWPE.cpp:\n(WebKit::WebPasteboardProxy::writeCustomData):\n(WebKit::pasteboardItemInfoFromFormats):\n* Tools/WebKitTestRunner/PlatformMac.cmake:\n\nCanonical link: https://commits.webkit.org/317528@main", "email": "ccarley2@apple.com", "hash": "f22a4386b7f213365c5cf30ef5597160e39b0b1f", "subject": "sf-saas.apple.com: Support copy/paste of SVG data" }, "317529@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317529@main", "clUrl": "https://commits.webkit.org/317529@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319797\nrdar://182674783\n\nReviewed by Chris Dumez.\n\nThe HashSet\u003cObjectIdentifierGeneric\u003cT, U, V\u003e\u003e specialization of\nCrossThreadCopierBase predates the IsNeeded flag and move-aware\ncopy() overload that the generic HashSet specialization gained\nlater, leaving it inconsistent with its sibling specializations\nand any code that queries IsNeeded for such a set.\n\n* Source/WTF/wtf/CrossThreadCopier.h:\n\nCanonical link: https://commits.webkit.org/317529@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "b214bd1362ead100935b58d2ff6227347767d52a", "subject": "CrossThreadCopierBase\u003cHashSet\u003cObjectIdentifierGeneric\u003e\u003e is missing IsNeeded and move-copy overload" }, "317530@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317530@main", "clUrl": "https://commits.webkit.org/317530@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319524\nrdar://182346464\n\nReviewed by Chris Dumez.\n\nThe variadic (3+ argument) overload of saturatingSum hardcoded its return\ntype as uint32_t, even though it delegates to the two-argument overloads,\nwhich correctly return the operand type. As a result, a saturating sum of\nthree or more arguments of a type wider than 32 bits (e.g. uint64_t) was\ncomputed correctly and then silently narrowed to uint32_t on return.\n\nNo in-tree caller currently trips this (the only variadic call site sums\nuint32_t values), so this is a latent correctness bug rather than an\nactive regression, but it is a trap waiting for the next wider-type caller.\n\nFix the return type to follow the operand type (IntegralType) instead of\nthe hardcoded uint32_t, and add API test coverage for the wide-type,\n3+ argument case, including a static_assert pinning the deduced return\ntype to the operand type.\n\nTest: Tools/TestWebKitAPI/Tests/WTF/SaturatingArithmeticOperations.cpp\n\n* Source/WTF/wtf/SaturatingArithmetic.h:\n(WTF::saturatingSum):\n* Tools/TestWebKitAPI/Tests/WTF/SaturatingArithmeticOperations.cpp:\n(TestWebKitAPI::TEST(WTF, SaturatingArithmeticAddition)):\n\nCanonical link: https://commits.webkit.org/317530@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "c9f0d5b44c9675990e91018b11f68d1c6f503900", "subject": "WTF::saturatingSum variadic overload truncates 3+ argument sums to uint32_t" }, "317531@main": { "author": "John Cardullo", "avatar": "https://www.gravatar.com/avatar/b92246f7b27e43c7656482c8ba7b5143?d=identicon\u0026s=64", "cl": "317531@main", "clUrl": "https://commits.webkit.org/317531@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317322\n\nReviewed by Michael Catanzaro and Carlos Garcia Campos.\n\nTo resolve GNOME Epiphany issue #1544, expose magnification get/set APIs\nin WebKit's GLib API layer (WebKitWebView). Also, add support for notifying\nproperty changes via a new \"magnification\" GObject property when pinch-zoom occurs.\nAdd API documentation and test coverage for the magnification APIs.\n\n* Source/WebKit/UIProcess/PageClient.h:\n(WebKit::PageClient::pageScaleFactorDidChange): Added.\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::pageScaleFactorDidChange): Forward scale changes to m_pageClient.\n* Source/WebKit/UIProcess/API/gtk/PageClientImpl.h:\n* Source/WebKit/UIProcess/API/gtk/PageClientImpl.cpp:\n(WebKit::PageClientImpl::pageScaleFactorDidChange): Trigger webkitWebViewDidChangePageScale.\n* Source/WebKit/UIProcess/API/wpe/PageClientImpl.h:\n* Source/WebKit/UIProcess/API/wpe/PageClientImpl.cpp:\n(WebKit::PageClientImpl::pageScaleFactorDidChange): Forward to WPE View.\n* Source/WebKit/UIProcess/API/wpe/WPEWebView.h:\n* Source/WebKit/UIProcess/API/wpe/WPEWebView.cpp:\n(WKWPE::View::pageScaleFactorDidChange): Notify WPE API view client.\n* Source/WebKit/UIProcess/API/wpe/APIViewClient.h:\n(API::ViewClient::pageScaleFactorDidChange): Added virtual method.\n* Source/WebKit/UIProcess/API/wpe/WebKitWebViewClient.h:\n* Source/WebKit/UIProcess/API/glib/WebKitWebView.h.in:\nAdd declarations for webkit_web_view_set_magnification and webkit_web_view_get_magnification.\n* Source/WebKit/UIProcess/API/glib/WebKitWebViewPrivate.h:\nDeclare webkitWebViewDidChangePageScale private helper.\n* Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp:\n(webkit_web_view_class_init): Document PROP_MAGNIFICATION.\n(WebKitWebViewClient::pageScaleFactorDidChange): Call webkitWebViewDidChangePageScale.\n(webkitWebViewDidChangePageScale): Notify magnification property change.\n(webkit_web_view_set_magnification): Scale page in view coordinates around the center point, and notify PROP_MAGNIFICATION change.\n(webkit_web_view_get_magnification): Retrieve pageScaleFactor.\n* Tools/TestWebKitAPI/Tests/WebKit/WKPage/glib/TestWebKitWebView.cpp:\n(magnificationChangedCallback): Added.\n(testWebViewMagnification): Added.\n(beforeAll): Register the magnification test.\n\nCanonical link: https://commits.webkit.org/317531@main", "email": "john@jcarmedia.org", "hash": "3bac3385d0b910a1f461dfd78508871f84bd8243", "subject": "GLib: Add magnification get/set APIs and notify property changes" }, "317532@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "317532@main", "clUrl": "https://commits.webkit.org/317532@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319555\n\nReviewed by Ryosuke Niwa.\n\n* Source/WTF/wtf/OverflowHandler.h:\n(WTF::AssertNoOverflow::crash):\n(WTF::RecordOverflow::crash):\n* Source/WebKit/Shared/Cocoa/CoreIPCNSURLRequest.mm:\n(WebKit::isTypedAllowlistKey):\n* Source/WebKit/Shared/WebBackForwardListFrameItem.h:\n* Source/WebKit/UIProcess/WebFullScreenManagerProxy.cpp:\n(WebKit::WebFullScreenManagerProxy::attachToNewClient):\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::contentRelativeViewsHysteresisTimerFired):\n* Source/WebKit/WebProcess/Network/webrtc/WebRTCResolver.h:\n* Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm:\n(WebKit::WebPage::didFlushLayerTreeAtTime):\n* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:\n(WebKit::WebFrame::containsAnyFormControls const):\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::didUpdateRendering):\n(WebKit::WebPage::shouldTriggerRenderingUpdate const):\n(WebKit::WebPage::finalizeRenderingUpdate):\n(WebKit::WebPage::releaseMemory):\n(WebKit::WebPage::remoteImagesCountForTesting const):\n(WebKit::WebPage::ensureRemoteRenderingBackendProxy):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Source/WebKit/WebProcess/WebProcess.cpp:\n(WebKit::failedToGetNetworkProcessConnection):\n* Source/JavaScriptCore/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/WTF/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/WebGPU/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/WebKit/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/WebKit/SaferCPPExpectations/RetainPtrCtorAdoptCheckerExpectations:\n* Source/WebKit/SaferCPPExpectations/UncheckedLocalVarsCheckerExpectations:\n* Source/WebKit/SaferCPPExpectations/UncountedCallArgsCheckerExpectations:\n* Source/WebKit/SaferCPPExpectations/UncountedLocalVarsCheckerExpectations:\n* Source/WebKit/SaferCPPExpectations/UnretainedCallArgsCheckerExpectations:\n\nCanonical link: https://commits.webkit.org/317532@main", "email": "cdumez@apple.com", "hash": "8f92bfdda93f83bbccb356464e001f89944a543e", "subject": "[SaferCPP] Address warnings in Source/WebKit" }, "317533@main": { "author": "Fujii Hironori", "avatar": "https://www.gravatar.com/avatar/ef99cb23f5e5d27977968ca097d9a85f?d=identicon\u0026s=64", "cl": "317533@main", "clUrl": "https://commits.webkit.org/317533@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319437\n\nReviewed by Carlos Garcia Campos.\n\n315799@main added findEventListenerRegionTypes() in ScrollingTreeCoordinated.cpp\nby copying collectDescendantLayersAtPoint() in the file. They can be consolidated.\nRemoved them, and added traverseDescendantLayersAtPoint().\n\n* Source/WebCore/page/scrolling/coordinated/ScrollingTreeCoordinated.cpp:\n(WebCore::traverseDescendantLayersAtPoint):\n(WebCore::ScrollingTreeCoordinated::scrollingNodeForPoint):\n(WebCore::ScrollingTreeCoordinated::eventListenerRegionTypesForPoint const):\n(WebCore::collectDescendantLayersAtPoint): Deleted.\n(WebCore::findEventListenerRegionTypes): Deleted.\n\nCanonical link: https://commits.webkit.org/317533@main", "email": "fujii@igalia.com", "hash": "0655dded5553cf5590d8d36a5965b3a771fc93e5", "subject": "[Coordinated Graphics] ScrollingTreeCoordinated: Consolidate findEventListenerRegionTypes and collectDescendantLayersAtPoint" }, "317534@main": { "author": "Philippe Normand", "avatar": "https://www.gravatar.com/avatar/eef27203750af3510263cc29af21a16e?d=identicon\u0026s=64", "cl": "317534@main", "clUrl": "https://commits.webkit.org/317534@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319489\n\nReviewed by Xabier Rodriguez-Calvar.\n\nuridecodebin hardcodes it to \"source\", which doesn't ease debugging involving multiple players. This\nissue is not present when playbin3 is used for playback.\n\n* Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:\n(WebCore::MediaPlayerPrivateGStreamer::sourceSetup):\n\nCanonical link: https://commits.webkit.org/317534@main", "email": "philn@igalia.com", "hash": "ae8ff801e92a4d62cfaa95a8a5912988c5955790", "subject": "[GStreamer] Give meaningful unique name to our HTTP source elements" }, "317535@main": { "author": "Carlos Garcia Campos", "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64", "cl": "317535@main", "clUrl": "https://commits.webkit.org/317535@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319809\n\nReviewed by Adrian Perez de Castro.\n\nIt replaces the empty spaces with null characters, but the size of the\nCString doesn't change. This is causing that the formats string shown in\nwebkit://gpu is garbled. It doesn't affect GTK for me because it doesn't\nshow any format with trailing spaces, but the bug is present anyway. We\ncan use a std::array instead of a CString, wich also saves a heap\nallocation for every format, and then construct a std::span with the\nbuffer size without the trailing spaces.\n\n* Source/WebKit/UIProcess/API/glib/WebKitProtocolHandler.cpp:\n(WebKit::webkitDrmGetFormatName):\n\nCanonical link: https://commits.webkit.org/317535@main", "email": "cgarcia@igalia.com", "hash": "7b34c82d13a834bce7e40335ec32c39ee8b2cdb8", "subject": "[GTK][WPE] Function webkitDrmGetFormatName produces wrong string when trimming trailing spaces" }, "317536@main": { "author": "Carlos Garcia Campos", "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64", "cl": "317536@main", "clUrl": "https://commits.webkit.org/317536@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319810\n\nReviewed by Adrian Perez de Castro.\n\nA null device in a preferred buffer format tranche means using the main\ndevice, so check if tranche device is null and use the main one instead.\n\n* Source/WebKit/UIProcess/API/glib/WebKitProtocolHandler.cpp:\n(WebKit::preferredBufferFormats):\n\nCanonical link: https://commits.webkit.org/317536@main", "email": "cgarcia@igalia.com", "hash": "9e6e8ccd4bcff98bb0646258a4b9cabe48f896c0", "subject": "[WPE] webkit://gpu doesn't show the preferred format device when using the default" }, "317537@main": { "author": "SABITHSAHEB", "avatar": "https://www.gravatar.com/avatar/797f235ab64c002e72b2bb8012bec6c1?d=identicon\u0026s=64", "cl": "317537@main", "clUrl": "https://commits.webkit.org/317537@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319161\n\nReviewed by Patrick Griffis.\n\nuserVisibleURL() probes the output buffer for an \"xn--\" prefix by reading\nback from the index it just wrote (after[afterIndex - 4 .. afterIndex - 2]),\nbut it gated those reads on the input index (i \u003e= 3) rather than the output\nindex. When an earlier percent escape decodes to a single byte (for example\n%AB, which is \u003e 0x7f), the input index advances three positions while the\noutput index advances one, so a '-' can be reached while afterIndex \u003c 4.\nafterIndex - 4 then wraps around as size_t and indexes the bounds-checked\nVector out of range.\n\nGate the probe on afterIndex \u003e= 4 so it tracks the buffer it actually reads.\nA legitimate \"xn--\" prefix always writes four literal output bytes, so its\ndetection is unaffected. The input is reachable from untrusted data through\nthe public webkit_uri_for_display() API and Internals.userVisibleString; the\nminimal trigger is \"%AB-\".