{
  "commits": {
    "317896@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "317896@main",
      "clUrl": "https://commits.webkit.org/317896@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320193\n\nReviewed by Antti Koivisto.\n\nFollowing 320188, FlexFormattingContext still wrote to the render tree directly for a\nhandful of flex-item operations. Move those mutations onto FlexIntegrationUtils so the\nformatting context no longer mutates renderers itself:\n\n- setFlexItemGeometry / setFlowAwareLocationForFlexItem (the flow-aware setLocation) -\u003e\n  FlexIntegrationUtils::setFlexItemGeometry, which takes isHorizontalFlow and does the\n  transpose + setLocation internally.\n- The stretch-alignment else-branch's setOverridingBorderBoxLogicalHeight -\u003e\n  setFlexItemOverridingBorderBoxLogicalHeight.\n- The conditional invalidateContentLogicalWidths (two sites) -\u003e\n  invalidateFlexItemContentLogicalWidthsIfNeeded, which folds in the\n  shouldInvalidateContentWidths guard.\n- The ScopedFlexBasisAsFlexItemMainSize RAII (a temporary main-axis override during a\n  flex-base-size measurement) moves to LayoutIntegration::ScopedFlexBasisAsFlexItemMainSize,\n  deriving mainAxisIsInlineAxis from the FlexLayoutItem.\n\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.cpp:\n(WebCore::FlexFormattingContext::flexBaseSizeForFlexItem):\n(WebCore::FlexFormattingContext::applyStretchAlignmentToFlexItem):\n(WebCore::FlexFormattingContext::applyStretchMinMaxCrossSize):\n(WebCore::FlexFormattingContext::setFlowAwareLocationForFlexItem): Deleted.\n(WebCore::FlexFormattingContext::setFlexItemGeometry): Deleted.\n(WebCore::FlexFormattingContext::computeFlexItemRects):\n(WebCore::FlexFormattingContext::placeFlexItems):\n(WebCore::FlexFormattingContext::layoutColumnReverse):\n(WebCore::FlexFormattingContext::computeMainAxisExtentForFlexItem):\n(WebCore::ScopedFlexBasisAsFlexItemMainSize::ScopedFlexBasisAsFlexItemMainSize): Deleted.\n(WebCore::ScopedFlexBasisAsFlexItemMainSize::~ScopedFlexBasisAsFlexItemMainSize): Deleted.\n(): Deleted.\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.h:\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.h:\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.cpp:\n(WebCore::LayoutIntegration::FlexIntegrationUtils::setFlexItemGeometry):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::setFlexItemOverridingBorderBoxLogicalHeight):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::invalidateFlexItemContentLogicalWidthsIfNeeded):\n(WebCore::LayoutIntegration::ScopedFlexBasisAsFlexItemMainSize::ScopedFlexBasisAsFlexItemMainSize):\n(WebCore::LayoutIntegration::ScopedFlexBasisAsFlexItemMainSize::~ScopedFlexBasisAsFlexItemMainSize):\n\nCanonical link: https://commits.webkit.org/317896@main",
      "email": "zalan@apple.com",
      "hash": "9fe4d62ecd55ac33b837178e9536e21d3eff2b20",
      "subject": "[cleanup] Move FlexFormattingContext's flex-item render-tree mutations onto FlexIntegrationUtils"
    },
    "317897@main": {
      "author": "Cole Carley",
      "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64",
      "cl": "317897@main",
      "clUrl": "https://commits.webkit.org/317897@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320032\nrdar://182967087\n\nReviewed by Sammy Gill.\n\nFind in Page text markers are removed and readded every time the\nuser finds a new match. We improve performance by only removing\nand readding if the DOM or search criteria has changed.\n\nNote that I had to decouple the counting and matching in Editor.h\nfor this to work. Editor::countMatchesForText and\nEditor::markAllMatchesForText both use a common helper\nEditor::findAllMatches, which calls into\nCachedMatchFinder::findMatches. This simplifies the code, and\nallows us the benefit of caching the markers, which out weighs\nthe cost of calling CachedMatchFinder::findMatches in the case\nwe that only count.\n\n* Source/WebCore/editing/CachedMatchFinder.cpp:\n(WebCore::CachedMatchFinder::findMatches):\n(WebCore::CachedMatchFinder::clearTextBufferCache):\n(WebCore::CachedMatchFinder::setMatchesMarked):\n(WebCore::CachedMatchFinder::clearMatchesMarked):\n(WebCore::CachedMatchFinder::matchesAreMarked const):\n* Source/WebCore/editing/CachedMatchFinder.h:\n* Source/WebCore/editing/Editor.cpp:\n(WebCore::Editor::countMatchesForText):\n(WebCore::Editor::textMatchMarkersWereCleared):\n* Source/WebCore/editing/Editor.h:\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::unmarkAllTextMatches):\n* Source/WebKit/WebProcess/WebPage/FindController.cpp:\n(WebKit::FindController::countStringMatches):\n(WebKit::FindController::markMatches):\n(WebKit::FindController::updateFindUIAfterFindingAllMatches):\n\nCanonical link: https://commits.webkit.org/317897@main",
      "email": "ccarley2@apple.com",
      "hash": "dca7909abc1adcba44fa11379ae05c0833513ed4",
      "subject": "Cache Find in Page Text Markers"
    },
    "317898@main": {
      "author": "Dominic Mazzoni",
      "avatar": "https://www.gravatar.com/avatar/f76643c44a7ee3be45148e66d97ed8e4?d=identicon\u0026s=64",
      "cl": "317898@main",
      "clUrl": "https://commits.webkit.org/317898@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320074\nrdar://182995716\n\nReviewed by Tyler Wilcock.\n\nWhen text is inserted into a text control, VoiceOver responds to the\nvalue-changed notification and could observe the updated value but a stale caret\nposition. There were two root causes.\n\nFirst, the tree-level selection (the selected text marker range) is\nupdated on the selection-change channel, which runs after the\nvalue-changed notification is delivered. A client responding to the\nvalue change therefore saw a selection from before the edit. The fix is to\npush the current selection alongside the value change for text\ncontrols, so both are delivered together. The live selection is\nalready up-to-date at this point, so no extra recomputation is needed.\n\nSecond, the node-level selection (AXProperty::SelectedTextRange) could\nbe reverted on the accessibility thread. A value change queues a full\nnode update, which is transported to the isolated tree as an \"append\"\ncarrying a complete, freshly recomputed copy of the node (including\nits selection). Separately, selection changes queue a\nSelectedTextRange property update, debounced by ~100ms to coalesce\nrapid pure-selection changes such as drag-select. When a debounced\nupdate from one keystroke and the full node append from the next\nkeystroke land in the same snapshot, the reader thread applies all\nappends before all property changes, so the older debounced selection\nwas applied last and clobbered the fresh one. There is already\nsame-cycle dedup for this in processQueuedNodeUpdates() (a property\nupdate is skipped when a full node update is pending for the same\nobject); the debounce simply moves the two into different cycles,\ndefeating it. queueChange() now drops an already-queued\nSelectedTextRange update for an object when committing an append for\nit, extending that dedup across cycles. Updates queued after the\nappend are preserved, keeping last-writer-wins by queue order intact.\n\nThe debounce is left in place for its original purpose. Value changes\nare naturally throttled by typing speed, whereas pure selection\nchanges are not, so coalescing still matters for the latter.\n\nTest: accessibility/mac/textarea-value-selection-consistency-on-valuechange.html\n\n* LayoutTests/accessibility/mac/textarea-value-selection-consistency-on-valuechange-expected.txt: Added.\n* LayoutTests/accessibility/mac/textarea-value-selection-consistency-on-valuechange.html: Added.\n* Source/WebCore/accessibility/AXCoreObject.cpp:\n(WebCore::AXCoreObject::isTextControl const):\n(WebCore::AXCoreObject::isTextControl):\n* Source/WebCore/accessibility/AXCoreObject.h:\n* Source/WebCore/accessibility/AXObjectCache.cpp:\n(WebCore::AXObjectCache::updateIsolatedTree):\n* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp:\n(WebCore::AXIsolatedTree::queueChange):\n\nCanonical link: https://commits.webkit.org/317898@main",
      "email": "dm_mazzoni@apple.com",
      "hash": "ec3a7ab1590bf34a2d0461690772437d3d1a2d7b",
      "subject": "AX: value and selection for an editable text field aren't updated together in isolated tree"
    },
    "317899@main": {
      "author": "Ling Ho",
      "avatar": "https://www.gravatar.com/avatar/a317955e944b0846697e4a9c8cd28b65?d=identicon\u0026s=64",
      "cl": "317899@main",
      "clUrl": "https://commits.webkit.org/317899@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320219\nrdar://183157526\n\nReviewed by Ryan Haddad.\n\ngit creates .git/index.lock (and sibling *.lock files) while an index-mutating\ncommand runs and removes it on exit. If the git process is killed mid-operation\nthe lock is orphaned, and every subsequent git command run by\ncleanUpWorkingCopy() fails with \"Unable to create '.../index.lock': File exists\"\n(exit 128) -- wedging the bot so reverts and the periodic pull stop working\nuntil the file is removed by hand.\n\nClear stale *.lock files at the start of cleanUpWorkingCopy(), before any git\ncommand. This is safe because the AsyncTaskQueue serializes all work and each\ngit subprocess is awaited, so no bot-spawned git process is running at that\npoint.\n\n* Tools/WebKitBot/src/WebKitBot.mjs:\n(WebKitBot.prototype.clearStaleGitLocks): Added. Remove orphaned git lock files.\n(WebKitBot.prototype.cleanUpWorkingCopy): Call clearStaleGitLocks() before resetting.\n\nCanonical link: https://commits.webkit.org/317899@main",
      "email": "lingho@apple.com",
      "hash": "2e35f45980c66c3c13083b545aac8949bdad9752",
      "subject": "[webkitbot] Orphaned .git/index.lock wedges reverts and the periodic pull"
    },
    "317900@main": {
      "author": "Carlos Alberto Lopez Perez",
      "avatar": "https://www.gravatar.com/avatar/05326c1dbe06f486e884975e73f25179?d=identicon\u0026s=64",
      "cl": "317900@main",
