{ "commits": { "317942@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317942@main", "clUrl": "https://commits.webkit.org/317942@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320267\nrdar://183189985\n\nReviewed by Alexey Proskuryakov.\n\nRunner.handle() referenced the undefined name `message_type` instead\nof its `message_name` parameter when raising on an unrecognized\nmessage, causing a NameError to mask the intended ValueError.\n\n* Tools/Scripts/webkitpy/test/runner.py:\n(Runner.handle):\n\nCanonical link: https://commits.webkit.org/317942@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "e97b5c4fa498231ca461dcdf24bac2fee4252fae", "subject": "webkitpy: Fix NameError in Runner.handle() for unknown messages" }, "317943@main": { "author": "Carlos Alberto Lopez Perez", "avatar": "https://www.gravatar.com/avatar/05326c1dbe06f486e884975e73f25179?d=identicon\u0026s=64", "cl": "317943@main", "clUrl": "https://commits.webkit.org/317943@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320284\n\nUnreviewed follow-up patch.\n\nIn the previous commit at 317938@main I broke the check on the JSC queues to see if\nthe bot should rebuild or download the built product without change from the builder.\n\nThe rebuild should only happen when the property rebuild_without_change_on_builder\nis False.\n\n* Tools/CISupport/ews-build/steps.py:\n(usesBuildWebKitForJSC):\n(shouldBuildJSCOnly):\n(RunJavaScriptCoreTests.evaluateCommand):\n\nCanonical link: https://commits.webkit.org/317943@main", "email": "clopez@igalia.com", "hash": "1e8fcb431bbb04288310c5b7e6955cb246e54163", "subject": "[WKCI][ews-build.webkit.org][WPE] The WPE-JSC queue should use build-webkit instead build-jsc to build without change (follow-up fix)" }, "317944@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "317944@main", "clUrl": "https://commits.webkit.org/317944@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320298\n\nReviewed by Antti Koivisto.\n\nFlexIntegrationUtils was a member of FlexLayout, so it lived as long as the RenderFlexibleBox even\nthough everything on it is flex-algorithm work. What kept it there was the flex-item content cache:\nFlexLayout owns the cache, and its renderer-facing entry points reached it by forwarding through\nFlexIntegrationUtils' RenderBox-taking overloads.\n\nHave FlexLayout talk to FlexItemContentCache directly instead. That drops those overloads, and with\nthem the last reason for anything outside the flex algorithm to hold FlexIntegrationUtils, so the\nformatting context can construct it in its initializer list and let it die with the layout. The\ncache is still owned by FlexLayout, since it has to outlive a single layout, and is now passed to\nthe formatting context by reference.\n\nMaking it a value member is what turns integrationUtils() into a const/non-const pair: constness\npropagates through a member but not through a reference, so the accessor now has to say which\nmethods actually mutate. The formatting context's own RenderFlexibleBox reference becomes const\nalong the way; its only two uses are InspectorInstrumentation calls.\n\nAlso drop the min-content branch in formattingContextRootLogicalHeightForType. It is the only thing\nthat called RenderFlexibleBox::flexItemContentLogicalHeight, and it is unreachable:\nIntegrationUtils::minContentHeight, the sole path to LogicalHeightType::MinContent for a flex item,\nhas no callers. That leaves the box argument used only by the ASSERT on the first line, which compiles\nout in release builds, so mark it UNUSED_PARAM.\n\nNo change in behaviour.\n\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.cpp:\n(WebCore::FlexFormattingContext::FlexFormattingContext):\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.h:\n* Source/WebCore/layout/integration/LayoutIntegrationFormattingContextLayout.cpp:\n(WebCore::LayoutIntegration::formattingContextRootLogicalHeightForType):\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.cpp:\n(WebCore::LayoutIntegration::FlexIntegrationUtils::applyStretchedLogicalHeightToFlexItem):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::layoutFlexItemForStretchedCrossSize):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::flexItemContentLogicalHeight):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::computeBlockAxisContentSizeForFlexItem):\n(WebCore::LayoutIntegration::canSetFlexItemContentLogicalHeight): Deleted.\n(WebCore::LayoutIntegration::FlexIntegrationUtils::setFlexItemContentLogicalHeightFromLayout): Deleted.\n(WebCore::LayoutIntegration::FlexIntegrationUtils::restoreFlexItemContentLogicalHeight): Deleted.\n(WebCore::LayoutIntegration::FlexIntegrationUtils::invalidateBlockAxisSizeForFlexItem): Deleted.\n(WebCore::LayoutIntegration::FlexIntegrationUtils::flexItemWillBeRemoved): Deleted.\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.h:\n* Source/WebCore/layout/integration/flex/LayoutIntegrationFlexLayout.cpp:\n(WebCore::LayoutIntegration::FlexLayout::FlexLayout):\n(WebCore::LayoutIntegration::FlexLayout::layout):\n(WebCore::LayoutIntegration::FlexLayout::setFlexItemContentLogicalHeightFromLayout):\n(WebCore::LayoutIntegration::FlexLayout::invalidateBlockAxisSizeForFlexItem):\n(WebCore::LayoutIntegration::FlexLayout::flexItemWillBeRemoved):\n(WebCore::LayoutIntegration::FlexLayout::flexItemContentLogicalHeight): Deleted.\n* Source/WebCore/layout/integration/flex/LayoutIntegrationFlexLayout.h:\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::flexItemContentLogicalHeight): Deleted.\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n\nCanonical link: https://commits.webkit.org/317944@main", "email": "zalan@apple.com", "hash": "60ed425475e2be58144ff1bdb539435c54053d68", "subject": "[cleanup] Have FlexFormattingContext own FlexIntegrationUtils instead of borrowing it from FlexLayout" }, "317945@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "317945@main", "clUrl": "https://commits.webkit.org/317945@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320304\nrdar://183238244\n\nReviewed by Eric Carlson.\n\nHTMLMediaElement::playPlayer() took a one-shot synchronous snapshot of\nm_categoryAtMostRecentPlayback and m_modeAtMostRecentPlayback; it was never read\nagain.\nWith site isolation, updating the category occurs asynchronously and the UIP\nsends an IPC message with the new category. However, any changes wasn't\nbroadcast to clients.\n\nWe add a categoryDidChange() API to the AudioSessionConfigurationChangeObserver\nand notify the HTMLMediaElement client of the category change.\n\nCovered by existing test\n\n* LayoutTests/platform/ios-site-isolation/TestExpectations:\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::categoryDidChange):\n* Source/WebCore/html/HTMLMediaElement.h:\n* Source/WebCore/platform/audio/AudioSession.h:\n(WebCore::AudioSessionConfigurationChangeObserver::categoryDidChange):\n* Source/WebKit/WebProcess/GPU/media/RemoteAudioSession.cpp:\n(WebKit::RemoteAudioSession::setCategory):\n\nCanonical link: https://commits.webkit.org/317945@main", "email": "jya@apple.com", "hash": "bb1d958caa857d4d81bc1b829acbaa86f0d12dad", "subject": "[site-isolation] media/audio-session-category-at-most-recent-playback.html is a permanent failure" }, "317946@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317946@main", "clUrl": "https://commits.webkit.org/317946@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320195\nrdar://183143887\n\nReviewed by Chris Dumez.\n\nEditor::pasteWithPasteboard() dereferences the std::optional\u003cSimpleRange\u003e\nreturned by selectedRange() without checking it first. If there is no\nselection, this could crash. The Windows, GLib, and libwpe backends\nalready guard against this case; add the same early-return guard to\nthe iOS and Mac backends for consistency and safety.\n\n* Source/WebCore/editing/ios/EditorIOS.mm:\n(WebCore::Editor::pasteWithPasteboard):\n* Source/WebCore/editing/mac/EditorMac.mm:\n(WebCore::Editor::pasteWithPasteboard):\n\nCanonical link: https://commits.webkit.org/317946@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "da6b7f167d01519d19d17ef6bcbfadbf5ac2a70b", "subject": "Potential crash pasting with no selection due to missing null-check on selectedRange()" }, "317947@main": { "author": "Zhuo Ying Jiang Li", "avatar": "https://www.gravatar.com/avatar/324e2791871d8411876b6bcbd3c4f2b5?d=identicon\u0026s=64", "cl": "317947@main", "clUrl": "https://commits.webkit.org/317947@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319668\n\nReviewed by Marcus Plutowski and Keith Miller.\n\nThis change correctly sets config-\u003eenabled=true when MTE_overrideEnablementForJavaScriptCore\nis set to true.\n\nNo new tests since this is a debug-only env var override.\n\n* Source/bmalloc/libpas/src/libpas/pas_mte_config.c:\n(pas_mte_do_initialization):\n\nCanonical link: https://commits.webkit.org/317947@main", "email": "z_jiangli@apple.com", "hash": "05c83a6550b7871c577106d34e40b6777c4e3381", "subject": "[libpas] Fix MTE_overrideEnablementForJavaScriptCore=true incorrectly disabling MTE" }, "317948@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317948@main", "clUrl": "https://commits.webkit.org/317948@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320266\nrdar://183189781\n\nReviewed by Chris Dumez.\n\nregisterProcessor()'s parameterDescriptors validation errors (duplicate\nname, defaultValue out of [minValue, maxValue] range) interpolated the\nworklet processor's name into the message instead of the name of the\nAudioParamDescriptor that actually failed validation, making it\nimpossible to tell which param was at fault when a processor declares\nmultiple parameters.\n\nFix by using descriptor.name instead of name in the three\nException messages.\n\n* Source/WebCore/Modules/webaudio/AudioWorkletGlobalScope.cpp:\n(WebCore::AudioWorkletGlobalScope::registerProcessor):\n\nCanonical link: https://commits.webkit.org/317948@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "34520da7d0fa1404787d3060c7c0aa1d449ec335", "subject": "registerProcessor() error messages report the processor name instead of the offending AudioParam name" }, "317949@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317949@main", "clUrl": "https://commits.webkit.org/317949@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320275\nrdar://183193218\n\nReviewed by Chris Dumez.\n\nBaseAudioContext::createScriptProcessor(0, ...) picks a buffer size based on\nthe current AudioSession's buffer size:\n\n bufferSize = 1 \u003c\u003c std::max\u003csize_t\u003e(8, std::min\u003csize_t\u003e(14, std::log2(AudioSession::singleton().bufferSize())));\n\nOn Cocoa platforms AudioSession::bufferSize() can legitimately return 0 through\nordinary paths: AudioSessionMac::bufferSize() returns m_bufferSize.value_or(0)\nwhen the CoreAudio device property query fails (e.g. no default output device),\nand AudioSessionIOS::bufferSize() computes IOBufferDuration * sampleRate(),\nwhich is 0 before the audio session route is configured.\n\nPer [1]:\n\n \"If the argument is ±0, -∞ is returned and FE_DIVBYZERO is raised.\"\n\nPassing that -infinity to std::min\u003csize_t\u003e forces a float-to-size_t conversion\nof an out-of-range value, which is undefined behavior.\n\nGuard the zero case so std::log2 is never called with 0. When the session\nbuffer size is 0, the exponent falls through to the std::max\u003csize_t\u003e(8, ...)\nfloor, yielding 256 (2^8) — matching the spec's requirement that the chosen\nvalue be a power of 2 between 256 and 16384. Behavior for all non-zero inputs\nis unchanged.\n\n[1] https://en.cppreference.com/cpp/numeric/math/log2\n\n* Source/WebCore/Modules/webaudio/BaseAudioContext.cpp:\n(WebCore::BaseAudioContext::createScriptProcessor):\n\nCanonical link: https://commits.webkit.org/317949@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "1a7d999224fc00ad856f44e592bef7dab0cb726d", "subject": "std::log2(AudioSession::bufferSize()) invokes undefined behavior when the session buffer size is 0" }, "317950@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317950@main", "clUrl": "https://commits.webkit.org/317950@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320276\nrdar://183194302\n\nReviewed by Chris Dumez.\n\nOfflineAudioContext::increaseNoiseMultiplierIfNeeded() sets up noise injection\nby walking the node graph with a worklist seeded from referencedSourceNodes(),\nfollowing each node's outputs via AudioNodeOutput::forEachInputNode(). The walk\nkept no record of visited nodes, so it appended every reached node to the\nworklist unconditionally.\n\nWeb Audio permits cyclic (feedback) graphs, which are legal as long as a\nDelayNode breaks the loop. On such a graph the walk never terminates: it keeps\nre-appending the nodes in the cycle to the worklist, growing it without bound.\nBecause this runs under graphLock(), the result is a hung main thread and\nrunaway memory growth. Non-tree (diamond) topologies were also visited multiple\ntimes, double-counting a node's noise-injection multiplier.\n\nTrack visited nodes in a HashSet and only enqueue a node the first time it is\nreached. This guarantees termination on cyclic graphs and ensures each node\ncontributes its noise multiplier exactly once. Linear/tree graphs -- every\nrealistic audio-fingerprinting probe -- are unaffected.\n\n* Source/WebCore/Modules/webaudio/OfflineAudioContext.cpp:\n(WebCore::OfflineAudioContext::increaseNoiseMultiplierIfNeeded): Track visited\nnodes so the graph walk neither loops forever on feedback cycles nor\ndouble-counts a node reachable via multiple paths.\n* Tools/TestWebKitAPI/Resources/cocoa/audio-fingerprinting.js:\n(testFeedbackCycle): Added. Renders an OfflineAudioContext containing a\ngain -\u003e delay -\u003e gain feedback cycle and returns the rendered length.\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/AdvancedPrivacyProtections.mm:\n(TEST(AdvancedPrivacyProtections, WebAudioNoiseInjectionWithFeedbackCycle)):\nAdded. With advanced privacy protections enabled (so noise injection runs),\nverifies the cyclic graph renders to completion instead of hanging.\n\nCanonical link: https://commits.webkit.org/317950@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "bf7ca923e061f649fde26415651ebd2409729f5f", "subject": "OfflineAudioContext noise injection hangs on feedback cycles in the audio graph" }, "317951@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317951@main", "clUrl": "https://commits.webkit.org/317951@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320264\nrdar://183189398\n\nReviewed by Chris Dumez.\n\nm_desiredDelayFrames was left uninitialized by both DelayDSPKernel\nconstructors. processKRate() reads it directly when delayProcessor()\nis null, which is undefined behavior.\n\n* Source/WebCore/Modules/webaudio/DelayDSPKernel.h:\n\nCanonical link: https://commits.webkit.org/317951@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "66df0f0c6b9c93cbf5c11a37dda31dcbe7b005b2", "subject": "DelayDSPKernel::m_desiredDelayFrames is uninitialized, causing undefined behavior in processKRate() when no DelayProcessor is attached" }, "317952@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317952@main", "clUrl": "https://commits.webkit.org/317952@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320265\nrdar://183189670\n\nReviewed by Chris Dumez.\n\nm_type was only set in create(), so an exception-return path before\nthat assignment left it uninitialized (garbage). Give it a default\nmember initializer matching the default oscillator type.\n\n* Source/WebCore/Modules/webaudio/OscillatorNode.h:\n\nCanonical link: https://commits.webkit.org/317952@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "8728f4ed1f59186285fbd1cf5328d0cf2aeea467", "subject": "OscillatorNode::m_type has no default member initializer, leaving it uninitialized on exception-return path in create()" }, "317953@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317953@main", "clUrl": "https://commits.webkit.org/317953@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320277\nrdar://183194827\n\nReviewed by Chris Dumez.\n\nThis patch aligns WebKit with Gecko / Firefox.\n\nWhen an oscillator is started at a sub-sample-accurate time,\nOscillatorNode::process() advances the initial virtualReadIndex by the\nfractional start offset scaled by one phase increment, so the oscillator\nbegins at the correct sub-sample phase. That compensation was written as\n`startFrameOffset * frequency * rateScale`, but `frequency` is a local\nthat is only assigned in the k-rate (!hasSampleAccurateValues) branch.\nWhenever a-rate frequency or detune automation is active, `frequency`\nstays 0, so the compensation term is 0 and the oscillator starts on the\nframe boundary instead of at the requested sub-sample offset, i.e.\naudibly out of phase.\n\nUse the first sample-accurate phase increment (phaseIncrements[0]) for\nthe compensation when hasSampleAccurateValues is true, falling back to\nfrequency * rateScale for the k-rate case. For a constant frequency the\ntwo are identical, so this only changes behavior when automation is\nactive.\n\nThis matches the k-rate path, which already advances by\n`frequency * rateScale` per frame.\n\nTest: imported/w3c/web-platform-tests/webaudio/the-audio-api/the-oscillatornode-interface/sub-sample-start.html\n\n* LayoutTests/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-oscillatornode-interface/sub-sample-start-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-oscillatornode-interface/sub-sample-start.html: Added.\n* Source/WebCore/Modules/webaudio/OscillatorNode.cpp:\n(WebCore::OscillatorNode::process):\n\nCanonical link: https://commits.webkit.org/317953@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "27d3de8f8b2289fbcba9812b6eb37d16a3db96fd", "subject": "OscillatorNode with a-rate automation ignores sub-sample start time and begins out of phase" }, "317954@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317954@main", "clUrl": "https://commits.webkit.org/317954@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320278\nrdar://183195414\n\nReviewed by Chris Dumez.\n\ndoFFTAnalysisIfNecessary() constructed a fresh AudioFloatArray on each\ncall to unroll the input buffer into. AudioArray's constructor does an\naligned malloc followed by a full zero-fill, and every one of those bytes\nis then immediately overwritten by the unroll memcpy that follows, so the\nzero-fill was pure waste. At the default fftSize of 2048 that is an 8KB\nmalloc/memset/free per pass, and 128KB at the maximum fftSize of 32768.\n\nThis runs once per render quantum whenever frequency data is being read,\nso a typical requestAnimationFrame-driven visualizer hits it around 60\ntimes a second.\n\nHold the scratch buffer as a member instead, sized alongside\nm_magnitudeBuffer in setFftSize(), matching how the magnitude buffer is\nalready managed. The unroll writes every element it uses, so dropping the\nper-call zero-initialization is not observable.\n\nWhile here, change applyWindow() to derive its length from the span it is\ngiven rather than taking a separate count, so the two cannot disagree.\n\n* Source/WebCore/Modules/webaudio/RealtimeAnalyser.cpp:\n(WebCore::RealtimeAnalyser::setFftSize):\n(WebCore::RealtimeAnalyser::doFFTAnalysisIfNecessary):\n* Source/WebCore/Modules/webaudio/RealtimeAnalyser.h:\n\nCanonical link: https://commits.webkit.org/317954@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "71f03e43c748b03c7b9d9df377186009db45ccb2", "subject": "RealtimeAnalyser heap-allocates a temporary FFT buffer on every analysis pass" }, "317955@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317955@main", "clUrl": "https://commits.webkit.org/317955@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=270554\nrdar://124498013\n\nReviewed by Chris Dumez.\n\nprocessExponentialRamp() computed the per-sample multiplier with powf() and\nthen accumulated the ramp value in a float, so rounding error compounded once\nper frame across the whole rendering quantum. By the end of a 128-frame quantum\nthe drift reached ~49 ulp, losing about 5.6 of the 24 bits of precision.\n\nCompute the ratio and the per-sample multiplier in double precision and carry\nthe running value in a double, narrowing to float only when storing each\noutput sample. This keeps the worst-case error at 0.45 ulp over the quantum,\nmatching a per-sample std::pow() evaluation while retaining the cheap\nrecurrence relation.\n\nThis fixes moderate-exponentialRamp.html and changes the sampled values in\naudioparam-exponentialRampToValueAtTime.html, both rebaselined here.