\n\n* Source/WTF/wtf/URLHelpers.cpp:\n(WTF::URLHelpers::userVisibleURL):\n* Tools/TestWebKitAPI/Tests/WebKit/WKPage/glib/TestWebKitURIUtilities.cpp:\n(testURIForDisplayShortPercentEncoded):\n(beforeAll):\n\nCanonical link: https://commits.webkit.org/317537@main", "email": "shabi7204192361@gmail.com", "hash": "e08a16763c94edc94dbd8bf2a7d498f3451e5d9f", "subject": "Fix out-of-bounds buffer index in userVisibleURL when probing for xn--" }, "317538@main": { "author": "Taher Ali", "avatar": "https://www.gravatar.com/avatar/e104800647d8c98b8c9dbe736b5e1751?d=identicon\u0026s=64", "cl": "317538@main", "clUrl": "https://commits.webkit.org/317538@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=258225\nrdar://114823248\n\nReviewed by Simon Fraser.\n\nAn SVG element's filter can now reference a \u003cfilter\u003e in another document —\nfilter=\"url(effects.svg#blur)\" or a data: URL instead of only a same-document\n`#id` reference.\n\nThis covers the filter presentation attribute on SVG elements only. External references from\nthe CSS filter property on HTML elements are a separate follow-up.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/css/filter-effects/svg-data-uri-filter-resource-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/filter-effects/svg-data-uri-filter-resource.html: Added.\n* Source/WebCore/rendering/svg/legacy/SVGResources.cpp:\n(WebCore::externalSVGResourceDocument):\n(WebCore::paintingResourceFromSVGPaint):\n(WebCore::SVGResources::buildCachedResources):\n* Source/WebCore/style/StylePendingResources.cpp:\n(WebCore::Style::loadExternalSVGResource):\n(WebCore::Style::loadPendingExternalSVGPaint):\n(WebCore::Style::loadPendingResources):\n* Source/WebCore/svg/SVGDocumentExtensions.cpp:\n(WebCore::SVGDocumentExtensions::hasExternalSVGResource const):\n(WebCore::SVGDocumentExtensions::addExternalSVGResource):\n(WebCore::SVGDocumentExtensions::isolatedSVGDocumentContext const):\n(WebCore::SVGDocumentExtensions::hasExternalSVGPaintResource const): Deleted.\n(WebCore::SVGDocumentExtensions::addExternalSVGPaintResource): Deleted.\n(WebCore::SVGDocumentExtensions::isolatedSVGPaintDocument const): Deleted.\n* Source/WebCore/svg/SVGDocumentExtensions.h:\n\nCanonical link: https://commits.webkit.org/317538@main", "email": "taher_ali@apple.com", "hash": "bc43d30fafc655c6428c87f9b96f5c50838933c9", "subject": "Support external and data: URL filter references on SVG elements" }, "317539@main": { "author": "Elika Etemad", "avatar": "https://www.gravatar.com/avatar/55e113d03e0552e6df90ecbc15acd9b8?d=identicon\u0026s=64", "cl": "317539@main", "clUrl": "https://commits.webkit.org/317539@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319521\nrdar://182338907\n\nReviewed by Alan Baradlay.\n\nWe have a lot of APIs that take WritingMode in order to map coordinates;\nfor example the marginStart()/marginBefore() getters.\n\nHowever layout does not always follow the primary inline/block directions.\nFor example, flex-flow can reverse these directions or transpose them.\nAnd inline layout is oriented to the line's over/under sides, which might\nnot match the block-start/inline-start sides.\n\nRather than requiring these cases to create their own mapping tools, this\npatch creates a FlowMode object that mimics WritingMode, and can be used\nsimilarly: it can be queried in ways similar to WritingMode, and can also\nbe cast into a WritingMode for use in existing APIs that accept WritingMode.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/FlowModeTests.cpp\n\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/platform/BoxSides.h:\n* Source/WebCore/platform/FlowMode.h: Added.\n(WebCore::FlowReversal::FlowReversal):\n(WebCore::FlowReversal::isMainReversed const):\n(WebCore::FlowReversal::isCrossReversed const):\n(WebCore::FlowMode::FlowMode):\n(WebCore::FlowMode::isMainHorizontal const):\n(WebCore::FlowMode::isMainInline const):\n(WebCore::FlowMode::isMainReverse const):\n(WebCore::FlowMode::isCrossReverse const):\n(WebCore::FlowMode::matches const):\n(WebCore::FlowMode::isOrthogonal const):\n(WebCore::FlowMode::isMainOpposing const):\n(WebCore::FlowMode::isCrossOpposing const):\n(WebCore::FlowMode::isMainMatchingAny const):\n(WebCore::FlowMode::isCrossMatchingAny const):\n(WebCore::FlowMode::isMainTopToBottom const):\n(WebCore::FlowMode::isMainLeftToRight const):\n(WebCore::FlowMode::isCrossTopToBottom const):\n(WebCore::FlowMode::isCrossLeftToRight const):\n(WebCore::FlowMode::isAnyTopToBottom const):\n(WebCore::FlowMode::isAnyLeftToRight const):\n(WebCore::FlowMode::isMainFlipped const):\n(WebCore::FlowMode::isCrossFlipped const):\n(WebCore::FlowMode::isInlineFlipped const):\n(WebCore::FlowMode::isBlockFlipped const):\n(WebCore::FlowMode::mainDirection const):\n(WebCore::FlowMode::crossDirection const):\n(WebCore::FlowMode::mainAxis const):\n(WebCore::FlowMode::crossAxis const):\n(WebCore::operator\u003c\u003c):\n* Source/WebCore/platform/text/WritingMode.h:\n* Source/WebCore/rendering/style/RenderStyleConstants.h:\n(WebCore::toAxisDirection):\n* Source/WebCore/style/computed/StyleComputedStyle+GettersInlines.h:\n(WebCore::Style::ComputedStyle::isReverseFlexDirection const):\n(WebCore::Style::ComputedStyle::flexFlowMode const):\n* Source/WebCore/style/computed/StyleComputedStyle.h:\n* Tools/TestWebKitAPI/CMakeLists.txt:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebCore/FlowModeTests.cpp: Added.\n(TestWebKitAPI::writingModeString):\n(TestWebKitAPI::flowModeString):\n(TestWebKitAPI::flowReversalString):\n(TestWebKitAPI::TEST(FlowMode, BoxAxisConstructor)):\n(TestWebKitAPI::TEST(FlowMode, LogicalBoxAxisConstructor)):\n(TestWebKitAPI::TEST(FlowMode, ConversionStyleConstructor)):\n\nCanonical link: https://commits.webkit.org/317539@main", "email": "fantasai.bugs@inkedblade.net", "hash": "ff9b65a73dacb1403fb444ab7e5ec60631db81cf", "subject": "Create FlowMode to allow using WritingMode APIs with e.g. flex-flow" }, "317540@main": { "author": "Shu-yu Guo", "avatar": "https://www.gravatar.com/avatar/3884544eb9e557e2ec917d32c6e12720?d=identicon\u0026s=64", "cl": "317540@main", "clUrl": "https://commits.webkit.org/317540@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319705\nrdar://181293951\n\nReviewed by Mark Lam and Yusuke Suzuki.\n\nResizable ArrayBuffers that are backed by Wasm memories cannot grow beyond\n65536 pages. Currently, we RELEASE_ASSERT when exceeding that max. This PR\nfixes it to throw a RangeError instead.\n\nTest: JSTests/wasm/js-api/memory-toResizableBuffer.js:\n\n* JSTests/wasm/js-api/memory-toResizableBuffer.js:\n(assertTrue):\n* Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n* Source/JavaScriptCore/runtime/PageCount.h:\n(JSC::PageCount::fromBytes):\n(JSC::PageCount::fromBytesUnchecked):\n\nCanonical link: https://commits.webkit.org/317540@main", "email": "syg@apple.com", "hash": "575b7fa2016905586dc82337b53bd04065f094c5", "subject": "[JSC] Wasm-backed resizable ArrayBuffers should throw for all invalid sizes" }, "317541@main": { "author": "Sammy Gill", "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64", "cl": "317541@main", "clUrl": "https://commits.webkit.org/317541@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=314669\nrdar://problem/176918714\n\nReviewed by Simon Fraser.\n\nIn 302097@main we started to make CSS Zoom affect iframes by making\nframeScaleFactor() return the used zoom value from style for iframes.\nThis allowed us to progress various testcases but certain subtests in\niframe-zoom-nested.html were still failing.\n\nOne problem that the WPT showcases is that we were not correctly\nconsidering this when computing the damaged rect in RenderView::repaintViewRectangle\nand we would only end up painting a portion of the iframes contents. To\nfix this, we need to apply the frame scale factor to the damage rect\nafter we have translated it into the coordinate space of the view so\nthat it properly covers the contents that were changed.\n\nOne thing to note is that I could not get this failure to reproduce\nlocally with WKTR but was able to successfully repro it with the WPT\nrunner. Loading up the testcase in Safari/MiniBrowser also showcased\nsome flakiness so it seems like there are some scenarios in which we\nalready recover from this presumably because we end up repainting the\nentire iframe anyway.\n\nI attempted to create a less flaky version of the WPT but was unable to\ndo so successfully. I did manage to create some varaint however by\ntracking the repaint rects.\n\n* LayoutTests/fast/repaint/css-zoom-iframe-partial-repaint.html: Added.\nAftorementioned testcase that always fails without our change. Note that\nthis covers the branch where we do not have an accumulated repaint\nregion.\n\nCanonical link: https://commits.webkit.org/317541@main", "email": "sammy.gill@apple.com", "hash": "65542b8e3e3178619c500ea71b5322052ce9e41f", "subject": "[EvaluationTimeZoom] Fix css/css-viewport/zoom/iframe-zoom-nested.html" }, "317542@main": { "author": "Tyler Wilcock", "avatar": "https://www.gravatar.com/avatar/9545082e6bed96158a9f52dac6e4b869?d=identicon\u0026s=64", "cl": "317542@main", "clUrl": "https://commits.webkit.org/317542@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319391\nrdar://182223716\n\nReviewed by Dominic Mazzoni.\n\nAn element's aria-actions attribute exposes other elements as custom actions on\nthat element. When an assistive technology invokes one of those actions, the\nfollowing sequence happens:\n\n 1. The platform's custom-action handler calls performCustomActionPress()\n which resolves the action target and presses it.\n\n 2. This dispatches a simulated click (to pretend a \"real\" mouseclick\n happened for privacy reasons). This inherently causes focus to\n move to it.\n\nThe result is that invoking an action steals focus from wherever the AT user was,\nand fires an accessibility focus notification for the target. This is not the\ndesired user experience for aria-actions -- focus should remain on the originating,\naria-actions-having element.\n\nFix this by giving the custom-action path its own press variant, pressPreservingFocus().\nIt records where focus currently is, presses the action target, and if the press moved\nfocus onto that target, restores focus to where it was. The accessibility focus notifications\nfor both the transient move onto the target and the restore are suppressed, so the momentary\nfocus movement is never surfaced to the assistive technology. The check-and-restore is done\nsynchronously, so no author script can run between observing that focus landed\non the target and restoring it. This only affects the aria-actions custom-action path.\n\nIf author script moved focus somewhere other than the action target, that is respected and left\nin place. If the origin can no longer take focus back (e.g. it was disconnected during the press),\nthe real focus is surfaced so the assistive technology can move there instead of being left\npointed at the stale origin.\n\nThis heuristic aligns with other browsers.\n\n* LayoutTests/accessibility/aria-actions-focus-author-override-expected.txt: Added.\n* LayoutTests/accessibility/aria-actions-focus-author-override.html: Added.\n* LayoutTests/accessibility/aria-actions-focus-in-other-frame-expected.txt: Added.\n* LayoutTests/accessibility/aria-actions-focus-in-other-frame.html: Added.\n* LayoutTests/accessibility/aria-actions-focus-no-origin-expected.txt: Added.\n* LayoutTests/accessibility/aria-actions-focus-no-origin.html: Added.\n* LayoutTests/accessibility/aria-actions-focus-restore-fallback-expected.txt: Added.\n* LayoutTests/accessibility/aria-actions-focus-restore-fallback.html: Added.\n* LayoutTests/accessibility/aria-actions-preserves-focus-expected.txt: Added.\n* LayoutTests/accessibility/aria-actions-preserves-focus.html: Added.\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebCore/accessibility/AXCoreObject.cpp:\n(WebCore::Accessibility::performCustomActionPress):\n* Source/WebCore/accessibility/AXObjectCache.cpp:\n(WebCore::AXObjectCache::onFocusChange):\n* Source/WebCore/accessibility/AXObjectCache.h:\n* Source/WebCore/accessibility/AccessibilityObject.cpp:\n(WebCore::AccessibilityObject::pressPreservingFocus):\n* Source/WebCore/accessibility/AccessibilityObject.h:\n\nCanonical link: https://commits.webkit.org/317542@main", "email": "tyler_w@apple.com", "hash": "9d4fccacaa23d20fbc6870a3f1278b656bbd5acf", "subject": "AX: Preserve the user's focus when invoking an aria-actions custom action" }, "317543@main": { "author": "Ryan Haddad", "avatar": "https://www.gravatar.com/avatar/b7d8cd2dec546cac2524e4b58181f9d5?d=identicon\u0026s=64", "cl": "317543@main", "clUrl": "https://commits.webkit.org/317543@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=311433\nrdar://174030151\n\nReviewed by Ryosuke Niwa.\n\nWhen compilation failed, `make analyze` still returned 0 (due to `|| true`), so build-and-analyze\ncontinued on to generate-static-analysis-archive and the SaferCPP EWS step compared an incomplete\nanalyzer output against baseline, spuriously blaming the PR author for pre-existing failures.