{
  "commits": {
    "318010@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "318010@main",
      "clUrl": "https://commits.webkit.org/318010@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=320337\u003e\n\u003crdar://183275236\u003e\n\nReviewed by Yusuke Suzuki.\n\n`WTF::HashTable` and its `Weak*` wrappers provide `removeIf()`, but\n`WTF::RobinHoodHashTable` did not, so the RobinHood-backed\n`HashMap`/`HashSet` variants failed to compile any `removeIf()` call.\nSeveral WebCore sites backed by RobinHood maps therefore collected\nmatching entries into a temporary `Vector` and then removed them in a\nsecond loop.\n\n`RobinHoodHashTable` uses backward-shift deletion rather than tombstones,\nso it cannot reuse `HashTable::removeIf()`: deleting a match shifts a\nfollowing entry into the current slot, so the sweep must re-examine that\nslot, and it must defer `shrink()` (which rehashes) to a single\n`shrinkToBestSize()` at the end.  Factor the backward-shift core of\n`remove()` into `shiftDeleteWithoutShrink()` for `removeIf()` to reuse.\n\nTests: TestWTF.WTF_RobinHoodHashSet.RemoveIf\n       TestWTF.WTF_RobinHoodHashSet.RemoveIfLarge\n       TestWTF.WTF_RobinHoodHashMap.RemoveIf\n       TestWTF.WTF_RobinHoodHashMap.RemoveIfLarge\n\n* Source/WTF/wtf/RobinHoodHashTable.h:\n(WTF::RobinHoodHashTable::shiftDeleteWithoutShrink): Add.\n(WTF::RobinHoodHashTable::remove):\n(WTF::RobinHoodHashTable::removeIf): Add.\n* Source/WebCore/Modules/web-locks/WebLockRegistry.cpp:\n(WebCore::LocalWebLockRegistry::PerOriginRegistry::clientsAreGoingAway):\n* Source/WebCore/dom/TreeScope.cpp:\n(WebCore::TreeScope::removeElementFromPendingSVGResources):\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:\n(WebCore::MediaPlayerPrivateAVFoundationObjC::keyAdded):\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:\n(WebCore::updateTracksOfKind):\n* Tools/TestWebKitAPI/Tests/WTF/RobinHoodHashMap.cpp:\n(TestWebKitAPI::TEST(WTF_RobinHoodHashMap, RemoveIf)): Add.\n(TestWebKitAPI::TEST(WTF_RobinHoodHashMap, RemoveIfLarge)): Add.\n* Tools/TestWebKitAPI/Tests/WTF/RobinHoodHashSet.cpp:\n(TestWebKitAPI::TEST(WTF_RobinHoodHashSet, RemoveIf)): Add.\n(TestWebKitAPI::TEST(WTF_RobinHoodHashSet, RemoveIfLarge)): Add.\n\nCanonical link: https://commits.webkit.org/318010@main",
      "email": "ddkilzer@apple.com",
      "hash": "e1fc460b8f1d82f50a1165573faca85fb9636352",
      "subject": "Add removeIf() to WTF::RobinHoodHashTable and adopt it to simplify remove-matching-entries loops"
    },
    "318011@main": {
      "author": "Yulun Wu",
      "avatar": "https://www.gravatar.com/avatar/9e34d6632f4d926cdf6fe8dce07f9cb7?d=identicon\u0026s=64",
      "cl": "318011@main",
      "clUrl": "https://commits.webkit.org/318011@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319687\n\u003crdar://182532662\u003e\n\nReviewed by Sammy Gill.\n\nThe machinery to resolve percentage/calc() padding for grid items against\ntheir grid area landed in bug 319913. Remove the coverage gate so grid\nitems with percentage/calc() padding use the modern GridFormattingContext\ninstead of falling back to legacy RenderGrid.\n\n* LayoutTests/fast/css-grid-layout/grid-item-with-calc-padding-track-sizing-expected.html: Added.\n* LayoutTests/fast/css-grid-layout/grid-item-with-calc-padding-track-sizing.html: Added.\n* LayoutTests/fast/css-grid-layout/grid-item-with-percent-padding-track-sizing-expected.html: Added.\n* LayoutTests/fast/css-grid-layout/grid-item-with-percent-padding-track-sizing.html: Added.\n* LayoutTests/fast/css-grid-layout/multi-span-content-sized-columns-padding-expected.html: Added.\n* LayoutTests/fast/css-grid-layout/multi-span-content-sized-columns-padding.html: Added.\n* LayoutTests/fast/css-grid-layout/multi-span-content-sized-rows-padding-expected.html: Added.\n* LayoutTests/fast/css-grid-layout/multi-span-content-sized-rows-padding.html: Added.\n* Source/WebCore/layout/integration/grid/LayoutIntegrationGridCoverage.cpp:\n(WebCore::LayoutIntegration::gridLayoutAvoidanceReason):\n(WebCore::LayoutIntegration::printReason):\n\nCanonical link: https://commits.webkit.org/318011@main",
      "email": "yulun_wu@apple.com",
      "hash": "b12061eca549a68aa3bf16de2ba53484754fec65",
      "subject": "[GFC] Remove GridItemHasPercentOrCalcPadding avoidance reason"
    },
    "318012@main": {
      "author": "Dana Estra",
      "avatar": "https://www.gravatar.com/avatar/bb57a3e383fc407cd4b341aeef87d877?d=identicon\u0026s=64",
      "cl": "318012@main",
      "clUrl": "https://commits.webkit.org/318012@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320205\nrdar://183151333\n\nReviewed by Eric Carlson.\n\nThe WebVTT positioning algorithm (7.2. Processing cue settings, step 10) asks that\nwhen the snap-to-lines flag is false and a cue is overlapped with another, the\nrenderer moves the cue in the direction (up or down if horizontal, left or right\nif vertical) that renders it the shortest distance from its original placement by\nthe VTT author.\n\nThe spec describes a different algorithm when snap-to-lines is true. In this case, the\nrenderer should first try moving the cue up (or to the left if vertical), and if the\nedge of the video is hit before finding a non-overlapping position, then try again in the\nopposite direction. Hence, when snap-to-lines is true, the cue is always moved up if there\nis open space above regardless if there is a closer spot below.\n\nWebKit's implementation of the snap-to-line == false path is incorrect because it only tries\nmoving the cue down if moving it up was unsuccessful. This patch changes it to check both\ndirections and to move the cue the shortest distance to avoid collision.\n\nAlso fixed bug in cues_overlapping_partially_move_down.html and marked it as passing. The test\nincorrectly treated default line alignment as \"center\", when the spec states it should be \"start.\"\n\n* LayoutTests/TestExpectations:\n* Source/WebCore/rendering/RenderVTTCue.cpp:\n(WebCore::RenderVTTCue::findNonOverlappingPosition const):\n* LayoutTests/imported/w3c/web-platform-tests/webvtt/rendering/cues-with-video/processing-model/2_cues_overlapping_partially_move_down-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/webvtt/rendering/cues-with-video/processing-model/2_cues_overlapping_partially_move_down-ref.html:\n\nCanonical link: https://commits.webkit.org/318012@main",
      "email": "destra@apple.com",
      "hash": "75881e26cd3acd585ac300d8add22a1fd1c826ef",
      "subject": "WebVTT cue overlap avoidance algorithm should always move cue shortest possible distance when snap-to-lines is false"
    },
    "318013@main": {
      "author": "Carlos Alberto Lopez Perez",
      "avatar": "https://www.gravatar.com/avatar/05326c1dbe06f486e884975e73f25179?d=identicon\u0026s=64",
      "cl": "318013@main",
      "clUrl": "https://commits.webkit.org/318013@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320402\n\nReviewed by Nikolas Zimmermann.\n\nThe EWS was failing to query the results database for the GTK and WPE ports due to a\nmismatch on the port name. The post-commit bots uploading the results where using all\nupper-case for the platform name but the EWS bots were trying to query those results\nusing lowercase (because lowercase is the default on EWS config.json file) and that\ncode runs on the EWS server, but on the post-commit bots the port name is decided\nby the webkit tooling that runs on the worker rather than by the buildbot server.\n\nMore specifically on the worker (post-commit) when uploading the info the uppercase\nname is set by computeFullConfiguration() in run-javascriptcore-tests, and in\nwebkitpy at port.configuration_for_upload() for api and layout tests.\n\nSo this was causing that all the queries from the EWS to the results DB were\nfailing with error (HTTP 400) for GTK and WPE.\n\nFix this by adding a function platform_for_query() that ensures to return the\nupper case name for GTK and WPE when doing the queries to results.webkit.org\n\n* Tools/CISupport/ews-build/results_db.py:\n(ResultsDatabase):\n(ResultsDatabase.platform_for_query):\n* Tools/CISupport/ews-build/steps.py:\n(RunJavaScriptCoreTests.filter_failures_using_results_db):\n(RunWebKitTests.filter_failures_using_results_db):\n(RunAPITests.filter_api_test_failures_using_results_db):\n(FindUnexpectedStaticAnalyzerResults.filter_results_using_results_db):\n* Tools/CISupport/ews-build/steps_unittest.py:\n(TestFilterLayoutTestFailuresUsingResultsDB):\n(TestFilterLayoutTestFailuresUsingResultsDB.test_wpe_platform_is_translated_to_uppercase_for_results_db):\n(TestFilterLayoutTestFailuresUsingResultsDB.test_wpe_platform_is_translated_to_uppercase_for_results_db.fake_is_pre_existing):\n\nCanonical link: https://commits.webkit.org/318013@main",
      "email": "clopez@igalia.com",
      "hash": "67c65bcbe9f7bb5139b087c237b2864c2d08abb9",
      "subject": "[WKCI][ews-build.webkit.org] Results database queries fail for the GTK and WPE ports because of using lowercase platform name."
    },
    "318014@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "318014@main",
      "clUrl": "https://commits.webkit.org/318014@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320370\n\nReviewed by Antti Koivisto.\n\nRecording a trimmed margin went out through the renderer and back: the formatting context called\nFlexIntegrationUtils::trimCrossAxisMarginStart, which called an addItemOnFirstFlexLine forwarder next to\nit, which reached FlexLayout through RenderFlexibleBox::flexLayout() to reach a set FlexLayout held. Five\nhops to add an item to a set, leaving the integration layer twice on the way.\n\nPut the sets on FlexLayoutState, which the integration already holds a reference to for the duration of\nthe algorithm, and the recording becomes flexLayoutState().addItemOnFirstFlexLine(...). FlexLayout keeps\nwhat the algorithm produced -- in FlexFormattingContext::Result, alongside the other three things it hands\nback -- because the queries do not all arrive while it is running:\n\n- Before layout: the container sizes itself, and RenderFlexibleBox trims the first and last in-flow\n  child's inline margins so they stay out of its intrinsic widths.\n- During: an item asks as it lays out, which is mid-algorithm, so the sets are still filling in.\n- After: the scrollbar reconciliation relayout runs an item's layoutBlock again, and a flex item can be\n  a subtree layout root on a later pass.\n\nThe pre-layout answer no longer needs storing. It is the first and last in-flow child and nothing else,\nwhich follows from style, so compute it where it is needed instead of keeping a member that\nRenderFlexibleBox has to seed at the right point in layoutBlock and clear at the right time.\ninitializeMarginTrimState and its call site go away with it.\n\nThat also fixes the reset. Clearing lived in initializeMarginTrimState, which layoutBlock only called\nwhen the container had a margin-trim value -- so removing margin-trim from an element left the previous\nlayout's entries in place indefinitely.\n\nWhile here, make FlexLayout's copy of FlexFormattingContext::Result an optional. Assigning an empty\nResult at the start of layout() left readers unable to tell \"the algorithm has not run\" from \"it ran and\nproduced zeroes\", and a flex container can be painted, hit-tested or asked for a baseline before its\nfirst layout.\n\nAlso rename the two functions that build the two different kinds of flex item, since both were called\n\"flex items\": buildFlexItemList produces the ordered list of in-flow children (FlexItemList), and\nbuildFlexLayoutItems produces what the formatting context works on (FlexLayoutItems). The margin\nresolution moves into the latter, so the two walks over the item list become one, and\nprepareFlexItemForPositionedLayout becomes prepareOutOfFlowBoxForPositionedLayout -- its argument is\nexplicitly not a flex item.\n\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.cpp:\n(WebCore::FlexFormattingContext::layout):\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.h:\n* Source/WebCore/layout/formattingContexts/flex/FlexLayoutState.h:\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.cpp:\n(WebCore::LayoutIntegration::FlexIntegrationUtils::trimMainAxisMarginStart):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::trimMainAxisMarginEnd):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::trimCrossAxisMarginStart):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::trimCrossAxisMarginEnd):\n* Source/WebCore/layout/integration/flex/LayoutIntegrationFlexLayout.cpp:\n(WebCore::LayoutIntegration::FlexLayout::prepareOutOfFlowBoxForPositionedLayout):\n(WebCore::LayoutIntegration::FlexLayout::buildFlexLayoutItems):\n(WebCore::LayoutIntegration::FlexLayout::marginTrimItemsBeforeFlexLayout):\n(WebCore::LayoutIntegration::FlexLayout::isFlexItemEligibleForMarginTrim):\n(WebCore::LayoutIntegration::FlexLayout::buildFlexItemList):\n(WebCore::LayoutIntegration::FlexLayout::adjustAllowedLayoutOverflow):\n(WebCore::LayoutIntegration::FlexLayout::layout):\n(WebCore::LayoutIntegration::FlexLayout::firstLineBaseline):\n(WebCore::LayoutIntegration::FlexLayout::lastLineBaseline):\n(WebCore::LayoutIntegration::FlexLayout::flexItemForFirstBaseline):\n(WebCore::LayoutIntegration::FlexLayout::flexItemForLastBaseline):\n(WebCore::LayoutIntegration::FlexLayout::initializeMarginTrimState): Deleted.\n(WebCore::LayoutIntegration::FlexLayout::collectFlexItems): Deleted.\n(WebCore::LayoutIntegration::FlexLayout::prepareFlexItemsAndMargins): Deleted.\n(WebCore::LayoutIntegration::FlexLayout::prepareFlexItemForPositionedLayout): Deleted.\n* Source/WebCore/layout/integration/flex/LayoutIntegrationFlexLayout.h:\n* Source/WebCore/rendering/RenderBlock.cpp:\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(WebCore::RenderFlexibleBox::layoutBlock):\n\nCanonical link: https://commits.webkit.org/318014@main",
      "email": "zalan@apple.com",
      "hash": "5de9040a20f5aec2a2fdb2ae097bcf67561ab82c",
      "subject": "[cleanup] Have the flex algorithm own which margins it trimmed"
    },
    "318015@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "318015@main",
      "clUrl": "https://commits.webkit.org/318015@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320344\nrdar://problem/183363731\n\nReviewed by Pascoe.\n\nCtapHidDriver::continueAfterChannelAllocated() reads the 4-byte channel ID from\npayload[8..11] of the CTAPHID_INIT response after only checking that the payload\nbegins with the requested nonce. spanHasPrefix() merely requires the payload to\nbe at least as long as the 8-byte nonce, and the size assumption was otherwise\nonly enforced by a debug-only ASSERT(payload.size() == kHidInitResponseSize). A\nmalicious or buggy authenticator can therefore return an INIT response whose\npayload matches the nonce prefix but is shorter than kHidInitResponseSize (as\nfew as 8 bytes), causing an out-of-bounds Vector access when reading the channel\nID. Under WebKit's bounds-checked Vector this crashes the UI process.\n\nTreat a too-short response the same as a nonce mismatch: replace the debug\nassertion with a runtime `payload.size() \u003c kHidInitResponseSize` check folded\ninto the existing restart condition, so the transaction is restarted (and\neventually times out) instead of reading past the buffer.\n\nTo make the vulnerable path testable, add a \"short-init-response\" mock HID\nerror. MockHidConnection previously always produced a well-formed\nkHidInitResponseSize-byte INIT response; it now emits a payload consisting of\njust the nonce when this error is configured.\n\nNo new tests, updated http/wpt/webauthn/ctap-hid-failure.https.html.\n\n* LayoutTests/http/wpt/webauthn/ctap-hid-failure.https-expected.txt:\n* LayoutTests/http/wpt/webauthn/ctap-hid-failure.https.html:\n* Source/WebCore/testing/MockWebAuthenticationConfiguration.h:\n* Source/WebCore/testing/MockWebAuthenticationConfiguration.idl:\n* Source/WebKit/Shared/WebCoreArgumentCodersAuth.serialization.in:\n* Source/WebKit/UIProcess/WebAuthentication/Mock/MockHidConnection.cpp:\n(WebKit::MockHidConnection::feedReports):\n* Source/WebKit/UIProcess/WebAuthentication/fido/CtapHidDriver.cpp:\n(WebKit::CtapHidDriver::continueAfterChannelAllocated):\n\nCanonical link: https://commits.webkit.org/318015@main",
      "email": "cdumez@apple.com",
      "hash": "808e77190fcf15156e06761c31e79230b166c8d0",
      "subject": "Out-of-bounds read in CtapHidDriver when a CTAPHID_INIT response is too short"
    },
    "318016@main": {
      "author": "Cole Carley",
      "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64",
      "cl": "318016@main",
      "clUrl": "https://commits.webkit.org/318016@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319924\nrdar://182851267\n\nReviewed by Keith Miller.\n\nThis patch introduces support for Table64 in the BBQ tier. Most of the table\nfunctions in the BBQ tier are just C calls to wasmOperations.h functions, so\na lot of this patch is fixing asserts and argument types when passing values\nfrom BBQ to C++ land.\n\n* JSTests/wasm/stress/table64-bulk.js:\n* JSTests/wasm/stress/table64-call-indirect.js:\n* JSTests/wasm/stress/table64-get-and-set.js:\n* JSTests/wasm/stress/table64-grow-and-size.js:\n* JSTests/wasm/stress/table64-overflow.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table_copy64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table_fill64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table_get64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table_grow64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table_init64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table_set64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table_size64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/address64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/align64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/binary_leb128_64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/bulk64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/call_indirect64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/endianness64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/float_memory64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/load64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/memory64-imports.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/memory64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/memory_copy64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/memory_fill64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/memory_grow64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/memory_init64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/memory_redundancy64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/memory_trap64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/table64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/table_copy64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/table_copy_mixed.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/table_fill64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/table_get64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/table_grow64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/table_init64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/table_set64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/table_size64.wast.js.html:\n* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:\n(JSC::Wasm::BBQJITImpl::BBQJIT::addTableSet):\n(JSC::Wasm::BBQJITImpl::BBQJIT::addTableInit):\n(JSC::Wasm::BBQJITImpl::BBQJIT::addTableSize):\n(JSC::Wasm::BBQJITImpl::BBQJIT::addTableGrow):\n(JSC::Wasm::BBQJITImpl::BBQJIT::addTableFill):\n(JSC::Wasm::BBQJITImpl::BBQJIT::addTableCopy):\n(JSC::Wasm::BBQJITImpl::BBQJIT::addCallIndirect):\n* Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp:\n(JSC::Wasm::BBQJITImpl::BBQJIT::addTableGet):\n* Source/JavaScriptCore/wasm/WasmOperations.cpp:\n(JSC::Wasm::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):\n* Source/JavaScriptCore/wasm/WasmOperations.h:\n* Source/JavaScriptCore/wasm/WasmOperationsInlines.h:\n(JSC::Wasm::tableGet):\n(JSC::Wasm::tableSet):\n(JSC::Wasm::tableInit):\n(JSC::Wasm::tableFill):\n(JSC::Wasm::tableGrow):\n(JSC::Wasm::tableCopy):\n* Source/JavaScriptCore/wasm/WasmTable.cpp:\n(JSC::Wasm::Table::grow):\n* Source/JavaScriptCore/wasm/WasmTable.h:\n(JSC::Wasm::Table::isValidLength):\n\nCanonical link: https://commits.webkit.org/318016@main",
      "email": "ccarley2@apple.com",
      "hash": "d202bedc5ff6a3256f6de16f842ff12a48f0fcac",
      "subject": "[Memory64] Implement Table64 in the BBQ tier"
    },
    "318017@main": {
      "author": "Zak Ridouh",
      "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64",
      "cl": "318017@main",
      "clUrl": "https://commits.webkit.org/318017@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320018\nrdar://182950456\n\nReviewed by Alex Christensen.\n\nUnder Site Isolation the focused frame may run in a different web process\nthan the main frame. setCompositionAsync, setWritingSuggestion,\nconfirmCompositionAsync, and setTextAsync were sent unconditionally to the\nmain-frame process, which has no local focused frame, so IME marked text /\ninline predictions were dropped when the focused element was inside a\ncross-origin iframe. Only committed text (insertText) worked, because\ninsertTextAsync was already routed correctly.\n\nRoute all four to the focused frame's process via\nsendToFocusedOrMainFrameProcess, matching insertTextAsync. The web-process\nhandlers already resolve focusController().focusedOrMainFrame(), so no other\nchange is needed.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::setTextAsync):\n(WebKit::WebPageProxy::setCompositionAsync):\n(WebKit::WebPageProxy::setWritingSuggestion):\n(WebKit::WebPageProxy::confirmCompositionAsync):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::TEST(SiteIsolation, SetMarkedTextInCrossOriginIframe)):\n\nCanonical link: https://commits.webkit.org/318017@main",
      "email": "zakr@apple.com",
      "hash": "3c3952e21f82397959a664ec61174df814dec86b",
      "subject": "[Site Isolation] IME composition is applied to the wrong process for inputs in cross-origin iframes"
    },
    "318018@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "318018@main",
