{
  "commits": {
    "318193@main": {
      "author": "lilly",
      "avatar": "https://www.gravatar.com/avatar/d0533d52eeb271270df480f37629a407?d=identicon\u0026s=64",
      "cl": "318193@main",
      "clUrl": "https://commits.webkit.org/318193@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320106\nrdar://183043471\n\nReviewed by Simon Fraser.\n\nRecord the border-box rounded rect on the offset BorderShape (new\nalignCornersToCurve flag on shapeForOffsetRect). When building an\noutline or box-shadow contour, regenerate just the exact-shape corners\n(bevel/notch/square) directly from that reference, offset out/in to\nthe contour rect, rather than scaling their corner box(rebuildOffsetCornersFromReference).\n\nNew tests will be written in a seperate commit for WPT\n\n* Source/WebCore/rendering/BackgroundPainter.cpp:\n(WebCore::BackgroundPainter::paintBoxShadow const):\n* Source/WebCore/rendering/BorderPainter.cpp:\n(WebCore::BorderPainter::paintBorderSides const):\n* Source/WebCore/rendering/BorderShape.cpp:\n(WebCore::BorderShape::shapeForOffsetRect):\n(WebCore::BorderShape::shapeWithBorderWidths const):\n(WebCore::BorderShape::move):\n(WebCore::rebuildOffsetCornersFromReference):\n(WebCore::addOuterCornerShapeToPath):\n(WebCore::BorderShape::pathForOuterCornerShape const):\n(WebCore::addInnerCornerShapeToPath):\n(WebCore::BorderShape::pathForInnerCornerShape const):\n(WebCore::BorderShape::pathForOuterShape const):\n(WebCore::BorderShape::pathForInnerShape const):\n(WebCore::BorderShape::addOuterShapeToPath const):\n(WebCore::BorderShape::addInnerShapeToPath const):\n(WebCore::BorderShape::clipToOuterShape const):\n(WebCore::BorderShape::clipToInnerShape const):\n(WebCore::BorderShape::clipOutOuterShape const):\n(WebCore::BorderShape::clipOutInnerShape const):\n(WebCore::BorderShape::fillOuterShape const):\n(WebCore::BorderShape::fillInnerShape const):\n(WebCore::snapOffsetReference):\n(WebCore::BorderShape::snappedOffsetReferenceRect const):\n* Source/WebCore/rendering/BorderShape.h:\n(WebCore::BorderShape::shapeForOffsetRect):\n\nCanonical link: https://commits.webkit.org/318193@main",
      "email": "173393835+cupidsity@users.noreply.github.com",
      "hash": "615d0d245f473fb9fcf6db8ec087bfe7f7626a04",
      "subject": "corner-shape: bevel/notch/square corners are mis-positioned on outlines and box-shadow spread"
    },
    "318194@main": {
      "author": "Kai Tamkun",
      "avatar": "https://www.gravatar.com/avatar/dff073cba21885df4d9f73ed3cc493c2?d=identicon\u0026s=64",
      "cl": "318194@main",
      "clUrl": "https://commits.webkit.org/318194@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320240\nrdar://183368480\n\nReviewed by Mark Lam.\n\nIn a case where we'd crash anyway, stuff some useful data into\nregisters first to make debugging easier in the absence of a repro.\n\nNo new tests because we don't have a repro that can trigger this path.\n\n* Source/JavaScriptCore/heap/BlockDirectory.cpp:\n(JSC::BlockDirectory::isFreeListedCell):\n* Source/JavaScriptCore/heap/BlockDirectory.h:\n* Source/JavaScriptCore/heap/LocalAllocator.cpp:\n(JSC::LocalAllocator::isFreeListedCell const):\n* Source/JavaScriptCore/heap/LocalAllocator.h:\n* Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:\n(JSC::LLInt::performLLIntGetByID):\n* Source/JavaScriptCore/runtime/JSCJSValue.h:\n* Source/JavaScriptCore/runtime/JSCJSValuePropertyInlines.h:\n(JSC::JSValue::get const):\n(JSC::JSValue::getPropertySlot const):\n* Source/JavaScriptCore/runtime/JSObject.cpp:\n(JSC::saturate):\n(JSC::EmptyValueCrashLayout::nibbleShift):\n(JSC::JSObject::crashDueToEmptyValueAtValidOffset):\n* Source/JavaScriptCore/runtime/JSObject.h:\n(JSC::JSObject::getOwnNonIndexPropertySlot):\n(JSC::JSObject::getPropertySlot):\n\nCanonical link: https://commits.webkit.org/318194@main",
      "email": "k_tamkun@apple.com",
      "hash": "4f54300b848acb86f95da242cbd1d7538c5d0cf9",
      "subject": "[JSC] Assemble diagnostic data when getDirect returns an all-zero JSValue during llint_slow_path_get_by_id"
    },
    "318195@main": {
      "author": "Gerald Squelart",
      "avatar": "https://www.gravatar.com/avatar/894904f08d85651bf2a76868a4d2f1b3?d=identicon\u0026s=64",
      "cl": "318195@main",
      "clUrl": "https://commits.webkit.org/318195@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320519\nrdar://183483114\n\nReviewed by Mike Wyrzykowski.\n\nAs per https://html.spec.whatwg.org/multipage/imagebitmap-and-animations.html#initialize-an-imagedata-object\n1.1: If settings[\"pixelFormat\"] equals \"rgba-unorm8\" and source is not a\n     Uint8ClampedArray, then throw an \"InvalidStateError\" DOMException.\n1.2: If settings[\"pixelFormat\"] is \"rgba-float16\" and source is not a\n     Float16Array, then throw an \"InvalidStateError\" DOMException.\n\n* LayoutTests/fast/canvas/hdr/float16-canvas-imagedata-large-unaccelerated-expected.txt:\n* LayoutTests/fast/canvas/hdr/float16-canvas-imagedata-small-accelerated-display-p3-expected.txt:\n* LayoutTests/fast/canvas/hdr/float16-canvas-imagedata-small-accelerated-display-p3-linear-expected.txt:\n* LayoutTests/fast/canvas/hdr/float16-canvas-imagedata-small-accelerated-expected.txt:\n* LayoutTests/fast/canvas/hdr/float16-canvas-imagedata-small-accelerated-srgb-linear-expected.txt:\n* LayoutTests/fast/canvas/hdr/float16-canvas-imagedata.js:\n* Source/WebCore/html/ImageData.cpp:\n(WebCore::ImageData::create):\n\nCanonical link: https://commits.webkit.org/318195@main",
      "email": "g_squelart@apple.com",
      "hash": "e9fc18b84ae2af773b28216685002cd3fdfa092a",
      "subject": "Catch mismatched pixelFormats in ImageData JS constructor"
    },
    "318196@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "318196@main",
      "clUrl": "https://commits.webkit.org/318196@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320292\nrdar://183225101\n\nReviewed by Abrar Rahman Protyasha.\n\nThis new implementation leverages SwiftUI to simplify the UI code of the PDF HUD view.\n\nIt is off-by-default as a runtime feature flag.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebKit/Modules/Internal/module.modulemap:\n* Source/WebKit/SourcesCocoa.txt:\n* Source/WebKit/UIProcess/PDF/WKAlternatePDFHUDView.h: Copied from Source/WebKit/UIProcess/PDF/WKPDFHUDView.h.\n* Source/WebKit/UIProcess/PDF/WKAlternatePDFHUDView.swift: Added.\n(Controls.body):\n(WKAlternatePDFHUDView.show):\n* Source/WebKit/UIProcess/PDF/WKDefaultPDFHUDView.h: Copied from Source/WebKit/UIProcess/PDF/WKPDFHUDView.h.\n* Source/WebKit/UIProcess/PDF/WKDefaultPDFHUDView.mm: Renamed from Source/WebKit/UIProcess/PDF/WKPDFHUDView.mm.\n(-[WKDefaultPDFHUDView performPDFZoomIn]):\n(-[WKDefaultPDFHUDView performPDFZoomOut]):\n(-[WKDefaultPDFHUDView performPDFOpenWithPreview]):\n(-[WKDefaultPDFHUDView performPDFSaveToPDF]):\n* Source/WebKit/UIProcess/PDF/WKDefaultPDFHUDView.swift: Renamed from Source/WebKit/UIProcess/PDF/WKPDFHUDView.swift.\n(isInRecoveryOS):\n(WKDefaultPDFHUDView.pluginIdentifier):\n(WKDefaultPDFHUDView.frameIdentifier):\n(WKDefaultPDFHUDView.webView):\n(WKDefaultPDFHUDView.barView):\n(WKDefaultPDFHUDView.stackView):\n(WKDefaultPDFHUDView.zoomOutButton):\n(WKDefaultPDFHUDView.zoomInButton):\n(WKDefaultPDFHUDView.separatorView):\n(WKDefaultPDFHUDView.openInPreviewButton):\n(WKDefaultPDFHUDView.saveButton):\n(WKDefaultPDFHUDView.isBarVisible):\n(WKDefaultPDFHUDView.mouseMovedToHUD):\n(WKDefaultPDFHUDView.initialHideTimerFired):\n(WKDefaultPDFHUDView.hideTimerTask):\n(WKDefaultPDFHUDView.show):\n(WKDefaultPDFHUDView._performAction(forControl:)):\n(WKDefaultPDFHUDView.layout):\n(WKDefaultPDFHUDView.hitTest(_:)):\n(WKDefaultPDFHUDView.mouseMoved(with:)):\n(WKDefaultPDFHUDView.zoomOutAction):\n(WKDefaultPDFHUDView.zoomInAction):\n(WKDefaultPDFHUDView.openInPreviewAction):\n(WKDefaultPDFHUDView.saveAction):\n(WKDefaultPDFHUDView.setBarVisible(_:)):\n(WKDefaultPDFHUDView.resetHideTimer):\n(WKDefaultPDFHUDView.hideTimerFired):\n(WKDefaultPDFHUDView.makeBarView):\n(WKDefaultPDFHUDView.makeButton(_:accessibilityLabel:isPrivateSymbol:)):\n(WKDefaultPDFHUDView.makeSeparator):\n* Source/WebKit/UIProcess/PDF/WKPDFHUDView.h:\n* Source/WebKit/UIProcess/mac/WebViewImpl.h:\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::createPDFHUD):\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/318196@main",
      "email": "richard_robinson2@apple.com",
      "hash": "f1c90a305e8e3344fb79d4595e3931c3237ebcdb",
      "subject": "[PDF] Add an experimental, off-by-default, prototype implementation of an alternate PDF HUD View"
    },
    "318197@main": {
      "author": "Yulun Wu",
      "avatar": "https://www.gravatar.com/avatar/9e34d6632f4d926cdf6fe8dce07f9cb7?d=identicon\u0026s=64",
      "cl": "318197@main",
      "clUrl": "https://commits.webkit.org/318197@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320585\n\u003crdar://183561463\u003e\n\nReviewed by Sammy Gill.\n\nRe-keys distributeExtraSpaceToBaseSizes()'s planned-increase to all tracks instead\nof the list of affectedTrackIndexes.\n\nThis is required by step 2.3, which distributes space into the non-affected\ntracks an item spans. In order to support this, we need to share one track-index\nacross distributeExtraSpaceToBaseSizes().\n\n* Source/WebCore/layout/formattingContexts/grid/TrackSizingAlgorithm.cpp:\n(WebCore::Layout::indexesForUnfrozenAffectedTracks):\n(WebCore::Layout::distributeExtraSpaceToBaseSizes):\n\nCanonical link: https://commits.webkit.org/318197@main",
      "email": "yulun_wu@apple.com",
      "hash": "40a9bf41957160d34f7f8b77353a64703fabc067",
      "subject": "[GFC] Key track sizing space distribution by grid track index"
    },
    "318198@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "318198@main",
      "clUrl": "https://commits.webkit.org/318198@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320520\n\nReviewed by Darin Adler.\n\nThe Boyer-Moore good-suffix shift table (m_goodSuffixShiftTable) was sized\nbmMaxShift, but it is indexed by pattern index over the range\n[m_start, patternLength], i.e. up to and including patternLength. When a\nneedle's length is exactly bmMaxShift (250), populateBoyerMooreTable() writes\nto index patternLength, which is one past the end of the table.\n\nThe out-of-bounds access was masked because the tables were handed around as\nraw int* and the good-suffix / suffix tables were accessed through a biased\npointer (table - m_start), so nothing bounds-checked the index against the\nphysical array.\n\nFix the size (bmMaxShift + 1) and, to make this class of bug fail loudly\nrather than silently write in the wrong place, replace the raw table pointers\nwith std::span:\n\n  - AdaptiveStringSearcherTables now vends fixed-extent std::span accessors\n    instead of int*, so every access is bounds-checked against a compile-time\n    constant extent (a hard trap under hardened libc++).\n  - Introduce BiasedShiftTable, which maps pattern indices in\n    [m_start, patternLength] onto the shift table while bounds-checking both\n    ends against the physical table, replacing the previous biased raw pointer.\n  - charOccurrence() takes a fixed-extent span and reduces the index into\n    [0, ucharAlphabetSize) via uint8_t / uint16_t casts so the bounds check\n    folds away.\n  - Replace the manual memset/loop that initializes the bad-char table with\n    std::ranges::fill.\n\nThis change tested as performance neutral on Speedometer and JetStream.\n\n* Source/WTF/wtf/text/AdaptiveStringSearcher.h:\n(WTF::BiasedShiftTable::BiasedShiftTable):\n(WTF::BiasedShiftTable::operator[] const):\n(WTF::AdaptiveStringSearcher::charOccurrence):\n(WTF::AdaptiveStringSearcher::goodSuffixShiftTable):\n(WTF::AdaptiveStringSearcher::suffixTable):\n(WTF::SubjectChar\u003e::boyerMooreSearch):\n(WTF::SubjectChar\u003e::populateBoyerMooreTable):\n(WTF::SubjectChar\u003e::boyerMooreHorspoolSearch):\n(WTF::SubjectChar\u003e::populateBoyerMooreHorspoolTable):\n\nCanonical link: https://commits.webkit.org/318198@main",
      "email": "cdumez@apple.com",
      "hash": "5590f2e70615e4b6f6a7187dbdaddf5c7b98520f",
      "subject": "AdaptiveStringSearcher good-suffix shift table is one element too small"
    },
    "318199@main": {
      "author": "Zak Ridouh",
      "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64",
      "cl": "318199@main",
      "clUrl": "https://commits.webkit.org/318199@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320597\nrdar://183572581\n\nReviewed by Pascoe.\n\n318196@main renamed WKPDFHUDView.{mm,swift} to WKDefaultPDFHUDView.{mm,swift}\nand added WKAlternatePDFHUDView.swift, but only updated the Xcode project and\nSourcesCocoa.txt. PlatformCocoa.cmake's macOS source list still named the old\nfiles, so configuring failed on both missing sources. WebKitUIProcess was left\nwith no sources at all, which in turn broke the targets that reuse WebKit's\nprecompiled header.\n\nUpdate the two renamed entries and add the new Swift file.\n\n* Source/WebKit/PlatformCocoa.cmake:\n\nCanonical link: https://commits.webkit.org/318199@main",
      "email": "zakr@apple.com",
      "hash": "44accd06b0d8a63b2c92a9e113f84f439caf84a5",
      "subject": "[CMake] Fix the macOS build after 318196@main"
    },
    "318200@main": {
      "author": "Jessica Lee",
      "avatar": "https://www.gravatar.com/avatar/fc717c99321d09f31fb9187418a8ffc5?d=identicon\u0026s=64",
      "cl": "318200@main",
      "clUrl": "https://commits.webkit.org/318200@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320549\nrdar://183509381\n\nReviewed by Alex Christensen.\n\nA provisional load that fails due to content filtering should be allowed to\nproceed and commit the substitute data rather than being transitioned to a\nremote page which results in failure to update the WebPageProxy's process/state-tracking.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ParentalControlsContentFilteringTests.mm\n\n* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:\n(WebKit::ProvisionalPageProxy::didFailProvisionalLoadForFrame):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ParentalControlsContentFilteringTests.mm:\n(TEST(ParentalControlsContentFilteringTests, OpenBlockedPopUp)):\n\nCanonical link: https://commits.webkit.org/318200@main",
      "email": "jlee53@apple.com",
      "hash": "4a18bc6d5a15cb1dbaebefb5c1f8ce842bb86360",
      "subject": "[Site Isolation] Content Filter failures shouldn't transition ProvisionalPageProxy to RemotePageProxy"
    },
    "318201@main": {
      "author": "Dan Glastonbury",
      "avatar": "https://www.gravatar.com/avatar/fb7cb28bf9f1bc9fc0c3bbf65566efdc?d=identicon\u0026s=64",
      "cl": "318201@main",
      "clUrl": "https://commits.webkit.org/318201@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320599\nrdar://183572865\n\nUnreviewed, reverting 318113@main (947e0ed57ed1)\n\nReverted change:\n\n    Avoid recomputing anonymousWrappers on removal of out-of-flow elements.\n    https://bugs.webkit.org/show_bug.cgi?id=320142\n    rdar://183081340\n\nCanonical link: https://commits.webkit.org/318201@main",
      "email": "djg@apple.com",
      "hash": "187449bc2b015f6f033ac35213c0de8fbf49e08b",
      "subject": "REGRESSION(318113@main): MotionMark 1.3 Leaves 19.5% worse than baseline"
    },
    "318202@main": {
      "author": "Dan Hecht",
      "avatar": "https://www.gravatar.com/avatar/080f47d912b1b34d0be8293f825d132d?d=identicon\u0026s=64",
      "cl": "318202@main",
      "clUrl": "https://commits.webkit.org/318202@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=305997\nrdar://168629094\n\nReviewed by Yusuke Suzuki.\n\nThe greedy register allocator has been the default B3 Air register\nallocator for all configurations for a while now, and we haven't\nencountered any need to revert back to this allocator. The greedy\nallocator results in faster compile times and performs better\non benchmarks. So let's clean up.\n\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/Sources.txt:\n* Source/JavaScriptCore/b3/air/AirAllocateRegistersByGraphColoring.cpp: Removed.\n* Source/JavaScriptCore/b3/air/AirAllocateRegistersByGraphColoring.h: Removed.\n* Source/JavaScriptCore/b3/air/AirGenerate.cpp:\n(JSC::B3::Air::prepareForGeneration):\n* Source/JavaScriptCore/runtime/OptionsList.h:\n* Tools/Scripts/run-jsc-stress-tests:\n\nCanonical link: https://commits.webkit.org/318202@main",
      "email": "dan.hecht@apple.com",
      "hash": "bfb1b1183bc24fae86e740a2f23c9374b8bba793",
      "subject": "[JSC] Remove the B3 Air graph coloring register allocator"
    },
    "318203@main": {
      "author": "Dan Glastonbury",
      "avatar": "https://www.gravatar.com/avatar/fb7cb28bf9f1bc9fc0c3bbf65566efdc?d=identicon\u0026s=64",
      "cl": "318203@main",
      "clUrl": "https://commits.webkit.org/318203@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320411\nrdar://183373416\n\nReviewed by Cameron McCormack.\n\nWhen Occlusion query is disabled via mOcclusionQueryIsEnabled, mResultOut isn't\nwritten. Fix by writing angle::Result::Continue.\n\n* Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_render_utils.mm:\n\nCanonical link: https://commits.webkit.org/318203@main",
      "email": "djg@apple.com",
      "hash": "ad7f3f1d0dba835c59310ee6d4a47673ef57afc9",
      "subject": "[ANGLE] ScopedDisableOcclusionQuery helper doesn't write mResultOut"
    },
    "318204@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "318204@main",
      "clUrl": "https://commits.webkit.org/318204@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320408\n\nReviewed by Youenn Fablet.\n\nCacheStorageManager::sizeDecreased() subtracted the given amount from m_size\nwithout checking that it did not exceed the current value. m_size is a uint64_t,\nso if the amount ever exceeds the tracked size the subtraction wraps to a value\nnear UINT64_MAX, which is then written to the cache's size file and used for\nquota accounting, effectively corrupting quota reporting for the origin until\nthe size is re-initialized.\n\nThe tracked size is normally kept consistent (increments and decrements are\nbalanced in putRecordsInStore), but removeRecords() and removeAllRecords() call\nsizeDecreased() directly, outside the space-request/initialization path, so the\nin-memory accounting and the asynchronously-measured cache size can in theory\ndrift and the decrement can exceed m_size.\n\nClamp the subtraction at zero, matching the saturating arithmetic used elsewhere\nin this code.\n\n* Source/WebKit/NetworkProcess/storage/CacheStorageManager.cpp:\n(WebKit::CacheStorageManager::sizeDecreased):\n\nCanonical link: https://commits.webkit.org/318204@main",
      "email": "cdumez@apple.com",
      "hash": "5d91250a8529e04434ea11a12669ac533bb17e77",
      "subject": "CacheStorage size accounting can underflow and persist a corrupt size"
    },
    "318205@main": {
      "author": "Roberto Rodriguez",
      "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64",
      "cl": "318205@main",
      "clUrl": "https://commits.webkit.org/318205@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320515\nrdar://180731415\n\nReviewed by Dan Glastonbury.\n\nCompiling a fragment shader that nests one interpolateAtOffset inside another\ncall's offset argument crashes in the Metal backend. The offset rewrite wraps\neach offset in a helper that adjusts it for Metal and passes the original offset\ninto that helper as a child. It incorrectly queues the replacement with\nOriginalNode::IS_DROPPED, telling the tree updater the original is gone. For\nnested calls the inner call is both a replaced node and the parent of its own\nreplacement, so the updater points the inner replacement at the wrapper, cannot\nfind the offset there, and fails an assertion.\n\nFix by queuing the replacement with OriginalNode::BECOMES_CHILD, which matches\nwhat actually happens since the offset is reused inside the wrapper. The updater\nthen leaves the inner call's parent alone and both offsets are rewritten\ncorrectly.\n\nVulkan (SPIR-V) backend has same bug in its own interpolateAtOffset offset rewrite\nso fix here too to keep it intact when the change is upstreamed.\n\n* Source/ThirdParty/ANGLE/src/compiler/translator/tree_ops/msl/RewriteInterpolants.cpp:\n* Source/ThirdParty/ANGLE/src/tests/gl_tests/ShaderMultisampleInterpolation.cpp:\n* Source/ThirdParty/ANGLE/src/compiler/translator/tree_ops/spirv/RewriteInterpolateAtOffset.cpp:\n\nCanonical link: https://commits.webkit.org/318205@main",
      "email": "roberto_rodriguez2@apple.com",
      "hash": "746d4c43e40a9cc16381da0caf3d4b3f44712215",
      "subject": "[ANGLE] Correctly rewrite nested interpolateAtOffset offsets"
    },
    "318206@main": {
      "author": "Yulun Wu",
      "avatar": "https://www.gravatar.com/avatar/9e34d6632f4d926cdf6fe8dce07f9cb7?d=identicon\u0026s=64",
      "cl": "318206@main",
      "clUrl": "https://commits.webkit.org/318206@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320259\n\u003crdar://183165448\u003e\n\nReviewed by Alan Baradlay.\n\nThis PR renames widthConstraint/heightConstraint to overridingBorderBoxLogicalWidth/Height\nacross *FC to better represent what they do.\n\nThis PR also renames the misnamed static layoutBoxWithOverridingBorderBoxSize()\nto layoutRendererWithOverridingBorderBoxSize(), since it operates on a RenderBox\nrather than a Layout::Box. This also cleans up the shared code for two layout entry\npoints into a new layoutRendererAndUpdateBoxGeometry() helper.\n\nNo behavior change.\n\n* Source/WebCore/layout/LayoutState.cpp:\n(WebCore::Layout::LayoutState::layoutWithFormattingContextForBox const):\n* Source/WebCore/layout/LayoutState.h:\n* Source/WebCore/layout/integration/LayoutIntegrationFormattingContextLayout.cpp:\n(WebCore::LayoutIntegration::layoutRendererWithOverridingBorderBoxSize):\n(WebCore::LayoutIntegration::layoutRendererAndUpdateBoxGeometry):\n(WebCore::LayoutIntegration::layoutWithFormattingContextForBox):\n(WebCore::LayoutIntegration::layoutGridItemWithFormattingContext):\n(WebCore::LayoutIntegration::layoutBoxWithOverridingBorderBoxSize): Deleted.\n* Source/WebCore/layout/integration/LayoutIntegrationFormattingContextLayout.h:\n* Source/WebCore/layout/integration/LayoutIntegrationUtils.cpp:\n(WebCore::Layout::IntegrationUtils::layoutWithFormattingContextForBox const):\n(WebCore::Layout::IntegrationUtils::layoutGridItem const):\n* Source/WebCore/layout/integration/LayoutIntegrationUtils.h:\n(WebCore::Layout::IntegrationUtils::layoutWithFormattingContextForBox):\n\nCanonical link: https://commits.webkit.org/318206@main",
      "email": "yulun_wu@apple.com",
      "hash": "2fe096a108bcb780001c4b882807bbe42021e27d",
      "subject": "[GFC][LayoutIntegrationUtils] Clarify intent of integration helper functions."