\n\nIt also requires regenerating the five Oscillator reference files, which\ndeserves explanation since binary rebaselines in a precision patch are easy to\nmistake for papering over a regression.\n\nThe Oscillator tests sweep osc.frequency from 10Hz to 24050Hz over 4 seconds\nand compare the rendered audio against checked-in WAVs. Those references were\ngenerated in 2020 (216569) by the very code corrected here. Because an\nAudioParam value feeding an oscillator is integrated into phase, the old\nerror was systematic rather than random -- powf() rounded the multiplier\nconsistently in one direction -- so it accumulated instead of averaging out,\nreaching ~0.022 cycles of phase drift by the end of the sweep. At the top of\nthe sweep that is a large sample-wise difference: SNR against the stale\nreferences falls from ~130 dB to ~31 dB. The references therefore encode the\nbug, and no correct fix can keep them.\n\nTo confirm the regenerated files are the more accurate ones rather than merely\ndifferent, each was measured against the closed-form exponential sweep instead\nof against the code that produced it. Over the region where the band-limited\nwavetable closely approximates an ideal sine, SNR against the analytic signal\nimproves from 68.00 dB to 107.75 dB (~97x less error), and the accumulated\nphase error at the final zero crossing drops from +0.00016 cycles to\n+0.00000.\n\nThe thresholds are left at their original strict values (129.72 dB SNR for\nsine), so these tests keep their full ability to catch oscillator regressions.\nNote that Chromium responded to the equivalent change by marking these tests\nas expected failures; regenerating instead preserves the coverage, at the cost\nof the references no longer matching upstream's if they are ever re-imported.\n\n* LayoutTests/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audioparam-interface/audioparam-exponentialRampToValueAtTime-expected.txt: Rebaselined\n* LayoutTests/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audioparam-interface/moderate-exponentialRamp-expected.txt: Progression\n* LayoutTests/webaudio/Oscillator/oscillator-custom-expected.wav: Regenerated\n* LayoutTests/webaudio/Oscillator/oscillator-sawtooth-expected.wav: Regenerated\n* LayoutTests/webaudio/Oscillator/oscillator-sine-expected.wav: Regenerated\n* LayoutTests/webaudio/Oscillator/oscillator-square-expected.wav: Regenerated\n* LayoutTests/webaudio/Oscillator/oscillator-triangle-expected.wav: Regenerated\n* Source/WebCore/Modules/webaudio/AudioParamTimeline.cpp:\n(WebCore::AudioParamTimeline::processExponentialRamp):\n\nCanonical link: https://commits.webkit.org/317955@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "768fd7d00d14925a1c1a756f6b7871d571e04338", "subject": "exponentialRampToValueAtTime() loses precision by accumulating the ramp in single precision" }, "317956@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317956@main", "clUrl": "https://commits.webkit.org/317956@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320309\nrdar://183245229\n\nReviewed by Chris Dumez.\n\nPer the Web Audio API, an AudioScheduledSourceNode is actively processing\n\"if and only if it is playing for at least part of the current rendering\nquantum\", and \"AudioNodes that are not actively processing output a single\nchannel of silence\" [1]. The number of channels of an AudioBufferSourceNode's\noutput therefore equals the number of channels of its buffer only while the\nnode is playing, and \"is one channel of silence if buffer is null\" [2].\n\nWe instead latched the output channel count in the buffer setter, from the\nbuffer alone, so it was wrong in three cases:\n\n- A node with a buffer that was never started kept the buffer's channel\n count, though it is not actively processing.\n- Setting buffer back to null left the previous count in place.\n- A playing node whose buffer is null kept the previous count.\n\nThe end-of-playback case already collapsed to a single channel, but only\nincidentally: finish() drops the context's reference to the node, which\ndisables its outputs, which removes them from\nAudioSummingJunction::maximumNumberOfChannels(). Nothing consulted playback\nstate, so the cases above were unaffected by that path.\n\nCompute the count from both the buffer and the playback state instead, in a\nnew updateOutputChannelCount(), and call it from the buffer setter and from\nstartPlaying() once the node is scheduled. Setting the buffer to null now\nalso clears the stale source and destination channel spans.\n\nstartPlaying() now takes the graph lock, since changing the output channel\ncount reconfigures the graph. It is acquired after the process lock, matching\nthe order used by process() and setBufferForBindings() to avoid deadlock.\n\nFirefox already behaves as specified in all of these cases; Chrome shares the\nold behavior.\n\n[1] https://webaudio.github.io/web-audio-api/#AudioNode-actively-processing\n[2] https://webaudio.github.io/web-audio-api/#AudioBufferSourceNode\n\nTest: imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audiobuffersourcenode-interface/audiobuffersource-output-channel-count.html\n\n* LayoutTests/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audiobuffersourcenode-interface/audiobuffersource-output-channel-count-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audiobuffersourcenode-interface/audiobuffersource-output-channel-count.html: Added.\n* Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp:\n(WebCore::AudioBufferSourceNode::setBufferForBindings):\n(WebCore::AudioBufferSourceNode::updateOutputChannelCount):\n(WebCore::AudioBufferSourceNode::startPlaying):\n* Source/WebCore/Modules/webaudio/AudioBufferSourceNode.h:\n\nCanonical link: https://commits.webkit.org/317956@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "d812eb91c045cbc32b619fecd38eac3b732a6d20", "subject": "AudioBufferSourceNode output channel count ignores actively-processing state" }, "317957@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317957@main", "clUrl": "https://commits.webkit.org/317957@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320274\nrdar://183191490\n\nReviewed by Chris Dumez.\n\nEvery other AudioNode connect/disconnect overload asserts isMainThread()\nbefore taking the graph lock. This overload did it in the opposite order,\nacquiring context().graphLock() first. Reorder to assert-then-lock to\nmatch the rest of the file.\n\n* Source/WebCore/Modules/webaudio/AudioNode.cpp:\n(WebCore::AudioNode::connect):\n\nCanonical link: https://commits.webkit.org/317957@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "c36c4605523902f42b38f1d9a99fe995c620d791", "subject": "AudioNode::connect(AudioParam\u0026, unsigned) acquires the graph lock before asserting main thread" }, "317958@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317958@main", "clUrl": "https://commits.webkit.org/317958@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320273\nrdar://183191369\n\nReviewed by Chris Dumez.\n\nm_sourceNumberOfChannels was assigned the same value twice in\nsetFormat(), once before configuring the resampler and once\nafter, with no use of the member in between. Removed the\nredundant second assignment.\n\n* Source/WebCore/Modules/webaudio/MediaStreamAudioSourceNode.cpp:\n(WebCore::MediaStreamAudioSourceNode::setFormat):\n\nCanonical link: https://commits.webkit.org/317958@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "05c611517b4bfb78981238f7311fb9c311137431", "subject": "MediaStreamAudioSourceNode::setFormat() sets m_sourceNumberOfChannels twice with no intervening use" }, "317959@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "317959@main", "clUrl": "https://commits.webkit.org/317959@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320299\n\nReviewed by Antti Koivisto.\n\nFlexLayoutState lived on RenderFlexibleBox and was engaged for all of layoutBlock, even though it\nonly describes how far the flex algorithm has got. That is why the scrollbar reconciliation relayout\nneeded m_inPostFlexUpdateScrollbarLayout: it runs after the algorithm is done but inside layoutBlock,\nso it still saw an engaged state sitting at whatever phase the algorithm finished in.\n\nMove the state to FlexLayout and scope it to FlexLayout::layout(), which is exactly the flex\nalgorithm's lifetime. Anything laying out flex content outside of that now sees no state at all and\ntakes the \"not in flex layout\" path on its own, so the flag and its FIXMEs go away.\n\nFlexFormattingContext takes the state and passes it to FlexIntegrationUtils, which can hold a plain\nFlexLayoutState\u0026 rather than an optional -- the formatting context only exists while the algorithm\nruns, so the state is always there.\n\nRenderFlexibleBox now reads the state through named queries on FlexLayout (isInLayout, layoutPhase,\nand the block-size definiteness trio) instead of an optional member. FlexLayoutState::Phase becomes a\nWebCore-scope LayoutPhase enum so those queries can hand it back without exposing the state class.\n\nNo change in behaviour.\n\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.cpp:\n(WebCore::FlexFormattingContext::FlexFormattingContext):\n(WebCore::FlexFormattingContext::computeFlexBaseAndHypotheticalMainSizes):\n(WebCore::FlexFormattingContext::computeFlexLines):\n(WebCore::FlexFormattingContext::computeMainSizeForFlexItems):\n(WebCore::FlexFormattingContext::layoutFlexItems):\n(WebCore::FlexFormattingContext::hypotheticalCrossSizeForFlexItems):\n(WebCore::FlexFormattingContext::handleMainAxisAlignment):\n(WebCore::FlexFormattingContext::computeCrossSizeForFlexItems):\n(WebCore::FlexFormattingContext::handleCrossAxisAlignmentForFlexItems):\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.h:\n* Source/WebCore/layout/formattingContexts/flex/FlexLayoutState.h:\n(WebCore::FlexLayoutState::phase const):\n(WebCore::FlexLayoutState::setPhase):\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.cpp:\n(WebCore::LayoutIntegration::FlexIntegrationUtils::FlexIntegrationUtils):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::flexLayoutState const):\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.h:\n* Source/WebCore/layout/integration/flex/LayoutIntegrationFlexLayout.cpp:\n(WebCore::LayoutIntegration::FlexLayout::layout):\n* Source/WebCore/layout/integration/flex/LayoutIntegrationFlexLayout.h:\n(WebCore::LayoutIntegration::FlexLayout::isInLayout const):\n(WebCore::LayoutIntegration::FlexLayout::layoutPhase const):\n(WebCore::LayoutIntegration::FlexLayout::isFlexBoxBlockSizeDefinite const):\n(WebCore::LayoutIntegration::FlexLayout::isFlexBoxBlockSizeIndefinite const):\n(WebCore::LayoutIntegration::FlexLayout::setFlexBoxBlockSizeIsDefinite):\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::layoutBlock):\n(WebCore::RenderFlexibleBox::canUseFlexItemForPercentageResolution):\n(WebCore::RenderFlexibleBox::isComputingFlexBaseSizes const):\n(WebCore::RenderFlexibleBox::isInCrossAxisStretchLayout const):\n(WebCore::RenderFlexibleBox::canResolvePercentAgainstContainerBlockSize):\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n(WebCore::RenderFlexibleBox::isComputingFlexBaseSizes const): Deleted.\n(WebCore::RenderFlexibleBox::isInCrossAxisStretchLayout const): Deleted.\n\nCanonical link: https://commits.webkit.org/317959@main", "email": "zalan@apple.com", "hash": "af61b9694bcbf9b2ff18c47bb99aeaf2e3d8b944", "subject": "N[cleanup] Have LayoutIntegration::FlexLayout own the per-layout flex state" }, "317960@main": { "author": "Ryosei Otaka", "avatar": "https://www.gravatar.com/avatar/f978923bcdbb9a06256164aa725f5df4?d=identicon\u0026s=64", "cl": "317960@main", "clUrl": "https://commits.webkit.org/317960@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320150\n\nReviewed by Yusuke Suzuki.\n\nSource\\JavaScriptCore\\wasm\\generateWasmOpsHeader.py\nrequires UTF-8 encoding, but in a Japanese environment\non Windows, CP932 is used by default.\nTherefore, there are characters that cannot be\ninterpreted, and an error occurs.\n\n\"—\" is not defined on CP932.\n\nNo new tests.\n\n* Source/JavaScriptCore/wasm/generateWasmOpsHeader.py:\n\nCanonical link: https://commits.webkit.org/317960@main", "email": "ryosei.otaka@sony.com", "hash": "244cd98f79863e405e0094b78d13c20817e3cfea", "subject": "generateWasmOpsHeader.py makes an error without UTF-8 environments" }, "317961@main": { "author": "Sammy Gill", "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64", "cl": "317961@main", "clUrl": "https://commits.webkit.org/317961@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320233\nrdar://problem/183166106\n\nReviewed by Cole Carley.\n\nDuring the TrackSizingAlgorithm we use a HashSet\u003csize_t\u003e to keep track\nof whether certain tracks are classified as inflexible. However, since\nthe first track can get into this state, we can end up crashing when the\nHashTable attempts to validate its key since the value is 0.\n\nWe can fix this simply by replacing the HashSet with a BitVector which\nis probably a better match for a data structure that we want to use in\nthis way.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/layout-algorithm/flexible-column-track-intrinsic-sizing-001-crash.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/layout-algorithm/flexible-column-track-intrinsic-sizing-002-crash.html: Added.\nThese tests actually do not crash on trunk because the commit that was\ncausing the crashes was reverted in 317889@main but will serve as\nregression tests when we want to enable GFC for the same content again.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/layout-algorithm/flexible-column-track-intrinsic-sizing-003-crash.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/layout-algorithm/flexible-column-track-intrinsic-sizing-004-crash.html: Added.\nThese tests, however, do actually crash without our patch so we get a\nlittle bit of extra coverage.\n\nCanonical link: https://commits.webkit.org/317961@main", "email": "sammy.gill@apple.com", "hash": "17ba5b9756932d0f55821fc832ca00549275a19a", "subject": "[GFC] Crash when certain tracks get marked as inflexible" }, "317962@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317962@main", "clUrl": "https://commits.webkit.org/317962@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320228\nrdar://183163523\n\nReviewed by Chris Dumez.\n\nThis patch aligns WebKit with Blink / Chromium.\n\ncollectElementsToRemoveFromFragment() recurses into a stray \u003chtml\u003e\nelement to find any nested \u003chead\u003e/\u003cbody\u003e elements that also need to\nbe stripped, but discarded the recursive call's return value, so\nthose nested elements were never added to the removal list and\nsurvived fragment sanitization.\n\nFold the recursive result into the outer list instead of discarding it.\n\nTest: imported/w3c/web-platform-tests/domparsing/createContextualFragment-xhtml.xhtml\n\n* LayoutTests/imported/w3c/web-platform-tests/domparsing/createContextualFragment-xhtml-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/domparsing/createContextualFragment-xhtml.xhtml: Added.\n* Source/WebCore/editing/markup.cpp:\n(WebCore::collectElementsToRemoveFromFragment):\n\nCanonical link: https://commits.webkit.org/317962@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "a2af12e3970773ee05a85ed0ffa09939df2510b7", "subject": "createContextualFragment() leaves nested \u003chead\u003e/\u003cbody\u003e behind when stripping a stray \u003chtml\u003e element" }, "317963@main": { "author": "Karl Dubost", "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64", "cl": "317963@main", "clUrl": "https://commits.webkit.org/317963@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318324\nrdar://181108927\n\nReviewed by Taher Ali.\n\nSVG 2 says a negative value for 'r', 'rx', or 'ry' is invalid and must be\nignored, e.g. https://w3c.github.io/svgwg/svg2-draft/geometry.html#R. Before\nthis change, getComputedStyle() correctly fell back to the initial value, but\nSVGAnimatedLength.baseVal.value leaked the raw negative number through:\n\n \u003csvg xmlns=\"http://www.w3.org/2000/svg\"\u003e\n \u003ccircle id=\"c\" r=\"5\"/\u003e\n \u003c/svg\u003e\n \u003cscript\u003e\n c.setAttribute(\"r\", \"-10\");\n getComputedStyle(c).r; // \"0px\" (correct)\n c.r.baseVal.value; // -10 (wrong; now 0)\n \u003c/script\u003e\n\nThe bug was in SVGLengthValue::construct(): when a negative value is\nforbidden, it only reset the parsed length to a fallback value if the call\nsite explicitly passed one (via the `fallbackValue` parameter). Most call\nsites don't pass one, so the negative value survived into baseVal.\n\nThe same shape of bug also affects width/height on \u003crect\u003e, \u003cimage\u003e,\n\u003cpattern\u003e, and \u003cuse\u003e, and textLength on \u003ctext\u003e, which all pass\n`SVGLengthNegativeValuesMode::Forbid` without a fallback. A cross-engine\nprobe confirmed a single fix in SVGLengthValue::construct() is correct\nfor all of them, rather than only patching the three call sites named\nin this bug.\n\nAdded ellipse rx/ry coverage to the existing WPT attribute-syntax tests,\nwhich previously only covered rect for those two attributes.\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/cx-attribute-invalid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/cx-attribute-invalid.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/cx-attribute-valid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/cx-attribute-valid.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/cy-attribute-invalid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/cy-attribute-invalid.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/cy-attribute-valid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/cy-attribute-valid.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/ellipse-rx-attribute-invalid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/ellipse-rx-attribute-invalid.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/ellipse-rx-attribute-valid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/ellipse-rx-attribute-valid.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/ellipse-ry-attribute-invalid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/ellipse-ry-attribute-invalid.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/ellipse-ry-attribute-valid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/ellipse-ry-attribute-valid.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/height-attribute-invalid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/height-attribute-invalid.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/height-attribute-valid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/height-attribute-valid.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/r-attribute-invalid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/r-attribute-invalid.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/r-attribute-valid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/r-attribute-valid.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/rx-attribute-invalid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/rx-attribute-invalid.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/rx-attribute-valid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/rx-attribute-valid.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/ry-attribute-invalid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/ry-attribute-invalid.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/ry-attribute-valid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/ry-attribute-valid.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/support/attribute-testcommon.js: Added.\n(test_valid_attribute_value):\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/width-attribute-invalid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/width-attribute-invalid.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/width-attribute-valid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/width-attribute-valid.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/x-attribute-invalid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/x-attribute-invalid.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/x-attribute-valid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/x-attribute-valid.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/y-attribute-invalid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/y-attribute-invalid.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/y-attribute-valid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/parsing/y-attribute-valid.svg: Added.