\n\nThe analyzer emits findings as warnings, so a successful analyze run that finds issues\nstill exits with rc=0. A non-zero exit code only signals a real compilation failure. Propagating\nit end-to-end lets the existing EWS revert/without-change path correctly attribute the failure\ninstead of the author.\n\n* Makefile.shared:\n(analyze): Remove `|| true` so a compilation failure propagates. On success the\nreport-indexing loop still runs as before.\n* Tools/Scripts/build-and-analyze:\n(main): Return early with the non-zero return code when a command fails, so\ngenerate-static-analysis-archive is skipped after a failed compile.\n* Tools/CISupport/ews-build/steps.py:\n(ScanBuild.run): Treat a non-zero return code as failure, not just a missing\n`ANALYZE SUCCEEDED` string, to catch partial builds where an early target\nsucceeds but a later one fails to compile.\n* Tools/CISupport/ews-build/steps_unittest.py:\n(TestScanBuild.test_compile_failure): Added.\n(TestScanBuild.test_partial_compile_failure): Added.\n\nCanonical link: https://commits.webkit.org/317543@main", "email": "ryanhaddad@apple.com", "hash": "8d7dde2b9a29de9204dbba36a839a81d1c5504ef", "subject": "[SaferCPP] Stop analysis when compilation fails to avoid false positives" }, "317544@main": { "author": "Sammy Gill", "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64", "cl": "317544@main", "clUrl": "https://commits.webkit.org/317544@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319713\nrdar://problem/182549809\n\nReviewed by Alan Baradlay.\n\nAllow items without an explicit row placement so that we can place them\nautomatically. An item with an explicit row-start and an auto row-end\n(the default single-row span) is also now accepted by the GFC coverage\ncheck, mirroring the existing column-placement handling.\n\nCanonical link: https://commits.webkit.org/317544@main", "email": "sammy.gill@apple.com", "hash": "98c9e18c53dfa45e0546d96d5ef01a1ebe713c28", "subject": "[GFC] Enable automatic row placement" }, "317545@main": { "author": "Dominic Mazzoni", "avatar": "https://www.gravatar.com/avatar/f76643c44a7ee3be45148e66d97ed8e4?d=identicon\u0026s=64", "cl": "317545@main", "clUrl": "https://commits.webkit.org/317545@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319672\nrdar://182515917\n\nReviewed by Tyler Wilcock and Andres Gonzalez.\n\nAXIndexForTextMarker and AXTextMarkerForIndex are documented inverses\n-- VoiceOver converts a text marker to a document-relative index and\nback -- but in the isolated-tree text path the two directions were\nimplemented by separate traversals that counted positions differently:\n\n- AXTextMarkerRange::toString (the string) walks findObjectWithRuns and emits a newline\n \"don't repeat a newline\" rule).\n- offsetFromRoot (AXIndexForTextMarker) walked nextInPreOrder and counted newlines with\n an emitsNewline() bool that added at most 1, never accounting for DoubleNewline.\n- nextMarkerFromOffset (AXTextMarkerForIndex) walked findMarker and counted every step.\n\nBecause these three disagree, converting a marker to an index and back\ndrifted, and the drift accumulated with each list, table, nested block\nwrapper, \u003cbr\u003e, and paragraph break, so selecting content further down\na page (e.g. Wikipedia) was increasingly wrong.\n\nMake offsetFromRoot and nextMarkerFromOffset inverses by construction\nby driving both from a single shared forward walk\n(forEachRunObjectForward) that mirrors AXTextMarkerRange:: toString's\niteration and newline emission. The index of a marker is defined as\nthe number of characters before it in that walk; nextMarkerFromOffset\nwalks the same way until it has consumed that many characters. Image\nalt text is intentionally excluded, so the index space is independent\nof it. The round-trip is now exact for every real (run-position)\nmarker -- which is what VoiceOver round-trips -- while positions\ninside an emitted newline gap, which have no marker of their own, snap\nto an adjacent boundary (bounded and non-accumulating).\n\nTests: accessibility/mac/text-marker-index-round-trip-list.html\n accessibility/mac/text-marker-index-round-trip-nested-blocks.html\n accessibility/mac/text-marker-index-round-trip-table.html\n accessibility/mac/text-marker-index-round-trip.html\n\n* LayoutTests/accessibility/mac/index-for-zero-offset-text-marker-expected.txt:\n* LayoutTests/accessibility/mac/index-for-zero-offset-text-marker.html:\n* LayoutTests/accessibility/mac/text-marker-index-round-trip-expected.txt: Added.\n* LayoutTests/accessibility/mac/text-marker-index-round-trip-list-expected.txt: Added.\n* LayoutTests/accessibility/mac/text-marker-index-round-trip-list.html: Added.\n* LayoutTests/accessibility/mac/text-marker-index-round-trip-nested-blocks-expected.txt: Added.\n* LayoutTests/accessibility/mac/text-marker-index-round-trip-nested-blocks.html: Added.\n* LayoutTests/accessibility/mac/text-marker-index-round-trip-table-expected.txt: Added.\n* LayoutTests/accessibility/mac/text-marker-index-round-trip-table.html: Added.\n* LayoutTests/accessibility/mac/text-marker-index-round-trip.html: Added.\n* LayoutTests/resources/ax-text-marker-helper.js: Added.\n(checkRoundTripAllTextMarkerIndicesWithinContainer):\n* Source/WebCore/accessibility/AXTextMarker.cpp:\n(WebCore::runEndsWithNewline):\n(WebCore::emittedNewlineLength):\n(WebCore::forEachRunObjectForward):\n(WebCore::AXTextMarker::offsetFromRoot const):\n(WebCore::AXTextMarker::nextMarkerFromOffset const):\n\nCanonical link: https://commits.webkit.org/317545@main", "email": "dm_mazzoni@apple.com", "hash": "6371c7a9813368cba21d606cb2a3209d064144c1", "subject": "AX: AXTextMarkerForIndex and AXIndexForTextMarker don't round-trip in the isolated tree" }, "317546@main": { "author": "Kiet Ho", "avatar": "https://www.gravatar.com/avatar/d9058b37006dce1f55f91b8ccc82f9a3?d=identicon\u0026s=64", "cl": "317546@main", "clUrl": "https://commits.webkit.org/317546@main", "description": "rdar://181410087\nhttps://bugs.webkit.org/show_bug.cgi?id=319036\n\nReviewed by Simon Fraser.\n\nCanvasRenderingContext2D limits the amount of state on the stack to MaxStackSize\n(currently 16384). If the limit is reached, save() is a no-op and doesn't push new\nstates onto the stack. This is fine for most code, however it'll cause trouble for\nCanvasFilterContextSwitcher as it requires a state save to change targetSwitcher:\n\nstd::unique_ptr\u003cCanvasFilterContextSwitcher\u003e CanvasFilterContextSwitcher::create(CanvasRenderingContext2DBase\u0026 context, const FloatRect\u0026 bounds)\n{\n auto filter = [...];\n\n auto filterSwitcher = makeUnique\u003cCanvasFilterContextSwitcher\u003e(context); \u003c-- (a)\n auto targetSwitcher = CanvasLayerContextSwitcher::create(context, bounds, WTF::move(filter)); \u003c-- (d)\n if (!targetSwitcher)\n return nullptr;\n\n context.modifiableState().targetSwitcher = WTF::move(targetSwitcher); \u003c-- (c)\n return filterSwitcher;\n}\n\nCanvasFilterContextSwitcher::CanvasFilterContextSwitcher(CanvasRenderingContext2DBase\u0026 context)\n : m_context(context)\n{\n // (b)\n context.save();\n context.realizeSaves();\n}\n\nRefPtr\u003cCanvasLayerContextSwitcher\u003e CanvasLayerContextSwitcher::create(CanvasRenderingContext2DBase\u0026 context, const FloatRect\u0026 bounds, RefPtr\u003cFilter\u003e\u0026\u0026 filter)\n{\n ASSERT(!bounds.isEmpty());\n auto* effectiveDrawingContext = context.effectiveDrawingContext(); \u003c-- (e)\n if (!effectiveDrawingContext)\n return nullptr;\n\n auto targetSwitcher = GraphicsContextSwitcher::create(*effectiveDrawingContext, bounds, context.colorSpace(), WTF::move(filter));\n if (!targetSwitcher)\n return nullptr;\n\n return adoptRef(*new CanvasLayerContextSwitcher(context, bounds, WTF::move(targetSwitcher)));\n}\n\nWhen the CanvasFilterContextSwitcher is created (a), it saves the current state (b),\nso it can change targetSwitcher later (c). But if the state stack is exhausted, then\nno states are pushed on the stack. In that case, the CanvasLayerContextSwitcher\ncreated in (d) holds the drawing context (e) from the current effectiveDrawingContext,\naka the drawing context from the targetSwitcher at the top of the stack. Then (c)\noverwrites the top targetSwitcher with the newly created one in (d). If the old\ntargetSwitcher is only kept alive by the top state, then overwriting it would free it.\nBut the new targetSwitcher holds a reference to the drawingContext of the targetSwitcher\nthat we just freed.\n\nThis patch fixes this by eliminating the state save. Instead, CanvasFilterContextSwitcher\nholds onto the old targetSwitcher in top of stack when it's created, then replace it with\nthe new one. On destruction, it'll put the old one back. This ensures filtered drawing\nwould work regardless of stack exhaustion.\n\nTest: fast/canvas/canvas-filtered-drawing-after-stack-exhaustion.html\n\n* LayoutTests/fast/canvas/canvas-filtered-drawing-after-stack-exhaustion-expected.html: Added.\n* LayoutTests/fast/canvas/canvas-filtered-drawing-after-stack-exhaustion.html: Added.\n* Source/WebCore/html/canvas/CanvasFilterContextSwitcher.cpp:\n(WebCore::CanvasFilterContextSwitcher::create):\n(WebCore::CanvasFilterContextSwitcher::CanvasFilterContextSwitcher):\n(WebCore::CanvasFilterContextSwitcher::~CanvasFilterContextSwitcher):\n* Source/WebCore/html/canvas/CanvasFilterContextSwitcher.h:\n\nCanonical link: https://commits.webkit.org/317546@main", "email": "kiet.ho@apple.com", "hash": "c5d6db573430acbf012085a24fb2368845e8158b", "subject": "CanvasRenderingContext2D: filtered drawing should not need to save states" }, "317547@main": { "author": "Jer Noble", "avatar": "https://www.gravatar.com/avatar/6d2cde9be23b98223ca964cb3b7813a0?d=identicon\u0026s=64", "cl": "317547@main", "clUrl": "https://commits.webkit.org/317547@main", "description": "rdar://180520011\nhttps://bugs.webkit.org/show_bug.cgi?id=319696\n\nReviewed by Andy Estes.\n\n* Source/WTF/wtf/PlatformHave.h:\n* Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm:\n(-[WKFullScreenWindowController didExitVideoFullscreen]):\n(-[WKFullScreenWindowController _performSpatialFullScreenTransition:completionHandler:]):\n(-[WKFullScreenWindowController toggleSceneDimming]):\n\nCanonical link: https://commits.webkit.org/317547@main", "email": "jer.noble@apple.com", "hash": "28f0b4c9148880df9f8e13973558b8c647fe5726", "subject": "[visionOS] Update Surroundings Effect to None when Lightspill is available" }, "317548@main": { "author": "Zak Ridouh", "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64", "cl": "317548@main", "clUrl": "https://commits.webkit.org/317548@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319800\nrdar://182686777\n\nReviewed by Elliott Williams.\n\nwindowWithDoubleClickEventListener() was defined as a file-local static\nin both PositionInformationForWebPage.mm (pre-existing) and\nWebPageCocoa.mm (added by c3785b72e0af, bug 319777). The two definitions\nare identical. CMake's unified-source build bundles both .mm files into\nthe same translation unit (UnifiedSource-WebProcess-1-nonARC.mm), so the\nduplicate static triggers a \"redefinition\" compile error. Xcode groups\nthe two files into different unified bundles, which is why the collision\nwas not caught before landing.\n\nDeclare the helper once in PositionInformationForWebPage.h, keep a single\nexternal-linkage definition in PositionInformationForWebPage.mm, and\nremove the duplicate from WebPageCocoa.mm (which already imports that\nheader). No behavior change.\n\n* Source/WebKit/WebProcess/WebPage/Cocoa/PositionInformationForWebPage.h:\n* Source/WebKit/WebProcess/WebPage/Cocoa/PositionInformationForWebPage.mm:\n(WebKit::windowWithDoubleClickEventListener):\n* Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm:\n(WebKit::windowWithDoubleClickEventListener): Deleted.\n\nCanonical link: https://commits.webkit.org/317548@main", "email": "zakr@apple.com", "hash": "53774f8c458f0109c18d3d44fc3d0267ddc1da95", "subject": "Dedupe windowWithDoubleClickEventListener to fix CMake macOS unified build" }, "317549@main": { "author": "Anand Srinivasan", "avatar": "https://www.gravatar.com/avatar/84643a20c269974c2df6681742daf0a4?d=identicon\u0026s=64", "cl": "317549@main", "clUrl": "https://commits.webkit.org/317549@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319518\nrdar://180967232\n\nReviewed by Yusuke Suzuki.\n\nSet --useWasmRelaxedSIMD to default to true\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/317549@main", "email": "anand_srinivasan@apple.com", "hash": "5391001a4503acf4612e387b4d2e520aadc27d90", "subject": "Enable wasm relaxed SIMD feature flag" }, "317550@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "317550@main", "clUrl": "https://commits.webkit.org/317550@main", "description": "rdar://182251956\nhttps://bugs.webkit.org/show_bug.cgi?id=319435\n\nReviewed by Yijia Huang.\n\nThis patch adds cooperative driving mechanism to AsyncFromSyncIterator.\nThis also moves all of functions of AsyncFromSyncIterator from builtin\nJS to C++.