      "clUrl": "https://commits.webkit.org/318018@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320342\nrdar://problem/183363933\n\nReviewed by Pascoe.\n\nCtapAuthenticator::continueMakeCredentialAfterResponseReceived() dereferenced\noptions.authenticatorSelection with operator-\u003e when handling a\nCTAP2_ERR_KEYSTORE_FULL response, without first checking that the optional was\nengaged. authenticatorSelection is a spec-optional dictionary\n(std::optional\u003cAuthenticatorSelectionCriteria\u003e) that is empty whenever a page\ncalls navigator.credentials.create() without it, and every other access in this\nfile guards it with `options.authenticatorSelection \u0026\u0026`. As a result, a page that\nomits authenticatorSelection and talks to an authenticator whose key store is\nfull would crash the UI process (a libc++ hardening assertion under the bounds-/\nvalue-checked optional).\n\nGuard the access with the boolean form of the optional, matching the sibling\ncheck in continueMakeCredentialAfterCheckExcludedCredentials(). When\nauthenticatorSelection is absent the code now falls through to the default\n\"resident key not required\" path, marks the key store full, retries the request\nonce, and eventually times out instead of crashing.\n\nTest: http/wpt/webauthn/public-key-credential-create-failure-hid-keystore-full-no-selection.https.html\n\n* LayoutTests/http/wpt/webauthn/public-key-credential-create-failure-hid-keystore-full-no-selection.https-expected.txt: Added.\n* LayoutTests/http/wpt/webauthn/public-key-credential-create-failure-hid-keystore-full-no-selection.https.html: Added.\n* Source/WebKit/UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp:\n(WebKit::CtapAuthenticator::continueMakeCredentialAfterResponseReceived):\n\nCanonical link: https://commits.webkit.org/318018@main",
      "email": "cdumez@apple.com",
      "hash": "f1fe25b43b64a779250e57669cab8d4cf4c78278",
      "subject": "Null std::optional dereference in CtapAuthenticator when a full key store is reported without authenticatorSelection"
    },
    "318019@main": {
      "author": "Zak Ridouh",
      "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64",
      "cl": "318019@main",
      "clUrl": "https://commits.webkit.org/318019@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320008\nrdar://182947071\n\nReviewed by Alex Christensen.\n\nUnder Site Isolation the focused frame may live in a different web process\nthan the main frame. insertDictatedTextAsync (when the dictation carries\nalternatives) and replaceDictatedText were sent unconditionally to the\nmain-frame process, which has no local focused frame, so dictated text and\nits alternatives were dropped when the focused element was inside a\ncross-origin iframe.\n\nRoute both to the focused frame's process via sendToProcessContainingFrame,\nmatching the sibling insertTextAsync. The empty-alternatives path already\ndelegated to insertTextAsync and is unchanged.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n\n* Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm:\n(WebKit::WebPageProxy::insertDictatedTextAsync):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n* Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm:\n(WebKit::WebPageProxy::replaceDictatedText):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, InsertDictatedTextWithAlternativesInCrossOriginIframe)):\n(TestWebKitAPI::(SiteIsolation, ReplaceDictatedTextInCrossOriginIframe)):\n\nCanonical link: https://commits.webkit.org/318019@main",
      "email": "zakr@apple.com",
      "hash": "65d380f3ec1fd7169c94a6dc1626d0e86d3f1db0",
      "subject": "[Site Isolation] Dictation is applied to the wrong process for inputs in cross-origin iframes"
    },
    "318020@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "318020@main",
      "clUrl": "https://commits.webkit.org/318020@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=315361\u003e\n\u003crdar://177718372\u003e\n\nReviewed by Zak Ridouh.\n\nThe libwebrtc project historically had no Xcode target compiling its\n`*_unittest.cc` files, so any regression tests that were added had no\nway to be run.  Add a `webrtc_unittests` target that compiles them, and\nwrap it in a `Unit Tests` aggregate target so future per-folder splits\ncan be aggregated without churning callers' schemes.\n\nRunning tests currently requires building with\n`ENABLE_LIBFUZZER=YES ENABLE_ADDRESS_SANITIZER=YES`.  The LIBFUZZER flag\nnullifies both `EXPORTED_SYMBOLS_FILE` and `WEBRTC_ALLOWABLE_CLIENTS` so\nthe test binary can link unrestricted against `libwebrtc.dylib` without\nper-symbol visibility annotations or changing the allowable-client list.\n\nAdd stubs for three upstream sources (`test_audio_device.cc`,\n`objc_codec_factory_helper.mm`, `dav1d_decoder.cc`) in a new\n`webrtc_unittests_stubs.cc` because their compile-time dependencies\nare absent from the WebKit tree: `AudioDeviceModuleImpl` is platform\ncode not in WebKit's API, the ObjC codec helper requires the iOS-only\n`sdk/objc/components/video_codec/` headers, and `dav1d_decoder.cc`\nneeds the dav1d project from `Source/WebCore/PAL/ThirdParty/dav1d`.\n\nExclude the upstream test sources that cannot compile or link in the\nWebKit tree via `EXCLUDED_SOURCE_FILE_NAMES`, grouped into one variable\nper missing dependency and documented in `webrtc_unittests.xcconfig`.\nThe exclusions matter beyond compilation: without the audio-resource\ngroup the first audio test trips a fatal `Check failed: fp_*` in\n`input_audio_file.cc` and aborts the entire binary, taking every\nsubsequent unrelated test with it.\n\n* Source/ThirdParty/libwebrtc/Configurations/webrtc_unittests.xcconfig: Add.\n* Source/ThirdParty/libwebrtc/Source/third_party/json/include/json/json.h:\n* Source/ThirdParty/libwebrtc/Source/webrtc/p2p/test/fake_port_allocator.h:\n* Source/ThirdParty/libwebrtc/Source/webrtc/pc/data_channel_integrationtest.cc:\n* Source/ThirdParty/libwebrtc/Source/webrtc/pc/peer_connection_integrationtest.cc:\n* Source/ThirdParty/libwebrtc/Source/webrtc/pc/peer_connection_stability_integrationtest.cc:\n* Source/ThirdParty/libwebrtc/Source/webrtc/pc/rtc_stats_collector_unittest.cc:\n* Source/ThirdParty/libwebrtc/Source/webrtc/pc/rtc_stats_integrationtest.cc:\n* Source/ThirdParty/libwebrtc/Source/webrtc/pc/rtp_sender_receiver_unittest.cc:\n* Source/ThirdParty/libwebrtc/Source/webrtc/pc/slow_peer_connection_integration_test.cc:\n* Source/ThirdParty/libwebrtc/Source/webrtc/pc/test/integration_test_helpers.cc:\n* Source/ThirdParty/libwebrtc/Source/webrtc/pc/webrtc_unittests_main.cc: Add.\n* Source/ThirdParty/libwebrtc/Source/webrtc/pc/webrtc_unittests_stubs.cc: Add.\n* Source/ThirdParty/libwebrtc/Source/webrtc/stats/rtc_stats_unittest.cc:\n* Source/ThirdParty/libwebrtc/libwebrtc.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/318020@main",
      "email": "ddkilzer@apple.com",
      "hash": "204a56f0f2d37a71d3843b59b30a0fd011b91134",
      "subject": "[libwebrtc] Build upstream unit tests using new `Unit Tests` aggregate target"
    },
    "318021@main": {
      "author": "Yijia Huang",
      "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64",
      "cl": "318021@main",
      "clUrl": "https://commits.webkit.org/318021@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320393\nrdar://183349883\n\nReviewed by Yusuke Suzuki.\n\nstringCopySameType() copies a string's bytes into the output buffer while\nchecking for characters that need JSON escaping ('\"', '\\', and control\ncharacters). It had a scalar byte-at-a-time fallback and a 16-byte SIMD fast\npath, but nothing in between, so strings shorter than 16 bytes always took\nthe scalar loop.\n\nAdd an intermediate tier for 8-15 byte strings: a SWAR (SIMD-within-a-register)\ncheck that packs 8 bytes into one 64-bit word and tests all of them for\nescapable characters at once using plain integer arithmetic. It mirrors the\nexisting 16-byte tier's overlapping-tail-read technique, so it never reads or\nwrites outside the string's own bounds.\n\nTest: Tools/TestWebKitAPI/Tests/WTF/MathExtras.cpp\nCanonical link: https://commits.webkit.org/318021@main",
      "email": "yijia_huang@apple.com",
      "hash": "656d3c36830f999c3dee135b2fc80e7a3e374128",
      "subject": "[JSC] Add an 8-byte SWAR fast path to JSON.stringify's stringCopySameType for short strings"
    },
    "318022@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "318022@main",
      "clUrl": "https://commits.webkit.org/318022@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320258\nrdar://183182586\n\nReviewed by Yijia Huang.\n\nThis patch extends first-character fast-fail filter in DFG / FTL.\n\n1. Inverted character class is supported. Just collecting the set\n   and inverted set is merged.\n2. Add filter for sticky RegExp#test(string) pattern as the same to\n   RegExp#exec(string).\n3. Move BitSet to RegExp so we can compile and store it per-RegExp cell\n   basis. Concurrently compiling and storing the data and we can reuse\n   this by anchoring RegExp cell from DFG::Graph.\n4. Expand first-character collection into parentheses, like ((^a)|(^b)).\n\nTests: JSTests/stress/regexp-anchored-first-char-filter-inverted-class-and-groups.js\n       JSTests/stress/regexp-first-char-filter-anchoring-soundness.js\n       JSTests/stress/regexp-test-sticky-first-char-filter.js\n\n* JSTests/stress/regexp-anchored-first-char-filter-inverted-class-and-groups.js: Added.\n(shouldBe):\n(step):\n* JSTests/stress/regexp-first-char-filter-anchoring-soundness.js: Added.\n(shouldBe):\n(check):\n(dotStarWrapped):\n(genuinelyAnchored):\n* JSTests/stress/regexp-test-anchored-first-char-filter.js:\n* JSTests/stress/regexp-test-sticky-first-char-filter.js: Added.\n(shouldBe):\n(shouldThrow):\n(step):\n(const.reGrp):\n(check):\n* Source/JavaScriptCore/dfg/DFGCommonData.h:\n* Source/JavaScriptCore/dfg/DFGGraph.cpp:\n(JSC::DFG::Graph::tryGetConstantRegExpFirstCharacterBitmap):\n(JSC::DFG::Graph::regExpFirstCharacterBitmap):\n* Source/JavaScriptCore/dfg/DFGGraph.h:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:\n(JSC::DFG::SpeculativeJIT::emitRegExpAnchoredFirstCharacterFilterGuards):\n(JSC::DFG::SpeculativeJIT::emitRegExpStickyFirstCharacterFilterGuards):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n* Source/JavaScriptCore/runtime/RegExp.cpp:\n(JSC::RegExp::estimatedSize):\n(JSC::RegExp::firstCharacterBitmap):\n* Source/JavaScriptCore/runtime/RegExp.h:\n* Source/JavaScriptCore/yarr/YarrPattern.cpp:\n(JSC::Yarr::FirstCharacterBitmapBuilder::collectLatin1Members):\n(JSC::Yarr::FirstCharacterBitmapBuilder::addCharacterClass):\n(JSC::Yarr::FirstCharacterBitmapBuilder::addInvertedCharacterClass):\n(JSC::Yarr::FirstCharacterBitmapBuilder::addTerm):\n(JSC::Yarr::FirstCharacterBitmapBuilder::addAlternative):\n(JSC::Yarr::FirstCharacterBitmapBuilder::addDisjunction):\n(JSC::Yarr::computeFirstCharacterBitmap):\n(JSC::Yarr::computeStickyFirstCharacterBitmap): Deleted.\n(JSC::Yarr::computeAnchoredFirstCharacterBitmap): Deleted.\n* Source/JavaScriptCore/yarr/YarrPattern.h:\n* Source/WTF/wtf/BitSet.h:\n\nCanonical link: https://commits.webkit.org/318022@main",
      "email": "ysuzuki@apple.com",
      "hash": "1e43057f135a31c9c9c893ab4efe2874cef8e426",
      "subject": "[JSC][YARR] Extend first-character filter more"
    },
    "318023@main": {
      "author": "Elliott Williams",
      "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64",
      "cl": "318023@main",
      "clUrl": "https://commits.webkit.org/318023@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320407\nrdar://183367343\n\nUnreviewed CI fix. We already fixed this for Xcode in 317445@main, but I\ndidn't realize CMake needed it too.\n\n* Tools/Scripts/measure-build-time:\n(get_args):\n\nCanonical link: https://commits.webkit.org/318023@main",
      "email": "emw@apple.com",
      "hash": "578c895afd5329d97a025ee5b3824c5850bff5b6",
      "subject": "[Build perf] CMake benchmark should target SDK version, not host OS version"
    },
    "318024@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "318024@main",
      "clUrl": "https://commits.webkit.org/318024@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320352\n\nReviewed by Abrar Rahman Protyasha.\n\nkeyWindow() initialized its index to allWindows.size() and only decremented\nit after indexing, so the first loop iteration accessed allWindows[size()] —\none past the end of the Vector. WTF::Vector::operator[] bounds-checks via its\ndefault CrashOnOverflow handler, so this hits CRASH() (in both debug and\nrelease) whenever keyWindow() runs with a non-empty window list. The last\nelement (index 0) was also never examined.\n\nDecrement the index before indexing so the loop walks the valid range\n[size()-1 .. 0], matching the Mac implementation in\nWebKitTestRunnerWindow::_WTR_keyWindow.\n\n* Tools/WebKitTestRunner/ios/PlatformWebViewIOS.mm:\n(WTR::PlatformWebView::keyWindow):\n\nCanonical link: https://commits.webkit.org/318024@main",
      "email": "cdumez@apple.com",
      "hash": "d6603cdc953449101221fc35928e66efa2f8601c",
      "subject": "WebKitTestRunner: Fix out-of-bounds read in iOS PlatformWebView::keyWindow()"
    },
    "318025@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "318025@main",
      "clUrl": "https://commits.webkit.org/318025@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=320319\u003e\n\u003crdar://183260812\u003e\n\nReviewed by Dan Glastonbury.\n\nThe constructor initializes only `m_shaderModule`, leaving the\n`m_stage` enum member with an indeterminate value.  `validate()`\nassigns `m_stage` per entry point before visiting each one, but a\nshader module with no entry points never enters that loop, so any\nlater read of `m_stage` would observe an indeterminate value.\n\nInitialize `m_stage` to `ShaderStage::Vertex`, matching how the\nsibling `IOValidator` and `GlobalVariableRewriter` passes default the\nsame member.  This silences the clang static analyzer's\n`optin.cplusplus.UninitializedObject` finding.\n\n* Source/WebGPU/WGSL/VisibilityValidator.cpp:\n(WGSL::VisibilityValidator::VisibilityValidator):\n\nCanonical link: https://commits.webkit.org/318025@main",
      "email": "ddkilzer@apple.com",
      "hash": "ced1eafb18fd6397a9cf57777148df375a0e0331",
      "subject": "[WGSL] Fix uninitialized VisibilityValidator::m_stage member"
    },
    "318026@main": {
      "author": "Roberto Rodriguez",
      "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64",
      "cl": "318026@main",
      "clUrl": "https://commits.webkit.org/318026@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320345\nrdar://183297312\n\nReviewed by Dan Glastonbury.\n\nANGLEEnd2EndTests fails at startup if it can't find src/tests/angle_end2end_tests_expectations.txt.\nCurrently it falls back to the copy in the WebKit checkout, found by walking up from the build directory\nto a hardcoded relative path (i.e., Source/ThirdParty/ANGLE/src/tests/angle_end2end_tests_expectations.txt).\nWithout that checkout, the suite won't run.\n\nFix by copying the file to $BUILT_PRODUCTS_DIR/src/tests/, the first location searched.\nNothing else is needed, since the binary links ANGLE statically and has no other runtime data.\nAlso, both dEQP targets already stage their data this way. This is macOS only, as iOS-family uses\nANGLEEnd2EndTestsApp and is unaffected.\n\n* Source/ThirdParty/ANGLE/ANGLE.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/318026@main",
      "email": "roberto_rodriguez2@apple.com",
      "hash": "b8b19de01e0ed105989ca7ef12df818c874100d4",
      "subject": "[ANGLE] Copy angle_end2end_tests_expectations.txt to build output folder"
    },
    "318028@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "318028@main",
      "clUrl": "https://commits.webkit.org/318028@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320415\n\nUnreviewed. Update safer C++ expectations.\n\n* Source/JavaScriptCore/SaferCPPExpectations/ForwardDeclCheckerExpectations:\n* Source/JavaScriptCore/SaferCPPExpectations/MemoryUnsafeCastCheckerExpectations:\n* Source/JavaScriptCore/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/JavaScriptCore/SaferCPPExpectations/NoUncountedMemberCheckerExpectations:\n* Source/JavaScriptCore/SaferCPPExpectations/NoUnretainedMemberCheckerExpectations:\n* Source/JavaScriptCore/SaferCPPExpectations/RetainPtrCtorAdoptCheckerExpectations:\n* Source/JavaScriptCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations:\n* Source/JavaScriptCore/SaferCPPExpectations/UncountedLambdaCapturesCheckerExpectations:\n* Source/JavaScriptCore/SaferCPPExpectations/UncountedLocalVarsCheckerExpectations:\n* Source/JavaScriptCore/SaferCPPExpectations/UnretainedCallArgsCheckerExpectations:\n* Source/JavaScriptCore/SaferCPPExpectations/UnretainedLocalVarsCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/UncheckedCallArgsCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/UncheckedLocalVarsCheckerExpectations:\n\nCanonical link: https://commits.webkit.org/318028@main",
      "email": "rniwa@webkit.org",
      "hash": "6de57e1b5eaaa2ef237409e11de9c465a0d81bf7",
      "subject": "Update safer C++ expectations (2026-07-27)"
    },
    "318029@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "318029@main",
      "clUrl": "https://commits.webkit.org/318029@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320222\nrdar://181047541\n\nReviewed by Abrar Rahman Protyasha.\n\nAdd a custom directional scroll locking algorithm instead of the existing predominant\naxis filter, which has no tolerance band.\n\nA future PR will refactor and unify this logic along with the fast scroll tracker with WKPanGestureRecognizer.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift\n\n* Source/WebCore/page/mac/WheelEventDeltaFilterMac.mm:\n(WebCore::WheelEventDeltaFilterMac::updateCurrentVelocityFromEvent):\n* Source/WebCore/platform/mac/ScrollingEffectsController.mm:\n(WebCore::ScrollingEffectsController::handleWheelEvent):\n\nOpt-out of the existing mechanism when needed, since WKDirectionalScrollLockTracker now takes care of it.\n\n* Source/WebKit/PlatformMac.cmake:\n* Source/WebKit/UIProcess/mac/WKAppKitGestureController.mm:\n(-[WKAppKitGestureController initWithPage:viewImpl:]):\n(-[WKAppKitGestureController panGestureRecognized:]):\n(-[WKAppKitGestureController sendWheelEventForGesture:]):\n(-[WKAppKitGestureController startMomentumIfNeededForGesture:]):\n(-[WKAppKitGestureController interruptMomentumIfNeeded]):\n(-[WKAppKitGestureController reset]):\n\nSet-up the tracker within WKAppKitGestureController like the existing fast scroll tracker.\n\n* Source/WebKit/UIProcess/mac/WKDirectionalScrollLockTracker.swift: Added.\n(WKDirectionalScrollLockTracker.lockedAxis):\n(WKDirectionalScrollLockTracker.lastLockedAxis):\n(WKDirectionalScrollLockTracker.lastEventTime):\n(WKDirectionalScrollLockTracker.uncommittedTranslation):\n(WKDirectionalScrollLockTracker.update(delta:canScrollHorizontally:canScrollVertically:time:)):\n(WKDirectionalScrollLockTracker.filterVelocity(_:)):\n(WKDirectionalScrollLockTracker.didStartGesture):\n(WKDirectionalScrollLockTracker.didEndGesture):\n(WKDirectionalScrollLockTracker.didCatchMomentum):\n(WKDirectionalScrollLockTracker.reset):\n(WKDirectionalScrollLockTracker.apply(_:to:)):\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n\nAdd another scroll tracker whose state mainly keeps track of the current locked axis. Generally,\nthis works by deciding which axis to lock to depending on the accumulated gesture translation within\na specific tolerance band.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift:\n\nCanonical link: https://commits.webkit.org/318029@main",
      "email": "richard_robinson2@apple.com",
      "hash": "0bde437173a5e888be34b3f95515b307fdee9a09",
      "subject": "[AppKit Gestures] Support directional scroll locking for diagonal scrolls"
    },
    "318030@main": {
      "author": "Ian Grunert",
      "avatar": "https://www.gravatar.com/avatar/6a676cf1bcb9ff83c6cd867a0e3a0fa4?d=identicon\u0026s=64",
      "cl": "318030@main",
      "clUrl": "https://commits.webkit.org/318030@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320179\n\nUnreviewed build fix.\n\nFix several independent breakages of the Windows build, found by\nbuilding main in the Windows EWS configuration now that its image\nincludes Swift 6.3.3:\n\n* Source/cmake/OptionsWin.cmake:\nOpt out of the Swift prototype features like OptionsIOS.cmake does.\nThey default on for any Clang host with swiftc \u003e= 6.3, which now\nincludes the Windows bots, and enabling them makes CMAKE_Swift_COMPILER\nthe swiftc-wrapper.sh bash script, which Windows cannot execute.\n\n* Source/WTF/wtf/SegmentedVector.h:\n(WTF::SegmentedVector::allocateSegment):\nstatic_assert(!sizeof(Segment)) from 317919@main only holds for the\nItanium ABI; MSVC sizes the empty Segment as alignof(T). Keep sizeof()\non non-Windows and check offsetof(Segment, m_entries) on Windows.\n\n* Source/JavaScriptCore/heap/Heap.h:\nAdd JS_EXPORT_PRIVATE to the friend declarations so GCOwnedDataScope.h\ndoes not add dllimport on a redeclaration, an error under\n-Wdll-attribute-on-redeclaration.\n\n* Source/ThirdParty/skia/CMakeLists.txt:\nAdd src/core/SkStrikeRef.cpp, new in the 2026-06-18 Skia update but\nmissing from the source list, leaving its constructor undefined.\n\n* Source/WebCore/platform/network/curl/OpenSSLHelper.cpp:\n(OpenSSL::toString):\nRestore toString(), removed by 315672@main as unused; Windows needs it\nfor getSubjectEntry() and getSubjectAltName(). OS(WINDOWS)-guarded\nbecause the PlayStation port builds without it and fails\n-Wunused-function with it present.\n\n* Source/WTF/wtf/win/DbgHelperWin.cpp:\n* Source/WTF/wtf/win/ThreadingWin.cpp:\n* Tools/TestRunnerShared/TestFeatures.cpp:\nFix -Wformat errors, fatal since LOG_ERROR gained WTF_ATTRIBUTE_PRINTF:\nGetLastError() is a DWORD, errno is an int, and\nstd::filesystem::path::c_str() is wchar_t* on Windows.\n\nCanonical link: https://commits.webkit.org/318030@main",
      "email": "ian.grunert@gmail.com",
      "hash": "f2429bc7943a842d3b066cbb4a63bd8930d9388a",
      "subject": "[Win] Build fixes August 27"
    },
    "318031@main": {
      "author": "Ian Grunert",
      "avatar": "https://www.gravatar.com/avatar/6a676cf1bcb9ff83c6cd867a0e3a0fa4?d=identicon\u0026s=64",
      "cl": "318031@main",
      "clUrl": "https://commits.webkit.org/318031@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319102\n\nUnreviewed build fix.\n\nApply the ccache configuration by passing it as inline \"KEY=VALUE ... compiler\"\narguments to ccache (a core ccache feature), so the settings are baked into every\nninja compile command and applied per invocation. This avoids relying on\nenvironment set at configure time (which does not survive to the ninja-spawned\ncompile) and avoids a launcher script -- a .cmd wrapper hits cmd.exe's 8191-char\ncommand-line limit on WebCore's long compile lines.\n\nDisable precompiled headers when ccache is enabled, matching the GTK and WPE\ndeveloper-mode ports. Caching a PCH under clang-cl is fragile -- ccache can\nrestore a PCH built against a different-sized generated header, which clang then\nrejects -- and PCH only accelerates ccache misses, so dropping it keeps the\nclean-rebuild speedup while removing that failure class.\n\n* Source/cmake/WebKitCCache.cmake:\n\nCanonical link: https://commits.webkit.org/318031@main",
      "email": "ian.grunert@gmail.com",
      "hash": "b28c618947150c97094ecec0dd0da16b145b7ab3",
      "subject": "[Win] Configure ccache via inline KEY=VALUE arguments"