    },
    "318207@main": {
      "author": "Devin Rousso",
      "avatar": "https://www.gravatar.com/avatar/c9e757d973342c773f107a94b70cb9cd?d=identicon\u0026s=64",
      "cl": "318207@main",
      "clUrl": "https://commits.webkit.org/318207@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320249\n\nReviewed by Yusuke Suzuki.\n\n* Source/JavaScriptCore/wasm/WasmModuleInformation.h:\n* Source/JavaScriptCore/wasm/WasmStreamingCompiler.h:\n(JSC::Wasm::StreamingCompiler::create):\n(JSC::Wasm::StreamingCompiler::StreamingCompiler):\n* Source/JavaScriptCore/wasm/WasmStreamingCompiler.cpp:\n(JSC::Wasm::StreamingCompiler::StreamingCompiler):\n(JSC::Wasm::StreamingCompiler::create):\n* Source/JavaScriptCore/debugger/Debugger.h:\n* Source/JavaScriptCore/debugger/Debugger.cpp:\n(JSC::Debugger::sourceParsed):\n* Source/JavaScriptCore/inspector/protocol/Debugger.json:\n* Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.h:\n* Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.cpp:\n(Inspector::InspectorDebuggerAgent::requestIdForScript): Added.\n(Inspector::InspectorDebuggerAgent::didParseSource):\n* Source/WebCore/inspector/agents/WebDebuggerAgent.h:\n* Source/WebCore/inspector/agents/WebDebuggerAgent.cpp:\n(WebCore::WebDebuggerAgent::requestIdForScript): Added.\n* Source/WebInspectorUI/UserInterface/Protocol/DebuggerObserver.js:\n(WI.DebuggerObserver.prototype.scriptParsed):\nKeep the final response URL and request identifier in `ModuleInformation`, and format the protocol `requestId` in Inspector so that it can be process-qualified when site isolation is enabled.\n\n* Source/WebInspectorUI/UserInterface/Controllers/NetworkManager.js:\n(WI.NetworkManager.prototype.resourceRequestWillBeSent):\nUpdate assertions for redirects of resources associated with a `WI.Target`.\n\n* Source/WebInspectorUI/UserInterface/Controllers/DebuggerManager.js:\n(WI.DebuggerManager):\n(WI.DebuggerManager.prototype.scriptDidParse):\n(WI.DebuggerManager.prototype._tryAssociateScripts): Added.\n(WI.DebuggerManager.prototype._handleResourceAdded): Added.\n(WI.DebuggerManager.prototype._handleResourceChanged): Added.\n* Source/WebInspectorUI/UserInterface/Models/Resource.js:\n(WI.Resource.prototype.get displayName):\n(WI.Resource.prototype.associateWithScript):\n(WI.Resource.Event.ScriptAssociated): Added.\n* Source/WebInspectorUI/UserInterface/Models/Script.js:\n(WI.Script):\n(WI.Script.isWebAssembly):\n(WI.Script.prototype.get customName): Added.\n(WI.Script.prototype.tryAssociateWithResource): Added.\n(WI.Script.prototype._resolveResource):\n(WI.Script.prototype._resolveResource.hasMatchingScript): Added.\n(WI.Script.prototype._resolveResource.isMatchingResource): Added.\n(WI.Script.Event.ResourceChanged): Added.\nExpand how `WI.Script` are associated with a `WI.Resource`.\n\n* Source/WebInspectorUI/UserInterface/Views/ResourceTreeElement.js:\n(WI.ResourceTreeElement.prototype.get filterableData):\n(WI.ResourceTreeElement.prototype._updateResource):\n(WI.ResourceTreeElement.prototype.get mainTitleText):\n(WI.ResourceTreeElement.prototype._handleScriptAssociated): Added.\n* Source/WebInspectorUI/UserInterface/Views/OpenResourceDialog.js:\n(WI.OpenResourceDialog.prototype.didDismissDialog):\n(WI.OpenResourceDialog.prototype.didPresentDialog):\n(WI.OpenResourceDialog.prototype._handleScriptResourceChanged): Added.\n* Source/WebInspectorUI/UserInterface/Views/SearchSidebarPanel.js:\n(WI.SearchSidebarPanel.prototype._handleTreeSelectionDidChange):\n* Source/WebInspectorUI/UserInterface/Views/SourcesNavigationSidebarPanel.js:\n(WI.SourcesNavigationSidebarPanel):\n(WI.SourcesNavigationSidebarPanel.prototype.closed):\n(WI.SourcesNavigationSidebarPanel.prototype.treeElementForRepresentedObject):\n(WI.SourcesNavigationSidebarPanel.prototype.treeElementForRepresentedObject.isAncestor):\n(WI.SourcesNavigationSidebarPanel.prototype.treeElementForRepresentedObject.getParent):\n(WI.SourcesNavigationSidebarPanel.prototype._removeScript): Added.\n(WI.SourcesNavigationSidebarPanel.prototype._handleScriptResourceChanged): Added.\n(WI.SourcesNavigationSidebarPanel.prototype._handleDebuggerScriptRemoved):\n* Source/WebInspectorUI/UserInterface/Views/WorkerTreeElement.js:\n(WI.WorkerTreeElement.prototype.descendantResourceTreeElementTypeDidChange): Added.\n(WI.WorkerTreeElement.prototype.descendantResourceTreeElementMainTitleDidChange): Added.\nReplace `WI.Script` with its associated `WI.Resource` wherever possible.\n\n* Source/WebInspectorUI/UserInterface/Views/GenericResourceContentView.js:\n(WI.GenericResourceContentView.prototype.contentAvailable): Added.\n* Source/WebInspectorUI/UserInterface/Views/ResourceClusterContentView.js:\n(WI.ResourceClusterContentView):\n(WI.ResourceClusterContentView.prototype._contentViewForResourceType):\n* Source/WebInspectorUI/UserInterface/Views/ScriptContentView.js:\n(WI.ScriptContentView.prototype._contentDidPopulate):\nShow a binary-content message for non-text resources that do not have a more specific preview.\n\n* Source/WebCore/Modules/fetch/FetchLoaderClient.h:\n(WebCore::FetchLoaderClient::didReceiveResponse):\n* Source/WebCore/Modules/fetch/FetchLoader.cpp:\n(WebCore::FetchLoader::didReceiveResponse):\n* Source/WebCore/Modules/fetch/FetchBodyOwner.h:\n(WebCore::FetchBodyOwner::BlobLoader::didReceiveResponse):\n* Source/WebCore/Modules/fetch/FetchBodyOwner.cpp:\n(WebCore::FetchBodyOwner::BlobLoader::didReceiveResponse):\n* Source/WebCore/Modules/fetch/FetchResponse.h:\n(WebCore::FetchResponse::resourceLoaderIdentifier const): Added.\n(WebCore::FetchResponse::Loader::didReceiveResponse):\n* Source/WebCore/Modules/fetch/FetchResponse.cpp:\n(WebCore::FetchResponse::clone):\n(WebCore::FetchResponse::Loader::didReceiveResponse):\n* Source/WebCore/loader/WorkerThreadableLoader.cpp:\n(WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveResponse):\n* Source/WebKit/WebProcess/Storage/WebServiceWorkerFetchTaskClient.h:\n(WebKit::WebServiceWorkerFetchTaskClient::BlobLoader::didReceiveResponse):\n* Source/WebKit/WebProcess/Inspector/FrameNetworkAgentProxy.cpp:\n(WebKit::FrameNetworkAgentProxy::willSendRequest):\n(WebKit::FrameNetworkAgentProxy::willSendRequestOfType):\n* Source/WebCore/bindings/js/JSDOMGlobalObject.cpp:\n(WebCore::handleResponseOnStreamingAction):\nPropagate the request identifier through cloning, `Worker`, `ServiceWorker`, etc..\n\n* LayoutTests/http/tests/inspector/debugger/wasm/resources/named-module.py: Added.\n* LayoutTests/http/tests/inspector/debugger/wasm/resources/resource-worker.js: Added.\n* LayoutTests/http/tests/inspector/debugger/wasm/script-url.html: Added.\n* LayoutTests/http/tests/inspector/debugger/wasm/script-url-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/debugger/resources/wasm-frame.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/debugger/wasm-frame-placement.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/debugger/wasm-frame-placement-expected.txt: Added.\n* LayoutTests/inspector/model/frame-extra-scripts.html:\n* LayoutTests/inspector/model/frame-extra-scripts-expected.txt:\n* LayoutTests/inspector/model/script-resource-relationship.html:\n* LayoutTests/inspector/model/script-resource-relationship-expected.txt:\n\nCanonical link: https://commits.webkit.org/318207@main",
      "email": "hi@devinrousso.com",
      "hash": "301d6b2b21f7a0d391ce46704ab7b2e83332c90e",
      "subject": "Web Inspector: associate WebAssembly module scripts with the resource that fetched it"
    },
    "318208@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "318208@main",
      "clUrl": "https://commits.webkit.org/318208@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320534\n\nReviewed by Darin Adler.\n\n* Source/WebCore/css/calc/CSSCalcTree.cpp:\n(WebCore::CSSCalc::subtract):\n* Source/WebCore/editing/Editor.cpp:\n* Source/WebCore/rendering/RenderLayerBacking.cpp:\n(WebCore::RenderLayerBacking::updateAncestorClippingStack):\n* Source/WebCore/style/StyleCustomPropertyRegistry.cpp:\n(WebCore::Style::CustomPropertyRegistry::registerFromStylesheet):\n* Source/WebCore/style/values/masking/StyleClipPath.h:\n(WebCore::Style::ClipPath::ClipPath):\n* Source/WebCore/workers/WorkerScriptLoader.cpp:\n(WebCore::WorkerScriptLoader::loadAsynchronously):\n* Source/WebCore/workers/service/context/ServiceWorkerThread.cpp:\n(WebCore::ServiceWorkerThread::queueTaskToFireBackgroundFetchEvent):\n* Source/WebCore/workers/service/server/SWServer.cpp:\n(WebCore::SWServer::tryInstallContextData):\n* Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.cpp:\n(WebKit::NetworkCORSPreflightChecker::willPerformHTTPRedirection):\n* Source/WebKit/UIProcess/WebProcessPool.cpp:\n(WebKit::WebProcessPool::setOverrideLanguages):\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::assumeReadAccessToBaseURLs):\n* Source/WebKit/webpushd/PushService.mm:\n(WebPushD::PushService::updateTopicLists):\n\nCanonical link: https://commits.webkit.org/318208@main",
      "email": "cdumez@apple.com",
      "hash": "6ce79778ca494ab59d10d66723e3238a84035f4c",
      "subject": "Fix several use-after-moves in the codebase"
    },
    "318209@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/cf9d615e1e00176d99cc4a21d33c3bbb?d=identicon\u0026s=64",
      "cl": "318209@main",
      "clUrl": "https://commits.webkit.org/318209@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=308288\n\nReviewed by Yusuke Suzuki.\n\nFor /u patterns, YARR JIT uses firstCharacterAdditionalReadSize (the advance latch)\nto move the match start past both units of a surrogate pair when a match attempt\nfails. The latch was set as a side effect of every non-BMP character read, so a read\nanywhere in the pattern could corrupt it, e.g. /.x/u.exec(\"a\\u{10000}x\") returned null\nbecause the U+10000 read at position 1 latched the register while the start character\n'a' is BMP. Several workarounds (word boundary and backreference read guards, latch\nresets at alternative reentry, and after wide character compares) papered over\nindividual instances of this.\n\nThis change makes the latch a function of the match start position alone:\n\n1. initAdvanceLatch() sets the latch iff the code units at the match start form a\n   complete surrogate pair (a lone lead advances by one code unit, like\n   AdvanceStringIndex). It is emitted where an alternative is entered as the first one\n   attempted at a start position: right before the alternative body after any\n   start-position prefilter (Boyer-Moore lookahead / SIMD searches move the index),\n   and on the path that enters a shorter alternative directly when longer ones no\n   longer fit.\n\n2. tryReadUnicodeCharImpl no longer touches the latch, so\n   TryReadUnicodeCharGenFirstNonBMPOptimization, its second slow-path thunk, and all of\n   the workarounds above are removed.\n\n3. Skipping the trail surrogate position is only unobservable when every alternative\n   consumes at least one character, since a character read at that position yields\n   errorCodePoint. A zero minimum-size alternative (e.g. /aa|\\B/u) can match there, so\n   the optimization now also requires m_body-\u003em_minimumSize; this fixes\n   /a?\\B|q/u.exec(\"X\\u{1F600}Z\") returning null instead of the empty match at 2.\n\nTest: JSTests/stress/regexp-unicode-nonbmp-advance-latch-bug.js\n\n* JSTests/stress/regexp-unicode-nonbmp-advance-latch-bug.js: Added.\n(shouldBe):\n(shouldBeMatch):\n* JSTests/stress/temporal-hebrew-day-constrain.js: Added.\n(shouldBe):\n(shouldBe.byCode.toString):\n(shouldBe.byOrdinal.toString):\n(Temporal.PlainDate.from):\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n(JSC::Yarr::tryReadUnicodeCharImpl):\n(JSC::Yarr::tryReadUnicodeCharSlowImpl):\n(JSC::Yarr::tryReadUnicodeCharSlowThunkGenerator):\n(JSC::Yarr::tryReadUnicodeCharIncForNonBMPSlowThunkGenerator): Deleted.\n\nCanonical link: https://commits.webkit.org/318209@main",
      "email": "sosuke@bun.com",
      "hash": "54916608d7d648c662f4524d57000ec33b0eb431",
      "subject": "[YARR] Fix non-BMP advance latch and simplify `tryReadUnicodeCharImpl`"
    },
    "318210@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "318210@main",
      "clUrl": "https://commits.webkit.org/318210@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320532\n\nReviewed by Yusuke Suzuki.\n\nThe ARM64 predicate passed to riscLowerMalformedAddresses compared\naddress.scale (an Immediate AST node) against Ruby integers, and\nImmediate#== only returns true when the other side is also an Immediate.\nSo `address.scale == 1 or address.scale == size` was always false and\nevery BaseIndex load/store was lowered to `add tmp, base, index, lsl #n`\nfollowed by `ldr/str [tmp]`, even though BaseIndex#arm64Operand can emit\n`[base, index, lsl #n]` directly.\n\nCompare address.scaleValue instead. Because the register-offset form now\nactually reaches the emitters, keep lowering the address for opcodes whose\nemitters only accept other address forms: load/store pair (`[base, #imm]`\nvia arm64PairAddressOperand), atomic/loadlinkacq/storecondrel (`[base]` via\narm64SimpleAddressOperand), loadv/storev (128-bit access, but the size\ntable says 8 and would produce an invalid `lsl #3`), loadqinc (post-index),\nand non-ADDRESS64 configurations (unchanged behavior).\n\nBefore:  add x13, x3, x4, lsl #3\n         ldr x5, [x13]\nAfter:   ldr x5, [x3, x4, lsl #3]\n\nOn macOS arm64 this removes 5,038 instructions (-6.4%) from LLIntAssembly.h.\n\n* Source/JavaScriptCore/offlineasm/arm64.rb:\n\nCanonical link: https://commits.webkit.org/318210@main",
      "email": "sosuke@bun.sh",
      "hash": "9610c2113b4510c465fe0cf6b5dd3cd0c5a2f7f7",
      "subject": "[JSC] offlineasm never emits ARM64 register-offset addressing for BaseIndex operands"
    },
    "318211@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "318211@main",
      "clUrl": "https://commits.webkit.org/318211@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320540\n\nReviewed by Yusuke Suzuki.\n\nStructure::defaultToPrimitiveFastAndNonObservable has been added by 317978@main.\nThis patch changes to use it for `JSObject::toString` as well.\n\n* Source/JavaScriptCore/runtime/JSObject.cpp:\n(JSC::JSObject::toString const):\n\nCanonical link: https://commits.webkit.org/318211@main",
      "email": "sosuke@bun.sh",
      "hash": "173a0bd6d9373b6131006bbea2ba7a613b675a63",
      "subject": "[JSC] Use `defaultToPrimitiveFastAndNonObservable` for `JSObject::toString`"
    },
    "318212@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "318212@main",