\n\n1. JSAsyncFromSyncIterator is now more complicated JS object. Since this\n is not observable to users, its currently-on-the-fly promise from\n `next()` etc., is only one! This means that we can do something\n similar to JSAsyncGenerator: having a current on-the-fly promise in\n JSAsyncFromSyncIterator and avoiding creating a new context each time.\n Furthermore, because JSAsyncFromSyncIterator's on-the-fly promise is\n only one at a time, we can have one slot in JSAsyncFromSyncIterator\n instead of a queue.\n2. We add similar mechanism to JSAsyncGenerator's cooperative driving.\n3. We move all of AsyncFromSyncIterator implementation from builtin JS\n to C++.\n\nAll microbenchmarks are neutral: we moved all of them to C++ and we\nadded fast path in C++, so still maintaining efficiency of builtin JS's\ninlined ones.\n\nTests: JSTests/microbenchmarks/for-await-of-array.js\n JSTests/microbenchmarks/for-await-of-generic-iterable.js\n JSTests/microbenchmarks/for-await-of-map.js\n JSTests/microbenchmarks/for-await-of-promise-elements.js\n JSTests/microbenchmarks/for-await-of-set.js\n JSTests/stress/async-from-sync-fast-consumer-species-tamper-during.js\n JSTests/stress/async-from-sync-fast-path-primordial-guard.js\n JSTests/stress/async-from-sync-generic-next-getter-throws.js\n JSTests/stress/async-from-sync-generic-next-memoized.js\n JSTests/stress/async-from-sync-generic-next-read-once.js\n JSTests/stress/async-from-sync-open-speculation-deopt.js\n JSTests/stress/async-from-sync-throw-closes-and-rejects.js\n JSTests/stress/async-iterator-fast-consumer-cross-realm.js\n JSTests/stress/async-iterator-fast-consumer-species-tamper-before-open.js\n JSTests/stress/string-iterator-as-iterable.js\n\n* JSTests/microbenchmarks/for-await-of-array.js: Added.\n(async values):\n(async keys):\n(async entries):\n* JSTests/microbenchmarks/for-await-of-generic-iterable.js: Added.\n(makeIterable):\n(async run):\n* JSTests/microbenchmarks/for-await-of-map.js: Added.\n(async entries):\n(async keys):\n(async values):\n* JSTests/microbenchmarks/for-await-of-promise-elements.js: Added.\n(async run):\n* JSTests/microbenchmarks/for-await-of-set.js: Added.\n* JSTests/stress/async-from-sync-fast-consumer-species-tamper-during.js: Added.\n(assert):\n(armReadCounter):\n(get restoreCtor):\n(async asyncFromSyncTamperDuring):\n(async main):\n* JSTests/stress/async-from-sync-fast-path-primordial-guard.js: Added.\n(assert):\n(async pristine.set s):\n(async pristine):\n(async customOwnIterator.arr.Symbol.iterator):\n(async customOwnIterator):\n(async main):\n* JSTests/stress/async-from-sync-generic-next-getter-throws.js: Added.\n(assert):\n(makeThrowingIterable.const.iterable.Symbol.iterator.return.get next):\n(makeThrowingIterable):\n(async run):\n(async main):\n(main.then):\n* JSTests/stress/async-from-sync-generic-next-memoized.js: Added.\n(assert):\n(makeIterable.return.replaceNext.iterator.next):\n(makeIterable):\n(async run):\n(async main):\n(main.then):\n* JSTests/stress/async-from-sync-generic-next-read-once.js: Added.\n(assert):\n(makeIterable.const.iterable.Symbol.iterator.return.get next):\n(makeIterable):\n(async run):\n(async main):\n(main.then):\n* JSTests/stress/async-from-sync-open-speculation-deopt.js: Added.\n(assert):\n(syncIterable):\n(asyncIterable):\n(async driveGenericFirst):\n(async driveAsyncFromSyncFirst):\n(async main):\n* JSTests/stress/async-from-sync-throw-closes-and-rejects.js: Added.\n(assert):\n(async throwInto.async wrapper):\n(async throwInto):\n(async runCases):\n(async main):\n* JSTests/stress/async-generator-assertion.js:\n* JSTests/stress/async-iterator-fast-consumer-cross-realm.js: Added.\n(assert):\n(thenableRealmProbe.record):\n(const.makeThenableGen.new.thenableRealmProbe.Function.return.async yield):\n(const.makeThenableGen.new.thenableRealmProbe.Function.return):\n(async main):\n(async yield):\n(mainConsumedInForeign.makeMainGen):\n* JSTests/stress/async-iterator-fast-consumer-species-tamper-before-open.js: Added.\n(assert):\n(armReadCounter):\n(get restoreCtor):\n(async asyncGeneratorTamperBefore.async g):\n(async asyncGeneratorTamperBefore):\n(async asyncFromSyncTamperBefore):\n(async main):\n* JSTests/stress/string-iterator-as-iterable.js: Added.\n(assert):\n(forOfStringIterator):\n(spreadStringIterator):\n(arrayFromStringIterator):\n(partiallyConsumed):\n(async asyncDriver):\n(asyncDriver.then):\n* Source/JavaScriptCore/CMakeLists.txt:\n* Source/JavaScriptCore/DerivedSources-input.xcfilelist:\n* Source/JavaScriptCore/DerivedSources-output.xcfilelist:\n* Source/JavaScriptCore/DerivedSources.make:\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/builtins/ArrayConstructor.js:\n(fromAsync):\n* Source/JavaScriptCore/builtins/AsyncFromSyncIteratorPrototype.js: Removed.\n* Source/JavaScriptCore/builtins/BuiltinNames.h:\n* Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.cpp:\n(JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry):\n* Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h:\n* Source/JavaScriptCore/bytecode/IterationModeMetadata.h:\n* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:\n(JSC::BytecodeGenerator::emitEnumeration):\n(JSC::BytecodeGenerator::emitGetAsyncIterator):\n* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h:\n(JSC::BytecodeGenerator::emitIsDerivedArray):\n(JSC::BytecodeGenerator::emitIsAsyncFromSyncIterator): Deleted.\n* Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:\n(JSC::asyncFromSyncIteratorInternalFieldIndex): Deleted.\n(JSC::BytecodeIntrinsicNode::emit_intrinsic_getAsyncFromSyncIteratorInternalField): Deleted.\n* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:\n(JSC::DFG::AbstractInterpreter\u003cAbstractStateType\u003e::executeEffects):\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::ByteCodeParser::handleIntrinsicCall):\n(JSC::DFG::ByteCodeParser::handleAsyncIteratorOpen):\n* Source/JavaScriptCore/dfg/DFGClobberize.h:\n(JSC::DFG::clobberize):\n* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:\n(JSC::DFG::doesGC):\n* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:\n(JSC::DFG::FixupPhase::fixupNode):\n* Source/JavaScriptCore/dfg/DFGMayExit.cpp:\n* Source/JavaScriptCore/dfg/DFGNodeType.h:\n* Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp:\n* Source/JavaScriptCore/dfg/DFGOperations.cpp:\n(JSC::DFG::JSC_DEFINE_JIT_OPERATION):\n* Source/JavaScriptCore/dfg/DFGOperations.h:\n* Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:\n* Source/JavaScriptCore/dfg/DFGSafeToExecute.h:\n(JSC::DFG::safeToExecute):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:\n(JSC::DFG::SpeculativeJIT::compile):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:\n(JSC::DFG::SpeculativeJIT::compile):\n* Source/JavaScriptCore/ftl/FTLCapabilities.cpp:\n(JSC::FTL::canCompile):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileNode):\n(JSC::FTL::DFG::LowerDFGToB3::compileOpenAsyncFromSyncIterator):\n(JSC::FTL::DFG::LowerDFGToB3::compileNewInternalFieldObject):\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n* Source/JavaScriptCore/ftl/FTLOperations.cpp:\n(JSC::FTL::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):\n* Source/JavaScriptCore/jit/JITOperations.cpp:\n* Source/JavaScriptCore/jit/JITOperations.h:\n* Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:\n* Source/JavaScriptCore/runtime/AsyncFromSyncIteratorPrototype.cpp:\n(JSC::AsyncFromSyncIteratorPrototype::finishCreation):\n(JSC::AsyncFromSyncIteratorPrototype::create):\n(JSC::awaitAndContinue):\n(JSC::callSyncIteratorMethodAndExtract):\n(JSC::driveFastSyncIterator):\n(JSC::driveSyncIterator):\n(JSC::asyncFromSyncIteratorNext):\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n(JSC::driveAsyncFromSyncIteratorWithDriver):\n* Source/JavaScriptCore/runtime/AsyncFromSyncIteratorPrototype.h:\n* Source/JavaScriptCore/runtime/CommonSlowPaths.cpp:\n(JSC::iteratorOpenTryFastImpl):\n(JSC::asyncIteratorOpenTryFastImpl):\n* Source/JavaScriptCore/runtime/Intrinsic.h:\n* Source/JavaScriptCore/runtime/IteratorOperations.cpp:\n(JSC::createAsyncFromSyncIterator):\n(JSC::fastSyncIteratorForIterable):\n(JSC::createAsyncFromSyncIteratorForIterable):\n(JSC::createAsyncFromSyncIteratorRecord):\n(JSC::getAsyncIteratorImpl):\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n* Source/JavaScriptCore/runtime/IteratorOperations.h:\n* Source/JavaScriptCore/runtime/JSAsyncFromSyncIterator.cpp:\n(JSC::JSAsyncFromSyncIterator::create):\n(JSC::JSAsyncFromSyncIterator::visitChildrenImpl):\n(JSC::JSAsyncFromSyncIterator::finishCreation): Deleted.\n(JSC::JSAsyncFromSyncIterator::createWithInitialValues): Deleted.\n(JSC::JSC_DEFINE_HOST_FUNCTION): Deleted.\n* Source/JavaScriptCore/runtime/JSAsyncFromSyncIterator.h:\n* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:\n(JSC::JSGlobalObject::init):\n(JSC::JSGlobalObject::visitChildrenImpl):\n* Source/JavaScriptCore/runtime/JSGlobalObject.h:\n* Source/JavaScriptCore/runtime/JSMicrotask.cpp:\n(JSC::asyncFromSyncIteratorContinueOrDone):\n(JSC::asyncGeneratorCompleteStep):\n(JSC::asyncIteratorNextWithDriver):\n(JSC::runInternalMicrotask):\n\nCanonical link: https://commits.webkit.org/317550@main", "email": "ysuzuki@apple.com", "hash": "3a8fc98f2190516aebf47e9bee7bb7609af8a4f5", "subject": "[JSC] Make AsyncFromSyncIterator handled in async_iterator_open / async_iterator_next" }, "317551@main": { "author": "Vitaly Dyachkov", "avatar": "https://www.gravatar.com/avatar/ab950c52088e289585a5a01580ec66a4?d=identicon\u0026s=64", "cl": "317551@main", "clUrl": "https://commits.webkit.org/317551@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=233092\n\nReviewed by Carlos Garcia Campos.\n\nPort `UIScriptControllerMac::sendEventStream()` to WPE and GTK as close\nas possible.\n\n* Tools/WebKitTestRunner/EventSenderProxy.h:\n* Tools/WebKitTestRunner/libwpe/EventSenderProxyClient.h:\n(WTR::EventSenderProxyClient::sendWheelEvent):\n* Tools/WebKitTestRunner/libwpe/EventSenderProxyLibWPE.cpp:\n(WTR::EventSenderProxy::sendWheelEvent):\n* Tools/WebKitTestRunner/wpe/EventSenderProxyClientWPE.cpp:\n(WTR::EventSenderProxyClientWPE::sendWheelEvent):\n(WTR::EventSenderProxyClientWPE::mouseScrollBy):\n* Tools/WebKitTestRunner/wpe/EventSenderProxyClientWPE.h:\n* Tools/WebKitTestRunner/wpe/UIScriptControllerWPE.cpp:\n(WTR::wheelEventPhaseFromString):\n(WTR::UIScriptControllerWPE::sendEventStream):\n* Tools/WebKitTestRunner/wpe/UIScriptControllerWPE.h:\n* LayoutTests/platform/glib/TestExpectations:\n* Tools/WebKitTestRunner/libwpe/EventSenderProxyClientLibWPE.cpp:\n(WTR::EventSenderProxyClientLibWPE::mouseScrollBy):\n(WTR::EventSenderProxyClientLibWPE::sendWheelEvent):\n* Tools/WebKitTestRunner/libwpe/EventSenderProxyClientLibWPE.h:\n* Tools/WebKitTestRunner/gtk/EventSenderProxyGtk.cpp:\n(WTR::EventSenderProxy::sendWheelEvent):\n* Tools/WebKitTestRunner/gtk/UIScriptControllerGtk.cpp:\n(WTR::wheelEventPhaseFromString):\n(WTR::UIScriptControllerGtk::sendEventStream):\n* Tools/WebKitTestRunner/gtk/UIScriptControllerGtk.h:\n\nCanonical link: https://commits.webkit.org/317551@main", "email": "vitaly@igalia.com", "hash": "24238837ecefc220816b222e85e20bfc17c7c043", "subject": "[WPE][GTK] Implement `UIScriptController.sendEventStream()` for wheel events" }, "317552@main": { "author": "Ithril", "avatar": "https://www.gravatar.com/avatar/fe2334cb59663d7d45fdcb65e19cc89e?d=identicon\u0026s=64", "cl": "317552@main", "clUrl": "https://commits.webkit.org/317552@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319785\n\nReviewed by Yijia Huang.\n\nUCAL_YEAR is the calendar-native field for Ethioaa's single AA era and matches Temporal's arithmetic year. Older ICU versions expose an Amete Mihret-relative UCAL_EXTENDED_YEAR, while newer versions may make the fields equal after ICU-23167. Use UCAL_YEAR consistently when converting, reading, setting, and validating Ethioaa years so the behavior is correct with older ICU and compatible with newer ICU.\n\nTest: JSTests/stress/temporal-calendar-icu-bridge-non-iso.js\n\n* JSTests/stress/temporal-calendar-icu-bridge-non-iso.js:\n - Add version-independent arithmetic-year round-trip and consistency coverage for Ethioaa.\n\n* Source/JavaScriptCore/runtime/temporal/core/CalendarICUBridge.cpp:\n (JSC::Temporal::isoToCalendarFields):\n (JSC::Temporal::calendarYear):\n (JSC::Temporal::calendarDateFromFields):\n - Use calendar-native UCAL_YEAR for Ethioaa arithmetic-year operations.\n\nCanonical link: https://commits.webkit.org/317552@main", "email": "ithril.laydec@gmail.com", "hash": "6aaccf24c3d5771482f1f8d763b89d1bffd01f27", "subject": "[JSC][Temporal] Fix Ethioaa arithmetic year" }, "317553@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "317553@main", "clUrl": "https://commits.webkit.org/317553@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319789\nrdar://182662211\n\nReviewed by Yijia Huang.\n\nstringCharLoad\u003cRelativeNegativeIndex::Yes\u003e is having very small jumps to\ncovert the negative-index to the positive one. But this can be branchless.