    },
    "318032@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "318032@main",
      "clUrl": "https://commits.webkit.org/318032@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320400\nrdar://problem/183357284\n\nReviewed by Alan Baradlay.\n\nDuring track sizing we may need to apply the automatic minimum size\nlogic for a grid item. If we are evaluating whether or not the grid item\nhas a specified size suggestion we are not able to resolve percentages\nin the middle of track sizing for it. As a result, the item should not\nhave a specified size suggestion so we need to check the transferred\nsize suggestion or content size suggestion. Currently we attempt to\nresolve the percentage which results in incorrect behavior.\n\nOne way we can fix this is by changing the automatic minimum size\nfunctions to take in an optionl LayoutUnit for the available space.\nDuring track sizing this will be empty to rerpesent the fact there is no\navailable space. Then we computing the specified size suggestion we can\nuse this information to return empty for that size as well and fall back\nto the other two sizes mentioned earlier.\n\nThe way we implement this is by checking how GridItemSizingFunction's\nused minimum size callback works. Instead of calling out to the version\non GridLayoutUtils it just implements its logic inline. This is done\nbecause almost all of the functions was just a switch on the minimum\nsize with the only difference being the space that was used to resolve\npercentages/calc or pass into the automatic minimum size function. Now\nthe GridItemSizingFunctions version resolve against 0 for\npercentages/calc and passes in std::nullopt for the automatic minimum\nsize functions (which get plumbed to the specified size suggestion).\n\nThe GridLayoutUtils variant will just be used for the final sizing of the\ngrid item instead. This does result in a tiny bit of code duplication,\nbut I think this is fine for now since a lot of the duplication is just\nboiler plate related to calling WTF::switchOn and handling the cases\nslighlty differently. I thought about passing in std::optional into the\nused minimum size functions directly but I think this makes it a little\nless clear as to what is happening inside the implementation of\ninlineMinimumSize/blockMinimumSize. So we can definitely revisit this in\nthe future but will probably need to think about how to do so without\nmaking the code confusing.\n\nCanonical link: https://commits.webkit.org/318032@main",
      "email": "sammy.gill@apple.com",
      "hash": "a0992f0bb3d09714ce0f5748d69af63c64925ac8",
      "subject": "[GFC] Automatic minimum size should not resolve percentages against unknown available space during track sizing"
    },
    "318033@main": {
      "author": "Yulun Wu",
      "avatar": "https://www.gravatar.com/avatar/9e34d6632f4d926cdf6fe8dce07f9cb7?d=identicon\u0026s=64",
      "cl": "318033@main",
      "clUrl": "https://commits.webkit.org/318033@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320423\nrdar://183380145\n\nReviewed by Sammy Gill.\n\nThis PR extracts isSizedUnderMinOrMaxContentConstraint() into a helper\nfunction and uses it where needed.\n\n* Source/WebCore/layout/formattingContexts/grid/TrackSizingAlgorithm.cpp:\n(WebCore::Layout::isSizedUnderMinOrMaxContentConstraint):\n(WebCore::Layout::sizeTracksToFitNonSpanningItems):\n(WebCore::Layout::increaseSizesToAccommodateSpanningItemsCrossingFlexibleTracks):\n\nCanonical link: https://commits.webkit.org/318033@main",
      "email": "yulun_wu@apple.com",
      "hash": "a009b4c93fdf2662a1852ee7e857b1647b1ca5a2",
      "subject": "[GFC] Consolidate the min/max-content constraint test and per-track content contributions"
    },
    "318034@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "318034@main",
      "clUrl": "https://commits.webkit.org/318034@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320385\nrdar://problem/183345808\n\nReviewed by Alan Baradlay.\n\nWhen constructing the list of unplaced grid items, GridFormattingContext\ndecided which placement bucket an item belongs to by inspecting the raw\ncomputed style and requiring all four grid-{column,row}-{start,end}\nvalues to be explicit before treating the item as non-auto-positioned.\n\nThat test is stricter than the spec's notion of a definite position. An\naxis is definite when either of its edges references an explicit line, so\na placement like grid-column: 2 (explicit start, auto end) is definite\neven though it is not \"fully explicit\". Such an item has a definite\nposition in both axes, but because it was not fully explicit it was\nrouted to definiteRowPositionedItems, which ignores the definite column\nand auto-places the item in the column axis, landing it in the wrong\ncolumn.\n\nNow that an UnplacedGridItem resolves and stores its position when it is\nconstructed, classify it from that resolved position instead: an item\nwith a definite position in both axes is non-auto-positioned, an item\nwith only a definite row is locked to that row, and everything else is\nauto-positioned.\n\nCanonical link: https://commits.webkit.org/318034@main",
      "email": "sammy.gill@apple.com",
      "hash": "0e3f9c7406374f46e0cf330b2ef7723b76f5245c",
      "subject": "[GFC] Use UnplacedGridItem::GridPosition when determining item position type."
    },
    "318035@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318035@main",
      "clUrl": "https://commits.webkit.org/318035@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318430\nrdar://181210169\n\nReviewed by Devin Rousso.\n\nNetworkResourcesData::clear(preservedLoaderId) only walked m_requestIdsDeque\nwhen preserving a loader on navigation. A resource enters that deque solely\nwhen its content is buffered, so resources tracked in the request-id map that\nnever buffered content (e.g. non-text subresources such as images) were never\nvisited: their entries for the previous loader survived every navigation and\nleaked until the next full clear.\n\nAfter rebuilding the deque, removeIf() over m_requestIdToResourceDataMap to\nevict and remove any remaining entries not belonging to the preserved loader.\n\nTest: http/tests/inspector/network/clear-non-buffered-resource-data-on-navigate.html\n\n* LayoutTests/http/tests/inspector/network/clear-non-buffered-resource-data-on-navigate-expected.txt: Added.\n* LayoutTests/http/tests/inspector/network/clear-non-buffered-resource-data-on-navigate.html: Added.\n* Source/WebCore/inspector/NetworkResourcesData.cpp:\n(WebCore::NetworkResourcesData::clear):\n\n* LayoutTests/platform/mac-site-isolation/TestExpectations: Mark the new test as an\nexpected failure; getResponseBody cannot resolve a non-buffered resource's body under\nSite Isolation, which trips the test's pre-navigation sanity check.\n\nCanonical link: https://commits.webkit.org/318035@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "d9c65d67a7baa9cf61cd6180fd0f74e2f84706f8",
      "subject": "[Web Inspector] resource data for non-buffered resources leaks across navigations"
    },
    "318036@main": {
      "author": "Said Abou-Hallawa",
      "avatar": "https://www.gravatar.com/avatar/ae80a929a378a055822829ae63903296?d=identicon\u0026s=64",
      "cl": "318036@main",
      "clUrl": "https://commits.webkit.org/318036@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317048\nrdar://179529478\n\nReviewed by Geoffrey Garen.\n\nSince the main thread and the worker thread both use the RunLoop, this problem\ncan be fixed by finishing the decoding request on the creator thread rather than\non the main thread.\n\ncallOnRunLoop() will be added and ImageFrameWorkQueue will use it instead of using\ncallOnMainThread(). The creater RunLoop will be captured when the ImageDecoder\nWrokQueue starts.\n\n* Source/WTF/wtf/RunLoop.cpp:\n(WTF::callOnRunLoop):\n* Source/WTF/wtf/RunLoop.h:\n* Source/WebCore/platform/graphics/ImageFrameWorkQueue.cpp:\n(WebCore::ImageFrameWorkQueue::start):\n(WebCore::ImageFrameWorkQueue::dispatch):\n(WebCore::ImageFrameWorkQueue::stop):\n(WebCore::ImageFrameWorkQueue::isPendingDecodingAtIndex const):\n\nCanonical link: https://commits.webkit.org/318036@main",
      "email": "said@apple.com",
      "hash": "98bd399284d49c61001e4b3f2d2d93f2c05fbc6b",
      "subject": "Async image decoding may be requested on a worker thread"
    },
    "318037@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "318037@main",
      "clUrl": "https://commits.webkit.org/318037@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=320315\u003e\n\u003crdar://183251187\u003e\n\nUnreviewed build fix.\n\nSeveral WebKit implementation types are foreign reference types\n(`SWIFT_SHARED_REFERENCE`), but do not declare how Swift should treat\nthe ownership of a returned value.  A stricter Swift toolchain rejects\nthis: any function returning one of these types -- such as\n`WTF::Ref\u003cT\u003e::ptr()`, `WebPageProxy::legacyMainFrameProcess()`, or\n`WKWebView._impl()` -- fails to import because the compiler cannot infer\nwhether the result is passed retained (+1) or unretained (+0).\n\nMark each affected WebKit foreign reference type\n`SWIFT_RETURNED_AS_UNRETAINED_BY_DEFAULT`.  Like all normal WebKit\nref-counted types, they are returned +0, so a caller does not take\nownership of the returned reference.  This mirrors the annotation\napplied to the WebGPU types in bug 320306 (317935@main) and continues\nthe work in bug 308456 (309469@main) and bug 310101, which these WebKit\ntypes were missing.\n\nNo new tests since this change is not directly testable.\n\n* Source/WebKit/Platform/IPC/Connection.h:\n(IPC::Connection):\n* Source/WebKit/Shared/API/APIArray.h:\n(API::Array):\n* Source/WebKit/Shared/API/APIObject.h:\n(API::Object):\n* Source/WebKit/Shared/SessionState.h:\n(WebKit::FrameState):\n* Source/WebKit/Shared/WebBackForwardListFrameItem.h:\n(WebKit::WebBackForwardListFrameItem):\n* Source/WebKit/UIProcess/AuxiliaryProcessProxy.h:\n(WebKit::AuxiliaryProcessProxy):\n* Source/WebKit/UIProcess/BrowsingContextGroup.h:\n(WebKit::BrowsingContextGroup):\n* Source/WebKit/UIProcess/SuspendedPageProxy.h:\n(WebKit::SuspendedPageProxy):\n* Source/WebKit/UIProcess/WebBackForwardCacheEntry.h:\n(WebKit::WebBackForwardCacheEntry):\n* Source/WebKit/UIProcess/WebProcessProxy.h:\n(WebKit::WebProcessProxy):\n* Source/WebKit/UIProcess/mac/WebViewImpl.h:\n(WebKit::WebViewImpl):\n\nCanonical link: https://commits.webkit.org/318037@main",
      "email": "ddkilzer@apple.com",
      "hash": "546057ba7bf7ffdbdec0a0221fff754b1fd31915",
      "subject": "[WebKit] Swift build fails with \"cannot infer ownership of foreign reference value\" errors"
    },
    "318038@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "318038@main",
      "clUrl": "https://commits.webkit.org/318038@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320279\nrdar://183196588\n\nReviewed by Alex Christensen.\n\nUse the LocalFrame that owns the client rather than WebFrame::coreLocalFrame(). During a\ncross-site provisional load under site isolation, the WebFrame still points at the RemoteFrame\nit will replace, so coreLocalFrame() is null and the context would never become valid.\n\nTest: http/tests/site-isolation/provisional-frame-networking-context.html\n\n* LayoutTests/http/tests/site-isolation/provisional-frame-networking-context-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/provisional-frame-networking-context.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/report-networking-context-validity.html: Added.\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::frameNetworkingContextIsValid const):\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\n* Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp:\n(WebKit::WebLocalFrameLoaderClient::createNetworkingContext):\n* Source/WebKit/WebProcess/WebCoreSupport/cocoa/WebFrameNetworkingContext.h:\n(WebKit::WebFrameNetworkingContext::create):\n(WebKit::WebFrameNetworkingContext::WebFrameNetworkingContext):\n* Source/WebKit/WebProcess/WebCoreSupport/curl/WebFrameNetworkingContext.cpp:\n(WebKit::WebFrameNetworkingContext::WebFrameNetworkingContext):\n* Source/WebKit/WebProcess/WebCoreSupport/curl/WebFrameNetworkingContext.h:\n(WebKit::WebFrameNetworkingContext::create):\n* Source/WebKit/WebProcess/WebCoreSupport/soup/WebFrameNetworkingContext.cpp:\n(WebKit::WebFrameNetworkingContext::WebFrameNetworkingContext):\n* Source/WebKit/WebProcess/WebCoreSupport/soup/WebFrameNetworkingContext.h:\n(WebKit::WebFrameNetworkingContext::create):\n\nCanonical link: https://commits.webkit.org/318038@main",
      "email": "richard_robinson2@apple.com",
      "hash": "b644eadfe2244bdf01c08b31d4a5952cbb8c8fe0",
      "subject": "[Site Isolation] A cross-site frame's FrameNetworkingContext is never valid, silently dropping in-process loads"
    },
    "318039@main": {
      "author": "Jessica Lee",
      "avatar": "https://www.gravatar.com/avatar/fc717c99321d09f31fb9187418a8ffc5?d=identicon\u0026s=64",
      "cl": "318039@main",
      "clUrl": "https://commits.webkit.org/318039@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320217\nrdar://183160090\n\nReviewed by Chris Dumez and Alex Christensen.\n\nMockParentalControlsURLFilter currently returns no substitute data if a URL is blocked.\nIt may be useful to populate this for testing.\n\nNo new tests needed.\n\n* Source/WebCore/testing/MockParentalControlsURLFilter.h:\n* Source/WebCore/testing/MockParentalControlsURLFilter.mm:\n(WebCore::MockParentalControlsURLFilter::create):\n(WebCore::MockParentalControlsURLFilter::MockParentalControlsURLFilter):\n(WebCore::MockParentalControlsURLFilter::isURLAllowedImpl):\n* Source/WebKit/NetworkProcess/NetworkProcess.cpp:\n(WebKit::NetworkProcess::installMockParentalControlsURLFilterForTesting):\n* Source/WebKit/NetworkProcess/NetworkProcess.h:\n* Source/WebKit/NetworkProcess/NetworkProcess.messages.in:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStore.mm:\n(-[WKWebsiteDataStore _installMockParentalControlsURLFilterForTestingWithBlockedURLs:completionHandler:]):\n(-[WKWebsiteDataStore _installMockParentalControlsURLFilterForTestingWithBlockedURLs:replacementData:completionHandler:]):\n* Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h:\n* Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp:\n(WebKit::NetworkProcessProxy::installMockParentalControlsURLFilterForTesting):\n* Source/WebKit/UIProcess/Network/NetworkProcessProxy.h:\n* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp:\n(WebKit::WebsiteDataStore::installMockParentalControlsURLFilterForTesting):\n* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.h:\n\nCanonical link: https://commits.webkit.org/318039@main",
      "email": "jlee53@apple.com",
      "hash": "3210023b22e24d67e19c08be04b26c1dec7c4c2d",
      "subject": "Populate replacement data for MockParentalControlsURLFilter"
    },
    "318040@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "318040@main",
      "clUrl": "https://commits.webkit.org/318040@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317726\nrdar://180479038\n\nReviewed by Aditya Keerthi.\n\nMake it possible to expose Swift SPI for watchOS and tvOS, and expose WebPage and related types as SPI.\n\nThe WebPage conformance to `Observation.Observable` is explicitly specified instead of previously relying\non the `@Observable` macro which synthesized it because the macro expansion fails to properly account\nfor the `@_spi_available` annotation.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebPageTests.swift\n\n* Source/WTF/wtf/PlatformEnableCocoa.h:\n* Source/WebKit/UIProcess/API/Cocoa/WebKitSwiftOverlay.swift:\n* Source/WebKit/UIProcess/API/Swift/URLSchemeHandler.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage+BackForwardList.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage+Configuration.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage+DialogPresenting.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage+FormInfo.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage+FrameInfo.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage+Navigation.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage+NavigationDeciding.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage+NavigationPreferences.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage+Transferable.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage.swift:\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebPageTests.swift:\n(WebPageTests.observableProperties):\n\nCanonical link: https://commits.webkit.org/318040@main",
      "email": "richard_robinson2@apple.com",
      "hash": "21a90b4135be296348a631244d3e9412a295a3bf",
      "subject": "[SwiftUI WebKit API] Expose WebPage and related types as SPI on watchOS and tvOS"
    },
    "318041@main": {
      "author": "Kristian Monsen",
      "avatar": "https://www.gravatar.com/avatar/d9b02ca94d143b7dd6118be4dbc4aa06?d=identicon\u0026s=64",
      "cl": "318041@main",
      "clUrl": "https://commits.webkit.org/318041@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320242\nrdar://182122186\n\nReviewed by Chris Dumez.\n\nWhen a navigate handler removes document.documentElement, NavigateEvent::finish called findAutofocusDelegate() on the null return value of documentElement(), dereferencing a null\npointer. The fix guards that call so focus reset is simply skipped when there is no document element.\n\nTest: navigation-api/navigation-api-remove-document-element-in-navigate-handler-crash.html\n\n* LayoutTests/navigation-api/navigation-api-remove-document-element-in-navigate-handler-crash-expected.txt: Added.\n* LayoutTests/navigation-api/navigation-api-remove-document-element-in-navigate-handler-crash.html: Added.\n* LayoutTests/navigation-api/resources/navigation-api-remove-document-element-in-navigate-handler-crash-inner.html: Added.\n* Source/WebCore/page/NavigateEvent.cpp:\n(WebCore::NavigateEvent::finish):\n\nCanonical link: https://commits.webkit.org/318041@main",
      "email": "k_monsen@apple.com",
      "hash": "e5d3b562ec6fc7d6d4e75ce47c6b7a6979251ca5",
      "subject": "Crash in NavigateEvent::finish when document element is removed inside navigate handler"
    },
    "318042@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "318042@main",
      "clUrl": "https://commits.webkit.org/318042@main",
      "description": "rdar://183125740\nhttps://bugs.webkit.org/show_bug.cgi?id=320183\n\nReviewed by Alex Christensen.\n\nIf the fetch event request body is read, even partially, we can no longer provide the data to the network if data comes from a ReadableStream originally.\nIn that case, we fail the load.\n\nCovered by rebased test.\n\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-event.https.h2-expected.txt:\n* Source/WebCore/workers/service/context/ServiceWorkerFetch.cpp:\n(WebCore::ServiceWorkerFetch::dispatchFetchEvent):\n\nCanonical link: https://commits.webkit.org/318042@main",
      "email": "youenn@apple.com",
      "hash": "4c947c1f3ca35596cfcb36fafd267f0d33caeabd",
      "subject": "Do not allow network fallback in case of a disturbed fetch event request body"
    },
    "318043@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "318043@main",
      "clUrl": "https://commits.webkit.org/318043@main",
      "description": "rdar://183317580\nhttps://bugs.webkit.org/show_bug.cgi?id=320359\n\nReviewed by Alex Christensen.\n\nWhen a service worker is cancelling a fetch event request body, we propagate it as follows:\n1. FetchRequest will cancel its FetchBody which will cancel its FetchBodyConsumer which will cancel its FormDataConsumer\n2. FormDataConsumer will ask its sw connection to cancel the upload forwarding to network process via IPC.\n3. network process stops the forwarding and notifies the related WebResourceLoader in web process.\n4. WebResourceLoader tells the PendingStreamState it has been cancelled.\n\nWhen starting the upstream, the PendingStreamState is created and the it is registered a cancel callback from the FetchRequest.\nThis cancel callback is now cancelling the original ReadableStream.\nTo implement this we rename DataAvailableHandler to CallbackHandler and add a specific cancel callback like there is a data available callback.\n\nTest: LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-request-body-cancel.https.html\n\n* Source/WebCore/Modules/fetch/FetchBody.cpp:\n(WebCore::FetchBody::startPendingStreamUpload):\n(WebCore::FetchBody::cancelReadableStream):\n* Source/WebCore/Modules/fetch/FetchBody.h:\n* Source/WebCore/Modules/fetch/FetchBodyConsumer.cpp:\n(WebCore::FetchBodyConsumer::cancelReadableStream):\n* Source/WebCore/Modules/fetch/FetchBodyConsumer.h:\n* Source/WebCore/Modules/fetch/FetchRequest.cpp:\n(WebCore::FetchRequest::cancel):\n* Source/WebCore/Modules/fetch/FetchRequest.h:\n* Source/WebCore/Modules/fetch/FetchResponse.cpp:\n(WebCore::FetchResponse::fetch):\n* Source/WebCore/platform/network/PendingStreamState.cpp:\n(WebCore::PendingStreamState::CallbackHandler::create):\n(WebCore::PendingStreamState::CallbackHandler::CallbackHandler):\n(WebCore::PendingStreamState::invokeHandlerIfNeeded):\n(WebCore::PendingStreamState::appendData):\n(WebCore::PendingStreamState::endStream):\n(WebCore::PendingStreamState::errorStream):\n(WebCore::PendingStreamState::setDataAvailableHandler):\n(WebCore::PendingStreamState::setCancelCallback):\n(WebCore::PendingStreamState::cancel):\n(WebCore::PendingStreamState::DataAvailableHandler::create): Deleted.\n(WebCore::PendingStreamState::DataAvailableHandler::invoke): Deleted.\n(WebCore::PendingStreamState::DataAvailableHandler::DataAvailableHandler): Deleted.\n* Source/WebCore/platform/network/PendingStreamState.h:\n(WebCore::PendingStreamState::setServiceWorkerFetchIdentifier):\n(WebCore::PendingStreamState::serviceWorkerFetchIdentifier const):\n* Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerFetchTask.cpp:\n(WebKit::ServiceWorkerFetchTask::cancelPendingStreamUpload):\n* Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerFetchTask.h:\n* Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerToContextConnection.cpp:\n(WebKit::WebSWServerToContextConnection::cancelPendingStreamUploadForwarding):\n* Source/WebKit/WebProcess/Network/WebResourceLoader.cpp:\n(WebKit::WebResourceLoader::cancelPendingStreamUpload):\n* Source/WebKit/WebProcess/Network/WebResourceLoader.h:\n* Source/WebKit/WebProcess/Network/WebResourceLoader.messages.in:\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-request-body-cancel-worker.js: Added.\n(async cancelBodyTest):\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-request-body-cancel.https-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-request-body-cancel.https.html: Added.\n\nCanonical link: https://commits.webkit.org/318043@main",
      "email": "youenn@apple.com",
      "hash": "b0957d9ae341ce80fcb9818848aff2635b457f00",
      "subject": "Service worker fetch event request body cancellation should be propagated to the original ReadableStream"