      "clUrl": "https://commits.webkit.org/317900@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319698\n\nReviewed by Alexey Proskuryakov.\n\nThis patch introduces the following three improvements:\n - Never crash on text that is not valid UTF-8. Test output can contain\ngarbage bytes from a crashing process, or lone unicode surrogates from WPT\ntests that use intentionally malformed text. The problematic characters\nare kept and written as visible escapes (for example \\udcff) instead\nof crashing or being dropped. This replaces the workaround from\n300617@main, which only covered the layout filter and silently dropped\nthe problematic lines from the log.\n - Open the log file line-buffered. If buildbot kills the step, the log\nuploaded to S3 is now complete up to the last line received, instead\nof losing whatever was sitting in the write buffer. The cost was\nmeasured on Linux and Mac and it is negligible (well below 1 second\nfor a 30-minute layout test run producing 150k lines).\n - Remove the duplicated code in the filter functions. The eight\nfunctions were almost identical, differing only in which lines switch\nthe filter to print-everything mode and which lines are always\nprinted. They are replaced by a single function plus a table (FILTERS)\ndescribing each filter with those two conditions. Adding a new filter\nis now a couple of lines in the table.\n\n* Tools/Scripts/filter-test-logs:\n(parser):\n(filter_logs):\n(main):\n(filter_jsc_tests): Deleted.\n(filter_layout_tests): Deleted.\n(filter_scan_build): Deleted.\n(filter_webdriver_tests): Deleted.\n(filter_test262): Deleted.\n(filter_minibrowser_tests): Deleted.\n(filter_swift): Deleted.\n(filter_api_tests): Deleted.\n\nCanonical link: https://commits.webkit.org/317900@main",
      "email": "clopez@igalia.com",
      "hash": "f98b3f2b9488e5917929305e79d87c820311792e",
      "subject": "[WKCI] filter-test-logs crashes on output that is not valid UTF-8, and loses the tail of the log when the step is killed"
    },
    "317901@main": {
      "author": "Yulun Wu",
      "avatar": "https://www.gravatar.com/avatar/9e34d6632f4d926cdf6fe8dce07f9cb7?d=identicon\u0026s=64",
      "cl": "317901@main",
      "clUrl": "https://commits.webkit.org/317901@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320126\nrdar://183065634\n\nReviewed by Sammy Gill.\n\nRemove blockAxisConstraint parameter which is not needed for intrinsic\ntrack sizing.\n\n* Source/WebCore/layout/formattingContexts/grid/GridItemSizingFunctions.cpp:\n(WebCore::Layout::GridItemSizingFunctions::inlineAxis):\n* Source/WebCore/layout/formattingContexts/grid/GridLayoutUtils.cpp:\n(WebCore::Layout::GridLayoutUtils::inlineAxisMinContentContribution):\n(WebCore::Layout::GridLayoutUtils::inlineAxisMaxContentContribution):\n* Source/WebCore/layout/formattingContexts/grid/GridLayoutUtils.h:\n\nCanonical link: https://commits.webkit.org/317901@main",
      "email": "yulun_wu@apple.com",
      "hash": "ead85dd00157fddcdf9444d6deb167ea871b580f",
      "subject": "[GFC] Remove orphaned constraints from inline-axis grid item sizing functions"
    },
    "317902@main": {
      "author": "Karl Dubost",
      "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64",
      "cl": "317902@main",
      "clUrl": "https://commits.webkit.org/317902@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318091\nrdar://181462046\n\nReviewed by Sihui Liu.\n\nThe quirk added in bug 270494 routed queue-it.net cookies through an\nephemeral partitioned NSHTTPCookieStorage when embedded on\ncagreatamerica.com, working around ITP fully blocking third-party\ncookies during the season-pass purchase flow. cagreatamerica.com now\nredirects to sixflags.com/cagreatamerica, so the domain check never\nmatches, and testing the purchase flow on the new domain shows the\n\"Buy Now\" button works without the quirk. Remove the quirk and the\npartitioned-cookie-storage machinery that existed solely to serve it.\n\n* Source/WebCore/page/Quirks.cpp:\n* Source/WebCore/page/Quirks.h:\n* Source/WebKit/SourcesCocoa.txt:\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Source/WebKit/WebProcess/WebPage/Cocoa/WebCookieJarCocoa.mm: Removed.\n* Source/WebKit/WebProcess/WebPage/WebCookieJar.cpp:\n(WebKit::WebCookieJar::cookies const):\n(WebKit::WebCookieJar::setCookies):\n(WebKit::WebCookieJar::cookiesInPartitionedCookieStorage const): Deleted.\n(WebKit::WebCookieJar::setCookiesInPartitionedCookieStorage): Deleted.\n* Source/WebKit/WebProcess/WebPage/WebCookieJar.h:\n\nCanonical link: https://commits.webkit.org/317902@main",
      "email": "karlcow@apple.com",
      "hash": "7651ae8883c7d42a090ba02b398b8f8e9d3d8902",
      "subject": "cagreatamerica.com quirk does not work anymore since it redirects to sixflags.com/cagreatamerica"
    },
    "317903@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "317903@main",
      "clUrl": "https://commits.webkit.org/317903@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320130\nrdar://problem/183069388\n\nReviewed by Alan Baradlay.\n\nCurrently, UnplacedGridItem holds the information needed to resolve a\ngrid item's position in two different fields. These two fields are each\na std::pair of Style::GridPosition which holds the computed style for\nthe item's start and end position. Then when we are trying to determine\nthe actual position of the item we query the computed values multiple\ntimes to determine what type of position it is (e.g. a definite position\nlike grid-column-start: 1) or an automatic position.\n\nInstead what we can do is we can store the position in a dedicated type\nthat represents the type of position that it is when we create the\nUnplacedGridItem. This will then make the implementation for the code\nthat is actually used during layout a lot simpler since we figured out\nall of this information before we run layout. So most of this patch is\njust introducing this new type and moving the logic that was used to\ndetermine the type of grid position so that it is instead used to\nconstruct this new type.\n\n* Source/WebCore/layout/formattingContexts/grid/UnplacedGridItem.h:\n(WebCore::Layout::UnplacedGridItem::GridPosition::GridPosition):\nGridPosition is the new type that will hold all of the information\nneeded to correctly place the grid item during layout. It replaces the\ncomputed values that were on the item. This new type will hold a variant\nwhich is one of the two possible types it could be: a DefinitePosition\n(e.g. grid-column: 1 / 2) which represents a specific spot in the grid\nit needs to be placed or an AutoPosition in which we will use an\nalgorithm to find the appropriate spot.\n\n(WebCore::Layout::explicitLineToIndex):\nThe line numbers in the spec are 1-index based but we store the\ninformation as 0-indexed so this is just a tiny wrapper to help us\nconvert.\n\n(WebCore::Layout::UnplacedGridItem::GridPosition::create):\nThis is the core logic that takes in the two computed style values we\nwere holding onto earlier which were being queried during layout and\ninstead creates a DefinitePosition or AutoPosition based upon that same\nset of logic we were using during layout.\n\nCanonical link: https://commits.webkit.org/317903@main",
      "email": "sammy.gill@apple.com",
      "hash": "743de0ac207deefbce5b1a927f0c07b0cfa43807",
      "subject": "[GFC] Store a grid item's resolved placement in UnplacedGridItem::GridPosition"
    },
    "317904@main": {
      "author": "Cole Carley",
      "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64",
      "cl": "317904@main",
      "clUrl": "https://commits.webkit.org/317904@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320129\nrdar://183067192\n\nReviewed by Marcus Plutowski.\n\nPer the Wasm spec, an element segment's element expressions are evaluated\nexactly once during module instantiation, and the resulting references are\nstored in the element instance. Then, table.init and array.new_elem only copy\nthose already-evaluated references.\n\nJSC instead re-evaluated the constant expression on every read of an element\nsegment (in initElementSegment and copyElementSegment). For reference-producing\nGC expressions such as array.new_default, each evaluation allocates a fresh\nobject, so two table.init operations from the same passive segment produced\ndistinct arrays and ref.eq returned 0 instead of 1. This surfaced as a failure\nin imported/w3c/web-platform-tests/wasm/core/memory64/table_init64.wast.js\n(test #1044).\n\nEvaluate each element-segment expression exactly once per instance by caching\nthe result in m_constantExpressionValues, and mark the cached references\nduring GC visitation.\n\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/table_init64.wast.js-expected.txt:\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp:\n(JSC::JSWebAssemblyInstance::visitChildrenImpl):\n(JSC::JSWebAssemblyInstance::initElementSegment):\n(JSC::JSWebAssemblyInstance::copyElementSegment):\n(JSC::JSWebAssemblyInstance::ensureConstantExpressionValue):\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h:\n\nCanonical link: https://commits.webkit.org/317904@main",
      "email": "ccarley2@apple.com",
      "hash": "8c7d5cdee6369ebb6b6f8e502ce16836737f73ca",
      "subject": "Evaluate element segment expressions exactly once per instance"
    },
    "317905@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "317905@main",