      "clUrl": "https://commits.webkit.org/318212@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320591\nrdar://183565424\n\nReviewed by Yijia Huang.\n\nThis patch extends existing StringSplitCache to have RegExp splitting\nversion as it is also common in practice. We basically follow to the\nsame conditions used for string split caching. We record extracted range\ninto a Vector, and materialize it to JSCellButterfly when necessary.\nOne critical point is that because it is using RegExp for splitting, it\ncan have a side-effect of updating RegExp cache information (e.g.\nRegExp.$1), to achieve that, we record MatchResult as well in the cache\nfor RegExp case.\n\nTest: JSTests/stress/regexp-split-cache-regexp-statics.js\n\n* JSTests/stress/regexp-split-cache-regexp-statics.js: Added.\n(shouldBe):\n(statics):\n(clobberStatics):\n(split):\n(regexp):\n(check):\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/SaferCPPExpectations/ForwardDeclCheckerExpectations:\n* Source/JavaScriptCore/Sources.txt:\n* Source/JavaScriptCore/heap/Heap.cpp:\n(JSC::Heap::clearConcurrentRetainedDataIfPossible):\n* Source/JavaScriptCore/runtime/RegExpPrototype.cpp:\n(JSC::genericSplit):\n(JSC::recordSplitSpan):\n(JSC::splitSpanCount):\n(JSC::createArrayFromSplitSpans):\n(JSC::tryAddToRegExpSplitCache):\n(JSC::regExpSplitFast):\n* Source/JavaScriptCore/runtime/StringPrototype.cpp:\n(JSC::stringSplitFast):\n(JSC::isASCIIIdentifierStart): Deleted.\n* Source/JavaScriptCore/runtime/StringPrototypeInlines.h:\n(JSC::isASCIIIdentifierStart):\n* Source/JavaScriptCore/runtime/StringSplitCache.cpp: Copied from Source/JavaScriptCore/runtime/StringSplitCache.h.\n* Source/JavaScriptCore/runtime/StringSplitCache.h:\n(JSC::StringSplitCache::clear):\n(JSC::StringSplitCache::regExpEntryIndex const):\n* Source/JavaScriptCore/runtime/StringSplitCacheInlines.h:\n(JSC::StringSplitCache::getForString):\n(JSC::StringSplitCache::setForString):\n(JSC::StringSplitCache::getForRegExp):\n(JSC::StringSplitCache::setForRegExp):\n(JSC::StringSplitCache::get): Deleted.\n(JSC::StringSplitCache::set): Deleted.\n* Source/JavaScriptCore/runtime/VM.cpp:\n(JSC::VM::VM):\n* Source/JavaScriptCore/runtime/VM.h:\n(JSC::VM::stringSplitCache):\n(JSC::VM::ensureStringSplitCache):\n\nCanonical link: https://commits.webkit.org/318212@main",
      "email": "ysuzuki@apple.com",
      "hash": "73e4c589c1e6f099ef31cab839174494da20d909",
      "subject": "[JSC] Extend StringSplitCache for RegExp"
    },
    "318213@main": {
      "author": "Devin Rousso",
      "avatar": "https://www.gravatar.com/avatar/c9e757d973342c773f107a94b70cb9cd?d=identicon\u0026s=64",
      "cl": "318213@main",
      "clUrl": "https://commits.webkit.org/318213@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320523\n\nReviewed by Qianlang Chen.\n\nSpeculative fix for a potential race when exporting HAR and/or auto-stopping timeline recordings.\n\n* Source/WebInspectorUI/UserInterface/Models/Frame.js:\n(WI.Frame.prototype.initialize):\nClear the previous navigation's `DOMContentLoaded` and load event timestamps when a frame is initialized with a new main resource.\n\n* LayoutTests/inspector/timeline/timeline-recording-autocapture.html:\n* LayoutTests/inspector/timeline/timeline-recording-autocapture-expected.txt:\n\nCanonical link: https://commits.webkit.org/318213@main",
      "email": "hi@devinrousso.com",
      "hash": "48da841046f62198c2898d6900f14cb787a97076",
      "subject": "Web Inspector: reset frame navigation event timestamps when initializing"
    },
    "318214@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "318214@main",
      "clUrl": "https://commits.webkit.org/318214@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320545\n\nReviewed by Sam Weinig and Darin Adler.\n\nThe -webkit-border-image legacy behavior treats a border-image-width whose value\ncontains a fixed \u003clength\u003e as also overriding the element's border widths. The\nparser records this in the \"hasLength\" flag, which must be true if ANY of the\nup-to-four width edges is a length.\n\n313588@main refactored consumeUnresolvedBorderImageWidth() and, in the process,\nsilently changed how \"hasLength\" is accumulated:\n```\n      Before: if (numericValue-\u003eisLength())\n                  hasLength = true;          // monotonic latch\n      After:  hasLength = WTF::switchOn(...) // last-write-wins overwrite\n```\nWith the overwrite, \"hasLength\" ends up reflecting only the last\nlength-percentage edge instead of whether any edge is a length. For a width such\nas `10px 5%`, the length edge (10px) sets it true, then the percentage edge (5%)\noverwrites it back to false.\n\nThis corrupts the stored legacyWebkitBorderImage flag, which two independent\nconsumers (ShorthandSerializer and the style extractor) recompute as\nanyOf(isLength) and compare against. On mismatch they bail out, so\n`-webkit-border-image: url(...) 10 / 10px 5%` fails to serialize (returns the\nempty string) via getComputedStyle / cssText, and the legacy border-width\noverride is dropped at paint time. The result is order-dependent: `5% 10px`\nround-trips but `10px 5%` does not.\n\nRestore the original monotonic-latch semantics by OR-accumulating the flag\nacross edges.\n\nTest: fast/css/webkit-border-image-width-length-serialization.html\n\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Background.cpp:\n(WebCore::CSSPropertyParserHelpers::consumeUnresolvedBorderImageWidth):\n* LayoutTests/fast/css/webkit-border-image-width-length-serialization-expected.txt: Added.\n* LayoutTests/fast/css/webkit-border-image-width-length-serialization.html: Added.\n\nCanonical link: https://commits.webkit.org/318214@main",
      "email": "cdumez@apple.com",
      "hash": "3801ac23e1641d048c562f1392e861563da9ff87",
      "subject": "REGRESSION(313588@main): -webkit-border-image width flag is lost when a length edge precedes a non-length edge"
    },
    "318215@main": {
      "author": "Karl Dubost",
      "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64",
      "cl": "318215@main",
      "clUrl": "https://commits.webkit.org/318215@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320606\nrdar://183574891\n\nReviewed by Kiet Ho.\n\nThe test is passing locally. This is just tweaking the fuziness to take into\naccount the failures on wpt.fyi\nhttps://wpt.fyi/results/svg/coordinate-systems/viewBox-scaling-text-001.html\nmaxDifference: 1\ntotalPixels: 1\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/coordinate-systems/viewBox-scaling-text-001.html:\n\nCanonical link: https://commits.webkit.org/318215@main",
      "email": "karlcow@apple.com",
      "hash": "7aad4de4735aa250848aea5040828747ad15df6f",
      "subject": "fix fuziness issue for imported/w3c/web-platform-tests/svg/coordinate-systems/viewBox-scaling-text-001.html"
    },
    "318216@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "318216@main",
      "clUrl": "https://commits.webkit.org/318216@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320589\nrdar://problem/183563686\n\nReviewed by Alan Baradlay.\n\nThe inline/block specified size suggestion functions only handled a\nfixed, percentage/calc, or auto preferred size and hit\nASSERT_NOT_IMPLEMENTED_YET() for everything else. Style::PreferredSize\nalso has the intrinsic sizing keywords (min-content, max-content,\nfit-content) along with the non-standard intrinsic/min-intrinsic\nkeywords, and stretch/-webkit-fill-available that needs to be taken into\nconsideration\n\nhttps://www.w3.org/TR/css-grid-2/#specified-size-suggestion says the\nspecified size suggestion only exists when the item's preferred size in\nthe relevant axis is definite. The intrinsic sizing keywords all size the\nbox from its contents, so they are not definite and there is no specified\nsize suggestion for them. Returning std::nullopt makes the caller\ncontinue on to the transferred size suggestion or the content size\nsuggestion, which is what we want.\n\nstretch/-webkit-fill-available resolve to the stretch-fit size, so like a\npercentage they are only definite once the grid area size is known. When\nit is not known (during track sizing) there is no specified size\nsuggestion. We defer to implementing the logic for the stretch fit size\nin a follow up patch.\n\nCanonical link: https://commits.webkit.org/318216@main",
      "email": "sammy.gill@apple.com",
      "hash": "2d6f59ccf8235b27ed9a71e6684fb9b68a235fab",
      "subject": "[GFC] Items with content based size do not have a specified size suggestion"
    },
    "318217@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318217@main",
      "clUrl": "https://commits.webkit.org/318217@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320586\nrdar://183561750\n\nReviewed by Alexey Proskuryakov.\n\ngetAllResponseHeaders() lazily builds the sorted, serialized header block\nand caches it in m_allResponseHeaders, but nothing ever invalidated that\ncache. Reusing an XMLHttpRequest object -- calling open() and send() a\nsecond time -- kept returning the first response's header block for the\nrest of the object's lifetime, since the cache is only ever written and\nnever cleared.\n\nClear it in clearResponseBuffers(), next to m_responseCacheIsValid, so it\nis dropped both when open() resets the response state via clearResponse()\nand when the load is aborted.\n\nFirefox and Chrome both return the new response's headers here.\n\nThe test reuses one XMLHttpRequest object across two .asis resources, whose\nresponses are byte-exact, so the second getAllResponseHeaders() result can be\ncompared with assert_equals().\n\n* LayoutTests/imported/w3c/web-platform-tests/xhr/getallresponseheaders-after-reuse-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/xhr/getallresponseheaders-after-reuse.html: Added.\n* Source/WebCore/xml/XMLHttpRequest.cpp:\n(WebCore::XMLHttpRequest::clearResponseBuffers):\n\nCanonical link: https://commits.webkit.org/318217@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "eb7b1d25196e82c5d9f5410c8dd444c3b5d1a929",
      "subject": "XMLHttpRequest.getAllResponseHeaders() returns the previous response's headers when the object is reused"
    },
    "318218@main": {
      "author": "Yulun Wu",
      "avatar": "https://www.gravatar.com/avatar/9e34d6632f4d926cdf6fe8dce07f9cb7?d=identicon\u0026s=64",
      "cl": "318218@main",
      "clUrl": "https://commits.webkit.org/318218@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320608\n\u003crdar://183579852\u003e\n\nReviewed by Sammy Gill.\n\nExtract the space distribution loop out of distributeExtraSpaceToBaseSizes (CSS\nGrid §12.5.1, #extra-space) into a standalone distributeSpaceEquallyAmongTracks()\n\nThis will let us reuse this code in steps 2.3 and 2.4. This was extracted as a standalone\ninstead of an inline lambda to keep the body of distributeExtraSpaceToBaseSizes more compact\nand readable.\n\n* Source/WebCore/layout/formattingContexts/grid/TrackSizingAlgorithm.cpp:\n(WebCore::Layout::distributeSpaceEquallyAmongTracks):\n(WebCore::Layout::distributeExtraSpaceToBaseSizes):\n\nCanonical link: https://commits.webkit.org/318218@main",
      "email": "yulun_wu@apple.com",
      "hash": "728eb106c9041a94ca490f55ad68b744e3c854be",
      "subject": "[GFC] Extract the equal-distribution loop for track sizing space distribution"
    },
    "318219@main": {
      "author": "Devin Rousso",
      "avatar": "https://www.gravatar.com/avatar/c9e757d973342c773f107a94b70cb9cd?d=identicon\u0026s=64",
      "cl": "318219@main",
      "clUrl": "https://commits.webkit.org/318219@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320335\n\nReviewed by Qianlang Chen.\n\n* Source/WebInspectorUI/UserInterface/Protocol/Connection.js:\n(InspectorBackend.Connection.prototype._dispatchResponse):\n(InspectorBackend.Connection.prototype._dispatchEvent):\n(InspectorBackend.Connection.prototype._sendCommandToBackendWithCallback):\n(InspectorBackend.Connection.prototype._sendCommandToBackendExpectingPromise):\n(InspectorBackend.Connection.prototype._sendMessageToBackend):\n* Source/WebInspectorUI/UserInterface/Protocol/InspectorBackend.js:\n(InspectorBackendClass):\n(InspectorBackendClass.prototype.set dumpInspectorProtocolMessages):\n(InspectorBackendClass.prototype.set dumpInspectorTimeStats): Deleted.\n(InspectorBackendClass.prototype.get dumpInspectorTimeStats): Deleted.\n(InspectorBackendClass.prototype.set filterMultiplexingBackendInspectorProtocolMessages):\n(InspectorBackendClass.prototype.set customTracer): Deleted.\n(InspectorBackendClass.prototype.get activeTracers): Deleted.\n(InspectorBackendClass.prototype.logProtocolMessage): Added.\n(InspectorBackendClass.prototype._startOrStopAutomaticTracing): Deleted.\n* Source/WebInspectorUI/UserInterface/Protocol/LoggingProtocolTracer.js: Removed.\n* Source/WebInspectorUI/UserInterface/Protocol/ProtocolTracer.js: Removed.\nLog protocol messages directly from `InspectorBackend` without dispatching through tracer objects.\nContinue honoring `InspectorBackend.dumpInspectorProtocolMessages` and `InspectorBackend.filterMultiplexingBackendInspectorProtocolMessages`.\nRemove tracer timing collection.\n\n* Source/WebInspectorUI/UserInterface/Protocol/MessageDispatcher.js:\n(WI.dispatchNextQueuedMessageFromBackend):\n* Source/WebInspectorUI/UserInterface/Base/Setting.js:\n* Source/WebInspectorUI/UserInterface/Views/SettingsTabContentView.js:\n(WI.SettingsTabContentView.prototype._createDebugSettingsView):\nRemove the remaining protocol timing statistics setting, output, and UI.\n\n* Source/WebInspectorUI/UserInterface/Base/Main.js:\n(WI._contextMenuRequested):\n* Source/WebInspectorUI/UserInterface/Debug/CapturingProtocolTracer.js: Removed.\n* Source/WebInspectorUI/UserInterface/Debug/ProtocolTrace.js: Removed.\n* Source/WebInspectorUI/UserInterface/Main.html:\nRemove the protocol capture/export UI and its script resources.\n\n* Source/WebInspectorUI/UserInterface/Test.html:\n\nCanonical link: https://commits.webkit.org/318219@main",
      "email": "hi@devinrousso.com",
      "hash": "d30e723b328c65fd6cde169ff95c289381c41000",
      "subject": "Web Inspector: remove unused `WI.CapturingProtocolTracer`"
    },
    "318220@main": {
      "author": "Fujii Hironori",
      "avatar": "https://www.gravatar.com/avatar/ef99cb23f5e5d27977968ca097d9a85f?d=identicon\u0026s=64",
      "cl": "318220@main",
      "clUrl": "https://commits.webkit.org/318220@main",
      "description": "* LayoutTests/TestExpectations:\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/gtk/TestExpectations:\n* LayoutTests/platform/wpe-legacy-api/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318220@main",
      "email": "fujii@igalia.com",
      "hash": "d7477ec5c6059f0acb41cde8a122b96a7550ce59",
      "subject": "[GLib] Unreviewed layout test gardening"
    },
    "318221@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "318221@main",
      "clUrl": "https://commits.webkit.org/318221@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320581\nrdar://problem/183558439\n\nReviewed by Alan Baradlay.\n\nWhen an ImplicitGrid is created we first compute the dimensions of the\ngrid by looping over the placement of the grid items. This is then\npassed into the constructor and the grid keeps track of the initial\nnumber of implicit columns as a member.\n\nThis member is only used in one place: the public API on ImplicitGrid to\ndetermine how many rows the grid has. This structure ended up resulting\nin a crash when attempting to enable more content to run GFC due to\ncallers using rowsCount() and columnsCount(). Instead, what we can do is\njust make sure there is at least one row when we calculate the implicit\ngrid dimensions.\n\nCanonical link: https://commits.webkit.org/318221@main",
      "email": "sammy.gill@apple.com",
      "hash": "8c3c4867e491626b96a310a141826deb83854fc7",
      "subject": "[GFC] Make sure there is at least one row when ImplicitGrid is created."