\n\n* Source/JavaScriptCore/jit/ThunkGenerators.cpp:\n(JSC::stringCharLoad):\n\nCanonical link: https://commits.webkit.org/317553@main", "email": "ysuzuki@apple.com", "hash": "512dfa371a12e5b7497f03cfea9c1588c0d00043", "subject": "[JSC] Fold String.prototype.at negative-index adjustment to a branchless csel" }, "317554@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "317554@main", "clUrl": "https://commits.webkit.org/317554@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319823\nrdar://182721000\n\nReviewed by Basuke Suzuki.\n\nSome tests were skipped, and some progressed with 317416@main\n\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/back-forward-cache-with-closed-webtransport-connection.https.window-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/back-forward-cache-with-open-webtransport-connection.https.window-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/close.https.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/close.https.any.serviceworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/close.https.any.sharedworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/close.https.any.worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/datagrams.https.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/datagrams.https.any.serviceworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/datagrams.https.any.sharedworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/datagrams.https.any.worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/historical.https.sub.any-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/historical.https.sub.any.serviceworker-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/historical.https.sub.any.sharedworker-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/historical.https.sub.any.worker-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/idlharness.https.sub.any-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/idlharness.https.sub.any.serviceworker-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/idlharness.https.sub.any.sharedworker-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/idlharness.https.sub.any.worker-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/sendorder.https.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/sendorder.https.any.serviceworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/sendorder.https.any.sharedworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/sendorder.https.any.worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/stats.https.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/stats.https.any.serviceworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/stats.https.any.sharedworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/stats.https.any.worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/streams-close.https.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/streams-close.https.any.serviceworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/streams-close.https.any.sharedworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/streams-close.https.any.worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/streams-echo.https.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/streams-echo.https.any.serviceworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/streams-echo.https.any.sharedworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/streams-echo.https.any.worker-expected.txt:\n\nCanonical link: https://commits.webkit.org/317554@main", "email": "achristensen@apple.com", "hash": "94f805315b5636260da031cb63d3a230a79b5cde", "subject": "Update WebTransport wpt test expectations" }, "317555@main": { "author": "Abrar Rahman Protyasha", "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64", "cl": "317555@main", "clUrl": "https://commits.webkit.org/317555@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319822\nrdar://182720554\n\nReviewed by Taher Ali and Zak Ridouh.\n\nAfter windowWithDoubleClickEventListener() moved from WebPageIOS to\nWebPageCocoa, the CMake builds started failing because there were two\nidentical definitions in WebPageCocoa and PositionInformationForWebPage,\nrespectively. This produced a collision when both of these files ended\nup in the same unified source bundle.\n\nThis patch addresses the error by consolidating as a LocalFrame method\ninstead.\n\n* Source/WebCore/page/LocalFrame.cpp:\n(WebCore::LocalFrame::windowWithDoubleClickEventListener const):\n* Source/WebCore/page/LocalFrame.h:\n* Source/WebKit/WebProcess/WebPage/Cocoa/PositionInformationForWebPage.mm:\n(WebKit::positionInformationForWebPage):\n(WebKit::windowWithDoubleClickEventListener): Deleted.\n* Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm:\n(WebKit::WebPage::handleDoubleTapForDoubleClickAtPoint):\n(WebKit::windowWithDoubleClickEventListener): Deleted.\n\nCanonical link: https://commits.webkit.org/317555@main", "email": "a_protyasha@apple.com", "hash": "3b6bc22d817db341643b972c6e18e4d81059abcc", "subject": "[CMake] macOS build broke after 317523@main (redefinition of 'windowWithDoubleClickEventListener')" }, "317556@main": { "author": "Tim Nguyen", "avatar": "https://www.gravatar.com/avatar/208c05ac2decdf818a4a08ada568328e?d=identicon\u0026s=64", "cl": "317556@main", "clUrl": "https://commits.webkit.org/317556@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319820\nrdar://182718298\n\nReviewed by Simon Fraser.\n\n/\u003e is only useful for XML/XHTML. \u003e is more consistent with other HTML tests.\n\n* LayoutTests/fast/harness/image-diff-template.html:\n\nCanonical link: https://commits.webkit.org/317556@main", "email": "ntim@apple.com", "hash": "524a4a5cbbfa1d4aaac7343f254d1606f445ab4a", "subject": "Use HTML self-closing tag in image diff fuzzy meta tag" }, "317557@main": { "author": "Richard Robinson", "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64", "cl": "317557@main", "clUrl": "https://commits.webkit.org/317557@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319757\nrdar://182608428\n\nReviewed by Abrar Rahman Protyasha.\n\nIt's always preferable to use typed throws instead of existential throws when dealing with generic\nError types (they are much more performant and ergonomic for clients).\n\nAlso clean up some `self.` that aren't needed.\n\n* Source/WebCore/PAL/pal/crypto/WTFExtras.swift:\n(WTF.endIndex):\n\nCanonical link: https://commits.webkit.org/317557@main", "email": "richard_robinson2@apple.com", "hash": "15accea208cba1b35acb8ec71f8b0fe7d6c3df2e", "subject": "[Swift in WebKit] WTFExtras.swift should use typed throws instead of existential throws" }, "317558@main": { "author": "Ithril", "avatar": "https://www.gravatar.com/avatar/fe2334cb59663d7d45fdcb65e19cc89e?d=identicon\u0026s=64", "cl": "317558@main", "clUrl": "https://commits.webkit.org/317558@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319787\n\nReviewed by Yijia Huang.\n\nICU represents the historical Ethiopic AA era as era 0 and the modern AM era as era 1. Map those values explicitly in both directions so Temporal accepts AA property bags and reports the correct era for historical dates.\n\nTest: JSTests/stress/temporal-calendar-icu-bridge-non-iso.js\n\n* JSTests/stress/temporal-calendar-icu-bridge-non-iso.js:\n - Add modern AM and historical AA parsing and field-output coverage.\n\n* Source/JavaScriptCore/runtime/temporal/core/CalendarICUBridge.cpp:\n (JSC::Temporal::mapICUEraToTemporalEra):\n (JSC::Temporal::mapTemporalEraToICUEra):\n - Distinguish Ethiopic AA and AM ICU era values.\n\nCanonical link: https://commits.webkit.org/317558@main", "email": "ithril.laydec@gmail.com", "hash": "c46df7f6e142a38fc92073960ce90389913387f4", "subject": "[JSC][Temporal] Fix Ethiopic AA era mapping" }, "317559@main": { "author": "Sihui Liu", "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64", "cl": "317559@main", "clUrl": "https://commits.webkit.org/317559@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319640\nrdar://182231936\n\nReviewed by Rupin Mittal.\n\nWhen opening an IDBCursor with 'nextunique' or 'prevunique' direction over a key range that matches\nno records, SQLiteIDBCursor::fetch() incorrectly reported failure instead of a legitimate empty\nresult. Its dedup loop checked whether the newly fetched record's key differed from\nm_currentKeyForUniqueness before checking whether the fetch had reached the end of the result set.\nOn a freshly created cursor, m_currentKeyForUniqueness is default-constructed (Invalid type), which\ncompares equal to the terminal record's also-default-constructed key, so the key-mismatch check did\nnot fire and control fell through to the completed check, which returned false.\nSQLiteIDBBackingStore::openCursor() treated that false as cursor-creation failure and surfaced an\nUnknownError, even though a range with no matching records is a case the IndexedDB spec requires to\nsucceed with a null result.\n\nCheck completed first, before the key-mismatch check, and return true in that case, matching how the\nnon-unique (next/prev) path already reports end-of-results as success rather than failure. This only\nchanges behavior for the empty-range case: whenever m_currentKeyForUniqueness holds a real key from\na previously fetched record, the key-mismatch check already returned true ahead of the completed\ncheck, since a real key can never equal the terminal record's default Invalid key.\n\nTests: storage/indexeddb/modern/cursor-unique-direction-empty-range-private.html\n storage/indexeddb/modern/cursor-unique-direction-empty-range.html\n\n* LayoutTests/storage/indexeddb/modern/cursor-unique-direction-empty-range-expected.txt: Added.\n* LayoutTests/storage/indexeddb/modern/cursor-unique-direction-empty-range-private-expected.txt: Added.\n* LayoutTests/storage/indexeddb/modern/cursor-unique-direction-empty-range-private.html: Added.\n* LayoutTests/storage/indexeddb/modern/cursor-unique-direction-empty-range.html: Added.\n* LayoutTests/storage/indexeddb/modern/resources/cursor-unique-direction-empty-range.js: Added.\n(done):\n(prepareDatabase):\n(runNextTest):\n(emptyIndexRange):\n(emptyObjectStoreRange):\n(testIndexCursor.request.onsuccess):\n(testIndexCursor.request.onerror):\n(testIndexCursor):\n(testObjectStoreCursor.request.onsuccess):\n(testObjectStoreCursor.request.onerror):\n(testObjectStoreCursor):\n* Source/WebCore/Modules/indexeddb/server/SQLiteIDBCursor.cpp:\n(WebCore::IDBServer::SQLiteIDBCursor::fetch):\n\nCanonical link: https://commits.webkit.org/317559@main", "email": "sihui_liu@apple.com", "hash": "63d90a92e5abed765bad3cb59b4dc7598d092c4d", "subject": "[IndexedDB] Opening a 'nextunique'/'prevunique' cursor over an empty key range fails with an UnknownError" }, "317560@main": { "author": "lilly", "avatar": "https://www.gravatar.com/avatar/d0533d52eeb271270df480f37629a407?d=identicon\u0026s=64", "cl": "317560@main", "clUrl": "https://commits.webkit.org/317560@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319759\nrdar://182652113\n\nReviewed by Simon Fraser.\n\nImplements the general superellipse family of CSS corner-shape values\n(squircle, superellipse(n), and the concave scoop/notch-adjacent cases)\nin CornerShapeUtilities, both for the outer contour and for the inner border edge.\n\nPasses tests written for another commit\n\n* Source/WebCore/platform/graphics/CornerShapeUtilities.cpp:\n(WebCore::borderContourPath):\n* Source/WebCore/platform/graphics/CornerShapeUtilities.h:\n* Source/WebCore/rendering/BorderShape.cpp:\n(WebCore::addInnerCornerShapeToPath):\n\nCanonical link: https://commits.webkit.org/317560@main", "email": "173393835+cupidsity@users.noreply.github.com", "hash": "8be67bb856d275e88daaf93bb7c851f446590687", "subject": "corner-shape: Implement superellipse case" }, "317561@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317561@main", "clUrl": "https://commits.webkit.org/317561@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319415\nrdar://182241938\n\nReviewed by Devin Rousso.\n\nDOMStorageManager stored its DOMStorageObjects in an array and resolved\nthe object for an incoming storage event by walking the whole array and\ncalling Object.shallowEqual on each entry's identifier. This ran for every\nDOMStorage observer event (itemAdded/itemUpdated/itemRemoved/itemsCleared),\nas well as on every add-if-needed and inspect.\n\nBack the collection with two Maps, one for localStorage and one for\nsessionStorage, each keyed directly by securityOrigin. This turns the\nlookup into an O(1) Map.get and drops the per-element Object.shallowEqual\ncomparison. The public domStorageObjects getter continues to return an\narray, so existing consumers are unchanged.\n\nCovered by the existing inspector/storage/domStorage-events.html test,\nwhich drives set/remove/clear on both sessionStorage and localStorage and\nasserts the events reach the correct DOMStorageObject.