      "clUrl": "https://commits.webkit.org/317905@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320196\n\nReviewed by Antti Koivisto.\n\nFollowing 320193, FlexFormattingContext still reached into RenderFlexibleBox directly\nfor three per-item cache/definiteness queries: flexItemContentLogicalHeight,\ncomputeBlockAxisContentSizeForFlexItem, and the flexItemMainSizeIsDefinite template.\nRoute these through FlexIntegrationUtils as well.\n\nUnlike the mutations moved in 320193, these are proxies rather than relocations: the\nbacking caches (m_contentLogicalHeights / m_blockAxisSize) are flex-container state\nread, written, and invalidated by ~8 non-FFC call sites (RenderBox's mid-layout\nsetFlexItemContentLogicalHeightIfNeeded, the scrollbar-relayout invalidation,\nflexItemWillBeRemoved, etc.), and computeBlockAxisContentSizeForFlexItem chains into the\nother two internally. So the implementations and caches stay on RenderFlexibleBox, and\nFlexIntegrationUtils simply forwards to them in FlexLayoutItem terms. This keeps the\nexternal callers untouched and avoids RenderFlexibleBox calling back into the integration\nlayer.\n\nflexItemMainSizeIsDefinite is a template, so its proxy is a template too, with the same\nfour explicit instantiations (FlexBasis / MinimumSize / MaximumSize / PreferredSize) that\ncomputeMainAxisExtentForFlexItem resolves through it. RenderFlexibleBox's own template and\ninstantiations are unchanged; they now serve the proxy across translation units instead of\nFlexFormattingContext.\n\nWith this, FlexFormattingContext no longer calls any method on the flex-container renderer:\nm_flexBox survives only as an argument (inspector instrumentation, and the containing block\nhanded to a flex item's own width resolution), never as a mid-layout state round-trip. Its\nremaining direct render-tree use is per-item flex-item reads.\n\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.cpp:\n(WebCore::FlexFormattingContext::flexBaseSizeForFlexItem):\n(WebCore::FlexFormattingContext::ensureBlockAxisContentSizeForFlexItemIfNeeded):\n(WebCore::FlexFormattingContext::computeContentBasedMinMainSize):\n(WebCore::FlexFormattingContext::computeMainAxisExtentForFlexItem):\n(WebCore::FlexFormattingContext::flexItemIntrinsicLogicalHeight):\n(WebCore::FlexFormattingContext::applyStretchAlignmentToFlexItem):\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.h:\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.cpp:\n(WebCore::LayoutIntegration::FlexIntegrationUtils::flexItemContentLogicalHeight):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::computeBlockAxisContentSizeForFlexItem):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::flexItemMainSizeIsDefinite):\n\nCanonical link: https://commits.webkit.org/317905@main",
      "email": "zalan@apple.com",
      "hash": "dad0a7c279cdea927f7a07aef9acb6cfcf846ae7",
      "subject": "[cleanup] Route FlexFormattingContext's last RenderFlexibleBox method calls through FlexIntegrationUtils"
    },
    "317906@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "317906@main",
      "clUrl": "https://commits.webkit.org/317906@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319946\nrdar://182862712\n\nReviewed by Yijia Huang.\n\nThis patch applies op_async_iterator_open and op_async_iterator_next to\nyield* in async generator functions. Previously we cannot apply that\nsince op_async_iterator_next was always calling `next()` while yield*\nwill pass a resume value `next(resumeValue)`. This patch extends\nop_async_iterator_next to have a flag \"hasValue\", and based on that\nargument will be pushed or not.\n\n                                       ToT                     Patched\n\nasync-generator-yield-star       95.7791+-0.6264     ^     79.6243+-0.7356        ^ definitely 1.2029x faster\n\nTests: JSTests/microbenchmarks/async-generator-yield-star.js\n       JSTests/stress/async-iteration-yield-star-resume-value.js\n\n* JSTests/microbenchmarks/async-generator-yield-star.js: Added.\n(async createAsyncGen):\n(async run):\n* JSTests/stress/async-iteration-yield-star-resume-value.js: Added.\n(assert):\n(async driverPath.async inner):\n(async driverPath.async outer):\n(async driverPath):\n(async genericPath):\n(async genericPath.async outer):\n(async forAwaitZeroArgs):\n(async asyncFromSyncPath):\n(async asyncFromSyncPath.async outer):\n(async asyncFromSyncPath.async outerArr):\n(async main):\n* Source/JavaScriptCore/bytecode/BytecodeList.rb:\n* Source/JavaScriptCore/bytecode/BytecodeOperandsForCheckpoint.h:\n(JSC::argumentCountIncludingThisFor):\n(JSC::resumeValueOperandFor):\n* Source/JavaScriptCore/bytecode/BytecodeUseDef.cpp:\n(JSC::computeUsesForBytecodeIndexImpl):\n* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:\n(JSC::BytecodeGenerator::emitGetGenericAsyncIterator):\n(JSC::BytecodeGenerator::emitAsyncIteratorNext):\n(JSC::BytecodeGenerator::emitEnumeration):\n(JSC::BytecodeGenerator::emitDelegateYield):\n(JSC::BytecodeGenerator::emitGetAsyncIterator): Deleted.\n* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h:\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::ByteCodeParser::handleAsyncIteratorNext):\n* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:\n(JSC::DFG::FixupPhase::fixupNode):\n* Source/JavaScriptCore/dfg/DFGOperations.cpp:\n(JSC::DFG::JSC_DEFINE_JIT_OPERATION):\n* Source/JavaScriptCore/dfg/DFGOperations.h:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n* Source/JavaScriptCore/jit/JITCall.cpp:\n(JSC::JIT::emit_op_async_iterator_next):\n* Source/JavaScriptCore/jit/JITOperations.cpp:\n(JSC::JSC_DEFINE_JIT_OPERATION):\n* Source/JavaScriptCore/jit/JITOperations.h:\n* Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:\n(JSC::LLInt::LLINT_SLOW_PATH_DECL):\n* Source/JavaScriptCore/llint/LowLevelInterpreter.asm:\n* Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm:\n* Source/JavaScriptCore/llint/LowLevelInterpreter64.asm:\n* Source/JavaScriptCore/runtime/AsyncFromSyncIteratorPrototype.cpp:\n(JSC::driveAsyncFromSyncIteratorWithDriver):\n* Source/JavaScriptCore/runtime/JSAsyncFromSyncIterator.h:\n* Source/JavaScriptCore/runtime/JSMicrotask.cpp:\n(JSC::resumeValueOrUndefined):\n(JSC::enqueueAsyncGeneratorDriver):\n(JSC::asyncIteratorNextWithDriver):\n* Source/JavaScriptCore/runtime/JSMicrotask.h:\n\nCanonical link: https://commits.webkit.org/317906@main",
      "email": "ysuzuki@apple.com",
      "hash": "5e28b6ce22ee4fccd38c23498a469f3d8508a47a",
      "subject": "[JSC] Use op_async_iterator_open and op_async_iterator_next for yield*"
    },
    "317907@main": {
      "author": "Jean-Yves Avenard",
      "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64",
      "cl": "317907@main",
      "clUrl": "https://commits.webkit.org/317907@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320173\nrdar://183108599\n\nReviewed by Eric Carlson.\n\nplay(); pause(); play(); sequence could leave play() promise permanently unsettled.\n\nplay() sent an admission request to the media session (clientWillBeginPlayback)\nand settled the pending play promises from its plain CompletionHandler, guarded\nby a bool flag (m_canBeginPlaybackInFlight) so a same-tick pause() wouldn't\nreject them out from under it. That flag only suppressed the reject call; it\ndid nothing to cancel the in-flight admission itself. If pause() ran while\nadmission was pending, clientWillBeginPlayback's own race handling would still\nresolve canBegin true, but with the paused/no-readyState booleans captured at\nplay() time now stale, the completion handler settled nothing and the play()\npromise hung forever under Site Isolation's async admission path.\n\nReplaced the flag with a NativePromiseRequest (m_playRequest) that tracks the\nin-flight admission as a cancellable GenericPromise. pauseInternal() now\ndisconnects m_playRequest before touching m_paused, so a pause() during\nadmission cancels the stale continuation outright instead of just muting one\nside effect of it, and the plain !m_paused guard reliably rejects the pending\npromises. Also handles play() called again on an already-playing element\ngetting denied on re-admission, situation which the old flag didn't cover\neither.\n\nMade the disconnect/reject conditional on a new m_playPromiseSettlementGuaranteed\nflag, captured alongside shouldNotifyAboutPlaying/shouldResolvePromises: when\neither of those was already true at play() time, the admission's own completion\nhandler is guaranteed to settle the promise itself, so pauseInternal() must\nleave it alone instead of preempting it with a spurious AbortError.\n\nCovered by existing test.\n\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::~HTMLMediaElement):\n(WebCore::HTMLMediaElement::playInternal):\n(WebCore::HTMLMediaElement::pauseInternal):\n* Source/WebCore/html/HTMLMediaElement.h:\n\nCanonical link: https://commits.webkit.org/317907@main",
      "email": "jya@apple.com",
      "hash": "05aab377dd33755b8a6c34c3c53a275f5daaed83",
      "subject": "[site-isolation] media/media-play-promise-reject-pause-abort.html is a permanent timeout"
    },
    "317908@main": {
      "author": "Qianlang Chen",
      "avatar": "https://www.gravatar.com/avatar/0fd54e904334f604739d0205aa6e2130?d=identicon\u0026s=64",
      "cl": "317908@main",
      "clUrl": "https://commits.webkit.org/317908@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318832\nrdar://181048565\n\nReviewed by BJ Burg.\n\nThe core getResponseBody routing under Site Isolation (SI) landed earlier\nin commit 313753@main (ProxyingNetworkAgent -\u003e WebInspectorBackend -\u003e\nBackendResourceDataStore). This finishes the remaining work: adds success-\nand error-path test coverage, and fixes two bugs that testing and manual\nverification surfaced.\n\nBug 1 (backend, WebProcess crash): when the WebContent process that served\na resource is gone, IPC synthesizes the async reply from default-constructed\narguments (AsyncReplyError). The old three-value reply\n(content, base64Encoded, errorString) then produced an empty errorString,\nwhich a null String reports as isEmpty(), so ProxyingNetworkAgent misread a\ndead process as an empty-body success. The reply is now\nExpected\u003cstd::tuple\u003cString, bool\u003e, String\u003e: a value is success, an unexpected\nwith a non-empty message is a real backend error, and an unexpected with an\nempty message (only produced by AsyncReplyError on connection loss) is\nreported as an explicit failure. A process-liveness check inside the reply\nhandler was rejected because it is racy: on a mid-request crash,\nAuxiliaryProcessProxy::shutDownProcess() runs Connection::cancelAsyncReplyHandlers()\nbefore clearing m_connection, so the process still reports state() == Running\nwhen the reply runs. The structural discriminator is timing-independent.