    },
    "318222@main": {
      "author": "Sihui Liu",
      "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64",
      "cl": "318222@main",
      "clUrl": "https://commits.webkit.org/318222@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320598\nrdar://182837687\n\nReviewed by Chris Dumez.\n\nAborting one suspended-client transaction can recurse into aborting the next one, forming a chain like:\nhandleTransactions()\n  -\u003e abortInProgressTransactionsBlockedOnSuspendedClients()\n\t-\u003e transactionCompleted()\n\t  -\u003e handleTransactions()\n\t\t-\u003e abortInProgressTransactionsBlockedOnSuspendedClients()\n\t\t  -\u003e transactionCompleted()\n\t\t\t-\u003e ...\n\nEach transactionCompleted() call re-enters handleTransactions(), which re-enters\nabortInProgressTransactionsBlockedOnSuspendedClients() to abort the next transaction, before the previous call has\nreturned. With enough blocked transactions from a suspended client, this chain gets deep enough to overflow the stack.\n\nBreak the chain: have the abort loop pass ShouldStartRunnableWork::No to transactionCompleted() so it only updates the\ntransaction bookkeeping and does not call back into handleTransactions(). Once every transaction in the batch has been\naborted, run handleDatabaseOperations()/handleTransactions() a single time, instead of once per aborted transaction.\n\nAPI test: IndexedDB.AbortMultipleTransactionsOfSuspendedProcess\n\n* Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.cpp:\n(WebCore::IDBServer::UniqueIDBDatabase::transactionCompleted):\n(WebCore::IDBServer::UniqueIDBDatabase::abortInProgressTransactionsBlockedOnSuspendedClients):\n* Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/IndexedDBSuspendImminently.mm:\n(AbortMultipleTransactionsOfSuspendedProcess)):\n\nCanonical link: https://commits.webkit.org/318222@main",
      "email": "sihui_liu@apple.com",
      "hash": "674b378249dd2ac78888412e09e5f7b727153783",
      "subject": "REGRESSION(315609@main): Aborting many in-progress transactions of a suspended process can cause stack overflow"
    },
    "318223@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "318223@main",
      "clUrl": "https://commits.webkit.org/318223@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320296\nrdar://183230177\n\nReviewed by Abrar Rahman Protyasha.\n\nThe buttons now do things! Also simplify the existing PDF HUD button mechanism by unifying the paths.\n\n* Source/WebKit/SourcesCocoa.txt:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewInternal.h:\n* Source/WebKit/UIProcess/API/mac/WKWebViewMac.mm:\n(-[WKWebView _pdfZoomIn:frameIdentifier:]): Deleted.\n(-[WKWebView _pdfZoomOut:frameIdentifier:]): Deleted.\n(-[WKWebView _pdfOpenWithPreview:frameIdentifier:]): Deleted.\n(-[WKWebView _pdfSaveToPDF:frameIdentifier:]): Deleted.\n* Source/WebKit/UIProcess/PDF/WKAlternatePDFHUDView.h:\n* Source/WebKit/UIProcess/PDF/WKAlternatePDFHUDView.swift:\n* Source/WebKit/UIProcess/PDF/WKDefaultPDFHUDView.h:\n* Source/WebKit/UIProcess/PDF/WKDefaultPDFHUDView.mm: Removed.\n* Source/WebKit/UIProcess/PDF/WKDefaultPDFHUDView.swift:\n(WKDefaultPDFHUDView.webView):\n(WKDefaultPDFHUDView.zoomOutAction):\n(WKDefaultPDFHUDView.zoomInAction):\n(WKDefaultPDFHUDView.openInPreviewAction):\n(WKDefaultPDFHUDView.saveAction):\n(WKDefaultPDFHUDView.pluginIdentifier): Deleted.\n(WKDefaultPDFHUDView.frameIdentifier): Deleted.\n* Source/WebKit/UIProcess/PDF/WKPDFHUDView.h:\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::createPDFHUD):\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/318223@main",
      "email": "richard_robinson2@apple.com",
      "hash": "e84d51e6c5ca334ceff346d8000e8b829ed5ce63",
      "subject": "[PDF] Add button actions to the alternate HUD view"
    },
    "318224@main": {
      "author": "Aleksei Marchenko",
      "avatar": "https://www.gravatar.com/avatar/9a469093291c12531caccfcaa6ab73b1?d=identicon\u0026s=64",
      "cl": "318224@main",
      "clUrl": "https://commits.webkit.org/318224@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320567\nrdar://183551686\n\nReviewed by Per Arne Vollan.\n\nLogStream is annotated DispatchedFrom=WebContent, so its generated message\nconstructor asserts isInWebProcess(). Now that the Model process forwards\nos_log through the same relay, that fires on every message and all\nModelProcess layout tests fail in Debug.\n\nLet DispatchedFrom list several processes separated by '|' (attributes are\ncomma-separated), asserting any of them, and annotate LogStream\nDispatchedFrom=WebContent|Model. Single-process receivers are unaffected;\nMessageDescription holds one ProcessName per direction, so multiple is\ndescribed as Unknown.\n\n* Source/WebKit/Scripts/generate-derived-log-sources.py:\n(generate_messages_file):\n* Source/WebKit/Scripts/webkit/messages.py:\n(generate_dispatched_for_x):\n(process_name_enumerator):\n(generate_message_names_implementation):\n* Source/WebKit/Scripts/webkit/messages_unittest.py:\n* Source/WebKit/Scripts/webkit/parser.py:\n(parse_process_name_string):\n* Source/WebKit/Scripts/webkit/tests/MessageArgumentDescriptions.cpp:\n(IPC::jsValueForArguments):\n(IPC::messageArgumentDescriptions):\n* Source/WebKit/Scripts/webkit/tests/MessageNames.cpp:\n* Source/WebKit/Scripts/webkit/tests/MessageNames.h:\n* Source/WebKit/Scripts/webkit/tests/TestWithMultipleDispatchedFrom.messages.in: Added.\n* Source/WebKit/Scripts/webkit/tests/TestWithMultipleDispatchedFromMessageReceiver.cpp: Added.\n(WebKit::TestWithMultipleDispatchedFrom::didReceiveMessage):\n(IPC::jsValueForDecodedMessage\u003cMessageName::TestWithMultipleDispatchedFrom_AlwaysEnabled\u003e):\n* Source/WebKit/Scripts/webkit/tests/TestWithMultipleDispatchedFromMessages.h: Added.\n(Messages::TestWithMultipleDispatchedFrom::messageReceiverName):\n(Messages::TestWithMultipleDispatchedFrom::AlwaysEnabled::name):\n(Messages::TestWithMultipleDispatchedFrom::AlwaysEnabled::AlwaysEnabled):\n(Messages::TestWithMultipleDispatchedFrom::AlwaysEnabled::encode):\n\nCanonical link: https://commits.webkit.org/318224@main",
      "email": "aleksei@apple.com",
      "hash": "31b41abf4cbfec8ac7dd14484782de0025820a39",
      "subject": "REGRESSION(318004@main): All ModelProcess LayoutTests are failing in Debug"
    },
    "318225@main": {
      "author": "Alex Christensen",
      "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64",
      "cl": "318225@main",
      "clUrl": "https://commits.webkit.org/318225@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320602\nrdar://183573725\n\nReviewed by Chris Dumez.\n\nhttps://www.w3.org/TR/webtransport/#web-transport-connection-stats has this note:\nNOTE: Any unavailable stats will be absent from the WebTransportConnectionStats dictionary.\nThis was from https://github.com/w3c/webtransport/issues/691\nI'm planning to propose this test change to be in line with the spec.\n\nAlso, using the initialization time as the smoothed/min roundtrip time is not great,\nand it is not what is meant by those members, so remove it too.\n\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/stats.https.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/stats.https.any.js:\n(validate_rtt_stats):\n(promise_test.async t):\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/stats.https.any.serviceworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/stats.https.any.sharedworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/stats.https.any.worker-expected.txt:\n* Source/WebCore/Modules/webtransport/WebTransportConnectionStats.h:\n(WebCore::WebTransportConnectionStats::isolatedCopy const):\n* Source/WebCore/Modules/webtransport/WebTransportConnectionStats.idl:\n* Source/WebKit/NetworkProcess/webtransport/NetworkTransportSession.cpp:\n(WebKit::NetworkTransportSession::getStats):\n(WebKit::NetworkTransportSession::completeRequestsAfterInitialization):\n* Source/WebKit/NetworkProcess/webtransport/NetworkTransportSession.h:\n* Source/WebKit/NetworkProcess/webtransport/WebTransport.serialization.in:\n\nCanonical link: https://commits.webkit.org/318225@main",
      "email": "achristensen@apple.com",
      "hash": "f6a71feeecfb5f6a9faf95762390a46974a0b247",
      "subject": "Remove unsupported stats from WebTransportConnectionStats"
    },
    "318226@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "318226@main",
      "clUrl": "https://commits.webkit.org/318226@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320308\nrdar://183241311\n\nReviewed by Abrar Rahman Protyasha.\n\nUse the `toolbar` control group style which looks a bit nicer.\n\n* Source/WebKit/UIProcess/PDF/WKAlternatePDFHUDView.swift:\n(Controls.body):\n\nCanonical link: https://commits.webkit.org/318226@main",
      "email": "richard_robinson2@apple.com",
      "hash": "51de489ad2505ec19c124ba34121c0de920b7e39",
      "subject": "[PDF] Update the control group design of the alternate HUD view"
    },
    "318227@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "318227@main",
      "clUrl": "https://commits.webkit.org/318227@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320311\nrdar://183246201\n\nReviewed by Abrar Rahman Protyasha.\n\nMake the controls fade away when they're not being hovered.\n\n* Source/WebKit/UIProcess/PDF/WKAlternatePDFHUDView.swift:\n(Controls.isVisible):\n(Controls.body):\n\nCanonical link: https://commits.webkit.org/318227@main",
      "email": "richard_robinson2@apple.com",
      "hash": "e02cba30b578dd75b0d12792795ad3a74441953e",
      "subject": "[PDF] Add fade animation support to alternate HUD view"
    },
    "318228@main": {
      "author": "Philippe Normand",
      "avatar": "https://www.gravatar.com/avatar/eef27203750af3510263cc29af21a16e?d=identicon\u0026s=64",
      "cl": "318228@main",
      "clUrl": "https://commits.webkit.org/318228@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320561\n\nReviewed by Carlos Garcia Campos.\n\nAdd a moduledir variable, like in the wpe-platform-2.0.pc file.\n\n* Source/WebKit/WPEPlatform/wpe-platform-uninstalled.pc.in:\n\nCanonical link: https://commits.webkit.org/318228@main",
      "email": "philn@igalia.com",
      "hash": "4e9da8cb6dbbaa676fe47ece053f82682ae5be24",
      "subject": "[WPE] Missing moduledir in wpe-platform-uninstalled.pc file"
    },
    "318229@main": {
      "author": "Marcos Caceres",
      "avatar": "https://www.gravatar.com/avatar/d31c9c6a3b0af558a2945682020e5b90?d=identicon\u0026s=64",
      "cl": "318229@main",
      "clUrl": "https://commits.webkit.org/318229@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319878\nrdar://182780988\n\nReviewed by Pascoe and Abrar Rahman Protyasha.\n\nWebPageProxy recorded the UI-process user-activation timestamp\n(lastActivationTimestamp) only inside the send*Event functions. On iOS a\ntap on a page with no touch event listeners takes the NotTracking early\nreturn in handlePreventableTouchEvent and never reaches\nsendPreventableTouchEvent, so the UI process never recorded the\nactivation. showDigitalCredentialsChooser, which independently verifies a\nrecent user activation, then rejected the request with NotAllowedError\neven for a genuine tap.\n\nRecord the activation at the UI-process input receipt points\n(handleMouseEvent, handleKeyboardEvent, handlePreventableTouchEvent,\nhandleUnpreventableTouchEvent) rather than in the send*Event functions.\nBecause the send*Event functions are re-entered when forwarding an event\nto a site-isolated subframe, this also stops a single gesture from\nre-stamping the timestamp and authorizing more than one chooser.\n\nSpeculative fix: WebKitTestRunner's synthesized taps do not exercise the\nNotTracking gesture path that a real tap takes, so a deterministic layout\ntest was not possible. Verified manually in MobileSafari on iOS 27: get()\nis rejected before the change and proceeds after.\n\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::sendMouseEvent):\n(WebKit::WebPageProxy::recordUIProcessUserActivation):\n(WebKit::WebPageProxy::handleMouseEvent):\n(WebKit::WebPageProxy::sendKeyEvent):\n(WebKit::WebPageProxy::handleKeyboardEvent):\n(WebKit::WebPageProxy::sendPreventableTouchEvent):\n(WebKit::WebPageProxy::handlePreventableTouchEvent):\n(WebKit::WebPageProxy::sendUnpreventableTouchEvent):\n(WebKit::WebPageProxy::handleUnpreventableTouchEvent):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n\nCanonical link: https://commits.webkit.org/318229@main",
      "email": "marcosc@apple.com",
      "hash": "8a4ec0dfb94b3328822b688329c223e7a95683ac",
      "subject": "[iOS] Digital Credentials get() rejects with \"requires transient user activation\" for a tap on a page with no touch event listeners"
    },
    "318230@main": {
      "author": "Jean-Yves Avenard",
      "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64",
      "cl": "318230@main",
      "clUrl": "https://commits.webkit.org/318230@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320547\nrdar://183071272\n\nReviewed by Andy Estes.\n\n311380@main made a media player release its video renderer once the element was no\nlonger visible, either because it had been scrolled far away from the viewport\n(fixing window server jetsams on infinite scrolling video websites) or because the\npage hosting it had become non-visible.\n\nSome clients keep displaying the video layer they host after hiding their web view.\nFor those, neither the page's visibility nor the element's position in the viewport\nindicate whether the video is on screen: the renderer is released while the client\nis still showing it, and the video turns black while audio keeps playing.\n\nAdd a MediaPlayerLoadOptions member, set from a new site-specific quirk, that\nselectively restores the pre-311380@main behaviour when set. Each of the three\nplaces where 311380@main made visibility release the renderer is reverted\nindividually:\n\n- HTMLVideoElement::computeAcceleratedRenderingStateAndUpdateMediaPlayer() ignores\nthe viewport intersection term that commit added to `canBeAccelerated`.\n- MediaPlayerPrivateMediaSourceAVFObjC::updateRendererVisibility() no longer calls\nacceleratedRenderingStateChanged(), which that commit added, and\nacceleratedRenderingStateChanged() forwards MediaPlayer::renderingCanBeAccelerated()\nunchanged rather than combining it with the page's and the viewport's visibility.\n- MediaPlayerPrivateAVFoundationObjC::shouldAttachLayerToPlayer(), added by that\ncommit, keeps the video layer attached to the AVPlayer as it was before.\n\nThe quirk is bound to\nSDKAlignedBehavior::NoMediaLayerTeardownOnPageVisibilityChangeQuirk so that it stops\napplying once the application is rebuilt against a newer SDK, giving it a chance to\nadopt a supported presentation mode in the meantime. The default behaviour, and\ntherefore the memory optimisation 311380@main introduced, is unchanged for every\nother client.\n\n* Source/WTF/wtf/cocoa/RuntimeApplicationChecksCocoa.h:\n* Source/WTF/wtf/cocoa/RuntimeApplicationChecksCocoa.mm:\n(WTF::IOSApplication::isMoonPlayer):\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::loadResource): Set the new load option.\n* Source/WebCore/html/HTMLVideoElement.cpp:\n(WebCore::HTMLVideoElement::computeAcceleratedRenderingStateAndUpdateMediaPlayer):\n* Source/WebCore/page/Quirks.cpp:\n(WebCore::Quirks::shouldDisableMediaLayerTeardownOnPageVisibilityChangeQuirk const):\n(WebCore::Quirks::determineRelevantQuirks):\n* Source/WebCore/page/Quirks.h:\n* Source/WebCore/page/QuirksData.h:\n* Source/WebCore/platform/graphics/MediaPlayer.h:\n* Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:\n(WebCore::MediaPlayerPrivateAVFoundation::load): Keep the load option, the base class\notherwise discards it.\n* Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:\n(WebCore::MediaPlayerPrivateAVFoundationObjC::shouldAttachLayerToPlayer):\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:\n(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::shouldTeardownOnVisibilityChange const):\n(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::updateRendererVisibility):\n(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::acceleratedRenderingStateChanged):\n* Source/WebKit/Shared/WebCoreArgumentCodersMedia.serialization.in:\n\nCanonical link: https://commits.webkit.org/318230@main",
      "email": "jya@apple.com",
      "hash": "6cb190d2d3d880bbca43f0e839e9fa46aeeae914",
      "subject": "(311380@main) [Moon Player: AI-Enhanced 3D] Video playback goes black but audio continues when playing YouTube videos in full screen"
    },
    "318231@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "318231@main",
      "clUrl": "https://commits.webkit.org/318231@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320530\n\nReviewed by Keith Miller.\n\nThe LLInt's op_enter unconditionally calls slow_path_enter on every\nfunction entry, paying a C++ call for what is usually just one store of\nthe callee's scope. 280547@main inlined this hot part in the Baseline\nJIT, but the LLInt never got the same treatment, so interpreted calls\n(startup, module initialization, cold code) still take the slow path.\n\nThis patch inlines the scope store in LowLevelInterpreter64.asm,\nfalling back to the slow path when the CodeBlock needs a write barrier\n(same dynamic-threshold check as the Baseline JIT's branchIfBarriered)\nor could be tainted. To make the couldBeTainted bit testable from asm,\nthe m_numberOfArgumentsToSkip / m_couldBeTainted bitfield pair becomes\na named union word whose sign bit is the taint bit, keeping\nsizeof(CodeBlock) unchanged.\n\nMicrobenchmark results with useJIT=false:\n\n                                                  Baseline                  Patched\n\narrowfunction-call-in-class-method            13.2319+-0.8860     ^     11.8726+-0.0429        ^ definitely 1.1145x faster\narrowfunction-call-in-function                41.5227+-0.6378     ^     36.7882+-1.0128        ^ definitely 1.1287x faster\ncall-or-not-call                             663.3894+-64.3912         608.4128+-13.9092         might be 1.0904x faster\nsimple-activation-demo                       106.1805+-3.7712     ?    109.7916+-6.0971        ? might be 1.0340x slower\nbound-function-call                           31.7472+-1.4550     ^     27.2062+-0.4002        ^ definitely 1.1669x faster\nfunction-call                                 45.8869+-3.1223     ^     38.7891+-1.7009        ^ definitely 1.1830x faster\narrowfunction-call                            35.7700+-1.9583     ^     28.9808+-0.8511        ^ definitely 1.2343x faster\narrowfunction-call-in-class-constructor       85.9472+-5.6473     ^     75.2668+-4.0816        ^ definitely 1.1419x faster\nawait-async-function-call-chain               56.1613+-2.0973           55.8413+-10.8399\ndfg-internal-function-call                     0.6401+-0.0274            0.6014+-0.0254          might be 1.0642x faster\n\n* Source/JavaScriptCore/bytecode/CodeBlock.cpp:\n(JSC::CodeBlock::CodeBlock):\n* Source/JavaScriptCore/bytecode/CodeBlock.h:\n* Source/JavaScriptCore/llint/LowLevelInterpreter64.asm:\n\nCanonical link: https://commits.webkit.org/318231@main",
      "email": "sosuke@bun.sh",
      "hash": "e759fa9dd06385bb3cdd8e6150c16322df0f1feb",
      "subject": "[JSC] Inline hot part of `op_enter` in LLInt"
    },
    "318232@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "318232@main",
      "clUrl": "https://commits.webkit.org/318232@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320632\nrdar://183595852\n\nReviewed by Charlie Wolfe.\n\nWKDefaultPDFHUDView.mm file is removed. We should drop it from\nPlatformCocoa.cmake.\n\n* Source/WebKit/PlatformCocoa.cmake:\n\nCanonical link: https://commits.webkit.org/318232@main",
      "email": "ysuzuki@apple.com",
      "hash": "e04c2e31abebc73a5b6b68037d4d71c3cb0d6bdc",
      "subject": "[CMake] Remove WKDefaultPDFHUDView.mm"
    },
    "318233@main": {
      "author": "Kiet Ho",
      "avatar": "https://www.gravatar.com/avatar/d9058b37006dce1f55f91b8ccc82f9a3?d=identicon\u0026s=64",
      "cl": "318233@main",
      "clUrl": "https://commits.webkit.org/318233@main",