\n\n* Source/WebInspectorUI/UserInterface/Controllers/DOMStorageManager.js:\n(WI.DOMStorageManager.prototype.get domStorageObjects):\n(WI.DOMStorageManager.prototype._reset):\n(WI.DOMStorageManager.prototype._domStorageForIdentifier):\n(WI.DOMStorageManager.prototype._addDOMStorageIfNeeded):\n\nCanonical link: https://commits.webkit.org/317561@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "bd758aa007dd580c7b3a547ce485d52afc5343fb", "subject": "Web Inspector: DOMStorageManager looks up storage objects with an O(n) Object.shallowEqual scan on every storage event" }, "317562@main": { "author": "Simon Fraser", "avatar": "https://www.gravatar.com/avatar/3763324aa0cdfa93be751c6081b8006a?d=identicon\u0026s=64", "cl": "317562@main", "clUrl": "https://commits.webkit.org/317562@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319731\nrdar://182562852\n\nReviewed by Alan Baradlay.\n\nWhen doing paged scrolling (Page Down or spacebar), scroll snap needs to not skip intermediate\nsnap points[1].\n\nFix by plumbing an enum value down to `closestSnapOffsetWithInfoAndAxis()` so we know when we're\ndoing a paged scroll, and use that to choose the next/previous snap point as appropriate.\n\nConvert `ScrollBehavior` to an enum class, and use `EnumSet` instead of `OptionSet`.\n\nFixes `css/css-scroll-snap/input/paged.html`.\n\n[1] https://drafts.csswg.org/css-scroll-snap-1/#snap-overflow\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/input/paged-expected.txt:\n* Source/WebCore/page/scrolling/ScrollSnapOffsetsInfo.cpp:\n(WebCore::closestSnapOffsetWithInfoAndAxis):\n(WebCore::LayoutScrollSnapOffsetsInfo::closestSnapOffset const):\n(WebCore::FloatScrollSnapOffsetsInfo::closestSnapOffset const):\n* Source/WebCore/page/scrolling/ScrollSnapOffsetsInfo.h:\n* Source/WebCore/platform/ScrollAnimator.cpp:\n(WebCore::ScrollAnimator::singleAxisScroll):\n(WebCore::ScrollAnimator::handleSteppedScrolling):\n* Source/WebCore/platform/ScrollAnimator.h:\n* Source/WebCore/platform/ScrollSnapAnimatorState.cpp:\n(WebCore::ScrollSnapAnimatorState::adjustedScrollDestination const):\n* Source/WebCore/platform/ScrollSnapAnimatorState.h:\n* Source/WebCore/platform/ScrollTypes.cpp:\n(WebCore::operator\u003c\u003c):\n* Source/WebCore/platform/ScrollTypes.h:\n* Source/WebCore/platform/ScrollableArea.cpp:\n(WebCore::ScrollableArea::scroll):\n* Source/WebCore/platform/ScrollingEffectsController.cpp:\n(WebCore::ScrollingEffectsController::adjustedScrollDestination const):\n* Source/WebCore/platform/ScrollingEffectsController.h:\n\nCanonical link: https://commits.webkit.org/317562@main", "email": "simon.fraser@apple.com", "hash": "f244f515a09c41cf21eb39ea883eba4c45a36c38", "subject": "[Scroll snap] Page Down skips over snap points" }, "317563@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "317563@main", "clUrl": "https://commits.webkit.org/317563@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317466\n\nReviewed by Yusuke Suzuki.\n\nArray.prototype.filter creates its result via op_new_array_with_species\nwith length 0, which the DFG converts to NewArrayWithSize(0). The\nresulting JSArray has a tiny initial vector, so appending elements\nrepeatedly reallocates the butterfly (~56% of filter time spent in\nensureLengthSlow / reallocArrayRightIfPossible / memmove / memset).\n\nArrayAllocationProfile already learns the eventual vectorLength of the\nlast allocated array (capped at BASE_CONTIGUOUS_VECTOR_LEN_MAX = 25),\nbut NewArrayWithSize was not consuming it. This patch threads the\nprofile vectorLengthHint through NewArrayWithSpecies / NewArrayWithSize\ninto NewButterflyWithSize and uses it as the initial vectorLength while\nkeeping publicLength unchanged. Because the hint is adaptive and capped,\nlow-selectivity filters and small arrays do not over-allocate.\n\n Baseline Patched\n\narray-prototype-filter-int32 119.0802+-0.6515 ^ 70.6984+-1.3794 ^ definitely 1.6843x faster\n\n* JSTests/microbenchmarks/array-prototype-filter-int32.js: Added.\n* JSTests/stress/new-array-with-size-vector-length-hint.js: Added.\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::ByteCodeParser::parseBlock):\n* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:\n(JSC::DFG::ConstantFoldingPhase::foldConstants):\n* Source/JavaScriptCore/dfg/DFGNode.cpp:\n(JSC::DFG::Node::convertToNewArrayWithSize):\n* Source/JavaScriptCore/dfg/DFGNode.h:\n(JSC::DFG::Node::hasVectorLengthHint):\n(JSC::DFG::Node::vectorLengthHint):\n* Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n(JSC::DFG::SpeculativeJIT::compileNewButterflyWithSize):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileNewButterflyWithSize):\n\nCanonical link: https://commits.webkit.org/317563@main", "email": "sosuke@bun.sh", "hash": "6654fe520c0b94de12aff50be1839be853f9e15e", "subject": "[JSC] Use `vectorLengthHint` in `ArrayAllocationProfile` for `NewArrayWithSize` node" }, "317564@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "317564@main", "clUrl": "https://commits.webkit.org/317564@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=271412\n\nReviewed by Yijia Huang.\n\nB3LowerToAir already selected sbfx for SShr(Shl((Z|S)Shr(src, lsb), amount), amount).\nAlso match SShr(Shl(src, leftAmt), rightAmt) with rightAmt \u003e leftAmt so that form\nselects sbfx without expanding IR in ReduceStrength on every target.\n\n* Source/JavaScriptCore/b3/B3LowerToAir.cpp:\n(JSC::B3::LowerToAir::lower):\n* Source/JavaScriptCore/b3/testb3.h:\n* Source/JavaScriptCore/b3/testb3_2.cpp:\n* Source/JavaScriptCore/b3/testb3_3.cpp:\n(testExtractSignedBitfieldNonCanonical32):\n(testExtractSignedBitfieldNonCanonical64):\n\nCanonical link: https://commits.webkit.org/317564@main", "email": "chi187@gmail.com", "hash": "41ee8b26825110c19e6aab1580e2d8ad89a2abb8", "subject": "[JSC] Match non-canonical SBFX form in B3LowerToAir" }, "317565@main": { "author": "Devin Rousso", "avatar": "https://www.gravatar.com/avatar/c9e757d973342c773f107a94b70cb9cd?d=identicon\u0026s=64", "cl": "317565@main", "clUrl": "https://commits.webkit.org/317565@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318566\n\nReviewed by BJ Burg.\n\nThese all were almost identical code, so create a common shared function to use instead.\n\n* Source/WebInspectorUI/UserInterface/Views/TimelineOverviewGraph.js:\n(WI.TimelineOverviewGraph.prototype.updateSelectedRecordBar): Added.\n* Source/WebInspectorUI/UserInterface/Views/LayoutTimelineOverviewGraph.js:\n(WI.LayoutTimelineOverviewGraph.prototype.updateSelectedRecord):\n* Source/WebInspectorUI/UserInterface/Views/MediaTimelineOverviewGraph.js:\n(WI.MediaTimelineOverviewGraph.prototype.updateSelectedRecord):\n* Source/WebInspectorUI/UserInterface/Views/ScriptTimelineOverviewGraph.js:\n(WI.ScriptTimelineOverviewGraph.prototype.updateSelectedRecord):\n\nCanonical link: https://commits.webkit.org/317565@main", "email": "hi@devinrousso.com", "hash": "eab5fd3f0b72ba3610918338bcbb049b97efae63", "subject": "Web Inspector: Timelines: unify record bar selection code" }, "317566@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "317566@main", "clUrl": "https://commits.webkit.org/317566@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319782\n\nReviewed by Yusuke Suzuki.\n\nWhen the input to JSON.parse is a 16-bit string (e.g. it contains a single emoji anywhere),\nLiteralParser\u003cchar16_t\u003e creates every value string longer than 16 characters via String(characters),\nwhich is unconditionally 16-bit, even when the value itself is pure Latin1. Keys and values up to\n16 characters already go through AtomStringImpl::add, which uses create8BitIfPossible.\n\nThis makes the value path use StringImpl::create8BitIfPossible as well, matching V8, which decides\none-byte vs two-byte per string in its JSON parser.\n\n* Source/JavaScriptCore/runtime/JSONAtomStringCacheInlines.h:\n(JSC::JSONAtomStringCache::makeJSString):\n\nCanonical link: https://commits.webkit.org/317566@main", "email": "sosuke@bun.sh", "hash": "5f2a8878118543bfc97b64abd558e5c8e75e33f4", "subject": "[JSC] `JSON.parse` should create 8-bit strings for Latin1 values in a 16-bit input" }, "317567@main": { "author": "Adrian Perez de Castro", "avatar": "https://www.gravatar.com/avatar/30ffea8cf404586741a8f5f7110c0914?d=identicon\u0026s=64", "cl": "317567@main", "clUrl": "https://commits.webkit.org/317567@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319811\n\nUnreviewed Skia update.\n\ngit log --pretty='%h %s' 0e98a9c635bb1395ce9551d0812c7c4afb0f9776..a6d4d199301da96b1d0c85968446d27222597be0\na6d4d19930 [graphite] Fix alpha-only handling when CSXform steps need unpremul\ne7efee434f Roll vulkan-deps from c95bf9c5e989 to 1380a5152f43 (2 revisions)\n2610b2e8cb [graphite] add sparse strips tiler bench\n77a21bc723 Roll ANGLE from 2d8f36f37859 to 4a6d53434044 (14 revisions)\n11994e08f4 Roll Skia Infra from 4ff5776b821e to 4bf523d4b47c (19 revisions)\nad0aff15b9 Roll vulkan-deps from 4391cb02adc5 to c95bf9c5e989 (13 revisions)\nc8780783c3 Roll recipe dependencies (trivial).\n8d61db7365 [graphite] Add isOpaque to PrecompileShader\n81a7327b24 Roll recipe dependencies (trivial).\ndfe5a30966 Reland \"Manually created dawn roll.\"\n82a0e41ce7 Roll recipe dependencies (trivial).\n5914dc7b7f Revert \"Manually created dawn roll.\"\n91d3c1e730 Make SkYUVAPixmap comments match behavior\nb4d0d3ae80 Manually created dawn roll.\ncb9bb94fbc Roll recipe dependencies (trivial).\naaf6a450c6 [graphite] Add Sparse Strips tiler\n3228140199 Roll vulkan-deps from e069d6e7382e to 4391cb02adc5 (1 revision)\n2514f6b5f9 Roll ANGLE from ab41985470ba to 2d8f36f37859 (11 revisions)\n9fb7d28146 Roll recipe dependencies (trivial).\n0b997acb2b Roll Skia Infra from 99ee78410476 to 4ff5776b821e (15 revisions)\n04eab405c3 Roll debugger-app-base from bb04143c038b to 18d4e53a226a\n5f461c27fe Roll vulkan-deps from 3a658da10db4 to e069d6e7382e (1 revision)\n8cafb209e8 Roll SKP CIPD package from 563 to 564\n05a03f99c7 Roll vulkan-deps from df94adb30172 to 3a658da10db4 (12 revisions)\n1fed4ed13d Roll recipe dependencies (trivial).\ndc78d4bd2e Revert \"Disable FramebufferFetch for Android\"\n31521f8508 Roll recipe dependencies (trivial).\n433e531f9c Add SkStrikeRef: public API for cached strike access from SkFont\na00db8749e Roll vulkan-deps from f2bd0563dba7 to df94adb30172 (10 revisions)\n5f7adf4403 Roll ANGLE from 95d16933d919 to ab41985470ba (11 revisions)\n4abccf5f65 Roll recipe dependencies (trivial).\n778f5c06b5 Roll Skia Infra from f7c1e4ac4125 to 99ee78410476 (21 revisions)\n926c09741c Roll vulkan-deps from a4ff3c87bd50 to f2bd0563dba7 (18 revisions)\n8cef48c8ae Roll recipe dependencies (trivial).\n9a3c5afee6 Address stack overflow in SkPicturePriv::MakeFromBuffer\n3a8795df2c Roll recipe dependencies (trivial).\n6eadf4a62c Fix assert in FuzzNicePath\nce85ca533d Roll recipe dependencies (trivial).\n3c73323d12 set JSON starting object node in SkCapture viewer slide\n799f4eda0f Roll vulkan-deps from 766d49b68e2f to a4ff3c87bd50 (2 revisions)\n2447c273d0 Roll ANGLE from 997936e81bd4 to 95d16933d919 (20 revisions)\n6f857c7fc8 Roll Skia Infra from c08a2903efbe to f7c1e4ac4125 (6 revisions)\n6b568d3717 Roll Dawn from b64fc1768c2d to b048990c1246 (39 revisions)\n8a3d4001f0 Roll recipe dependencies (trivial).\na52ece789e Roll recipe dependencies (trivial).\n605786788e Roll recipe dependencies (trivial).\n81fb45e331 Roll vulkan-deps from 0cac26b01455 to 766d49b68e2f (4 revisions)\nf1b6a8479d Roll Skia Infra from dd2538e6ee98 to c08a2903efbe (17 revisions)\n024b288c98 Roll ANGLE from 117aeb5a1170 to 997936e81bd4 (11 revisions)\n9e1964abd3 Roll recipe dependencies (trivial).\n426f2198c4 Roll vulkan-deps from 533bdd27e736 to 0cac26b01455 (10 revisions)\na3b5123cfa Revert \"[graphite] Move inverting atlas size into vertex shader\"\n1ffe7a8845 Roll recipe dependencies (trivial).\n182b55c380 Reland \"Reland \"[skcapture] Add tracking content IDs to SkCapture\"\"\n5e1ab545ac Roll recipe dependencies (trivial).\n836df02c8e [graphite] Simplify prep code around calling UploadSource::Make\n100292563c Fix assert in SkBlurEngine/SkBitmap\n5a1217976a Disable FramebufferFetch for Android\na750b3ae77 Make SkSurface_Base::type() and onCapabilities() pure virtual\n7f65726c5e Roll vulkan-deps from acf189fce64b to 533bdd27e736 (2 revisions)\ne4012ccf0d [graphite] Consolidate upload code around UploadSource\n37c602d46d Roll recipe dependencies (trivial).\n503b7a1d9c Merge 4 release notes into RELEASE_NOTES.md\n8e64b4463c Update Skia milestone to 150\n85da0822ff Roll recipe dependencies (trivial).\ne2e144b4fa Roll ANGLE from 5f0e794041ec to 117aeb5a1170 (12 revisions)\n54d551022f Roll Skia Infra from 1e3576271edf to dd2538e6ee98 (8 revisions)\n4e820f1922 Roll SwiftShader from 6cc7757d2bd0 to f9d5d49a3c59 (2 revisions)\nca0dd7da93 Roll vulkan-deps from 27c5bf379452 to acf189fce64b (15 revisions)\n15cd2573c2 Roll recipe dependencies (trivial).\n879d6b690a [path builder] Validate conic weights\n8e39cd2188 Roll recipe dependencies (trivial).\nad4ebe7da9 Change assert to graceful failure in SkRuntimeEffect\n225858c9b7 Remove Bazel-built viewer from CQ\ned2e144f8d Roll recipe dependencies (trivial).