\n\nBug 2 (frontend, target routing): a resource's target defaults to\nWI.mainTarget because the SI proxy sends an empty targetID, and under SI\nWI.mainTarget is the page target. But the Network domain\n(ProxyingNetworkAgent) lives on the multiplexing backend target, so the\nUI content path (Resource.requestContent) issued getResponseBody on the\npage target's legacy NetworkAgent, which does not know the resource's\ncross-process requestId and answers \"Missing resource for given\nrequestId\". Resource.requestContentFromBackend now routes\ngetResponseBody to the backend target when it has Network enabled. The\ngate is WI.networkManager.enabledNetworkForSiteIsolation (set when the\nfirst Frame target appears and Network is enabled on the backend\ntarget), not Target.hasDomain(\"Network\"): hasDomain is statically true\non the WebPage-type backend target even when no Network agent is enabled\non it. Absent that agent (the single-process case) no Frame target is\ncreated, so the flag stays false and the content path stays on the\nresource's own target. The existing layout tests missed this because\nthey call WI.backendTarget.NetworkAgent directly; a new test drives the\nreal requestContent() path.\n\nScope notes: the requestId routing-trust hardening (a UIProcess-side\nrequestId -\u003e process map instead of reverse-parsing the frontend string)\nremains the existing FIXME in ProxyingNetworkAgent.cpp filed under bug 308890\n(the same bug whose BackendResourceDataStore work landed in ccf6c82ad5c8); it\nis intentionally left for that FIXME and does not block getResponseBody\nworking. Main-document content capture for cross-origin iframes is tracked by\nbug 312828 (the main resource is classified ResourceType::Other); a parked\ntest for it is held for that change and is not included here. Memory-cache and\nreal-eviction layout coverage are descoped: the backend memory-cache path is\ncode-verified, but a deterministic layout-test trigger is unreliable.\n\nTests: http/tests/site-isolation/inspector/network/cross-origin-iframe-get-response-body-after-navigation.html\n       http/tests/site-isolation/inspector/network/cross-origin-iframe-get-response-body-after-process-crash.html\n       http/tests/site-isolation/inspector/network/cross-origin-iframe-get-response-body-error-cases.html\n       http/tests/site-isolation/inspector/network/cross-origin-iframe-get-response-body-via-request-content.html\n       http/tests/site-isolation/inspector/network/cross-origin-iframe-get-response-body.html\n\n* LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-get-response-body-after-navigation-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-get-response-body-after-navigation.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-get-response-body-after-process-crash-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-get-response-body-after-process-crash.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-get-response-body-error-cases-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-get-response-body-error-cases.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-get-response-body-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-get-response-body-via-request-content-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-get-response-body-via-request-content.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-get-response-body.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/network/resources/fetch-content-iframe.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/network/resources/get-response-body-iframe.html: Added.\n* Source/WebInspectorUI/UserInterface/Controllers/NetworkManager.js:\n(WI.NetworkManager.prototype.get enabledNetworkForSiteIsolation):\n* Source/WebInspectorUI/UserInterface/Models/Resource.js:\n(WI.Resource.prototype.requestContentFromBackend):\n* Source/WebKit/UIProcess/Inspector/Agents/ProxyingNetworkAgent.cpp:\n(Inspector::ProxyingNetworkAgent::getResponseBody):\n* Source/WebKit/WebProcess/Inspector/BackendResourceDataStore.cpp:\n(WebKit::BackendResourceDataStore::getResponseBody):\n* Source/WebKit/WebProcess/Inspector/BackendResourceDataStore.h:\n* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.cpp:\n(WebKit::WebInspectorBackend::getResponseBody):\n* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.h:\n* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.messages.in:\n\nCanonical link: https://commits.webkit.org/317908@main",
      "email": "qianlangchen@apple.com",
      "hash": "8e056fb08f560f5480e173eaf332c7ddae1fa5f3",
      "subject": "[Site Isolation] Web Inspector: finish Network.getResponseBody"
    },
    "317909@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "317909@main",
      "clUrl": "https://commits.webkit.org/317909@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=320245\u003e\n\u003crdar://183175357\u003e\n\nUnreviewed test gardening.\n\nThe test fails only on x86_64 configurations: it crashes on macOS wk2\nRelease and produces a text failure on GTK and WPE, in both debug and\nrelease.  Every arm64 configuration is clean over 700 runs, so the\nexpectations are scoped to the architectures and configurations that\nactually flake rather than applied port-wide.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/317909@main",
      "email": "ddkilzer@apple.com",
      "hash": "a2efd7ea166214ba3c89e36abb17131b8b5a9354",
      "subject": "[macOS wk2 x86_64, GTK, WPE] imported/w3c/web-platform-tests/web-locks/bfcache/abort.tentative.https.html is a flaky failure"
    },
    "317910@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "317910@main",
      "clUrl": "https://commits.webkit.org/317910@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=320093\u003e\n\u003crdar://182961418\u003e\n\nReviewed by Jean-Yves Avenard.\n\n`AudioVideoRendererRemote::m_seeking` is an atomic flag, but its\naccesses are split across two work queues.\n`AudioVideoRendererRemote::prepareToSeek()` sets it and\n`AudioVideoRendererRemote::finishSeek()` reads it while those methods\nrun on `MediaSourcePrivateAVFObjC::queueSingleton()`, whereas the\nGPU-reply `whenSettled` callbacks inside them clear it on\n`AudioVideoRendererRemote::queueSingleton()`.  With no ordering between\nthe two queues, a superseding seek whose `prepareToSeek()` reply is\ndefinite (or a GPU-not-running path) can clear `m_seeking` while an\nearlier seek is still being finished, so `finishSeek()` is entered with\n`m_seeking` already false.  The debug `ASSERT(m_seeking)` at that entry\ntreats this internally-reachable state as caller misuse and traps,\nwhich is the source of the crashes seen on Debug builds.\n`AudioVideoRendererRemote::cancelPendingSeek()` does not close the\nwindow: it can neither stop an in-flight GPU round trip from settling\nand clearing the flag, nor a fresh `prepareToSeek()` from re-setting it.\n\nTreat a no-longer-seeking state as a superseded seek and reject early,\nmatching `AudioVideoRendererAVFObjC::finishSeek()`, which already\nhandles the same interface state this way for the non-GPU-process\nrenderer.  Besides removing the Debug assertion, this also stops a\nsuperseded seek from issuing a redundant `FinishSeek` to the GPU\nprocess and completing the player to a stale seek time in release\nbuilds.\n\nThese existing media-source seek tests exercise the path and hit the\nassertion crash on the bots:\n\n    media/media-source/media-source-muted-scroll-and-seek-crash.html\n    media/media-source/media-source-no-preload-set-duration-crash.html\n    media/media-source/media-source-real-scrub-then-play.html\n    media/media-source/media-source-seek-and-play.html\n\n* Source/WebKit/WebProcess/GPU/media/AudioVideoRendererRemote.cpp:\n(WebKit::AudioVideoRendererRemote::finishSeek):\n\nCanonical link: https://commits.webkit.org/317910@main",
      "email": "ddkilzer@apple.com",
      "hash": "ae61725f4cb3e96e996777e60f91f1dab925aada",
      "subject": "AudioVideoRendererRemote::finishSeek should handle a superseded seek instead of asserting"
    },
    "317911@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "317911@main",
      "clUrl": "https://commits.webkit.org/317911@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320243\n\nReviewed by Antti Koivisto.\n\nFlexFormattingContext works in FlexLayoutItems, but still reached through .renderer to call a\nhandful of FlexFormattingUtils per-item helpers that only had a RenderBox overload -- so several\ncall sites kept a `CheckedRef flexItem = flexLayoutItem.renderer` local purely to feed them.\n\nGive those helpers a FlexLayoutItem overload -- crossAxisExtentForFlexItem, mainAxisExtentForFlexItem,\noverflowAlignmentForFlexItem, flexItemHasAspectRatio, and availableAlignmentSpaceForFlexItem -- each a\none-line forwarder to the existing RenderBox form, mirroring the static/instance pairs the class\nalready had (crossAxisMarginExtentForFlexItem, alignmentForFlexItem, ...). Switch the\nFlexFormattingContext call sites to pass the FlexLayoutItem so none of them hands FlexFormattingUtils a\nrenderer, and drop three now-unused renderer locals (their asserts read flexLayoutItem.renderer directly).\n\nThe RenderBox forms stay: they are still called from the render side -- RenderFlexibleBox,\nLayoutIntegration::FlexLayout's baseline and positioned static-position paths, and FlexIntegrationUtils'\noverride scopes -- which hold a bare renderer rather than a FlexLayoutItem.\n\nNo change in behavior.\n\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.cpp:\n(WebCore::FlexFormattingContext::crossSizeForFlexLines):\n(WebCore::FlexFormattingContext::computeCrossSizeForFlexItems):\n(WebCore::FlexFormattingContext::handleCrossAxisAlignmentForFlexItems):\n(WebCore::FlexFormattingContext::performBaselineAlignment):\n(WebCore::FlexFormattingContext::placeFlexItems):\n(WebCore::FlexFormattingContext::layoutColumnReverse):\n(WebCore::FlexFormattingContext::computeContentBasedMinMainSize):\n(WebCore::FlexFormattingContext::computeMainSizeFromAspectRatioUsing):\n(WebCore::FlexFormattingContext::applyStretchMinMaxCrossSize):\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingUtils.h:\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingUtils.cpp:\n(WebCore::FlexFormattingUtils::crossAxisExtentForFlexItem):\n(WebCore::FlexFormattingUtils::mainAxisExtentForFlexItem):\n(WebCore::FlexFormattingUtils::overflowAlignmentForFlexItem):\n(WebCore::FlexFormattingUtils::flexItemHasAspectRatio):\n(WebCore::FlexFormattingUtils::availableAlignmentSpaceForFlexItem):\n\nCanonical link: https://commits.webkit.org/317911@main",
