{ "commits": { "315227@main": { "author": "Jessica Lee", "avatar": "https://www.gravatar.com/avatar/fc717c99321d09f31fb9187418a8ffc5?d=identicon\u0026s=64", "cl": "315227@main", "clUrl": "https://commits.webkit.org/315227@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320715\nrdar://183701872\n\nReviewed by Alex Christensen.\n\nThese were fixed by https://commits.webkit.org/315227@main.\n\n* LayoutTests/platform/ios-site-isolation/TestExpectations:\n* LayoutTests/platform/mac-site-isolation/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318331@main", "email": "jlee53@apple.com", "hash": "54fbaaac22685884e507e4363c90e589c0ff0f99", "subject": "image-loading-lazy-in-cross-origin-iframe-001 \u0026 002 are test passes" }, "317594@main": { "author": "Per Arne Vollan", "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64", "cl": "317594@main", "clUrl": "https://commits.webkit.org/317594@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320596\nrdar://183569964\n\nReviewed by Sihui Liu.\n\nIn https://commits.webkit.org/317594@main, we added some syscalls in the sandboxes.\nThis patch adds telemetry to these new syscall rules, so that we can confirm their\nuse. The sandboxes will be updated after we have gathered enough telemetry.\n\n* Source/WebKit/GPUProcess/mac/com.apple.WebKit.GPUProcess.sb.in:\n* Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:\n* Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.GPU.sb.in:\n* Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.Networking.sb.in:\n* Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in:\n* Source/WebKit/Shared/Sandbox/iOS/gpu-defines.sb:\n* Source/WebKit/Shared/Sandbox/iOS/networking-defines.sb:\n* Source/WebKit/Shared/Sandbox/iOS/webcontent-defines.sb:\n* Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:\n* Source/WebKit/WebProcess/com.apple.WebProcess.x86.sb.in:\n\nCanonical link: https://commits.webkit.org/318315@main", "email": "pvollan@apple.com", "hash": "9ad3a6f5714afc4876a3e7d7f8515729ebe5097c", "subject": "Add telemetry to some syscalls in the sandboxes" }, "318272@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "318272@main", "clUrl": "https://commits.webkit.org/318272@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320610\n\nReviewed by Yusuke Suzuki.\n\npas_pgm_storage is allocated via pas_utility_heap_try_allocate(), which does\nnot zero memory (the utility heap recycles freed blocks). The allocation path\ninitialized every field of the struct except free_status, which was only ever\nwritten (to true) on the deallocation path. As a result, a still-live PGM\nallocation carried a garbage free_status.\n\nThe crash reporter (pas_report_crash.c) reads free_status to label a guard-page\nfault as \"UAF\" versus \"OOB\" (and the long-range variants). For an out-of-bounds\naccess on a never-freed allocation -- the primary case PGM exists to detect --\nfree_status held uninitialized memory, so the fault could be misreported as a\nuse-after-free instead of an out-of-bounds access.\n\nInitialize free_status to false on the allocation path. This is a diagnostics\nfix only; it does not affect allocator control flow or memory safety.\n\n* Source/bmalloc/libpas/src/libpas/pas_probabilistic_guard_malloc_allocator.c:\n(pas_probabilistic_guard_malloc_allocate):\n\nCanonical link: https://commits.webkit.org/318272@main", "email": "cdumez@apple.com", "hash": "e388877954d173a431657d2d143692cefc4f677a", "subject": "PGM allocator reads uninitialized free_status, misclassifying live-allocation OOB as UAF" }, "318273@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "318273@main", "clUrl": "https://commits.webkit.org/318273@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320615\n\nReviewed by Mike Wyrzykowski.\n\nThe vector-returning textureDimensions(t, level) overload emits Metal code that\nclamps the caller-supplied mip level with min(t.get_num_mip_levels(), uint(level)),\nthen calls get_width/get_height/get_depth(\u003cthat value\u003e). get_num_mip_levels()\nreturns the mip level count, so the valid LOD range is [0, count - 1]. A shader\npassing level == count clamps to count -- still one past the last valid LOD -- and\nqueries get_width(count), an out-of-range LOD access whose result is\nMetal-implementation-defined.\n\nThe level argument is arbitrary shader-controlled input, and nothing else clamps\nit: the bounds-check pass (BoundsCheck.cpp) only rewrites index-access\nexpressions and variables, never texture-builtin arguments, so this min() is the\nsole bounds protection for the builtin -- and it is off by one. The same file's\nindex-access bounds check clamps with min(index, size - 1) (BoundsCheck.cpp), i.e.\nsubtracts one from the count to get the last valid index; this fix applies the\nsame idiom to the mip level.\n\nClamp against get_num_mip_levels() - 1 instead. A texture always has at least one\nmip level, so the subtraction cannot underflow, and valid levels (already\n\u003c= count - 1) are unaffected.\n\n* Source/WebGPU/WGSL/Metal/MetalFunctionWriter.cpp:\n(WGSL::Metal::emitTextureDimensions):\n\nCanonical link: https://commits.webkit.org/318273@main", "email": "cdumez@apple.com", "hash": "4ed1e2966ece9c19e07e22ce81a735d83d21ef69", "subject": "WGSL textureDimensions(t, level) codegen clamps mip level one past the last valid LOD" }, "318274@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "318274@main", "clUrl": "https://commits.webkit.org/318274@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320614\n\nReviewed by Mike Wyrzykowski.\n\nToken stores its identifier in a union member (String ident), so the String's\nlifetime must be managed manually via the type discriminant. The move-assignment\noperator and the destructor both destruct the existing String before overwriting\n(if (type == TokenType::Identifier) ident.~String();), but the copy-assignment\noperator omitted this: it overwrote type and then placement-constructed a fresh\nString over the still-live one, leaking the previously held StringImpl reference.\n\nParser::consume() copy-assigns into m_current on every token advance\n(m_current = m_tokens[++m_currentTokenIndex]), and identifiers are the most common\ntoken in WGSL, so compiling attacker-supplied shader source leaked one StringImpl\nper identifier consumed for the lifetime of the process -- a monotonic\nmemory-growth vector reachable from untrusted WGSL in the GPU process.\n\nDestruct the existing Identifier String at the top of the copy-assignment\noperator, mirroring the move-assignment operator and the destructor.\n\n* Source/WebGPU/WGSL/Token.h:\n(WGSL::Token::operator=):\n\nCanonical link: https://commits.webkit.org/318274@main", "email": "cdumez@apple.com", "hash": "e02581f3b0d9122b97c7aef7454c3327a1dc553b", "subject": "WGSL Token copy-assignment leaks the Identifier String's StringImpl on every token advance" }, "318275@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "318275@main", "clUrl": "https://commits.webkit.org/318275@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320637\n\nReviewed by Darin Adler.\n\n* Source/WebCore/svg/SVGAltGlyphDefElement.cpp:\n(WebCore::SVGAltGlyphDefElement::hasValidGlyphElements const): Deleted.\n* Source/WebCore/svg/SVGAltGlyphDefElement.h:\n* Source/WebCore/svg/SVGAltGlyphElement.cpp:\n(WebCore::SVGAltGlyphElement::hasValidGlyphElements const): Deleted.\n* Source/WebCore/svg/SVGAltGlyphElement.h:\n* Source/WebCore/svg/SVGAltGlyphItemElement.cpp:\n(WebCore::SVGAltGlyphItemElement::hasValidGlyphElements const): Deleted.\n* Source/WebCore/svg/SVGAltGlyphItemElement.h:\n* Source/WebCore/svg/SVGGlyphRefElement.cpp:\n(WebCore::SVGGlyphRefElement::hasValidGlyphElement const): Deleted.\n* Source/WebCore/svg/SVGGlyphRefElement.h:\n\nCanonical link: https://commits.webkit.org/318275@main", "email": "cdumez@apple.com", "hash": "1db54fba037f5e76caabb29c3edfe40a3a24212c", "subject": "Drop SVGAltGlyphElement::hasValidGlyphElements() as it is dead code" }, "318276@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "318276@main", "clUrl": "https://commits.webkit.org/318276@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320629\n\nReviewed by Eric Carlson.\n\nsessionWillEndPlayback() intends to demote the just-paused session behind the\nfirst already-paused session (or to the end of the list) so that the front of\nm_sessions keeps pointing at a still-playing session. It did this via:\n```\n auto sessions = this-\u003esessions();\n```\nsessions() returns WeakListHashSet\u003cPlatformMediaSessionInterface\u003e\u0026, but the\nmissing reference means auto deduces a value and copies the set. The subsequent\nremove()/insertBefore()/appendOrMoveToLast() calls therefore mutate a throwaway\ncopy, and the live m_sessions ordering is never updated. As a result\ncurrentSession() (which returns m_sessions.first()) can keep returning the\nsession that just paused instead of the one that should take over, which in turn\nfeeds the wrong value into computeSupportsSeeking() and the now-playing / remote\ncommand routing that depend on session order.\n\nFix it by taking a reference to the live set, and add an API test covering the\nordering after a pause.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/PlatformMediaSessionManagerTests.cpp\n\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.cpp:\n(WebCore::MediaSessionManagerInterface::sessionWillEndPlayback):\n* Tools/TestWebKitAPI/CMakeLists.txt:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebCore/PlatformMediaSessionManagerTests.cpp: Added.\n(TestWebKitAPI::TEST(PlatformMediaSessionManager, PausingFrontSessionDemotesItInCurrentSession)):\n\nCanonical link: https://commits.webkit.org/318276@main", "email": "cdumez@apple.com", "hash": "d058de4fcb0ca270323b9bd0d7a066646928175f", "subject": "MediaSessionManagerInterface::sessionWillEndPlayback reorders a copy of the session set" }, "318277@main": { "author": "Ian Gower", "avatar": "https://www.gravatar.com/avatar/cc2e677bc728b92e5463660d8b8d9ed8?d=identicon\u0026s=64", "cl": "318277@main", "clUrl": "https://commits.webkit.org/318277@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320674\nrdar://161198753\n\nReviewed by Simon Fraser.\n\nShowing one preview popover and hiding another land in the same render tree\nupdate. Attaching the new out-of-flow box discards the paragraph's line layout,\nso when the old box is torn down RenderInline::offsetForInFlowPositionedInline\ncan no longer find the anchor inline's first line box and falls back to a zero\noffset. The repaint is issued at the right size but the wrong origin, leaving\nthe pixels the box painted on screen.\n\nRepaint using the rect the layer cached while the geometry was still resolvable.\nLimited to tearing down an out-of-flow box whose container is an in-flow\npositioned inline.\n\nFollow-ups: offsetForInFlowPositionedInline cannot signal failure, since\ncomputeVisibleRectsInContainer already uses std::nullopt for \"nothing to\nrepaint\"; and invalidateLineLayout's InsertionOrRemoval path lacks the\nInlineWalker repaint that ContentChange does before dropping line layout.\n\nout-of-flow-inside-relative-inline.html covers this and had the displaced rect\nbaked into its baseline, so its \"PASS if no red\" was never actually met.\nRebaselined.\n\n* LayoutTests/fast/repaint/out-of-flow-inside-relative-inline-expected.txt:\n* Source/WebCore/rendering/updating/RenderTreeUpdater.cpp:\n(WebCore::repaintAndMarkContainingBlockDirtyBeforeTearDown):\n\nCanonical link: https://commits.webkit.org/318277@main", "email": "i_gower@apple.com", "hash": "a60246ff6a2efda4643bff69a44dc873094415cf", "subject": "Repaint artifacts on techmeme.com after returning to the page with the back button" }, "318278@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "318278@main", "clUrl": "https://commits.webkit.org/318278@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319126\nrdar://181946137\n\nReviewed by Matthew Finkel.\n\nHAVE(NETWORK_LOADER) was used when we still supported platforms without it.\nCFNetworkNetworkLoaderEnabled was used to enable it for local testing initially.\nnw_settings_get_unified_http_enabled was used to experiment with turning it on.\nnw_settings_get_unified_http_enabled_webkit was used to experiment with turning it on just for WebKit.