\n* LayoutTests/svg/hixie/error/007-expected.txt\n* Source/WebCore/svg/SVGLengthValue.cpp:\n(WebCore::SVGLengthValue::construct):\n\nCanonical link: https://commits.webkit.org/317963@main", "email": "karlcow@apple.com", "hash": "81156f087d4a7f806965e361402a8d55cc6f64ac", "subject": "SVGLength.value returns raw negative numbers for r/rx/ry/width/height/textLength after setAttribute, disagreeing with getComputedStyle()" }, "317964@main": { "author": "Youenn Fablet", "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64", "cl": "317964@main", "clUrl": "https://commits.webkit.org/317964@main", "description": "rdar://183108477\nhttps://bugs.webkit.org/show_bug.cgi?id=320171\n\nReviewed by Alex Christensen.\n\nWhen a fetch handler reads event.request.body, the request may carry a pending upload stream that only exists on the initiating WebProcess.\nWe wire the service worker WebProcess to pull the body from the network process on demand.\n\nOn the SW WebProcess side, WebSWContextManagerConnection::startFetch attaches a fresh PendingStreamState to the request body when it carries a pending stream identifier, tagged with the FetchIdentifier.\nWhen the SW reads the request body, FormDataConsumer routes the PendingStreamData element to consumePendingStream.\nThis installs a data-available handler and asks the network process (via SWContextManager::Connection::startPendingStreamUploadForwarding) to start forwarding.\n\nOn the network process side, WebSWServerToContextConnection looks up the corresponding NetworkResourceLoader's PendingStreamState.\nIt keeps it alive in its own FetchIdentifier-keyed map, and installs a handler that drains chunks over IPC.\n\nFormDataConsumer::cancel notifies the network process via cancelPendingStreamUploadForwarding so the NP-side handler tears down and the map entry is removed if the SW gives up before EOF.\n\nCovered by existing tests.\n\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-event.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-event.https.h2-expected.txt:\n* Source/WebCore/Modules/fetch/FetchResponse.h:\n* Source/WebCore/Modules/fetch/FormDataConsumer.cpp:\n(WebCore::FormDataConsumer::FormDataConsumer):\n(WebCore::FormDataConsumer::~FormDataConsumer):\n(WebCore::FormDataConsumer::read):\n(WebCore::FormDataConsumer::consumePendingStream):\n(WebCore::FormDataConsumer::drainPendingStream):\n(WebCore::FormDataConsumer::cancel):\n* Source/WebCore/Modules/fetch/FormDataConsumer.h:\n(WebCore::FormDataConsumer::hasPendingActivity const):\n* Source/WebCore/platform/network/PendingStreamState.cpp:\n(WebCore::PendingStreamState::setDataAvailableHandler):\n* Source/WebCore/platform/network/PendingStreamState.h:\n(WebCore::PendingStreamState::setServiceWorkerFetchIdentifier):\n(WebCore::PendingStreamState::serviceWorkerFetchIdentifier const):\n* Source/WebCore/workers/service/context/SWContextManager.h:\n* Source/WebCore/workers/service/context/ServiceWorkerFetch.cpp:\n(WebCore::ServiceWorkerFetch::dispatchFetchEvent):\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.h:\n* Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerFetchTask.cpp:\n(WebKit::ServiceWorkerFetchTask::loader const):\n* Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerFetchTask.h:\n* Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerToContextConnection.cpp:\n(WebKit::WebSWServerToContextConnection::startPendingStreamUploadForwarding):\n(WebKit::WebSWServerToContextConnection::pendingStreamDataAvailable):\n(WebKit::WebSWServerToContextConnection::cancelPendingStreamUploadForwarding):\n* Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerToContextConnection.h:\n* Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerToContextConnection.messages.in:\n* Source/WebKit/Scripts/webkit/opaque_ipc_types.tracking.in:\n* Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.cpp:\n(WebKit::WebSWContextManagerConnection::startFetch):\n(WebKit::WebSWContextManagerConnection::startPendingStreamUploadForwarding):\n(WebKit::WebSWContextManagerConnection::cancelPendingStreamUploadForwarding):\n(WebKit::WebSWContextManagerConnection::forwardPendingStreamUploadData):\n(WebKit::WebSWContextManagerConnection::forwardPendingStreamUploadEnd):\n(WebKit::WebSWContextManagerConnection::forwardPendingStreamUploadError):\n* Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.h:\n* Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.messages.in:\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-event.https.h2-expected.txt:\n\nCanonical link: https://commits.webkit.org/317964@main", "email": "youenn@apple.com", "hash": "e4afe2dda27977d441e69736fd7b6d356ef41fb4", "subject": "Service workers should be able to get stream upload data" }, "317965@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "317965@main", "clUrl": "https://commits.webkit.org/317965@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320077\n\nReviewed by Youenn Fablet.\n\nThe device-ID hash salt is built by concatenating the hex representation of\n`randomDataSize` (hashSaltSize / 16 = 3) random uint64_t values, expecting\n3 * 16 = 48 hex characters to match hashSaltSize. However, hex(number) defaults\nto minimumDigits = 0, so it emits only the significant hex digits: a value such\nas 0x00000000000000AB produces \"AB\" rather than a zero-padded 16 characters. A\n64-bit value yields 16 digits only when its top nibble is non-zero, so all three\nvalues produce a 48-character salt only ~82% of the time. The remaining ~18% of\ngenerated salts are shorter than 48 characters.\n\nBecause the salt is also used as the on-disk filename, loadStorageFromDisk()\nrejects any file whose salt length != hashSaltSize on the next launch, silently\ndiscarding and regenerating the per-origin salt and defeating its cross-launch\npersistence.\n\nPad each value to a fixed 16 hex digits with `hex(number, 16)` so the salt is\nalways exactly 48 characters and survives the reload length check. Existing\n48-character salts on disk continue to load unchanged.\n\n* Source/WebKit/UIProcess/DeviceIdHashSaltStorage.cpp:\n(WebKit::DeviceIdHashSaltStorage::completeDeviceIdHashSaltForOriginCall):\n* Source/WebKit/UIProcess/DeviceIdHashSaltStorage.h:\n(WebKit::createDeviceIdHashSaltString):\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebKit/DeviceIdHashSaltStorage.cpp: Added.\n(TestWebKitAPI::TEST(DeviceIdHashSaltStorage, GeneratedSaltHasExpectedLength)):\n(TestWebKitAPI::TEST(DeviceIdHashSaltStorage, SaltStringHasFixedWidth)):\n* Source/WebKit/Scripts/IPCTestingHeaders-input.xcfilelist:\n* Source/WebKit/Scripts/IPCTestingHeaders-output.xcfilelist:\n\nCanonical link: https://commits.webkit.org/317965@main", "email": "cdumez@apple.com", "hash": "e25c1eebf37b2ecd34e67bf4606c33f7bd1d3769", "subject": "DeviceIdHashSaltStorage generates hash salts shorter than the validated length" }, "317966@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317966@main", "clUrl": "https://commits.webkit.org/317966@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320192\nrdar://183139946\n\nReviewed by Chris Dumez.\n\nEditor::Command::execute() calls updateLayoutIgnorePendingStylesheets(),\nwhich can run arbitrary script and detach or reparent m_document. The\ncode was meant to guard against this by comparing the frame before and\nafter the layout call, bailing out if it changed.\n\nHowever, Command::frame() is just a live forwarding accessor for\nm_document-\u003eframe(). execute() called it once after the layout call\nand compared it against another read of m_document-\u003eframe() taken\nimmediately after, with nothing in between able to change the result.\nThe check was `X != X`, which can never be true, so the guard never\nfired.\n\nThis regressed in 289096@main, which removed the m_frame member\ncaptured at Command construction time and replaced it with\nCommand::frame(), collapsing both sides of the comparison into\nback-to-back reads of the same live value.\n\nFix this by capturing the frame before calling\nupdateLayoutIgnorePendingStylesheets(), so the comparison actually\nreflects state before vs. after the potentially script-running call.\n\nNo new tests: the restored guard is only observably different from the\ncurrent code when the document's frame changes from one live frame to a\ndifferent live frame across the layout call. Document::observeFrame() is\nthe only mutator of that value, and it only ever goes frame \u003c-\u003e null\n(attachToCachedFrame/detachFromCachedFrame/detachFromFrame), never frame\nA -\u003e frame B. A null starting frame cannot reach the layout call at all,\nsince both Command::isEnabled() and Command::allowExecutionWhenDisabled()\nreturn false without a frame. That leaves frame -\u003e null as the only\nreachable change, and the following `if (!frame)` check already returned\nfalse for it. The fix restores the guard's intent rather than changing\nbehavior for any reachable state.\n\n* Source/WebCore/editing/EditorCommand.cpp:\n(WebCore::Editor::Command::execute const):\n\nCanonical link: https://commits.webkit.org/317966@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "e7237c0f884c4215715f8dd9901155d986525ea8", "subject": "Editor::Command::execute() re-entrancy check is a permanent tautology, no longer detects frame changes during layout" }, "317967@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317967@main", "clUrl": "https://commits.webkit.org/317967@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318425\nrdar://181206139\n\nReviewed by Devin Rousso.\n\ngetResources() maps each CachedResource to a previously-assigned string\nidentifier. m_resources is a forward map (identifier -\u003e CachedResource),\nso the reverse lookup (\"do I already have this resource, and what is its\nid?\") was done by linearly scanning the entire map for every resource\nreturned by cachedResourcesForFrame(). That is O(n) per resource, or\nO(n²) per call. Because m_resources is never pruned, it accumulates every\nresource seen across all getResources() calls for the object's lifetime,\nso the scan grows unboundedly across repeated audit calls.\n\nAdd a reverse map m_resourceIdentifiers (CachedResource -\u003e identifier)\nkept in sync on insertion, turning the reverse lookup into O(1). Because\nCachedResource is RefCountedAndCanMakeWeakPtr, this uses a WeakHashMap\nrather than a raw-pointer key, matching how ResourceTimingInformation\nkeys CachedResource and satisfying the SaferCPP prohibition on raw\npointer map keys.\n\nWhile here, change the forward map to hold WeakPtr\u003cCachedResource\u003e\ninstead of a raw CachedResource*. Clients are non-owning and\n~CachedResource neither asserts on nor notifies outstanding clients, so a\nresource could be destroyed while this (never-pruned) map still held a\nraw pointer to it, leaving the destructor's removeClient() and\ngetResourceContent()'s lookup as latent use-after-frees. Weak pointers\nmake both sites null-check safely and, as a bonus, prevent a reused\naddress from ever false-matching a stale entry. Identifier numbering is\nunchanged: dead entries remain in the map as null weak pointers, so\nsize()-based ids stay unique.\n\n* Source/WebCore/inspector/InspectorAuditResourcesObject.cpp:\n(WebCore::InspectorAuditResourcesObject::~InspectorAuditResourcesObject):\n(WebCore::InspectorAuditResourcesObject::getResources):\n(WebCore::InspectorAuditResourcesObject::getResourceContent):\n* Source/WebCore/inspector/InspectorAuditResourcesObject.h:\n\nCanonical link: https://commits.webkit.org/317967@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "5f7ab40afc2d8c7dd20253955edbe834a91db32e", "subject": "[Web Inspector] InspectorAuditResourcesObject::getResources() is O(n²) due to linear reverse lookup" }, "317968@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "317968@main", "clUrl": "https://commits.webkit.org/317968@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320149\n\nReviewed by Jean-Yves Avenard.\n\nRemoteAudioDestination::render() only writes into the output buffer when\nConsumerSharedCARingBuffer::fetchIfHasEnoughData() succeeds. On underrun\n(common at stream start or under load) it left ioData untouched, so the\naudio unit played whatever stale samples happened to be in the buffer\ninstead of silence, producing an audible glitch and leaking prior audio\ncontent. The sibling WebRTC path\n(RemoteAudioMediaStreamTrackRendererInternalUnitManager) already zero-fills\nits buffer on underrun; this path did not.\n\nFill the output buffer on the underrun path rather than leaving it stale.\nInstead of an abrupt cutoff to zero (which clicks when the last rendered\nsample was non-zero), remember the last rendered sample per channel on\neach successful render and, on the first underrun, linearly ramp from that\nvalue down to zero to declick before going fully silent. Subsequent\nconsecutive underruns output pure silence.\n\n* Source/WebKit/GPUProcess/media/RemoteAudioDestinationManager.cpp:\n\nCanonical link: https://commits.webkit.org/317968@main", "email": "cdumez@apple.com", "hash": "c315a716758008c2e11d996fe2e663db6097d114", "subject": "RemoteAudioDestination plays stale buffer contents instead of silence on ring buffer underrun" }, "317969@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "317969@main", "clUrl": "https://commits.webkit.org/317969@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320167\n\nReviewed by Jean-Yves Avenard.\n\nThe completion handler passed to requestSystemValidation() captures only a\nWeakPtr to the manager and, on the denial (!isOK) path, dereferenced the\nm_currentUserMediaRequest member directly. On Cocoa, that callback is invoked\nasynchronously once the system capture-access (TCC) prompt resolves. While the\nprompt is pending, m_currentUserMediaRequest can be cleared by\ninvalidatePendingRequests() (reachable from stopCapture() / clearCachedState(),\ne.g. on navigation or capture stop). When the prompt then returns a denial, the\nhandler dereferenced a null RefPtr and crashed.\n\nAdd a null check on m_currentUserMediaRequest before use, mirroring the sibling\ndecidePolicyForUserMediaPermissionRequest() method that the isOK path calls.\nBoth callback paths now no-op cleanly when there is no current request.\n\nThis is difficult to cover with an automated test: the only path that is both\nasynchronous and can report denial goes through the real system TCC prompt,\nwhereas automated media tests use mock capture devices, which resolve\nrequestSystemValidation() synchronously with success and never reach this\nbranch.\n\n* Source/WebKit/UIProcess/UserMediaPermissionRequestManagerProxy.cpp:\n(WebKit::UserMediaPermissionRequestManagerProxy::processUserMediaPermissionValidRequest):\n\nCanonical link: https://commits.webkit.org/317969@main", "email": "cdumez@apple.com", "hash": "7815063976b2892c650e6f974e9d5c30e6131839", "subject": "Null-check m_currentUserMediaRequest before denying in requestSystemValidation callback" }, "317970@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "317970@main", "clUrl": "https://commits.webkit.org/317970@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320147\n\nReviewed by Jean-Yves Avenard.\n\nRemoteLegacyCDMSessionProxy::generateKeyRequest() calls into the CDM's\ngenerateKeyRequest(), which fills the destinationURL out-parameter with\nthe real key-request destination. However, a leftover test string\n(\"this is a test string\") unconditionally overwrote destinationURL\nbefore it was passed back to the WebProcess via the completion handler.\nThis debug scaffolding has been present since the original 2020\nimplementation (221729@main). Remove it so the real destination URL\nis returned.\n\n* Source/WebKit/GPUProcess/media/RemoteLegacyCDMSessionProxy.cpp:\n(WebKit::RemoteLegacyCDMSessionProxy::generateKeyRequest): Remove the\nleftover test-string assignment that clobbered the destinationURL\nout-parameter.\n\nCanonical link: https://commits.webkit.org/317970@main", "email": "cdumez@apple.com", "hash": "116a737926d32533ac298d89e646e405e7883f00", "subject": "Legacy EME generateKeyRequest returns a bogus destination URL due to leftover debug scaffolding" }, "317971@main": { "author": "Philippe Normand", "avatar": "https://www.gravatar.com/avatar/eef27203750af3510263cc29af21a16e?d=identicon\u0026s=64", "cl": "317971@main", "clUrl": "https://commits.webkit.org/317971@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320170\n\nReviewed by Xabier Rodriguez-Calvar.\n\n* Source/WebCore/platform/graphics/gstreamer/mse/AppendPipeline.cpp:\n(WebCore::AppendPipeline::parseDemuxerSrcPadCaps): Refactor an else clause.\n(WebCore::AppendPipeline::appsinkNewSample): Pass the moved media sample reference to\ndidReceiveSample.\n(WebCore::createOptionalParserForFormat): Add string operator for comparison with mediaType CStringView.\n(WebCore::createOptionalEncoderForFormat): Ditto.\n\nCanonical link: https://commits.webkit.org/317971@main", "email": "philn@igalia.com", "hash": "34b6ff507c2824538a48a31f86345f272ba85f47", "subject": "[GStreamer][MSE] Minor fixes for AppendPipeline" }, "317972@main": { "author": "Pawel Lampe", "avatar": "https://www.gravatar.com/avatar/3c9bf19417c230eff7ade252118deb7a?d=identicon\u0026s=64", "cl": "317972@main", "clUrl": "https://commits.webkit.org/317972@main", "description": "Canonical link: https://commits.webkit.org/317972@main", "email": "plampe@igalia.com", "hash": "0f106444cece6b748136a3d7e2057b2cf46adf4e", "subject": "Unreviewed tests gardening of 2026-07-27." }, "317973@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "317973@main", "clUrl": "https://commits.webkit.org/317973@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320300\n\nReviewed by Antti Koivisto.\n\nupdateFlexContainerLogicalHeight resolves the flex container's logical height from the extent the\nflex algorithm produced, and hands back the used cross and block extents the formatting context then\nworks from. It is flex-algorithm work, but it lived on RenderFlexibleBox with FlexIntegrationUtils\nforwarding to it. Its body is all container getters and setters, which is what the integration is\nfor, so move it there and drop the RenderFlexibleBox member.\n\nThe other caller was FlexLayout::layout, which special-cased an empty flex item list by resolving the\ncontainer height and returning before it built the formatting context. Since FlexIntegrationUtils is\nnow owned by the formatting context (320298), that call would have had to construct one just to reach\na single method. Let FlexFormattingContext::layout take the empty list instead and return an empty\nresult: an empty container still resolves its own height, so that is the flex algorithm's job, not\nsomething the integration should reach around it to do. The result's members all default to what the\nearly return used to leave in place, so the caller's assignments are no-ops on that path.\n\nNo change in behaviour.\n\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.cpp:\n(WebCore::FlexFormattingContext::layout):\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.cpp:\n(WebCore::LayoutIntegration::FlexIntegrationUtils::updateFlexContainerLogicalHeight):\n* Source/WebCore/layout/integration/flex/LayoutIntegrationFlexLayout.cpp:\n(WebCore::LayoutIntegration::FlexLayout::layout):\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::updateFlexContainerLogicalHeight): Deleted.\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n\nCanonical link: https://commits.webkit.org/317973@main", "email": "zalan@apple.com", "hash": "278596afd8a4f7c56357053ea0bc7f6ddccb3203", "subject": "[cleanup] Move updateFlexContainerLogicalHeight to FlexIntegrationUtils" }, "317974@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "317974@main", "clUrl": "https://commits.webkit.org/317974@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320317\n\nReviewed by Antti Koivisto.\n\nRenderFlexibleBox held two pieces of per-layout flex state: the ordered flex item list and the\nmargin-trim item sets. Both are produced and consumed by the flex algorithm -- the setters for the\nmargin-trim sets were already only called from FlexIntegrationUtils, and the item list only exists\nbetween prepareFlexItemsAndMargins and the post-layout queries -- so move both to FlexLayout, and\nwith them the functions that walk them.\n\nFolding prepareFlexItemsAndMargins into layout() while there: it builds the item list, which is now\nFlexLayout's own member, and the only reason it was a separate step was that layoutBlock had to\nsnapshot the items' rects between building the list and running the algorithm. The snapshot and the\nrepaint it feeds stay on RenderFlexibleBox: repainting is the renderer's job and it has to be\nsequenced against the scrollbar reconciliation, which can move the items after the flex algorithm is\ndone. Both walk the in-flow children directly, since the item list is built inside layout() now --\nthe same shape RenderDeprecatedFlexibleBox uses, where the snapshot and the repaint each re-walk the\nchildren.