      "email": "zalan@apple.com",
      "hash": "6c9904c1764ad0e759022a201281b2d0d726876e",
      "subject": "[cleanup] Pass FlexLayoutItem instead of RenderBox to the remaining FlexFormattingUtils flex-item helpers"
    },
    "317912@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "317912@main",
      "clUrl": "https://commits.webkit.org/317912@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320206\n\nReviewed by Antti Koivisto.\n\nContinuing to route FlexFormattingContext's flex-item work through FlexIntegrationUtils,\nmove the flex-item main-axis measurement and the cross-axis-override machinery it depends\non off the render side:\n\n- computeMainAxisExtentForFlexItem moves from FlexFormattingContext to FlexIntegrationUtils.\n  Its body is all render-tree measurement (min/maxContentLogicalWidthContribution,\n  computeLogicalWidthUsing, computeContentLogicalHeight, table captions, scrollbars); the\n  only FlexFormattingContext state it needs is mainAxisSizeForLengthResolution, now passed\n  as an argument, and the container, reached via flexBox().\n- OverridingSizesScope and ScopedCrossAxisOverrideForFlexItem move from RenderFlexibleBox\n  nested classes to the LayoutIntegration namespace (in FlexIntegrationUtils), alongside\n  ScopedFlexBasisAsFlexItemMainSize.\n- FlexIntegrationUtils grows helpers that bundle the override scope with the measurement:\n  computeMainAxisExtentForFlexItemWithCrossAxisOverride (the three intrinsic/stretch/content\n  computeMainAxisExtent sites) and max/minContentMainAxisContributionForFlexItem (the two\n  direct min/maxContentLogicalWidthContribution reads). FlexFormattingContext now constructs\n  no override scope and performs no direct contribution reads.\n\nScopedCrossAxisOverrideForFlexItem keeps toggling RenderFlexibleBox's\nm_inFlexItemIntrinsicWidthComputation, which stays on the renderer: it is set during\npreferred-width computation (RenderBlock::computeChildIntrinsicLogicalWidths, where no\nFlexLayoutState is engaged) as well as during flex layout, and canUseFlexItemForPercentageResolution\nconsumes it before the FlexLayoutState guard. The relocated scope reaches the private flag\nvia friendship, as RenderFlexibleBox already befriends FlexIntegrationUtils and FlexLayout;\nRenderBlock's preferred-width path constructs the LayoutIntegration scope directly.\n\nNo behavior change.\n\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.cpp:\n(WebCore::FlexFormattingContext::flexBaseSizeForFlexItem):\n(WebCore::FlexFormattingContext::computeUsedMaxMainSize):\n(WebCore::FlexFormattingContext::computeUsedNonAutoMinMainSize):\n(WebCore::FlexFormattingContext::computeContentBasedMinMainSize):\n(WebCore::FlexFormattingContext::computeMainAxisExtentForFlexItem): Deleted.\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.h:\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.h:\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.cpp:\n(WebCore::LayoutIntegration::FlexIntegrationUtils::computeMainAxisExtentForFlexItem):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::computeMainAxisExtentForFlexItemWithCrossAxisOverride):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::maxContentMainAxisContributionForFlexItem):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::minContentMainAxisContributionForFlexItem):\n(WebCore::LayoutIntegration::OverridingSizesScope::OverridingSizesScope):\n(WebCore::LayoutIntegration::OverridingSizesScope::~OverridingSizesScope):\n(WebCore::LayoutIntegration::ScopedCrossAxisOverrideForFlexItem::ScopedCrossAxisOverrideForFlexItem):\n(WebCore::LayoutIntegration::ScopedCrossAxisOverrideForFlexItem::~ScopedCrossAxisOverrideForFlexItem):\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::OverridingSizesScope::OverridingSizesScope): Deleted.\n(WebCore::RenderFlexibleBox::OverridingSizesScope::~OverridingSizesScope): Deleted.\n(WebCore::RenderFlexibleBox::ScopedCrossAxisOverrideForFlexItem::ScopedCrossAxisOverrideForFlexItem): Deleted.\n(WebCore::RenderFlexibleBox::ScopedCrossAxisOverrideForFlexItem::~ScopedCrossAxisOverrideForFlexItem): Deleted.\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n* Source/WebCore/rendering/RenderBlock.cpp:\n(WebCore::RenderBlock::computeChildIntrinsicLogicalWidths):\n\nCanonical link: https://commits.webkit.org/317912@main",
      "email": "zalan@apple.com",
      "hash": "7b505e5caaaaf2cd057bab541a50f1bf52a06999",
      "subject": "[cleanup] Move flex-item main-axis measurement and its cross-axis-override scope into FlexIntegrationUtils"
    },
    "317913@main": {
      "author": "Andy Estes",
      "avatar": "https://www.gravatar.com/avatar/643f10f01b26fd94d03482a2013b2ea0?d=identicon\u0026s=64",
      "cl": "317913@main",
      "clUrl": "https://commits.webkit.org/317913@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320203\nrdar://183150290\n\nReviewed by Eric Carlson.\n\nFilled in two gaps in test coverage identified by Claude:\n1. Test that -webView:requestMediaCapturePermissionForOrigin:initiatedByFrame:type:decisionHandler:\n   is called with the correct frame info when permission is requested from a cross-origin frame,\n   and that the delegate can deny such requests.\n2. Test that the main frame's autoplay policy takes precedence when evaluating autoplay policy in a\n   cross-origin frame.\n\n* Tools/TestWebKitAPI/Helpers/cocoa/UserMediaCaptureUIDelegate.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/UserMediaCaptureUIDelegate.mm:\n(-[UserMediaCaptureUIDelegate init]):\n(-[UserMediaCaptureUIDelegate setDecision:forFrameHost:]):\n(-[UserMediaCaptureUIDelegate lastRequestFrameHost]):\n(-[UserMediaCaptureUIDelegate webView:requestMediaCapturePermissionForOrigin:initiatedByFrame:type:decisionHandler:]):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::TEST(SiteIsolation, MediaCapturePermissionUsesRemoteFrameOrigin)):\n(TestWebKitAPI::TEST(SiteIsolation, AutoplayPolicyInRemoteFrameFollowsMainFrame)):\n\nCanonical link: https://commits.webkit.org/317913@main",
      "email": "aestes@apple.com",
      "hash": "aba0a6a26b7555b95b7ee372625655a8661b0e4e",
      "subject": "[Site Isolation] Expand test coverage for per-site camera, microphone, and autoplay policies in cross-origin frames"
    },
    "317914@main": {
      "author": "Wenson Hsieh",
      "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64",
      "cl": "317914@main",
      "clUrl": "https://commits.webkit.org/317914@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320221\nrdar://180970146\n\nReviewed by Richard Robinson, Aditya Keerthi, and Abrar Rahman Protyasha.\n\nThe changes in 316271@main allowed the Siri affordance to dismiss after a short delay (2 seconds),\nonce scrolling ends. However, this still looks strange, as the UI lingers on screen where it\nshouldn't be.\n\nTo mitigate this, we detect when the mouse cursor no longer intersects with the bounds of the\nselection rect (based on `EditorState`), and explicitly dismiss the Siri affordance.\n\nTest: EditorStateTests.DismissSiriAffordanceWhenSelectionScrollsAwayFromCursor\n\n* Source/WTF/wtf/PlatformHave.h:\n* Source/WebKit/Platform/spi/mac/AppKitSPI.h:\n* Source/WebKit/UIProcess/mac/WebViewImpl.h:\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::handleProcessSwapOrExit):\n(WebKit::WebViewImpl::pageDidScroll):\n(WebKit::WebViewImpl::updateCursorOverlapsSelectionAndNotifyIfNeeded):\n* Tools/TestWebKitAPI/Helpers/mac/AppKitSPI.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/EditorStateTests.mm:\n(-[TestSiriAffordanceController isVisible]):\n(-[TestSiriAffordanceController dismiss]):\n(-[TestSiriAffordanceController setRealController:]):\n(-[TestSiriAffordanceController forwardingTargetForSelector:]):\n(-[TestSiriAffordanceController respondsToSelector:]):\n(TestWebKitAPI::TEST(EditorStateTests, DismissSiriAffordanceWhenSelectionScrollsAwayFromCursor)):\n\nCanonical link: https://commits.webkit.org/317914@main",
      "email": "wenson_hsieh@apple.com",
      "hash": "98f32bc74deaeb95471f888c1b27855e255770cd",
      "subject": "macOS 27: Siri affordance should dismiss immediately after scrolling the selection away from the mouse cursor"
    },
    "317915@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "317915@main",