\nIt's now on everywhere except applications linked before dyld_fall_2024_os_versions.\n\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/mac/TestExpectations:\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WTF/wtf/PlatformHave.h:\n* Source/WebCore/PAL/pal/spi/cf/CFNetworkSPI.h:\n* Source/WebCore/PAL/pal/spi/cocoa/NetworkSPI.h:\n* Source/WebKit/Configurations/AllowedSPI-legacy.toml:\n* Source/WebKit/NetworkProcess/NetworkSessionCreationParameters.h:\n* Source/WebKit/NetworkProcess/NetworkSessionCreationParameters.serialization.in:\n* Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm:\n(WebKit::NetworkSessionCocoa::NetworkSessionCocoa):\n* Source/WebKit/NetworkProcess/cocoa/NetworkSoftLink.h:\n* Source/WebKit/NetworkProcess/cocoa/NetworkSoftLink.mm:\n* Source/WebKit/UIProcess/WebsiteData/Cocoa/WebsiteDataStoreCocoa.mm:\n(WebKit::WebsiteDataStore::useNetworkLoader): Deleted.\n* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp:\n(WebKit::WebsiteDataStore::parameters):\n* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKHTTPCookieStore.mm:\n\nCanonical link: https://commits.webkit.org/318278@main", "email": "achristensen@apple.com", "hash": "e874b0bcb7a21f05409ca3c650864894ace264e0", "subject": "Clean up infrastructure for turning on new network loader" }, "318279@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "318279@main", "clUrl": "https://commits.webkit.org/318279@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=298890\nrdar://161114695\n\nReviewed by Darin Adler.\n\ntoRelatedAcuteAngle() is meant to return the acute angle from the vertical\naxis, but it only handled angles up to 270 degrees:\n```\n angle = toPositiveAngle(angle);\n if (angle \u003c 90)\n return angle;\n return std::abs(180 - angle);\n```\nFor an angle in the fourth quadrant it returned the obtuse supplement instead\nof an acute angle (e.g. 300 -\u003e 120, 315 -\u003e 135, 350 -\u003e 170). This fed wrong\nvalues into intersectionSide() and lengthOfRayIntersectionWithBoundingBox(),\nso an offset-path ray() with a 'sides' size and a fourth-quadrant angle picked\nthe wrong box side and produced an incorrect (sometimes negative) ray length,\nplacing the element in the wrong position.\n\nFold the angle into [0, 90] for every quadrant by reducing it modulo 180 and\ntaking the smaller of the angle and its supplement. This matches the previous\nbehavior for angles in [0, 270] and fixes the (270, 360) range.\n\nTest: imported/w3c/web-platform-tests/css/motion/offset-path-ray-sides-fourth-quadrant.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/motion/offset-path-ray-sides-fourth-quadrant-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/motion/offset-path-ray-sides-fourth-quadrant-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/motion/offset-path-ray-sides-fourth-quadrant.html: Added.\n* Source/WebCore/platform/graphics/GeometryUtilities.cpp:\n(WebCore::toRelatedAcuteAngle):\n(WebCore::toPositiveAngle):\n\nCanonical link: https://commits.webkit.org/318279@main", "email": "cdumez@apple.com", "hash": "3c1f378072db455b9d588cd5bc8cac5106d08e80", "subject": "toRelatedAcuteAngle in GeometryUtilities.cpp doesn't handle an angle greater than 270 degrees" }, "318280@main": { "author": "Cole Carley", "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64", "cl": "318280@main", "clUrl": "https://commits.webkit.org/318280@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320672\nrdar://183653434\n\nReviewed by Keith Miller.\n\nWhen linking a table import, we validated the element type, 'initial', and\n'maximum', but never compared the address type of the provided table against\nthe one declared by the importing module. As a result an i32 table could\nsatisfy a table64 import (and vice versa), instead of throwing a LinkError.\n\nThis fixes the 8 failing subtests in the imported WPT memory64-imports test\ncovering memory64-imports.wast:53, 57, 61 and 65.\n\n* LayoutTests/imported/w3c/web-platform-tests/wasm/core/memory64/memory64-imports.wast.js-expected.txt:\n* Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp:\n(JSC::WebAssemblyModuleRecord::initializeImports):\n\nCanonical link: https://commits.webkit.org/318280@main", "email": "ccarley2@apple.com", "hash": "862994e2cc372c16a11440b96b4f5c34158431f2", "subject": "[Memory64] Wasm table imports don't check that the address type matches" }, "318281@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "318281@main", "clUrl": "https://commits.webkit.org/318281@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320636\n\nReviewed by Darin Adler.\n\nSVGFEDropShadowElement::setFilterEffectAttribute() updated the drop-shadow's\nstandard deviation with:\n```\n return effect.setStdDeviationX(stdDeviationX()) || effect.setStdDeviationY(stdDeviationY());\n```\nFEDropShadow::setStdDeviationX() returns true when the x deviation actually\nchanges, so the || short-circuits and setStdDeviationY() is never called. When\nthe stdDeviation attribute of an already-built feDropShadow is changed (via\nsetAttribute or SMIL) such that its x component changes, the y component of the\neffect is left stale and the shadow is repainted with the wrong vertical blur.\n\nEvaluate both setters into separate booleans before combining them, matching\nthe pattern already used by SVGFEGaussianBlurElement.\n\nTest: imported/w3c/web-platform-tests/css/filter-effects/svg-mutation-fedropshadow-stddeviation.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/filter-effects/svg-mutation-fedropshadow-stddeviation-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/filter-effects/svg-mutation-fedropshadow-stddeviation-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/filter-effects/svg-mutation-fedropshadow-stddeviation.html: Added.\n* Source/WebCore/svg/SVGFEDropShadowElement.cpp:\n(WebCore::SVGFEDropShadowElement::setFilterEffectAttribute):\n\nCanonical link: https://commits.webkit.org/318281@main", "email": "cdumez@apple.com", "hash": "9636543604b585aaebbfc937370f05d0eace4574", "subject": "feDropShadow ignores stdDeviation Y update when X changes" }, "318282@main": { "author": "Cole Carley", "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64", "cl": "318282@main", "clUrl": "https://commits.webkit.org/318282@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320681\nrdar://183666875\n\nReviewed by Keith Miller.\n\nWe rejected at parse time any memory declaring more than 65,536 pages,\nregardless of index type. This is right for only the memory32 case.\nThe JS API limits a 64-bit memory's min and max to 2^37-1 pages, which\nis far more than can be allocated. Such a module must compile and fail\nat instantiation instead.\n\nBound the declared limits by index type in the memory section parser, using\nnew limits in WasmLimits.h alongside the other JS API limits it mirrors. A\ndeclaration above what can be allocated is still rejected by\nMemory::tryCreate(), matching how oversized table sizes are handled.\n\nPageCount's sentinel for \"no page count\" moves from UINT_MAX to UINT64_MAX:\n2^32-1 pages is now a legal declared page count, so it can no longer double\nas the sentinel.\n\nNote that memory64.wast.js still fails at memory64.wast:8 and :9, which\ndeclare 2^48 pages. That is the core spec's bound; the JS API's is lower, and\nthe imported wasm/core tests do not account for it. This behavior matches\nChrome, and FireFox.\n\n* JSTests/wasm/stress/memory64-oversized-limits.js: Added.\n(leb128):\n(moduleBytesWithMemoryLimits):\n* Source/JavaScriptCore/runtime/PageCount.h:\n(JSC::PageCount::PageCount):\n(JSC::PageCount::operator bool const):\n* Source/JavaScriptCore/wasm/WasmLimits.h:\n* Source/JavaScriptCore/wasm/WasmSectionParser.cpp:\n(JSC::Wasm::SectionParser::parseMemoryHelper):\n\nCanonical link: https://commits.webkit.org/318282@main", "email": "ccarley2@apple.com", "hash": "bf0425598904dd7ae7929e7e9e4ac248d93b9bdd", "subject": "[Memory64] Expand memory's declared limits in Memory64 case" }, "318283@main": { "author": "Eric Carlson", "avatar": "https://www.gravatar.com/avatar/e227ff07cc6d645fc1c69fd56c2c8cb8?d=identicon\u0026s=64", "cl": "318283@main", "clUrl": "https://commits.webkit.org/318283@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320689\nrdar://183672900\n\nReviewed by Jean-Yves Avenard.\n\nAudioContext::stop() (document/frame teardown) stopped the audio thread but never removed the\ncontext's PlatformMediaSession -- unlike close(), it left the session registered with the manager\nuntil the context was garbage-collected, keeping the audio session (and NowPlaying) alive on behalf\nof a context whose frame was already gone.\n\nRemove the media session in stop(), mirroring close(). setActive(false) is a no-op if the context\nnever activated.\n\nTest: platform/mac/media/webaudio-session-removed-when-frame-is-destroyed.html\n\n* LayoutTests/platform/mac/media/webaudio-session-removed-when-frame-is-destroyed-expected.txt: Added.\n* LayoutTests/platform/mac/media/webaudio-session-removed-when-frame-is-destroyed.html: Added.\n* Source/WebCore/Modules/webaudio/AudioContext.cpp:\n(WebCore::AudioContext::stop):\n\nCanonical link: https://commits.webkit.org/318283@main", "email": "eric.carlson@apple.com", "hash": "9f60bad504c7d2484e156301d360042fc318dc1a", "subject": "[WebAudio] AudioContext leaves its media session registered after frame teardown" }, "318284@main": { "author": "Ryosuke Niwa", "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64", "cl": "318284@main", "clUrl": "https://commits.webkit.org/318284@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320577\n\nReviewed by Geoffrey Garen.\n\nUse __builtin_trap instead of inline asm when running safer C++ static analysis\nsince no-delete analysis gets confused with inline asm.\n\nNo new tests since there should be no behavior changes.\n\n* Source/JavaScriptCore/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/WTF/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/WTF/wtf/Assertions.h:\n\nCanonical link: https://commits.webkit.org/318284@main", "email": "rniwa@webkit.org", "hash": "5b84cf3719fa3c23a2cf8bac7a029738c723aebc", "subject": "__builtin_trap instead of inline asm when running clang static analyzer" }, "318285@main": { "author": "Kiet Ho", "avatar": "https://www.gravatar.com/avatar/d9058b37006dce1f55f91b8ccc82f9a3?d=identicon\u0026s=64", "cl": "318285@main", "clUrl": "https://commits.webkit.org/318285@main", "description": "rdar://183562156\nhttps://bugs.webkit.org/show_bug.cgi?id=320587\n\nReviewed by Tim Nguyen.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/7aed6630812b20e6eec2a2e40594f8dfda036e00\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/resources/resource-files.json:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/at-supports-matches-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/at-supports-matches.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/at-supports-named-feature-001-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/at-supports-named-feature-001.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/at-container-style-parsing-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/at-container-style-parsing.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/comma-separated-invalidation-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/comma-separated-invalidation.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/comma-separated-skip-invalid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/comma-separated-skip-invalid.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/container-rule-cssom-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/container-rule-cssom.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/container-size-rem-change-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/container-size-rem-change.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/container-units-svglength.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/crashtests/chrome-bug-491994185-crash.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/crashtests/container-query-nested-oof-invalidation-crash.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/crashtests/svg-resource-in-container-crash.