\n\nRenderBlock overrides have to stay on the renderer, so paintChildren, hitTestChildren,\nallowedLayoutOverflow and isChildEligibleForMarginTrim become one-line forwarders, the same shape\nRenderBlockFlow::hitTestInlineChildren already has for the inline formatting context.\nallowedLayoutOverflow keeps the RenderBox::allowedLayoutOverflow() call, which only the derived\nclass can make, and passes the result to FlexLayout to widen; the two content-alignment overflow\nvalues it reads move along with it.\n\nThis needs RenderBlock::paintChild to be public: FlexLayout::paint walks the item list itself and\npaints each item through it, the way LineLayout::hitTest calls the public per-child entry points\nrather than reusing the container's child-iteration helpers.\n\nAlso move the container queries that were thin proxies to FlexFormattingUtils. willStretchItem and\nhasStretchedFlexItemWithAspectRatio move their bodies there; isMultiline and isHorizontalFlow are\ndeleted outright, with their handful of callers in RenderBlock, RenderBlockFlow and RenderBox\ncalling the utils directly (RenderFlexibleBox itself already did). hasStretchedFlexItemWithAspectRatio\nkeeps walking the children rather than the collected item list: it runs from layout invalidation,\nbefore the container has necessarily laid out.\n\nFinally, resetAutoMarginsAndLogicalTopInCrossAxis, dirtyPercentHeightDescendantsWithinFlexItem and\nflexItemHasPercentHeightDescendants had FlexIntegrationUtils as their only caller and mutate or\nquery flex items, so they move there.\n\nNo change in behaviour.\n\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingUtils.cpp:\n(WebCore::FlexFormattingUtils::willStretchFlexItem):\n(WebCore::FlexFormattingUtils::hasStretchedFlexItemWithAspectRatio):\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingUtils.h:\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.cpp:\n(WebCore::LayoutIntegration::FlexIntegrationUtils::resetAutoMarginsAndLogicalTopInCrossAxis):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::dirtyPercentHeightDescendantsWithinFlexItem):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::flexItemHasPercentHeightDescendants):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::addItemAtFlexLineStart):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::addItemAtFlexLineEnd):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::addItemOnFirstFlexLine):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::addItemOnLastFlexLine):\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.h:\n* Source/WebCore/layout/integration/flex/LayoutIntegrationFlexLayout.cpp:\n(WebCore::LayoutIntegration::FlexLayout::initializeMarginTrimState):\n(WebCore::LayoutIntegration::FlexLayout::isFlexItemEligibleForMarginTrim):\n(WebCore::LayoutIntegration::FlexLayout::prepareFlexItemsAndMargins):\n(WebCore::LayoutIntegration::FlexLayout::adjustAllowedLayoutOverflow):\n(WebCore::LayoutIntegration::FlexLayout::paint):\n(WebCore::LayoutIntegration::FlexLayout::hitTest):\n(WebCore::LayoutIntegration::FlexLayout::collectFlexItems):\n(WebCore::LayoutIntegration::FlexLayout::layout):\n* Source/WebCore/layout/integration/flex/LayoutIntegrationFlexLayout.h:\n* Source/WebCore/rendering/RenderBlock.cpp:\n* Source/WebCore/rendering/RenderBlock.h:\n* Source/WebCore/rendering/RenderBlockFlow.cpp:\n* Source/WebCore/rendering/RenderBox.cpp:\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::layoutBlock):\n(WebCore::RenderFlexibleBox::hitTestChildren):\n(WebCore::RenderFlexibleBox::paintChildren):\n(WebCore::RenderFlexibleBox::willStretchItem):\n(WebCore::RenderFlexibleBox::flexItemBorderBoxRects):\n(WebCore::RenderFlexibleBox::repaintFlexItemsDuringLayoutIfMoved):\n(WebCore::RenderFlexibleBox::allowedLayoutOverflow):\n(WebCore::RenderFlexibleBox::isChildEligibleForMarginTrim):\n(WebCore::RenderFlexibleBox::hasStretchedFlexItemWithAspectRatio): Deleted.\n(WebCore::RenderFlexibleBox::isHorizontalFlow): Deleted.\n(WebCore::RenderFlexibleBox::isMultiline): Deleted.\n(WebCore::RenderFlexibleBox::initializeMarginTrimState): Deleted.\n(WebCore::RenderFlexibleBox::prepareFlexItemsAndMargins): Deleted.\n(WebCore::RenderFlexibleBox::appendFlexItemBorderBoxRects): Deleted.\n(WebCore::RenderFlexibleBox::resetAutoMarginsAndLogicalTopInCrossAxis): Deleted.\n(WebCore::RenderFlexibleBox::dirtyPercentHeightDescendantsWithinFlexItem): Deleted.\n(WebCore::RenderFlexibleBox::flexItemHasPercentHeightDescendants): Deleted.\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n\nCanonical link: https://commits.webkit.org/317974@main", "email": "zalan@apple.com", "hash": "2178fce816b64e41bc8b3127e91febb928d46b9e", "subject": "[cleanup] Move flex item list, painting, hit-testing and margin trimming off RenderFlexibleBox" }, "317975@main": { "author": "Cornelius Emase", "avatar": "https://www.gravatar.com/avatar/1e93f1ca8f713bf27c4e32122059264f?d=identicon\u0026s=64", "cl": "317975@main", "clUrl": "https://commits.webkit.org/317975@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319409\n\nReviewed by Adrian Perez de Castro.\n\nUpdate the imported Trusted Types web-platform-tests for the Dynamic\nCode Brand Checks proposal and regenerate the corresponding expected\nresults.\n\nNo functional engine changes. I'm doing a follow up implmentation fix\nfor the Dynamic Code Brand Checks proposal in JSC that will make the\nnew Function constructor not call toString on code-like objects, so\nthe tests for that behavior are being updated here.\n\n* LayoutTests/imported/w3c/web-platform-tests/trusted-types/eval-function-constructor-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/trusted-types/eval-function-constructor-untrusted-arguments-and-applying-default-policy-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/trusted-types/eval-function-constructor-untrusted-arguments-and-applying-default-policy.html:\n* LayoutTests/imported/w3c/web-platform-tests/trusted-types/eval-function-constructor.html:\n\nCanonical link: https://commits.webkit.org/317975@main", "email": "corneliuslochipi@gmail.com", "hash": "970134c173209618a7bc15c93ba8543e02632849", "subject": "LayoutTests: Update Dynamic Code Brand Checks WPT tests" }, "317976@main": { "author": "Sammy Gill", "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64", "cl": "317976@main", "clUrl": "https://commits.webkit.org/317976@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320000\nrdar://183290856\n\nReviewed by Zak Ridouh.\n\nWe initially enabled this content to run through GFC in 317783@main.\nThis ended up exposing a crash in a certain part of the track sizing\ncode related to key validation in the HashSet\u003csize_t\u003e we were using so\nwe ended up reverting it. Now that we have fixed this in 317961@main\nwe can enable this content again.\n\nCanonical link: https://commits.webkit.org/317976@main", "email": "sammy.gill@apple.com", "hash": "b7fca846835088379d84671457cb10c7f13ab0c1", "subject": "[GFC][Attempt 2] Relax alignment checks a bit." }, "317977@main": { "author": "Eric Carlson", "avatar": "https://www.gravatar.com/avatar/e227ff07cc6d645fc1c69fd56c2c8cb8?d=identicon\u0026s=64", "cl": "317977@main", "clUrl": "https://commits.webkit.org/317977@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320247\nrdar://183175861\n\nReviewed by Jean-Yves Avenard.\n\nMediaSessionManagerCocoa notifies the active NowPlaying session changing by looking up a\nWebCore::Page via Page::fromPageIdentifier() and calling hasActiveNowPlayingSessionChanged()\non it. That does not work for the UI-process RemoteMediaSessionManagerProxy, which has no\nWebCore::Page and aggregates media sessions from many web processes; when that class was\nmade a singleton in 317396@main the dependency was side-stepped by making the\nPageIdentifier optional, with a note that a better abstraction was needed in a follow-up\nto use a client of some sort.\n\nThis adds that abstraction. MediaSessionManagerClient is a small interface for the\nenvironment-coupled NowPlaying notification. MediaSessionManagerInterface owns one,\ndefaulting to PageMediaSessionManagerClient, which reproduces the existing behavior\n(resolve the PageIdentifier to a WebCore::Page and forward the call), so there is no\nbehavior change. A follow-up will let the UI-process singleton install its own client\nthat routes the notification to the right page.\n\nNo new tests; this is a behavior-preserving refactor covered by existing media tests.\n\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/platform/audio/MediaSessionManagerClient.h: Added.\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.cpp:\n(WebCore::MediaSessionManagerInterface::MediaSessionManagerInterface):\n(WebCore::MediaSessionManagerInterface::client const):\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.h:\n* Source/WebCore/platform/audio/cocoa/MediaSessionManagerCocoa.mm:\n(WebCore::MediaSessionManagerCocoa::removeSession):\n(WebCore::MediaSessionManagerCocoa::updateActiveNowPlayingSession):\n\nCanonical link: https://commits.webkit.org/317977@main", "email": "eric.carlson@apple.com", "hash": "3ec8c62695a2acc1bd7470b552d105b350cc7943", "subject": "[Site Isolation] Define a MediaSessionManagerClient to route audio-session activation and NowPlaying" }, "317978@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "317978@main", "clUrl": "https://commits.webkit.org/317978@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320343\nrdar://183289080\n\nReviewed by Sosuke Suzuki.\n\nMake ToPrimitive(object) faster by caching a flag in StructureRareData.\nm_cachedHasDefaultToPrimitiveFastAndNonObservable says that we can use\ntoStringTag cached value.\n\nTests: JSTests/stress/object-toprimitive-fastpath-deopt.js\n JSTests/stress/object-toprimitive-fastpath-overrides.js\n JSTests/stress/object-toprimitive-fastpath-prototype.js\n JSTests/stress/object-toprimitive-fastpath.js\n\n* JSTests/stress/object-toprimitive-fastpath-deopt.js: Added.\n(shouldBe):\n(O):\n(Object.prototype.toString):\n(a.Symbol.toPrimitive):\n(Tagged):\n(Plain):\n* JSTests/stress/object-toprimitive-fastpath-overrides.js: Added.\n(shouldBe):\n(v.valueOf):\n(s.toString):\n(tp.Symbol.toPrimitive):\n(catch):\n(other.Object.prototype.toString):\n(Plain):\n* JSTests/stress/object-toprimitive-fastpath-prototype.js: Added.\n(shouldBe):\n(O):\n(O.prototype.valueOf):\n(O.prototype.toString):\n(O.prototype.Symbol.toPrimitive):\n(valueOf):\n(o.valueOf):\n* JSTests/stress/object-toprimitive-fastpath.js: Added.\n(shouldBe):\n(O):\n* Source/JavaScriptCore/runtime/JSObject.cpp:\n(JSC::JSObject::toPrimitive const):\n* Source/JavaScriptCore/runtime/Structure.h:\n* Source/JavaScriptCore/runtime/StructureInlines.h:\n(JSC::Structure::defaultToPrimitiveFastAndNonObservable):\n* Source/JavaScriptCore/runtime/StructureRareData.cpp:\n(JSC::StructureRareData::giveUpOnSpecialPropertyCache):\n(JSC::StructureRareData::clearCachedSpecialProperty):\n* Source/JavaScriptCore/runtime/StructureRareData.h:\n\nCanonical link: https://commits.webkit.org/317978@main", "email": "ysuzuki@apple.com", "hash": "cd91e7f128dd09f6f9bb8f19e8bc66c6d7e94dfa", "subject": "[JSC] Add fast flag for ToPrimitive(Object) calls in runtime" }, "317979@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "317979@main", "clUrl": "https://commits.webkit.org/317979@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320322\n\nReviewed by Antti Koivisto.\n\nFlexFormattingContext::layout returns a Result with four fields, and FlexLayout copied each one into a\nmember of its own right after the call. Those four members are not state FlexLayout maintains, they are\njust the last run's answers, kept around for the queries that run after layout: adjustAllowedLayoutOverflow\nreads the two content-alignment overflows, and the baseline queries read the two line item counts. Store\nthe Result itself and let those queries read through it.\n\nThis also fixes align-content's start overflow going stale. The two overflows were treated differently:\njustifyContentStartOverflow is a LayoutUnit the flex algorithm always writes, but alignContentStartOverflow\nis a std::optional, left disengaged when handleCrossAxisAlignmentForFlexLines returns early (no lines to\nalign, or an alignment that cannot overflow the start edge). FlexLayout only assigned its member when the\noptional was engaged, so a layout taking that early path kept the previous layout's value and reported an\noverflow allowance that no longer had anything producing it. Resetting the whole result at the start of\nlayout() and reading the optional with value_or means \"the algorithm did not compute one\" now means no\noverflow, which is what the early returns intend. This has been the behaviour since the two members were\nintroduced in 275209.\n\n* Source/WebCore/layout/integration/flex/LayoutIntegrationFlexLayout.cpp:\n(WebCore::LayoutIntegration::FlexLayout::initializeMarginTrimState):\n(WebCore::LayoutIntegration::FlexLayout::adjustAllowedLayoutOverflow):\n(WebCore::LayoutIntegration::FlexLayout::layout):\n(WebCore::LayoutIntegration::FlexLayout::firstLineBaseline):\n(WebCore::LayoutIntegration::FlexLayout::lastLineBaseline):\n(WebCore::LayoutIntegration::FlexLayout::flexItemForFirstBaseline):\n(WebCore::LayoutIntegration::FlexLayout::flexItemForLastBaseline):\n(WebCore::LayoutIntegration::FlexLayout::adjustAllowedLayoutOverflow const):\n(WebCore::LayoutIntegration::FlexLayout::firstLineBaseline const):\n(WebCore::LayoutIntegration::FlexLayout::lastLineBaseline const):\n(WebCore::LayoutIntegration::FlexLayout::flexItemForFirstBaseline const):\n(WebCore::LayoutIntegration::FlexLayout::flexItemForLastBaseline const):\n* Source/WebCore/layout/integration/flex/LayoutIntegrationFlexLayout.h:\n* LayoutTests/imported/w3c/web-platform-tests/css/cssom-view/scrollWidthHeight-negative-margin-002-expected.txt:\n\nCanonical link: https://commits.webkit.org/317979@main", "email": "zalan@apple.com", "hash": "38ad658016df9f935bc095c555f93179ae5bba89", "subject": "[cleanup] Have LayoutIntegration::FlexLayout store the flex layout result instead of unpacking it into members" }, "317980@main": { "author": "Elika Etemad", "avatar": "https://www.gravatar.com/avatar/55e113d03e0552e6df90ecbc15acd9b8?d=identicon\u0026s=64", "cl": "317980@main", "clUrl": "https://commits.webkit.org/317980@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320157\nrdar://183092726\n\nReviewed by Tim Nguyen.\n\nFolds in a number of experimental updates to customizable select UA styles,\nwith the goal of removing the *need* for authors to apply their own styling\n(as well as fixing some very noticeable problems with the existing styles):\n- Refinements to spacing (padding, margins, etc.)\n- Refinements to border and background color-mix()es\n- Adjustments to border-radius to more closely match common design patterns\n- Handling overflow rather than letting it spill out\n- More appropriate cursor styles\n- Removing unnecessary text-transform rule. (none == initial)\n- Switching to 'system-ui' for iconography\n- Applying border-box sizing more extensively, to better match author resets\n- Corrections to anchor positioning fallback behaviors\n- Adding a box-shadow to the picker dialog\n- Adding optgroup styling\n- Adding prefers-contrast mode colors\n\nSlightly more experimental updates include:\n- Styling for :user-invalid\n- Color-matched styling for the picker dialog\n\nLanding on main to keep open a compat gap with Chrome and help maintain\nsome space for the standardization groups to maneuver while these points\nare discussed and resolved.\n\nTests were updated:\n- A few marked as known failures given the new rules.\n- Most reftests now import a copy of our html.css rules into their -expected\n references so they still work. ASuppressed animations so they snapshot reliably.\n These are both applied as one-liners for easy diffing.\n- Some keyboard navigation tests depended too much on geometry, they are now\n more robust. This set of changes should be exported to WPT.\n- Adjusted focus outline test to work with moved declaration. (Moved\n outline-offset to reduce selector matching in UA stylesheet, and to\n apply it more consistently.)\n\n* LayoutTests/TestExpectations:\n* LayoutTests/fast/forms/select/base/option-focus-visible-outline-offset-expected.txt:\n* LayoutTests/fast/forms/select/base/option-focus-visible-outline-offset.html:\n* LayoutTests/fast/forms/select/base/select-pagedown-pageup.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/rendering/non-replaced-elements/form-controls/resets-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/rendering/widgets/the-select-element/select-as-listbox-default-styles.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/appearance-base-and-base-select.tentative-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/appearance-base-and-base-select.tentative.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/appearance-base-select-other-elements-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/appearance-base-select-other-elements.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/border-rendering-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/border-rendering.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/checkmark-animation-002-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/checkmark-animation-002.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/closed-listbox-rendering-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/closed-listbox-rendering.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/focus-ring-rendering-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/focus-ring-rendering.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/option-label-in-shadow-tree-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/option-label-in-shadow-tree.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/picker-and-slotted-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/picker-and-slotted-invalidation-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/picker-and-slotted-invalidation.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/picker-and-slotted.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/picker-icon-and-slotted-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/picker-icon-and-slotted.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/picker-icon-animation-002-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/picker-icon-animation-002.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-active-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-active.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-button-after-option-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-button-after-option.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-button-after-span-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-button-after-span.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-button-after-text-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-button-after-text.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-custom-button-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-custom-button.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-dark-mode-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-dark-mode.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-default-button-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-default-button.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-disabled-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-disabled-option-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-disabled-option.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-disabled.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-fallback-bottom-left-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-fallback-bottom-left-scroller-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-fallback-bottom-left-scroller.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-fallback-bottom-left.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-fallback-bottom-right-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-fallback-bottom-right-scroller-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-fallback-bottom-right-scroller.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-fallback-bottom-right.