      "clUrl": "https://commits.webkit.org/317915@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=319467\u003e\n\u003crdar://170007132\u003e\n\nReviewed by Zak Ridouh.\n\nEnable `-Wallocator-wrappers` for the libwebrtc projects and resolve\nthe ten resulting warnings.  The warning flags functions that directly\nwrap a system allocator (`malloc`/`calloc`/`realloc`); the wrapper\nhides the allocation from the compiler and prevents Typed Memory\nOperations (TMO) type inference at call sites.\n\nResolve each wrapper using one of three strategies, picked per\nwrapper based on body complexity, public-API exposure, and whether\nthe function is taken by-address:\n\n- Adopt `_MALLOC_TYPED` for substantive wrappers whose `size_t`\n  parameter maps directly to the underlying allocation.  The\n  compiler rewrites direct calls to a typed variant that forwards\n  a `malloc_type_id_t` inferred from the cast at each call site.\n  Applies to `srtp_crypto_alloc`, `pffft_aligned_malloc`, and\n  `webrtc::AlignedMalloc`.\n- Convert trivial pass-through wrappers to function-like macros so\n  the compiler sees the underlying allocator at every call site.\n  Applies to `opus_alloc`, `opus_realloc`, `opus_alloc_scratch`,\n  `strdup_libc_malloc`, and `webrtc::AllocatePffftBuffer`.\n- Suppress `-Wallocator-wrappers` for wrappers that cannot be\n  rewritten because the function is taken by-address.  yasm's\n  `def_xmalloc`/`def_xcalloc`/`def_xrealloc` are only assigned to\n  global function pointers; `OPENSSL_malloc` is assigned to a\n  function pointer in `OPENSSL_vasprintf_internal`.  In both cases\n  the rewriter cannot rewrite calls made through a function pointer\n  at runtime, so the original symbol must remain defined.\n\nEnable the warning in `Base.xcconfig`, whose `WARNING_CFLAGS` every\nlibwebrtc target inherits via `$(inherited)`.\n\nAll WebKit-specific divergences are wrapped in\n`#if defined(WEBRTC_WEBKIT_BUILD)` so future upstream resyncs land in\nthe `#else` branch, per the libwebrtc fork's macro contract.  The\nyasm pragma is unconditional because `yasm.xcconfig` does not define\n`WEBRTC_WEBKIT_BUILD` (yasm is built as a build-time tool, not linked\ninto `libwebrtc.dylib`).\n\n`strdup_libc_malloc` calls libc `strdup()` directly rather than\nreimplementing it; upstream's MSVC deprecation and glibc/musl\nfeature-macro concerns do not apply on Apple platforms.\n\nNo new tests since this change is not directly testable.\n\n* Source/ThirdParty/libwebrtc/Configurations/Base.xcconfig:\n* Source/ThirdParty/libwebrtc/Source/third_party/boringssl/src/crypto/err/err.cc:\n(strdup_libc_malloc):\n* Source/ThirdParty/libwebrtc/Source/third_party/boringssl/src/crypto/mem.cc:\n(OPENSSL_malloc):\n* Source/ThirdParty/libwebrtc/Source/third_party/libsrtp/crypto/include/alloc.h:\n* Source/ThirdParty/libwebrtc/Source/third_party/libsrtp/crypto/kernel/alloc.c:\n(srtp_crypto_alloc_typed): Add.\n(srtp_crypto_alloc):\n* Source/ThirdParty/libwebrtc/Source/third_party/opus/src/celt/os_support.h:\n* Source/ThirdParty/libwebrtc/Source/third_party/pffft/src/pffft.c:\n(pffft_aligned_malloc_typed): Add.\n(pffft_aligned_malloc):\n* Source/ThirdParty/libwebrtc/Source/third_party/pffft/src/pffft.h:\n* Source/ThirdParty/libwebrtc/Source/third_party/yasm/libyasm/xmalloc.c:\n(def_xmalloc):\n(def_xcalloc):\n(def_xrealloc):\n* Source/ThirdParty/libwebrtc/Source/webrtc/modules/audio_processing/utility/pffft_wrapper.cc:\n(webrtc::AllocatePffftBuffer):\n* Source/ThirdParty/libwebrtc/Source/webrtc/rtc_base/memory/aligned_malloc.cc:\n(webrtc::AlignedMalloc_typed): Add.\n(webrtc::AlignedMalloc):\n* Source/ThirdParty/libwebrtc/Source/webrtc/rtc_base/memory/aligned_malloc.h:\n\nCanonical link: https://commits.webkit.org/317915@main",
      "email": "ddkilzer@apple.com",
      "hash": "757068e48bcf5f86dacd0ba7211fe77ad286e64b",
      "subject": "[libwebrtc] Adopt Typed Memory Operations in allocator wrappers"
    },
    "317916@main": {
      "author": "Zak Ridouh",
      "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64",
      "cl": "317916@main",
      "clUrl": "https://commits.webkit.org/317916@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=312033\u003e\n\u003crdar://problem/182231103\u003e\n\nReviewed by Elliott Williams.\n\nThe IDL/CSS/bindings generators got their feature --defines from the CMake\noption list, which hand-mirrored SDK-gated PlatformEnableCocoa.h features (the\nENABLE_APPLE_PAY_* family and friends) and drifted from what the compiler sees\nthrough wtf/Platform.h.\n\nMake Platform.h the source of truth, like Xcode's DerivedSources.make: retire\nthose options from the Mac port, since their value depends on the SDK and so\nisn't knowable at configure time, and derive the generators' defines by\npreprocessing Platform.h at build time, passing them via a new --defines-file.\nMac-only for now.\n\n* Source/WTF/Scripts/generate-platform-args:\n(run_clang_command):\n(run_cmake_mode):\n(write_if_changed):\n(run_print_feature_defines_mode):\n(main):\n* Source/cmake/OptionsCocoa.cmake:\n* Source/cmake/OptionsMac.cmake:\n* Source/cmake/WebKitFeatures.cmake:\n(WEBKIT_OPTION_OWNED_BY_PLATFORM_H):\n* Source/cmake/WebKitMacros.cmake:\n(_webkit_platform_args_empty_input):\n(_webkit_platform_args_clang_prefix):\n(webkit_generate_platform_feature_defines_file):\n(_webkit_generate_platform_swift_args):\n* Source/WebCore/CMakeLists.txt:\n* Source/WebCore/WebCoreMacros.cmake:\n* Source/WebCore/bindings/scripts/generate-bindings-all.pl:\n* Source/WebCore/css/make-css-file-arrays.pl:\n* Source/WebCore/css/scripts/process-css-properties.py:\n* Source/WebCore/css/scripts/process-css-pseudo-selectors.py:\n* Source/WebCore/css/scripts/process-css-values.py:\n\nCanonical link: https://commits.webkit.org/317916@main",
      "email": "zakr@apple.com",
      "hash": "4a74cec87d6df520ffb556bc0a488cf9e195c118",
      "subject": "[CMake] Derive the generators' feature defines from Platform.h on Mac"
    },
    "317917@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "317917@main",
      "clUrl": "https://commits.webkit.org/317917@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320255\nrdar://183180839\n\nReviewed by Richard Robinson.\n\nThis is a test coverage follow up from 303122@main. In said patch, we\nprincipally addressed the race conditions around gesture event\nprocessing when site isolation is enabled. In this patch, we simply add\na regression test verifying that gesture events over cross-origin iframe\nPDFs are no longer crashy, either, which was internally tracked through\nrdar://163141314.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/http/tests/site-isolation/magnify-gesture-over-cross-origin-pdf-iframe-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/magnify-gesture-over-cross-origin-pdf-iframe.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/test.pdf: Added.\n\nCanonical link: https://commits.webkit.org/317917@main",
      "email": "a_protyasha@apple.com",
      "hash": "051b2714048ac3a10c4884fccad581430bacd55e",
      "subject": "[Site Isolation] [macOS] Add crash verification test for pinch zooming over cross-origin \u003ciframe src=pdf\u003e"
    },
    "317918@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "317918@main",
      "clUrl": "https://commits.webkit.org/317918@main",
      "description": "rdar://183147333\nhttps://bugs.webkit.org/show_bug.cgi?id=320200\n\nReviewed by Alex Christensen.\n\nWebResourceLoader data available handler can be synchronously called when set.\nWe thus adoptRef WebResourceLoader and then set the data available handler.\n\nCovered by existing tests.\n\n* Source/WebKit/WebProcess/Network/WebResourceLoader.cpp:\n(WebKit::WebResourceLoader::create):\n(WebKit::WebResourceLoader::WebResourceLoader):\n(WebKit::WebResourceLoader::initPendingStreamState):\n* Source/WebKit/WebProcess/Network/WebResourceLoader.h:\n\nCanonical link: https://commits.webkit.org/317918@main",
      "email": "youenn@apple.com",
      "hash": "5d23f731cb40ba88bd6f4a6aa048bda68c31e90b",
      "subject": "WebResourceLoader constructor is crashing on GTK bots"
    },
    "317919@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "317919@main",
      "clUrl": "https://commits.webkit.org/317919@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=320260\u003e\n\u003crdar://183185724\u003e\n\nReviewed by Zak Ridouh.\n\n`SegmentedVector::Segment` is a flexible-array-member handle whose only\nmember is the trailing `T m_entries[0]`, so a segment is sized to hold\n`segSize` elements of `T` and the buffer is reinterpreted as a\n`Segment*`.  The unix.MallocSizeof checker flags this deliberate\n`sizeof(T)` versus `Segment*` mismatch.  The checker has no\nflexible-array-member exemption, and because it is an AST-based checker\nits report is not silenced by `[[clang::suppress]]`, so the suppression\nmacros from `wtf/Compiler.h` do not apply here.\n\nThe checker only inspects a cast that syntactically wraps the\nallocation call, so hold the result in its natural `void*` and cast at\nthe point of use instead.  Typed Memory Operations infer the allocation\ntype from the cast wherever it appears, so this keeps the same\n`malloc_type_id_t` the compiler infers today.\n\nAdd a `static_assert` that `Segment` adds no header.  Nothing else ties\nthe allocation size to the overlay: were `Segment` to gain a member,\nevery element would shift past it and the last one would fall outside\nthe buffer.\n\nNo new tests since no change in behavior.\n\n* Source/WTF/wtf/SegmentedVector.h:\n(WTF::SegmentedVector::allocateSegment):\n\nCanonical link: https://commits.webkit.org/317919@main",
      "email": "ddkilzer@apple.com",
      "hash": "4477de733d5b3aa1244d05fd21146678c82041a0",
      "subject": "Avoid unix.MallocSizeof static analyzer false positive in SegmentedVector::allocateSegment()"
    },
    "317920@main": {
      "author": "Simon Fraser",
      "avatar": "https://www.gravatar.com/avatar/3763324aa0cdfa93be751c6081b8006a?d=identicon\u0026s=64",
      "cl": "317920@main",
      "clUrl": "https://commits.webkit.org/317920@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320209\nrdar://182918397\n\nReviewed by Tim Horton.\n\n`RemoteLayerTreeDisplayLinkClient::displayLinkFired()` is called off the main thread from\na CVDisplayLink callback, and does a `RunLoop::mainSingleton().dispatch()`. If the main\nthread is busy for some reason (either CPU bound, or perhaps in some scenarios involving\nmachine sleep or certain window configurations), then the main thread dispatches pile up.\nWhen the main thread finally wakes up, it may have a huge queue of callbacks to process.\nMy my testing, things like window resize and printing could result in queued callbacks.\n\nAs noted in my earlier fix in this area (313360@main), each call to the drawing area's\n`didRefreshDisplay()` can block for about 4ms because it's trying to sync with the\nscrolling thread, so this pile of callbacks can take a long time to process, resulting\nin user-perceived hangs.\n\nFix by coalescing the main thread dispatches via an atomic timestamp on `RemoteLayerTreeDisplayLinkClient`.\nIn order to clear this inside the callback, make `RemoteLayerTreeDisplayLinkClient`\nthread-safe refcounted with a create function.\n\nBecause getting stuck never calling `didRefreshDisplay()` on a drawing area would be\ncatastrophic, be paranoid and call it anyway if it's been over 500ms since the previous\nsuccessful call, with some release logging.\n\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeDrawingAreaProxyMac.h:\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeDrawingAreaProxyMac.mm:\n(WebKit::RemoteLayerTreeDisplayLinkClient::displayLinkFired):\n(WebKit::RemoteLayerTreeDrawingAreaProxyMac::RemoteLayerTreeDrawingAreaProxyMac):\n\nCanonical link: https://commits.webkit.org/317920@main",