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/crashtests/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/first-letter-outside-size-container-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/first-letter-outside-size-container.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/multiple-conditions-001-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/multiple-conditions-001-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/multiple-conditions-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/nested-style-size-container-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/nested-style-size-container.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/query-container-name-dynamic-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/query-container-name-dynamic.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/query-container-name-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/query-container-name.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/query-evaluation-style-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/query-evaluation-style.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/query-style-color-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/query-style-color-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/query-style-color.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/scroll-state/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/scroll-state/scroll-state-stuck-snapshot-after-scroll.tentative.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/scroll-state/scroll-state-stuck-snapshot.tentative.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/scroll-state/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/size-container-popover-change-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/size-container-popover-change.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/size-query-with-var-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/size-query-with-var.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/style-query-attr-change-svg-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/style-query-attr-change-svg.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/style-query-change-with-ancestor-zoom-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/style-query-change-with-ancestor-zoom.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/style-query-container-name-change-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/style-query-container-name-change.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/style-query-custom-attr-change-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/style-query-custom-attr-change-named-container-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/style-query-custom-attr-change-named-container.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/style-query-custom-attr-change.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/style-query-registered-custom-em-change-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/style-query-registered-custom-em-change.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/style-query-registered-custom-removed-initial-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/style-query-registered-custom-removed-initial.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/style-query-with-container-name-custom-change-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/style-query-with-container-name-custom-change.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/style-range-dynamic-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/style-range-dynamic.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/support/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/svg-foreignobject-child-container.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/svg-foreignobject-no-size-container.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/svg-root-size-container.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/crashtests/supports-malformed.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/crashtests/w3c-import.log: Copied from LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/reference/w3c-import.log.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/js/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/js/supports-at-rule-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/js/supports-at-rule.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/js/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/match-container.tentative-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/match-container.tentative.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/reference/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/support/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/w3c-import.log:\n\nCanonical link: https://commits.webkit.org/318285@main", "email": "kiet.ho@apple.com", "hash": "20a1cf5457e6e74c79074fe0db688fc2d672f616", "subject": "[css-conditional] Re-import WPT /css/css-conditional" }, "318286@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "318286@main", "clUrl": "https://commits.webkit.org/318286@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=294584\n\nReviewed by Yusuke Suzuki.\n\nAdd DEFINE_IPINT_THUNK_FOR_ENTRY for the IPInt function entry thunk,\nmirroring DEFINE_IPINT_THUNK_FOR_CATCH. Entry is only used under\nENABLE(JIT) (callers fall back to ipint_trampoline otherwise), so the\nmacro and definition stay JIT-only and always use\ngenerateThunkWithJumpToPrologue, matching the previous hand-rolled thunk.\n\n* Source/JavaScriptCore/llint/LLIntThunks.cpp:\n\nCanonical link: https://commits.webkit.org/318286@main", "email": "chi187@gmail.com", "hash": "51d3dbaa278ef8b8283ec7172bc4913256ea366a", "subject": "[JSC][Wasm] Add DEFINE_IPINT_THUNK_FOR_ENTRY for IPInt entry" }, "318287@main": { "author": "lilly", "avatar": "https://www.gravatar.com/avatar/d0533d52eeb271270df480f37629a407?d=identicon\u0026s=64", "cl": "318287@main", "clUrl": "https://commits.webkit.org/318287@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320590\nrdar://183564957\n\nReviewed by Simon Fraser.\n\nNon-round corner-shape corners don't follow their geometry when a decoration\nis offset from the border box, outlines (with outline-offset) and box-shadow\nspread. Scaling the corner radii on the moved rect only works for corners that\nmeet their edges tangentially, so shapes that don't (or have no radius to scale)come\nout wrong across the board, not just the exact-shape corners.\n\nPasses tests written in another commit\n\n* Source/WebCore/platform/graphics/BezierUtilities.cpp:\n(WebCore::pointOnBezierAtParameter):\n(WebCore::resampleByArcLength):\n(WebCore::hermiteInterpolate):\n(WebCore::addCatmullRomBeziers):\n* Source/WebCore/platform/graphics/BezierUtilities.h:\n* Source/WebCore/platform/graphics/CornerShapeUtilities.cpp:\n(WebCore::borderContourPath):\n* Source/WebCore/platform/graphics/CornerShapeUtilities.h:\n* Source/WebCore/rendering/BorderShape.cpp:\n(WebCore::BorderShape::shapeForOffsetRect):\n(WebCore::BorderShape::shapeWithBorderWidths const):\n(WebCore::cornersHaveConvexSuperellipse):\n(WebCore::cornersUseAlignedToCurveOffset):\n(WebCore::addAlignedToCurveOffsetContour):\n(WebCore::BorderShape::pathForOuterCornerShape const):\n(WebCore::BorderShape::pathForInnerCornerShape const):\n(WebCore::BorderShape::fillRectWithInnerHoleShape const):\n* Source/WebCore/rendering/BorderShape.h:\n(WebCore::BorderShape::shapeForOffsetRect):\n* Source/WebCore/rendering/OutlinePainter.cpp:\n(WebCore::OutlinePainter::paintOutline const):\n(WebCore::OutlinePainter::paintFocusRing const):\n\nCanonical link: https://commits.webkit.org/318287@main", "email": "173393835+cupidsity@users.noreply.github.com", "hash": "f0f0f788dff03626596509029957a1fd63411667", "subject": "corner-shape: corners are mis-positioned/mis-shaped on outlines and box-shadow spread" }, "318288@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "318288@main", "clUrl": "https://commits.webkit.org/318288@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320623\n\nReviewed by Darin Adler.\n\nFileReader::abort() early-returns when m_finishedLoading is true. That flag is\nset inside the didFinishLoading task and was intended (230152@main) only to\npreserve behavior when abort() is called re-entrantly from within the last\nonprogress event. However, m_finishedLoading was never reset when a new read\nstarted, so once any read completed the flag stayed true for the lifetime of the\nFileReader.\n\nAs a result, reusing a FileReader (which is allowed by the spec once readyState\nis no longer LOADING) left abort() permanently disabled: a subsequent read that\nis genuinely in progress could not be aborted, and instead of firing\nabort/loadend it ran to completion and delivered load and a result.\n\nReset m_finishedLoading = false in readInternal() when starting a new read, so\nthe guard is once again scoped to the intended last-onprogress-event window.\n\nNo new tests, updated imported/w3c/web-platform-tests/FileAPI/reading-data-section/filereader_abort.any.js.\n\n* LayoutTests/imported/w3c/web-platform-tests/FileAPI/reading-data-section/filereader_abort.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/FileAPI/reading-data-section/filereader_abort.any.js:\n(promise_test.t.return.eventWatcher.wait_for.string_appeared_here.then.eventWatcher.wait_for.string_appeared_here.then.eventWatcher.wait_for.string_appeared_here.then):\n(promise_test.t.then):\n* LayoutTests/imported/w3c/web-platform-tests/FileAPI/reading-data-section/filereader_abort.any.worker-expected.txt:\n* Source/WebCore/fileapi/FileReader.cpp:\n(WebCore::FileReader::readInternal):\n\nCanonical link: https://commits.webkit.org/318288@main", "email": "cdumez@apple.com", "hash": "40bdd4bde9f5fb62c2d3b7e0c5377caf5f34e488", "subject": "FileReader.abort() is silently ignored on a reused reader after a prior read completes" }, "318289@main": { "author": "Phinehas Fuachie", "avatar": "https://www.gravatar.com/avatar/900d85de8c325e38975f39115c36bb75?d=identicon\u0026s=64", "cl": "318289@main", "clUrl": "https://commits.webkit.org/318289@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320204\nrdar://164521127\n\nReviewed by Alex Christensen.\n\nUnder Site Isolation, removing a cross-origin \u003ciframe\u003e and re-inserting it with its src still set\ncan issue two navigations on the same frame in quick succession. The second navigation supersedes\nthe first, replacing the frame's provisional frame; the first navigation then reports a\ncancellation (NSURLErrorCancelled).\n\ndidFailProvisionalLoadForFrameShared unconditionally tore down the frame's current provisional\nframe on that cancellation, destroying the second (healthy) provisional frame that was still\nloading. As a result the navigation never committed and the frame stayed stuck on its initial empty\ndocument (about:blank), so cross-origin content such as a re-inserted media embed never loaded.\n\nTag each ProvisionalFrameProxy with the NavigationIdentifier it was created for and only tear down\nthe current provisional frame when the failing navigation is the one that owns it. A superseded\nnavigation's stale cancellation is now ignored, leaving the live provisional frame intact to\ncommit. This mirrors the existing supersession check in ProvisionalPageProxy::validateInput().\n\nTest: http/tests/site-isolation/iframe-reinsert-same-src-commits.html\n\n* LayoutTests/http/tests/site-isolation/iframe-reinsert-same-src-commits-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/iframe-reinsert-same-src-commits.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/frame-reports-commit-to-top.html: Added.\n* Source/WebKit/UIProcess/ProvisionalFrameProxy.cpp:\n(WebKit::ProvisionalFrameProxy::ProvisionalFrameProxy):\n* Source/WebKit/UIProcess/ProvisionalFrameProxy.h:\n(WebKit::ProvisionalFrameProxy::navigationID const):\n* Source/WebKit/UIProcess/WebFrameProxy.cpp:\n(WebKit::WebFrameProxy::prepareForProvisionalLoadInProcess):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::didFailProvisionalLoadForFrameShared):\n\nCanonical link: https://commits.webkit.org/318289@main", "email": "pfuachie2@apple.com", "hash": "0b53fc9713a27a7af61a06931ff125a4abe86af9", "subject": "[Site Isolation] Cross-origin iframe stuck at about:blank after removal and re-insertion" }, "318290@main": { "author": "Megan Gardner", "avatar": "https://www.gravatar.com/avatar/b466a5bcbfabf4d82a8ecc595db5a531?d=identicon\u0026s=64", "cl": "318290@main", "clUrl": "https://commits.webkit.org/318290@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320542\nrdar://183500253\n\nUnreviewed updating test expectations.