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-fallback-top-left-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-fallback-top-left-scroller-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-fallback-top-left-scroller.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-fallback-top-left.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-fallback-top-right-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-fallback-top-right-scroller-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-fallback-top-right-scroller.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-fallback-top-right.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-font-inheriting-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-font-inheriting.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-hover-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-hover.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-mixing-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-mixing.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-optgroup-legend-and-label-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-optgroup-legend-and-label.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-optgroup-legend-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-optgroup-legend.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-optgroup-rendering-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-optgroup-rendering.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-option-with-label-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-option-with-label.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-picker-select-border-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-picker-select-border.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-sizing-in-flex-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-sizing-in-flex.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-switching-invalidation-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-switching-invalidation.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-writing-mode-vertical-lr-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-writing-mode-vertical-lr.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-writing-mode-vertical-rl-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-writing-mode-vertical-rl.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-wrong-picker-argument-expected-mismatch.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-appearance-wrong-picker-argument.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-base-appearance-computed-style-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-button-text-and-icon-clipping-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-button-text-and-icon-clipping.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-clipping-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-clipping.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-display-block.tentative-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-display-block.tentative.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-explicit-size-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-explicit-size.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-font-size-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-font-size.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-grid-before-after-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-grid-before-after.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-home-end-pagedown-pageup-detailed.optional-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-home-end-pagedown-pageup-detailed.optional.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-home-end-pagedown-pageup.optional.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-icon-color-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-icon-color.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-only-button-opt-in-expected-mismatch.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-only-button-opt-in.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-only-picker-opt-in-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-only-picker-opt-in.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-open-invalidation-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-open-invalidation.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-optgroup-legend-label-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-optgroup-legend-label.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-option-hover-styles-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-option-images-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-option-images.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-picker-pseudo-backdrop-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-picker-pseudo-backdrop.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-picker-pseudo-before-after-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-picker-pseudo-before-after.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-picker-pseudo-first-letter-first-line-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-picker-pseudo-first-letter-first-line.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-picker-pseudo-highlight-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-picker-pseudo-highlight.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-picker-pseudo-selection-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-picker-pseudo-selection.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-picker-pseudo-target-text-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-picker-pseudo-target-text.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-popover-exit-animation-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-popover-exit-animation.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-second-child-button-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-second-child-button.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-size-multiple-new-content-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-size-multiple-new-content.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-text-only-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-text-only.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/selectedcontent-color-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/selectedcontent-color.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/standalone-optgroup-no-shadow-tree-after-select-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/standalone-optgroup-no-shadow-tree-after-select.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/standalone-optgroup-no-shadow-tree-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/standalone-optgroup-no-shadow-tree.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/standalone-option-no-shadow-tree-after-select-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/standalone-option-no-shadow-tree-after-select.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/standalone-option-no-shadow-tree-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/standalone-option-no-shadow-tree.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/update.css: Added.\n(select,):\n(select:not([popover]),):\n(select:enabled:hover:not(:user-invalid),):\n(.customizable-select-button.hover):\n(select:enabled:active,):\n(select:disabled,):\n(select:user-invalid):\n(select:not([multiple]) \u003e button:first-child):\n(select selectedcontent,):\n(select::picker-icon,):\n(select::picker(select),):\n(select::picker(select):popover-open):\n(option):\n(select option,):\n(select option:enabled:hover,):\n(select option:enabled:active):\n(select option:disabled,):\n(select option::checkmark,):\n(select option:not(:checked)::checkmark,):\n(optgroup,):\n(select optgroup,):\n(optgroup:first-child,):\n(select optgroup option,):\n(select optgroup legend,):\n(@media (prefers-contrast) select,):\n(@media (prefers-contrast) select:enabled:hover:hover,):\n(@media (prefers-contrast) select:enabled:active:active,):\n(@media (prefers-contrast) select:disabled:disabled,):\n(@media (prefers-contrast) select::picker(select),):\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/uses-label-dynamic-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/uses-label-dynamic.html:\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/ios/fast/forms/select/base/option-focus-visible-outline-offset-expected.txt:\n* LayoutTests/platform/ios/fast/forms/select/base/option-inset-outline-offset-expected.txt:\n* LayoutTests/platform/ios/imported/w3c/web-platform-tests/html/rendering/widgets/the-select-element/select-as-listbox-default-styles.tentative-expected.txt:\n* Source/WebCore/css/html.css:\n(select:-internal-uses-menulist):\n(select:-internal-uses-menulist:enabled:hover:not(:user-invalid)):\n(select:-internal-uses-menulist:enabled:active):\n(select:-internal-uses-menulist:disabled):\n(select:-internal-uses-menulist:user-invalid):\n(select selectedcontent):\n(select::picker-icon):\n(:-internal-select-popover):\n();):\n(select:-internal-uses-menulist option):\n(select option):\n(select option:enabled:hover,):\n(select option:enabled:active):\n(select option:disabled):\n(select option::checkmark):\n(optgroup):\n(select:-internal-uses-menulist optgroup):\n(optgroup:first-child):\n(select optgroup legend):\n(@media (prefers-contrast) :-internal-select-popover):\n(@media (prefers-contrast) select option:enabled:is(:hover, :focus-visible, :active)):\n(@media (prefers-contrast) select option:disabled,):\n(select:-internal-uses-menulist:enabled:hover): Deleted.\n(select option:enabled:hover): Deleted.\n(select option:focus-visible): Deleted.\n\nCanonical link: https://commits.webkit.org/317980@main", "email": "fantasai.bugs@inkedblade.net", "hash": "0d950bca70506c66a29ee9fbafd80d6033021f1c", "subject": "appearance: base-select select styling lacks adequate polish and professionalism" }, "317981@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "317981@main", "clUrl": "https://commits.webkit.org/317981@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320347\nrdar://183300022\n\nReviewed by Yijia Huang.\n\n/(?:^a)?b/ is incorrectly working since it is marked as m_startsWithBOL.\nBut we need to ensure that ^ parentheses does not pass with empty input.\nThis patch correctly recomputes m_startsWithBOL flag by scanning\nalternatives.\n\nWe also fixes copyDisjunction too. The current one is incorrectly\ndropping ^ pattern in the middle, so /x(?:^a)b/ becomes /xb/, but this\nis not correct. We should use only when all copies succeed.\n\nTest: JSTests/stress/regexp-bol-inside-parentheses-is-not-anchored.js\n\n* JSTests/stress/regexp-bol-inside-parentheses-is-not-anchored.js: Added.\n(shouldBe):\n(check):\n(step):\n* Source/JavaScriptCore/yarr/YarrPattern.cpp:\n(JSC::Yarr::YarrPatternConstructor::atomParenthesesEnd):\n(JSC::Yarr::YarrPatternConstructor::copyDisjunction):\n(JSC::Yarr::YarrPatternConstructor::parenthesesMustMatch):\n(JSC::Yarr::YarrPatternConstructor::copyTerms):\n(JSC::Yarr::YarrPatternConstructor::recomputeStartsWithBOL):\n(JSC::Yarr::YarrPatternConstructor::optimizeBOL):\n(JSC::Yarr::YarrPatternConstructor::optimizeDotStarWrappedExpressions):\n(JSC::Yarr::YarrPattern::compile):\n\nCanonical link: https://commits.webkit.org/317981@main", "email": "ysuzuki@apple.com", "hash": "98d0367d2247df6cfc363a38eadc33fa2ce1723e", "subject": "[YARR] A ^ inside a parenthesis that can match empty does not anchor the pattern" }, "317982@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "317982@main", "clUrl": "https://commits.webkit.org/317982@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320372\nrdar://183336943\n\nReviewed by Cole Carley and Youenn Fablet.\n\nAdmittedly the function doesn't exist yet, so this isn't an issue yet,\nbut when it does it will have RETURNS_RETAINED so the adoptNS is correct.\nAdding the annotation fixes a safer-cpp warning.\n\n* Source/WebCore/PAL/pal/spi/cocoa/NetworkSPI.h:\n* Source/WebKit/NetworkProcess/cocoa/NetworkSoftLink.h:\n\nCanonical link: https://commits.webkit.org/317982@main", "email": "achristensen@apple.com", "hash": "f794faf253d3943c16c359adc3583549de4a315c", "subject": "Add RETURNS_RETAINED to nw_webtransport_metadata_copy_sec_protocol_metadata" }, "317983@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "317983@main", "clUrl": "https://commits.webkit.org/317983@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320348\nrdar://183300106\n\nReviewed by Yijia Huang.\n\noptimizeDotStarWrappedExpressions() rewrites /^.*EXPR.*$/ into EXPR\nfollowed by a DotStarEnclosure term standing in for the deleted `^`\nand the two `.*`. The enclosure reports the position of EXPR rather than\nthe position the leading `.*` starts at. That is invisible for an\nordinary search, but a sticky pattern must begin its match exactly at\nlastIndex, so /^.*a.*$/y rejected \"xa\" instead of matching the whole\nstring at index 0. This patch disables optimizeDotStarWrappedExpressions\nwhen sticky bit is set.\n\nTest: JSTests/stress/regexp-sticky-dot-star-wrapped-expression.js\n\n* JSTests/stress/regexp-sticky-dot-star-wrapped-expression.js: Added.\n(shouldBe):\n(check):\n(step):\n* Source/JavaScriptCore/yarr/YarrPattern.cpp:\n(JSC::Yarr::YarrPatternConstructor::optimizeDotStarWrappedExpressions):\n\nCanonical link: https://commits.webkit.org/317983@main", "email": "ysuzuki@apple.com", "hash": "b128ddd863ab9e89a71288a461606b0aee6b3bca", "subject": "[YARR] The dot-star-wrapped-expression optimization is wrong for sticky patterns" }, "317984@main": { "author": "Ruthvik Konda", "avatar": "https://www.gravatar.com/avatar/bca33cefcce93017251a8fbc1204cdc4?d=identicon\u0026s=64", "cl": "317984@main", "clUrl": "https://commits.webkit.org/317984@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320035\nrdar://182967586\n\nReviewed by Adrian Taylor.\n\nThe IPC code generator can already emit a Swift message receiver for\nnon-stream receivers (as used by WebBackForwardList), but not for Stream\nreceivers. A Stream receiver dispatches off the main thread and uses a\ndifferent base class (IPC::StreamMessageReceiver) and entry point\n(didReceiveStreamMessage), so a receiver marked both Stream and SwiftReceiver\nwas generated with the wrong shape. Supporting it is a prerequisite for moving\nstream-based receivers such as RemoteMesh to Swift.\n\nTeach the generator to emit the stream-shaped forwarder: it inherits\nIPC::StreamMessageReceiver (itself ThreadSafeRefCounted, so its refcount is\natomic for the off-main work queue), overrides didReceiveStreamMessage, and\nforwards ref()/deref() to the stream base. If the weakly-held Swift target has\nalready been destroyed (a benign off-main teardown race), the forwarder marks\nthe message invalid so the stream connection tears down cleanly instead of\nleaving the shared buffer mis-framed.\n\nCovered by a new fixture, TestWithStreamSwift, added to the IPC\nmessage-generator test messages_unittest.py.\n\n* Source/WebKit/Scripts/webkit/messages.py:\n(forward_declarations_and_headers):\n(generate_messages_header):\n(generate_get_target_statements.append_swift_get_target_statements):\n* Source/WebKit/Scripts/webkit/messages_unittest.py:\n* Source/WebKit/Scripts/webkit/tests/Makefile:\n* Source/WebKit/Scripts/webkit/tests/MessageArgumentDescriptions.cpp:\n* Source/WebKit/Scripts/webkit/tests/MessageNames.cpp:\n* Source/WebKit/Scripts/webkit/tests/MessageNames.h:\n* Source/WebKit/Scripts/webkit/tests/TestWithStreamSwift.messages.in: Added.\n* Source/WebKit/Scripts/webkit/tests/TestWithStreamSwiftMessageReceiver.cpp: Added.\n* Source/WebKit/Scripts/webkit/tests/TestWithStreamSwiftMessageReceiver.swift: Added.\n* Source/WebKit/Scripts/webkit/tests/TestWithStreamSwiftMessages.h: Added.\n\nCanonical link: https://commits.webkit.org/317984@main", "email": "rkonda2@apple.com", "hash": "85ec3f6980f7fd9767bf955bb851f9b93d5d499c", "subject": "Stream IPC message receivers can call directly into Swift" }, "317985@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317985@main", "clUrl": "https://commits.webkit.org/317985@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320356\nrdar://183308541\n\nReviewed by Eric Carlson.\n\nprocessLinearRamp() computed fillToFrameTrunc twice from a byte-identical\nexpression: an inner declaration shadowed the outer one that guards the\n4-step unrolled fast path. The values are always equal, and both lines date\nfrom 217453@main, which hoisted the computation to form the if-guard without\nremoving the original.\n\nRemove the shadowing declaration, matching processSetTarget(), which computes\nthe same quantity once. No behavior change.\n\n* Source/WebCore/Modules/webaudio/AudioParamTimeline.cpp:\n(WebCore::AudioParamTimeline::processLinearRamp):\n\nCanonical link: https://commits.webkit.org/317985@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "92eed789f622c2c4954350f9d5f352bf554d69f9", "subject": "Redundant shadowed fillToFrameTrunc computation in AudioParamTimeline::processLinearRamp()" }, "317986@main": { "author": "Youenn Fablet", "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64", "cl": "317986@main", "clUrl": "https://commits.webkit.org/317986@main", "description": "rdar://182789617\nhttps://bugs.webkit.org/show_bug.cgi?id=319884\n\nReviewed by Jer Noble.\n\nWe enable WebRTC AV1 for all cocoa platforms.\nTo keep supported MediaRecorder AV1 for AV1 HW enabled devices, we use WebCodecsAV1Enabled to gate MediaRecorder AV1.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebCore/platform/mediarecorder/MediaRecorderPrivateAVFImpl.cpp:\n(WebCore::MediaRecorderPrivateAVFImpl::isTypeSupported):\n\nCanonical link: https://commits.webkit.org/317986@main", "email": "youenn@apple.com", "hash": "19690ae29ad8f41d69624c5318ffdebc5befbb0c", "subject": "[Cocoa] Enable WebRTC AV1 by default" }, "317988@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317988@main", "clUrl": "https://commits.webkit.org/317988@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320357\nrdar://183308918\n\nReviewed by Eric Carlson.\n\nAudioNodeOutput declares a private typedef for InputsMap::iterator, but\nits last three uses were converted to modern range-based for-loops in\n163795@main (2015). The typedef has been dead code ever since. Remove it.\n\nNo change in behavior.\n\n* Source/WebCore/Modules/webaudio/AudioNodeOutput.h:\n\nCanonical link: https://commits.webkit.org/317988@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "87b49d252dd7f77c6da0bba4689f6fd5a6010df9", "subject": "Remove unused AudioNodeOutput::InputsIterator typedef" }, "317989@main": { "author": "Qianlang Chen", "avatar": "https://www.gravatar.com/avatar/0fd54e904334f604739d0205aa6e2130?d=identicon\u0026s=64", "cl": "317989@main", "clUrl": "https://commits.webkit.org/317989@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319020\nrdar://181636486\n\nReviewed by BJ Burg.\n\nUnder Site Isolation the Network domain is served by ProxyingNetworkAgent\nin the UIProcess, which routes each requestId-keyed command to the\nWebContent process that performed the load. A resource's TLS certificate\nhas to follow that path: it lives on the ResourceResponse in the loading\nprocess and is not retained afterwards, so it is captured at response\ntime into the same per-process store that already backs getResponseBody.\n\nThat buffering already existed but sat behind a store setting that was\nnever turned on. We drive the setting from the inspected page's existing\ncertificate-display preference rather than forcing it on, so Site\nIsolation makes the same embedder- and platform-gated decision as the\nnon-Site-Isolation path instead of quietly diverging from it. It is\napplied when network instrumentation is enabled -- the point where the\npage is known to be live and where the other network overrides are\nalready latched.\n\nThe protocol command was synchronous. Serving it that way would mean a\nsynchronous UIProcess-to-WebContent IPC, which blocks the UIProcess on a\nweb content process and would require teaching WebPage to forward\nsynchronous messages to its inspector receiver. Making the command\nasynchronous instead lets it reuse the getResponseBody routing and adds\nno new IPC plumbing; the shared requestId-to-process resolution is\nfactored into a helper. The tradeoff is converting the shared WebCore\nhandler that every non-Site-Isolation port implements from a synchronous\nreturn to a callback; that is mechanical and invisible to the frontend,\nwhich already awaits the command.\n\nNeither shared-code change moves the non-Site-Isolation path: the page\ntarget's handler still completes synchronously in place (only its return\nshape changed, not its timing), and the frontend's backend-target\nreroute is gated on a flag set only under Site Isolation.