      "description": "rdar://182249814\nhttps://bugs.webkit.org/show_bug.cgi?id=319429\n\nReviewed by Tim Nguyen.\n\nPer spec [1], @container accepts a \"container query\", which is a list of\n\"container conditions\", at least one of which must evaluate to true for\nthe @container rule to apply. WebKit currently only supports one condition,\nso this patch implements support for a list of conditions.\n\nNOTE: WebCore used to call the \"container condition\" in the spec as\n\"container query\" (e.g ContainerQuery struct). This patch renames all\nmentions of \"container query\" to \"container condition\", and make\n\"container query\" mean the list of container conditions.\n\n[1]: https://drafts.csswg.org/css-conditional-5/#container-rule\n\nTests: imported/w3c/web-platform-tests/css/css-conditional/container-queries/at-container-parsing.html\n       imported/w3c/web-platform-tests/css/css-conditional/container-queries/at-container-serialization.html\n       imported/w3c/web-platform-tests/css/css-conditional/container-queries/multiple-size-containers-comma-separated-queries.html\n       imported/w3c/web-platform-tests/css/css-conditional/container-queries/multiple-style-containers-comma-separated-queries-expected.html\n       inspector/css/setGroupingHeaderText.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/at-container-parsing-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/at-container-serialization-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/multiple-size-containers-comma-separated-queries-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/multiple-style-containers-comma-separated-queries-expected.txt:\n    - Test progression.\n\n* LayoutTests/inspector/css/setGroupingHeaderText-expected.txt:\n* LayoutTests/inspector/css/setGroupingHeaderText.html:\n    - This test sets @container condition to a list of valid/invalid conditions,\n      and check whether the condition is correctly accepted/rejected. Some invalid\n      conditions tested (e.g \"screen, (max-width: 9999px)\") are now valid as we\n      support comma-separated list now, so mark them as valid in the test.\n\n* Source/WebCore/css/CSSContainerRule.cpp:\n(WebCore::CSSContainerRule::cssText const):\n    - Re-use the condition serialization logic in conditionText()\n\n(WebCore::CSSContainerRule::containerName const):\n(WebCore::CSSContainerRule::containerQuery const):\n    - Per spec, change these two methods to return an empty string if more than\n      one conditions are specified.\n\n* Source/WebCore/css/parser/CSSParser.cpp:\n(WebCore::CSSParser::consumeContainerRule):\n    - Don't need to check that the prelude is entirely consumed, that's done in\n      ContainerQueryParser::consumeContainerQuery.\n\n* Source/WebCore/css/query/ContainerQuery.cpp:\n(WebCore::CQ::serialize):\n* Source/WebCore/css/query/ContainerQuery.h:\n    - Rename ContainerQuery to ContainerCondition, as it represents a \"container condition\"\n    - Add a ContainerQuery, which is a Vector of ContainerCondition.\n    - Add a serialize() method method to serialize the new ContainerQuery.\n\n* Source/WebCore/css/query/ContainerQueryParser.cpp:\n(WebCore::CQ::ContainerQueryParser::consumeContainerQuery):\n(WebCore::CQ::ContainerQueryParser::consumeContainerCondition):\n* Source/WebCore/css/query/ContainerQueryParser.h:\n    - Rename consumeContainerQuery to consumeContainerCondition\n    - Add consumeContainerQuery that uses consumeContainerCondition to parse the\n      container query.\n\n* Source/WebCore/css/query/GenericMediaQueryParser.h:\n(WebCore::MQ::GenericMediaQueryParser\u003cConcreteParser\u003e::consumeCondition):\n    - Tweak the method to not reject the parsed condition if there're still tokens\n      to be consumed. ContainerQueryParser::consumeContainerQuery can then use this\n      to repeatedly consume a comma-separated list of conditions until the token\n      range is exhausted.\n\n(WebCore::MQ::GenericMediaQueryParser\u003cConcreteParser\u003e::consumeQueryInParens):\n    - Try to consume \u003cquery-in-parens\u003e as feature first before consuming it as\n      a recursive condition.\n\n* Source/WebCore/style/ContainerQueryEvaluator.cpp:\n(WebCore::Style::ContainerQueryEvaluator::evaluate const):\n    - Change this method to evaluate a container query. A container query is true\n      if any container conditions is true.\n\n(WebCore::Style::ContainerQueryEvaluator::featureEvaluationContextForCondition const):\n(WebCore::Style::ContainerQueryEvaluator::featureEvaluationContextForQuery const): Deleted.\n* Source/WebCore/style/ContainerQueryEvaluator.h:\n    - Rename featureEvaluationContextForQuery to featureEvaluationContextForCondition.\n\n* Source/WebCore/style/StyleScopeRuleSets.cpp:\n(WebCore::Style::ScopeRuleSets::customPropertyNamesInStyleContainerQueries const):\n    - Tweak the method to collect custom property names from all conditions\n      in the container query.\n\nCanonical link: https://commits.webkit.org/318233@main",
      "email": "kiet.ho@apple.com",
      "hash": "aa31f29c3a430559a383f708cb40164926265087",
      "subject": "[css-conditional-5] @container: support comma-separated list of conditions"
    },
    "318234@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "318234@main",
      "clUrl": "https://commits.webkit.org/318234@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320611\n\nReviewed by Yusuke Suzuki.\n\n    /^a|(?!^)b/.exec(\"b\") // [\"b\"], should be null\n\noptimizeBOL()'s loop copy drops subterms that can only match at the start of\nthe input, since the onceThrough copy already covers position 0. Inside a\nnegative lookahead this flips: (?!^) fails at the start of the input and\nsucceeds everywhere else, so after 317981@main filtered out its content the\nwhole term was dropped and the loop copy /b/ falsely matched at position 0.\ncopyTerm() now copies the contents of an inverted assertion unfiltered.\n\nTest: JSTests/stress/regexp-negative-assertion-with-bol-is-not-dropped.js\n\n* JSTests/stress/regexp-negative-assertion-with-bol-is-not-dropped.js: Added.\n(shouldBe):\n(check):\n(step):\n* Source/JavaScriptCore/yarr/YarrPattern.cpp:\n(JSC::Yarr::YarrPatternConstructor::copyTerm):\n\nCanonical link: https://commits.webkit.org/318234@main",
      "email": "sosuke@bun.sh",
      "hash": "46a4b17efbe9a1b9fe05a4ca8b6452650b001b51",
      "subject": "[YARR] Do not filter the contents of a negative lookahead in `optimizeBOL`"
    },
    "318235@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318235@main",
      "clUrl": "https://commits.webkit.org/318235@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320618\nrdar://183587223\n\nReviewed by Chris Dumez.\n\nThe Match::Set arm of the switch in constructFragmentsInternal() is byte-identical\nto the Match::Exact/Match::Hyphen arm next to it, ever since bug 141880 moved the\ncase-sensitivity decision into attributeSelectorCaseSensitivity(), which\nspecial-cases Match::Set itself. Fold Set into the existing label group; it still\nenters below the value().isEmpty() check, which matters because [attr] carries no\nvalue.\n\nNo change in behavior.\n\n* Source/WebCore/cssjit/SelectorCompiler.cpp:\n(WebCore::SelectorCompiler::constructFragmentsInternal):\n\nCanonical link: https://commits.webkit.org/318235@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "55ea3570274437858f12647c3678ae68207e07e2",
      "subject": "[CSS] Deduplicate the identical CSSSelector::Match::Set case in SelectorCompiler"
    },
    "318236@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "318236@main",
      "clUrl": "https://commits.webkit.org/318236@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320436\nrdar://problem/183400867\n\nReviewed by Alex Christensen.\n\nTo implement backpressure, we do the following:\n- ReadableStreamToSharedBufferSink is taking an optional max buffered size parameter. When reported size is above a threshold, it stops reading the readable stream.\n- ReadableStreamToSharedBufferSink is registering a drained buffer to the PendingStreamState it is sharing with WebResourceLoader. Whenever it sees that more data is needed, it restarts reading.\n- WebResourceLoader is getting data from ReadableStreamToSharedBufferSink via its PendingStreamState. After having sent some data (256ko), it waits for network process to notify whether it should send more. Network process does notify via two mechanisms:\n  1. Either service worker is reading the body and upload streaming is forwarded to service worker. In that case, backpressure is removed and all data goes to the service worker.\n  2. Or the upload is going to the network via NetworkResourceLoader/FormDataStreamCFNet, in which case the network process is sending back to web process the bytes that have been sent.\n\nCovered by newly added test.\n\n* LayoutTests/http/wpt/service-workers/upload-stream-backpressure-worker.js: Added.\n(event.url.searchParams):\n(event.event.respondWith.async await):\n(event.event.respondWith):\n* LayoutTests/http/wpt/service-workers/upload-stream-backpressure.https-expected.txt: Added.\n* LayoutTests/http/wpt/service-workers/upload-stream-backpressure.https.html: Added.\n* Source/WebCore/Modules/fetch/FetchBody.cpp:\n(WebCore::FetchBody::startPendingStreamUpload):\n* Source/WebCore/Modules/streams/ReadableStreamToSharedBufferSink.cpp:\n(WebCore::ReadableStreamToSharedBufferSink::ReadableStreamToSharedBufferSink):\n(WebCore::ReadableStreamToSharedBufferSink::enqueue):\n(WebCore::ReadableStreamToSharedBufferSink::resumeReading):\n(WebCore::ReadableStreamToSharedBufferSink::scheduleKeepReading):\n* Source/WebCore/Modules/streams/ReadableStreamToSharedBufferSink.h:\n* Source/WebCore/platform/network/PendingStreamState.cpp:\n(WebCore::PendingStreamState::appendData):\n(WebCore::PendingStreamState::endStream):\n(WebCore::PendingStreamState::errorStream):\n(WebCore::PendingStreamState::setDataAvailableHandler):\n(WebCore::PendingStreamState::setQueueDrainedHandler):\n(WebCore::PendingStreamState::read):\n(WebCore::PendingStreamState::takeNextChunk):\n* Source/WebCore/platform/network/PendingStreamState.h:\n(WebCore::PendingStreamState::WTF_GUARDED_BY_LOCK):\n* Source/WebCore/platform/network/cf/FormDataStreamCFNet.mm:\n* Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerToContextConnection.cpp:\n(WebKit::WebSWServerToContextConnection::startPendingStreamUploadForwarding):\n* Source/WebKit/WebProcess/Network/WebResourceLoader.cpp:\n(WebKit::WebResourceLoader::initPendingStreamState):\n(WebKit::WebResourceLoader::drainPendingStreamIfPossible):\n(WebKit::WebResourceLoader::serviceWorkerPendingStreamForwardingStarted):\n(WebKit::WebResourceLoader::didSendData):\n* Source/WebKit/WebProcess/Network/WebResourceLoader.h:\n* Source/WebKit/WebProcess/Network/WebResourceLoader.messages.in:\n\nCanonical link: https://commits.webkit.org/318236@main",
      "email": "youenn@apple.com",
      "hash": "5e1804eb373e303a701daf25b01d0133c157542b",
      "subject": "Implement fetch upload backpressure"
    },
    "318237@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "318237@main",
      "clUrl": "https://commits.webkit.org/318237@main",
      "description": "rdar://181909962\nhttps://bugs.webkit.org/show_bug.cgi?id=318556\n\nReviewed by Chris Dumez.\n\nWhen doing soft-update, the networking process is responsible to generate the update requests.\nIt was missing Sec-Fetch headers, that are typically added by web process.\n\nWe add Sec-Fetch headers and make sure to cover the 3 different cases:\n- The main script\n- Imported scripts\n- Module loaded scripts.\n\nWe add a WPT test, which is passing in Chrome.\nFirefox is also populating those headers but is not consistently setting Sec-Fetch-Dest to service worker.\n\nTest: imported/w3c/web-platform-tests/service-workers/service-worker/soft-update-fetch-metadata.https.html\n\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/resources/soft-update-fetch-metadata.py: Added.\n(main):\n(main.header_value):\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/soft-update-fetch-metadata.https-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/soft-update-fetch-metadata.https.html: Added.\n* Source/WebCore/workers/service/server/SWServer.cpp:\n(WebCore::addFetchMetadataHeaders):\n(WebCore::SWServer::createScriptRequest):\n(WebCore::SWServer::startScriptFetch):\n(WebCore::SWServer::refreshImportedScripts):\n* Source/WebCore/workers/service/server/SWServer.h:\n\nCanonical link: https://commits.webkit.org/318237@main",
      "email": "youenn@apple.com",
      "hash": "d526f33ee5d447ab59659024d36f1170b377e97f",
      "subject": "Service Worker request is missing sec-fetch-dest"
    },
    "318238@main": {
      "author": "Przemyslaw Gorszkowski",
      "avatar": "https://www.gravatar.com/avatar/e543ed682c6f99c866b01ca9bcbab360?d=identicon\u0026s=64",
      "cl": "318238@main",
      "clUrl": "https://commits.webkit.org/318238@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320569\n\nUnreviewed test gardening.\n\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318238@main",
      "email": "pgorszkowski@igalia.com",
      "hash": "cdb31ac23ab4eb139fb20d2f7a66133e6ae3d450",
      "subject": "[WPE] webrtc/vp8-then-h264.html is a rare flaky crash"
    },
    "318239@main": {
      "author": "Darryl Parkinson",
      "avatar": "https://www.gravatar.com/avatar/0ccfac602a7a33ff85e51e56ce49df0b?d=identicon\u0026s=64",
      "cl": "318239@main",
      "clUrl": "https://commits.webkit.org/318239@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320557\nrdar://180217073\n\nReviewed by Qianlang Chen.\n\ndidCommitProvisionalPage() removes every frame target belonging to the page. A subframe that still\nhad a pending ProvisionalFrameProxy can commit after that, because the suspended page keeps both the\nsubframe and the RemotePageProxy that routes its DidCommitLoadForFrame, so didCommitProvisionalFrame()\nfinds no target for the frame and dereferences a null CheckedPtr.\n\nGuard the target notifications on the target still being present, while still running the\ninstrumentation migration that follows so per-process registrations stay paired. Also skip taking the\nold target when both identifiers match, which happens when a frame commits into the process it was\nalready provisional in and would otherwise destroy the target just committed\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n\n* Source/WebKit/UIProcess/Inspector/WebPageInspectorController.cpp:\n(WebKit::WebPageInspectorController::didCommitProvisionalFrame):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, ProvisionalSubframeCommitAfterMainFrameSwapDoesNotCrash)):\n\nCanonical link: https://commits.webkit.org/318239@main",
      "email": "d_parkinson@apple.com",
      "hash": "f079bfc262594de4bbabad95f2478951a95dd07f",
      "subject": "[Site Isolation] Web Inspector: UI process crash in didCommitProvisionalFrame when a provisional subframe commits after a main-frame swap"
    },
    "318240@main": {
      "author": "Lily Spiniolas",
      "avatar": "https://www.gravatar.com/avatar/b65cfeb51301399bd50e338bb2d7613e?d=identicon\u0026s=64",
      "cl": "318240@main",
      "clUrl": "https://commits.webkit.org/318240@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320537\nrdar://183493772\n\nReviewed by Tim Nguyen, Megan Gardner, and Abrar Rahman Protyasha.\n\nAdd a WIP neutralizing color filter.\n\n* Source/WebCore/style/values/filter-effects/StyleAppleColorFilter.h:\n\nCanonical link: https://commits.webkit.org/318240@main",
      "email": "lily_spiniolas@apple.com",
      "hash": "6c3817d4322ae8c7d5a953d8acbb5c393ff0d89b",
      "subject": "[AX] Add neutralizing color filter"
    },
    "318241@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318241@main",
      "clUrl": "https://commits.webkit.org/318241@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320617\nrdar://183587043\n\nReviewed by Chris Dumez.\n\nXMLHttpRequest::abort() only called clearResponseBuffers(), which clears the\nresponse body, decoder and cached document but leaves m_response -- and\ntherefore the response URL, status, status message and header list -- intact.\n\nstatus(), statusText(), getResponseHeader() and getAllResponseHeaders() all\nhappen to hide the stale response because they bail out early when m_error is\nset, but responseURL() has no such guard and reads m_response.url() directly.\nSo after abort() we reported status 0, empty statusText and empty headers,\nwhile responseURL kept handing back the URL of the request that was just\naborted, in all three abort states (HEADERS_RECEIVED, LOADING and DONE).\n\nPer https://xhr.spec.whatwg.org/#the-abort()-method, both the request error\nsteps (step 2) and step 3 set the response to a network error, and a network\nerror's URL is null, so responseURL must return the empty string. Call\nclearResponse() instead, which resets m_response as well as the buffers.\n\nFirefox and Chrome both return the empty string here.\n\nTests: imported/w3c/web-platform-tests/xhr/responseurl-after-abort.any.html\n       imported/w3c/web-platform-tests/xhr/responseurl-after-abort.any.worker.html\n\n* LayoutTests/imported/w3c/web-platform-tests/xhr/responseurl-after-abort.any-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/xhr/responseurl-after-abort.any.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/xhr/responseurl-after-abort.any.js: Added.\n(assertNetworkError):\n(async_test.test.client.onreadystatechange.test.step_func):\n(async_test.test.client.onloadend.test.step_func_done):\n(async_test.test.client.onload.test.step_func_done):\n(test):\n* LayoutTests/imported/w3c/web-platform-tests/xhr/responseurl-after-abort.any.worker-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/xhr/responseurl-after-abort.any.worker.html: Added.\n* Source/WebCore/xml/XMLHttpRequest.cpp:\n(WebCore::XMLHttpRequest::abort):\n\nCanonical link: https://commits.webkit.org/318241@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "f8eec063afd9a4a16b29d2a0c800a1de7e1034a5",
      "subject": "XMLHttpRequest.responseURL still returns the aborted request's URL after abort()"
    },
    "318242@main": {
      "author": "Etienne Segonzac",
      "avatar": "https://www.gravatar.com/avatar/3566820d0ba7e035bc440dc736c17f0c?d=identicon\u0026s=64",
      "cl": "318242@main",
      "clUrl": "https://commits.webkit.org/318242@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320112\n\u003crdar://182292360\u003e\n\nReviewed by Mike Wyrzykowski.\n\nWhen a model is nested inside of a `spatial: portal` element, delegate\nits loading / rendering to the portal.\nWhen a Spatial Portal is nested inside of a Spatial Portal it's a noop.\n\nTests: spatial-css/spatial-portal-layers.html\n       spatial-css/spatial-portal-model-insert-remove.html\n       spatial-css/spatial-portal-model-move.html\n       spatial-css/spatial-portal-nested-portals.html\n       spatial-css/spatial-portal-scroll-to-load.html\n       spatial-css/spatial-portal-single-model.html\n       spatial-css/spatial-portal-nesting-dynamic.html\n       spatial-css/spatial-portal-without-box.html\n       Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SpatialPortal.mm\n\n* LayoutTests/spatial-css/spatial-portal-layers-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-layers.html: Added.\n* LayoutTests/spatial-css/spatial-portal-model-insert-remove-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-model-insert-remove.html: Added.\n* LayoutTests/spatial-css/spatial-portal-model-move-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-model-move.html: Added.\n* LayoutTests/spatial-css/spatial-portal-nested-portals-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-nested-portals.html: Added.\n* LayoutTests/spatial-css/spatial-portal-scroll-to-load-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-scroll-to-load.html: Added.\n* LayoutTests/spatial-css/spatial-portal-single-model-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-single-model.html: Added.\n* LayoutTests/spatial-css/spatial-portal-nesting-dynamic-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-nesting-dynamic.html: Added.\n* LayoutTests/spatial-css/spatial-portal-without-box-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-without-box.html: Added.\nComplete the test suite to cover:\n- the basic single model scenario\n- the resulting CALayer tree\n- dynamic insertions, removal and move between portals\n- lazy loading while inside of a portal\n- nested portals and dynamic updates\n\n* Source/WebCore/Modules/model-element/HTMLModelElement.cpp:\n(WebCore::HTMLModelElement::createElementRenderer):\n(WebCore::HTMLModelElement::rendererIsNeeded):\n(WebCore::HTMLModelElement::findPortalAncestor const):\n(WebCore::HTMLModelElement::isInsidePortal const):\n(WebCore::HTMLModelElement::findPortalController const):\n(WebCore::HTMLModelElement::updateSpatialPortalController):\n(WebCore::HTMLModelElement::didFinishLoadingInsidePortal):\n(WebCore::HTMLModelElement::didFailLoadingInsidePortal):\n(WebCore::HTMLModelElement::spatialPortalContextDidChange):\n(WebCore::HTMLModelElement::isVisible const):\n(WebCore::HTMLModelElement::modelDidChange):\n(WebCore::HTMLModelElement::insertionSteps):\n(WebCore::HTMLModelElement::removingSteps):\n(WebCore::HTMLModelElement::configureGraphicsLayer):\n* Source/WebCore/Modules/model-element/HTMLModelElement.h:\nDetect if a model element is nested inside of a Spatial Portal. In that\ncase it doesn't get a Renderer and delegates to the\nSpatialPortalController.\n\n* Source/WebCore/Modules/model-element/ModelPlayerGraphicsLayerConfiguration.h:\n* Source/WebCore/Modules/model-element/SpatialPortalController.cpp:\n(WebCore::SpatialPortalController::SpatialPortalController):\n(WebCore::SpatialPortalController::~SpatialPortalController):\n(WebCore::SpatialPortalController::unregisterChildModel):\n(WebCore::SpatialPortalController::registerChildModel):\n(WebCore::SpatialPortalController::childModelDidChange):\n(WebCore::SpatialPortalController::loadChildModelIfReady):\n(WebCore::SpatialPortalController::observePortalVisibility):\n(WebCore::SpatialPortalController::viewportIntersectionChanged):\n(WebCore::SpatialPortalController::ensureModelPlayer):\n(WebCore::SpatialPortalController::unloadModel):\n(WebCore::SpatialPortalController::portalContentSize const):\n(WebCore::SpatialPortalController::configureGraphicsLayer):\n(WebCore::SpatialPortalController::sizeMayHaveChanged):\n(WebCore::SpatialPortalController::modelDidFinishLoading):\n(WebCore::SpatialPortalController::modelDidFailLoading):\n(WebCore::SpatialPortalController::modelDidUnload):\n(WebCore::SpatialPortalController::modelDidUpdate):\n(WebCore::SpatialPortalController::reconfigurePortalLayer):\n(WebCore::SpatialPortalController::portalGraphicsLayer const):\n(WebCore::SpatialPortalController::isPortalVisible const):\n(WebCore::SpatialPortalController::logWarning):\n* Source/WebCore/Modules/model-element/SpatialPortalController.h:\n(WebCore::SpatialPortalController::modelPlayer const):\n(WebCore::SpatialPortalController::numberOfHostedModels const):\n* Source/WebCore/dom/Element.cpp:\n(WebCore::Element::ensureSpatialPortalController):\n(WebCore::Element::establishesSpatialPortal const):\n* Source/WebCore/dom/Element.h:\n* Source/WebCore/platform/graphics/ModelContext.cpp:\n(WebCore::ModelContext::create):\n(WebCore::ModelContext::ModelContext):\n* Source/WebCore/platform/graphics/ModelContext.h:\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Source/WebKit/UIProcess/Model/PortalPresentationManagerProxy.mm:\n(WebKit::PortalPresentationManagerProxy::setUpModelView):\n* Source/WebKit/UIProcess/ios/WKPageHostedPortalView.mm:\n(-[WKPageHostedPortalView layoutSubviews]):\n* Source/WebKit/WebProcess/Model/ModelProcessModelPlayer.cpp:\n(WebKit::ModelProcessModelPlayer::configureGraphicsLayer):\nCreate a ModelPlayer and establish the portal's view hierarchy\n(WKPageHostedPortalView and RemoteView to the ModelProcess) as soon as\nthe Spatial Portal is created (even if it contains no model element).\nAdd support for a custom origin (in the standalone model use case a 0x0\norigin is always correct but not for Spatial Portals).\n\n* Source/WebCore/rendering/RenderBox.cpp:\n(WebCore::spatialPortalStyleDidChange):\n(WebCore::isNestedInsideSpatialPortal):\n(WebCore::updateSpatialPortalController):\n(WebCore::RenderBox::styleDidChange):\nSignal nested model elements when a parent Spatial Portal is\ncreated / destroyed.\n\n* Source/WebCore/rendering/RenderLayerCompositor.cpp:\n(WebCore::RenderLayerCompositor::updateBackingAndHierarchy):\n(WebCore::RenderLayerCompositor::isSpatialPortal):\n(WebCore::RenderLayerCompositor::requiresCompositingForSpatialPortal const):\n(WebCore::RenderLayerCompositor::needsContentsCompositingLayer const):\n* Source/WebCore/rendering/RenderLayerCompositor.h:\nPrevent Spatial Portals nesting.\n\n* Source/WebCore/rendering/RenderLayerBacking.cpp:\n(WebCore::RenderLayerBacking::updateConfiguration):\n(WebCore::RenderLayerBacking::updateContentsRects):\n(WebCore::RenderLayerBacking::contentsBox const):\nConfigure the Spatial Portal layers.\n\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::numberOfHostedModelsInSpatialPortal):\n(WebCore::Internals::establishesSpatialPortal):\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\nTest-only: expose the number of models nested in a portal and if an\nelement establishes a portal.\n(More to come in rdar://182292429.)\n\n* Tools/TestWebKitAPI/Resources/spatial-portal-two-models-page.html: Added.\n* Tools/TestWebKitAPI/SourcesCocoa.txt:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SpatialPortal.mm: Added.\n(TestWebKitAPI::loadTwoModelPortalWebView):\n(TestWebKitAPI::TEST(SpatialPortal, EnabledSharesOnePlayerAcrossModels)):\n(TestWebKitAPI::TEST(SpatialPortal, DisabledRendersModelsStandalone)):\nAdd basic API tests modeled after `ModelProcess.mm`.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebViewServerTrustKVC.mm:\nUnified-build fix.\n\nCanonical link: https://commits.webkit.org/318242@main",