\n\nimported/w3c/web-platform-tests/css/css-highlight-api/painting/custom-highlight-painting-below-selection-transparency.html\nimported/w3c/web-platform-tests/css/css-highlight-api/painting/custom-highlight-painting-020.html\n\n* LayoutTests/TestExpectations:\n* LayoutTests/platform/ios/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318290@main", "email": "megan_gardner@apple.com", "hash": "1ea4cf62abc937d371ac58ebbdaf71329c8c7dfb", "subject": "[Custom Highlight] Remove stale ImageOnlyFailure expectations for now-passing highlight painting tests." }, "318291@main": { "author": "Jessica Lee", "avatar": "https://www.gravatar.com/avatar/fc717c99321d09f31fb9187418a8ffc5?d=identicon\u0026s=64", "cl": "318291@main", "clUrl": "https://commits.webkit.org/318291@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320714\nrdar://183700247\n\nReviewed by Chris Dumez.\n\nChange Jessica Lee's contributor status to WebKit reviewer\n\n* metadata/contributors.json:\n\nCanonical link: https://commits.webkit.org/318291@main", "email": "jlee53@apple.com", "hash": "8a83b308dfd3ffbbdd205c4d81ef996ef6ce29c9", "subject": "Change Jessica Lee's contributor status to WebKit reviewer" }, "318292@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "318292@main", "clUrl": "https://commits.webkit.org/318292@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320341\n\nReviewed by Yusuke Suzuki.\n\nSince 317844@main, hostResolveImportedModule looks up [[LoadedModules]] by specifier\nalone, probing each ScriptFetchParameters::Type in a fixed order (JavaScript first).\nWhen one specifier is loaded under two types, JSON/WebAssembly-typed bindings resolve\nagainst the JavaScript module:\n\n // a.js contains `42`, run with --useImportDefer=1\n import jsonValue from \"./a.js\" with { type: \"json\" }; // SyntaxError: no default export in the JavaScript module\n import defer * as ns from \"./a.js\";\n\nThis patch:\n\n1. Records the request's ScriptFetchParameters::Type in ImportEntry, ExportEntry, and\n star export entries, and makes hostResolveImportedModule an exact (specifier, type)\n lookup. The enum fits existing struct padding, so entry sizes are unchanged.\n\n2. Dedups ModuleAnalyzer's requested modules by (specifier, type) instead of specifier\n alone, so two same-specifier requests with different types are both loaded.\n\n3. Keys m_starExportEntries by (module name, type) instead of module name alone (still\n an OrderedHashSet, so occurrence order is preserved), which keeps `export * from \"./a\"`\n and `export * from \"./a\" with { type: \"json\" }` distinct.\n\nTests: JSTests/modules/import-attributes-same-specifier-different-type.js\n JSTests/modules/import-attributes-same-specifier-same-phase.js\n\n* JSTests/modules/import-attributes-same-specifier-different-type.js: Added.\n* JSTests/modules/import-attributes-same-specifier-same-phase.js: Added.\n* JSTests/modules/resources/dual-type-reexport.js: Added.\n* JSTests/modules/resources/dual-type.js: Added.\n* Source/JavaScriptCore/parser/ModuleAnalyzer.cpp:\n(JSC::ModuleAnalyzer::appendRequestedModule):\n(JSC::ModuleAnalyzer::exportVariable):\n* Source/JavaScriptCore/parser/ModuleAnalyzer.h:\n* Source/JavaScriptCore/parser/NodesAnalyzeModule.cpp:\n(JSC::ImportDeclarationNode::analyzeModule):\n(JSC::ExportAllDeclarationNode::analyzeModule):\n(JSC::ExportNamedDeclarationNode::analyzeModule):\n* Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp:\n(JSC::AbstractModuleRecord::addStarExportEntry):\n(JSC::AbstractModuleRecord::ExportEntry::createLocal):\n(JSC::AbstractModuleRecord::ExportEntry::createIndirect):\n(JSC::AbstractModuleRecord::ExportEntry::createNamespace):\n(JSC::AbstractModuleRecord::hostResolveImportedModule):\n(JSC::AbstractModuleRecord::resolveImport):\n(JSC::AbstractModuleRecord::resolveExportImpl):\n(JSC::AbstractModuleRecord::resolveExport):\n(JSC::AbstractModuleRecord::getModuleNamespace):\n(JSC::AbstractModuleRecord::dump):\n* Source/JavaScriptCore/runtime/AbstractModuleRecord.h:\n* Source/JavaScriptCore/runtime/CyclicModuleRecord.cpp:\n(JSC::CyclicModuleRecord::initializeEnvironment):\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp:\n(JSC::JSWebAssemblyInstance::tryCreate):\n* Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp:\n(JSC::WebAssemblyModuleRecord::initializeImports):\n\nCanonical link: https://commits.webkit.org/318292@main", "email": "sosuke@bun.sh", "hash": "90b2ecf79ae30cf5c76d5a8ae6b6761a474f347b", "subject": "[JSC] `hostResolveImportedModule` should respect the module request's import attribute type" }, "318293@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "318293@main", "clUrl": "https://commits.webkit.org/318293@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320620\n\nReviewed by Yusuke Suzuki and Keith Miller.\n\nThe sane-chain speculation for the indexed enumerator mode was guarded\nonly by benefitsFromOriginalArray(), which checks the indexing type but\nnot the array class. As a result an array with a custom prototype got\nInBoundsSaneChain and DFG/FTL skipped hole checks against the prototype,\ndiverging from LLInt/baseline. Check isJSArrayWithOriginalStructure()\nfirst, like every other sane-chain site in fixup does.\n\nTest: JSTests/stress/for-in-enumerator-hole-with-inherited-index-custom-prototype.js\n\n* JSTests/stress/for-in-enumerator-hole-with-inherited-index-custom-prototype.js: Added.\n(shouldBe):\n(mutate):\n(test):\n(makeArray):\n* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:\n(JSC::DFG::FixupPhase::fixupNode):\n\nCanonical link: https://commits.webkit.org/318293@main", "email": "sosuke@bun.sh", "hash": "1566615170ec213c8f5c9188609d7b03fe245118", "subject": "[JSC] `EnumeratorNextUpdateIndexAndMode` should require the original array structure before using `InBoundsSaneChain`" }, "318294@main": { "author": "Przemyslaw Gorszkowski", "avatar": "https://www.gravatar.com/avatar/e543ed682c6f99c866b01ca9bcbab360?d=identicon\u0026s=64", "cl": "318294@main", "clUrl": "https://commits.webkit.org/318294@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320635\n\nReviewed by Carlos Alberto Lopez Perez.\n\nRunner.pm now resolves its default expectations file based on\nplatform: expectations-linux.yaml on Linux, expectations.yaml\neverywhere else. This lets glib/wpe test262 results be tracked\nseparately from other ports without requiring --expectations on\nevery invocation.\n\nReuse expectations.yaml to create expectations-linux.yaml\nso existing known failures carry over as the starting baseline.\n\n* JSTests/test262/expectations-linux.yaml: Added.\n* Tools/Scripts/test262/Runner.pm:\n\nCanonical link: https://commits.webkit.org/318294@main", "email": "pgorszkowski@igalia.com", "hash": "f0dbc4c6b9d1bc9c9db77f9708d92d4ba0b4eb59", "subject": "[WPE][GTK] use a separate expectations file for test262" }, "318295@main": { "author": "Marcos Caceres", "avatar": "https://www.gravatar.com/avatar/d31c9c6a3b0af558a2945682020e5b90?d=identicon\u0026s=64", "cl": "318295@main", "clUrl": "https://commits.webkit.org/318295@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320721\nrdar://183702924\n\nReviewed by Chris Dumez.\n\nAdded reviewer status to metadata/contributors.json for Marcos Caceres.\n\n* metadata/contributors.json:\n\nCanonical link: https://commits.webkit.org/318295@main", "email": "marcosc@apple.com", "hash": "4d8aff4e67b3895eab31f0d9b2784b30fe658901", "subject": "Grant Marcos Caceres reviewer status" }, "318296@main": { "author": "Ryosuke Niwa", "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64", "cl": "318296@main", "clUrl": "https://commits.webkit.org/318296@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320410\n\nReviewed by Simon Fraser.\n\nOn iOS with site isolation enabled, text-selection gestures inside a cross-origin iframe were broken in\nseveral ways because the gesture machinery assumed the selection target lived in the main frame's process:\n\n * Long-pressing text in a cross-origin iframe selected the whole iframe element in the parent frame\n instead of a word inside it, because the gesture was never routed into the subframe's process.\n * Focus never moved into the subframe: updateFocusBeforeSelectingTextAtLocation() used localMainFrame(),\n which is null in the subframe's process.\n * The selection highlight was drawn at the wrong offset, since the subframe reports selection rects in\n its own local root-view coordinates rather than offset by the iframe's position in the top-level page.\n * The highlight \"flashed\" at the wrong location on touch-down and only corrected on move/up, because\n UIKit reads selection rects synchronously mid-gesture, so any asynchronous UI-process coordinate\n conversion arrives too late.\n * After scrolling the iframe, tapping, clicking links, and selecting all hit-tested at the wrong location\n due to double conversions of coordinates.\n\nFixes: route selectWithGesture and selectTextWithGranularityAtPoint into the process containing the target\nframe via RemoteUserInputEventData, fix focus to use localRootFrame(), and convert selection rects to\nmain-frame coordinates in the web process (rather than the UI process) so UIKit reads correct coordinates\nsynchronously. The web process obtains the frame's offset within the top-level page through a channel\npushed from the parent process.\n\nThe scrolling bug was a double-applied scroll offset: RemoteFrameGeometryTransformer converted a point all\nthe way to the remote frame's contents coordinates (via rootViewToContents()), but every consumer delivers\nthe transformed point into the remote frame's process as a root-view point and re-converts it with\nrootViewToContents(), applying the remote frame's scroll offset a second time. Transform to the remote\nframe's root-view coordinates (convertFromRootView()) instead, so scroll is applied exactly once during\nhit-testing. This is the shared input transform, so it fixes tap, link activation, and selection alike.\n\nAlso rename the offset plumbing that was reusing the accessibility offset channel: the value it carries\n(a remote frame's content origin in main-frame coordinates) is the same for accessibility and selection,\nso drop the misleading \"Accessibility\" qualifier and store it unconditionally rather than only when\naccessibility is active. The accessibility-specific WebCore client interface and the Mac accessibility\nelement accessor keep their existing names.\n\n* LayoutTests/TestExpectations: Skip http/tests/site-isolation/ios by default.\n* LayoutTests/http/tests/site-isolation/ios/long-press-selection-highlight-position-in-cross-origin-iframe-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/ios/long-press-selection-highlight-position-in-cross-origin-iframe.html: Added.\n* LayoutTests/http/tests/site-isolation/ios/long-press-selects-word-in-cross-origin-iframe-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/ios/long-press-selects-word-in-cross-origin-iframe.html: Added.\n* LayoutTests/http/tests/site-isolation/ios/long-press-selects-word-in-scrolled-cross-origin-iframe-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/ios/long-press-selects-word-in-scrolled-cross-origin-iframe.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/scrollable-selectable-text-frame.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/selectable-text-frame.html: Added.\n* Source/WebCore/accessibility/AccessibilityScrollView.cpp: Updated for the rename.\n(WebCore::AccessibilityScrollView::addRemoteFrameChild):\n* Source/WebCore/page/RemoteFrame.cpp:\n(WebCore::RemoteFrame::updateRemoteFrameOffsetInMainFrame): Renamed from\n(WebCore::RemoteFrame::updateRemoteFrameAccessibilityOffset): Deleted.\nupdateRemoteFrameAccessibilityOffset.\n* Source/WebCore/page/RemoteFrame.h:\n* Source/WebCore/page/RemoteFrameClient.h: Ditto.\n* Source/WebCore/page/RemoteFrameGeometryTransformer.cpp:\n(WebCore::RemoteFrameGeometryTransformer::transformToRemoteFrameCoordinates const):\nroot-view coordinates instead of contents coordinates so the remote frame's scroll offset is not applied twice.