\n\nTwo caveats shared with getResponseBody: the command must be declared\non the web-page target or it is absent from the backend dispatcher\nwhere ProxyingNetworkAgent lives, and the frontend must issue it\nagainst the backend target, since a resource's own target is the page\ntarget that cannot resolve the requestId under Site Isolation.\n\nA real certificate requires a TLS load, so the test drives the success\npath through a cross-origin https iframe and covers the\nmissing-certificate, malformed-requestId, and unknown-process routing\npaths without one.\n\nTest: http/tests/site-isolation/inspector/network/cross-origin-iframe-get-serialized-certificate.html\n\n* LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-get-serialized-certificate-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-get-serialized-certificate.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/network/resources/get-serialized-certificate-iframe.html: Added.\n* Source/JavaScriptCore/inspector/protocol/Network.json:\n* Source/WebCore/inspector/agents/InspectorNetworkAgent.cpp:\n(WebCore::InspectorNetworkAgent::getSerializedCertificate):\n* Source/WebCore/inspector/agents/InspectorNetworkAgent.h:\n* Source/WebInspectorUI/UserInterface/Models/Resource.js:\n(WI.Resource.prototype.async showCertificate):\n* Source/WebKit/UIProcess/Inspector/Agents/ProxyingNetworkAgent.cpp:\n(Inspector::replyFailureString):\n(Inspector::resolveRequestProcess):\n(Inspector::ProxyingNetworkAgent::getResponseBody):\n(Inspector::ProxyingNetworkAgent::getSerializedCertificate):\n* Source/WebKit/UIProcess/Inspector/Agents/ProxyingNetworkAgent.h:\n* Source/WebKit/WebProcess/Inspector/BackendResourceDataStore.cpp:\n(WebKit::BackendResourceDataStore::getSerializedCertificate):\n* Source/WebKit/WebProcess/Inspector/BackendResourceDataStore.h:\n(WebKit::BackendResourceDataStore::setSupportsShowingCertificate):\n* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.cpp:\n(WebKit::WebInspectorBackend::enableNetworkInstrumentation):\n(WebKit::WebInspectorBackend::getSerializedCertificate):\n* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.h:\n* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.messages.in:\n\nCanonical link: https://commits.webkit.org/317989@main", "email": "qianlangchen@apple.com", "hash": "479edb2e4395baaa1f7bec9655aacf4b24a611a6", "subject": "[Site Isolation] Web Inspector: Implement Network.getSerializedCertificate" }, "317990@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "317990@main", "clUrl": "https://commits.webkit.org/317990@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320333\n\nReviewed by Antti Koivisto.\n\ncanUseFlexItemForPercentageResolution answered two separate questions in one function: whether the flex\nalgorithm has produced the item's height yet, and whether CSS Flexbox 9.8 considers the resulting size\ndefinite. Only the first is about RenderFlexibleBox. The second is spec logic over the item's style plus\nthe container's block-size definiteness, both of which the flex formatting context already owns.\n\nSplit them. FlexLayout gains isFlexItemHeightDefiniteInLayoutPhase for the phase question, returning\nstd::optional so that \"the flex algorithm is not running\" stays distinguishable from a yes or a no --\noutside of layout only the container knows which of its own passes is in play. It also takes the 9.8 rules\n(hasDefiniteSizeForPercentResolution), flexItemMainSizeIsDefinite and both\ncanResolvePercentAgainstContainerBlockSize overloads; the latter reads and writes the block-size\ndefiniteness the layout state carries, which FlexLayout owns since 320299. That removes two function\ntemplates and their four explicit instantiations from RenderFlexibleBox, and lets FlexIntegrationUtils\nforward to FlexLayout rather than bouncing through the renderer.\n\nWhat is left on RenderFlexibleBox is the part that is genuinely about the renderer's own layout passes:\nm_inFlexItemIntrinsicWidthComputation, m_inSimplifiedLayout and the subtree layout root check. Those are\nnot flex algorithm state, so they stay where the flags live.\n\nThe phase check reads the opposite way round now -- it answers \"is the height definite\" rather than \"is\npercentage resolution disabled\" -- so that both halves are positive and can be combined with \u0026\u0026. The\nshort-circuit is deliberate: canResolvePercentAgainstContainerBlockSize memoizes into the layout state, so\nit must not run when the phase check has already said no.\n\nNo change in behaviour.\n\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.cpp:\n(WebCore::LayoutIntegration::FlexIntegrationUtils::computeBlockAxisContentSizeForFlexItem):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::flexItemMainSizeIsDefinite):\n* Source/WebCore/layout/integration/flex/LayoutIntegrationFlexLayout.cpp:\n(WebCore::LayoutIntegration::FlexLayout::isFlexItemHeightDefiniteInLayoutPhase const):\n(WebCore::LayoutIntegration::FlexLayout::hasDefiniteSizeForPercentResolution):\n(WebCore::LayoutIntegration::FlexLayout::flexItemMainSizeIsDefinite):\n(WebCore::LayoutIntegration::FlexLayout::canResolvePercentAgainstContainerBlockSize):\n* Source/WebCore/layout/integration/flex/LayoutIntegrationFlexLayout.h:\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::canUseFlexItemForPercentageResolution):\n(WebCore::RenderFlexibleBox::canResolvePercentAgainstContainerBlockSize): Deleted.\n(WebCore::RenderFlexibleBox::flexItemMainSizeIsDefinite): Deleted.\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n\nCanonical link: https://commits.webkit.org/317990@main", "email": "zalan@apple.com", "hash": "b1c69511447cfc4d4e82e49dd5633edac8d09a55", "subject": "[cleanup] Move the flex percentage-resolution definiteness checks off RenderFlexibleBox" }, "317991@main": { "author": "Taher Ali", "avatar": "https://www.gravatar.com/avatar/e104800647d8c98b8c9dbe736b5e1751?d=identicon\u0026s=64", "cl": "317991@main", "clUrl": "https://commits.webkit.org/317991@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320118\nrdar://183059589\n\nReviewed by Simon Fraser.\n\nThe CSS filter: property on an HTML element now resolves a \u003cfilter\u003e\nreferenced by an external file or a data: URL.\n\n* LayoutTests/TestExpectations:\n\nsvg-relative-urls-001 and -002 are marked ImageOnlyFailure: they exercise\nrelative filter URLs that are not re-resolved when an element moves\ndocuments, a pre-existing issue surfaced here and tracked in bug 320225.\n\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/img-src/css-filter-blocked.tentative-expected.txt: now passes\n* Source/WebCore/rendering/ReferencedSVGResources.cpp:\n(WebCore::ReferencedSVGResources::referencedFilterElement):\n* Source/WebCore/style/StylePendingResources.cpp:\n(WebCore::Style::loadPendingExternalSVGFilter):\n(WebCore::Style::loadPendingResources):\n(WebCore::Style::loadExternalSVGResource):\n(WebCore::Style::loadPendingExternalSVGPaint):\n(WebCore::Style::loadPendingExternalSVGMarker):\n(WebCore::Style::loadPendingExternalSVGClipPath):\n\nCanonical link: https://commits.webkit.org/317991@main", "email": "taher_ali@apple.com", "hash": "690ab3f55222060f2c53a44c81373dd003440dfb", "subject": "Support external and data: URL filter references on HTML elements" }, "317992@main": { "author": "Lily Spiniolas", "avatar": "https://www.gravatar.com/avatar/b65cfeb51301399bd50e338bb2d7613e?d=identicon\u0026s=64", "cl": "317992@main", "clUrl": "https://commits.webkit.org/317992@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320377\nrdar://181328806\n\nReviewed by Tim Horton.\n\nIn WebViewImpl::updateScrollPocket(), a scroll pocket is created when\n`needsTopViewForFullScreenTitlebar` is true. In certain cases, in fullscreen\napplications, the scroll pocket of a webview in an NSScrollView may have a non-zero\nheight and obscure the web content. Speculatively fix this bug by making\n`needsTopViewForFullScreenTitlebar` false when the webview is not the document view\nof an NSScrollView.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ObscuredContentInsets.mm\n\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::updateScrollPocket):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ObscuredContentInsets.mm:\n(TestWebKitAPI::TEST(ObscuredContentInsets, ScrollPocketIgnoresFullScreenTitlebarHeightForSubscrollers)):\n\nCanonical link: https://commits.webkit.org/317992@main", "email": "lily_spiniolas@apple.com", "hash": "79c1efa2cd30fc9bed6a5e8af5cb17022e1c717e", "subject": "Scroll pocket may obscure web content in fullscreen mode" }, "317994@main": { "author": "Ryosuke Niwa", "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64", "cl": "317994@main", "clUrl": "https://commits.webkit.org/317994@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320288\nrdar://179511074\n\nReviewed by Sihui Liu and Wenson Hsieh.\n\nThe bug was caused by a coordinate-transform bug in the iOS two-phase tap path.\n\nWhen user taps on a page and the main frame's process first does hit testing. When it lands\non a cross-origin (remote) iframe it transforms the tap into that frame's coordinate space\nand re-dispatches it to the frame's process. The transform was:\n\nremoteFrameView-\u003erootViewToContents( ownerFrameView-\u003econtentsToRootView(position) )\n\nwhere ownerFrameView was frameOwner-\u003edocument().frame()-\u003eview() - the view of the frame that\ncontains the tapped iframe element. The position is now expressed in the hit-tested (root)\nframe's coordinates, but when the cross-origin iframe is nested inside an offset same-site\nsubframe, frameOwner-\u003edocument().frame() is that nested subframe - not the root frame.\n\nFeeding a root-frame point through the nested frame's contentsToRootView double-counts the\ncontainer's offset; rootViewToContents then subtracts it back, so the transform nets to\nidentity and the tap lands outside the target frame. The remote frame's process finds no\nnode there so the click is never synthesized and nothing happens.\n\nThis PR fixes the bug by in potentialTapAtPosition, transforming the point starting from\nlocalRootFrame's view (the frame the hit-test was performed in, whose coordinates position\nis actually in) instead of the tapped iframe owner's frame view.\nRemoteFrameView::rootViewToContents already walks the full ancestor chain, so composing it\nwith the root frame's contentsToRootView yields the correct point regardless of nesting depth.\nDirect-child taps are unchanged (there localRootFrame == the owner's frame).\n\nTest: http/tests/site-isolation/touch-events/tap-nested-cross-origin-frame-in-offset-subframe.html\n\n* LayoutTests/http/tests/site-isolation/touch-events/resources/nested-ad-reports-click.html: Added.\n* LayoutTests/http/tests/site-isolation/touch-events/resources/samesite-offset-container.html: Added.\n* LayoutTests/http/tests/site-isolation/touch-events/tap-nested-cross-origin-frame-in-offset-subframe-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/touch-events/tap-nested-cross-origin-frame-in-offset-subframe.html: Added.\n* Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm:\n(WebKit::WebPage::potentialTapAtPosition):\n\nCanonical link: https://commits.webkit.org/317994@main", "email": "rniwa@webkit.org", "hash": "0825ca6fee879a88c69897d806a5d1db09b77f70", "subject": "[Site Isolation] [iOS] Tapping sometimes doesn't work when shared process is enabled" }, "317995@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317995@main", "clUrl": "https://commits.webkit.org/317995@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320373\nrdar://183338187\n\nReviewed by Eric Carlson.\n\nCast away constness on `this` to reach the non-const context() overload,\neven though `const BaseAudioContext\u0026 context() const` exists and\nContextDestructionObserver::scriptExecutionContext() is itself const.\n\nUse the const overload. The static_cast stays to disambiguate\nActiveDOMObject's non-virtual scriptExecutionContext() from EventTarget's\npure-virtual one; only the const_cast goes away. No behavior change.\n\n* Source/WebCore/Modules/webaudio/AudioNode.cpp:\n(WebCore::AudioNode::scriptExecutionContext const):\n\nCanonical link: https://commits.webkit.org/317995@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "9babc122dc0298ebdc689b41ade1d81f9141b8f7", "subject": "AudioNode::scriptExecutionContext() uses const_cast despite a const context() overload existing" }, "317996@main": { "author": "Qianlang Chen", "avatar": "https://www.gravatar.com/avatar/0fd54e904334f604739d0205aa6e2130?d=identicon\u0026s=64", "cl": "317996@main", "clUrl": "https://commits.webkit.org/317996@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319019\nrdar://181636193\n\nReviewed by BJ Burg.\n\nImplement the ProxyingNetworkAgent::loadResource that was a stub.\n\nNetwork.loadResource loads a URL in a frame's context on behalf of the\ninspector (e.g. to fetch a source map). Unlike getResponseBody, which is\nrouted by a process-qualified requestId and returns already-buffered\ncontent, loadResource is routed by frame (frameId + URL) and initiates a\nload, so it needs frame -\u003e process routing and a WebProcess-side load leg\nrather than the requestId / BackendResourceDataStore path.\n\nThe WebProcess load leg reuses WebCore's InspectorThreadableLoaderClient,\nrefactored to report its result through a completion handler instead of a\nLoadResourceCallback so it no longer depends on a backend dispatcher. It is\nexposed behind a new shared ResourceUtilities::loadResource() helper that\nowns the request/options and loader lifetime; the single-process\nInspectorNetworkAgent now delegates to the same helper, so both paths share\none implementation.\n\nOn the UIProcess side, ProxyingNetworkAgent decodes the frame's hosting\nprocess from the protocol frameId, the same way getResponseBody decodes it\nfrom a requestId. It keeps getResponseBody's convention that an empty reply\nerror string means the WebProcess connection was lost (AsyncReplyError)\nrather than a real failure.\n\nTwo supporting changes make the command reachable under Site Isolation:\nNetwork.loadResource gains the \"web-page\" target type so it is exposed on\nthe multiplexing target where ProxyingNetworkAgent lives (without it the\nfrontend cannot call it there), and the two frontend callers route to the\nbackend target when Network is enabled there, mirroring the getResponseBody\nreroute in Resource.requestContentFromBackend. Both are no-ops outside Site\nIsolation.\n\nTest: http/tests/site-isolation/inspector/network/cross-origin-iframe-load-resource.html\n\n* LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-load-resource-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/network/cross-origin-iframe-load-resource.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/network/resources/load-resource-iframe.html: Added.\n* Source/JavaScriptCore/inspector/protocol/Network.json:\n* Source/WebCore/inspector/InspectorResourceUtilities.cpp:\n(Inspector::ResourceUtilities::loadResource):\n* Source/WebCore/inspector/InspectorResourceUtilities.h:\n* Source/WebCore/inspector/InspectorThreadableLoaderClient.cpp:\n(Inspector::InspectorThreadableLoaderClient::didFinishLoading):\n(Inspector::InspectorThreadableLoaderClient::didFail):\n(Inspector::InspectorThreadableLoaderClient::failWithMessage):\n* Source/WebCore/inspector/InspectorThreadableLoaderClient.h:\n* Source/WebCore/inspector/agents/InspectorNetworkAgent.cpp:\n(WebCore::InspectorNetworkAgent::loadResource):\n* Source/WebInspectorUI/UserInterface/Controllers/NetworkManager.js:\n(WI.NetworkManager.prototype._loadAndParseSourceMap):\n* Source/WebInspectorUI/UserInterface/Models/SourceMapResource.js:\n(WI.SourceMapResource.prototype.requestContentFromBackend):\n* Source/WebKit/UIProcess/Inspector/Agents/ProxyingNetworkAgent.cpp:\n(Inspector::ProxyingNetworkAgent::loadResource):\n* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.cpp:\n(WebKit::WebInspectorBackend::loadResource):\n* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.h:\n* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.messages.in:\n* Source/WebKit/Scripts/webkit/messages.py:\n(class_template_headers):\n\nCanonical link: https://commits.webkit.org/317996@main", "email": "qianlangchen@apple.com", "hash": "28b979b1659bca24e518a83cd0e55d8e8ed7a424", "subject": "[Site Isolation] Web Inspector: Implement Network.loadResource" }, "317997@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "317997@main", "clUrl": "https://commits.webkit.org/317997@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319733\nrdar://182571341\n\nReviewed by Simon Fraser.\n\nWhen multiple snap areas are aligned at the same offset, snap target\nselection breaks the tie by \"first in tree order\"\n(ScrollSnapAnimatorState::selectSnapTargetForAxis), which assumes\nsnapAreas/snapAreasIDs are built in tree order. But\nupdateSnapOffsetsForScrollableArea() iterates\nRenderView::boxesWithScrollSnapPositions(), a hash set with arbitrary\niteration order, so the box chosen as \"first in tree order\" was\neffectively random.\n\nRather than sorting every snap box in the scroller into tree order up\nfront, insert each snap area's index into its offset's snapAreaIndices\nin tree order relative only to the other indices already tied at that\nexact offset (almost always zero or one of them). This avoids an\nO(n log n) sort of all snap boxes on every layout in exchange for a\nhandful of treeOrder() comparisons limited to actual aligned ties,\nwhile still keeping the tree-order comparison itself on the main\nthread, since ScrollSnapAnimatorState::selectSnapTargetForAxis (which\nconsumes the already-ordered snapAreaIndices) can run on the scrolling\nthread, where live DOM access is unsafe.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/snap-after-relayout/multiple-aligned-targets/prefer-first-in-tree-order-expected.txt: Progressions\n* Source/WebCore/page/scrolling/ScrollSnapOffsetsInfo.cpp:\n(WebCore::updateSnapOffsetsForScrollableArea):\n\nCanonical link: https://commits.webkit.org/317997@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "ab7cea82fa11083830493260bdccf58b5246ffa0", "subject": "[CSS Scroll Snap] Aligned snap targets are not selected in tree order" }, "317998@main": { "author": "Jer Noble", "avatar": "https://www.gravatar.com/avatar/6d2cde9be23b98223ca964cb3b7813a0?d=identicon\u0026s=64", "cl": "317998@main", "clUrl": "https://commits.webkit.org/317998@main", "description": "rdar://182833486\nhttps://bugs.webkit.org/show_bug.cgi?id=319912\n\nReviewed by Eric Carlson.\n\nAdds LayoutTests for 14 previously-uncovered EME spec behaviors, plus\nmock-CDM plumbing to enable the new invariants and persistence tests.\nWriting the tests surfaced three implementation gaps whose bodies were\nalready commented in as spec steps but never actually written:\n\n- CDMPrivate::getSupportedCapabilitiesForAudioVideoType step 3.11 was\n a bare comment - an audio/* MIME type under videoCapabilities (or\n vice versa) survived instead of being filtered.\n- MockCDMFactory::supportsKeySystem matched case-insensitively; spec\n says Key System strings are case-sensitive.\n- MediaKeySession::updateExpiration was notImplemented(), so\n session.expiration stayed NaN even when a CDM reported an\n expiration.\n\nMock plumbing added to support the new tests: an expirationOnUpdate\nattribute the mock returns in the update() callback, a\nkeyCountForSession(sessionId) introspection method, per-session type\ntracking, differentiated closeSession (retains state for\npersistent-license), and loadSession restoring stored key statuses.\n\n* Source/WebCore/Modules/encryptedmedia/MediaKeySession.cpp:\n(WebCore::MediaKeySession::updateExpiration): Implement per spec.\n\n* Source/WebCore/platform/encryptedmedia/CDMPrivate.cpp:\n(WebCore::CDMPrivate::getSupportedCapabilitiesForAudioVideoType):\nImplement step 3.11 - skip capabilities whose top-level MIME type does\nnot match the requested audio/video type.\n\n* Source/WebCore/testing/MockCDMFactory.h:\n* Source/WebCore/testing/MockCDMFactory.cpp:\n(WebCore::MockCDMFactory::supportsKeySystem): Case-sensitive match.\n(WebCore::MockCDMFactory::keyCountForSession): New.\n(WebCore::MockCDMFactory::sessionType): New.\n(WebCore::MockCDMFactory::removeSessionWithID): Also clear session type.\n(WebCore::MockCDM::sanitizeSessionId): Accept tracked session IDs so\ntests can round-trip close()/load().\n(WebCore::MockCDMInstanceSession::requestLicense): Record session type.