    },
    "318045@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "318045@main",
      "clUrl": "https://commits.webkit.org/318045@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320340\nrdar://183139377\n\nReviewed by Abrar Rahman Protyasha.\n\nSpindumps of watchdog-terminated MobileSafari showed the UIProcess main\nthread spinning while decoding a DecidePolicyForNavigationAction message:\nthe ResourceRequest it carries holds a pathologically large URL, and\ndecoding it re-parses that URL on the main thread, which can burn seconds\nof CPU and trip the process watchdog.\n\nReject over-sized URLs when decoding them for IPC, matching Chromium. Chromium\ncaps every URL crossing a process boundary at url::kMaxURLChars (2MB) in its\nGURL and KURL mojo traits, whose Read() returns false past that length; the\nURL is never parsed. Do the same via a Validator on the WTF::URL IPC decoder:\nthe validator runs on the raw string before the URL is constructed, so an\nover-sized URL is rejected (the message is treated as invalid) without being\nparsed. The limit is WTF::maxURLLength, matching kMaxURLChars.\n\nFor now the validator is enabled on Cocoa only. A failed decode is treated as\nan invalid message and terminates the sender, so the limit is only safe where\na legitimately-large URL never crosses this boundary. On Cocoa, data: URLs are\nloaded in-process (WebLoaderStrategy::startLocalLoad), so they do not cross it.\nOn the other ports (GTK/WPE/Win/PlayStation) data: URLs are loaded by the\nNetworkProcess (NetworkDataTaskDataURL, routed via NetworkDataTask::create), so\na large-but-legitimate data: URL does cross this boundary and rejecting it would\nterminate the process (e.g. large canvas.toDataURL() images). Enabling\nthe limit on the other ports requires either loading data: URLs in-process there\ntoo, or capping navigation URLs specifically rather than every URL on the wire.\n\nTest: TestWebKitAPI ArgumentCoderURL.*\n\n* Source/WTF/wtf/URL.h:\nAdd WTF::maxURLLength (2MB, matching url::kMaxURLChars).\n* Source/WebKit/Shared/WTFArgumentCoders.serialization.in:\nReject URLs longer than WTF::maxURLLength when decoding WTF::URL, on Cocoa.\n* Tools/TestWebKitAPI/Tests/IPC/ArgumentCoderTests.cpp:\n(TestWebKitAPI::makeURLStringOfLength): Added.\n(TestWebKitAPI::decodeURLFromWireString): Added.\nAdd ArgumentCoderURL tests for round-trip, the at-limit boundary, and (on\nCocoa) decode rejection over the limit.\n\nCanonical link: https://commits.webkit.org/318045@main",
      "email": "cdumez@apple.com",
      "hash": "04e3d47960f3135b16aff2382ac0d1b712e0d884",
      "subject": "Limit URL size at the IPC boundary to match Chrome/Blink"
    },
    "318046@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318046@main",
      "clUrl": "https://commits.webkit.org/318046@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320037\nrdar://problem/182968516\n\nReviewed by Youenn Fablet.\n\nWhen a numeric constraint (width, height, frameRate, zoom, aspectRatio, ...)\nhas both min and max set but no ideal, valueForCapabilityRange() first computes\na value that preserves the current setting if it already satisfies the min\nconstraint, then unconditionally overwrites that value with the max constraint\nin the following block. This forces applyConstraints() to jump the setting to\nthe max bound even when the current value already lies within [min, max],\ne.g. applyConstraints({width: {min: 640, max: 1920}}) with a current width of\n1280 incorrectly changes width to 1920 instead of leaving it unchanged.\n\nFix the max block to clamp the already-computed value down to max only when\nit exceeds max, instead of always replacing it with the max constraint value.\n\nThe same problem also existed when only max is set (no min): the max block\nunconditionally set the value to the max constraint, ignoring a current value\nthat already satisfied it. Apply the same current-preserving fix there. The\nmin-only case was already correct, since the min block has always preserved\na valid current value independently of the max block.\n\nIn the max-only case, only preserve current when it is itself a valid value\nfor the capability (current \u003e= capabilityMin). Otherwise a sentinel/default\ncurrent of 0, such as the RealtimeMediaSource width/height before any frame\nhas been produced, is always less than a positive max constraint and would be\nincorrectly preserved as the resolved value, collapsing width/height to 0.\nThis was caught by fast/mediastream/getDisplayMedia-max-constraints2.html,\ngetDisplayMedia-max-constraints4.html, and getDisplayMedia-max-constraints5.html,\nwhich asserted in RealtimeMediaSource::addVideoFrameObserver() because the\nzeroed size threw off UserMediaCaptureManagerProxySourceProxy's observer\nbookkeeping. The min-only case does not need the same guard, since a current\nof 0 is never greater than a positive min constraint.\n\n* Source/WebCore/platform/mediastream/MediaConstraints.h:\n(WebCore::NumericConstraint::valueForCapabilityRange const):\n* Tools/TestWebKitAPI/CMakeLists.txt:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebCore/MediaConstraintsTests.cpp: Added.\n(TestWebKitAPI::TEST(MediaConstraintsTest, ValueForCapabilityRangeMinMaxPreservesValidCurrent)):\n(TestWebKitAPI::TEST(MediaConstraintsTest, ValueForCapabilityRangeMinMaxClampsAboveMax)):\n(TestWebKitAPI::TEST(MediaConstraintsTest, ValueForCapabilityRangeMinMaxClampsBelowMin)):\n(TestWebKitAPI::TEST(MediaConstraintsTest, ValueForCapabilityRangeMaxOnlyClampsAboveMax)):\n(TestWebKitAPI::TEST(MediaConstraintsTest, ValueForCapabilityRangeMaxOnlyPreservesValidCurrent)):\n(TestWebKitAPI::TEST(MediaConstraintsTest, ValueForCapabilityRangeMaxOnlyIgnoresCurrentBelowCapabilityMin)):\n(TestWebKitAPI::TEST(MediaConstraintsTest, ValueForCapabilityRangeMinOnlyPreservesValidCurrent)):\n(TestWebKitAPI::TEST(MediaConstraintsTest, ValueForCapabilityRangeMinMaxIdealIsUnaffected)):\n* LayoutTests/fast/mediastream/apply-constraints-framerate-range.html: Added.\n* LayoutTests/fast/mediastream/apply-constraints-framerate-range-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/318046@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "fdc1fa6d65eadd301ae44497e2dce31645437fe1",
      "subject": "NumericConstraint::valueForCapabilityRange() ignores a valid current value when both min and max constraints are set"
    },
    "318047@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318047@main",
      "clUrl": "https://commits.webkit.org/318047@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320113\nrdar://183054655\n\nReviewed by Youenn Fablet.\n\nm_isPlaying and m_audioTransport are written from StartPlayout(),\nStopPlayout(), and RegisterAudioCallback() — called from libwebrtc's\ncallback threads — and read from pollAudioData()/pollFromSource() on\nthe internal WorkQueue thread, as well as from Playing(), with no\nlock or atomic. Make both members std::atomic to close the race.\n\n* Source/WebCore/platform/mediastream/libwebrtc/LibWebRTCAudioModule.cpp:\n(WebCore::LibWebRTCAudioModule::StartPlayout):\n(WebCore::LibWebRTCAudioModule::StopPlayout):\n(WebCore::LibWebRTCAudioModule::pollFromSource):\n* Source/WebCore/platform/mediastream/libwebrtc/LibWebRTCAudioModule.h:\n\nCanonical link: https://commits.webkit.org/318047@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "17afba52f935e236c57013631ed39f83e5c4668d",
      "subject": "LibWebRTCAudioModule has a data race on m_isPlaying and m_audioTransport"
    },
    "318048@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318048@main",
      "clUrl": "https://commits.webkit.org/318048@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320166\nrdar://183100852\n\nReviewed by Youenn Fablet.\n\nMediaStreamPrivate's constructor takes MediaStreamTrackPrivateVector\u0026\u0026\nbut initialized m_tracks via m_tracks(tracks), copying the vector\ninstead of moving it, even though tracks is unused afterward\n\n* Source/WebCore/platform/mediastream/MediaStreamPrivate.cpp:\n(WebCore::MediaStreamPrivate::MediaStreamPrivate):\n\nCanonical link: https://commits.webkit.org/318048@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "d881d6bac4c105ffef4ff3b13e62746edd61e3fa",
      "subject": "MediaStreamPrivate constructor copies the tracks vector instead of moving it"
    },
    "318049@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318049@main",
      "clUrl": "https://commits.webkit.org/318049@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320163\nrdar://183098892\n\nReviewed by Youenn Fablet.\n\nThe switchOn call computing imageSize took RetainPtr\u003cIOSurfaceRef\u003e,\nRefPtr\u003cNativeImage\u003e, and RetainPtr\u003cCMSampleBufferRef\u003e by value, causing\nan extra retain/release per invocation. The second switchOn over the\nsame frame variable already takes these by reference; make the first\none consistent.\n\n* Source/WebCore/platform/mediastream/cocoa/DisplayCaptureSourceCocoa.cpp:\n(WebCore::DisplayCaptureSourceCocoa::emitFrame):\n\nCanonical link: https://commits.webkit.org/318049@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "747bb571ff355c8fc4fb9bd9676d9caf61647d66",
      "subject": "DisplayCaptureSourceCocoa::generateFrame() first switchOn takes Variant alternatives by value"
    },
    "318050@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318050@main",
      "clUrl": "https://commits.webkit.org/318050@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320049\nrdar://182986735\n\nReviewed by Youenn Fablet.\n\nm_sampleRate was overwritten with the new sampleRate before it was\nused as the divisor in the frame-count rebase, so the computation\nbecame m_numberOfFrames * r / r — always equal to the original value\ninstead of rescaling the fallback frame counter across a sample-rate\nchange. This only affects the timestamp computed when no audio\nmodule is attached yet.\n\nCapture the previous sample rate before overwriting m_sampleRate and\nuse it as the divisor.\n\n* Source/WebCore/platform/mediastream/cocoa/RealtimeIncomingAudioSourceCocoa.cpp:\n(WebCore::RealtimeIncomingAudioSourceCocoa::OnData):\n\nCanonical link: https://commits.webkit.org/318050@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "c2c858a8f87c1ac084b5bf77b8b463585073d71c",
      "subject": "RealtimeIncomingAudioSourceCocoa::OnData rescales the frame counter against the already-updated sample rate, making it a no-op"
    },
    "318051@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318051@main",
      "clUrl": "https://commits.webkit.org/318051@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320155\nrdar://183089603\n\nReviewed by Chris Dumez.\n\nmakeStringByReplacingAll() hand-rolled a first-occurrence loop in both the\n8-bit and 16-bit branches to locate the target character. WTF::find() is\nSIMD-accelerated (find8()/find16()) and is used everywhere else for exactly\nthis, so replacing both loops is a real win on long strings.\nCollapse the two branches into a single generic lambda templated on the span's\ncharacter type. This also drops the explicit !isLatin1(target) early return:\nthe find(span\u003cLatin1Character\u003e, char16_t) overload already returns notFound for\na non-Latin1 target, so an 8-bit string searched for a 16-bit target still\nreturns the original string unchanged. No behavior change.\n\n* Source/WTF/wtf/text/StringView.cpp:\n(WTF::makeStringByReplacingAll):\n\nCanonical link: https://commits.webkit.org/318051@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "6cb1077d85c825a9a89187ae89483449033a144c",
      "subject": "makeStringByReplacingAll() uses a scalar scan instead of SIMD-accelerated find()"
    },
    "318052@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318052@main",
      "clUrl": "https://commits.webkit.org/318052@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320375\nrdar://183342212\n\nReviewed by Chris Dumez.\n\nfinalValue() declared `float value;` uninitialized and relied on calculateFinalValues()\nto write it, but that function early-returns without touching the output span when there\nis no context, we are off the audio thread, or the span is empty. The garbage value then\nflows into DSP as an oscillator frequency, filter cutoff, delay time, pan, compressor\nthreshold, etc.\n\nInitialize `value` to m_value, which is always set from defaultValue in the constructor.\nThe k-rate path fills the span with m_value anyway, so this only changes the\npreviously-garbage path.\n\nNo new test.\n\n* Source/WebCore/Modules/webaudio/AudioParam.cpp:\n(WebCore::AudioParam::finalValue):\n\nCanonical link: https://commits.webkit.org/318052@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "2a2036f697b145ad90e29dd24dfc94502f0068bb",
      "subject": "AudioParam::finalValue() returns an uninitialized float when calculateFinalValues() bails out"
    },
    "318053@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318053@main",
      "clUrl": "https://commits.webkit.org/318053@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318194\nrdar://181000906\n\nReviewed by Chris Dumez.\n\nThis change is just to make code easier to understand true intention as\nmentioned below:\n\nrespondToNodeModification() adjusts the selection for a node removal. The\nstart/end block is written as `} if (startRemoved || endRemoved) {`, sharing a\nline with the close of the anchor/focus block, which reads like a dropped `else`.\nIt isn't one, and the missing separation is what makes it look like a typo.\n\nThe two blocks are sequential passes, and both are needed. nodeWillBeRemoved()\nruns before the node leaves the tree. The anchor/focus block rewrites\nanchor-relative positions into positions in the removed node's parent via\npositionInParentBefore/AfterNode(), and setWithoutValidation() derives the start\nand end from them. Those parent offsets still describe the pre-removal tree, so\nthe start/end block runs afterwards to apply the child-index shift.\n\nFor `foo\u003chr\u003ebar` with the caret after the hr, the first block produces (div, 2),\nwhich lands after \"bar\" once the hr is gone; the second maps it to (div, 1),\nmatching the expected result in editing/execCommand/insertHorizontalRule. The\ndouble pass cannot over-decrement, since the first block only runs when the\nremoved node is an inclusive ancestor of the anchor or focus, so it always emits\nan offset equal to the node's own index or one past it.\n\nPut the second `if` on its own line so the fallthrough is deliberate on its face.\nNo behavior change.\n\n* Source/WebCore/editing/FrameSelection.cpp:\n(WebCore::FrameSelection::respondToNodeModification):\n\nCanonical link: https://commits.webkit.org/318053@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "2826db838ec7c2b5eb8b1447484f6306e3d29c63",
      "subject": "Split the start/end block in FrameSelection::respondToNodeModification onto its own line"
    },
    "318054@main": {
      "author": "Fady Farag",
      "avatar": "https://www.gravatar.com/avatar/0ac5127c69f90d0c57054173ae4c3108?d=identicon\u0026s=64",
      "cl": "318054@main",
      "clUrl": "https://commits.webkit.org/318054@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320417\nrdar://183378247\n\nReviewed by Chris Dumez.\n\nDrop `NODELETE` from a function that destroys objects since it is a lie.\n\n* Source/WebCore/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/WebCore/css/CSSFontFaceRule.cpp:\n(WebCore::CSSFontFaceRule::reattach):\n* Source/WebCore/css/CSSPageRule.cpp:\n(WebCore::CSSPageRule::reattach):\n* Source/WebCore/css/CSSPositionTryRule.cpp:\n(WebCore::CSSPositionTryRule::reattach):\n* Source/WebCore/css/PropertySetCSSDescriptors.h:\n\nCanonical link: https://commits.webkit.org/318054@main",
      "email": "com.webkit.iidmsa@gmail.com",
      "hash": "b64f79b00305bf580132d795c6cbd1d3a2ad8ae0",
      "subject": "Remove incorrect `NODELETE` annotation from `PropertySetCSSDescriptors::reattach()`"
    },
    "318055@main": {
      "author": "Philippe Normand",
      "avatar": "https://www.gravatar.com/avatar/eef27203750af3510263cc29af21a16e?d=identicon\u0026s=64",
      "cl": "318055@main",
      "clUrl": "https://commits.webkit.org/318055@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320327\n\nReviewed by Xabier Rodriguez-Calvar.\n\nMake sure GStreamer is initialized before creating WebCodecs backends.\n\n* Source/WebCore/platform/audio/gstreamer/AudioDecoderGStreamer.cpp:\n(WebCore::GStreamerAudioDecoder::create):\n* Source/WebCore/platform/audio/gstreamer/AudioEncoderGStreamer.cpp:\n(WebCore::GStreamerAudioEncoder::create):\n* Source/WebCore/platform/graphics/gstreamer/VideoDecoderGStreamer.cpp:\n(WebCore::GStreamerVideoDecoder::create):\n* Source/WebCore/platform/graphics/gstreamer/VideoEncoderGStreamer.cpp:\n(WebCore::GStreamerVideoEncoder::create):\n\nCanonical link: https://commits.webkit.org/318055@main",
      "email": "philn@igalia.com",
      "hash": "9f0d1487e00281ae05f8b8a99dbf45bdb7da6fc2",
      "subject": "[GStreamer] Any WebCodecs VideoEncoder use crashes WebKitWebProcess (SIGABRT) during webkitvideoencoder element registration"
    },
    "318056@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "318056@main",
      "clUrl": "https://commits.webkit.org/318056@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320350\n\nReviewed by Youenn Fablet.\n\nAsyncRevalidation::staleWhileRevalidateEnding() fires when the stale-while-revalidate\nwindow elapses, which is precisely the case where the revalidation network load may still\nbe in flight. It only invoked the completion handler (reporting Result::Timeout), which\nremoves the AsyncRevalidation from Cache::m_pendingAsyncRevalidations and, once the timer's\nprotecting reference is released, destroys it along with its owned SpeculativeLoad.\n\nDestroying a SpeculativeLoad whose load is still outstanding is not a clean teardown:\n~SpeculativeLoad asserts that m_networkLoad is null, and its RevalidationCompletionHandler\nis destroyed without ever being called (CompletionHandler asserts it must always be\ncalled). In debug this is a pair of assertion failures; in release the in-flight\nNetworkLoad is orphaned and the completion handler's captured state leaks.\n\nCancel the load on this path, matching AsyncRevalidation::cancel(). We move the completion\nhandler out before calling SpeculativeLoad::cancel() so that cancel()'s own callback does\nnot re-enter our handler and report Result::Failure before we report Result::Timeout.\n\n* Source/WebKit/NetworkProcess/cache/AsyncRevalidation.cpp:\n(WebKit::NetworkCache::AsyncRevalidation::staleWhileRevalidateEnding):\n\nCanonical link: https://commits.webkit.org/318056@main",
      "email": "cdumez@apple.com",
      "hash": "bff32498c2d9ad936c05a27899b5f794aacb2563",
      "subject": "Cancel the in-flight SpeculativeLoad when a stale-while-revalidate revalidation times out"
    },
    "318057@main": {
      "author": "Yoav Weiss",
      "avatar": "https://www.gravatar.com/avatar/228600d5a1cfae576e64ee92e46f6a1e?d=identicon\u0026s=64",
      "cl": "318057@main",
      "clUrl": "https://commits.webkit.org/318057@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316291\n\nReviewed by Alex Christensen.\n\nCurrently the timeOrigin is set when the final process starts the navigation request load.\nBut in the case of a BCG switch, that load ends up resuming/reusing a load that was already\nstarted in the previous process.\nThis PR pipes the relevant information over, so that the `timeOrigin` will be properly set\nin these cases.\n\nThis is fine from a w3c/navigation-timing#160 perspective, because as\nagainst this by obfuscating more than just the redirect data for cross-origin redirects.\n\nTest progression.\n\n* Source/WebCore/loader/DocumentLoader.cpp:\n(WebCore::DocumentLoader::startLoadingMainResource): Set the original navigation time if provided.\n* Source/WebCore/loader/DocumentLoader.h:\n(WebCore::DocumentLoader::setOriginalNavigationStartTime): Setter.\n* Source/WebCore/loader/FrameLoadRequest.h:\n(WebCore::FrameLoadRequest::originalNavigationStartTime const): Getter.\n(WebCore::FrameLoadRequest::setOriginalNavigationStartTime): Setter.\n* Source/WebCore/loader/FrameLoader.cpp:\n(WebCore::FrameLoader::load): Set the originalNavigationStartTime from the request.\n* Source/WebCore/loader/ResourceLoadTiming.h:\n(WebCore::ResourceLoadTiming::setStartTime): Setter.\n* Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.h:\n* Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.serialization.in:\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:\n(WebKit::NetworkResourceLoader::sendDidReceiveResponsePotentiallyInNewBrowsingContextGroup): Add originalNavigationStartTime as parameter to the BCG switch.\n(WebKit::NetworkResourceLoader::sendDidReceiveResponseWithPotentialProcessSwap):\n* Source/WebKit/Shared/LoadParameters.h:\n* Source/WebKit/Shared/LoadParameters.serialization.in:\n* Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp:\n(WebKit::NetworkProcessProxy::triggerBrowsingContextGroupSwitchForNavigation): Add originalNavigationStartTime as parameter to the BCG switch.\n(WebKit::NetworkProcessProxy::considerProcessSwapForNavigationResponse):\n* Source/WebKit/UIProcess/Network/NetworkProcessProxy.h:\n* Source/WebKit/UIProcess/Network/NetworkProcessProxy.messages.in:\n* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:\n(WebKit::ProvisionalPageProxy::loadRequest): Add originalNavigationStartTime as parameter to the BCG switch.\n* Source/WebKit/UIProcess/ProvisionalPageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::loadRequestWithNavigationShared): Set the originalNavigationStartTime in parameters.\n(WebKit::WebPageProxy::continueNavigationInNewProcess): Pass originalNavigationStartTime.\n(WebKit::WebPageProxy::triggerBrowsingContextGroupSwitchForNavigation): Pass originalNavigationStartTime.\n(WebKit::WebPageProxy::loadRequest):\n(WebKit::WebPageProxy::receivedNavigationActionPolicyDecision):\n(WebKit::WebPageProxy::performProcessSwapForNavigationResponse):\n(WebKit::WebPageProxy::triggerProcessSwapForEnhancedSecurity):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp:\n(WebKit::WebLoaderStrategy::scheduleLoadFromNetworkProcess): Set the originalNavigationStartTime from the documentLoader's startTime.\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::loadRequest): Set the originalNavigationStartTime from the load parameters.\n* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/response-start-after-coop-bcg-switch-no-tao.tentative.https-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/response-start-after-coop-bcg-switch-no-tao.tentative.https.html: Added.\n\nCanonical link: https://commits.webkit.org/318057@main",
      "email": "yoav.weiss@shopify.com",
      "hash": "f8352ee5402eeb2d84d156b368e5abf0f0659fc1",
      "subject": "Set timeOrigin to align with spec, even when BCG switches take place."