\n* Source/WebCore/page/RemoteFrameView.cpp:\n(WebCore::RemoteFrameView::setFrameRect): Push the frame's origin in main-frame coordinates to its process.\n* Source/WebKit/UIProcess/API/ios/WKWebViewTestingIOS.mm:\n(-[WKWebView _selectionBoundingRectInMainFrameCoordinatesForTesting:]): Read the rect directly.\n* Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm:\n(WebKit::WebPageProxy::selectWithGesture):\n(WebKit::WebPageProxy::selectTextWithGranularityAtPoint): Re-dispatch into the remote frame, reporting\nthe gesture point in content-view coordinates.\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::updateRemoteFrameOffsetInMainFrame): Renamed.\n(WebKit::WebPageProxy::pushCumulativeOffsetInMainFrame):\n(WebKit::WebPageProxy::updateRemoteFrameAccessibilityOffset): Deleted.\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.messages.in: Renamed message; added frame-routed selection.\n* Source/WebKit/UIProcess/WebPageProxy.swift: Updated selection callers.\n* Source/WebKit/UIProcess/WebPageProxyInternals.h:\n* Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm: Pass the target frame identifier; read converted\n(-[WKContentView lookupForWebView:]):\n(-[WKContentView shareForWebView:]):\n(-[WKContentView translateForWebView:]):\n(-[WKContentView addShortcutForWebView:]):\n(-[WKContentView changeSelectionWithGestureAt:withGesture:withState:withFlags:]):\n(-[WKContentView selectTextWithGranularity:atPoint:completionHandler:]):\nrects from the editor state directly at the menu callsites.\n* Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm: Removed the UI-process selection-rect conversion path in\n(WebKit::WebPageProxy::didUpdateEditorState):\n(WebKit::WebPageProxy::convertEditorStateSelectionRectToMainFrameCoordinates): Deleted.\nfavor of web-process conversion.\n* Source/WebKit/WebProcess/WebCoreSupport/WebRemoteFrameClient.cpp:\n(WebKit::WebRemoteFrameClient::updateRemoteFrameOffsetInMainFrame): Renamed.\n(WebKit::WebRemoteFrameClient::updateRemoteFrameAccessibilityOffset): Deleted.\n* Source/WebKit/WebProcess/WebCoreSupport/WebRemoteFrameClient.h:\n* Source/WebKit/WebProcess/WebCoreSupport/cocoa/WebLocalFrameLoaderClientCocoa.mm:\n(WebKit::WebLocalFrameLoaderClient::accessibilityRemoteFrameOffset): Call the renamed WebPage getter.\n* Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm:\n(WebKit::remoteUserInputEventDataForSelectionGesture):\n(WebKit::WebPage::selectWithGesture):\n(WebKit::WebPage::updateFocusBeforeSelectingTextAtLocation):\n(WebKit::WebPage::selectPositionAtPoint):\n(WebKit::WebPage::setSelectionRange): Use localRootFrame(frameID).\n(WebKit::WebPage::selectTextWithGranularityAtPoint): Re-route to the remote subframe.\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::updateRemotePageOffsetInMainFrame): Renamed from\n(WebKit::WebPage::updateRemotePageAccessibilityOffset): Deleted.\nupdateRemotePageAccessibilityOffset.\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.messages.in:\n* Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm:\n(WebKit::WebPage::getPlatformEditorState const):\n(WebKit::WebPage::updateRemotePageOffsetInMainFrame):\n(WebKit::WebPage::remoteFrameOffsetInMainFrame): Renamed; store the offset unconditionally.\n(WebKit::WebPage::updateRemotePageAccessibilityOffset): Deleted.\n(WebKit::WebPage::accessibilityRemoteFrameOffset): Deleted.\n* Source/WebKit/WebProcess/WebPage/mac/WebPageMac.mm:\n(WebKit::WebPage::updateRemotePageOffsetInMainFrame):\n(WebKit::WebPage::remoteFrameOffsetInMainFrame): Renamed.\n(WebKit::WebPage::updateRemotePageAccessibilityOffset): Deleted.\n(WebKit::WebPage::accessibilityRemoteFrameOffset): Deleted.\n\nCanonical link: https://commits.webkit.org/318296@main", "email": "rniwa@webkit.org", "hash": "74c70a5bc37390b462456e98ffc3a00c6c8a172f", "subject": "[Site Isolation][iOS] Long tap does not select a word inside a cross-origin iframe" }, "318297@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "318297@main", "clUrl": "https://commits.webkit.org/318297@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320579\nrdar://183557495\n\nReviewed by Chris Dumez.\n\ndidReceiveData() resolved the final response charset into m_responseEncoding on\nevery chunk, costing a media type parse and a String allocation per network\ncallback. It was only read by finalResponseCharset() feeding createDecoder(),\nwhich runs once per load, and neither input can change in between:\noverrideMimeType() and the responseType setter throw once the state reaches\nLOADING.\n\nResolve the charset directly from the two inputs in finalResponseCharset(), per\n\u003chttps://xhr.spec.whatwg.org/#final-charset\u003e, and remove m_responseEncoding.\nThis also drops a second extractCharsetFromMediaType() call that could never\nmatch, since its input was that same parser's output. No behavior change.\n\nAdd coverage for a charset spanning chunk boundaries; the existing\noverrideMimeType() tests all use single-chunk responses.\n\nTest: imported/w3c/web-platform-tests/xhr/overridemimetype-chunked-response.window.html\n\n* LayoutTests/imported/w3c/web-platform-tests/xhr/overridemimetype-chunked-response.window-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/xhr/overridemimetype-chunked-response.window.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/xhr/overridemimetype-chunked-response.window.js: Added.\n(chunkedURL):\n(async_test.t.client.onload.t.step_func_done):\n* LayoutTests/imported/w3c/web-platform-tests/xhr/resources/content-in-chunks.py: Added.\n(main):\n* Source/WebCore/xml/XMLHttpRequest.cpp:\n(WebCore::XMLHttpRequest::clearResponseBuffers):\n(WebCore::XMLHttpRequest::didFinishLoading):\n(WebCore::XMLHttpRequest::finalResponseCharset const):\n(WebCore::XMLHttpRequest::didReceiveData):\n* Source/WebCore/xml/XMLHttpRequest.h:\n\nCanonical link: https://commits.webkit.org/318297@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "3524e0b12a24b4427183d7789b4ca9f9436b783b", "subject": "[XHR] Final response charset is recomputed for every received data chunk" }, "318298@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "318298@main", "clUrl": "https://commits.webkit.org/318298@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320676\nrdar://183655373\n\nReviewed by Yijia Huang.\n\n1. Introduce cachedModFixed, which is basically 1:1 version of cachedMod\n but it uses fixed size for input so that it can streamline the\n computation, making it significantly faster. We use N=4 threshold to\n expand this code to handle small division incredibly faster.\n2. Previously, we were using Comba multiplication only for NxN fixed\n sized multiplication. But this patch extends and applies broadly. We\n add multiplyComba. We rename old multiplyComba to multiplyCombaFixed.\n multiplyComba can handle non NxN fixed sized cases.\n3. Rename Textbook to Schoolbook.\n4. multiplySpecialLow and multiplySpecialHigh are used for division\n specially so far. And we made it using Comba multiplication as well.\n\nNote that Comba multiplication is simple idea.\n\n a6 a5 a4 a3 a2 a1 a0\n x b6 b5 b4 b3 b2 b1 b0\n --------------------------------------\n a6b0 a5b0 a4b0 a3b0 a2b0 a1b0 a0b0\n a6b1 a5b1 a4b1 a3b1 a2b1 a1b1 a0b1\n a6b2 a5b2 a4b2 a3b2 a2b2 a1b2 a0b2\n a6b3 a5b3 a4b3 a3b3 a2b3 a1b3 a0b3\n a6b4 a5b4 a4b4 a3b4 a2b4 a1b4 a0b4\n a6b5 a5b5 a4b5 a3b5 a2b5 a1b5 a0b5\n a6b6 a5b6 a4b6 a3b6 a2b6 a1b6 a0b6\n -----------------------------------------------------------------\n\nSchoolbook approach is computing a0b0 -\u003e a6b0, and then a0b1 -\u003e a6b1 and\nadding and offering a carry to the next digit. But this is slow due to\nrepeated load and store to the different sites. Comba multiplication is\ncomputing column-based: a4b0 -\u003e a0b4 for example, and adding them. And\naccumulator is offering the carry to the next phase and adding all of them.\n\nTests: JSTests/microbenchmarks/bigint-add-large.js\n JSTests/microbenchmarks/bigint-mod-cached-large.js\n JSTests/microbenchmarks/bigint-mod-cached.js\n JSTests/microbenchmarks/bigint-sub-large.js\n JSTests/stress/bigint-cached-mod-fixed-size.js\n\n* JSTests/microbenchmarks/bigint-add-large.js: Added.\n(test):\n(next):\n* JSTests/microbenchmarks/bigint-mod-cached-large.js: Added.\n(test):\n* JSTests/microbenchmarks/bigint-mod-cached.js: Added.\n(test):\n* JSTests/microbenchmarks/bigint-sub-large.js: Added.\n(test):\n(next):\n* JSTests/stress/bigint-cached-mod-fixed-size.js: Added.\n(shouldBe):\n(refMod):\n(checkRepeated):\n* JSTests/stress/bigint-multiply-comba.js: Added.\n(shouldBe):\n(refMul):\n(makeOperand):\n(check):\n* Source/JavaScriptCore/runtime/JSBigInt.cpp:\n(JSC::DigitColumnAccumulator::low const):\n(JSC::DigitColumnAccumulator::fitsInLow const):\n(JSC::CombaAccumulator::computeColumn):\n(JSC::CombaAccumulator::pass):\n(JSC::JSBigInt::multiplyCombaFixed):\n(JSC::JSBigInt::multiplySchoolbook):\n(JSC::JSBigInt::multiplySpecialLow):\n(JSC::JSBigInt::multiplySpecialHigh):\n(JSC::shouldUseComba):\n(JSC::JSBigInt::multiplyComba):\n(JSC::multiplySpecialColumn):\n(JSC::JSBigInt::multiplySpecialHighFixed):\n(JSC::JSBigInt::multiplySpecialLowFixed):\n(JSC::JSBigInt::multiplyImpl):\n(JSC::JSBigInt::divideSchoolbook):\n(JSC::JSBigInt::remainderSameSize):\n(JSC::JSBigInt::divideImpl):\n(JSC::JSBigInt::addDigits):\n(JSC::JSBigInt::multiplyDigits):\n(JSC::JSBigInt::divideDigits):\n(JSC::JSBigInt::cachedModMakeInverse):\n(JSC::JSBigInt::cachedModFixed):\n(JSC::JSBigInt::cachedMod):\n(JSC::JSBigInt::remainderImpl):\n(JSC::JSBigInt::digitAdd3):\n(JSC::JSBigInt::digitSub2):\n(JSC::JSBigInt::addSchoolbook):\n(JSC::JSBigInt::absoluteAdd):\n(JSC::JSBigInt::subSchoolbook):\n(JSC::JSBigInt::absoluteSub):\n(JSC::CombaAccumulator::mac): Deleted.\n(JSC::CombaAccumulator::storeAndShift): Deleted.\n(JSC::JSBigInt::multiplyTextbook): Deleted.\n(JSC::JSBigInt::divideTextbook): Deleted.\n(JSC::JSBigInt::addTextbook): Deleted.\n(JSC::JSBigInt::subTextbook): Deleted.\n* Source/JavaScriptCore/runtime/JSBigInt.h:\n\nCanonical link: https://commits.webkit.org/318298@main", "email": "ysuzuki@apple.com", "hash": "39b1bb9cfc85b74fa5ead850deee710547b2df71", "subject": "[JSC] Deploy Comba multiplication more broadly" }, "318299@main": { "author": "Philippe Normand", "avatar": "https://www.gravatar.com/avatar/eef27203750af3510263cc29af21a16e?d=identicon\u0026s=64", "cl": "318299@main", "clUrl": "https://commits.webkit.org/318299@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320444\n\nReviewed by Xabier Rodriguez-Calvar.\n\nThe end-of-append pipeline dumps are very frequent, leading to a large number of dot files when\nGST_DEBUG_DUMP_DOT_DIR is enabled. These along with a couple more dumpBinToDotFile calls are gated\nby the WEBKIT_GST_MSE_VERBOSE_PIPELINE_DUMPS environment variable.\n\nCanonical link: https://commits.webkit.org/318299@main", "email": "philn@igalia.com", "hash": "127b4d5943c517eab35641022288e79d5815e754", "subject": "[GStreamer][MSE] Make some of the append pipeline and msesrc debug dumps opt-in" }, "318300@main": { "author": "Carlos Garcia Campos", "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64", "cl": "318300@main", "clUrl": "https://commits.webkit.org/318300@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320639\n\nReviewed by Adrian Perez de Castro.\n\nMost of them are false positives that just require proper annotations,\nbut there are quite a few real issues too.