\n(WebCore::MockCDMInstanceSession::updateLicense): Pass expirationOnUpdate\nin the callback when set.\n(WebCore::MockCDMInstanceSession::loadSession): Return stored key\nstatuses for tracked sessions.\n(WebCore::MockCDMInstanceSession::closeSession): Retain state for\npersistent-license sessions.\n\n* Source/WebCore/testing/MockCDMFactory.idl:\nAdd expirationOnUpdate attribute and keyCountForSession method.\n\n* LayoutTests/media/encrypted-media/mock-navigator-requestMediaKeySystemAccess.html:\n* LayoutTests/media/encrypted-media/mock-navigator-requestMediaKeySystemAccess-expected.txt:\n* LayoutTests/media/encrypted-media/mock-MediaKeySession-invariants.html: Added.\n* LayoutTests/media/encrypted-media/mock-MediaKeySession-invariants-expected.txt: Added.\n* LayoutTests/media/encrypted-media/mock-MediaKeySession-persistence.html: Added.\n* LayoutTests/media/encrypted-media/mock-MediaKeySession-persistence-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/317998@main", "email": "jer.noble@apple.com", "hash": "c3dc693948c295da745dfa16044aefc49295df80", "subject": "[Testing] Add more mock- tests for EME" }, "317999@main": { "author": "Jer Noble", "avatar": "https://www.gravatar.com/avatar/6d2cde9be23b98223ca964cb3b7813a0?d=identicon\u0026s=64", "cl": "317999@main", "clUrl": "https://commits.webkit.org/317999@main", "description": "rdar://182808868\nhttps://bugs.webkit.org/show_bug.cgi?id=320374\n\nReviewed by Simon Fraser.\n\nIn 316238@main, in order to work around an issue where both YouTube's custom-rendered\nsubtitles and quirk-derived system subtitles were displayed simultanously, YouTube's\nown subtitle divs were hidden with `display:none`. However this broke their ability to\ndetect that subtitles have grown too tall inside the video viewport, and they fail to\nremove those generated subtitles when adding new ones.\n\nSwitch from `display:none` to `visibility:hidden` so that size detection works the way\nYouTube expects, even though the subtitles are not displayed.\n\n* Source/WebCore/Modules/modern-media-controls/media/YouTubeCaptionQuirk.js:\n(CaptionMirror.prototype._handlePresentationModeChanged):\n\nCanonical link: https://commits.webkit.org/317999@main", "email": "jer.noble@apple.com", "hash": "f67b7993605d66a0198231ba0de8a056bdf1ed9d", "subject": "REGRESSION(316238@main): YouTube captions become infinitely tall in iPhone fullscreen" }, "318000@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "318000@main", "clUrl": "https://commits.webkit.org/318000@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320237\nrdar://183168793\n\nReviewed by Youenn Fablet.\n\nWe added a lot of things in macOS 26.4's Network.framework to support WebTransport.\nWe initially needed to soft link optionally while they were being added, then we kept\nand expanded it to support Safari Tech Preview, which was built with the macOS 26.0\nSDK. Now it's built with an SDK that has all the needed pieces, so we can clean up\nthe code. If anything is wrong with this PR, it will cause a binary that doesn't\nlink successfully, so if everything compiles and links it shouldn't change behavior.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebTransport.mm\n\n* Source/WTF/wtf/PlatformHave.h:\n* Source/WebKit/NetworkProcess/cocoa/NetworkSoftLink.h:\n* Source/WebKit/NetworkProcess/cocoa/NetworkSoftLink.mm:\n* Source/WebKit/NetworkProcess/webtransport/NetworkTransportSession.cpp:\n* Source/WebKit/NetworkProcess/webtransport/NetworkTransportSession.h:\n* Source/WebKit/NetworkProcess/webtransport/NetworkTransportStream.cpp:\n* Source/WebKit/NetworkProcess/webtransport/NetworkTransportStream.h:\n* Source/WebKit/NetworkProcess/webtransport/cocoa/NetworkTransportSessionCocoa.mm:\n(WebKit::createParameters):\n(WebKit::NetworkTransportSession::create):\n(WebKit::NetworkTransportSession::initialize):\n(WebKit::NetworkTransportSession::setupDatagramConnection):\n(WebKit::NetworkTransportSession::createStream):\n(WebKit::NetworkTransportSession::terminate):\n(WebKit::NetworkTransportSession::isSessionClosed const):\n(WebKit::NetworkTransportSession::exportKeyingMaterial):\n* Source/WebKit/NetworkProcess/webtransport/cocoa/NetworkTransportStreamCocoa.mm:\n(WebKit::NetworkTransportStream::initializeReadyConnection):\n(WebKit::NetworkTransportStream::cancelReceive):\n(WebKit::NetworkTransportStream::cancelSend):\n* Source/WebKit/Shared/WebPreferencesDefaultValues.cpp:\n(WebKit::defaultWebTransportEnabled):\n* Tools/TestWebKitAPI/Helpers/cocoa/NetworkConnection.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/NetworkConnection.mm:\n(TestWebKitAPI::Connection::abortReads):\n(TestWebKitAPI::Connection::abortWrites):\n(TestWebKitAPI::Connection::setRemoteReceiveErrorHandler):\n(TestWebKitAPI::Connection::setRemoteSendErrorHandler):\n(TestWebKitAPI::ConnectionGroup::drainWebTransportSession):\n* Tools/TestWebKitAPI/Helpers/cocoa/WebTransportServer.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/WebTransportServer.mm:\n(TestWebKitAPI::WebTransportServer::isAvailable): Deleted.\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebTransport.mm:\n(TestWebKitAPI::TEST(WebTransport, ClientBidirectional)):\n(TestWebKitAPI::TEST(WebTransport, ClientBidirectionalBYOB)):\n(TestWebKitAPI::TEST(WebTransport, Datagram)):\n(TestWebKitAPI::TEST(WebTransport, Unidirectional)):\n(TestWebKitAPI::TEST(WebTransport, ServerBidirectional)):\n(TestWebKitAPI::TEST(WebTransport, NetworkProcessCrash)):\n(TestWebKitAPI::TEST(WebTransport, Worker)):\n(TestWebKitAPI::TEST(WebTransport, WorkerAfterNetworkProcessCrash)):\n(TestWebKitAPI::TEST(WebTransport, ServiceWorker)):\n(TestWebKitAPI::CreateStreamsBeforeReady)):\n(TestWebKitAPI::DISABLED_CSP)):\n(TestWebKitAPI::ServerCertificateHashes)):\n(TestWebKitAPI::ServerConnectionTermination)):\n(TestWebKitAPI::BackForwardCache)):\n(TestWebKitAPI::ServerDrain)):\n(TestWebKitAPI::DISABLED_ClientStreamAborts)):\n(TestWebKitAPI::DISABLED_ServerStreamAborts)):\n\nCanonical link: https://commits.webkit.org/318000@main", "email": "achristensen@apple.com", "hash": "ee0c88f3df171e5d47496b2bb4402d0f828537e0", "subject": "Replace most of NetworkSoftLink with HAVE(WEBTRANSPORT)" }, "318001@main": { "author": "Dan Hecht", "avatar": "https://www.gravatar.com/avatar/080f47d912b1b34d0be8293f825d132d?d=identicon\u0026s=64", "cl": "318001@main", "clUrl": "https://commits.webkit.org/318001@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320384\nrdar://183345434\n\nReviewed by Marcus Plutowski.\n\nzeroFillLatchIfMadvZeroIsSupported() probes for kernel MADV_ZERO support by\nmadvise()ing a scratch page, but recorded the result backwards: a successful\nprobe latched the feature off and a failing probe latched it on. It also\nignored errno entirely, so it could not distinguish \"kernel does not\nimplement MADV_ZERO\" (ENOTSUP) from an incidental failure such as CoW\nmemory. The function is a copy of libpas's\npas_page_malloc_zero_fill_latch_if_madv_zero_is_supported(), which gets both\nof these right.\n\nThe effect is a pessimization rather than a correctness bug, since\nvmZeroAndPurge() still checks madvise()'s return value before taking the\nfast path: latching off on a supporting kernel loses the optimization, and\nlatching on for an unsupporting kernel pays a doomed syscall on every call,\nwhich is exactly the overhead the latch exists to avoid. Nothing is\ncurrently affected because BMALLOC_USE_MADV_ZERO is 0 in both arms of its\n\nLatch on success, and on failure only latch off for ENOTSUP, matching libpas.\n\nTesting: ran some JSC stress tests with BMALLOC_USE_MADV_ZERO=1\n\n* Source/bmalloc/bmalloc/VMAllocate.cpp:\n(bmalloc::zeroFillLatchIfMadvZeroIsSupported):\n\nCanonical link: https://commits.webkit.org/318001@main", "email": "dan.hecht@apple.com", "hash": "8b8b3e5ee16cd1d31c62cae86a8a1ad4404b6777", "subject": "[bmalloc] MADV_ZERO support latch is inverted in VMAllocate.cpp" }, "318002@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "318002@main", "clUrl": "https://commits.webkit.org/318002@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320363\n\nReviewed by Antti Koivisto.\n\nFlexLayout, FlexIntegrationUtils and FlexFormattingUtils had accumulated public methods that only their\nown implementations call. Sort out what each of them actually offers its callers.\n\nThe flex item list becomes private to FlexLayout. Its only reader outside the flex algorithm was\nInspectorOverlay, through a RenderFlexibleBox::flexItems() forwarder, so let the overlay collect the\ncontainer's in-flow children itself. It needs them in order-modified document order, since the line-start\nindices it caches during layout are relative to that order, so it repeats the stable sort by used 'order'\nvalue. Three baseline helpers inside FlexLayout were also reading the list back through the renderer\n(flexBox().flexItems()); they now use the member directly, which is what they were doing before the list\nmoved off RenderFlexibleBox in 320317.\n\nThe margin-trim setters lose a layer. FlexIntegrationUtils::addItemAtFlexLineStart and friends were\none-line forwarders whose only callers were the trim functions right above them in the same file, and\nwhich reached FlexLayout by going out through the renderer. Fold them into those callers.\n\nEverything else here is visibility only:\n\n- FlexIntegrationUtils: setTrimmedMarginForChild, invalidateFlexItemContentLogicalWidthsIfNeeded,\n resetAutoMarginsAndLogicalTopInCrossAxis and dirtyPercentHeightDescendantsWithinFlexItem are steps of\n the public operations above them, called from nowhere else.\n- FlexLayout: isInLayout and the three block-size-definiteness accessors only back the percentage\n resolution entry points on the same class. The formatting context reaches the same state through\n FlexLayoutState directly.\n- FlexFormattingUtils: six of the RenderBox-taking overloads are what their FlexLayoutItem siblings\n unwrap to, and callers outside the class hold a FlexLayoutItem. The three that a bare RenderBox does\n reach -- crossAxisExtentForFlexItem, mainAxisExtentForFlexItem and overflowAlignmentForFlexItem, from\n FlexLayout's baseline and static-position helpers -- stay public.\n\nAlso narrow the flex layout state's scope to the formatting context call itself, rather than opening it\nbefore the item list is built. Nothing between the two lays out a flex item, so nothing consults the\nphase there.\n\nNo change in behaviour.\n\n* Source/WebCore/inspector/InspectorOverlay.cpp:\n(WebCore::InspectorOverlay::buildFlexOverlay):\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingUtils.h:\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.cpp:\n(WebCore::LayoutIntegration::FlexIntegrationUtils::trimMainAxisMarginStart):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::trimMainAxisMarginEnd):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::trimCrossAxisMarginStart):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::trimCrossAxisMarginEnd):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::addItemAtFlexLineStart): Deleted.\n(WebCore::LayoutIntegration::FlexIntegrationUtils::addItemAtFlexLineEnd): Deleted.\n(WebCore::LayoutIntegration::FlexIntegrationUtils::addItemOnFirstFlexLine): Deleted.\n(WebCore::LayoutIntegration::FlexIntegrationUtils::addItemOnLastFlexLine): Deleted.\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.h:\n* Source/WebCore/layout/integration/flex/LayoutIntegrationFlexLayout.cpp:\n(WebCore::LayoutIntegration::FlexLayout::layout):\n(WebCore::LayoutIntegration::FlexLayout::flexItemForFirstBaseline):\n(WebCore::LayoutIntegration::FlexLayout::flexItemForLastBaseline):\n(WebCore::LayoutIntegration::FlexLayout::baselineFlexItemInLine):\n(WebCore::LayoutIntegration::FlexLayout::flexItemForFirstBaseline const):\n(WebCore::LayoutIntegration::FlexLayout::flexItemForLastBaseline const):\n(WebCore::LayoutIntegration::FlexLayout::baselineFlexItemInLine const):\n* Source/WebCore/layout/integration/flex/LayoutIntegrationFlexLayout.h:\n(WebCore::LayoutIntegration::FlexLayout::isInLayout const):\n(WebCore::LayoutIntegration::FlexLayout::isFlexBoxBlockSizeDefinite const):\n(WebCore::LayoutIntegration::FlexLayout::isFlexBoxBlockSizeIndefinite const):\n(WebCore::LayoutIntegration::FlexLayout::setFlexBoxBlockSizeIsDefinite):\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n\nCanonical link: https://commits.webkit.org/318002@main", "email": "zalan@apple.com", "hash": "1da6dfcfae3507006ffd02ec8cd72644947b4626", "subject": "[cleanup] Hide the flex formatting context's helper class internals" }, "318003@main": { "author": "Fujii Hironori", "avatar": "https://www.gravatar.com/avatar/ef99cb23f5e5d27977968ca097d9a85f?d=identicon\u0026s=64", "cl": "318003@main", "clUrl": "https://commits.webkit.org/318003@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319941\n\nReviewed by Carlos Garcia Campos.\n\nWPE Platform API wpe_event_touch_new takes only a single touch point. This is\nnot a problem for normal usecases. If two fingers touch the screen, the\napplication calls wpe_event_touch_new twice with a single touch point each\ntime. WPEWebViewPlatform class memorizes all touch points in m_touchEvents\nmember variable.\n\nHowever, this causes two problems for layout tests. Some layout tests expect a\ntouch event with multiple touch points at a time. For example,\nfast/events/touch/touch-target.html has this code.\n\n\u003e eventSender.clearTouchPoints();\n\u003e eventSender.addTouchPoint(50, 150);\n\u003e eventSender.addTouchPoint(50, 250);\n\u003e eventSender.touchStart();\n\nThis should dispatch a touchstart event with two touch points at a time.\nHowever, WPE WebKitTestRunner dispatched two touchstart events because\nwpe_event_touch_new accepts only a single touch point at a time.\n\nThe second problem is that some layout tests don't release all touch points.\nFor example, fast/events/touch/touch-target.html has this code at the end of\nthe test.\n\n\u003e eventSender.releaseTouchPoint(1);\n\u003e eventSender.touchEnd();\n\nOnly the 1st touch point is released. The 0th touch point isn't released. This\ncaused a problme for the next test because WPEWebViewPlatform memorizes touch\npoints in m_touchEvents.\n\nAdded new internal API wpeEventTouchCreateForTesting, wpeEventIsTouchForTesting\nand wpeEventTouchTouchPoints.\n\n* Source/WebKit/UIProcess/API/wpe/WPEWebViewPlatform.cpp:\n(WKWPE::platformTouchPoints):\n(WKWPE::ViewPlatform::handleEvent):\n* Source/WebKit/WPEPlatform/wpe/WPEEvent.cpp:\n(wpe_event_get_modifiers):\n(wpe_event_touch_get_sequence_id):\n(wpeEventTouchCreateForTesting):\n(wpeEventTouchTouchPoints):\n(wpeEventTouchPointsForTesting):\n(wpeEventIsTouchForTesting):\n* Tools/WebKitTestRunner/wpe/EventSenderProxyClientWPE.cpp:\n(WTR::EventSenderProxyClientWPE::sendTouchEvent):\n(WTR::EventSenderProxyClientWPE::touchStart):\n(WTR::EventSenderProxyClientWPE::touchMove):\n(WTR::EventSenderProxyClientWPE::touchEnd):\n(WTR::EventSenderProxyClientWPE::touchCancel):\n(WTR::std::function\u003cbool): Deleted.\n* Tools/WebKitTestRunner/wpe/EventSenderProxyClientWPE.h:\n* LayoutTests/platform/wpe/TestExpectations:\n* Source/WebKit/WPEPlatform/wpe/WPEEventInternal.h: Added.\n\nCanonical link: https://commits.webkit.org/318003@main", "email": "fujii@igalia.com", "hash": "103ad17fab7bb625a285a8f785e7a1bc709ccb6d", "subject": "[WPE Platform] New internal API to create a touch event with multiple touch points" }, "318004@main": { "author": "Aleksei Marchenko", "avatar": "https://www.gravatar.com/avatar/9a469093291c12531caccfcaa6ab73b1?d=identicon\u0026s=64", "cl": "318004@main", "clUrl": "https://commits.webkit.org/318004@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319852\nrdar://182429803\n\nReviewed by Per Arne Vollan.\n\nUnder ENABLE(LOGD_BLOCKING_IN_WEBCONTENT), child processes are denied logd and\nrelay os_log to the UI process. Model #includes the WebContent sandbox profile,\nso it inherited the block but had no relay, silently dropping all os_log from\ncom.apple.WebKit.Model; a direct log-service grant in Model's profile was added\nas a temporary stopgap.\n\nGive Model the relay by sharing it: the child-side setup (initializeLogForwarding\nand registerLogClient — the os_log hook, log prewarming, and signpost forwarding)\nmoves to AuxiliaryProcess and the UI-side re-emit (LogStream, createLogStream,\nlaunch-window XPC handler) to AuxiliaryProcessProxy, leaving only the process name\nand the CreateLogStream message per process.\n\nWith the relay in place, remove the stopgap log service permission from Model's\nsandbox profile.\n\n* Source/WebKit/ModelProcess/ModelProcess.cpp:\n(WebKit::ModelProcess::initializeModelProcess):\n* Source/WebKit/ModelProcess/ModelProcess.h:\n* Source/WebKit/ModelProcess/ModelProcessCreationParameters.h:\n* Source/WebKit/ModelProcess/ModelProcessCreationParameters.serialization.in:\n* Source/WebKit/ModelProcess/cocoa/ModelProcessCocoa.mm:\n(WebKit::ModelProcess::sendCreateLogStreamToParent):\n* Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Model.sb.in:\n* Source/WebKit/Shared/AuxiliaryProcess.h:\n(WebKit::AuxiliaryProcess::sendCreateLogStreamToParent):\n* Source/WebKit/Shared/Cocoa/AuxiliaryProcessCocoa.mm:\n(WebKit::shouldIgnoreLogMessage):\n(WebKit::prewarmLogs):\n(WebKit::registerLogClient):\n(WebKit::AuxiliaryProcess::initializeLogForwarding):\n* Source/WebKit/Shared/LogStream.h:\n* Source/WebKit/Shared/LogStream.mm:\n(WebKit::LogStream::LogStream):\n(WebKit::LogStream::logOnBehalfOfWebContent):\n(WebKit::LogStream::create):\n(WebKit::LogStream::didReceiveInvalidMessage):\n* Source/WebKit/UIProcess/AuxiliaryProcessProxy.h:\n(WebKit::AuxiliaryProcessProxy::didReceiveLogsDuringLaunchForTesting):\n* Source/WebKit/UIProcess/Cocoa/AuxiliaryProcessProxyCocoa.mm:\n(WebKit::AuxiliaryProcessProxy::LogXPCEventHandler::LogXPCEventHandler):\n(WebKit::AuxiliaryProcessProxy::LogXPCEventHandler::handleXPCEvent):\n(WebKit::AuxiliaryProcessProxy::createLogStream):\n(WebKit::AuxiliaryProcessProxy::stopLogStream):\n* Source/WebKit/UIProcess/Cocoa/WebProcessProxyCocoa.mm:\n(WebKit::WebProcessProxy::platformDestroy):\n(WebKit::WebProcessProxy::xpcEventHandler const):\n(WebKit::WebProcessProxy::didReceiveLogsDuringLaunchForTesting):\n(WebKit::WebProcessProxy::createLogStream):\n(WebKit::WebProcessProxy::stopLogStream): Deleted.\n(WebKit::WebProcessProxy::WebProcessXPCEventHandler::handleXPCEvent): Deleted.\n(WebKit::WebProcessProxy::WebProcessXPCEventHandler::WebProcessXPCEventHandler): Deleted.\n* Source/WebKit/UIProcess/Launcher/cocoa/ProcessLauncherCocoa.mm:\n(WebKit::ProcessLauncher::tryFinishLaunchingProcess):\n* Source/WebKit/UIProcess/Model/ModelProcessProxy.cpp:\n(WebKit::ModelProcessProxy::modelProcessExited):\n* Source/WebKit/UIProcess/Model/ModelProcessProxy.h:\n* Source/WebKit/UIProcess/Model/ModelProcessProxy.messages.in:\n* Source/WebKit/UIProcess/Model/cocoa/ModelProcessProxyCocoa.mm:\n(WebKit::ModelProcessProxy::updateModelProcessCreationParameters):\n(WebKit::ModelProcessProxy::xpcEventHandler const):\n* Source/WebKit/UIProcess/WebProcessProxy.h:\n* Source/WebKit/WebProcess/WebProcess.h:\n* Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm:\n(WebKit::WebProcess::accessibilityFocusedUIElement):\n\nCanonical link: https://commits.webkit.org/318004@main", "email": "aleksei@apple.com", "hash": "64e4e8a7d098e5535b6f07ce2f0efec70fa6395a", "subject": "Add log messaging relay to the Model Process" }, "318005@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "318005@main", "clUrl": "https://commits.webkit.org/318005@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320198\nrdar://183148186\n\nReviewed by Jer Noble.\n\nSince 2cfd74cacfc8 switched AudioFileReader from AudioToolbox's AudioFile to an\nAVAssetReader, decoding is conditional on WebKit resolving a MIME type itself:\ndemuxAVFData() first sniffs the content, then falls back to AudioFile's file-type\ndetection, and returns nullptr if neither produces one.\n\nPer the MIME sniffing spec, an ISO-BMFF file is only reported as MP4 when the major\nbrand or one of the compatible brands in the ftyp box begins with \"mp4\". Plenty of\nvalid M4A files carry other brands -- \"M4A \"/\"isom\"/\"iso2\" is what CoreAudio and\nseveral common encoders emit -- so sniffing yields nothing for them. The fallback\nthen fails too, because mimeTypeFor() has no case for the ISO-BMFF file types and\ndrops through to default:, logging a fault and returning an empty string. Decoding\nis rejected with EncodingError before AVFoundation is ever given the data.