      "email": "sgz@apple.com",
      "hash": "214a0eb36a63bf39948da15d0138b608016139a7",
      "subject": "Add support for loading a single nested model inside of a Spatial Portal"
    },
    "318243@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "318243@main",
      "clUrl": "https://commits.webkit.org/318243@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320634\n\nReviewed by Youenn Fablet.\n\n314498@main guarded the inner skip-NUL loop in hasSignatureForWebM(),\nbut a second unguarded iter + 1 read remains at the top of the loop:\n```\n    while (iter \u003c length \u0026\u0026 iter \u003c 38) {\n        if (sequence[iter] == 0x42 \u0026\u0026 sequence[iter + 1] == 0x82) {\n```\nThe loop guard only guarantees iter \u003c length, not iter + 1 \u003c length. When\niter == length - 1 and sequence[iter] == 0x42, the short-circuit \u0026\u0026 goes on\nto evaluate sequence[iter + 1], reading one byte past the end of the span.\nThis is reachable before the skip-NUL path 314498@main fixed: a 5-byte\ninput of EBML magic + a trailing 0x42 (0x1A 0x45 0xDF 0xA3 0x42) enters the\nloop at iter == 4 == length - 1 and reads sequence[5]. getMIMETypeFromContent()\nis called on attacker-controlled response bytes via MediaResourceSniffer with\na span sized to the exact number of received bytes, so this is a remotely\nreachable crash. WebKit builds with hardened libc++, so std::span's bounds\ncheck turns it into a safe abort on every build.\n\nGuard the two-byte compare with iter + 1 \u003c length so the bounds check\nshort-circuits the dereference, matching the guarded reads later in the\nfunction, and extend the regression test with the truncated 5-byte input.\n\nTest: MIMESniffer.WebMSnifferDoesNotReadPastEnd\n\n* Source/WebCore/platform/graphics/MIMESniffer.cpp:\n(WebCore::MIMESniffer::hasSignatureForWebM):\n* Tools/TestWebKitAPI/Tests/WebCore/MIMESniffer.cpp:\n(TestWebKitAPI::TEST(MIMESniffer, WebMSnifferDoesNotReadPastEnd)):\n\nCanonical link: https://commits.webkit.org/318243@main",
      "email": "cdumez@apple.com",
      "hash": "ef325e63cb21634b26ba345fb7783f4938db6173",
      "subject": "Out-of-bounds read in WebM MIME sniffer at the 0x42 0x82 DocType check"
    },
    "318244@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318244@main",
      "clUrl": "https://commits.webkit.org/318244@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320630\nrdar://183593777\n\nReviewed by Chris Dumez.\n\ngenerateElementIsNthChildOf built its list of non-trivial nth filters with a\nmanual loop, while the three sibling functions that do the same filtering\n(generateElementIsNthChild, generateElementIsNthLastChild and\ngenerateElementIsNthLastChildOf) all use WTF::compactMap. Match them.\n\nNo change in behavior.\n\n* Source/WebCore/cssjit/SelectorCompiler.cpp:\n(WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsNthChildOf):\n\nCanonical link: https://commits.webkit.org/318244@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "c61466deef93b4a529c8cbc18b633a2781b2d15a",
      "subject": "[cssjit] Use WTF::compactMap in generateElementIsNthChildOf"
    },
    "318245@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318245@main",
      "clUrl": "https://commits.webkit.org/318245@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320624\nrdar://183590585\n\nReviewed by Chris Dumez.\n\ndataLogFIf() is a function, not a macro, so its arguments are evaluated\nunconditionally. Every SelectorCodeGenerator construction therefore paid a\nfull recursive CSSSelector::selectorText() serialization plus a CString\nmalloc for the UTF-8 conversion, then discarded both, since\ndumpCSSJITDisassembly is off in every shipping configuration.\n\nGate the work behind if (shouldDumpCSSJITDisassembly()) and call dataLogF()\ndirectly, matching how the rest of this file guards disassembly-only work.\n\nNo behavior change, so no new tests.\n\n* Source/WebCore/cssjit/SelectorCompiler.cpp:\n(WebCore::SelectorCompiler::SelectorCodeGenerator::SelectorCodeGenerator):\n\nCanonical link: https://commits.webkit.org/318245@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "f2988007e86ec3f0646c78b960e4eff8a38a24e7",
      "subject": "CSS JIT serializes the full selector text on every compile even when disassembly dumping is disabled"
    },
    "318246@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "318246@main",
      "clUrl": "https://commits.webkit.org/318246@main",
      "description": "rdar://183614090\nhttps://bugs.webkit.org/show_bug.cgi?id=320640\n\nReviewed by Chris Dumez.\n\nThe goal of m_isInvokingQueueDrainedHandler assertions is to ensure that, when we call the drained handler, we do not synchronously append new data within that handler.\nBut m_isInvokingQueueDrainedHandler assertions are too aggresive.\nIn particular, if the drained handler is being called on thread A and thread B tries to append data, we would assert although this is fine.\n\nWe change m_isInvokingQueueDrainedHandler from a bool to the thread id on which the drained handler is being called.\nWe replace the past m_isInvokingQueueDrainedHandler assertions by checking that we are not adding data on that specific thread when the drained handler is being called.\n\nCovered by existing tests on debug builds.\n\n* Source/WebCore/platform/network/PendingStreamState.cpp:\n(WebCore::PendingStreamState::invokeDrainedHandlerIfNeeded):\n(WebCore::PendingStreamState::isInvokingQueueDrainedHandlerInSameThread const):\n(WebCore::PendingStreamState::appendData):\n(WebCore::PendingStreamState::endStream):\n(WebCore::PendingStreamState::errorStream):\n(WebCore::PendingStreamState::setDataAvailableHandler):\n(WebCore::PendingStreamState::readInto):\n(WebCore::PendingStreamState::takeAvailableChunks):\n* Source/WebCore/platform/network/PendingStreamState.h:\n\nCanonical link: https://commits.webkit.org/318246@main",
      "email": "youenn@apple.com",
      "hash": "a044b48be8a5207680cd24678cf03910c7e7d1b6",
      "subject": "m_isInvokingQueueDrainedHandler assertions are thread racy"
    },
    "318247@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318247@main",
      "clUrl": "https://commits.webkit.org/318247@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320628\nrdar://183591712\n\nReviewed by Chris Dumez.\n\nSelectorFragment had 12 bytes of padding holes on 64-bit: 3 bytes after\nisRightmostOrAdjacent, 3 bytes after backtrackingFlags, and 6 bytes of tail\npadding after the two trailing bools.\n\nGive BacktrackingAction, FragmentRelation and FragmentPositionInRootFragments\nan explicit uint8_t underlying type, and move matchesHasScope and\nonlyMatchesLinksInQuirksMode up beside the other byte-sized members so all ten\nof them pack contiguously into offsets 0-9. This moves the first pointer member\nfrom offset 56 down to 40 and takes sizeof(SelectorFragment) from 528 to 504,\nleaving only the 2 bytes of alignment padding before the first unsigned.\n\nThese three enums are used only within SelectorCompiler.cpp for bookkeeping\nduring compilation; none of them are encoded into the generated code, so\nnarrowing them has no effect on the emitted JIT code.\n\nSelectorFragmentList is a Vector\u003cSelectorFragment, 4\u003e, so its inline (stack)\nstorage shrinks from 2144 to 2048 bytes. That saving compounds while compiling\nnested functional pseudo-classes, where notFilters, matchesFilters and the\nnthChildOf filter lists nest SelectorFragmentLists recursively. See the\nexisting FIXME about the inline capacity in this struct.\n\nNo change in behavior.\n\n* Source/WebCore/cssjit/SelectorCompiler.cpp:\n\nCanonical link: https://commits.webkit.org/318247@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "08d31de09e2b120d1bb2a2bb9abe97c6f3802c13",
      "subject": "Reduce sizeof(SelectorFragment) by eliminating struct padding in the CSS JIT"
    },
    "318248@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "318248@main",
      "clUrl": "https://commits.webkit.org/318248@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320583\nrdar://problem/183559501\n\nReviewed by Alan Baradlay.\n\nAfter laying out a grid, the integration layer tells the legacy grid that its items\nno longer need placement so that render tree clients which rely on that state (e.g.\nRenderGrid::paintChildren) behave as if placement had run. It does not, however,\npopulate the legacy grid's item area map, which only legacy placement fills in.\n\nClients which consult the grid area of a grid item outside of layout therefore read\nfrom an empty map. RenderGrid::isExtrinsicallySized, which RenderObject::markContainingBlocksForLayout\ncalls on every ancestor grid, does exactly that through\nisPlacedWithinExtrinsicallySizedExplicitTracks: its needsItemsPlacement() guard passes\nand Grid::gridItemArea asserts that the item is in the map.\n\nWe can have the integration layer write back the grid areas for each of\nthe grid items at the end of layout. This information is already\noutputted to us by GridLayout as the part of the GridItemRects in\nGridLayoutResult.\n\n* Source/WebCore/layout/formattingContexts/grid/GridFormattingContext.cpp:\nReturn the GridLayoutResult that we got from GridLayout. It was being\nused above to do some mapping of the grid item rects so that the\nlocations are in the coordinate space of the grid's content box.\n\n* Source/WebCore/layout/integration/grid/LayoutIntegrationGridLayout.cpp:\nGo through each item and take the line numbers for its grid area and map\nthem to \"translated definite spans,\" which is what is seems like\nRenderGrid uses for the positions of the grid item after placement is\ndone.\n\nCanonical link: https://commits.webkit.org/318248@main",
      "email": "sammy.gill@apple.com",
      "hash": "d9d5b5e6ff86784a3bc8e05bea925d1fa7243774",
      "subject": "[GFC][Integration] RenderGrid needs grid items' areas after layout."
    },
    "318249@main": {
      "author": "Etienne Segonzac",
      "avatar": "https://www.gravatar.com/avatar/3566820d0ba7e035bc440dc736c17f0c?d=identicon\u0026s=64",
      "cl": "318249@main",
      "clUrl": "https://commits.webkit.org/318249@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320458\n\u003crdar://182292365\u003e\n\nReviewed by Mike Wyrzykowski.\n\nIntroduce a top-level wrapper that owns the global transforms: auto-fit,\nstagemode, and in the future `portal-transform` / `portal-action`.\n\n* Source/WebKit/ModelProcess/cocoa/ModelProcessModelPlayerProxy.h:\n* Source/WebKit/ModelProcess/cocoa/ModelProcessModelPlayerProxy.mm:\n(WebKit::ModelProcessModelPlayerProxy::updateTransform):\n(WebKit::ModelProcessModelPlayerProxy::didFinishLoading):\n(WebKit::ModelProcessModelPlayerProxy::updateForCurrentStageMode):\n(WebKit::ModelProcessModelPlayerProxy::updateTransformSRT):\n(WebKit::ModelProcessModelPlayerProxy::ensurePortalEntityHierarchy):\n(WebKit::ModelProcessModelPlayerProxy::parentToContainer):\n(WebKit::ModelProcessModelPlayerProxy::teardownEntity):\nAdd a wrapper entity that will contain multiple models.\n\n* Source/WebKit/WebKitSwift/RealityKit/WKRKEntity.h:\n* Source/WebKit/WebKitSwift/RealityKit/WKRKEntity.swift:\n(WKRKEntity.reference):\n(WKRKEntity.transform):\nClean-up a previous work-around making all transforms apply in world\nspace now that we have some hierarchy.\n\nCanonical link: https://commits.webkit.org/318249@main",
      "email": "sgz@apple.com",
      "hash": "ed12ae04be1437210d092774dd2033e051e15be3",
      "subject": "[ModelProcess] Prepare the RealityKit hierarchy to support multiple entities with global transforms"
    },
    "318250@main": {
      "author": "Dana Estra",
      "avatar": "https://www.gravatar.com/avatar/bb57a3e383fc407cd4b341aeef87d877?d=identicon\u0026s=64",
      "cl": "318250@main",
      "clUrl": "https://commits.webkit.org/318250@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320404\nrdar://183365541\n\nReviewed by Jean-Yves Avenard.\n\nAdd removeTextTrack() to the HTMLMediaElement API, which takes as an\nargument a track element that was added via HTMLMediaElement.addTextTrack().\nIt throws an exception if the media element does not contain that text track,\nor if the track is a type other than AddTrack (meaning it was not added via\naddTextTrack()).\n\nChange the existing removeTextTrack(TextTrack\u0026 track, bool scheduleEvent) to\nreturn a bool indicating whether it succeeded at removing the track. Also\nremove the default value for scheduleEvent, since it would otherwise be\nambiguous with the new single-argument overload.\n\nAdded new test: media/track/track-remove-text-track.html\n\n* LayoutTests/media/track/track-remove-text-track-expected.txt: Added.\n* LayoutTests/media/track/track-remove-text-track.html: Added.\n* Source/WebCore/Modules/mediasource/MediaSource.cpp:\n(WebCore::MediaSource::removeSourceBufferWithOptionalDestruction):\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::removeTextTrack):\n(WebCore::HTMLMediaElement::willRemoveTextTrack):\n(WebCore::HTMLMediaElement::didRemoveTextTrack):\n(WebCore::HTMLMediaElement::forgetResourceSpecificTracks):\n* Source/WebCore/html/HTMLMediaElement.h:\n* Source/WebCore/html/HTMLMediaElement.idl:\n\nCanonical link: https://commits.webkit.org/318250@main",
      "email": "destra@apple.com",
      "hash": "c45604eac6d555f26647dc2eb9d0d190a75d24f8",
      "subject": "Add HTMLMediaElement.removeTextTrack()"
    },
    "318251@main": {
      "author": "Yijia Huang",
      "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64",
      "cl": "318251@main",
      "clUrl": "https://commits.webkit.org/318251@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320575\nrdar://183552376\n\nReviewed by Yusuke Suzuki.\n\nArray.from() already bypasses the generic iterator protocol for plain\nArray.from(set) and Array.from(map.keys()/.values()), reading internal\nhash-table storage directly. arrayConstructorPrivateFromFastWithoutMapFn\nhad a JSMapIteratorType case but no JSSetIteratorType case, so\nArray.from(set.keys()) and Array.from(set.values()) never got the fast\npath Map already had. Add tryCreateArrayFromSetIterator(), a mirror of\nthe existing tryCreateArrayFromMapIterator().\n\n                                    ToT                     Patched\n\narray-from-set-iterator        6.3581+-0.4507     ^      2.9109+-0.1796        ^ definitely 2.1842x faster\n\nTests: JSTests/microbenchmarks/array-from-set-iterator.js\n       JSTests/stress/array-from-set-iterator-fast-path.js\n\nCanonical link: https://commits.webkit.org/318251@main",
      "email": "yijia_huang@apple.com",
      "hash": "cb1c48b3e95fb9670d91b400cc1111ea7b420dbe",
      "subject": "[JSC] Extend Array.from()'s Set fast path to cover set.keys()/.values()"
    },
    "318252@main": {
      "author": "Yijia Huang",
      "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64",
      "cl": "318252@main",
      "clUrl": "https://commits.webkit.org/318252@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320578\nrdar://183555635\n\nReviewed by Yusuke Suzuki.\n\nThis patch makes the following changes:\n- find16()/find32(): drop the 32-element override so SIMD::find()'s own\nsmaller threshold applies, closing a scalar gap below it.\n- StringImpl/AtomString case-conversion: bulk-copy the already-correct\nprefix instead of a byte-at-a-time loop.\n- containsOnlyLatin1(): delegate to the existing SIMD-accelerated\ncharactersAreAllLatin1().\n\n                                                     ToT                     Patched\n\ntyped-array-indexof-uint16-uint32-boundary.     17.2571+-0.1205     ^     15.9118+-0.1062        ^ definitely 1.0845x faster\nstring-case-conversion-prefix-copy              365.4766+-1.4266     ^    250.2327+-0.8555        ^ definitely 1.4605x faster\n\nTests: JSTests/microbenchmarks/string-case-conversion-prefix-copy.js\n       JSTests/microbenchmarks/typed-array-indexof-uint16-uint32-boundary.js\n       Tools/TestWebKitAPI/Tests/WTF/StringCommon.cpp\n       Tools/TestWebKitAPI/Tests/WTF/StringImpl.cpp\n\nCanonical link: https://commits.webkit.org/318252@main",
      "email": "yijia_huang@apple.com",
      "hash": "a288a8ec809b7ae932104ad4c4b78272214d80bd",
      "subject": "Widen find16/find32 SIMD threshold; speed up ASCII case-conversion prefix copy"
    },
    "318253@main": {
      "author": "Simon Pena",
      "avatar": "https://www.gravatar.com/avatar/3dde875c8abcd38f7ddad8ab6c88df1c?d=identicon\u0026s=64",
      "cl": "318253@main",
      "clUrl": "https://commits.webkit.org/318253@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320656\n\nUnreviewed gardening.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318253@main",
      "email": "spena@igalia.com",
      "hash": "2bd60a7df5d616ef2f26823310f58f1d806aa3dc",
      "subject": "[GTK][WPE] Gardening of tests - 2026-07-30"
    },
    "318254@main": {
      "author": "Andy Estes",
      "avatar": "https://www.gravatar.com/avatar/643f10f01b26fd94d03482a2013b2ea0?d=identicon\u0026s=64",
      "cl": "318254@main",
      "clUrl": "https://commits.webkit.org/318254@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320588\nrdar://177423546\n\nReviewed by Kiet Ho.\n\nAs of 311380@main we gate accelerated video rendering on the video element intersecting the\nviewport (by using an IntersectionObserver). If the observer never reports the video as\nintersecting, a video layer is never attached and decoded frames are dropped, so the video plays\naudio but shows no frames.\n\nFor a video in a cross-origin iframe with Site Isolation enabled, the observer computes\nintersection from geometry sent over by the parent frame's process. That geometry was wrong on some\nyahoo.com pages, so the video was reported as never intersecting even while fully within the\nviewport.\n\nThe process that contains the iframe computes the frame's visible rect in\nLocalFrameView::visibleRectOfChild by passing the iframe's rect to computeVisibleRectsInContainer.\nThat function expects a rect in the iframe's own coordinate space, but we were passing it a rect in\nits container's coordinate space. This resulted in the iframe's offset position being applied\ntwice, resulting in an IntersectionObserver believing that elements within the iframe were too far\ndown to intersect the viewport.\n\nResolved this by passing borderBoxRect() (i.e. a rect in the element's own coordinate space) to\ncomputeVisibleRectsInContainer, matching other call sites.\n\nTests: imported/w3c/web-platform-tests/intersection-observer/offset-iframe-cross-origin.html\n       imported/w3c/web-platform-tests/intersection-observer/offset-iframe-same-origin.html\n\n* LayoutTests/imported/w3c/web-platform-tests/intersection-observer/offset-iframe-cross-origin-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/intersection-observer/offset-iframe-cross-origin.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/intersection-observer/offset-iframe-same-origin-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/intersection-observer/offset-iframe-same-origin.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/intersection-observer/resources/offset-iframe-subframe.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/intersection-observer/resources/offset-iframe.js: Added.\n(runOffsetIframeTest.):\n(runOffsetIframeTest):\n* Source/WebCore/page/LocalFrameView.cpp:\n(WebCore::LocalFrameView::visibleRectOfChild const):\n\nCanonical link: https://commits.webkit.org/318254@main",