\n\n* Source/JavaScriptCore/API/glib/JSCVirtualMachine.cpp:\n(jscVirtualMachineGetOrCreate):\n* Source/WTF/wtf/glib/ActivityObserver.h:\n(WTF::ActivityObserver::start):\n(WTF::ActivityObserver::notify):\n* Source/WebCore/page/scrolling/coordinated/ScrollingTreeCoordinated.cpp:\n(WebCore::ScrollingTreeCoordinated::applyLayerPositionsInternal):\n(WebCore::traverseDescendantLayersAtPoint):\n(WebCore::ScrollingTreeCoordinated::scrollingNodeForPoint):\n(WebCore::ScrollingTreeCoordinated::eventListenerRegionTypesForPoint const):\n* Source/WebCore/platform/audio/gstreamer/AudioDestinationGStreamer.cpp:\n(WebCore::AudioDestinationGStreamer::notifyIsPlaying):\n* Source/WebCore/platform/graphics/gstreamer/TrackPrivateBaseGStreamer.cpp:\n(WebCore::TrackDataHolder::disconnect):\n* Source/WebCore/platform/graphics/gstreamer/VideoFrameMetadataGStreamer.cpp:\n(webkitGstBufferGetVideoFrameMetadata):\n(webkitGstBufferGetProcessingTime):\n* Source/WebCore/platform/graphics/gstreamer/mse/MediaSourcePrivateGStreamer.cpp:\n(WebCore::MediaSourcePrivateGStreamer::addSourceBuffer):\n(WebCore::MediaSourcePrivateGStreamer::startPlaybackIfHasAllTracks):\n* Source/WebCore/platform/graphics/skia/SkiaGPUAtlas.h:\n(WebCore::AtlasUploadCondition::wait):\n* Source/WebCore/platform/graphics/texmap/BitmapTexturePool.cpp:\n(WebCore::BitmapTexturePool::scheduleReleaseUnusedTextures):\n(WebCore::BitmapTexturePool::releaseUnusedTexturesTimerFired):\n(WebCore::BitmapTexturePool::enterLimitExceededModeIfNeeded):\n(WebCore::BitmapTexturePool::exitLimitExceededModeIfNeeded):\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedBackingStoreProxy.cpp:\n(WebCore::CoordinatedBackingStoreProxy::updateIfNeeded):\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.cpp:\n(WebCore::CoordinatedPlatformLayer::setPosition):\n(WebCore::CoordinatedPlatformLayer::position const):\n(WebCore::CoordinatedPlatformLayer::setBoundsOrigin):\n(WebCore::CoordinatedPlatformLayer::boundsOrigin const):\n(WebCore::CoordinatedPlatformLayer::setAnchorPoint):\n(WebCore::CoordinatedPlatformLayer::anchorPoint const):\n(WebCore::CoordinatedPlatformLayer::setSize):\n(WebCore::CoordinatedPlatformLayer::size const):\n(WebCore::CoordinatedPlatformLayer::bounds const):\n(WebCore::CoordinatedPlatformLayer::setTransform):\n(WebCore::CoordinatedPlatformLayer::transform const):\n(WebCore::CoordinatedPlatformLayer::setChildrenTransform):\n(WebCore::CoordinatedPlatformLayer::childrenTransform const):\n(WebCore::CoordinatedPlatformLayer::setVisibleRect):\n(WebCore::CoordinatedPlatformLayer::visibleRect const):\n(WebCore::CoordinatedPlatformLayer::setTransformedVisibleRect):\n(WebCore::CoordinatedPlatformLayer::setScrollingNodeID):\n(WebCore::CoordinatedPlatformLayer::scrollingNodeID const):\n(WebCore::CoordinatedPlatformLayer::setDrawsContent):\n(WebCore::CoordinatedPlatformLayer::setMasksToBounds):\n(WebCore::CoordinatedPlatformLayer::setPreserves3D):\n(WebCore::CoordinatedPlatformLayer::setBackfaceVisibility):\n(WebCore::CoordinatedPlatformLayer::setOpacity):\n(WebCore::CoordinatedPlatformLayer::setBlendMode):\n(WebCore::CoordinatedPlatformLayer::setContentsVisible):\n(WebCore::CoordinatedPlatformLayer::contentsVisible const):\n(WebCore::CoordinatedPlatformLayer::setContentsOpaque):\n(WebCore::CoordinatedPlatformLayer::setContentsRect):\n(WebCore::CoordinatedPlatformLayer::setContentsRectClipsDescendants):\n(WebCore::CoordinatedPlatformLayer::setContentsClippingRect):\n(WebCore::CoordinatedPlatformLayer::setContentsScale):\n(WebCore::CoordinatedPlatformLayer::contentsScale const):\n(WebCore::CoordinatedPlatformLayer::hasCommittedContentsBuffer const):\n(WebCore::CoordinatedPlatformLayer::setContentsBuffer):\n(WebCore::CoordinatedPlatformLayer::setContentsImage):\n(WebCore::CoordinatedPlatformLayer::setContentsColor):\n(WebCore::CoordinatedPlatformLayer::setContentsTileSize):\n(WebCore::CoordinatedPlatformLayer::setContentsTilePhase):\n(WebCore::CoordinatedPlatformLayer::setDirtyRegion):\n(WebCore::CoordinatedPlatformLayer::addDamage):\n(WebCore::CoordinatedPlatformLayer::damageWholeLayer):\n(WebCore::CoordinatedPlatformLayer::setFilters):\n(WebCore::CoordinatedPlatformLayer::setMask):\n(WebCore::CoordinatedPlatformLayer::setReplica):\n(WebCore::CoordinatedPlatformLayer::setBackdrop):\n(WebCore::CoordinatedPlatformLayer::notifyBackdropFiltersChanged):\n(WebCore::CoordinatedPlatformLayer::setBackdropRect):\n(WebCore::CoordinatedPlatformLayer::setIsBackdropRoot):\n(WebCore::CoordinatedPlatformLayer::setAnimations):\n(WebCore::CoordinatedPlatformLayer::setChildren):\n(WebCore::CoordinatedPlatformLayer::children const):\n(WebCore::CoordinatedPlatformLayer::setEventRegion):\n(WebCore::CoordinatedPlatformLayer::eventRegion const):\n(WebCore::CoordinatedPlatformLayer::setClipPath):\n(WebCore::CoordinatedPlatformLayer::setDebugBorder):\n(WebCore::CoordinatedPlatformLayer::setShowRepaintCounter):\n(WebCore::CoordinatedPlatformLayer::needsBackingStore const):\n(WebCore::CoordinatedPlatformLayer::updateContents):\n(WebCore::CoordinatedPlatformLayer::paint):\n(WebCore::CoordinatedPlatformLayer::record):\n(WebCore::CoordinatedPlatformLayer::replay):\n(WebCore::CoordinatedPlatformLayer::flushPositionChanges):\n(WebCore::CoordinatedPlatformLayer::flushCompositingStateOnTarget):\n(WebCore::CoordinatedPlatformLayer::flushCompositingStateOnSkiaTarget):\n(WebCore::CoordinatedPlatformLayer::hasPendingBackingStoreTileUpdates const):\n(WebCore::CoordinatedPlatformLayer::processPendingBackingStoreTileUpdates):\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.h:\n(WebCore::CoordinatedPlatformLayer::WTF_RETURNS_LOCK):\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferProxy.cpp:\n(WebCore::CoordinatedPlatformLayerBufferProxy::consumePendingBufferIfNeeded):\n* Source/WebCore/platform/graphics/texmap/coordinated/GraphicsLayerContentsDisplayDelegateCoordinated.cpp:\n(WebCore::GraphicsLayerContentsDisplayDelegateCoordinated::display):\n* Source/WebCore/platform/graphics/texmap/coordinated/GraphicsLayerCoordinated.cpp:\n(WebCore::GraphicsLayerCoordinated::updateGeometry):\n(WebCore::GraphicsLayerCoordinated::updateVisibleRect):\n(WebCore::GraphicsLayerCoordinated::updateBackdropFilters):\n(WebCore::GraphicsLayerCoordinated::updateBackdropFiltersRect):\n(WebCore::GraphicsLayerCoordinated::updateAnimations):\n(WebCore::GraphicsLayerCoordinated::updateIndicators):\n* Source/WebCore/platform/gstreamer/GStreamerElementHarness.cpp:\n(WebCore::GStreamerElementHarness::Stream::Stream):\n(WebCore::GStreamerElementHarness::Stream::pullSample):\n(WebCore::GStreamerElementHarness::Stream::outputCaps):\n* Source/WebCore/platform/gstreamer/GStreamerElementHarness.h:\n* Source/WebCore/platform/image-decoders/avif/AVIFImageDecoder.cpp:\n(WebCore::AVIFImageDecoder::findFirstRequiredFrameToDecode):\n(WebCore::AVIFImageDecoder::frameBufferAtIndex):\n(WebCore::AVIFImageDecoder::isComplete):\n(WebCore::AVIFImageDecoder::decode):\n* Source/WebCore/platform/image-decoders/bmp/BMPImageDecoder.cpp:\n(WebCore::BMPImageDecoder::frameBufferAtIndex):\n(WebCore::BMPImageDecoder::decode):\n(WebCore::BMPImageDecoder::decodeHelper):\n* Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp:\n(WebCore::GIFImageDecoder::frameCount const):\n(WebCore::GIFImageDecoder::findFirstRequiredFrameToDecode):\n(WebCore::GIFImageDecoder::frameBufferAtIndex):\n(WebCore::GIFImageDecoder::clearFrameBufferCache):\n(WebCore::GIFImageDecoder::haveDecodedRow):\n(WebCore::GIFImageDecoder::frameComplete):\n(WebCore::GIFImageDecoder::decode):\n(WebCore::GIFImageDecoder::initFrameBuffer):\n(WebCore::GIFImageDecoder::decodeIfNeededAndGetFrameCount const):\n(WebCore::GIFImageDecoder::clearDecodedPixelDataIfNeeded):\n* Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp:\n(WebCore::ICOImageDecoder::frameCount const):\n(WebCore::ICOImageDecoder::frameBufferAtIndex):\n(WebCore::ICOImageDecoder::decode):\n(WebCore::ICOImageDecoder::decodeAtIndex):\n(WebCore::ICOImageDecoder::decodeIfNeededAndGetFrameCount const):\n* Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp:\n(WebCore::JPEGImageDecoder::frameBufferAtIndex):\n(WebCore::JPEGImageDecoder::outputScanlines):\n(WebCore::JPEGImageDecoder::jpegComplete):\n(WebCore::JPEGImageDecoder::decode):\n* Source/WebCore/platform/image-decoders/jpegxl/JPEGXLImageDecoder.cpp:\n(WebCore::JPEGXLImageDecoder::frameBufferAtIndex):\n(WebCore::JPEGXLImageDecoder::clearFrameBufferCache):\n(WebCore::JPEGXLImageDecoder::updateFrameCount):\n(WebCore::JPEGXLImageDecoder::processInput):\n(WebCore::JPEGXLImageDecoder::imageOut):\n(WebCore::JPEGXLImageDecoder::decodeIfNeededAndGetFrameCount const):\n(WebCore::JPEGXLImageDecoder::clearDecodedPixelDataIfNeeded):\n(WebCore::JPEGXLImageDecoder::frameCount const): Deleted.\n* Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp:\n(WebCore::PNGImageDecoder::frameBufferAtIndex):\n(WebCore::PNGImageDecoder::rowAvailable):\n(WebCore::PNGImageDecoder::pngComplete):\n(WebCore::PNGImageDecoder::readChunks):\n(WebCore::PNGImageDecoder::clearFrameBufferCache):\n(WebCore::PNGImageDecoder::initFrameBuffer):\n(WebCore::PNGImageDecoder::frameComplete):\n(WebCore::PNGImageDecoder::firstFrameBuffer):\n(WebCore::PNGImageDecoder::clearDecodedPixelDataIfNeeded):\n* Source/WebCore/platform/image-decoders/png/PNGImageDecoder.h:\n* Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp:\n(WebCore::WEBPImageDecoder::frameBufferAtIndex):\n(WebCore::WEBPImageDecoder::findFirstRequiredFrameToDecode):\n(WebCore::WEBPImageDecoder::decode):\n(WebCore::WEBPImageDecoder::decodeFrame):\n(WebCore::WEBPImageDecoder::initFrameBuffer):\n(WebCore::WEBPImageDecoder::applyPostProcessing):\n(WebCore::WEBPImageDecoder::clearFrameBufferCache):\n(WebCore::WEBPImageDecoder::clearDecodedPixelDataIfNeeded):\n* Source/WebCore/platform/mediarecorder/MediaRecorderPrivateGStreamer.cpp:\n(WebCore::MediaRecorderPrivateBackend::stopRecording):\n* Source/WebCore/platform/mediastream/gstreamer/GStreamerVideoCapturer.cpp:\n(WebCore::GStreamerVideoCapturer::setupPipeline): Deleted.\n* Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGLGBM.cpp:\n(WebKit::RemoteGraphicsContextGLGBM::prepareForDisplay):\n* Source/WebKit/UIProcess/glib/DisplayVBlankMonitorThreaded.cpp:\n(WebKit::DisplayVBlankMonitorThreaded::startThreadIfNeeded):\n(WebKit::DisplayVBlankMonitorThreaded::invalidate):\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/AcceleratedSurface.cpp:\n(WebKit::AcceleratedSurface::SwapChain::createTarget const):\n(WebKit::AcceleratedSurface::isOpaque const):\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/AcceleratedSurface.h:\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/ThreadedCompositor.cpp:\n(WebKit::m_renderTimer):\n(WebKit::ThreadedCompositor::startRenderTimer):\n(WebKit::ThreadedCompositor::stopRenderTimer):\n(WebKit::ThreadedCompositor::updateRenderTimer):\n(WebKit::ThreadedCompositor::isOnlyRenderingUpdatePendingAndWaitingForTiles const):\n(WebKit::ThreadedCompositor::scheduleUpdateLocked):\n* Source/WebKit/UIProcess/wpe/DisplayVBlankMonitorWPE.cpp:\n(WebKit::DisplayVBlankMonitorWPE::addCallbackIfNeeded):\n(WebKit::DisplayVBlankMonitorWPE::removeCallbackIfNeeded):\n* Source/WebKit/UIProcess/wpe/DisplayVBlankMonitorWPE.h:\n* Source/WebCore/platform/image-decoders/ScalableImageDecoder.cpp:\n(WebCore::ScalableImageDecoder::frameCount const):\n(WebCore::ScalableImageDecoder::clearFrameBufferCache):\n* Source/WebCore/platform/image-decoders/ScalableImageDecoder.h:\n(WebCore::ScalableImageDecoder::WTF_REQUIRES_LOCK):\n* Source/WebCore/platform/image-decoders/avif/AVIFImageDecoder.h:\n* Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.h:\n* Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.h:\n* Source/WebCore/platform/image-decoders/jpegxl/JPEGXLImageDecoder.h:\n* Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.h:\n\nCanonical link: https://commits.webkit.org/318300@main", "email": "cgarcia@igalia.com", "hash": "a7ea27dd3bb648bfff86a210d1cd640f96f21d1c", "subject": "[GTK][WPE] Fix thread safety issues caught by -Wthread-safety" }, "318301@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "318301@main", "clUrl": "https://commits.webkit.org/318301@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320707\nrdar://183692683\n\nReviewed by Chris Dumez and Frédéric Wang Nélar.\n\nString::trim() allocates a new StringImpl whenever there is actually something\nto trim, so the common `\u003cmo\u003e + \u003c/mo\u003e` allocated on every parse. The function\nonly needs isEmpty(), length(), two indexed code units and\nconvertToSingleCodePoint(), so take a StringView and use StringView::trim(),\nwhich returns a view over the existing buffer.\n\nNo change in behavior.\n\n* Source/WebCore/mathml/MathMLOperatorElement.cpp:\n(WebCore::MathMLOperatorElement::parseOperatorChar):\n* Source/WebCore/mathml/MathMLOperatorElement.h:\n\nCanonical link: https://commits.webkit.org/318301@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "801e9b5ab020287e8be5a18cf5a332c551dce9c5", "subject": "MathMLOperatorElement::parseOperatorChar() needlessly allocates a String when trimming whitespace" }, "318302@main": { "author": "Przemyslaw Gorszkowski", "avatar": "https://www.gravatar.com/avatar/e543ed682c6f99c866b01ca9bcbab360?d=identicon\u0026s=64", "cl": "318302@main", "clUrl": "https://commits.webkit.org/318302@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320719\n\nUnreviewed test gardening.