    },
    "318058@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "318058@main",
      "clUrl": "https://commits.webkit.org/318058@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=320331\u003e\n\u003crdar://183267494\u003e\n\nReviewed by Elliott Williams.\n\nThe TestWebKitAPI, TestWTF, TestIPC, and TestWGSL executables are built\nby the tools build but never installed, so run-api-tests can not find\nthem in the collected root.  Give each an INSTALL_PATH in the Resources\nfolder of WebKit.framework, mirroring WebKitTestRunner, so the tools\nbuild collects them.\n\nNo new tests since this change is not directly testable.\n\n* Tools/TestWebKitAPI/Configurations/TestIPC.xcconfig:\n* Tools/TestWebKitAPI/Configurations/TestWGSL.xcconfig:\n* Tools/TestWebKitAPI/Configurations/TestWTF.xcconfig:\n* Tools/TestWebKitAPI/Configurations/TestWebKitAPI.xcconfig:\n\nCanonical link: https://commits.webkit.org/318058@main",
      "email": "ddkilzer@apple.com",
      "hash": "f30b74114a35a3e6fc0b48d0231648f324c0a1f8",
      "subject": "Install TestWebKitAPI and API-test executables on tools builds"
    },
    "318059@main": {
      "author": "ark",
      "avatar": "https://www.gravatar.com/avatar/4ae561c26ab15c23950b75f5e3a35f1a?d=identicon\u0026s=64",
      "cl": "318059@main",
      "clUrl": "https://commits.webkit.org/318059@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320364\n\nReviewed by Tadeu Zagallo.\n\nAdds missing braces to WGSL alias analsis, correcting the logic that can\nbe overly conservative today as a result\n\n* Source/WebGPU/WGSL/AliasAnalysis.cpp:\n(WGSL::AliasAnalysis::write):\n\nCanonical link: https://commits.webkit.org/318059@main",
      "email": "ark@localhost",
      "hash": "41daa01748411a95855d8b6a0f0ffbd54f729a08",
      "subject": "Add missing braces in the WGSL alias analysis pass"
    },
    "318060@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "318060@main",
      "clUrl": "https://commits.webkit.org/318060@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320177\n\nReviewed by Yusuke Suzuki.\n\nEvery DFG BasicBlock allocates intersectionOfPastValuesAtHead, an\nOperands\u003cAbstractValue\u003e costing 32 bytes per operand, but its only\nconsumer is JITCompiler::noticeOSREntry, which reads it to build the\nOSR entry's expected values. Only the entry block and non-inlined loop\nheaders are OSR entry targets, so for the vast majority of blocks the\narray is written on every CFA run and never read.\n\nAllocate it lazily in CFAPhase instead, only for OSR target blocks that\nCFA has reached. noticeOSREntry now reads the field directly and asserts\nit is populated and sized like variablesAtHead.\n\nPeak RSS on Apple Silicon: a synthetic function with 1200 branches and\n128 locals goes from 236.4MB to 219.4MB (-7.2%), and 8 iterations of\nOctane/typescript go from 578.6MB to 564.2MB (-2.5%).\n\n* Source/JavaScriptCore/dfg/DFGBasicBlock.cpp:\n(JSC::DFG::BasicBlock::BasicBlock):\n(JSC::DFG::BasicBlock::ensureLocals):\n(JSC::DFG::BasicBlock::ensureTmps):\n(JSC::DFG::BasicBlock::ensureIntersectionOfPastValuesAtHead):\n* Source/JavaScriptCore/dfg/DFGBasicBlock.h:\n* Source/JavaScriptCore/dfg/DFGCFAPhase.cpp:\n(JSC::DFG::CFAPhase::run):\n* Source/JavaScriptCore/dfg/DFGGraph.cpp:\n(JSC::DFG::Graph::dump):\n* Source/JavaScriptCore/dfg/DFGJITCompiler.cpp:\n(JSC::DFG::JITCompiler::noticeOSREntry):\n\nCanonical link: https://commits.webkit.org/318060@main",
      "email": "sosuke@bun.sh",
      "hash": "83540481435f16b21495a8463bc3c0bf79c670a1",
      "subject": "[JSC] Allocate DFG `BasicBlock::intersectionOfPastValuesAtHead` only for OSR entry targets"
    },
    "318061@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "318061@main",
      "clUrl": "https://commits.webkit.org/318061@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320312\n\nReviewed by Yusuke Suzuki.\n\nTwo places in the Joint Iteration builtins created ordinary objects backed by\nObject.prototype, so polluting the prototype changed observable behavior:\n\n1. getOptionsObject() returned `{}` instead of OrdinaryObjectCreate(null), so with\n   options omitted, Get(options, \"mode\") / Get(options, \"padding\") read through\n   Object.prototype:\n\n       Object.defineProperty(Object.prototype, \"mode\", { value: \"strict\" });\n       Array.from(Iterator.zip([[1, 2, 3], [4, 5]]));   // throws instead of [[1, 4], [2, 5]]\n\n2. iteratorZip() installed the synthetic underlying iterator's return() with an\n   ordinary [[Set]] on `{}`. A non-writable Object.prototype.return made every\n   Iterator.zip() call throw at creation, and an accessor silently swallowed the\n   assignment so IteratorCloseAll never ran.\n\nUse @Object.@create(null) for both. This covers zip and zipKeyed since both go\nthrough @iteratorZip.\n\nTest: JSTests/stress/iterator-zip-object-prototype-pollution.js\n\n* JSTests/stress/iterator-zip-object-prototype-pollution.js: Added.\n(shouldBe):\n(try.shouldBe.JSON.stringify.Array.from.Iterator.zipKeyed):\n(try.b.makeIterator):\n(set configurable):\n* Source/JavaScriptCore/builtins/JSIteratorConstructor.js:\n(linkTimeConstant.getOptionsObject):\n\nCanonical link: https://commits.webkit.org/318061@main",
      "email": "sosuke@bun.sh",
      "hash": "0731b27c1b605241c9e23cceddae5af7717716ea",
      "subject": "[JSC] `Iterator.zip` should use null-prototype objects for `GetOptionsObject` and the synthetic underlying iterator"
    },
    "318062@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "318062@main",
      "clUrl": "https://commits.webkit.org/318062@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320313\n\nReviewed by Yusuke Suzuki.\n\nThe U_FAILURE(status) check sat after the early return for non-Chinese/Dangi\ncalendars (i.e. Hebrew), so it never guarded the ucal_getLimit call: on ICU\nfailure the function returned an engaged optional { 0 } and the callers\nclamped the day to 0 under overflow: \"constrain\" instead of throwing a\nRangeError. Check the status right after ucal_getLimit.\n\n* Source/JavaScriptCore/runtime/temporal/core/CalendarICUBridge.cpp:\n(JSC::TemporalCore::actualLunisolarMonthLength):\n\nCanonical link: https://commits.webkit.org/318062@main",
      "email": "sosuke@bun.sh",
      "hash": "09917ef55b0f95601817be0ad3100e4ff5044a69",
      "subject": "[JSC] Add missing `U_FAILURE(status)` for `actualLunisolarMonthLength`"
    },
    "318063@main": {
      "author": "Lauro Moura",
      "avatar": "https://www.gravatar.com/avatar/6157f52d61e04c2c63fe7ff668ba69b3?d=identicon\u0026s=64",
      "cl": "318063@main",
      "clUrl": "https://commits.webkit.org/318063@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320450\n\nReviewed by Carlos Alberto Lopez Perez.\n\nReplace the stop-the-world ASSERT_NOT_IMPLEMENTED_YET with\na notImplement() call, avoiding the ~40 crashes reaching this block.\nThis follows the same pattern used in other callbacks in the same file.\n\n* Source/WebCore/layout/formattingContexts/grid/TrackSizingAlgorithm.cpp:\n(WebCore::Layout::sizeTracksToFitNonSpanningItems):\n\nCanonical link: https://commits.webkit.org/318063@main",
      "email": "lmoura@igalia.com",
      "hash": "385d8e2ffd58ad860a545dffcb4898e26ca8e8eb",
      "subject": "REGRESSION(318033@main) Crash in Layout::sizeTracksToFitNonSpanningItems due to ASSERT_NOT_IMPLEMENTED_YET"
    },
    "318064@main": {
      "author": "Lauro Moura",
      "avatar": "https://www.gravatar.com/avatar/6157f52d61e04c2c63fe7ff668ba69b3?d=identicon\u0026s=64",
      "cl": "318064@main",
      "clUrl": "https://commits.webkit.org/318064@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320453\n\nUnreviewed test gardening.\n\n* WebDriverTests/TestExpectations.json:\n\nCanonical link: https://commits.webkit.org/318064@main",
      "email": "lmoura@igalia.com",
      "hash": "01c6bd3af8fe1783936122b81c8cae3eb42be6c4",
      "subject": "[WebDriver] Execute Script serializes non-Element DOM nodes as element handles instead of cloning them"
    },
    "318065@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "318065@main",
      "clUrl": "https://commits.webkit.org/318065@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320388\n\nReviewed by Antti Koivisto.\n\nplaceFlexItems walked each line forwards accumulating a main-axis offset, then mirrored that offset about\nthe container's main extent for a reversed row before recording it. So its output was partly logical and\npartly physical, and the two cross-axis flips it does not know about -- wrap-reverse and rtl-column --\nwere applied afterwards in computeFlexItemRects.\n\nMove the main-axis flip there too. placeFlexItems now emits flow-relative offsets only, and\ncomputeFlexItemRects is the single logical-to-physical conversion, resolving every reversed direction in\none place against extents that are final by the time it runs.\n\nColumn flow keeps reversing in layoutColumnReverse, and the flip here stays row-only. Two things stand in\nthe way of folding it in: the container's block axis is the column's main axis, so its extent is not\nsettled until the items have been placed and the flip has nothing to pivot on; and isLeftToRightFlow is\nalready false for a column whose block axis runs backwards (vertical-rl), a reversal the flow-aware\nborder, padding and margin accessors consume rather than a position flip. Turning the flip on for columns\ntherefore double-counts the writing mode, and folding flex-direction into isLeftToRightFlow swaps column\nwith column-reverse instead of reversing either.\n\nplaceFlexItems and layoutColumnReverse keep writing the item's position, even though computeFlexItemRects\nwalks every line and writes each item again. The value is read in between: cross-axis stretching lays the\nitem out once more, and content inside it can read its position back off the renderer -- an outside list\nmarker offsets itself by the flex item's logical left in\nBoxGeometryUpdater::setListMarkerOffsetForMarkerOutside. So the item needs a main-axis position by then, and\nthe row flip that produces it moves into a helper both callers share.\n\nWhile here, have FlexFormattingContext keep the FlexLayoutState reference it is constructed with rather\nthan reading it back out of FlexIntegrationUtils, which it had handed the same reference to. That was the\nlast caller of FlexIntegrationUtils::flexLayoutState(), so it becomes private, and flexBox() turns out to\nhave no callers outside the class either.\n\nNo change in behaviour.\n\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.cpp:\n(WebCore::FlexFormattingContext::FlexFormattingContext):\n(WebCore::FlexFormattingContext::layoutState):\n(WebCore::FlexFormattingContext::computeFlexItemRects):\n(WebCore::FlexFormattingContext::placeFlexItems):\n(WebCore::FlexFormattingContext::layoutColumnReverse):\n(WebCore::FlexFormattingContext::mainAxisFlippedOffsetForRow const):\n(WebCore::FlexFormattingContext::layoutState const):\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.h:\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.h:\n\nCanonical link: https://commits.webkit.org/318065@main",
      "email": "zalan@apple.com",
      "hash": "182d57a142ef5cfd81780b6fa836de8ade7e2a2e",
      "subject": "[cleanup] Have the flex algorithm place items in flow-relative coordinates"
    },
    "318066@main": {
      "author": "Carlos Garcia Campos",
      "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64",
      "cl": "318066@main",
      "clUrl": "https://commits.webkit.org/318066@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314883\n\nReviewed by Nikolas Zimmermann.\n\nMake SkiaCompositingLayer3DRenderingContext::Layer public and make\nSkiaCompositingLayer3DRenderingContext::paint() receive a list of\nSkiaCompositingLayer3DRenderingContext::Layer instead. This way while\ncollecting the 3D context layers we can build the\nSkiaCompositingLayer3DRenderingContext::Layer without having to iterate\nthe layers again in paint(). The geometry for 3D context is now computed\ntaking into account the flattened bounding box when needed instead of\nalways using the layer rectangle, which is what actually fixes the\nincorrect z-ordering.\n\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.cpp:\n(WebCore::SkiaCompositingLayer::transformedFlattenedBounds const):\n(WebCore::SkiaCompositingLayer::geometryFor3DRenderingContext const):\n(WebCore::SkiaCompositingLayer::collect3DRenderingContextLayers):\n(WebCore::SkiaCompositingLayer::paintWith3DRenderingContext):\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.h:\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayer3DRenderingContext.cpp:\n(WebCore::SkiaCompositingLayer3DRenderingContext::paint):\n(WebCore::SkiaCompositingLayer3DRenderingContext::buildTree):\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayer3DRenderingContext.h:\n(WebCore::SkiaCompositingLayer3DRenderingContext::Layer::Layer):\n\nCanonical link: https://commits.webkit.org/318066@main",
      "email": "cgarcia@igalia.com",
      "hash": "7a767a006f81bc3462b6c2ea74e65316a4ae5e21",
      "subject": "[GTK][WPE] SkiaCompositingLayer: incorrect z-ordering at Snow Stack"
    },
    "318067@main": {
      "author": "Frédéric Wang Nélar",
      "avatar": "https://www.gravatar.com/avatar/2c634be4515bda5959ed1d7138b17d48?d=identicon\u0026s=64",
      "cl": "318067@main",
      "clUrl": "https://commits.webkit.org/318067@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320094\n\nReviewed by Adrian Perez de Castro.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/020e10bcee5ec1ff7af556d1187963b0e6ab4290\n\n* LayoutTests/TestExpectations: Skip most of the tests, since they time out until compression dictionary transport is implemented and can be very slow.\n* LayoutTests/imported/w3c/resources/resource-files.json:\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/compressed-large-resources-001.tentative.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/compressed-large-resources-002.tentative.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-clear-site-data-cache.tentative.https-expected.txt: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-clear-site-data-cookies.tentative.https-expected.txt: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-clear-site-data-storage.tentative.https-expected.txt: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-compressed-fetch-with-link-match-dest.tentative.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-compressed.tentative.https-expected.txt: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-decompression.tentative.https-expected.txt: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-decompression.tentative.https.h2.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-no-cors.tentative.https-expected.txt: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-no-cors.tentative.https.html:\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-timing-001.tentative.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-timing-002.tentative.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-with-imagesrcset.tentative.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-with-link-connect-src-nonce.tentative.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-with-link-connect-src-nonce.tentative.https.html.headers: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-with-link-connect-src.tentative.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-with-link-connect-src.tentative.https.html.headers: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-with-link-element-baseURL.tentative.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-with-link-element-crossorigin.tentative.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-with-link-element-events.tentative.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-with-link-element-in-body.tentative.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-with-link-element-invalid-url.tentative.https-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-with-link-element-invalid-url.tentative.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-with-link-element.tentative.https-expected.txt: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-with-link-element.tentative.https.html:\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-with-link-header-in-early-hints.tentative.https.h2.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-with-link-header-in-subresources.tentative.https-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-with-link-header-in-subresources.tentative.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-with-link-header.tentative.https-expected.txt: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-with-link-integrity.tentative.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-with-link-referrer-and-referrerpolicy.tentative.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-fetch-with-type-attribute.tentative.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-match.tentative.https-expected.txt: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-match.tentative.https.html:\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-registration.tentative.https-expected.txt: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/dictionary-registration.tentative.https.html:\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/fetch-destination.tentative.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/compressed-data.h2.py: Added.\n(handle_headers):\n(main):\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/compressed-data.py:\n(main):\n(headers_and_content):\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/compression-dictionary-util.sub.js:\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/dictionary-fetch-timing-001-subframe.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/dictionary-fetch-timing-001-subframe.https.html.headers: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/dictionary-fetch-with-link-header-in-early-hints.tentative.https.h2.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/dummy: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/early-hint-for-compression-dictionary-test-loader.h2.py: Added.\n(_remove_relative_resources_prefix):\n(handle_headers):\n(main):\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/empty.https.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/fetch-options-worker.js: Added.\n(event.request.url.includes):\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/register-dictionary-network-error.py: Added.\n(main):\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/register-dictionary.h2.py: Added.\n(main):\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/Makefile: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/dcb-header: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/dcz-header: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/image-001.png: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/image-001.png.headers: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/script-001.js: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/script-001.js.headers: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/self-compressed-image-001.png.dcb: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/self-compressed-image-001.png.dcb.headers: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/self-compressed-image-001.png.dcz: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/self-compressed-image-001.png.dcz.headers: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/self-compressed-script-001.js.dcb: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/self-compressed-script-001.js.dcb.headers: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/self-compressed-script-001.js.dcz: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/self-compressed-script-001.js.dcz.headers: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/self-compressed-style-001.css.dcb: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/self-compressed-style-001.css.dcb.headers: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/self-compressed-style-001.css.dcz: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/self-compressed-style-001.css.dcz.headers: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/self-compressed-subframe-001.html.dcb: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/self-compressed-subframe-001.html.dcb.headers: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/self-compressed-subframe-001.html.dcz: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/self-compressed-subframe-001.html.dcz.headers: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/style-001.css: Added.\n(.green_square):\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/style-001.css.headers: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/subframe-001-compressed-by-script-001.html.dcb: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/subframe-001-compressed-by-script-001.html.dcb.headers: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/subframe-001-compressed-by-script-001.html.dcz: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/subframe-001-compressed-by-script-001.html.dcz.headers: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/subframe-001-compressed-by-style-001.html.dcb: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/subframe-001-compressed-by-style-001.html.dcb.headers: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/subframe-001-compressed-by-style-001.html.dcz: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/subframe-001-compressed-by-style-001.html.dcz.headers: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/subframe-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/subframe-001.html.headers: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/static/w3c-import.log: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/resources/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/fetch/compression-dictionary/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/lint.ignore:\n* LayoutTests/tests-options.json:\n\nCanonical link: https://commits.webkit.org/318067@main",
      "email": "fwang@igalia.com",
      "hash": "c1b2e8ce2cf135a2f57324c8bf1423605bb6949d",
      "subject": "Update fetch/compression-dictionary from WPT"
    },
    "318068@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "318068@main",