\n\nHandle kAudioFileMPEG4Type, kAudioFileM4AType and kAudioFileM4BType as \"audio/mp4\",\nand kAudioFile3GPType and kAudioFile3GP2Type as \"audio/3gpp\" and \"audio/3gpp2\"\nrespectively. AudioFile has already parsed the container to determine these, so its\nanswer is authoritative where the sniffer's brand check is not.\n\nThe new test uses a one-second mono AAC-LC M4A whose brands are \"M4A \"/\"iso2\"/\"isom\"\nand which therefore fails to sniff as MP4. Frame count is compared with a tolerance\nbecause the number of frames trimmed for encoder delay is decoder-dependent.\n\n* Source/WebCore/platform/audio/cocoa/AudioFileReaderCocoa.mm:\n(WebCore::mimeTypeFor):\n* LayoutTests/webaudio/decode-audio-data-m4a-no-mp4-brand-expected.txt: Added.\n* LayoutTests/webaudio/decode-audio-data-m4a-no-mp4-brand.html: Added.\n* LayoutTests/webaudio/resources/media/m4a-no-mp4-brand.m4a: Added.\n\nCanonical link: https://commits.webkit.org/318005@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "c3244cf76da410fe534f880686d375e1390bbbfd", "subject": "REGRESSION (iOS 27 beta): AudioContext.decodeAudioData() fails with EncodingError on valid AAC/M4A file containing an edit list" }, "318006@main": { "author": "Robert Jenner", "avatar": "https://www.gravatar.com/avatar/05a1bd874251a1f64c7b6a0ed8120640?d=identicon\u0026s=64", "cl": "318006@main", "clUrl": "https://commits.webkit.org/318006@main", "description": "rdar://178546498\n\nUnreviewed rebaseline.\n\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/ios/imported/w3c/web-platform-tests/url/IdnaTestV2.any-expected.txt:\n* LayoutTests/platform/mac-sequoia-wk2/imported/w3c/web-platform-tests/url/IdnaTestV2.any-expected.txt: Copied from LayoutTests/platform/ios/imported/w3c/web-platform-tests/url/IdnaTestV2.any-expected.txt.\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318006@main", "email": "jenner@apple.com", "hash": "58a67eda16202fab2a8286f4b6bfb15fdcd256cc", "subject": "[REBASELINE]PROGRESSION(iOS 26.5): [ iOS ] imported/w3c/web-platform-tests/url/IdnaTestV2.any.html is a constant text failure" }, "318007@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "318007@main", "clUrl": "https://commits.webkit.org/318007@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320162\n\nReviewed by Brady Eidson.\n\nWebNotificationManagerProxy::providerDidCloseNotifications() iterates over the\narray of notification identifiers passed by the notification provider and closes\neach one. For a persistent (service worker) notification, it dispatched the close\nevent to the service worker and then did `return;` instead of `continue;`, which\nhad two consequences:\n\n- Any notification identifiers appearing after the first persistent notification\n in the batch were never processed: they were not closed and no\n DidCloseNotifications message was sent for them.\n- The persistent notification had already been removed from m_notifications via\n take(), but the early return skipped removing its entry from\n m_globalNotificationMap, leaving a stale identifier mapping behind.\n\nEvery other skip case in the same loop already uses `continue;`; this one should\ntoo. Replace the `return;` with `continue;`.\n\nThe existing TestNotificationProvider could only close a single notification per\nprovider callback (it tracked one pending notification and built a one-element\narray), so the batch path was never exercised. Extend it to remember every shown\nnotification and add simulateMultipleNotificationsClose(), which closes them all\nin a single WKNotificationManagerProviderDidCloseNotifications() call. The\nnow-redundant single m_pendingNotification member is removed and the existing\nsimulateNotificationClick()/simulateNotificationClose() helpers are reimplemented\non top of m_pendingNotifications.\n\nAdd a regression test that shows two persistent notifications, closes them in one\nprovider callback, and verifies both fire a notificationclose event.\n\nTest: PushAPI.fireMultipleNotificationCloseEvents\n\n* Source/WebKit/UIProcess/Notifications/WebNotificationManagerProxy.cpp:\n(WebKit::WebNotificationManagerProxy::providerDidCloseNotifications):\n* Tools/TestWebKitAPI/Helpers/TestNotificationProvider.cpp:\n(TestWebKitAPI::TestNotificationProvider::~TestNotificationProvider):\n(TestWebKitAPI::TestNotificationProvider::showWebNotification):\n(TestWebKitAPI::TestNotificationProvider::simulateNotificationClick):\n(TestWebKitAPI::TestNotificationProvider::simulateNotificationClose):\n(TestWebKitAPI::TestNotificationProvider::simulateMultipleNotificationsClose):\n* Tools/TestWebKitAPI/Helpers/TestNotificationProvider.h:\n(TestWebKitAPI::TestNotificationProvider::pendingNotificationCount const):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/PushAPI.mm:\n(-[CountNotificationCloseMessageHandler userContentController:didReceiveScriptMessage:]):\n((PushAPI, fireMultipleNotificationCloseEvents)):\n\nCanonical link: https://commits.webkit.org/318007@main", "email": "cdumez@apple.com", "hash": "e64287e8977f5c4445ef74621f35416737f28aa6", "subject": "providerDidCloseNotifications() stops closing notifications after the first persistent one" }, "318008@main": { "author": "David Kilzer", "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64", "cl": "318008@main", "clUrl": "https://commits.webkit.org/318008@main", "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=320366\u003e\n\u003crdar://183330983\u003e\n\nReviewed by Richard Robinson.\n\nLink `_WebKit_SwiftUI.framework` into the `TestWebKitAPI` target. The\ntarget's Swift module imports both `WebKit` and `SwiftUI`, which pulls\nin the `_WebKit_SwiftUI` cross-import overlay, so the module's Swift\ndependency scan requires the overlay framework to be linked. Without\nit, the build emits a warning that the `TestWebKitAPI` module is\nmissing a dependency on `_WebKit_SwiftUI`. The sibling\n`TestWebKitAPIBundle` target already links it.\n\nNo new tests since this change is not directly testable.\n\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/318008@main", "email": "ddkilzer@apple.com", "hash": "906987bb68bf5bff9a31b82f4eaa18cfb9d553a2", "subject": "[TestWebKitAPI] Fix missing dependency on _WebKit_SwiftUI for the TestWebKitAPI Swift module" }, "318009@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "318009@main", "clUrl": "https://commits.webkit.org/318009@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=280613\nrdar://137422489\n\nReviewed by Sammy Gill.\n\nThis patch aligns WebKit with Blink / Chromium.\n\nPer CSS Grid Level 2 [1], a subgrid \"acts as if it was completely empty\nfor track sizing purposes in the subgridded dimension\" and \"its track\nsizes are governed by the parent grid.\" So a subgrid must not contribute\nits own gap to that axis. WebKit did, twice, overflowing a\nmax-width-constrained parent and any item spanning the subgrid:\n\n parent grid (max-width) |--------------|\n +---------------------------------------+\n | subgrid [t0].gap.[t1].gap.[t2]... ----+--\u003e overflow: + 12 x 10rem\n +---------------------------------------+ (subgrid's own gap, wrongly\n tracks governed by parent --+ added on top of parent tracks)\n\n1. computeTrackSizesForIndefiniteSize() unconditionally added\n guttersSize() to the container's min/max-content width. In a\n subgridded axis this injected the subgrid's own gap (13 inherited\n tracks, gap: 10rem -\u003e +12 x 10rem), forcing the parent wider than its\n containing block. Fix: skip gutters when isSubgrid(direction).\n\n2. gridAreaBreadthForGridItemIncludingAlignmentOffsets() used\n tracks[end-1]-\u003ebaseSize(). To realize [1]'s rule that \"half the\n difference between the subgrid's gutters and its parent grid's\n gutters is applied as an extra layer of (potentially negative)\n margin,\" copyUsedTrackSizesForSubgrid() stores negative base sizes;\n baseSize() clamps them to zero, overstating the breadth. Fix: use\n unclampedBaseSize(), matching populateGridPositionsForDirection().\n\n[1] https://drafts.csswg.org/css-grid-2/#subgrids\n\nTest: imported/w3c/web-platform-tests/css/css-grid/subgrid/subgrid-own-column-gap-does-not-inflate-intrinsic-width.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/subgrid/subgrid-own-column-gap-does-not-inflate-intrinsic-width-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/subgrid/subgrid-own-column-gap-does-not-inflate-intrinsic-width.html: Added.\n* Source/WebCore/rendering/RenderGrid.cpp:\n(WebCore::RenderGrid::computeTrackSizesForIndefiniteSize const):\n(WebCore::RenderGrid::gridAreaBreadthForGridItemIncludingAlignmentOffsets const):\n\nCanonical link: https://commits.webkit.org/318009@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "9bb7a30a2ff78ca1732dd096e6c14c054677f615", "subject": "Subgrid with large column-gap overflows max-width-constrained parent" } }, "date": "2026-07-27", "days": 1, "generatedAt": "2026-07-27T22:05:58Z", "markdown": "## Highlights\n- **Rendering** Subgrid now respects max-width constraints even with large column gaps, fixing a nasty overflow case in nested layouts. [commit 318009@main](https://commits.webkit.org/318009@main)\n- **Media** Web Audio decoding stops rejecting valid AAC/M4A files with edit lists on iOS 27 beta, unbreaking real-world audio pipelines. [commit 318005@main](https://commits.webkit.org/318005@main)\n- **Media** WebRTC AV1 is now enabled by default on Cocoa, expanding modern codec coverage for real-time media apps. [commit 317986@main](https://commits.webkit.org/317986@main)\n- **DevTools** Site-isolated Web Inspector gained Network.loadResource, closing a real protocol gap for remote resource inspection. [commit 317996@main](https://commits.webkit.org/318996@main)\n- **DevTools** Site-isolated Web Inspector also added Network.getSerializedCertificate, improving certificate inspection in split-process debugging. [commit 317989@main](https://commits.webkit.org/317989@main)\n- **Networking** Service workers can now access stream upload data, a meaningful capability bump for streaming request handling. [commit 317964@main](https://commits.webkit.org/317964@main)\n- **Security** DeviceIdHashSaltStorage now enforces the validated salt length, tightening identifier hashing behavior. [commit 317965@main](https://commits.webkit.org/317965@main)\n- **Web Platform** HTML elements now support external and data: URL filter references, improving SVG/CSS filter interoperability. [commit 317991@main](https://commits.webkit.org/317991@main)\n- **UI** Base select styling got a quality pass, making default form controls look less rough out of the box. [commit 317980@main](https://commits.webkit.org/317980@main)\n\n## What landed by area\n\n### Audio and Web Audio\n- **Media** RemoteAudioDestination now outputs silence instead of stale ring-buffer data on underrun, fixing audible corruption. [commit 317968@main](https://commits.webkit.org/317968@main)\n- **Media** OfflineAudioContext no longer hangs when noise injection meets feedback cycles in the graph. [commit 317950@main](https://commits.webkit.org/317950@main)\n- **Media** OscillatorNode now honors sub-sample start time with a-rate automation instead of starting out of phase. [commit 317953@main](https://commits.webkit.org/317953@main)\n- **Media** exponentialRampToValueAtTime() keeps precision instead of accumulating error in single precision. [commit 317955@main](https://commits.webkit.org/317955@main)\n- **Media** RealtimeAnalyser stops heap-allocating a temporary FFT buffer on every analysis pass. [commit 317954@main](https://commits.webkit.org/317954@main)\n- **Media** AudioBufferSourceNode now respects actively-processing state when reporting output channel count. [commit 317956@main](https://commits.webkit.org/317956@main)\n- **Media** DelayDSPKernel no longer reads an uninitialized desired delay frame count in k-rate processing. [commit 317951@main](https://commits.webkit.org/317951@main)\n- **Media** OscillatorNode::m_type now gets a safe default initializer on exception-return paths. [commit 317952@main](https://commits.webkit.org/317952@main)\n- **Media** std::log2(AudioSession::bufferSize()) no longer hits undefined behavior when the buffer size is 0. [commit 317949@main](https://commits.webkit.org/317949@main)\n- **Media** registerProcessor() error messages now point at the offending AudioParam instead of the processor name. [commit 317948@main](https://commits.webkit.org/317948@main)\n- **Refactor** AudioNode::scriptExecutionContext() stops using const_cast now that a const overload already exists. [commit 317995@main](https://commits.webkit.org/317995@main)\n- **Refactor** Remove an unused AudioNodeOutput::InputsIterator typedef. [commit 317988@main](https://commits.webkit.org/317988@main)\n- **Refactor** AudioParamTimeline::processLinearRamp() drops a redundant shadowed fillToFrameTrunc computation. [commit 317985@main](https://commits.webkit.org/317985@main)\n- **Refactor** MediaStreamAudioSourceNode::setFormat() no longer assigns m_sourceNumberOfChannels twice. [commit 317958@main](https://commits.webkit.org/317958@main)\n- **Security** AudioNode::connect(AudioParam\u0026, unsigned) now asserts main thread before taking the graph lock. [commit 317957@main](https://commits.webkit.org/317957@main)\n\n### Rendering and layout\n- **Rendering** CSS Scroll Snap now selects aligned snap targets in tree order as expected. [commit 317997@main](https://commits.webkit.org/317997@main)\n- **Rendering** createContextualFragment() now strips stray html wrappers without leaving nested head/body behind. [commit 317962@main](https://commits.webkit.org/317962@main)\n- **Rendering** SVGLength.value no longer exposes raw negative values for clamped length attributes after setAttribute(). [commit 317963@main](https://commits.webkit.org/317963@main)\n- **Rendering** YouTube captions stop becoming infinitely tall in iPhone fullscreen after a recent regression. [commit 317999@main](https://commits.webkit.org/317999@main)\n- **Rendering** Fullscreen scroll pockets no longer obscure page content. [commit 317992@main](https://commits.webkit.org/317992@main)\n- **Rendering** Grid formatting context no longer crashes when certain tracks become inflexible. [commit 317961@main](https://commits.webkit.org/317961@main)\n- **Rendering** Flex layout internals got another substantial cleanup pass to narrow responsibilities and reduce RenderFlexibleBox baggage. [commit 318002@main](https://commits.webkit.org/318002@main)\n- **Refactor** Flex percentage-resolution definiteness checks moved off RenderFlexibleBox. [commit 317990@main](https://commits.webkit.org/317990@main)\n- **Refactor** LayoutIntegration::FlexLayout now stores the flex layout result instead of unpacking it into members. [commit 317979@main](https://commits.webkit.org/317979@main)\n- **Refactor** Flex item list, painting, hit-testing, and margin trimming moved off RenderFlexibleBox. [commit 317974@main](https://commits.webkit.org/317974@main)\n- **Refactor** updateFlexContainerLogicalHeight moved to FlexIntegrationUtils. [commit 317973@main](https://commits.webkit.org/317973@main)\n- **Refactor** LayoutIntegration::FlexLayout now owns per-layout flex state directly. [commit 317959@main](https://commits.webkit.org/317959@main)\n- **Refactor** FlexFormattingContext now owns FlexIntegrationUtils instead of borrowing it from FlexLayout. [commit 317944@main](https://commits.webkit.org/317944@main)\n- **Perf** Grid formatting context relaxed alignment checks to avoid over-strict behavior. [commit 317976@main](https://commits.webkit.org/317976@main)\n\n### Networking, service workers, and WebTransport\n- **Networking** Most NetworkSoftLink usage was replaced with HAVE(WEBTRANSPORT), simplifying feature gating around WebTransport. [commit 318000@main](https://commits.webkit.org/318000@main)\n- **Networking** nw_webtransport_metadata_copy_sec_protocol_metadata now correctly advertises retained ownership. [commit 317982@main](https://commits.webkit.org/317982@main)\n- **Networking** providerDidCloseNotifications() now keeps closing notifications after the first persistent one instead of stopping early. [commit 318007@main](https://commits.webkit.org/318007@main)\n\n### Media, EME, and streaming\n- **Media** GStreamer MSE AppendPipeline picked up minor fixes, likely reducing rough edges in append processing. [commit 317971@main](https://commits.webkit.org/317971@main)\n- **Media** Legacy EME generateKeyRequest stops returning a bogus destination URL left behind by debug scaffolding. [commit 317970@main](https://commits.webkit.org/317970@main)\n- **Media** Test coverage expanded with more mock-based EME tests. [commit 317998@main](https://commits.webkit.org/317998@main)\n- **Media** Null-check m_currentUserMediaRequest before denial during requestSystemValidation callbacks, preventing a bad failure path. [commit 317969@main](https://commits.webkit.org/317969@main)\n- **Media** Site-isolated audio session activation and NowPlaying now route through a MediaSessionManagerClient. [commit 317977@main](https://commits.webkit.org/317977@main)\n- **Media** A persistent site-isolation media test failure was fixed for audio-session-category-at-most-recent-playback.html. [commit 317945@main](https://commits.webkit.org/317945@main)\n\n### JavaScriptCore, regex, and Wasm\n- **V8** YARR fixed a sticky-pattern optimization bug in dot-star-wrapped expressions. [commit 317983@main](https://commits.webkit.org/317983@main)\n- **V8** YARR also fixed incorrect anchoring when ^ appears inside a parenthesis that can match empty. [commit 317981@main](https://commits.webkit.org/317981@main)\n- **V8** JSC added a fast flag for ToPrimitive(Object) runtime calls. [commit 317978@main](https://commits.webkit.org/317978@main)\n- **Build** generateWasmOpsHeader.py now works in non-UTF-8 environments instead of erroring out. [commit 317960@main](https://commits.webkit.org/317960@main)\n- **Security** libpas fixed MTE_overrideEnablementForJavaScriptCore=true incorrectly disabling MTE. [commit 317947@main](https://commits.webkit.org/317947@main)\n- **V8** Dynamic Code Brand Checks WPT expectations were updated in LayoutTests. [commit 317975@main](https://commits.webkit.org/317975@main)\n\n### DevTools, site isolation, and process plumbing\n- **DevTools** InspectorAuditResourcesObject::getResources() no longer does an O(n^2) reverse lookup. [commit 317967@main](https://commits.webkit.org/317967@main)\n- **Mobile** On iOS with shared process enabled, taps that sometimes failed under site isolation should now land reliably. [commit 317994@main](https://commits.webkit.org/317994@main)\n- **DevTools** The Model Process can now receive relayed log messages, improving observability across process boundaries. [commit 318004@main](https://commits.webkit.org/318004@main)\n- **Refactor** Stream IPC message receivers can now call directly into Swift. [commit 317984@main](https://commits.webkit.org/317984@main)\n\n### Editing, forms, and DOM APIs\n- **UI** Base select appearance was polished to look more intentional and production-ready. [commit 317980@main](https://commits.webkit.org/317980@main)\n- **Security** Pasting with no selection no longer risks a crash from a missing selectedRange() null check. [commit 317946@main](https://commits.webkit.org/317946@main)\n- **Refactor** Editor::Command::execute() fixed a broken re-entrancy check that had become a tautology after layout changes. [commit 317966@main](https://commits.webkit.org/317966@main)\n\n### Platform, WPE, memory, and build\n- **Mobile** WPE added an internal API to construct touch events with multiple touch points. [commit 318003@main](https://commits.webkit.org/318003@main)\n- **Perf** bmalloc fixed inverted MADV_ZERO support latching in VMAllocate.cpp. [commit 318001@main](https://commits.webkit.org/318001@main)\n- **Build** TestWebKitAPI now correctly depends on _WebKit_SwiftUI for the Swift test module. [commit 318008@main](https://commits.webkit.org/318008@main)\n- **Build** The WPE-JSC EWS queue now uses build-webkit instead of build-jsc for no-change builds. [commit 317943@main](https://commits.webkit.org/317943@main)\n- **Build** webkitpy fixed a NameError in Runner.handle() when unknown messages arrive. [commit 317942@main](https://commits.webkit.org/317942@main)\n- **Build** Unreviewed tests gardening landed for 2026-07-27. [commit 317972@main](https://commits.webkit.org/317972@main)\n- **Build** Imported WPT expectations were rebaselined for an iOS 26.5 constant text failure in IdnaTestV2.any.html. [commit 318006@main](https://commits.webkit.org/318006@main)\n\n## Reverts \u0026 Reapplies", "repo": "webkit", "repoDisplay": "WebKit", "rollGroups": [ { "name": "Unreviewed", "count": 2 } ], "since": "2026-07-27", "totals": { "commits": 68, "features": 66, "rolls": 2 }, "until": "2026-07-27" }