\n\n* JSTests/test262/expectations-linux.yaml:\n\nCanonical link: https://commits.webkit.org/318302@main", "email": "pgorszkowski@igalia.com", "hash": "8d06d1ed50b0bf0211b80d24bea3bd3cd77c3643", "subject": "[WPE][GTK] Gardening failing test262 tests" }, "318303@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "318303@main", "clUrl": "https://commits.webkit.org/318303@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320709\nrdar://183696552\n\nReviewed by Frédéric Wang Nélar and Ryosuke Niwa.\n\nThis patch aligns WebKit with Gecko / Firefox and Blink / Chromium.\n\nMathMLElement::attributeChanged() and SVGElement::attributeChanged() only cleared the\nexplicitly set tab index when the new value was empty, leaving a previously parsed value\nin place for any other value that failed to parse. So after\n\n \u003cmi tabindex=\"3\"\u003e.setAttribute(\"tabindex\", \"abc\")\n\nmi.tabIndex kept reporting 3 instead of falling back to the default of -1.\n\nHTML resets the tab index for any value that is not a valid integer, not just the empty\nstring, and both MathML Core and SVG2 defer tabindex to HTML. HTMLElement::attributeChanged()\nalready implements this; the MathML and SVG copies predate that fix. Match them.\n\nTests: imported/w3c/web-platform-tests/mathml/relations/html5-tree/tabindex-003.html\n imported/w3c/web-platform-tests/svg/interact/scripted/focus-tabindex-invalid-value.svg\n\n* LayoutTests/imported/w3c/web-platform-tests/mathml/relations/html5-tree/tabindex-003-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/mathml/relations/html5-tree/tabindex-003.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/interact/scripted/focus-tabindex-invalid-value-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/interact/scripted/focus-tabindex-invalid-value.svg: Added.\n* Source/WebCore/mathml/MathMLElement.cpp:\n(WebCore::MathMLElement::attributeChanged):\n* Source/WebCore/svg/SVGElement.cpp:\n(WebCore::SVGElement::attributeChanged):\n\nCanonical link: https://commits.webkit.org/318303@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "0985315890a7ba02b5e034deaf980fc8ab177faf", "subject": "MathML and SVG elements do not reset tabIndex when tabindex is changed to an invalid value" }, "318304@main": { "author": "Ronan Turner", "avatar": "https://www.gravatar.com/avatar/b0adc2e7c8739eb712598294baec9184?d=identicon\u0026s=64", "cl": "318304@main", "clUrl": "https://commits.webkit.org/318304@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320638\nrdar://183480452\n\nReviewed by Simon Fraser.\n\nWhen performing a same-document fragment navigation, the UI process still receives a\npolicy decision call from WebContent. For same-document navigations, the same navigation\nobject is used as in the original load, which retains state on whether this was a\nUI-driven navigation.\n\nWhen considering Enhanced Security state changes, instead of consulting the navigation\nobject, which may have this older state, we should consult the latest navigation action\nwhich is a more accurate representation for the current policy decision.\n\nA test is added which performs a same-document fragment navigation and ensures no\nadditional load is occurring.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/EnhancedSecurityPolicies.mm\n\n* Source/WebKit/UIProcess/EnhancedSecurityTracking.cpp:\n(WebKit::EnhancedSecurityTracking::trackNavigation):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/EnhancedSecurityPolicies.mm:\n(runHttpFragmentNavigation):\n\nCanonical link: https://commits.webkit.org/318304@main", "email": "ronan_turner@apple.com", "hash": "ff933d97cec7db5b7e11bdc9417a95f1564dc796", "subject": "Track the latest navigation action when considering Enhanced Security state changes" }, "318306@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "318306@main", "clUrl": "https://commits.webkit.org/318306@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320710\nrdar://183698052\n\nReviewed by Frédéric Wang Nélar.\n\nMathMLMencloseElement::parseNotationAttribute() open-coded whitespace\nsplitting to walk the notation attribute. The notation attribute is an\nunordered set of unique space-separated tokens, which is exactly what\nSpaceSplitString models, so use it and delete the hand-rolled loop.\n\nNo change in behavior: SpaceSplitString tokenizes on isASCIIWhitespace()\njust as the removed loop did, matching is still case-sensitive\n(ShouldFoldCase::No), and a missing, empty, or whitespace-only attribute\nstill yields no notation flags (the default longdiv case is handled\nbefore this point).\n\n* Source/WebCore/mathml/MathMLMencloseElement.cpp:\n(WebCore::MathMLMencloseElement::parseNotationAttribute):\n\nCanonical link: https://commits.webkit.org/318306@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "e61b71940cb9b5d2b61651c7e31e46f79062a57e", "subject": "[MathML] Use SpaceSplitString to parse the \u003cmenclose\u003e notation attribute instead of a hand-rolled tokenizer" }, "318307@main": { "author": "Lily Spiniolas", "avatar": "https://www.gravatar.com/avatar/b65cfeb51301399bd50e338bb2d7613e?d=identicon\u0026s=64", "cl": "318307@main", "clUrl": "https://commits.webkit.org/318307@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320678\nrdar://183607479\n\nReviewed by Aditya Keerthi and Abrar Rahman Protyasha.\n\nAdd foundation for PDF accessibility modes which alter the\nappearance of a rendered PDF.\n\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/AsyncPDFRenderer.h:\n(WebKit::TileRenderInfo::equivalentForPainting const):\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/AsyncPDFRenderer.mm:\n(WebKit::AsyncPDFRenderer::invalidateAllRenderedContent):\n(WebKit::renderPDFPagePreview):\n(WebKit::AsyncPDFRenderer::generatePreviewImageForPage):\n(WebKit::AsyncPDFRenderer::renderInfoForTile const):\n(WebKit::renderPDFTile):\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/PDFAccessibilityDisplayMode.h: Added.\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/PDFDiscretePresentationController.h:\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/PDFDiscretePresentationController.mm:\n(WebKit::PDFDiscretePresentationController::buildRows):\n(WebKit::PDFDiscretePresentationController::updateForAccessibilityDisplayModeChange):\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/PDFPresentationController.h:\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/PDFPresentationController.mm:\n(WebKit::PDFPresentationController::makePageContainerLayer):\n(WebKit::PDFPresentationController::invalidateRenderedContentForAccessibilityDisplayModeChange):\n(WebKit::PDFPresentationController::accessibilityDisplayMode const):\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/PDFScrollingPresentationController.h:\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/PDFScrollingPresentationController.mm:\n(WebKit::PDFScrollingPresentationController::setupLayers):\n(WebKit::PDFScrollingPresentationController::updateForAccessibilityDisplayModeChange):\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/UnifiedPDFPlugin.h:\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/UnifiedPDFPlugin.mm:\n(WebKit::UnifiedPDFPlugin::accessibilityDisplayMode const):\n(WebKit::applyPDFContentAXColorAdjustment):\n(WebKit::pdfPageBackgroundColor):\n(WebKit::pdfSelectionBlendMode):\n(WebKit::pdfScrollbarOverlayStyle):\n(WebKit::UnifiedPDFPlugin::UnifiedPDFPlugin):\n(WebKit::UnifiedPDFPlugin::didChangeSettings):\n(WebKit::UnifiedPDFPlugin::paintPDFContent):\n(WebKit::UnifiedPDFPlugin::paintPDFSelection):\n(WebKit::UnifiedPDFPlugin::updateScrollbarOverlayStyle):\n\nCanonical link: https://commits.webkit.org/318307@main", "email": "lily_spiniolas@apple.com", "hash": "6867fc6a135399bfb87863ef3146d0c7aeb410a4", "subject": "[AX] Add foundation for PDF accessibility modes" }, "318308@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "318308@main", "clUrl": "https://commits.webkit.org/318308@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320717\nrdar://183702303\n\nReviewed by Frédéric Wang Nélar.\n\nflags had no initializer, unlike its sibling dirtyFlags, and m_properties is\nnot initialized in the constructor. computeOperatorFlag() then read-modify-\nwrites it (`flags |= flag` / `flags \u0026= ~flag`), which is undefined behavior.\nZero-initialize it. No behavior change, no new test.\n\n* Source/WebCore/mathml/MathMLOperatorElement.h:\n\nCanonical link: https://commits.webkit.org/318308@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "89c4be0b935b645dbcb30b25c055408ac2637b02", "subject": "[MathML] MathMLOperatorElement::OperatorProperties::flags is read uninitialized" }, "318309@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "318309@main", "clUrl": "https://commits.webkit.org/318309@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320711\nrdar://183698156\n\nReviewed by Chris Dumez and Frédéric Wang Nélar.\n\nparseMathMLLength took a const String\u0026 only to immediately convert it to a\nStringView and trim it, unlike its two sibling helpers parseNumberAndUnit and\nparseNamedSpace, which already take StringView. Take a StringView directly and\ndrop the intermediate local.\n\nAll three call sites pass an AtomString returned by\nattributeWithoutSynchronization(), which converts to StringView just as it did\nto const String\u0026, so no string is allocated or copied either way. This just\nlets the function accept a StringView caller without materializing a String.\n\n* Source/WebCore/mathml/MathMLPresentationElement.cpp:\n(WebCore::MathMLPresentationElement::parseMathMLLength):\n* Source/WebCore/mathml/MathMLPresentationElement.h:\n\nCanonical link: https://commits.webkit.org/318309@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "4cf1ce000dad0bd6ebc8fa09c572997ce0a20b42", "subject": "Take a StringView in MathMLPresentationElement::parseMathMLLength" }, "318310@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "318310@main", "clUrl": "https://commits.webkit.org/318310@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320712\nrdar://183698921\n\nReviewed by Frédéric Wang Nélar.\n\nMathMLMathElement::attributeChanged() reproduced the body of\nMathMLPresentationElement::attributeChanged() verbatim and then chained\nstraight to MathMLElement::attributeChanged() so the invalidation would\nnot run twice.\n\nMathMLRowElement does not override attributeChanged(), so the inherited\nimplementation for \u003cmath\u003e is MathMLPresentationElement's, which is\nidentical. acceptsLegacyMathVariantAttribute() is virtual, so the base\nimplementation still dispatches to MathMLMathElement's override. The\nwhole override is therefore redundant and is removed, along with the\nnow-unused MathMLNames include and using-directive.\n\nNo change in behavior.\n\n* Source/WebCore/mathml/MathMLMathElement.cpp:\n(WebCore::MathMLMathElement::attributeChanged): Deleted.\n* Source/WebCore/mathml/MathMLMathElement.h:\n\nCanonical link: https://commits.webkit.org/318310@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "4629e1b12aed6c812c42f21432241798bf8e4a52", "subject": "[MathML] Remove duplicated mathvariant invalidation from MathMLMathElement::attributeChanged" }, "318311@main": { "author": "Abrar Rahman Protyasha", "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64", "cl": "318311@main", "clUrl": "https://commits.webkit.org/318311@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320546\nrdar://183718878\n\nUnreviewed test gardening.\n\nCanonical link: https://commits.webkit.org/318311@main", "email": "a_protyasha@apple.com", "hash": "a283c7e0d632c04c9125c4803b0b74b66048fee9", "subject": "[Gardening] REGRESSION(318122@main): http/wpt/identity/digital-credential-openid4vp-request-parsing.https.html is consistently failing" }, "318312@main": { "author": "Carlos Garcia Campos", "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64", "cl": "318312@main", "clUrl": "https://commits.webkit.org/318312@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320654\n\nReviewed by Nikolas Zimmermann.