      "clUrl": "https://commits.webkit.org/318068@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320358\nrdar://162548811\n\nReviewed by Richard Robinson and Aditya Keerthi.\n\nA PDF plugin reports its HUD bounding box in its frame tree's root view\ncoordinate space. When an embedded PDF is in a site isolated subframe,\nthat root is the subframe rather than the top-level web view the HUD is\na subview of, so the box lacks the subframe's offset within the page and\nthe HUD is drawn at the wrong location.\n\nIn this patch, we convert the bounding box from the plugin frame's local\nroot to the top-level main frame coordinates in the UI process. Since\nthis is an async conversion, we defer PDF HUD creation until the frame\nhas been converted. As such, we introduce a map to keep track of pending\nHUD location updates that we apply after HUD creation.\n\nTest: TestWebKitAPI.UnifiedPDF.EmbeddedPDFHUDSiteIsolation\n\n* Source/WebKit/UIProcess/mac/WebViewImpl.h:\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::createPDFHUD):\n(WebKit::WebViewImpl::updatePDFHUDLocation):\n(WebKit::WebViewImpl::convertPDFHUDBoundingBoxToWebViewCoordinates):\n(WebKit::WebViewImpl::removePDFHUD):\n(WebKit::WebViewImpl::removeAllPDFHUDs):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/UnifiedPDFTests.mm:\n(TestWebKitAPI::EmbeddedPDFHUDSiteIsolation::embedElement const):\n(TestWebKitAPI::EmbeddedPDFHUDSiteIsolation::crossOrigin const):\n(TestWebKitAPI::EmbeddedPDFHUDSiteIsolation::siteIsolationEnabled const):\n(TestWebKitAPI::EmbeddedPDFHUDSiteIsolation::mainHTML const):\n(TestWebKitAPI::EmbeddedPDFHUDSiteIsolation::testNameGenerator):\n(TestWebKitAPI::TEST_P):\n  Covers the matrix of { \u003ciframe\u003e, \u003cembed\u003e, \u003cobject\u003e } x { same-origin,\n  cross-origin } x { SI disabled, enabled } and asserting that the HUD\n  frame lands at the emebedded element's offset in every case.\n\nCanonical link: https://commits.webkit.org/318068@main",
      "email": "a_protyasha@apple.com",
      "hash": "bbc90c010446b48541978c95b55d83151583dfb8",
      "subject": "[Site Isolation] [macOS] PDF HUD in cross origin \u003ciframe src=pdf\u003e is unexpectedly offset"
    },
    "318069@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "318069@main",
      "clUrl": "https://commits.webkit.org/318069@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320413\nrdar://183375736\n\nReviewed by Richard Robinson and Megan Gardner.\n\nThis patch adds some simple debugging visuals for the PDF HUD to help\nidentify the relevant HUD frames. We key off of CompositingBordersVisible\nto display the debug indicators.\n\nWe wrap the changes around Swift 6.4 and SWIFT_WEBKIT_TOOLCHAIN presence\n-- minimum Swift version with the necessary C++ interop features and the\nsaferCpp bots (which set SWIFT_WEBKIT_TOOLCHAIN) are still on \u003c 6.4.\n\n* Source/WebKit/UIProcess/PDF/WKPDFHUDView.swift:\n\nCanonical link: https://commits.webkit.org/318069@main",
      "email": "a_protyasha@apple.com",
      "hash": "5eda8501c9c38260707f908d735ecda495bfb925",
      "subject": "Add a debug UI for the PDF HUD"
    },
    "318070@main": {
      "author": "Lauro Moura",
      "avatar": "https://www.gravatar.com/avatar/6157f52d61e04c2c63fe7ff668ba69b3?d=identicon\u0026s=64",
      "cl": "318070@main",
      "clUrl": "https://commits.webkit.org/318070@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320461\n\nUnreviewed test gardening.\n\n* WebDriverTests/TestExpectations.json:\n\nCanonical link: https://commits.webkit.org/318070@main",
      "email": "lmoura@igalia.com",
      "hash": "f8196a94ab2f086c4d93ef877fc2f949b92c59fc",
      "subject": "[WebDriver] Cannot access elements inside a closed shadow tree (\"no such shadow root\")"
    },
    "318071@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "318071@main",
      "clUrl": "https://commits.webkit.org/318071@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320382\nrdar://problem/183344674\n\nReviewed by Alan Baradlay.\n\nWhen a negative line number is used to position a grid item this causes\nus to begin searching from the line from the end of the grid instead of\nfrom the beginning. Depending on the value of this negative line number\nwe may end up going past the beginning of the explicit grid and create\nimplicit tracks at the beginning. For example a grid with two explicit\ncolumns with lines L1 L2 L3, a grid item with position -4 / -3 would end\nup creating one implicit column in the beginning of the grid.\n\nWe currently keep track of where this position is by computing a\nnormalization offset which basically keeps track of the magnitude of the\nnegative grid positions. We then shift each grid item's position by this\noffset so that the resulting position is relative to the start of the\nimpicit grid. We currently have a dedicated API which callers are\nexpected to use during item placement that contains some debug asserts\nto make sure that the normalization offset was computed and applied. To\nsimplify this API, we can move this logic outside of GridLayout and into\nthe formatting context since we should be able to compute this\ninformation beforehand. Then, when we create the GridPosition type that\nwe created recently we can compute and set a position that is relative\nto the implicit grid as we create the UnplacedGridItem. We can then get\nrid of one of the two APIs we have for getting an item's position which\nshould make things overall a bit simpler.\n\n* Source/WebCore/layout/formattingContexts/grid/GridFormattingContext\n(WebCore::Layout::GridFormattingContext::constructUnplacedGridItems\nWe go through all of the grid items already so during this process let's\ntry to figure out the largest magnitude of the negative line numbers. We\nwill then plumb this value into the rest of the code that creates the\nUnplacedGridItem and corresponding GridPosition. The resulting\nGridPosition will be relative to the implicit grid.\n\n* Source/WebCore/layout/formattingContexts/grid/GridLayout.cpp:\n(WebCore::Layout::GridLayout::calculateInitialImplicitGridDimension\nNow that we compute the positions relative to the implicit grid itself\nthe number of columns/tracks is just the maximum of the column/row\npositions of the items.\n\n* Source/WebCore/layout/formattingContexts/grid/UnplacedGridItem.cp\n(WebCore::Layout::UnplacedGridItem::GridPosition::create):\nTake into consideration the offset that we computed earlier inside\nGridFormattingContext when we construct the positions of the\nUnplacedGridItem now.\n\n(WebCore::Layout::UnplacedGridItem::resolveDefinitePosition):\nNew helper that is used to determine if a grid item's position or not\naccording to:\nhttps://drafts.csswg.org/css-grid-1/#placement\n\n(WebCore::Layout::UnplacedGridItem::definiteRowStartEnd const):\n(WebCore::Layout::UnplacedGridItem::definiteColumnStartEnd const):\n(WebCore::Layout::UnplacedGridItem::normalizedColumnStart const): D\n(WebCore::Layout::UnplacedGridItem::normalizedColumnEnd const): Del\n(WebCore::Layout::UnplacedGridItem::normalizedRowStart const): Dele\n(WebCore::Layout::UnplacedGridItem::normalizedRowEnd const): Delete\n(WebCore::Layout::UnplacedGridItem::normalizedRowStartEnd const): D\n(WebCore::Layout::UnplacedGridItem::normalizedColumnStartEnd const)\nNow that we no longer have the contept of a normalized position we can\njust have the single definite position API.\n\nCanonical link: https://commits.webkit.org/318071@main",
      "email": "sammy.gill@apple.com",
      "hash": "7be8af50b716ba102581dc35e626637cfa45c693",
      "subject": "[GFC] Apply a grid item's negative line offset when constructing UnplacedGridItem"
    },
    "318072@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "318072@main",
      "clUrl": "https://commits.webkit.org/318072@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320437\nrdar://183400665\n\nReviewed by Sosuke Suzuki.\n\n316941@main becomes performance regression in JSON.stringify because we\ninsert toJSON name check in the one of the hottest loop listing\nproperties. But we do not need this check for enumerable properties.\nWhen it is enumerable, we check this field later anyway, and we fail if\nit is callable one and otherwise it is just handled as a normal object.\nSo we only need to check this name when a property is non-enumerable.\nThis patch fixes it by moving the check to make this loop fast.\n\nTest: JSTests/stress/json-stringify-enumerable-to-json.js\n\n* JSTests/stress/json-stringify-enumerable-to-json.js: Added.\n(shouldBe):\n(shouldThrow):\n(shouldBe.JSON.stringify.toJSON):\n(shouldBe.JSON.stringify.key.toJSON):\n(shouldBe.JSON.stringify.nested.toJSON):\n(shouldBe.JSON.stringify.toJSON.new.Proxy):\n(shouldThrow.JSON.stringify.toJSON):\n(shouldThrow.JSON.stringify):\n(i.shouldBe.JSON.stringify.toJSON):\n* Source/JavaScriptCore/runtime/JSONObject.cpp:\n(JSC::bufferMode\u003e::append):\n\nCanonical link: https://commits.webkit.org/318072@main",
      "email": "ysuzuki@apple.com",
      "hash": "9f9370cc729f0e035aa09416b3ca84e6ac8a69c5",
      "subject": "[JSC] Fix JSON stringify regression due to toJSON check"
    },
    "318073@main": {
      "author": "Brady Eidson",
      "avatar": "https://www.gravatar.com/avatar/31bed81d6d8ef517f93b30add03f5651?d=identicon\u0026s=64",
      "cl": "318073@main",
      "clUrl": "https://commits.webkit.org/318073@main",
      "description": "rdar://182962288\nhttps://bugs.webkit.org/show_bug.cgi?id=320028\n\nReviewed by Alex Christensen.\n\nJavaScript dialog APIs (i.e. window.alert(), etc) currently work well with site isolation on.\nThese tests verify they continue to work well.\n\nOne notable difference with site isolation is that a cross-origin iframe stuck in a JS dialog no longer\nblocks the main frame. This is web compatible and suggested by the specs. And these tests also confirm\nthat behavior remains as expected.\n\n* LayoutTests/http/tests/site-isolation/javascript-dialogs-in-cross-origin-iframe-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/javascript-dialogs-in-cross-origin-iframe.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/javascript-dialogs-iframe.html: Added.\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::testCrossSiteIframeCanShowAlert):\n(TestWebKitAPI::TEST(SiteIsolation, CrossSiteIframeCanShowAlertWithSiteIsolation)):\n(TestWebKitAPI::TEST(SiteIsolation, CrossSiteIframeCanShowAlertWithoutSiteIsolation)):\n(TestWebKitAPI::TEST(SiteIsolation, MainFrameHeartbeatContinuesWhileCrossSiteIframeDialogShown)):\n\nCanonical link: https://commits.webkit.org/318073@main",
      "email": "beidson@apple.com",
      "hash": "2d50d7a754c72cf9ef44a64254bcf2b4e9d3b22d",
      "subject": "Add tests verifying cross-origin iframe window.alert() behavior"
    },
    "318074@main": {
      "author": "Pascoe",
      "avatar": "https://www.gravatar.com/avatar/7a6e50b09dba6a185f45250268683d71?d=identicon\u0026s=64",
      "cl": "318074@main",
      "clUrl": "https://commits.webkit.org/318074@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320038\nrdar://problem/182968585\n\nReviewed by Abrar Rahman Protyasha.\n\nTurn the unvalidated digital credential request into a variant so the\nOpenID4VP presentation protocols can be represented alongside the\nexisting ISO 18013 mobile document request, and parse the signed and\nmultisigned variants entirely in the web content process.\n\nAdd IPC-serializable request structs under Modules/identity/protocols/openid/:\nOpenID4VPSignedRequest ({ request }, a JWS Compact Serialization) and\nOpenID4VPMultisignedRequest ({ payload, signatures }, a JWS JSON\nSerialization, whose signatures are OpenID4VPSignature { protected,\nsignature }).  All members are strings/vectors so the unvalidated\nrequest remains serializable across IPC; no JSObject crosses the process\nboundary.  The \"openid4vp-v1-unsigned\" protocol is added once its DCQL\nrequest parsing lands.\n\nUnvalidatedDigitalCredentialRequest becomes\nVariant\u003cMobileDocumentRequest, OpenID4VPSignedRequest,\nOpenID4VPMultisignedRequest\u003e.  convertProtocolString() now takes the\ndocument so it can gate the OpenID4VP protocols behind the off-by-default\nDigitalCredentialsOpenID4VPEnabled setting, and jsToCredentialRequest()\nconverts each via convertDictionary() in the web content process.  The\nrequest validator and the raw-request handoff to the picker switch over\nthe variant, handling the mobile document request and skipping the\nOpenID4VP requests until their validation and wallet routing land.\n\nTests: http/wpt/identity/digital-credential-openid4vp-request-parsing.https.html\n       http/wpt/identity/digital-credential-openid4vp-request-parsing-disabled.https.html\n\n* Source/WebCore/CMakeLists.txt:\n* Source/WebCore/DerivedSources.make:\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/Modules/identity/DigitalCredential.cpp:\n(WebCore::convertProtocolString):\n(WebCore::jsToCredentialRequest):\n* Source/WebCore/Modules/identity/protocols/UnvalidatedDigitalCredentialRequest.h:\n* Source/WebCore/Modules/identity/protocols/openid/OpenID4VPMultisignedRequest.h: Added.\n* Source/WebCore/Modules/identity/protocols/openid/OpenID4VPMultisignedRequest.idl: Added.\n* Source/WebCore/Modules/identity/protocols/openid/OpenID4VPSignature.h: Added.\n* Source/WebCore/Modules/identity/protocols/openid/OpenID4VPSignature.idl: Added.\n* Source/WebCore/Modules/identity/protocols/openid/OpenID4VPSignedRequest.h: Added.\n* Source/WebCore/Modules/identity/protocols/openid/OpenID4VPSignedRequest.idl: Added.\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebKit/Shared/WebCoreArgumentCodersAuth.serialization.in:\n* Source/WebKit/UIProcess/DigitalCredentials/WKDigitalCredentialsPicker.mm:\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/WebProcess/DigitalCredentials/DigitalCredentialsCoordinator.messages.in:\n* Source/WebKit/WebProcess/cocoa/IdentityDocumentServices/DigitalCredentialsRequestValidatorBridge.h:\n* Source/WebKit/WebProcess/cocoa/IdentityDocumentServices/DigitalCredentialsRequestValidatorBridge.mm:\n(WebKit::DigitalCredentials::validateRequests):\n* LayoutTests/http/wpt/identity/digital-credential-openid4vp-request-parsing.https.html: Added.\n* LayoutTests/http/wpt/identity/digital-credential-openid4vp-request-parsing.https-expected.txt: Added.\n* LayoutTests/http/wpt/identity/digital-credential-openid4vp-request-parsing-disabled.https.html: Added.\n* LayoutTests/http/wpt/identity/digital-credential-openid4vp-request-parsing-disabled.https-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/318074@main",
      "email": "pascoe@apple.com",
      "hash": "18ea1bb6285663216d95a9cebfe72c6ee10fe88e",
      "subject": "[Digital Credentials] Start to parse OpenID4VP signed and multisigned requests in the web content process"
    },
    "318075@main": {
      "author": "Charlie Wolfe",
      "avatar": "https://www.gravatar.com/avatar/857b3b5ff3394c31fa2689310a93dbab?d=identicon\u0026s=64",
      "cl": "318075@main",
      "clUrl": "https://commits.webkit.org/318075@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320430\nrdar://183391902\n\nReviewed by Alex Christensen.\n\nHistoryController::goToItem blocks the web process on BackForwardGoToItem in order to move the\nUIProcess's back/forward cursor before the load commits. This no longer needs to be synchronous. The\nonly reply payload is WebBackForwardListCounts, used to refresh WebBackForwardListProxy's cached\ncounts — but WebBackForwardList::goToItem already ends in didChangeBackForwardList(), which\nbroadcasts InvalidateBackForwardListCache to every web content process, so the cache is invalidated\nregardless of the reply.\n\n* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:\n(WebKit::ProvisionalPageProxy::backForwardGoToItem):\n(WebKit::ProvisionalPageProxy::didReceiveMessage):\n(WebKit::ProvisionalPageProxy::didReceiveSyncMessage):\n* Source/WebKit/UIProcess/ProvisionalPageProxy.h:\n* Source/WebKit/UIProcess/WebBackForwardList.cpp:\n(WebKit::WebBackForwardList::backForwardGoToItem):\n(WebKit::WebBackForwardList::backForwardGoToItemShared):\n* Source/WebKit/UIProcess/WebBackForwardList.h:\n* Source/WebKit/UIProcess/WebBackForwardList.messages.in:\n* Source/WebKit/UIProcess/WebBackForwardList.swift:\n(MakeAPIArray.backForwardGoToItem(_:)):\n(MakeAPIArray.backForwardGoToItemShared(_:)):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::didCommitLoadForFrame):\n(WebKit::WebPageProxy::backForwardGoToItemShared):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/WebProcess/WebPage/WebBackForwardListProxy.cpp:\n(WebKit::WebBackForwardListProxy::goToItem):\n\nCanonical link: https://commits.webkit.org/318075@main",
      "email": "charliew@apple.com",
      "hash": "eb3b8a3eb27175faecc4ec397acec2804c5199a9",
      "subject": "Make `BackForwardGoToItem` asynchronous"
    },
    "318076@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "318076@main",
      "clUrl": "https://commits.webkit.org/318076@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320465\nrdar://183413467\n\nUnreviewed build fix.\n\nFix the build by reverting the changes to the swift overlay file.\n\n* Source/WebKit/UIProcess/API/Cocoa/WebKitSwiftOverlay.swift:\n\nCanonical link: https://commits.webkit.org/318076@main",
      "email": "a_protyasha@apple.com",
      "hash": "e3257d149983ca263bf04ce5b205da0f0a3f243a",
      "subject": "REGRESSION(318040@main): Broke internal watchOS and tvOS builds"
    },
    "318078@main": {
      "author": "Yijia Huang",
      "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64",
      "cl": "318078@main",
      "clUrl": "https://commits.webkit.org/318078@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320419\nrdar://183378922\n\nReviewed by Yusuke Suzuki.\n\nstringCopyUpconvert() is stringCopySameType()'s Latin1-to-char16_t upconvert\nsibling and has the same gap: a scalar byte-at-a-time fallback and a 16-byte\nSIMD fast path, but nothing in between, so strings shorter than 16 bytes\nalways took the scalar loop.\n\nAdd the same 8-byte SWAR tier. Widening 4 packed Latin1 bytes into 4\nchar16_t lanes needs an extra step beyond stringCopySameType's plain copy,\nso this adds WTF::zeroExtendBytesToHalfwords(), a small bit-doubling\n\"spread\" helper, and reuses it instead of an 8-instruction unrolled\nextract-and-store loop.\n\n                                                   ToT                     Patched\n\njson-stringify-short-strings-upconvert      174.2817+-5.1099     ^    144.8684+-5.8863        ^ definitely 1.2030x faster\n\nTests: JSTests/microbenchmarks/json-stringify-short-strings-upconvert.js\n       Tools/TestWebKitAPI/Tests/WTF/MathExtras.cpp\n\nCanonical link: https://commits.webkit.org/318078@main",
      "email": "yijia_huang@apple.com",
      "hash": "1d355c27ea88a9e50184d16b7a76adb1ed6492bb",
      "subject": "[JSC] Add an 8-byte SWAR fast path to JSON.stringify's stringCopyUpconvert for short strings"
    },
    "318079@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "318079@main",
      "clUrl": "https://commits.webkit.org/318079@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320394\n\nReviewed by Antti Koivisto.\n\nlayoutColumnReverse walked each line a second time after placeFlexItems had already placed it,\nsubtracting where the first walk added, to lay the items out from the container's main-axis end. Two\nplacement functions had to stay in step, and column-reverse was the last flex-direction reversal the\nalgorithm resolved while laying out rather than at the flow-relative-to-physical conversion.\n\ncomputeFlexItemRects can flip the positions instead, now that it runs after the container's block extent\nis final -- which is what the second pass was waiting for. It flips the item's *margin* box and steps back\nover its leading margin: the two walks consume marginStart and marginEnd in opposite orders, so flipping\nthe border box only lines up if those two swap, while the margin box is symmetric under reversal by\nconstruction.\n\nThe edge to flip about is the container's main border-box extent, less the main-axis scrollbar, adjusted\nby the difference between the flow-aware start and end border+padding -- the same quantities the removed\nwalk started from.\n\nNote this flip keys off flex-direction alone and leaves isLeftToRightFlow untouched. For a column the\nwriting mode's own reversal is already accounted for twice over: isLeftToRightFlow moves the flow-aware\nstart edge, and the renderer flips the position in RenderBox::flipForWritingMode, since RenderBox::location\nis stored in flipped-blocks coordinates. Folding flex-direction into isLeftToRightFlow would reverse a\nvertical-rl column twice and leave vertical-rl column-reverse unreversed.\n\nWith this, every reversed direction -- row-reverse, RTL rows, column-reverse, wrap-reverse and rtl-column\n-- is resolved in computeFlexItemRects, and the algorithm above it lays every line out forwards.\n\nNo change in behaviour.\n\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.cpp:\n(WebCore::FlexFormattingContext::layout):\n(WebCore::FlexFormattingContext::computeFlexItemRects):\n(WebCore::FlexFormattingContext::reverseColumnLinesFromContainerMainEndIfNeeded): Deleted.\n(WebCore::FlexFormattingContext::layoutColumnReverse): Deleted.\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.h:\n\nCanonical link: https://commits.webkit.org/318079@main",
      "email": "zalan@apple.com",
      "hash": "000ed9be50923e8a72fc9f71f1682cdc2b528af9",
      "subject": "[cleanup] Remove the column-reverse placement pass from the flex algorithm"
    },
    "318080@main": {
      "author": "Keith Miller",
      "avatar": "https://www.gravatar.com/avatar/bddc1595b29098429a6ce7c8bf4aced2?d=identicon\u0026s=64",
      "cl": "318080@main",
      "clUrl": "https://commits.webkit.org/318080@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320459\nrdar://183427197\n\nReviewed by Yijia Huang.\n\nNow that we run WPT tests in wasm.yaml these spec tests are subsumed by\nthe official copy. Let's run those instead. There were a few tests that\nused the harness from the various spec tests forks. Those have been\nre-written to use some other method but produce the same wasm blob.\n\nThe one remaining spec tests are the threads/atomics ones since those\ndo not appear to have been imported into the WPT tests.\n\nCanonical link: https://commits.webkit.org/318080@main",
      "email": "keith_miller@apple.com",
      "hash": "a7a8712387e8149e4d00915e88b27f79f920f571",
      "subject": "[Wasm] Remove stale spec tests"
    },
    "318081@main": {
      "author": "Simon Fraser",
      "avatar": "https://www.gravatar.com/avatar/3763324aa0cdfa93be751c6081b8006a?d=identicon\u0026s=64",
      "cl": "318081@main",