      "email": "aestes@apple.com",
      "hash": "00dd50aa571465067bb054efe20518947ed6a9a5",
      "subject": "[Site Isolation] Embedded YouTube videos on yahoo.com fail to render"
    },
    "318255@main": {
      "author": "Dan Hecht",
      "avatar": "https://www.gravatar.com/avatar/080f47d912b1b34d0be8293f825d132d?d=identicon\u0026s=64",
      "cl": "318255@main",
      "clUrl": "https://commits.webkit.org/318255@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320595\nrdar://183569873\n\nReviewed by Yusuke Suzuki.\n\nThe preceding lines may have called deallocate(thread_local_cache)\nso thread_local_cache shouldn't be dereferenced to get the lock.\n\nThis is benign, however, because:\n1. TLC allocations are in the large utility free heap which doesn't write\nmetadata into freed blocks.\n2. The heap lock is held so the memory won't be recycled or decommitted\nin the meantime.\n3. No other allocations in this window come from the large utility free heap.\n\n* Source/bmalloc/libpas/src/libpas/pas_thread_local_cache.c:\n(pas_thread_local_cache_get_local_allocator_slow):\n\nCanonical link: https://commits.webkit.org/318255@main",
      "email": "dan.hecht@apple.com",
      "hash": "90cbe5e8552858d3b1fb959864db034b5b91c9f4",
      "subject": "[libpas] Fix a benign read from a deallocated TLC"
    },
    "318256@main": {
      "author": "Vitaly Dyachkov",
      "avatar": "https://www.gravatar.com/avatar/ab950c52088e289585a5a01580ec66a4?d=identicon\u0026s=64",
      "cl": "318256@main",
      "clUrl": "https://commits.webkit.org/318256@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320365\n\nReviewed by Devin Rousso.\n\nAccording to the spec [1]:\n\n14. If request's header list does not contain `Accept-Language`, then\nuser agents should append (`Accept-Language`, an appropriate header\nvalue) to request's header list.\n\n[1] https://fetch.spec.whatwg.org/#concept-request-header-list\n\n* Source/WebCore/platform/network/curl/CurlRequest.cpp:\n(WebCore::CurlRequest::setupTransfer):\n(WebCore::CurlRequest::appendAcceptLanguageHeaderIfNeeded):\n(WebCore::CurlRequest::appendAcceptLanguageHeader): Deleted.\n* Source/WebCore/platform/network/curl/CurlRequest.h:\n\nCanonical link: https://commits.webkit.org/318256@main",
      "email": "vitaly@igalia.com",
      "hash": "7e3a4b02e376d2638ebf77e9f6211c0ca14352c3",
      "subject": "[Curl] Don't add default `Accept-Language` if the request already has one"
    },
    "318257@main": {
      "author": "Cole Carley",
      "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64",
      "cl": "318257@main",
      "clUrl": "https://commits.webkit.org/318257@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320570\nrdar://183543404\n\nReviewed by Keith Miller.\n\nAfter this patch, useWasmMemory64 flag is on by default.\n\n* JSTests/wasm/js-api/memory64-js-api.js:\n* JSTests/wasm/js-api/table64-js-api.js:\n* JSTests/wasm/stress/memory64-atomic-notify-out-of-bounds.js:\n* JSTests/wasm/stress/memory64-atomic-wait-out-of-bounds.js:\n* JSTests/wasm/stress/memory64-atomics.js:\n* JSTests/wasm/stress/memory64-bulk-memory.js:\n* JSTests/wasm/stress/memory64-grow-and-size.js:\n* JSTests/wasm/stress/memory64-load-and-store.js:\n* JSTests/wasm/stress/memory64-overflow.js:\n(testOverflow):\n* JSTests/wasm/stress/memory64-write-to-address-over-4-gigs.js:\n* JSTests/wasm/stress/table64-bulk.js:\n* JSTests/wasm/stress/table64-call-indirect.js:\n* JSTests/wasm/stress/table64-get-and-set.js:\n* JSTests/wasm/stress/table64-grow-and-size.js:\n* JSTests/wasm/stress/table64-initial-truncation.js:\n* JSTests/wasm/stress/table64-overflow.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table_copy64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table_fill64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table_get64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table_grow64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table_init64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table_set64.wast.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/js/memory64/table_size64.wast.js:\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/318257@main",
      "email": "ccarley2@apple.com",
      "hash": "0d0080ea539d2c07b06d92edb5705cbcc24fe3cc",
      "subject": "Enable WebAssembly Memory64 feature flag"
    },
    "318258@main": {
      "author": "Ryan Haddad",
      "avatar": "https://www.gravatar.com/avatar/b7d8cd2dec546cac2524e4b58181f9d5?d=identicon\u0026s=64",
      "cl": "318258@main",
      "clUrl": "https://commits.webkit.org/318258@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320662\nrdar://183642052\n\nReviewed by Aakash Jain.\n\n* Tools/CISupport/build-webkit-org/config.json: Update OS and Xcode version.\n\nCanonical link: https://commits.webkit.org/318258@main",
      "email": "ryanhaddad@apple.com",
      "hash": "7de434b37cd4e55e41246d379bc893b4048d2521",
      "subject": "[build.webkit.org] Migrate Apple-Tahoe-Safer-CPP-Checks to macOS 26.6"
    },
    "318259@main": {
      "author": "Jessica Lee",
      "avatar": "https://www.gravatar.com/avatar/fc717c99321d09f31fb9187418a8ffc5?d=identicon\u0026s=64",
      "cl": "318259@main",
      "clUrl": "https://commits.webkit.org/318259@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320605\nrdar://183577172\n\nReviewed by Per Arne Vollan and Alex Christensen.\n\nThis is currently a case that is missing from the test suite in ParentalControlsContentFilteringTests.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ParentalControlsContentFilteringTests.mm:\n(TEST(ParentalControlsContentFilteringTests, BlockedNavigationFromLinkClick)):\n\nCanonical link: https://commits.webkit.org/318259@main",
      "email": "jlee53@apple.com",
      "hash": "1438cd6114e3e23dbed7b0501e413bc3e4f25da8",
      "subject": "Add parental controls content filtering test for blocked navigation via clicked links"
    },
    "318260@main": {
      "author": "Eric Carlson",
      "avatar": "https://www.gravatar.com/avatar/e227ff07cc6d645fc1c69fd56c2c8cb8?d=identicon\u0026s=64",
      "cl": "318260@main",
      "clUrl": "https://commits.webkit.org/318260@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320666\nrdar://183640839\n\nReviewed by David Kilzer.\n\nClear `m_photoOutput` if `-[AVCaptureSession canAddOutput:]` fails so we don't try to\nuse the invalid `AVCapturePhotoOutput`.\n\n* Source/WebCore/platform/mediastream/cocoa/AVVideoCaptureSource.mm:\n(WebCore::AVVideoCaptureSource::photoOutput):\n\nCanonical link: https://commits.webkit.org/318260@main",
      "email": "eric.carlson@apple.com",
      "hash": "0ee36699845551e329b74375fdc18d6a4e81cc64",
      "subject": "ImageCapture.takePhoto() silently fails forever on a getUserMedia track after one transient -[AVCaptureSession canAddOutput:] failure"
    },
    "318261@main": {
      "author": "Ryan Haddad",
      "avatar": "https://www.gravatar.com/avatar/b7d8cd2dec546cac2524e4b58181f9d5?d=identicon\u0026s=64",
      "cl": "318261@main",
      "clUrl": "https://commits.webkit.org/318261@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320576\n\nReviewed by Aakash Jain.\n\nAnalyzeLayoutTestsResults.retry_build() already passes triggers=[scheduler] when re-triggering\nits parent archive build, intending for that rebuild to only re-run the tester that asked for\nthe retry. That value never reached the new parent build, so every automatic retry fanned out\nto the parent's full set of configured testers.\n\nTo fix this, pass the explicit list instead. ConfigureBuild already declines to overwrite a pre-set 'triggers'\nproperty, which is the same mechanism the force-retry-\u003cbuilder\u003e schedulers rely on, so no other\nchanges are needed.\n\n* Tools/CISupport/ews-build/steps.py:\n(Trigger.propertiesToPassToTriggers): Pass the explicit trigger list rather than a renderable\nthat reads the wrong build's property.\n* Tools/CISupport/ews-build/steps_unittest.py:\n(TestAnalyzeLayoutTestsResults.test_retry_build_triggers_only_current_queue): Add unit test.\n(TestTrigger.test_triggers_property_passes_explicit_list): Ditto.\n(TestTrigger.test_triggers_property_is_not_a_renderable): Ditto.\n\nCanonical link: https://commits.webkit.org/318261@main",
      "email": "ryanhaddad@apple.com",
      "hash": "ccea3d8723c964e5d3cef2ff2afacaf841bf93fb",
      "subject": "[EWS] Parent build retries in AnalyzeLayoutTestsResults should only trigger the builder that made the request"
    },
    "318262@main": {
      "author": "Ryan Haddad",
      "avatar": "https://www.gravatar.com/avatar/b7d8cd2dec546cac2524e4b58181f9d5?d=identicon\u0026s=64",
      "cl": "318262@main",
      "clUrl": "https://commits.webkit.org/318262@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320229\nrdar://problem/183163928\n\nReviewed by Aakash Jain.\n\nThe improvement to the git-webkit user hints for GitHub API errors in 317643@main did not\naccount for non-JSON responses. The 500 errors seen today caused the script to exit due to\njson.decoder.JSONDecodeError instead of printing the hint.\n\n* Tools/Scripts/libraries/webkitbugspy/webkitbugspy/__init__.py: Bump version to 0.15.4 since\nwebkitscmpy will now call the new Tracker.decode_json() functions\n* Tools/Scripts/libraries/webkitbugspy/webkitbugspy/github.py:\n(Tracker.decode_json): Add helper that decodes the response body, returning {} on invalid JSON.\n(Tracker.request): Route the error-path message read through decode_json().\n(Tracker.user): Ditto.\n* Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tests/github_unittest.py:\n(TestGitHub.test_decode_json): Add new test.\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/__init__.py: Bump version to 7.0.4 and\nrequire webkitbugspy 0.15.4.\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/remote/git_hub.py:\n(PullRequests.create): Route parse_error() through Tracker.decode_json().\n(PullRequests.update): Ditto.\n(GitHub._make_comment): Ditto.\n(GitHub.review): Ditto.\n(GitHub.graphql): Route the error-path message read through Tracker.decode_json().\n\nCanonical link: https://commits.webkit.org/318262@main",
      "email": "ryanhaddad@apple.com",
      "hash": "3f78363de00ec5adf1989421af24156ef4eb7f77",
      "subject": "[git-webkit] Handle non-JSON responses when printing user hints for GitHub API errors"
    },
    "318263@main": {
      "author": "Ryan Haddad",
      "avatar": "https://www.gravatar.com/avatar/b7d8cd2dec546cac2524e4b58181f9d5?d=identicon\u0026s=64",
      "cl": "318263@main",
      "clUrl": "https://commits.webkit.org/318263@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320395\n\nReviewed by Aakash Jain.\n\n`git-webkit revert` inherits the project, component, and version of the bug attached to the\ncommit being reverted. When that bug is old enough that its version has since been retired\nin Bugzilla, bug creation failed with a \"\u003cversion\u003e is not active.\" error which aborts the revert\nwithout creating a bug or PR.\n\nAddress this by filtering out inactive versions (as was already done for products and components)\nand falling back to the default version instead of raising an error.\n\n* Tools/Scripts/libraries/webkitbugspy/webkitbugspy/bugzilla.py:\n(Tracker): Hoist the hardcoded default version to a DEFAULT_VERSION constant.\n(Tracker.projects): Exclude versions Bugzilla reports as inactive, so callers only ever see\nversions a new bug can actually be filed against.\n(Tracker.create): Substitute the default version and warn on stderr when the requested version\nis inactive, instead of raising. Still raises if the project has no active versions at all.\n* Tools/Scripts/libraries/webkitbugspy/webkitbugspy/mocks/bugzilla.py:\n(Bugzilla._product_details): Report versions listed in a project's new 'inactive_versions'\nkey as inactive rather than marking every version active.\n(Bugzilla._create): Reject inactive versions with the same 400 real Bugzilla returns, so the\nclient-side fallback is tested against server enforcement.\n* Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tests/bugzilla_unittest.py:\n(TestBugzilla.test_create_falls_back_to_default_version): An inactive version is replaced\nby the default and the substitution is reported on stderr.\n(TestBugzilla.test_create_falls_back_to_last_version): When the default is itself inactive,\nthe last remaining active version is used.\n(TestBugzilla.test_create_no_version_is_silent): Omitting a version still picks the default\nwithout emitting a warning.\n(TestBugzilla.test_projects_excludes_inactive_versions): Inactive versions are absent from\nthe project's version list.\n\nCanonical link: https://commits.webkit.org/318263@main",
      "email": "ryanhaddad@apple.com",
      "hash": "b6658b694e0d6c2d19ea810aada91758d1d3daeb",
      "subject": "[git-webkit] revert fails when the original bug's version is no longer active, blocking reverts of older commits"
    },
    "318264@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "318264@main",
      "clUrl": "https://commits.webkit.org/318264@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317439\nrdar://problem/180064739\n\nReviewed by Antti Koivisto.\n\n    \u003cdiv style=\"display: flex; width: 300px\"\u003e\n        \u003cdiv style=\"min-width: 0; max-width: 100px\"\u003e\u003cdiv style=\"width: 300px\"\u003e\u003c/div\u003e\u003c/div\u003e\n        \u003cdiv style=\"min-width: 0\"\u003e\u003cdiv style=\"width: 300px\"\u003e\u003c/div\u003e\u003c/div\u003e\n    \u003c/div\u003e\n\nThe first item should be 100px wide and the second 200px. Instead they were 75px and 225px.\n\nEach item holds 300px of content, so each has a 300px flex base size. Shrinking 600px into a\n300px container takes both toward 150px, the first then freezes at its 100px max-width and the\nsecond takes the 200px left over. We clamped the first item's content-based contribution by its\nown max-width before handing it over as the flex base size, so flexing started from a base of\n100px instead of 300px and distributed the shrinkage 1:3 rather than 1:1.\n\nPer CSS Flexbox the flex base size is the content size; the item's own min/max main sizes only\ncome in afterwards, when deriving the hypothetical main size. shouldIgnoreLogicalMinMaxWidthSizes()\nalready identifies a flex item being measured for its base size and RenderReplaced consults it,\nso let's skip the clamps in constrainIntrinsicLogicalWidthsByMinMax() as well.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-flexbox/flex-base-size-ignores-max-width-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-flexbox/flex-base-size-ignores-max-width-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-flexbox/flex-base-size-ignores-max-width.html: Added.\n* Source/WebCore/rendering/RenderBox.cpp:\n(WebCore::RenderBox::constrainIntrinsicLogicalWidthsByMinMax const):\n\nCanonical link: https://commits.webkit.org/318264@main",
      "email": "zalan@apple.com",
      "hash": "797c5b0b8d2d86efe53139ec4fc3b181fb9f8e99",
      "subject": "[Flex] A flex item's flex base size should not be clamped by its own min/max-width"
    },
    "318265@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "318265@main",
      "clUrl": "https://commits.webkit.org/318265@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320631\nrdar://183594766\n\nReviewed by Abrar Rahman Protyasha.\n\nMimic the behavior of WKDefaultPDFHUDView.\n\n* Source/WebKit/UIProcess/PDF/WKAlternatePDFHUDView.swift:\n(Controls.body):\n(WKAlternatePDFHUDView.show):\n* Source/WebKit/UIProcess/PDF/WKDefaultPDFHUDView.swift:\n(isInRecoveryOS):\n\nCanonical link: https://commits.webkit.org/318265@main",
      "email": "richard_robinson2@apple.com",
      "hash": "46aeab80f4bcd0d83874adb1f6e4016411aea623",
      "subject": "[PDF] Don't show system actions in Recovery mode for the alternate PDF HUD view"
    },
    "318266@main": {
      "author": "Mike Wyrzykowski",
      "avatar": "https://www.gravatar.com/avatar/4b1bc9e238714f95e22d5d2454c07066?d=identicon\u0026s=64",
      "cl": "318266@main",
      "clUrl": "https://commits.webkit.org/318266@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320478\nrdar://183094727\n\nReviewed by Per Arne Vollan.\n\nThe fix added to 307679@main supports loading libWebKitSwift.dylib\nat runtime from local builds, but not from downloaded bundles\nwhich also have their frameworks relocated.\n\nAdjust 307679@main to support downloaded app bundles.\n\n* Source/WebKit/GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:\n* Source/WebKit/Shared/mac/AuxiliaryProcessMac.mm:\n(WebKit::populateSandboxInitializationParameters):\n* Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:\n* Source/WebKit/WebProcess/com.apple.WebProcess.x86.sb.in:\n\nCanonical link: https://commits.webkit.org/318266@main",
      "email": "mwyrzykowski@apple.com",
      "hash": "52773b38d5deafc9f5be68897872b8cbcfdb4bfd",
      "subject": "libWebKitSwift.dylib is not loaded in some configurations"
    },
    "318267@main": {
      "author": "lilly",
      "avatar": "https://www.gravatar.com/avatar/d0533d52eeb271270df480f37629a407?d=identicon\u0026s=64",
      "cl": "318267@main",
      "clUrl": "https://commits.webkit.org/318267@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320660\nrdar://183638981\n\nReviewed by Simon Fraser.\n\nPromote CSS corner-shape to preview and animate the shorthand by computed value\n\nNew tests are not necessary here\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebCore/css/CSSProperties.json:\n\nCanonical link: https://commits.webkit.org/318267@main",
      "email": "173393835+cupidsity@users.noreply.github.com",
      "hash": "d23f1c29ac74558cfcf21c3257caef2d0d43e267",
      "subject": "corner-shape: update property details"
    },
    "318268@main": {
      "author": "Charlie Wolfe",
      "avatar": "https://www.gravatar.com/avatar/857b3b5ff3394c31fa2689310a93dbab?d=identicon\u0026s=64",
      "cl": "318268@main",
      "clUrl": "https://commits.webkit.org/318268@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320613\nrdar://183584888\n\nReviewed by Alan Baradlay.\n\nCSS requires an atomic inline's synthesized central baseline to be halfway between its line-over and\nline-under margin edges. Rounding that midpoint for odd-sized boxes loses the fractional component\nand causes one-pixel baseline alignment errors in flex and grid layouts.\n\nPreserve the fractional midpoint without changing the box's logical height.\n\nhttps://drafts.csswg.org/css-inline-3/#baseline-synthesis-box\nhttps://www.w3.org/TR/css-writing-modes-3/#replaced-baselines\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-flexbox/alignment/flex-align-baseline-flex-002-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-flexbox/alignment/flex-align-baseline-grid-002-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-flexbox/alignment/flex-align-baseline-grid-003-expected.txt:\n* Source/WebCore/layout/formattingContexts/inline/InlineLineBoxBuilder.cpp:\n(WebCore::Layout::LineBoxBuilder::adjustIdeographicBaselineIfApplicable):\n\nCanonical link: https://commits.webkit.org/318268@main",
      "email": "charliew@apple.com",
      "hash": "f692b8e75f587db273ca9a8a67806e2931a68559",
      "subject": "[css-inline] Preserve fractional central baselines for atomic inlines"
    },
    "318269@main": {
      "author": "Mike Wyrzykowski",
      "avatar": "https://www.gravatar.com/avatar/4b1bc9e238714f95e22d5d2454c07066?d=identicon\u0026s=64",
      "cl": "318269@main",
      "clUrl": "https://commits.webkit.org/318269@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319838\nrdar://181089113\n\nReviewed by Alex Christensen.\n\nAn out of process iframe gets its own TileController, but previously\nwe were not clipping the child iframe's visibleRect to that of its\nparent.\n\nThis occurs when site isolation is disabled since its all in the same\nprocess.\n\nNo new IPC messages needed since we were already sending the needed\ninformation across processes, we just didn't use it to constrain the\noverdraw rect of the child iframes.\n\nThis reclaims ~100% of the IOSurface memory increase in plum4 testing.\n\nTests: http/tests/site-isolation/iframe-transform-2d-rotate.html\n       http/tests/site-isolation/iframe-transform-2d-translate.html\n       http/tests/site-isolation/iframe-transform-3d-rotate.html\n\n* LayoutTests/http/tests/site-isolation/iframe-transform-2d-rotate-expected.html: Added.\n* LayoutTests/http/tests/site-isolation/iframe-transform-2d-rotate.html: Added.\n* LayoutTests/http/tests/site-isolation/iframe-transform-2d-translate-expected.html: Added.\n* LayoutTests/http/tests/site-isolation/iframe-transform-2d-translate.html: Added.\n* LayoutTests/http/tests/site-isolation/iframe-transform-3d-rotate-expected.html: Added.\n* LayoutTests/http/tests/site-isolation/iframe-transform-3d-rotate.html: Added.\n* Source/WebCore/page/LocalFrameView.h:\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::syncLocalFrameInfoToRemote):\n* Source/WebCore/page/RemoteFrameLayoutInfo.cpp:\n(WebCore::RemoteFrameLayoutInfo::projectVisibleRectToChildContent const):\n* Source/WebCore/page/RemoteFrameLayoutInfo.h:\n* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:\n(WebKit::WebFrame::updateLocalFrameRect):\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::frameTreeSyncDataChangedInAnotherProcess):\n(WebKit::WebPage::allFrameTreeSyncDataChangedInAnotherProcess):\n(WebKit::WebPage::updateExposedRectFromParent):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n\nCanonical link: https://commits.webkit.org/318269@main",