      "email": "simon.fraser@apple.com",
      "hash": "7369e2faf2790fb25ef0736579f8eb1d0b9c6d2d",
      "subject": "Safari main thread can block under RemoteLayerTreeEventDispatcher::mainThreadDisplayDidRefresh()"
    },
    "317921@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "317921@main",
      "clUrl": "https://commits.webkit.org/317921@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320216\n\nReviewed by Antti Koivisto.\n\nScopedCrossAxisOverrideForFlexItem (introduced in 320206) bundled two separate concerns that\nwere applied together at every flex-item intrinsic-width measurement:\n\n- the cross-axis size override, set on the item so its own size computation sees the container's\n  definite cross size (and cleared when the cross size is indefinite), plus the optional\n  preferred-width invalidation; and\n- RenderFlexibleBox::m_inFlexItemIntrinsicWidthComputation, which makes the item's percentage\n  content resolve against that definite cross size (via canUseFlexItemForPercentageResolution).\n\nBundling them made the class unnameable and forced both onto every use regardless of need.\nSplit it into two single-purpose scopes:\n\n- FlexItemDefiniteCrossSizeScope: the override + invalidation. Touches only the item, so it\n  needs no access to the container. It is used when measuring an item before it is stretched:\n  when the item is going to be stretched to a definite cross size (flexbox 9.8 rule 1), that size\n  becomes its cross-axis overriding size so the measurement sees the item's final cross size;\n  otherwise the item has no definite cross size and both of its overriding sizes are cleared.\n- FlexItemIntrinsicWidthComputationScope: the flag. This is the only piece that reaches the\n  container's private member, so it stays a friend of RenderFlexibleBox.\n\nBoth main-axis branches of computeMainAxisExtentForFlexItem need the definite cross size: the\ninline (width) branch measures the item's width by laying its content out, and the block\n(column/height) branch resolves an intrinsic height that -- for a replaced item, or any item with\na preferred aspect ratio -- is computed from the item's used cross size. The intrinsic-width flag,\non the other hand, only affects percentage resolution while the item's width is being measured, so\nit is applied to the inline branch, the two direct min/maxContentLogicalWidthContribution reads,\nand RenderBlock::computeChildIntrinsicLogicalWidths, but not to the block branch. No intended\nchange in behavior.\n\nSince FlexItemDefiniteCrossSizeScope was the last user of the generic OverridingSizesScope that\nsaved, replaced and restored a box's overriding sizes, that class is folded into it: the flex-item\nscope now saves and restores the axes it touches directly, which lets its two branches read as the\nsizing rule they implement rather than as axis bookkeeping. The one remaining caller,\nFlexFormattingContext::flexItemIntrinsicLogicalWidth, clears the item's overriding width around a\ncomputeLogicalWidth call, and now does that save/restore by hand with a FIXME: computeLogicalWidth\nreturns the overriding width as-is for a flex item, but nothing in the layout pass appears to set an\noverriding inline size on an orthogonal flex item at that point, so this may be removable.\n\nAlso fixed a stale comment: computeLogicalWidthUsing re-computes the intrinsic widths for content\nsizes, not \"always\".\n\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.h:\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.cpp:\n(WebCore::LayoutIntegration::FlexItemDefiniteCrossSizeScope::FlexItemDefiniteCrossSizeScope):\n(WebCore::LayoutIntegration::FlexItemDefiniteCrossSizeScope::~FlexItemDefiniteCrossSizeScope):\n(WebCore::LayoutIntegration::FlexItemIntrinsicWidthComputationScope::FlexItemIntrinsicWidthComputationScope):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::computeMainAxisExtentForFlexItemWithCrossAxisOverride):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::maxContentMainAxisContributionForFlexItem):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::minContentMainAxisContributionForFlexItem):\n(WebCore::LayoutIntegration::OverridingSizesScope::OverridingSizesScope): Deleted.\n(WebCore::LayoutIntegration::OverridingSizesScope::~OverridingSizesScope): Deleted.\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.cpp:\n(WebCore::FlexFormattingContext::flexItemIntrinsicLogicalWidth):\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n* Source/WebCore/rendering/RenderBlock.cpp:\n(WebCore::RenderBlock::computeChildIntrinsicLogicalWidths):\n\nCanonical link: https://commits.webkit.org/317921@main",
      "email": "zalan@apple.com",
      "hash": "0b1757694dabeeb50887ecb95dc800f36ebddf79",
      "subject": "[cleanup] Split the flex-item cross-size override and intrinsic-width flag into separate scopes"
    },
    "317922@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "317922@main",
      "clUrl": "https://commits.webkit.org/317922@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320226\n\nReviewed by Antti Koivisto.\n\nAfter 320216 the flex-item main-axis measurement was split across two functions with awkward\ngating: callers picked computeMainAxisExtentForFlexItem for definite sizes and\ncomputeMainAxisExtentForFlexItemWithCrossAxisOverride for intrinsic ones, and the wrapper then\nre-checked the axis to decide which scopes to apply.\n\nFold the two scopes into computeMainAxisExtentForFlexItem, where they are actually consumed. An\nintrinsic main size is measured from the item's content, so it gets its definite cross size\n(FlexItemDefiniteCrossSizeScope) for both main-axis branches: the inline (width) branch lays the\nitem's content out, and the block (height) branch resolves a height that -- for a replaced item, or\nany item with a preferred aspect ratio -- is computed from the item's used cross size. A definite\nmain size resolves to a length without measuring the content, so it gets neither scope. The\nintrinsic-width flag only affects percentage resolution while the item's width is being measured, so\nit stays on the inline branch alone.\n\ncomputeMainAxisExtentForFlexItemWithCrossAxisOverride (and its explicit instantiations) is removed,\nand the three call sites collapse to a single computeMainAxisExtentForFlexItem call each. No change\nin behavior for the paths that already had the scopes: the internal size.isIntrinsicOrStretch() gate\nreproduces the callers' former base-vs-wrapper choice.\n\nThe block (height) branch did not previously get the cross-size override, so an intrinsic main size\nthere is now measured with the container's definite cross size applied. That progresses\ncss/css-flexbox/flex-basis-013.html subtests 3-5, where a row flex item with flex-basis:\nmin-content / fit-content / max-content around a \u003ccanvas\u003e now resolves its width through the aspect\nratio (50px) instead of measuring the canvas' raw intrinsic width (5px).\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-flexbox/flex-basis-013-expected.txt:\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.cpp:\n(WebCore::FlexFormattingContext::computeUsedMaxMainSize):\n(WebCore::FlexFormattingContext::computeUsedNonAutoMinMainSize):\n(WebCore::FlexFormattingContext::computeContentBasedMinMainSize):\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.h:\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.cpp:\n(WebCore::LayoutIntegration::FlexIntegrationUtils::computeMainAxisExtentForFlexItem):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::computeMainAxisExtentForFlexItemWithCrossAxisOverride): Deleted.\n\nCanonical link: https://commits.webkit.org/317922@main",
      "email": "zalan@apple.com",
      "hash": "46327f724be09f4b27c1c72b9dd083ca34d6abcc",
      "subject": "Fold the cross-size-override/intrinsic-width scopes into computeMainAxisExtentForFlexItem"
    },
    "317923@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "317923@main",
      "clUrl": "https://commits.webkit.org/317923@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320236\n\nReviewed by Antti Koivisto.\n\nA couple of flex-item measurements still read the render tree straight from\nFlexFormattingContext. Move them behind FlexIntegrationUtils so the formatting context keeps\nthe flex algorithm and the integration owns the RenderBox access.\n\nflexItemIntrinsicLogicalHeight and flexItemIntrinsicLogicalWidth move to FlexIntegrationUtils.\nEach takes the one flex-algorithm decision it needs -- whether the item's logical height must be\nstretched, and whether its cross size is definite -- as a bool computed by the formatting context\n(via FlexFormattingUtils / FlexLayoutState) and passed in. That keeps FlexLayoutState and the\nFlexFormattingUtils queries on the formatting-context side and leaves the integration methods as\npure render-tree measurement: scrollbar + border/padding + constrainLogicalHeightByMinMax, or\ncomputeLogicalWidth with the item's overriding width cleared.\n\nWhile here, fold the flex-base-size max-content branch's border/padding subtraction into the\nintegration. maxContentMainAxisExtentForFlexItem now returns the content-box extent (the\ncontribution minus the item's main-axis border/padding) instead of the raw contribution, so\nflexBaseSizeForFlexItem no longer reads the item's border/padding directly. It is renamed from\nmaxContentMainAxisContributionForFlexItem to reflect the value it returns.\n\nNo change in behavior.\n\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.cpp:\n(WebCore::FlexFormattingContext::hypotheticalCrossSizeForFlexItems):\n(WebCore::FlexFormattingContext::flexBaseSizeForFlexItem):\n(WebCore::FlexFormattingContext::flexItemIntrinsicLogicalHeight): Deleted.\n(WebCore::FlexFormattingContext::flexItemIntrinsicLogicalWidth): Deleted.\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.h:\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.cpp:\n(WebCore::LayoutIntegration::FlexIntegrationUtils::maxContentMainAxisExtentForFlexItem):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::flexItemIntrinsicLogicalHeight):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::flexItemIntrinsicLogicalWidth):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::maxContentMainAxisContributionForFlexItem): Deleted.\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.h:\n\nCanonical link: https://commits.webkit.org/317923@main",