\n82e20c2da9 Fix potential integer overflows in SurfaceContext using SkSafeMath\n61e98d58d6 Add missing entries to FuzzMain\n04ba047051 [graphite] Consolidate format support table into Caps\n70f79346a2 Prevent potential overflow in SkTDArray\nbdf369f261 [infra] Remove IntelIris6100 tasks and related configs\n0d066743d3 [skparagraph] Skip soft hyphen in hit-testing\nc955fa047a Roll vulkan-deps from 662a49003d41 to 27c5bf379452 (1 revision)\n76254dcfe3 Roll ANGLE from 61c46b826e6d to 5f0e794041ec (12 revisions)\n898b4cc27e Roll Skia Infra from a89472f1bea4 to 1e3576271edf (4 revisions)\nbf214d666a Roll vulkan-deps from 7a546022f5ea to 662a49003d41 (1 revision)\na87f066e50 Roll SKP CIPD package from 562 to 563\n562cb89f9b Roll vulkan-deps from 620786d23ad6 to 7a546022f5ea (1 revision)\n05cb369826 Roll vulkan-deps from 43d30a1d9669 to 620786d23ad6 (2 revisions)\ndba763e9ec Roll recipe dependencies (trivial).\n0374b13b6f Roll vulkan-deps from 146e2616bc5d to 43d30a1d9669 (2 revisions)\n040ea25083 Manual roll vulkan-deps from a8788d0caa0b to 146e2616bc5d (10 revisions)\ne1e3c8b149 [skottie] Fix fallback glyph metrics\n850f615f88 Roll recipe dependencies (trivial).\nd10ea850c2 Defer marking stencil as cleared until after render pass creation succeeds\neb79f27573 Fix AAHairlineOp to fill in default degenerate quad information.\nad23c7c199 Add Adreno 621 GPU identification and MSAA workaround\n1d533738ea Fix potential integer underflow in GrStagingBufferManager\n7ac6d42f2f Roll vulkan-deps from 9acac13c9376 to a8788d0caa0b (7 revisions)\nfa1dcb2897 Roll ANGLE from e44b533ccb2b to 61c46b826e6d (14 revisions)\n559eaa8c53 Roll Skia Infra from cb5054201166 to a89472f1bea4 (13 revisions)\n1431e606a9 Roll Dawn from 579447cf7164 to b64fc1768c2d (10 revisions)\n54cc00adde Roll recipe dependencies (trivial).\ne659c95803 [graphite] Add SIMD sparse strips flattenner\na075b88248 Roll vulkan-deps from 68b1d78abfc4 to 9acac13c9376 (3 revisions)\n2e279266f0 [graphite] Remove SK_GRAPHITE_USE_LEGACY_CLAMPING logic\nee34f1011c Reland \"Reland \"[graphite] Replicate Dawn format capability table\"\"\naf0898534e [graphite] Increase the max number of graphics pipelines\n3068271616 Fix some SkPixmap logic\n8317649d9c Validate glyph size before insetting for atlases\n7b88c5c281 Roll vulkan-deps from a5c5df5b99ef to 68b1d78abfc4 (10 revisions)\n26a59aa71e Roll ANGLE from 8e610d05a7c8 to e44b533ccb2b (3 revisions)\n4f1f61a7c5 Roll Dawn from 23b8b77451d9 to 579447cf7164 (4 revisions)\n6d039dac35 Roll SwiftShader from 89556131bf9d to 6cc7757d2bd0 (1 revision)\ne33bd82c23 Roll Skia Infra from b9288fb1bc36 to cb5054201166 (5 revisions)\n6b4167b4e2 Roll recipe dependencies (trivial).\n17ac67edbb Manual roll ANGLE from 93dfda3c5783 to 8e610d05a7c8 (10 revisions)\n2dbf05ca7f Add more ANGLE test suppressions\nf2c260c4c3 Manual roll Dawn from 7d5e2bbf689c to 23b8b77451d9 (11 revisions)\nb6e7bf6f3c Revert \"Reland \"[skcapture] Add tracking content IDs to SkCapture\"\"\ncab0eb5178 Add a big set of new Android Paint Options\n8261e25dc3 Manual roll ANGLE from c04bb283b5ed to 93dfda3c5783 (21 revisions)\n62c6c6487e Reland \"[skcapture] Add tracking content IDs to SkCapture\"\n1bd2f1cc27 Roll vulkan-deps from 8a72637bc40a to a5c5df5b99ef (4 revisions)\n5ab06c8b68 [text] Zero out glyph images on cache miss\n12d2da5301 [graphite] Enable culling on flattener\ne452d4d001 [graphite] Add isAlphaUnchanged to precompile colorfilters\n4e867caaa6 Manual ANGLE role w/ test suppressions\nf5c781c083 Roll recipe dependencies (trivial).\nf48c94fb7e Roll Dawn from b1bac31dd0ae to 7d5e2bbf689c (20 revisions)\n05251260fd Roll Skia Infra from 565b5c4d8808 to b9288fb1bc36 (11 revisions)\n24a3c9dad0 Roll vulkan-deps from 5b3b02a7fc87 to 8a72637bc40a (5 revisions)\n6285eed269 Roll recipe dependencies (trivial).\n4e4bde8eda Roll recipe dependencies (trivial).\ne36196702e [path builder] Fix trailing moveTo handling in addPath\n817a98f227 [graphite] Add more multiplanar formats to TextureFormat enum\n55b23fb650 [graphite] Cache single-UBO descriptor sets on VulkanBuffers\n6e4365c785 Alphabetize gn/sksl_tests.gni\n0bc11e81b1 Roll vulkan-deps from 51f7937194ce to 5b3b02a7fc87 (2 revisions)\n28359a5bf5 Add test for multi-slot push/immediate/pop optimization\n967d9b5137 Roll Dawn from 35e124b3aad8 to b1bac31dd0ae (10 revisions)\n0631f60a7e Roll Skia Infra from 9c32dea11310 to 565b5c4d8808 (8 revisions)\ndf0c1b5277 Roll recipe dependencies (trivial).\nd8349b017a Roll vulkan-deps from 74bb7122d7ae to 51f7937194ce (6 revisions)\n19e1438193 Roll recipe dependencies (trivial).\nad89fd880d [skcapture] add display command history and SkCapture metadata within Viewer.\n8ac48d9b53 Identify overflow in SkGlyph allocation earlier\nd3934f5b07 Make local optimized copy of program when creating SkRP version\nb8e9cc1531 Roll recipe dependencies (trivial).\n67d27e8b7f [rust icc] Make B2A conversion failure non-fatal in ToSkcmsIccProfile\nbdea964163 Roll recipe dependencies (trivial).\n2e6e016137 [skottie] Randomize order support\nacb0421565 [rust icc] Require output_channels == 3 for A2B, matching skcms\nae4ccbe7a8 Manual roll ANGLE from 887d15753e30 to 1a95cc9cfeb4 (1 revision)\n2b94912a4d Avoid removing too many stack entries in SkRP during discard_stack\n2457cd36ac Roll recipe dependencies (trivial).\ne59ca98647 Check success of reading image lattices from skps\nf87a90790c [Fontations] Roll Fontations\nce82d32b3e Roll vulkan-deps from 19ca205e6128 to 74bb7122d7ae (1 revision)\nf1238e0f10 Roll Dawn from 31e25af254ab to 35e124b3aad8 (16 revisions)\nf3549fefbc Roll Skia Infra from 396cc20257a2 to 9c32dea11310 (9 revisions)\n7d47a31931 Roll skottie-base from a835580afc8e to 4b069fbc5e1a\n07a3c4f14f Roll shaders-base from 66ef19d82393 to 33357ebae78c\nd77e3356d5 Roll SKP CIPD package from 561 to 562\nce9aa22312 Roll vulkan-deps from 1b1ec55d8c84 to 19ca205e6128 (1 revision)\n622fff4c24 Roll vulkan-deps from 2dd03dd70ec7 to 1b1ec55d8c84 (1 revision)\n185f6b57d6 Roll vulkan-deps from bb8155eeeb89 to 2dd03dd70ec7 (7 revisions)\n3f467a5819 Roll recipe dependencies (trivial).\n790068cb4b Roll recipe dependencies (trivial).\ne64cc6cd9b Revert \"Reland \"MiraclePtr: Add raw_ptr definitions\"\"\n300d432048 [graphite] Avoid unnecessary shader clamping for pixel-aligned images\nbe1d174136 Add cliperator, spanerator, and iterator to SkRegion fuzzing\nbd511845bd [graphite] Add other planar wgpu::TextureFormats to is_valid_view\ncd23c17ad2 Reland \"MiraclePtr: Add raw_ptr definitions\"\n63dbf37c37 Reject SkRegions with multiple empty slices in a row\n1c9b0b9141 Roll recipe dependencies (trivial).\n244d963918 Roll vulkan-deps from 8b69233a4c27 to bb8155eeeb89 (7 revisions)\n04c6c369cf Roll Skia Infra from 5300bf8291db to 396cc20257a2 (14 revisions)\n8afef4d917 Roll Dawn from 219c6e1eb500 to 31e25af254ab (17 revisions)\n290a056fcd Roll recipe dependencies (trivial).\n4c8bedd3c9 Roll recipe dependencies (trivial).\nb0bc3cd974 Roll recipe dependencies (trivial).\n4d036b819f Roll recipe dependencies (trivial).\nea20c73ac7 Roll recipe dependencies (trivial).\nbb0593cf8a [graphite] Move inverting atlas size into vertex shader\n04ff020368 [graphite] Fix a security issue in GlobalCache::findGraphicsPipeline\n24dba230b6 Roll vulkan-deps from b68105cc00f0 to 8b69233a4c27 (5 revisions)\nf65d1e1621 [graphite] Account for clock granularity in resource purge test\neafcdd5779 [bazel] Add support for Graphite Dawn backend\n2cf2a85fa1 [bazel] Add native rules to build Dawn\n8106701adb Revert \"Reland \"[graphite] Replicate Dawn format capability table\"\"\ne8d00d634c Roll ANGLE from 664858ab7de2 to 887d15753e30 (13 revisions)\n6ef1bbafc2 Roll vulkan-deps from 97c656c3aa9d to b68105cc00f0 (6 revisions)\n9fd689ce8a Roll Skia Infra from 298872497a26 to 5300bf8291db (9 revisions)\n5fe6162546 Roll Dawn from e10184f6962d to 219c6e1eb500 (11 revisions)\n0049c5d91b Roll recipe dependencies (trivial).\na1b67bcdd6 Revert \"[sksl] Limit field count for structs\"\n7ea7d15719 [graphite] Add sparse strips flattenner bench\n7b08dae3b2 Add test for capped hairlines\n57a80d08a9 Reland \"[graphite] Replicate Dawn format capability table\"\nf4834c75d3 [rust icc] Reject unsupported A2B/B2A channel counts and grid dimensions\ne5d302806c Implement onIsAlphaUnchanged() for SkColorSpaceXformColorFilter\n92e7b9a739 [graphite] Make tiger svg dataset shareable\n25b5136016 Roll vulkan-deps from f4814e7bd340 to 97c656c3aa9d (9 revisions)\n5a0ed89aea Roll skcms from 15db2430b628 to a7a3b15f0635 (1 revision)\n684457bb5d [sksl] Limit field count for structs\n11640d1cbc Revert \"[skcapture] Add tracking content IDs to SkCapture\"\n059176912f [graphite] Adjust PrecompileRTEffect hierarchy to allow for virtuals\nd3f7d6103a [graphite] Add clamp control to PrecompileColorFilter::Matrix\nf12c895807 Revert \"MiraclePtr: Add raw_ptr definitions\"\nf765937d06 MiraclePtr: Add raw_ptr definitions\n635b78342e Roll Skia Infra from 122473f2db6d to 298872497a26 (14 revisions)\n41eba71f47 Roll ANGLE from 9ae7fc30f236 to 664858ab7de2 (21 revisions)\n48c53ddf40 Roll debugger-app-base from 16abd26d2ada to bb04143c038b\ncda2af3f5c Roll Dawn from e28e86598c54 to e10184f6962d (12 revisions)\n281a6de9c0 Roll fiddler-base from 05799bdc4674 to 51e85c2ffa70\nf70bc110c9 Roll jsfiddle-base from a48b4b4877fa to 5bae7afba87d\n632a41e2ba Roll recipe dependencies (trivial).\nb48db88ce8 Roll recipe dependencies (trivial).\nfb919a96f4 [rust icc] Fix heap buffer overflow in CLUT gather for 16-bit profiles\n019de7776c Fix abandoning of Ganesh MappedBufferManager.\ncf1af1425f Reland \"[graphite] Allow Src w/o dual-source blending to have inner fills\"\n3150bddf3e [sksl] Check allowSkSL for SkRuntimeImageFilter::CreateProc\nc3d3126faf [skcapture] Add tracking content IDs to SkCapture\n24cc08a784 [graphite] DrawListLayer sometimes match on uniforms\n970222f4b2 [graphite] Introduce PrecompileColorFilterPriv access\n757309dce9 [graphite] Add scalar sparse strips path flattenner\nded25ae4da Roll vulkan-deps from 976181e82c65 to f4814e7bd340 (3 revisions)\n6ea6bc5a3f [MSKP] Add Graphite image capture support to SkSharingProc\n21789d5e2f Update Intel job config to fix tree\na234f0ed72 Roll recipe dependencies (trivial).\na77db83af9 Roll recipe dependencies (trivial).\nf8637ade3d Roll recipe dependencies (trivial).\nd630b87b73 Roll ANGLE from 1ffb4e6262b0 to 9ae7fc30f236 (11 revisions)\n473f6a4025 Roll Skia Infra from 3be410981c1b to 122473f2db6d (11 revisions)\nd99916baf5 Roll Dawn from afd3d886e5dc to e28e86598c54 (11 revisions)\n3e93851d47 Roll vulkan-deps from bc55e53a5330 to 976181e82c65 (3 revisions)\nc52c45b7ac Revert \"[graphite] Replicate Dawn format capability table\"\n75f3442f36 Revert \"[graphite] Allow Src w/o dual-source blending to have inner fills\"\n914e945319 Roll recipe dependencies (trivial).\n7dd4bb76ce [graphite] Replicate Dawn format capability table\n3b338913f6 [graphite] Allow Src w/o dual-source blending to have inner fills\n827c1f2937 Expose RTE analysis via SkRuntimeEffectPriv\n56ef7b2483 Roll recipe dependencies (trivial).\n75c2791c62 Roll vulkan-deps from 4b07e996b081 to bc55e53a5330 (1 revision)\nafd586cc37 Roll ANGLE from 82fdb86b3a2b to 1ffb4e6262b0 (8 revisions)\n2f29689238 Roll Skia Infra from 172704c43a23 to 3be410981c1b (18 revisions)\nc553d876f7 Roll debugger-app-base from 047a12df8bbe to 16abd26d2ada\n30bea343ea Roll Dawn from 829f73d077f2 to afd3d886e5dc (9 revisions)\ne7aecdc9bb Roll skottie-base from 2027949950ed to a835580afc8e\nee41b4e1a7 Roll shaders-base from 1537a8ed61c9 to 66ef19d82393\ne3ea7e0826 Roll fiddler-base from bb868b9b7c78 to 05799bdc4674\n04efe0873e Roll vulkan-deps from ec72843e97f4 to 4b07e996b081 (1 revision)\n31d8cb67ef Roll SKP CIPD package from 560 to 561\n07acef992f Roll vulkan-deps from 457cf36c6fed to ec72843e97f4 (1 revision)\n2c40548f24 Roll vulkan-deps from 710e3a630ced to 457cf36c6fed (4 revisions)\n485483c0f6 Roll recipe dependencies (trivial).\ne0df605e5e Roll vulkan-deps from a4ae63ef58f2 to 710e3a630ced (3 revisions)\n6e12daa9ab [Project-Fortify] Increase SkEdgeClipper buffer sizes and add safety checks\nf7017d03fb Remove unnecessary SkCFObject.h #include\n13314a1f2d Roll recipe dependencies (trivial).\n1c886cb964 [infra] Add jobs for Rauru Chromebooks\n56cb01f6dd [skparagraph] Use structural checks in soft hyphen tests\n55eef24867 Improve AVX2 min/max in SkRP\n4cf294791a Roll vulkan-deps from 859ad1479ce2 to a4ae63ef58f2 (4 revisions)\n7bc3f085ba Roll ANGLE from 942c07d0c8a6 to 82fdb86b3a2b (9 revisions)\n506fe277cd Roll Skia Infra from 8a3814645574 to 172704c43a23 (11 revisions)\n0df5d7fe4d Roll Dawn from 678a2d1cb827 to 829f73d077f2 (23 revisions)\n0df03e02e6 Roll debugger-app-base from 13903d912e2d to 047a12df8bbe\nc8851c7927 Roll fiddler-base from 5a61b268b2c2 to bb868b9b7c78\n8f2d1bf319 Roll jsfiddle-base from 268fe17ee4d6 to a48b4b4877fa\n36bb4bb687 Roll recipe dependencies (trivial).