      "email": "mwyrzykowski@apple.com",
      "hash": "88d15b836df1c203053e3cff296dd35b2f1a25f5",
      "subject": "TileController's visible size is not constricted to its parent"
    },
    "318270@main": {
      "author": "Keith Miller",
      "avatar": "https://www.gravatar.com/avatar/bddc1595b29098429a6ce7c8bf4aced2?d=identicon\u0026s=64",
      "cl": "318270@main",
      "clUrl": "https://commits.webkit.org/318270@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320661\nrdar://183640618\n\nReviewed by Mark Lam, Yusuke Suzuki, and Marcus Plutowski.\n\nThis patch adds Clang's preserve_most attribute to most fastMalloc APIs.\nThe preserve_most attribute on ARM64 turns `x9-x15` into callee saves.\nSee: https://clang.llvm.org/docs/AttributeReference.html#preserve-most\nFor functions that are leaf functions this can be beneficial as the\ncaller has more scratch registers to work with that they don't have to\nsave. AI helped me gather the following analysis of a production build.\n\nCounting every stp/str that writes a callee-saved register to the stack.\n```\n  ┌───────────┬─────────┬──────────┬─────────┬─────────┬────────┐\n  │ framework │ bucket  │ baseline │ patched │  delta  │   %    │\n  ├───────────┼─────────┼──────────┼─────────┼─────────┼────────┤\n  │ JSC       │ x19-x28 │  163,270 │ 153,920 │  -9,350 │ -5.73% │\n  ├───────────┼─────────┼──────────┼─────────┼─────────┼────────┤\n  │           │ x9-x15  │   23,459 │  24,647 │  +1,188 │ +5.06% │\n  ├───────────┼─────────┼──────────┼─────────┼─────────┼────────┤\n  │           │ d8-d15  │    3,290 │   3,290 │       0 │      — │\n  ├───────────┼─────────┼──────────┼─────────┼─────────┼────────┤\n  │           │ fp/lr   │   49,488 │  49,507 │     +19 │ +0.04% │\n  ├───────────┼─────────┼──────────┼─────────┼─────────┼────────┤\n  │           │ total   │  239,507 │ 231,364 │  -8,143 │ -3.40% │\n  ├───────────┼─────────┼──────────┼─────────┼─────────┼────────┤\n  │ WebCore   │ x19-x28 │  412,378 │ 395,350 │ -17,028 │ -4.13% │\n  ├───────────┼─────────┼──────────┼─────────┼─────────┼────────┤\n  │           │ x9-x15  │   28,562 │  30,434 │  +1,872 │ +6.55% │\n  ├───────────┼─────────┼──────────┼─────────┼─────────┼────────┤\n  │           │ d8-d15  │   16,426 │  16,427 │      +1 │      — │\n  ├───────────┼─────────┼──────────┼─────────┼─────────┼────────┤\n  │           │ fp/lr   │  178,373 │ 178,362 │     -11 │ -0.01% │\n  ├───────────┼─────────┼──────────┼─────────┼─────────┼────────┤\n  │           │ total   │  635,739 │ 620,573 │ -15,166 │ -2.39% │\n  ├───────────┼─────────┼──────────┼─────────┼─────────┼────────┤\n  │ WebKit    │ x19-x28 │  209,816 │ 203,697 │  -6,119 │ -2.92% │\n  ├───────────┼─────────┼──────────┼─────────┼─────────┼────────┤\n  │           │ x9-x15  │    7,672 │   8,360 │    +688 │ +8.97% │\n  ├───────────┼─────────┼──────────┼─────────┼─────────┼────────┤\n  │           │ d8-d15  │    5,472 │   5,472 │       0 │      — │\n  ├───────────┼─────────┼──────────┼─────────┼─────────┼────────┤\n  │           │ fp/lr   │  117,244 │ 117,242 │      -2 │      — │\n  ├───────────┼─────────┼──────────┼─────────┼─────────┼────────┤\n  │           │ total   │  340,204 │ 334,771 │  -5,433 │ -1.60% │\n  └───────────┴─────────┴──────────┴─────────┴─────────┴────────┘\n```\nCombined: 1,215,450 → 1,186,708, a net -28,742 (-2.36%).\n\nText size shrinks in step: -15,142 / -17,215 / -6,438 instructions.\n\nI only applied preserve_most to ARM64 since on X86 it leaves only one\nscratch free, which doesn't seem worth it. Additionally, there seems to\nbe a \"bug\" in LLVM's hot-cold outlining where the cold function doesn't\ninherit the hot function's calling convention. I filed rdar://183555125\nto track this. That said, LTO seems to undo this problem (even without\nPGO data) so it's still worth enabling when LTO is on.\n\nNo new tests, no observable behavior change.\n\nCanonical link: https://commits.webkit.org/318270@main",
      "email": "keith_miller@apple.com",
      "hash": "f5716f6401ed2ce8769c42fa2aa33f7c4a4dd39b",
      "subject": "Add preserve_most to most fastMalloc APIs on ARM64"
    },
    "318271@main": {
      "author": "Megan Gardner",
      "avatar": "https://www.gravatar.com/avatar/b466a5bcbfabf4d82a8ecc595db5a531?d=identicon\u0026s=64",
      "cl": "318271@main",
      "clUrl": "https://commits.webkit.org/318271@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320609\nrdar://182941183\n\nReviewed by Abrar Rahman Protyasha.\n\nAppKit's Siri affordance asks the web view for its selected text, then does substringWithRange: on the context we hand back —\nso if the range doesn't fit the text, it throws and takes down Safari. We build that pair from two  separate TextIterator walks,\nand the session-less path the affordance uses returned without ever checking that the  range fits. Now we clamp it in the controller\nand again in convertToPlatformContext, so nothing coming over IPC can throw inside AppKit.\n\nNo test, as the invalid range isn't reproducible from a test page — every selection a test can construct is kept valid by VisibleSelection::validate.\n\n* Source/WebCore/page/writing-tools/WritingToolsController.mm:\n(WebCore::rangeClampedToLength):\n(WebCore::WritingToolsController::willBeginWritingToolsSession):\n* Source/WebKit/UIProcess/Cocoa/PlatformWritingToolsUtilities.mm:\n(WebKit::convertToPlatformContext):\n\nCanonical link: https://commits.webkit.org/318271@main",
      "email": "megan_gardner@apple.com",
      "hash": "d7904663aaea57313abe6c909cd55bbc32ba6a82",
      "subject": "StabilityTracer: Safari crashes in AppKit when Writing Tools requests the selected text with a range that exceeds the context text"
    }
  },
  "date": "2026-07-30",
  "days": 1,
  "generatedAt": "2026-07-30T22:06:21Z",
  "markdown": "## Highlights\n- **Security** Fixed an out-of-bounds read in WebM MIME sniffing, closing a parser bug on untrusted media input. [commit 318243@main](https://commits.webkit.org/318243@main)\n- **Security** Fixed CacheStorage size accounting underflow that could persist corrupted quota state. [commit 318204@main](https://commits.webkit.org/318204@main)\n- **Web Platform** Enabled the WebAssembly Memory64 feature flag, moving 64-bit linear memory support closer to real-world use. [commit 318257@main](https://commits.webkit.org/318257@main)\n- **Networking** Implemented fetch upload backpressure, which should improve correctness and memory behavior for streaming uploads. [commit 318236@main](https://commits.webkit.org/318236@main)\n- **Media** Added HTMLMediaElement.removeTextTrack(), closing a long-standing API gap for text track management. [commit 318250@main](https://commits.webkit.org/318250@main)\n- **Perf** Landed multiple JSC and WTF speedups, including faster Array.from() on Set iterators and faster string search and ASCII prefix copying. [commit 318251@main](https://commits.webkit.org/318251@main) [commit 318252@main](https://commits.webkit.org/318252@main)\n- **UI** Started shipping an experimental alternate PDF HUD view, then quickly fleshed it out with controls, animation, and recovery-mode behavior. [commit 318196@main](https://commits.webkit.org/318196@main) [commit 318223@main](https://commits.webkit.org/318223@main) [commit 318226@main](https://commits.webkit.org/318226@main) [commit 318227@main](https://commits.webkit.org/318227@main) [commit 318265@main](https://commits.webkit.org/318265@main)\n- **Rendering** Grid and flex layout got a dense batch of spec fixes, especially around implicit rows, content-based sizing, area availability after layout, and flex base-size clamping. [commit 318264@main](https://commits.webkit.org/318264@main) [commit 318216@main](https://commits.webkit.org/318216@main) [commit 318221@main](https://commits.webkit.org/318221@main) [commit 318248@main](https://commits.webkit.org/318248@main)\n- **Security** Fixed a Safari crash in AppKit when Writing Tools asked for selected text beyond the available context range. [commit 318271@main](https://commits.webkit.org/318271@main)\n\n## What landed by area\n\n### JavaScriptCore and regex\n- **Perf** Extended Array.from()'s Set fast path to also cover set.keys() and set.values(). [commit 318251@main](https://commits.webkit.org/318251@main)\n- **Perf** Inlined the hot part of op_enter in LLInt to reduce interpreter overhead. [commit 318231@main](https://commits.webkit.org/318231@main)\n- **Perf** Extended StringSplitCache support to RegExp-backed splits. [commit 318212@main](https://commits.webkit.org/318212@main)\n- **Perf** Switched JSObject::toString to defaultToPrimitiveFastAndNonObservable for a cheaper fast path. [commit 318211@main](https://commits.webkit.org/318211@main)\n- **Build** Fixed offlineasm so ARM64 BaseIndex operands can emit register-offset addressing. [commit 318210@main](https://commits.webkit.org/318210@main)\n- **Refactor** Removed the B3 Air graph coloring register allocator. [commit 318202@main](https://commits.webkit.org/318202@main)\n- **Security** Added diagnostic assembly when getDirect returns an all-zero JSValue during llint_slow_path_get_by_id. [commit 318194@main](https://commits.webkit.org/318194@main)\n- **Web Platform** Fixed YARR optimization so negative lookahead contents are not incorrectly filtered in optimizeBOL. [commit 318234@main](https://commits.webkit.org/318234@main)\n- **Web Platform** Fixed non-BMP advance handling in YARR and simplified Unicode character reads. [commit 318209@main](https://commits.webkit.org/318209@main)\n\n### Networking, loading, and storage\n- **Networking** Implemented fetch upload backpressure for better streaming request flow control. [commit 318236@main](https://commits.webkit.org/318236@main)\n- **Networking** Added sec-fetch-dest on Service Worker requests for better fetch metadata conformance. [commit 318237@main](https://commits.webkit.org/318237@main)\n- **Networking** Curl now preserves an explicit Accept-Language header instead of appending a default one. [commit 318256@main](https://commits.webkit.org/318256@main)\n- **Web Platform** Fixed XMLHttpRequest.responseURL so abort() no longer leaves the previous URL visible. [commit 318241@main](https://commits.webkit.org/318241@main)\n- **Web Platform** Fixed reused XMLHttpRequest objects so getAllResponseHeaders() no longer returns stale headers. [commit 318217@main](https://commits.webkit.org/318217@main)\n- **Security** Fixed CacheStorage size accounting underflow that could persist a corrupt stored size. [commit 318204@main](https://commits.webkit.org/318204@main)\n- **Networking** Removed unsupported fields from WebTransportConnectionStats to align the API with reality. [commit 318225@main](https://commits.webkit.org/318225@main)\n- **Security** Added a parental-controls content filtering test for blocked navigations triggered by clicked links. [commit 318259@main](https://commits.webkit.org/318259@main)\n- **Security** Prevented content-filter failures from incorrectly transitioning ProvisionalPageProxy to RemotePageProxy under Site Isolation. [commit 318200@main](https://commits.webkit.org/318200@main)\n\n### Rendering, CSS, and layout\n- **Rendering** Fixed flexbox so a flex item's flex base size is not clamped by its own min/max-width. [commit 318264@main](https://commits.webkit.org/318264@main)\n- **Rendering** Preserved fractional central baselines for atomic inlines in css-inline. [commit 318268@main](https://commits.webkit.org/318268@main)\n- **Web Platform** Added support for comma-separated @container condition lists from css-conditional-5. [commit 318233@main](https://commits.webkit.org/318233@main)\n- **Rendering** Fixed -webkit-border-image width parsing so mixed length and non-length edges keep the width flag. [commit 318214@main](https://commits.webkit.org/318214@main)\n- **Rendering** Fixed corner-shape positioning for bevel, notch, and square corners on outlines and box-shadow spread. [commit 318193@main](https://commits.webkit.org/318193@main)\n- **Web Platform** Updated corner-shape property details to match the current definition. [commit 318267@main](https://commits.webkit.org/318267@main)\n- **Rendering** Ensured Grid formatting context has at least one row when ImplicitGrid is created. [commit 318221@main](https://commits.webkit.org/318221@main)\n- **Rendering** Fixed grid items with content-based size so they get a specified size suggestion. [commit 318216@main](https://commits.webkit.org/318216@main)\n- **Rendering** Made RenderGrid keep grid item areas available after layout in the integration path. [commit 318248@main](https://commits.webkit.org/318248@main)\n- **Rendering** Keyed track sizing space distribution by grid track index for more stable sizing. [commit 318197@main](https://commits.webkit.org/318197@main)\n- **Refactor** Extracted the equal-distribution loop used in grid track sizing space distribution. [commit 318218@main](https://commits.webkit.org/318218@main)\n- **Refactor** Clarified LayoutIntegrationUtils helper intent in Grid formatting context code. [commit 318206@main](https://commits.webkit.org/318206@main)\n- **Perf** Reduced sizeof(SelectorFragment) by removing struct padding in the CSS JIT. [commit 318247@main](https://commits.webkit.org/318247@main)\n- **Perf** Stopped CSS JIT from serializing full selector text on every compile when disassembly dumping is off. [commit 318245@main](https://commits.webkit.org/318245@main)\n- **Perf** Switched generateElementIsNthChildOf to WTF::compactMap in cssjit. [commit 318244@main](https://commits.webkit.org/318244@main)\n- **Refactor** Deduplicated an identical CSSSelector::Match::Set case in SelectorCompiler. [commit 318235@main](https://commits.webkit.org/318235@main)\n- **UI** Fixed TileController sizing so the visible size is constrained correctly relative to its parent. [commit 318269@main](https://commits.webkit.org/318269@main)\n- **Rendering** Fixed a text fuzziness issue in an imported SVG WPT around viewBox text scaling. [commit 318215@main](https://commits.webkit.org/318215@main)\n\n### Media, graphics, and GPU\n- **Media** Added HTMLMediaElement.removeTextTrack() for dynamic text track removal. [commit 318250@main](https://commits.webkit.org/318250@main)\n- **Media** Fixed ImageCapture.takePhoto() getting stuck after a transient AVCaptureSession canAddOutput failure. [commit 318260@main](https://commits.webkit.org/318260@main)\n- **Media** Fixed a regression where Moon Player full-screen YouTube playback could go black while audio kept playing. [commit 318230@main](https://commits.webkit.org/318230@main)\n- **GPU** Corrected ANGLE's rewrite of nested interpolateAtOffset offsets. [commit 318205@main](https://commits.webkit.org/318205@main)\n- **GPU** Fixed ANGLE's ScopedDisableOcclusionQuery helper so it writes mResultOut correctly. [commit 318203@main](https://commits.webkit.org/318203@main)\n- **Web Platform** ImageData JS constructor now rejects mismatched pixelFormats earlier. [commit 318195@main](https://commits.webkit.org/318195@main)\n- **Security** Fixed an out-of-bounds read in the WebM MIME sniffer's DocType check. [commit 318243@main](https://commits.webkit.org/318243@main)\n\n### Site isolation, process model, and stability\n- **UI** Fixed a Web Inspector UI process crash when a provisional subframe commits after a main-frame swap under Site Isolation. [commit 318239@main](https://commits.webkit.org/318239@main)\n- **Rendering** Fixed embedded YouTube rendering on yahoo.com under Site Isolation. [commit 318254@main](https://commits.webkit.org/318254@main)\n- **Security** Fixed a Safari crash in AppKit when Writing Tools requests selected text with an out-of-range context span. [commit 318271@main](https://commits.webkit.org/318271@main)\n- **Security** Fixed a benign read from a deallocated TLC in libpas. [commit 318255@main](https://commits.webkit.org/318255@main)\n- **Security** Fixed several use-after-move bugs across the codebase. [commit 318208@main](https://commits.webkit.org/318208@main)\n- **Security** Fixed an AdaptiveStringSearcher good-suffix shift table that was one element too small. [commit 318198@main](https://commits.webkit.org/318198@main)\n- **Stability** Fixed a thread-racy m_isInvokingQueueDrainedHandler assertion. [commit 318246@main](https://commits.webkit.org/318246@main)\n- **Stability** Fixed a regression where aborting many in-progress transactions of a suspended process could overflow the stack. [commit 318222@main](https://commits.webkit.org/318222@main)\n\n### Web Inspector, tooling, and build\n- **DevTools** Associated WebAssembly module scripts with the resource that fetched them in Web Inspector. [commit 318207@main](https://commits.webkit.org/318207@main)\n- **DevTools** Reset frame navigation event timestamps during Web Inspector initialization. [commit 318213@main](https://commits.webkit.org/318213@main)\n- **DevTools** Removed unused WI.CapturingProtocolTracer code. [commit 318219@main](https://commits.webkit.org/318219@main)\n- **Build** Fixed libWebKitSwift.dylib not loading in some configurations. [commit 318266@main](https://commits.webkit.org/318266@main)\n- **Build** Fixed the macOS build after the alternate PDF HUD landing. [commit 318199@main](https://commits.webkit.org/318199@main)\n- **Build** Removed WKDefaultPDFHUDView.mm from CMake. [commit 318232@main](https://commits.webkit.org/318232@main)\n- **Build** Fixed the missing moduledir in wpe-platform-uninstalled.pc for WPE builds. [commit 318228@main](https://commits.webkit.org/318228@main)\n- **Build** Migrated the Apple-Tahoe-Safer-CPP-Checks builder to macOS 26.6. [commit 318258@main](https://commits.webkit.org/318258@main)\n- **Build** Tightened EWS parent build retries so only the requesting builder gets retried. [commit 318261@main](https://commits.webkit.org/318261@main)\n- **Build** Fixed git-webkit revert when the original bug version is no longer active. [commit 318263@main](https://commits.webkit.org/318263@main)\n- **Build** Made git-webkit handle non-JSON GitHub API error responses when printing user hints. [commit 318262@main](https://commits.webkit.org/318262@main)\n- **Build** Added GTK and WPE layout test gardening updates for the day. [commit 318253@main](https://commits.webkit.org/318253@main)\n- **Build** Landed unreviewed GLib layout test gardening. [commit 318220@main](https://commits.webkit.org/318220@main)\n\n### PDF, accessibility, and platform features\n- **UI** Added an experimental off-by-default alternate PDF HUD view prototype. [commit 318196@main](https://commits.webkit.org/318196@main)\n- **UI** Added button actions to the alternate PDF HUD view. [commit 318223@main](https://commits.webkit.org/318223@main)\n- **UI** Updated the alternate PDF HUD view control group design. [commit 318226@main](https://commits.webkit.org/318226@main)\n- **UI** Added fade animation support to the alternate PDF HUD view. [commit 318227@main](https://commits.webkit.org/318227@main)\n- **UI** Hid system actions in Recovery mode for the alternate PDF HUD view. [commit 318265@main](https://commits.webkit.org/318265@main)\n- **A11y** Added a neutralizing color filter in AX. [commit 318240@main](https://commits.webkit.org/318240@main)\n- **Mobile** Fixed iOS Digital Credentials get() so a tap without touch listeners still counts as transient user activation. [commit 318229@main](https://commits.webkit.org/318229@main)\n- **UI** Prepared the RealityKit hierarchy in ModelProcess for multiple entities with global transforms. [commit 318249@main](https://commits.webkit.org/318249@main)\n- **UI** Added support for loading a single nested model inside a Spatial Portal. [commit 318242@main](https://commits.webkit.org/318242@main)\n- **Stability** Fixed a debug regression that broke all ModelProcess layout tests. [commit 318224@main](https://commits.webkit.org/318224@main)\n\n### Core performance and memory\n- **Perf** Added preserve_most to more fastMalloc APIs on ARM64, trimming calling overhead in allocator hot paths. [commit 318270@main](https://commits.webkit.org/318270@main)\n- **Perf** Widened the find16 and find32 SIMD threshold and sped up ASCII case-conversion prefix copying. [commit 318252@main](https://commits.webkit.org/318252@main)\n- **Perf** Fixed a MotionMark 1.3 regression that hurt Leaves by 19.5 percent. [commit 318201@main](https://commits.webkit.org/318201@main)\n\n## Reverts \u0026 Reapplies\n- **Build** Fixed git-webkit revert so older commits can still be reverted when the original bug version is no longer active. [commit 318263@main](https://commits.webkit.org/318263@main)",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [],
  "since": "2026-07-30",
  "totals": {
    "commits": 79,
    "features": 79,
    "rolls": 0
  },
  "until": "2026-07-30"
}