      "clUrl": "https://commits.webkit.org/318081@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320405\nrdar://183375912\n\nReviewed by Abrar Rahman Protyasha.\n\nThe WPT `css/css-scroll-snap/overscroll-snap.html` has a fractional height scroll snap element\nthat goes to the end of the scrolling content, which reveals a couple of issues in the scroll\nsnap code.\n\nFirst, `snapOffsetCoversSnapport()` needs a bit of tolerance, because in this case the end\nsnap point is at, say, 20.5px, but the `scrollHeight` is integral and rounded up to 21px,\nand we need to not thing we're outside this snap port, otherwise it triggers scrolling\nback to the start.\n\nSecond, two places that use the destination scroll offset need to clamp for rubber-banding,\notherwise we again think that the target scroll position is outside the last snap target element,\nand scroll to the wrong place.\n\nTests: fast/scrolling/mac/hidpi-overscroll-snap-discrete-scroll.html\n       fast/scrolling/mac/overscroll-snap-adjusted-scroll-destination.html\n\n* LayoutTests/fast/scrolling/mac/hidpi-overscroll-snap-discrete-scroll-expected.txt: Added.\n* LayoutTests/fast/scrolling/mac/hidpi-overscroll-snap-discrete-scroll.html: Added.\n* LayoutTests/fast/scrolling/mac/overscroll-snap-adjusted-scroll-destination-expected.txt: Added.\n* LayoutTests/fast/scrolling/mac/overscroll-snap-adjusted-scroll-destination.html: Added.\n* Source/WebCore/page/scrolling/ScrollSnapOffsetsInfo.cpp:\n(WebCore::RectType\u003e::snapOffsetCoversSnapport const):\n* Source/WebCore/platform/ScrollSnapAnimatorState.cpp:\n(WebCore::ScrollSnapAnimatorState::adjustedScrollDestination const):\n(WebCore::ScrollSnapAnimatorState::targetOffsetForStartOffset const):\n\nCanonical link: https://commits.webkit.org/318081@main",
      "email": "simon.fraser@apple.com",
      "hash": "1d489b3538d6c3f561e8ceab185be188eab4e3dc",
      "subject": "[Scroll snap] css/css-scroll-snap/overscroll-snap.html fails in Safari"
    },
    "318082@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "318082@main",
      "clUrl": "https://commits.webkit.org/318082@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320472\nrdar://183440214\n\nUnreviewed re-land of 318040@main.\n\nRe-land 318040@main but without exposing anything from `WebKitSwiftOverlay.swift`.\n\nTests: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n       Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebPageTests.swift\n       Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebPageTransferableTests.swift\n\n* Source/WTF/wtf/PlatformEnableCocoa.h:\n* Source/WebKit/Scripts/generate-swift-availability-macros:\n* Source/WebKit/UIProcess/API/Cocoa/WKUserContentController.swift:\n* Source/WebKit/UIProcess/API/Cocoa/WebKitSwiftOverlay.swift:\n(WKPDFConfiguration.rect):\n(WKWebView.createWebArchiveData(_:any:)):\n(WKWebView.pdf(_:)):\n(WKWebView.find(_:configuration:)):\n* Source/WebKit/UIProcess/API/Swift/URLSchemeHandler.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage+BackForwardList.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage+Configuration.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage+DialogPresenting.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage+FormInfo.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage+FrameInfo.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage+ImmersiveEnvironment.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage+Navigation.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage+NavigationDeciding.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage+NavigationPreferences.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage+Transferable.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage.swift:\n* Tools/TestWebKitAPI/Helpers/cocoa/ImageAnalysisTestingUtilities.swift:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebPageTests.swift:\n(WebPageTests.observableProperties):\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebPageTransferableTests.swift:\n\nCanonical link: https://commits.webkit.org/318082@main",
      "email": "richard_robinson2@apple.com",
      "hash": "32946d40f8e8c89310f2d928023384171e32d2ad",
      "subject": "Re-land [SwiftUI WebKit API] Expose WebPage and related types as SPI on watchOS and tvOS"
    },
    "318083@main": {
      "author": "Issac Roy",
      "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64",
      "cl": "318083@main",
      "clUrl": "https://commits.webkit.org/318083@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=299929\nrdar://162168233\n\nReviewed by Tim Nguyen.\n\nThe default orientation for a bare \u003cpage-size\u003e on the `size` @page descriptor\nis still unsettled on https://github.com/w3c/csswg-drafts/issues/13178,\nbut presumably should be portrait. Hence, `letter portrait` should normalize\nto `letter`. The issue was that it was stored as a CSSValuePair and just\nserialized verbatim without normalization.\n\nThis should fix the fails on\nhttps://wpt.fyi/results/css/css-page/page-rule-declarations-000.html\nand https://wpt.fyi/css/css-page/parsing/size-valid.html.\n\nLayout is unaffected: an absent orientation is already treated as portrait.\n\nCovered by existing WPT tests; no new tests needed.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-page/page-rule-declarations-000.html:\nCorrected stale `a4 portrait`/`jis-b5 portrait` expectations to `a4`/`jis-b5`.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-page/parsing/size-valid-expected.txt:\n* LayoutTests/printing/page-rule-css-text-expected.txt:\n* Source/WebCore/css/parser/CSSPropertyParser.cpp:\n(WebCore::consumePageDescriptor): Drop a redundant `portrait` from a page-size pair.\n\nCanonical link: https://commits.webkit.org/318083@main",
      "email": "issacroy05@gmail.com",
      "hash": "7b79e6dcb6518f8515e13a2b36068cae6972b84e",
      "subject": "Serialization of @page {size: letter portrait;} is incorrect. WPT failure"
    },
    "318084@main": {
      "author": "Phinehas Fuachie",
      "avatar": "https://www.gravatar.com/avatar/900d85de8c325e38975f39115c36bb75?d=identicon\u0026s=64",
      "cl": "318084@main",
      "clUrl": "https://commits.webkit.org/318084@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320421\nrdar://156429277\n\nReviewed by Alex Christensen.\n\nThe generic expected result records beganEnterFullScreen()/beganExitFullScreen() origins of\n{8, 442}, which is the fullscreen element's position in macOS AppKit bottom-left screen coordinates\n(600 - 8 - 150 = 442). iOS uses a top-left coordinate system, so the same cross-origin iframe at\npage offset (8, 8) is reported as {8, 8}. iOS therefore produced a deterministic text mismatch\nagainst the macOS baseline (50/50 locally) rather than a genuine flake.\n\nAdd an iOS-specific baseline with the correct top-left coordinates and remove the Pass/Failure\nexpectation so the test is enforced on iOS.\n\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/ios/http/tests/site-isolation/fullscreen-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/318084@main",
      "email": "pfuachie2@apple.com",
      "hash": "4a95db7eb32a0e6f00a76fad355d5e71b8bdceaa",
      "subject": "[ iOS ] http/tests/site-isolation/fullscreen.html is a constant text failure"
    },
    "318085@main": {
      "author": "Jessica Lee",
      "avatar": "https://www.gravatar.com/avatar/fc717c99321d09f31fb9187418a8ffc5?d=identicon\u0026s=64",
      "cl": "318085@main",
      "clUrl": "https://commits.webkit.org/318085@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320223\nrdar://183162111\n\nReviewed by Sihui Liu.\n\nWhen site isolation is enabled, an iframe's shield page fails to load if its content is blocked.\nThe iframe's WebContent is torn down while it's committing the load for the shield / substitute data.\nThe subframe teardown path needs to apply the same willContinueLoading check that the main-frame\npath already uses before destroying a process.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ParentalControlsContentFilteringTests.mm\n\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::didFailProvisionalLoadForFrameShared):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ParentalControlsContentFilteringTests.mm:\n(TEST(ParentalControlsContentFilteringTests, BlockedIframe)):\n\nCanonical link: https://commits.webkit.org/318085@main",
      "email": "jlee53@apple.com",
      "hash": "1d57cc0609c60594f0a72dacc169ca781cffd93d",
      "subject": "Check willContinueLoading for iframes when provisional frame loads fail."
    },
    "318086@main": {
      "author": "Said Abou-Hallawa",
      "avatar": "https://www.gravatar.com/avatar/ae80a929a378a055822829ae63903296?d=identicon\u0026s=64",
      "cl": "318086@main",
      "clUrl": "https://commits.webkit.org/318086@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316241\nrdar://183365415\n\nReviewed by Taher Ali.\n\nName it HTMLInCanvasEnabled and make it internal and off by default for now.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/318086@main",
      "email": "said@apple.com",
      "hash": "9e5b3b7e127718d50ad7ecaf50b0e27b23a67fb7",
      "subject": "[HTML-in-Canvas] Add a feature control flag to enable HTML-in-Canvas"
    },
    "318087@main": {
      "author": "Charlie Wolfe",
      "avatar": "https://www.gravatar.com/avatar/857b3b5ff3394c31fa2689310a93dbab?d=identicon\u0026s=64",
      "cl": "318087@main",
      "clUrl": "https://commits.webkit.org/318087@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320332\nrdar://183271849\n\nReviewed by Rupin Mittal.\n\nThe Cookie Store specification stores a service worker registration's cookie change subscriptions\nin a list. subscribe() appends new subscriptions to that list, and getSubscriptions() iterates the\nlist in order.\n\nUse ListHashSet to preserve the specified list order while avoiding duplicate subscriptions.\n\n* LayoutTests/imported/w3c/web-platform-tests/cookiestore/cookieStore_subscribe_arguments.https.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/cookiestore/cookieStore_subscribe_arguments.https.any.serviceworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/cookiestore/httponly_cookies.https.window-expected.txt:\n* Source/WebCore/workers/service/server/SWServerRegistration.cpp:\n(WebCore::SWServerRegistration::addCookieChangeSubscriptions):\n(WebCore::SWServerRegistration::removeCookieChangeSubscriptions):\n* Source/WebCore/workers/service/server/SWServerRegistration.h:\n\nCanonical link: https://commits.webkit.org/318087@main",
      "email": "charliew@apple.com",
      "hash": "3996020d9c9cde340f8c1607915dfa471d8658e4",
      "subject": "[Cookie Store] Preserve cookie change subscription list order"
    },
    "318088@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "318088@main",
      "clUrl": "https://commits.webkit.org/318088@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320469\n\u003crdar://problem/183436566\u003e\n\nReviewed by Antti Koivisto.\n\n* Source/WebCore/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/UncheckedCallArgsCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/UncheckedLocalVarsCheckerExpectations:\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.cpp:\n(WebCore::FlexLayoutItem::borderAndPaddingLogicalHeight const):\n(WebCore::FlexLayoutItem::intrinsicSize const):\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.h:\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingUtils.cpp:\n(WebCore::FlexFormattingUtils::willStretchFlexItem):\n* Source/WebCore/layout/integration/flex/FlexIntegrationUtils.cpp:\n(WebCore::LayoutIntegration::FlexIntegrationUtils::applyStretchedLogicalHeightToFlexItem):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::layoutFlexItemForStretchedCrossSize):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::layoutFlexItemWithMainSize):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::updateAutoMarginsInMainAxis):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::updateAutoMarginsInCrossAxis):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::setFlexItemOverridingBorderBoxLogicalHeight):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::invalidateFlexItemContentLogicalWidthsIfNeeded):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::trimMainAxisMarginStart):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::dirtyPercentHeightDescendantsWithinFlexItem):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::flexItemHasPercentHeightDescendants const):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::flexItemContentLogicalHeight const):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::computeBlockAxisContentSizeForFlexItem):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::maxContentMainAxisExtentForFlexItem):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::minContentMainAxisContributionForFlexItem):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::flexItemIntrinsicLogicalHeight const):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::flexItemIntrinsicLogicalWidth):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::constrainFlexItemLogicalHeightByMinMax const):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::constrainFlexItemLogicalWidthByMinMax const):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::computePercentageLogicalHeightForFlexItem const):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::computeLogicalHeightUsingForFlexItem const):\n(WebCore::LayoutIntegration::FlexIntegrationUtils::computeLogicalWidthUsingForFlexItem const):\n* Source/WebCore/layout/integration/flex/LayoutIntegrationFlexLayout.cpp:\n(WebCore::LayoutIntegration::FlexLayout::marginTrimItemsBeforeFlexLayout const):\n* Source/WebCore/rendering/RenderBox.cpp:\n(WebCore::RenderBox::shouldResetLogicalHeightBeforeLayout const):\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n\nCanonical link: https://commits.webkit.org/318088@main",
      "email": "zalan@apple.com",
      "hash": "b205d90d7bc65ae3d7fe4050d437d3da81ef2129",
      "subject": "Fix safer C++ failures in Source/WebCore/layout/flex"
    },
    "318089@main": {
      "author": "Lauro Moura",
      "avatar": "https://www.gravatar.com/avatar/6157f52d61e04c2c63fe7ff668ba69b3?d=identicon\u0026s=64",
      "cl": "318089@main",
      "clUrl": "https://commits.webkit.org/318089@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320371\n\nReviewed by Adrian Perez de Castro.\n\nCurrently, when JOURNALD_LOG is enabled, RELEASE_LOG messages are sent\nto sd_journal_send_with_location without any fallback. But, according to\nthis function's documentation:\n\n\"If systemd-journald(8) is not running (the socket is not present),\nthose functions do nothing, and also return 0.\"\n\nThis behavior can lead to lost RELEASE_LOG messages. For example, small CI\nrunners might not run systemd at all during the tests.\n\nThis commit adds a stderr fallback, enabled when the journald's socket\nis not found at startup. The new WEBKIT_DEBUG_OUTPUT environment\nvariable can be set to 'stderr' to replace the journal output, or to\n'journal' to disable the fallback completely.\n\nNote that the actual filtering of what would be printed is still\ncontrolled by the WEBKIT_DEBUG variable as usual. That is, \"off\"\nchannels are still filtered out.\n\n* Source/WTF/wtf/Assertions.cpp:\n* Source/WTF/wtf/Assertions.h:\n(wtfLogPriorityName):\n* Source/WTF/wtf/Logger.h:\n(WTF::Logger::log):\n(WTF::Logger::logVerbose):\n* Source/WebKit/glib/environment-variables.md.in:\n\nCanonical link: https://commits.webkit.org/318089@main",
      "email": "lmoura@igalia.com",
      "hash": "33e302a9ccbcaff5a332461866a26ac7581a6b5a",
      "subject": "[GLIB] Add log fallback when journald is not reachable"
    },
    "318090@main": {
      "author": "Sean Patterson",
      "avatar": "https://www.gravatar.com/avatar/b19318d92b64ac7809b78670c03b0f1e?d=identicon\u0026s=64",
      "cl": "318090@main",
      "clUrl": "https://commits.webkit.org/318090@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319695\nrdar://164578060\n\nReviewed by Per Arne Vollan.\n\nLoading a top-level file:// resource requires a sandbox extension to be handed down to the Networking\nprocess, which performs the file read. WebPageProxy::maybeInitializeSandboxExtensionHandle() cannot\nissue that extension while the target WebContent process is still launching (it has no audit token\nyet), so it returns std::nullopt and the load is expected to be deferred until the process finishes\nlaunching, at which point the extension is re-issued (WebProcessProxy::shouldSendPendingMessage).\n\nloadFile(), loadRequestWithNavigationShared(), and ProvisionalPageProxy all implement this deferral:\nfor a file:// URL on a launching process they send the *WaitingForProcessLaunch variant of the load\nmessage. WebPageProxy::launchProcessForReload() -- the path taken to reload the current back/forward\nitem after the WebContent process is killed or crashes -- did not. It relaunched the process and\nimmediately sent WebPage::GoToBackForwardItem with an empty sandbox extension handle. For a file://\nitem the relaunched WebContent therefore had no file access, could not create a sandbox extension for\nthe Networking process, and the main-resource read failed with EPERM -- surfaced to the client as\nNSURLErrorDomain -3001 (kCFURLErrorCannotOpenFile) and an error page.\n\nThis is intermittent in the field because it requires the file load to coincide with a WebContent\nprocess launch/relaunch; it reproduces reliably by killing the WebContent process and reloading a\nlocal file (e.g. a Mail attachment or a file in ~/Downloads or ~/Documents). Granting the browser\nFull Disk Access masks it because TCC then bypasses the extension chain entirely.\n\nFix launchProcessForReload() to defer the reload for a file:// item on a still-launching process by\nsending GoToBackForwardItemWaitingForProcessLaunch, matching the other load paths, so the sandbox\nextension is re-issued once the process has finished launching.\n\nAlso add release-level error logging along the file-load sandbox-extension path -- when the\nextension fails to be minted in the Networking process (createSandboxExtensionHandlesIfNecessary)\nor fails to reach the loader (startNetworkLoad) -- so this class of failure can be diagnosed from\na field log without a debug build.\n\n* Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.cpp:\n(WebKit::NetworkResourceLoadParameters::createSandboxExtensionHandlesIfNecessary):\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:\n(WebKit::NetworkResourceLoader::startNetworkLoad):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::launchProcessForReload):\n* Tools/TestWebKitAPI/Tests/WebKit/WKPage/cocoa/FetchLocalFile.mm:\n(TEST(WebKit, ReloadLocalFileAfterWebContentProcessTermination)):\n\nCanonical link: https://commits.webkit.org/318090@main",
      "email": "sean_patterson@apple.com",
      "hash": "22d9c3a6e99c50eeb774cc1583e9654788ca18a3",
      "subject": "Reloading a local file after a WebContent process crash can fail with kCFURLErrorCannotOpenFile (-3001)"
    },
    "318091@main": {
      "author": "Issac Roy",
      "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64",
      "cl": "318091@main",
      "clUrl": "https://commits.webkit.org/318091@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319918\nrdar://182840873\n\nReviewed by Sam Sneddon.\n\nThe validate-commit-message EWS step and the pull-request pre-check\nboth matched Reviewed-by anywhere in the commit message body, causing\nfalse positives when the body text mentions Reviewed-by as a phrase\n(e.g. a commit message that describes the feature itself).\n\nIn the EWS step, `git log` without `--format=%B` indents commit message\nlines with 4 spaces, so a `^` anchor in grep would not work. Switch to\n`--format=%B` to get the raw message without indentation, then add the\n`^` anchor to the grep patterns so only lines that start with a reviewer\nstring are matched.\n\nIn the pull-request check, replace the plain `Reviewed-by in message`\nstring search with a regex anchored to the start of a line.\n\n* Tools/CISupport/ews-build/steps.py:\n(ValidateCommitMessage.run): Use --format=%B and ^ in grep so reviewer\nstrings are only matched at the start of a line.\n* Tools/CISupport/ews-build/steps_unittest.py:\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/pull_request.py:\n(PullRequest.create_pull_request): Use an anchored regex instead of a\nplain substring check for Reviewed-by.\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/land.py:\n(Land.REVIEWED_BY_RE): Anchor to start of line.\n\nCanonical link: https://commits.webkit.org/318091@main",
      "email": "issacroy05@gmail.com",
      "hash": "2dbe57d1dccf76b432c5381202d574d350af844c",
      "subject": "The check for Reviewed-by should check at the start of the line"
    },
    "318092@main": {
      "author": "Cole Carley",
      "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64",
      "cl": "318092@main",