\n1c1552b5c3 Force release of latest skottie web\n3b7ac5f9e4 Roll vulkan-deps from 88bc797c62ac to 859ad1479ce2 (3 revisions)\nc807249b9d [graphite] Pre-compute more DstUsage flags before toKey()\n51f9ba490c [graphite] Apply sampling optimization all the time for root KeyContext\nfa3d352e68 added bounds check for glyph access on typeface\n701a036459 Roll recipe dependencies (trivial).\n73dfb5a471 [infra] Loosen Windows version dimensions\n3de77f0abf [pdf] Better structure element kids order\n4478832db5 [graphite] use textureSize intrinsic instead of uniforms\n94e42e1632 Update fiddler-base for c21d4134a71a\n868c8cfe6c [graphite] Update SubRunData to use mask-to-device with Geometry\n64be904355 Revert \"Temporarily remove Bazel from the CQ\"\nd8415c5d7b Roll ANGLE from e45b5fbf2710 to 942c07d0c8a6 (6 revisions)\n782c197635 Roll vulkan-deps from b59a366edcc0 to 88bc797c62ac (4 revisions)\n391cdbe3ff Roll Skia Infra from 1139a26d53b5 to 8a3814645574 (15 revisions)\nc2d118720b Roll Dawn from 63b237e40fc2 to 678a2d1cb827 (16 revisions)\n2c49b3f9c3 Update fiddler-base for 1bac3fe41979\n8e466ad912 Roll recipe dependencies (trivial).\n881275b683 Roll recipe dependencies (trivial).\nbe6b733581 [graphite] Improve DrawListLayer batching\n3df5987e6c [docker] Remove --progress flag from docker_build.sh\nfc31f5f5aa [graphite] CoverageMaskShape stores mask-to-device transform\nb6ed81f8cf Roll vulkan-deps from 7646a87dd950 to b59a366edcc0 (5 revisions)\n98daf58d4c Reland^2 \"[skparagraph] Render visible hyphen at soft hyphen (U+00AD) line breaks\"\nb3829c16ab Improve assertion in SubRunAllocator::allocateBytesFor.\ncf85357932 [graphite] Land framework for mask-to-device tracking\n530a64f289 Update fiddler-base for 74a6444abdcf\nebd1acff89 Add kjlubick to include owners.\n3078799bff infra: Disable PartitionAlloc on CodeSize builders\n779a09a6d2 Roll ANGLE from 5e591d03650d to e45b5fbf2710 (3 revisions)\nf4e3cd2c21 Roll Skia Infra from 61363e8559c7 to 1139a26d53b5 (11 revisions)\nb6089d3234 Roll Dawn from d0a283a7a5e6 to 63b237e40fc2 (10 revisions)\n313c0d67a1 Roll vulkan-deps from ef6bc0f88945 to 7646a87dd950 (5 revisions)\n2714767959 [graphite] Remove std::bit_cast usage from LayerKey\nbda7232e67 Additional performance optimization in SkScan_Hairline\n4fd1cd091f Remove legacy SkCodec::Register\n97872bbb46 [graphite] simplify layering\n56a8788096 SkJpegxlCodec: Fix uninitialized members in SkJpegxlCodecPriv\nf6fa41dc95 SkJpegxlCodec: Fix assignment instead of comparison in onGetPixels\nd400a4e9b6 Regression fix relating to review.skia.org/1205876\n31e7cab894 Roll vulkan-deps from 1d7928d07115 to ef6bc0f88945 (4 revisions)\n4c382df6a2 Expand the AndroidPaintOptions test to cover several new Pipelines\n0851d988db Roll ANGLE from fd958ac6533e to 5e591d03650d (6 revisions)\n29bf5b96e4 Roll Skia Infra from a27de25378c2 to 61363e8559c7 (9 revisions)\nc162a8ac07 Roll Dawn from d2eac07e6a1a to d0a283a7a5e6 (16 revisions)\nd34c84df4c Roll vulkan-deps from a4418d38ded4 to 1d7928d07115 (7 revisions)\n1d21a79543 Roll recipe dependencies (trivial).\n8cb6c7d110 Roll recipe dependencies (trivial).\nad7c94ac5a Make SkShader::isOpaque pure virtual; fill out missing cases\n3d08a21145 [skp] Validate image lattice counts\n\nCanonical link: https://commits.webkit.org/317567@main", "email": "aperez@igalia.com", "hash": "63dc09435158113350b0348118a4cfb1c8293f7b", "subject": "Update Skia to 2026-05-12 (a6d4d199301da96b1d0c85968446d27222597be0)" } }, "date": "2026-07-20", "days": 1, "generatedAt": "2026-07-20T22:05:46Z", "markdown": "## Highlights\n- **Rendering** CSS `corner-shape` now supports the superellipse case, filling in a notable piece of the emerging shape model. [commit 317560@main](https://commits.webkit.org/317560@main)\n- **Web Platform** SVG elements can now use external and `data:` URL filter references, closing a long-standing compatibility gap for filter-heavy content. [commit 317538@main](https://commits.webkit.org/317538@main)\n- **Security** WebKit fixed an out-of-bounds buffer index in `userVisibleURL` while probing for punycode prefixes, tightening a URL handling edge case. [commit 317537@main](https://commits.webkit.org/317537@main)\n- **V8** WebAssembly relaxed SIMD is now enabled behind a feature flag, expanding the wasm execution surface for newer SIMD code paths. [commit 317549@main](https://commits.webkit.org/317549@main)\n- **A11y** Accessibility text markers now round-trip correctly in the isolated tree, fixing a deep correctness issue for assistive technology text navigation. [commit 317545@main](https://commits.webkit.org/317545@main)\n- **Perf** Canvas 2D filtered drawing no longer needs to save state, removing unnecessary work from a hot rendering path. [commit 317546@main](https://commits.webkit.org/317546@main)\n- **Web Platform** Grid auto-placement support landed for GFC, pushing layout behavior closer to expected modern CSS grid semantics. [commit 317544@main](https://commits.webkit.org/317544@main)\n- **UI** Scroll snapping got a user-visible fix where Page Down could skip snap points, improving paging behavior on snap containers. [commit 317562@main](https://commits.webkit.org/317562@main)\n- **Build** The Skia import moved up to 2026-05-12, pulling in a fresh graphics stack update with broad downstream rendering impact. [commit 317567@main](https://commits.webkit.org/317567@main)\n\n## What landed by area\n\n### JavaScriptCore and WebAssembly\n- **Perf** `JSON.parse` now creates 8-bit strings for Latin1 values even when the input is 16-bit, reducing memory overhead on a common parse path. [commit 317566@main](https://commits.webkit.org/317566@main)\n- **Perf** B3LowerToAir now matches a non-canonical SBFX form, improving codegen pattern coverage in the JIT pipeline. [commit 317564@main](https://commits.webkit.org/317564@main)\n- **Perf** `ArrayAllocationProfile` now uses `vectorLengthHint` for `NewArrayWithSize`, sharpening array allocation heuristics. [commit 317563@main](https://commits.webkit.org/317563@main)\n- **Web Platform** Temporal's Ethiopic Amete Alem era mapping was corrected. [commit 317558@main](https://commits.webkit.org/317558@main)\n- **Perf** `String.prototype.at` negative-index adjustment was folded into a branchless `csel`, shaving control flow from a builtin fast path. [commit 317553@main](https://commits.webkit.org/317553@main)\n- **Web Platform** Temporal arithmetic for Ethioaa years was fixed, continuing standards-correctness work in the calendar implementation. [commit 317552@main](https://commits.webkit.org/317552@main)\n- **Web Platform** Async-from-sync iterators are now handled in `async_iterator_open` and `async_iterator_next`, tightening iterator protocol behavior. [commit 317550@main](https://commits.webkit.org/317550@main)\n- **V8** Wasm relaxed SIMD was enabled behind a feature flag. [commit 317549@main](https://commits.webkit.org/317549@main)\n- **Web Platform** Wasm-backed resizable ArrayBuffers now throw for all invalid sizes, aligning error behavior more closely with spec expectations. [commit 317540@main](https://commits.webkit.org/317540@main)\n- **Perf** Double-to-bool conversion in JSC was made branchless. [commit 317527@main](https://commits.webkit.org/317527@main)\n- **Perf** The opportunistic task scheduler and incremental sweeper now use `ApproximateTime` for deadlines. [commit 317524@main](https://commits.webkit.org/317524@main)\n\n### CSS, layout, and rendering\n- **Rendering** Nested iframe viewport zoom testing was fixed under EvaluationTimeZoom, unblocking a tricky zoom correctness case. [commit 317541@main](https://commits.webkit.org/317541@main)\n- **Rendering** `FlowMode` was introduced so WritingMode APIs can model flows like `flex-flow` more directly. [commit 317539@main](https://commits.webkit.org/317539@main)\n- **Rendering** `::highlight()` decoration metrics tests were unskipped after the `text-underline-offset` fix, confirming the rendering path is now stable. [commit 317525@main](https://commits.webkit.org/317525@main)\n- **Rendering** `ArrayPixelBuffer` became the superclass of `TypedArrayPixelBuffer`, a cleanup with future payoff for pixel buffer architecture. [commit 317522@main](https://commits.webkit.org/317522@main)\n\n### Accessibility and input\n- **A11y** Invoking an `aria-actions` custom action now preserves user focus, avoiding disruptive focus jumps for assistive tech users. [commit 317542@main](https://commits.webkit.org/317542@main)\n- **UI** Synthetic click based DOM `dblclick` support is now available across all `ENABLE_TWO_PHASE_CLICKS` configurations, reducing config-specific behavior drift. [commit 317523@main](https://commits.webkit.org/317523@main)\n\n### Storage, networking, and web APIs\n- **Web Platform** IndexedDB no longer throws `UnknownError` when opening `nextunique` or `prevunique` cursors over an empty key range. [commit 317559@main](https://commits.webkit.org/317559@main)\n- **Networking** WebTransport WPT expectations were updated, reflecting current interoperability and test behavior. [commit 317554@main](https://commits.webkit.org/317554@main)\n\n### Web Inspector and developer tooling\n- **DevTools** Web Inspector timelines now share unified record bar selection code, simplifying behavior across timeline views. [commit 317565@main](https://commits.webkit.org/317565@main)\n- **Perf** `DOMStorageManager` no longer does an O(n) `Object.shallowEqual` scan on every storage event, removing a bad scaling path in Inspector storage handling. [commit 317561@main](https://commits.webkit.org/317561@main)\n- **DevTools** WPE and GTK `UIScriptController.sendEventStream()` now supports wheel events, broadening test automation coverage for scrolling input. [commit 317551@main](https://commits.webkit.org/317551@main)\n- **DevTools** A constant-failure IPC sandbox-extension test was converted into an explicit new test expectation, cleaning up debug signal on Apple ports. [commit 317526@main](https://commits.webkit.org/317526@main)\n\n### GTK, WPE, media, and platform ports\n- **GPU** `webkit://gpu` on WPE now shows the preferred-format device even when the default device path is used. [commit 317536@main](https://commits.webkit.org/317536@main)\n- **Media** `webkitDrmGetFormatName` on GTK and WPE now trims trailing spaces correctly instead of producing malformed format strings. [commit 317535@main](https://commits.webkit.org/317535@main)\n- **Media** GStreamer HTTP source elements now get meaningful unique names, making media pipeline inspection easier. [commit 317534@main](https://commits.webkit.org/317534@main)\n- **Mobile** GLib gained magnification get/set APIs plus notify property updates, improving zoom integration for embedders. [commit 317531@main](https://commits.webkit.org/317531@main)\n- **UI** visionOS now switches the Surroundings Effect to `None` when Lightspill is available, refining environment presentation behavior. [commit 317547@main](https://commits.webkit.org/317547@main)\n- **UI** `sf-saas.apple.com` now supports copy and paste of SVG data. [commit 317528@main](https://commits.webkit.org/317528@main)\n\n### Build, infrastructure, and refactoring\n- **Build** Swift-in-WebKit cleanup switched `WTFExtras.swift` from existential throws to typed throws. [commit 317557@main](https://commits.webkit.org/317557@main)\n- **Build** A self-closing HTML tag fix landed for the image diff fuzzy meta tag, keeping parser expectations aligned in test infrastructure. [commit 317556@main](https://commits.webkit.org/317556@main)\n- **Build** macOS CMake builds were fixed after a unified-build symbol redefinition around `windowWithDoubleClickEventListener`. [commit 317555@main](https://commits.webkit.org/317555@main)\n- **Build** A dedupe of `windowWithDoubleClickEventListener` landed as the direct fix for the macOS unified-build breakage. [commit 317548@main](https://commits.webkit.org/317548@main)\n- **Refactor** Coordinated Graphics consolidated `findEventListenerRegionTypes` and `collectDescendantLayersAtPoint`, trimming duplication in scrolling tree hit-testing code. [commit 317533@main](https://commits.webkit.org/317533@main)\n- **Build** SaferCPP now stops analysis when compilation fails, avoiding false positives from broken compile states. [commit 317543@main](https://commits.webkit.org/317543@main)\n- **Build** SaferCPP warning fixes landed in `Source/WebKit`. [commit 317532@main](https://commits.webkit.org/317532@main)\n- **Refactor** `WTF::saturatingSum`'s variadic overload was fixed so sums of 3 or more arguments no longer truncate to `uint32_t`. [commit 317530@main](https://commits.webkit.org/317530@main)\n- **Refactor** `CrossThreadCopierBase\u003cHashSet\u003cObjectIdentifierGeneric\u003e\u003e` gained missing `IsNeeded` and move-copy support. [commit 317529@main](https://commits.webkit.org/317529@main)\n\n## Reverts \u0026 Reapplies\n\nNone.", "repo": "webkit", "repoDisplay": "WebKit", "rollGroups": [], "since": "2026-07-20", "totals": { "commits": 46, "features": 46, "rolls": 0 }, "until": "2026-07-20" }