      "email": "zalan@apple.com",
      "hash": "d17570d0d2aaed5ea087bca65d75c5be810028c8",
      "subject": "[cleanup] Have FlexIntegrationUtils own the flex item's intrinsic-size measurement"
    }
  },
  "date": "2026-07-25",
  "days": 1,
  "generatedAt": "2026-07-25T22:05:45Z",
  "markdown": "## Highlights\n- **Rendering** Flex layout cleanup keeps intrinsic sizing and render-tree mutations inside FlexIntegrationUtils, tightening one of WebCore's messier layout paths and making future flex fixes safer. [commit 317923@main](https://commits.webkit.org/317923@main)\n- **UI** Safari fixes a main-thread stall in RemoteLayerTreeEventDispatcher::mainThreadDisplayDidRefresh(), targeting a visible responsiveness issue during display refresh. [commit 317920@main](https://commits.webkit.org/317920@main)\n- **Security** Site Isolation adds a crash verification test for pinch zoom over cross-origin PDF iframes on macOS, hardening a sensitive embed path. [commit 317917@main](https://commits.webkit.org/317917@main)\n- **Security** Cross-origin frame policy coverage expands for camera, microphone, and autoplay, strengthening enforcement tests around per-site permissions. [commit 317913@main](https://commits.webkit.org/317913@main)\n- **DevTools** Web Inspector finishes Network.getResponseBody for Site Isolation, closing a real tooling gap when debugging isolated page loads. [commit 317908@main](https://commits.webkit.org/317908@main)\n- **V8** JavaScriptCore now uses dedicated async iterator bytecodes for yield*, a targeted interpreter and compiler improvement for async generator paths. [commit 317906@main](https://commits.webkit.org/317906@main)\n- **A11y** Editable text fields in the isolated accessibility tree now update value and selection together, fixing stale assistive-technology state. [commit 317898@main](https://commits.webkit.org/317898@main)\n- **Perf** Find in Page now caches text markers, which should cut repeated marker work and make in-page search feel snappier. [commit 317897@main](https://commits.webkit.org/317897@main)\n\n## What landed by area\n\n### Flexbox and layout plumbing\n- **Refactor** FlexIntegrationUtils now owns flex item intrinsic-size measurement, consolidating sizing logic into one place. [commit 317923@main](https://commits.webkit.org/317923@main) [bug 320236](https://bugs.webkit.org/show_bug.cgi?id=320236)\n- **Refactor** Cross-size-override and intrinsic-width scopes were folded into computeMainAxisExtentForFlexItem, reducing scope churn in main-axis sizing. [commit 317922@main](https://commits.webkit.org/317922@main) [bug 320226](https://bugs.webkit.org/show_bug.cgi?id=320226)\n- **Refactor** Flex item cross-size override and intrinsic-width flags were split into separate scopes for cleaner state handling. [commit 317921@main](https://commits.webkit.org/317921@main) [bug 320216](https://bugs.webkit.org/show_bug.cgi?id=320216)\n- **Refactor** Flex item main-axis measurement and its cross-axis override scope moved into FlexIntegrationUtils. [commit 317912@main](https://commits.webkit.org/317912@main) [bug 320206](https://bugs.webkit.org/show_bug.cgi?id=320206)\n- **Refactor** Remaining flex-item helpers now take FlexLayoutItem instead of RenderBox, continuing the move away from raw render-tree coupling. [commit 317911@main](https://commits.webkit.org/317911@main) [bug 320243](https://bugs.webkit.org/show_bug.cgi?id=320243)\n- **Refactor** FlexFormattingContext's last RenderFlexibleBox calls now route through FlexIntegrationUtils, further centralizing the flex integration layer. [commit 317905@main](https://commits.webkit.org/317905@main) [bug 320196](https://bugs.webkit.org/show_bug.cgi?id=320196)\n- **Refactor** FlexFormattingContext's flex-item render-tree mutations moved onto FlexIntegrationUtils, reducing mutation spread across layout code. [commit 317896@main](https://commits.webkit.org/317896@main) [bug 320193](https://bugs.webkit.org/show_bug.cgi?id=320193)\n\n### Site Isolation and security coverage\n- **Security** A macOS crash verification test now covers pinch zooming over a cross-origin PDF iframe in Site Isolation. [commit 317917@main](https://commits.webkit.org/317917@main) [bug 320255](https://bugs.webkit.org/show_bug.cgi?id=320255)\n- **Security** Test coverage expanded for per-site camera, microphone, and autoplay policies in cross-origin frames. [commit 317913@main](https://commits.webkit.org/317913@main) [bug 320203](https://bugs.webkit.org/show_bug.cgi?id=320203)\n- **DevTools** Site Isolation support in Web Inspector advances with a finished Network.getResponseBody implementation. [commit 317908@main](https://commits.webkit.org/317908@main) [bug 318832](https://bugs.webkit.org/show_bug.cgi?id=318832)\n\n### Media and WebRTC\n- **Media** AudioVideoRendererRemote::finishSeek now handles a superseded seek instead of asserting, fixing a nasty seek-race failure mode. [commit 317910@main](https://commits.webkit.org/317910@main) [bug 320093](https://bugs.webkit.org/show_bug.cgi?id=320093)\n- **Media** A permanent timeout in media-play-promise-reject-pause-abort.html was addressed under site isolation coverage. [commit 317907@main](https://commits.webkit.org/317907@main) [bug 320173](https://bugs.webkit.org/show_bug.cgi?id=320173)\n- **Refactor** libwebrtc allocator wrappers adopted typed memory operations, modernizing low-level memory handling. [commit 317915@main](https://commits.webkit.org/317915@main) [bug 319467](https://bugs.webkit.org/show_bug.cgi?id=319467)\n\n### JavaScriptCore and language semantics\n- **V8** JavaScriptCore switches yield* to op_async_iterator_open and op_async_iterator_next for async iteration paths. [commit 317906@main](https://commits.webkit.org/317906@main) [bug 319946](https://bugs.webkit.org/show_bug.cgi?id=319946)\n- **Web Platform** Element segment expressions are now evaluated exactly once per instance, tightening spec behavior and avoiding duplicate side effects. [commit 317904@main](https://commits.webkit.org/317904@main) [bug 320129](https://bugs.webkit.org/show_bug.cgi?id=320129)\n\n### Grid and rendering\n- **Rendering** Grid items now store resolved placement in UnplacedGridItem::GridPosition, simplifying later placement lookups. [commit 317903@main](https://commits.webkit.org/317903@main) [bug 320130](https://bugs.webkit.org/show_bug.cgi?id=320130)\n- **Rendering** Orphaned constraints were removed from inline-axis grid item sizing functions in GFC, trimming dead complexity from grid sizing. [commit 317901@main](https://commits.webkit.org/317901@main) [bug 320126](https://bugs.webkit.org/show_bug.cgi?id=320126)\n\n### UI, Safari, and platform behavior\n- **UI** Safari fixes a main-thread block in RemoteLayerTreeEventDispatcher::mainThreadDisplayDidRefresh(). [commit 317920@main](https://commits.webkit.org/317920@main) [bug 320209](https://bugs.webkit.org/show_bug.cgi?id=320209)\n- **UI** On macOS 27, the Siri affordance now dismisses immediately after the selected text scrolls away from the mouse cursor. [commit 317914@main](https://commits.webkit.org/317914@main) [bug 320221](https://bugs.webkit.org/show_bug.cgi?id=320221)\n- **Mobile** A compatibility quirk for cagreatamerica.com was updated to keep working after the site redirected to sixflags.com/cagreatamerica. [commit 317902@main](https://commits.webkit.org/317902@main) [bug 318091](https://bugs.webkit.org/show_bug.cgi?id=318091)\n\n### Accessibility and text search\n- **A11y** Editable text fields in the isolated accessibility tree now keep value and selection updates in sync. [commit 317898@main](https://commits.webkit.org/317898@main) [bug 320074](https://bugs.webkit.org/show_bug.cgi?id=320074)\n- **Perf** Find in Page now caches text markers to avoid recomputing them. [commit 317897@main](https://commits.webkit.org/317897@main) [bug 320032](https://bugs.webkit.org/show_bug.cgi?id=320032)\n\n### Build, bots, and test infrastructure\n- **Build** CMake now derives generator feature defines from Platform.h on Mac, reducing drift between generated config and platform reality. [commit 317916@main](https://commits.webkit.org/317916@main) [bug 312033](https://bugs.webkit.org/show_bug.cgi?id=312033)\n- **Build** WebResourceLoader constructor crashes on GTK bots were fixed. [commit 317918@main](https://commits.webkit.org/317918@main) [bug 320200](https://bugs.webkit.org/show_bug.cgi?id=320200)\n- **Build** A flaky web-locks BFCache WPT on macOS wk2 x86_64, GTK, and WPE was stabilized. [commit 317909@main](https://commits.webkit.org/317909@main) [bug 320245](https://bugs.webkit.org/show_bug.cgi?id=320245)\n- **Build** WKCI's filter-test-logs now survives invalid UTF-8 and preserves log tails when killed. [commit 317900@main](https://commits.webkit.org/317900@main) [bug 319698](https://bugs.webkit.org/show_bug.cgi?id=319698)\n- **Build** webkitbot now recovers from orphaned .git/index.lock files that previously wedged reverts and periodic pulls. [commit 317899@main](https://commits.webkit.org/317899@main) [bug 320219](https://bugs.webkit.org/show_bug.cgi?id=320219)\n- **Refactor** SegmentedVector::allocateSegment() was adjusted to avoid a unix.MallocSizeof static analyzer false positive. [commit 317919@main](https://commits.webkit.org/317919@main) [bug 320260](https://bugs.webkit.org/show_bug.cgi?id=320260)",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [],
  "since": "2026-07-25",
  "totals": {
    "commits": 28,
    "features": 28,
    "rolls": 0
  },
  "until": "2026-07-25"
}