      "clUrl": "https://commits.webkit.org/318092@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320014\nrdar://182949083\n\nReviewed by Keith Miller.\n\nThis patch adds support for Table64 in the OMG tier.\n\n* JSTests/wasm/stress/table64-bulk.js:\n* JSTests/wasm/stress/table64-call-indirect.js:\n* JSTests/wasm/stress/table64-get-and-set.js:\n* JSTests/wasm/stress/table64-grow-and-size.js:\n* JSTests/wasm/stress/table64-overflow.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table_copy64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table_fill64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table_get64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table_grow64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table_init64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table_set64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table_size64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/address64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/align64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/binary_leb128_64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/bulk64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/call_indirect64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/endianness64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/float_memory64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/load64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/memory64-imports.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/memory64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/memory_copy64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/memory_fill64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/memory_grow64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/memory_init64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/memory_redundancy64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/memory_trap64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/table64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/table_copy64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/table_copy_mixed.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/table_fill64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/table_get64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/table_grow64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/table_init64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/table_set64.wast.js.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/table_size64.wast.js.html:\n* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:\n(JSC::Wasm::BBQJITImpl::BBQJIT::addTableSet):\n(JSC::Wasm::BBQJITImpl::BBQJIT::addTableInit):\n(JSC::Wasm::BBQJITImpl::BBQJIT::addTableSize):\n(JSC::Wasm::BBQJITImpl::BBQJIT::addTableGrow):\n(JSC::Wasm::BBQJITImpl::BBQJIT::addTableFill):\n(JSC::Wasm::BBQJITImpl::BBQJIT::addTableCopy):\n(JSC::Wasm::BBQJITImpl::BBQJIT::addCallIndirect):\n* Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp:\n(JSC::Wasm::BBQJITImpl::BBQJIT::addTableGet):\n* Source/JavaScriptCore/wasm/WasmIPIntSlowPaths.cpp:\n(JSC::IPInt::WASM_IPINT_EXTERN_CPP_DECL):\n* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:\n(JSC::Wasm::OMGIRGenerator::addTableSize):\n(JSC::Wasm::OMGIRGenerator::addTableGrow):\n(JSC::Wasm::OMGIRGenerator::addCallIndirect):\n* Source/JavaScriptCore/wasm/WasmOperations.cpp:\n(JSC::Wasm::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):\n* Source/JavaScriptCore/wasm/WasmOperations.h:\n* Source/JavaScriptCore/wasm/WasmOperationsInlines.h:\n(JSC::Wasm::tableGet):\n(JSC::Wasm::tableSet):\n(JSC::Wasm::tableInit):\n(JSC::Wasm::tableFill):\n(JSC::Wasm::tableGrow):\n(JSC::Wasm::tableCopy):\n* Source/JavaScriptCore/wasm/WasmTable.cpp:\n(JSC::Wasm::Table::grow):\n* Source/JavaScriptCore/wasm/WasmTable.h:\n(JSC::Wasm::Table::isValidLength):\n\nCanonical link: https://commits.webkit.org/318092@main",
      "email": "ccarley2@apple.com",
      "hash": "184ee4c654bdc0653e57c7aefd6c4b90a8dd9269",
      "subject": "[Memory64] Implement Table64 in the OMG tier"
    },
    "318093@main": {
      "author": "Dan Hecht",
      "avatar": "https://www.gravatar.com/avatar/080f47d912b1b34d0be8293f825d132d?d=identicon\u0026s=64",
      "cl": "318093@main",
      "clUrl": "https://commits.webkit.org/318093@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320470\nrdar://183437138\n\nReviewed by Keith Miller.\n\nThe tests here dirty a region and free it, so the zeroed path only ever runs\nover pages that are resident-dirty or decommitted, never over pages brought\nback by a read fault.\n\nAdd a case that puts a large region through a randomized number of\nevict/read-fault rounds before freeing it, then reallocates the same size and\nverifies the reused region reads zero, across all three first-fault orders.\nEviction uses madvise(MADV_PAGEOUT) where available; where it is not, the\nrounds degenerate into plain re-reads, which the test reports.\n\n* Source/bmalloc/libpas/src/test/AllocationZeroingTests.cpp:\n(addAllocationZeroingTests):\n\nCanonical link: https://commits.webkit.org/318093@main",
      "email": "dan.hecht@apple.com",
      "hash": "d18773ec666ea2bd59f8411c3bcd8d832998dad2",
      "subject": "[libpas] Add evicted, read-faulted backing coverage to AllocationZeroingTests"
    },
    "318094@main": {
      "author": "Luke Warlow",
      "avatar": "https://www.gravatar.com/avatar/262b456ff1e93842b93f9694d1e01a9e?d=identicon\u0026s=64",
      "cl": "318094@main",
      "clUrl": "https://commits.webkit.org/318094@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320096\n\nReviewed by Ryosuke Niwa.\n\nThis updates the node traversal in moveBefore() to recurse into shadow roots, and\nupdates a test to cover the scenario of a shadowroot inside the moved container.\n\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/custom-element-move-reactions-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/custom-element-move-reactions.html:\n* Source/WebCore/dom/ContainerNode.cpp:\n(WebCore::runMovingStepsForShadowIncludingInclusiveDescendants):\n(WebCore::ContainerNode::moveBefore):\n\nCanonical link: https://commits.webkit.org/318094@main",
      "email": "lwarlow@igalia.com",
      "hash": "1cc7b9f63d58412a3a05fcdc9620880677c55fb5",
      "subject": "moveBefore() doesn't iterate through shadow roots"
    },
    "318095@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "318095@main",
      "clUrl": "https://commits.webkit.org/318095@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320473\nrdar://183391399\n\nUnreviewed, reverting 314501@main (a8c7730a75ef)\n\nReverted change:\n\n    GitHub.com: emoji reaction touches code box in comment.\n    https://bugs.webkit.org/show_bug.cgi?id=312152\n    rdar://174652842\n    314501@main (a8c7730a75ef)\n\nCanonical link: https://commits.webkit.org/318095@main",
      "email": "sammy.gill@apple.com",
      "hash": "3b267afd25f09bce02896306d27d82acd984a765",
      "subject": "REGRESSION(314501@main): On flights.google.com, can't use backspace to delete airport from box"
    },
    "318096@main": {
      "author": "Jessica Lee",
      "avatar": "https://www.gravatar.com/avatar/fc717c99321d09f31fb9187418a8ffc5?d=identicon\u0026s=64",
      "cl": "318096@main",
      "clUrl": "https://commits.webkit.org/318096@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320480\nrdar://183449981\n\nReviewed by Per Arne Vollan.\n\nIf build flag WEBCONTENTRESTRICTIONS_ASK_TO is enabled but there is no referrerURL, the provided completionHandler is not called.\n\nNo new tests needed.\n\n* Source/WebKit/NetworkProcess/NetworkProcess.cpp:\n(WebKit::NetworkProcess::allowEvaluatedURL):\n\nCanonical link: https://commits.webkit.org/318096@main",
      "email": "jlee53@apple.com",
      "hash": "2e37adcc23b7924259e34c73db142a30ad07c4d3",
      "subject": "NetworkProcess::allowEvaluatedURL may not call its completionHandler"
    }
  },
  "date": "2026-07-28",
  "days": 1,
  "generatedAt": "2026-07-28T22:06:23Z",
  "markdown": "## Highlights\n- **Security** Added hard IPC-side URL length limits to align with Chrome/Blink and reduce oversized input risk across process boundaries. [commit 318045@main](https://commits.webkit.org/318045@main)\n- **Security** Fixed two CTAP parsing bugs, covering a null optional dereference in authenticator selection flows and an out-of-bounds read on short CTAPHID_INIT replies. [commit 318018@main](https://commits.webkit.org/318018@main) [commit 318015@main](https://commits.webkit.org/318015@main)\n- **Web Platform** Service worker request-body handling got stricter and more spec-correct, propagating cancellation and blocking network fallback for disturbed bodies. [commit 318043@main](https://commits.webkit.org/318043@main) [commit 318042@main](https://commits.webkit.org/318042@main)\n- **Rendering** Grid and flexbox saw a broad batch of correctness work, including crash fixes, negative line offset handling, automatic minimum-size behavior, and internal flex algorithm cleanup. [commit 318071@main](https://commits.webkit.org/318071@main) [commit 318063@main](https://commits.webkit.org/318063@main) [commit 318032@main](https://commits.webkit.org/318032@main) [commit 318079@main](https://commits.webkit.org/318079@main)\n- **V8** JavaScriptCore landed a dense performance and correctness wave: two short-string JSON.stringify fast paths, a regression fix, YARR filtering improvements, and DFG memory trimming. [commit 318078@main](https://commits.webkit.org/318078@main) [commit 318021@main](https://commits.webkit.org/318021@main) [commit 318072@main](https://commits.webkit.org/318072@main) [commit 318022@main](https://commits.webkit.org/318022@main) [commit 318060@main](https://commits.webkit.org/318060@main)\n- **Mobile** Site isolation input plumbing on Apple platforms improved with fixes for dictation, IME composition, fullscreen test stability, and PDF HUD positioning in cross-origin frames. [commit 318019@main](https://commits.webkit.org/318019@main) [commit 318017@main](https://commits.webkit.org/318017@main) [commit 318084@main](https://commits.webkit.org/318084@main) [commit 318068@main](https://commits.webkit.org/318068@main)\n- **Web Platform** New platform surface keeps moving: HTML-in-Canvas gained a feature flag, Digital Credentials started parsing signed and multisigned OpenID4VP requests, and Performance.timeOrigin now stays spec-aligned across BCG switches. [commit 318086@main](https://commits.webkit.org/318086@main) [commit 318074@main](https://commits.webkit.org/318074@main) [commit 318057@main](https://commits.webkit.org/318057@main)\n- **Networking** Navigation and loading robustness improved with fixes for local-file reloads after WebContent crashes, stale-while-revalidate speculative loads, and iframe provisional-load failure handling. [commit 318090@main](https://commits.webkit.org/318090@main) [commit 318056@main](https://commits.webkit.org/318056@main) [commit 318085@main](https://commits.webkit.org/318085@main)\n\n## What landed by area\n\n### JavaScriptCore and Wasm\n- **V8** Implemented Table64 in the OMG tier for Wasm Memory64 support. [commit 318092@main](https://commits.webkit.org/318092@main)\n- **V8** Implemented Table64 in the BBQ tier, extending Memory64 coverage across both Wasm JIT paths. [commit 318016@main](https://commits.webkit.org/318016@main)\n- **V8** Fixed JSON.stringify regression caused by toJSON checking. [commit 318072@main](https://commits.webkit.org/318072@main)\n- **Perf** Added an 8-byte SWAR fast path for JSON.stringify short-string upconversion. [commit 318078@main](https://commits.webkit.org/318078@main)\n- **Perf** Added an 8-byte SWAR fast path for JSON.stringify short-string same-type copies. [commit 318021@main](https://commits.webkit.org/318021@main)\n- **Perf** Extended YARR's first-character filter for better regexp screening. [commit 318022@main](https://commits.webkit.org/318022@main)\n- **V8** Allocated DFG BasicBlock::intersectionOfPastValuesAtHead only for OSR entry targets, cutting unnecessary work. [commit 318060@main](https://commits.webkit.org/318060@main)\n- **Web Platform** Updated Iterator.zip to use null-prototype objects for GetOptionsObject and its synthetic iterator. [commit 318061@main](https://commits.webkit.org/318061@main)\n- **V8** Added missing U_FAILURE(status) handling for actualLunisolarMonthLength. [commit 318062@main](https://commits.webkit.org/318062@main)\n- **Refactor** Removed stale Wasm spec tests. [commit 318080@main](https://commits.webkit.org/318080@main)\n\n### Layout, rendering, and CSS\n- **Rendering** moveBefore() now iterates through shadow roots correctly. [commit 318094@main](https://commits.webkit.org/318094@main)\n- **Rendering** Fixed safer C++ failures in flex layout code. [commit 318088@main](https://commits.webkit.org/318088@main)\n- **Web Platform** Corrected @page { size: letter portrait; } serialization to match WPT expectations. [commit 318083@main](https://commits.webkit.org/318083@main)\n- **Rendering** Fixed Safari scroll snap behavior for overscroll-snap.html. [commit 318081@main](https://commits.webkit.org/318081@main)\n- **Refactor** Removed the column-reverse placement pass from the flex algorithm. [commit 318079@main](https://commits.webkit.org/318079@main)\n- **Rendering** Applied a grid item's negative line offset while constructing UnplacedGridItem. [commit 318071@main](https://commits.webkit.org/318071@main)\n- **Refactor** Moved flex item placement into flow-relative coordinates. [commit 318065@main](https://commits.webkit.org/318065@main)\n- **Rendering** Fixed a regression crash in Layout::sizeTracksToFitNonSpanningItems. [commit 318063@main](https://commits.webkit.org/318063@main)\n- **Refactor** Removed an incorrect NODELETE annotation from PropertySetCSSDescriptors::reattach(). [commit 318054@main](https://commits.webkit.org/318054@main)\n- **Rendering** Grid position type checks now use UnplacedGridItem::GridPosition directly. [commit 318034@main](https://commits.webkit.org/318034@main)\n- **Rendering** Consolidated min/max-content constraint testing with per-track content contribution logic in grid sizing. [commit 318033@main](https://commits.webkit.org/318033@main)\n- **Rendering** Automatic minimum size no longer resolves percentages against unknown available space during grid track sizing. [commit 318032@main](https://commits.webkit.org/318032@main)\n- **Refactor** Flex layout now tracks which margins it trimmed internally. [commit 318014@main](https://commits.webkit.org/318014@main)\n- **Refactor** Removed GridItemHasPercentOrCalcPadding as a grid avoidance reason. [commit 318011@main](https://commits.webkit.org/318011@main)\n\n### Loading, navigation, and network process\n- **Networking** NetworkProcess::allowEvaluatedURL was fixed so the completion handler is not left hanging. [commit 318096@main](https://commits.webkit.org/318096@main)\n- **Networking** Reloading a local file after a WebContent crash now avoids kCFURLErrorCannotOpenFile failures. [commit 318090@main](https://commits.webkit.org/318090@main)\n- **Networking** Provisional iframe load failures now check willContinueLoading before aborting follow-up work. [commit 318085@main](https://commits.webkit.org/318085@main)\n- **UI** BackForwardGoToItem was made asynchronous, reducing synchronous navigation plumbing. [commit 318075@main](https://commits.webkit.org/318075@main)\n- **Networking** Stale-while-revalidate now cancels in-flight speculative loads when revalidation times out. [commit 318056@main](https://commits.webkit.org/318056@main)\n- **Privacy** MockParentalControlsURLFilter now populates replacement data, improving policy-path realism in tests and behavior. [commit 318039@main](https://commits.webkit.org/318039@main)\n- **Networking** Cross-site frames no longer silently drop in-process loads because of an always-invalid FrameNetworkingContext. [commit 318038@main](https://commits.webkit.org/318038@main)\n- **Security** Added cross-origin iframe window.alert() behavior tests to lock down dialog semantics. [commit 318073@main](https://commits.webkit.org/318073@main)\n\n### DOM, fetch, storage, and web platform APIs\n- **Web Platform** Cookie Store now preserves cookie change subscription list order. [commit 318087@main](https://commits.webkit.org/318087@main)\n- **Web Platform** HTML-in-Canvas gained a runtime feature control flag for staged bringup. [commit 318086@main](https://commits.webkit.org/318086@main)\n- **Privacy** Started parsing signed and multisigned OpenID4VP Digital Credentials requests in the WebContent process. [commit 318074@main](https://commits.webkit.org/318074@main)\n- **Web Platform** Updated fetch/compression-dictionary coverage from WPT. [commit 318067@main](https://commits.webkit.org/318067@main)\n- **Web Platform** Performance.timeOrigin now stays aligned with spec even when browsing context groups switch. [commit 318057@main](https://commits.webkit.org/318057@main)\n- **Web Platform** Service worker fetch event request body cancellation now propagates back to the original ReadableStream. [commit 318043@main](https://commits.webkit.org/318043@main)\n- **Security** Disturbed fetch event request bodies no longer permit network fallback. [commit 318042@main](https://commits.webkit.org/318042@main)\n- **Web Platform** Fixed a crash in NavigateEvent::finish when the document element is removed inside a navigate handler. [commit 318041@main](https://commits.webkit.org/318041@main)\n\n### Media, WebRTC, and graphics\n- **Media** Fixed a GStreamer WebCodecs VideoEncoder crash during webkitvideoencoder registration. [commit 318055@main](https://commits.webkit.org/318055@main)\n- **Media** AudioParam::finalValue() no longer returns an uninitialized float when final-value calculation bails out. [commit 318052@main](https://commits.webkit.org/318052@main)\n- **Media** RealtimeIncomingAudioSourceCocoa now rescales frame counters against the correct sample rate. [commit 318050@main](https://commits.webkit.org/318050@main)\n- **Media** DisplayCaptureSourceCocoa::generateFrame() no longer copies Variant alternatives in its first switchOn. [commit 318049@main](https://commits.webkit.org/318049@main)\n- **Media** MediaStreamPrivate now moves the tracks vector instead of copying it. [commit 318048@main](https://commits.webkit.org/318048@main)\n- **Media** Fixed a data race in LibWebRTCAudioModule on m_isPlaying and m_audioTransport. [commit 318047@main](https://commits.webkit.org/318047@main)\n- **Media** NumericConstraint::valueForCapabilityRange() now respects a valid current value when both min and max are set. [commit 318046@main](https://commits.webkit.org/318046@main)\n- **GPU** Added missing braces in the WGSL alias analysis pass. [commit 318059@main](https://commits.webkit.org/318059@main)\n- **GPU** Fixed an uninitialized VisibilityValidator::m_stage member in WGSL validation. [commit 318025@main](https://commits.webkit.org/318025@main)\n- **Rendering** Async image decoding can now be requested from a worker thread. [commit 318036@main](https://commits.webkit.org/318036@main)\n- **Rendering** Fixed incorrect z-ordering in GTK and WPE SkiaCompositingLayer rendering. [commit 318066@main](https://commits.webkit.org/318066@main)\n- **Media** WebVTT cue overlap avoidance now always moves cues by the shortest possible distance when snap-to-lines is false. [commit 318012@main](https://commits.webkit.org/318012@main)\n\n### Platform UI, site isolation, and developer tooling\n- **Mobile** Re-landed SwiftUI WebKit SPI exposure for WebPage and related types on watchOS and tvOS. [commit 318082@main](https://commits.webkit.org/318082@main)\n- **UI** Added a debug UI for the PDF HUD. [commit 318069@main](https://commits.webkit.org/318069@main)\n- **UI** Fixed PDF HUD offset in cross-origin PDF iframes on macOS site isolation. [commit 318068@main](https://commits.webkit.org/318068@main)\n- **A11y** Fixed directional scroll locking for diagonal AppKit gesture scrolls. [commit 318029@main](https://commits.webkit.org/318029@main)\n- **DevTools** Web Inspector no longer leaks non-buffered resource data across navigations. [commit 318035@main](https://commits.webkit.org/318035@main)\n- **Build** Swift build errors around foreign reference ownership inference were fixed in WebKit. [commit 318037@main](https://commits.webkit.org/318037@main)\n- **Build** Installed TestWebKitAPI and API-test executables on tools builds. [commit 318058@main](https://commits.webkit.org/318058@main)\n- **Build** Windows ccache configuration now uses inline KEY=VALUE arguments. [commit 318031@main](https://commits.webkit.org/318031@main)\n- **Build** Landed a batch of Windows build fixes. [commit 318030@main](https://commits.webkit.org/318030@main)\n- **Build** ANGLE end-to-end test expectations are now copied to the build output folder. [commit 318026@main](https://commits.webkit.org/318026@main)\n- **Build** CMake benchmark builds now target the SDK version instead of the host OS version. [commit 318023@main](https://commits.webkit.org/318023@main)\n- **Build** libwebrtc upstream unit tests now build through the new \"Unit Tests\" aggregate target. [commit 318020@main](https://commits.webkit.org/318020@main)\n- **Build** Fixed lowercase platform-name handling that broke GTK and WPE results database queries on EWS. [commit 318013@main](https://commits.webkit.org/318013@main)\n- **Build** Added a GLib log fallback when journald is unreachable. [commit 318089@main](https://commits.webkit.org/318089@main)\n- **Build** Updated safer C++ expectations for 2026-07-27. [commit 318028@main](https://commits.webkit.org/318028@main)\n- **Security** Fixed an out-of-bounds read in WebKitTestRunner's iOS PlatformWebView::keyWindow(). [commit 318024@main](https://commits.webkit.org/318024@main)\n\n### Editing, input, and WebDriver\n- **UI** Fixed a regression where Backspace could not delete airport text on flights.google.com. [commit 318095@main](https://commits.webkit.org/318095@main)\n- **Web Platform** WebDriver can now access elements inside a closed shadow tree without spuriously returning \"no such shadow root\". [commit 318070@main](https://commits.webkit.org/318070@main)\n- **Web Platform** WebDriver Execute Script now clones non-Element DOM nodes instead of serializing them as element handles. [commit 318064@main](https://commits.webkit.org/318064@main)\n- **Mobile** Dictation is now applied to the correct process for inputs inside cross-origin iframes. [commit 318019@main](https://commits.webkit.org/318019@main)\n- **Mobile** IME composition is now applied to the correct process for inputs inside cross-origin iframes. [commit 318017@main](https://commits.webkit.org/318017@main)\n- **Refactor** Split the start/end block in FrameSelection::respondToNodeModification onto its own line for clearer structure around editing logic. [commit 318053@main](https://commits.webkit.org/318053@main)\n\n### Core runtime and infrastructure\n- **Perf** makeStringByReplacingAll() now uses SIMD-accelerated find() instead of a scalar scan. [commit 318051@main](https://commits.webkit.org/318051@main)\n- **Refactor** Added removeIf() to WTF::RobinHoodHashTable and adopted it to simplify remove-matching-entries loops. [commit 318010@main](https://commits.webkit.org/318010@main)\n- **Perf** Added evicted and read-faulted backing coverage to libpas AllocationZeroingTests. [commit 318093@main](https://commits.webkit.org/318093@main)\n- **Build** Tightened Reviewed-by validation to only match at the start of a line. [commit 318091@main](https://commits.webkit.org/318091@main)\n\n## Reverts \u0026 Reapplies\n- **Build** Re-landed SwiftUI WebKit SPI exposure for watchOS and tvOS after the original change broke internal platform builds. [commit 318082@main](https://commits.webkit.org/318082@main) [commit 318076@main](https://commits.webkit.org/318076@main) [commit 318040@main](https://commits.webkit.org/318040@main)",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [
    {
      "name": "Unreviewed",
      "count": 3
    }
  ],
  "since": "2026-07-28",
  "totals": {
    "commits": 87,
    "features": 84,
    "rolls": 3
  },
  "until": "2026-07-28"
}