\n\nDrawsContent, ClipPath and ScrollingNode are never removed from\nm_pendingChanges. DrawsContent and ScrollingNode are not really needed\nbecause those values are not passed to the compositing layer.\n\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.cpp:\n(WebCore::CoordinatedPlatformLayer::setScrollingNodeID):\n(WebCore::CoordinatedPlatformLayer::setDrawsContent):\n(WebCore::CoordinatedPlatformLayer::flushCompositingStateOnSkiaTarget):\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.h:\n\nCanonical link: https://commits.webkit.org/318312@main", "email": "cgarcia@igalia.com", "hash": "59e7807aea6b444a6d280e4fa8126a8e3e07ff6f", "subject": "[CoordinatedGraphics] Some CoordinatedPlatformLayer pending changes are never reset" }, "318313@main": { "author": "Carlos Garcia Campos", "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64", "cl": "318313@main", "clUrl": "https://commits.webkit.org/318313@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320738\n\nReviewed by Fujii Hironori.\n\nOnly the one including future is used, so we can keep that one as just\nm_transformedVisibleRect. We can also simplify GraphicsLayerCoordinated,\nm_layerTransform.cachedCombined is only used inside computeLayerTransformIfNeeded()\nso it can be a local variable.\n\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.cpp:\n(WebCore::CoordinatedPlatformLayer::setTransformedVisibleRect):\n(WebCore::CoordinatedPlatformLayer::updateBackingStore):\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.h:\n* Source/WebCore/platform/graphics/texmap/coordinated/GraphicsLayerCoordinated.cpp:\n(WebCore::GraphicsLayerCoordinated::computeLayerTransformIfNeeded):\n(WebCore::GraphicsLayerCoordinated::updateVisibleRect):\n* Source/WebCore/platform/graphics/texmap/coordinated/GraphicsLayerCoordinated.h:\n\nCanonical link: https://commits.webkit.org/318313@main", "email": "cgarcia@igalia.com", "hash": "715e928122550027230c5aff497c31fe60d0c04b", "subject": "[CoordinatedGraphics] Remove unused m_transformedVisibleRect from CoordinatedPlatformLayer" }, "318314@main": { "author": "Per Arne Vollan", "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64", "cl": "318314@main", "clUrl": "https://commits.webkit.org/318314@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320487\nrdar://168244132\n\nReviewed by Sihui Liu.\n\nWith Site Isolation enabled, when a popup triggers user interaction,\nrequestStorageAccessUnderOpener failed because the opener is a\nRemoteFrame, so the existing LocalFrame downcast returned null.\n\nIn WebResourceLoadObserver, detect when the opener is a RemoteFrame\nand send RequestStorageAccessUnderOpener directly to the\nNetworkProcess using the opener URL from WebPage creation parameters.\n\n(WebKit::WebResourceLoadObserver::logUserInteractionWithReducedTimeResolution):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TEST):\n\nCanonical link: https://commits.webkit.org/318314@main", "email": "pvollan@apple.com", "hash": "4412374ea0fcf2daa2efa5e75455b98a85bcef66", "subject": "\"Continue with Google\" sign-in redirects to blank page" }, "318316@main": { "author": "Carlos Garcia Campos", "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64", "cl": "318316@main", "clUrl": "https://commits.webkit.org/318316@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320741\n\nReviewed by Philippe Normand.\n\n* Source/WebCore/Modules/mediastream/PeerConnectionBackend.cpp:\n(WebCore::JSONFileHandler::open):\n* Source/WebCore/platform/RunLoopObserver.cpp:\n(WebCore::RunLoopObserver::runLoopObserverFired):\n* Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:\n(WebCore::MediaPlayerPrivateGStreamer::repaint):\n\nCanonical link: https://commits.webkit.org/318316@main", "email": "cgarcia@igalia.com", "hash": "bd37677064a8766c131e7918b00311c542236676", "subject": "[GTK][WPE] Fix more issues caught by -Wthread-safety" }, "318317@main": { "author": "Sam Weinig", "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64", "cl": "318317@main", "clUrl": "https://commits.webkit.org/318317@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320566\n\nReviewed by Darin Adler.\n\nDoes a little cleanup in StyleLengthResolution.h/cpp\n\n- Factors relative unit conversions into standalone functions\n with links to their spec definitions.\n- Renames Style::computeNonCalcLengthDouble to Style::resolveLength\n- Removes unnecessary alias Style::computeCanonicalNonCalcLengthDouble,\n callers can call Style::resolveLength now.\n- Updates comment for Style::resolveLength to account for required\n FontCascade argument and more accurately describe the viewport-percentage\n unit results.\n- Makes all arguments to Style::resolveLength required.\n- Removes viewport factor getters from CSSToLengthConversionData as these\n were only used by Style::resolveLength.\n- Exposes setUsesViewportUnits along side setUsesContainerUnits for use by\n Style::resolveLength now that the viewport factor getters are not used.\n- Uses a consistent style of \"return value * ...\" for each unit, removing\n all uses of break from the switch statements. The fact that some units\n returned early and some didn't was a source of confusion.\n\nThe newly passing test cases are due to the viewport-percentage unit calculations\nnow staying in `double` precision the entire time. Previously, some of the math was\ndone on `float` values.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/viewport-units-extreme-scale-expected.txt:\n* Source/WebCore/SaferCPPExpectations/UncheckedCallArgsCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/UncountedLocalVarsCheckerExpectations:\n* Source/WebCore/css/CSSToLengthConversionData.cpp:\n* Source/WebCore/css/CSSToLengthConversionData.h:\n* Source/WebCore/css/calc/CSSCalcTree+Simplification.cpp:\n* Source/WebCore/css/calc/CSSCalcValue.cpp:\n* Source/WebCore/css/parser/SizesAttributeParser.cpp:\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:\n* Source/WebCore/style/StyleResolveForFont.cpp:\n* Source/WebCore/style/calc/StyleCalculationTree+Conversion.cpp:\n* Source/WebCore/style/values/primitives/StyleLengthResolution.cpp:\n* Source/WebCore/style/values/primitives/StyleLengthResolution.h:\n* Source/WebCore/style/values/primitives/StylePrimitiveNumericTypes+Conversions.cpp:\n* Source/WebCore/svg/SVGLengthContext.cpp:\n\nCanonical link: https://commits.webkit.org/318317@main", "email": "sam@webkit.org", "hash": "e3276268feac295db37cc2f3c842bb81a87bdff5", "subject": "[Cleanup] Factor length unit conversion into standalone functions" }, "318318@main": { "author": "Shu-yu Guo", "avatar": "https://www.gravatar.com/avatar/3884544eb9e557e2ec917d32c6e12720?d=identicon\u0026s=64", "cl": "318318@main", "clUrl": "https://commits.webkit.org/318318@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318174\nrdar://180908109\n\nReviewed by Yusuke Suzuki.\n\nThe YARR JIT's ParenContext save area, used to snapshot inter-iteration state\nfor capturing/backtrackable repeating parenthesized groups, was sized to the\nentire pattern's call frame. This meant every repeating group's ParenContext\nreserved space for, and coped on each iteration copied, its own interior frame\nslots in addition to every sibling and ancestor-sibling term's frame slots.\n\nFor patterns with several repeating groups in sequence (e.g.\n/(a|b)+(c|d)+(e|f)+.../), each group's frame slots are laid out after the\nprevious ones', so the whole-frame save area grows with the pattern and the\namount of work redundantly copied per group grows with it, resulting in the\ncopying being quadratic in the number of groups.\n\nThis PR optimizes copying the be linear.\n\nA repeating group's PatternDisjunction is laid out at frame offsets\n[frameLocation + YarrStackSpaceForBackTrackInfoParentheses, m_callFrameSize),\nand nothing outside that range is ever touched while looping over that\ngroup's iterations: a forward continuation into a following term\nreinitializes that term's own backtrack slots before reading them, and a\nbacktrack into the group's own content only re-touches its own interior\nrange. So the save area only needs to be as large as the largest such\ninterior range across the whole pattern, and slots can be saved/restored\nusing indices relative to the group's own base rather than absolute\nframe-slot indices.\n\nParenContext objects are fixed sizes for all parenthesized groups in a pattern.\nCurrently this is the whole pattern body's frame size. This PR changes it so\nthat it's the maximum interior frame size across all repeating groups.\n\nThis PR also adds a microbenchmark with a chain of 250 sequential quantified\nalternation groups, matched and force-backtracked 3000 times. This change makes\nthis ~53x faster.\n\n* JSTests/microbenchmarks/regexp-sequential-parencontext-groups.js: Added.\n(buildPattern):\n(buildMatchingInput):\n* JSTests/stress/regexp-parencontext-large-frame.js: Added.\n(shouldBe):\n* JSTests/stress/regexp-parencontext-multi-alt-backreference.js: Added.\n(shouldBe):\n* JSTests/stress/regexp-parencontext-sibling-frame-slots.js: Added.\n(shouldBe):\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n* Source/JavaScriptCore/yarr/YarrPattern.cpp:\n(JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets):\n* Source/JavaScriptCore/yarr/YarrPattern.h:\n(JSC::Yarr::YarrPattern::resetForReparsing):\n\nCanonical link: https://commits.webkit.org/318318@main", "email": "syg@apple.com", "hash": "e1def8f4e5fdd2c8cbce4fa68c8e228f02041e83", "subject": "[YARR] Don't save sibling and ancestor sibling frame slots for ParenContext" }, "318319@main": { "author": "Sihui Liu", "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64", "cl": "318319@main", "clUrl": "https://commits.webkit.org/318319@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320633\nrdar://182905055\n\nReviewed by Alex Christensen.\n\nThe subscribe widget iframe on bbc.com's /subscribe page (piano.io) never loaded when reached by clicking a same-site\nlink from bbc.com's home page, even though it worked fine when /subscribe was loaded directly.\n\nThe cause is that same-site top-level navigation (no process swap for the main frame, e.g. bbc.com -\u003e bbc.com/subscribe)\ncan reuse the same WebPage/process for a cross-site iframe present on both the old and new page. Caching the old page\ninto BackForwardCache broadcasts SuspendWithFrameItem to that shared iframe process, and the previous code responded by\ncalling freezeLayerTree() on the whole WebPage. Since the new page's own iframe is added to that same, now-frozen\nWebPage moments later, it inherited the freeze before ever rendering a single frame and stayed permanently blank.\n\nFixed by having suspendWithFrameItem only detach the specific root frame(s) being cached from Page::rootFrames() -- pure\ncompositing bookkeeping; the frame stays alive via its RemoteFrame parent's ownership in the FrameTree -- instead of\nfreezing the whole DrawingArea. The detached frames are recorded on BackForwardCache's own CachedPage entry for that\nidentifier (BackForwardCache::setDetachedRootFramesForFrameItem / CachedPage::detachedRootFrames), and\nrestoreWithFrameItem reattaches them via Page::addRootFrame() on restore.\n\nTesting this case surfaced two more, related bugs in the same code:\n- Suspending the same, reused WebPage more than once before any restore (e.g.a.com/page1 -\u003e page2 -\u003e page3, each with\nits own same-site iframe) silently skipped caching every suspend after the first, because suspendWithFrameItem guarded\non a single WebPage-wide \"already suspended\" bool instead of tracking each cached identifier separately. Fixed by keying\nthe detached-root-frame bookkeeping -- and the guard itself -- per identifier instead of per WebPage.\n\n- Evicting a cache entry without ever restoring it (e.g. via prune() or _clearBackForwardCache) could remove the same\nroot frame a second time: the normal teardown (CachedFrame::destroy() -\u003e Frame::detachFromPage() -\u003e\nPage::removeRootFrame()) doesn't know the frame was already detached from Page::rootFrames() by suspendWithFrameItem,\nand tripped an assertion. Frame::detachFromPage() now only calls Page::removeRootFrame() if the frame is still actually\nregistered as a root frame.\n\nAdded regression tests for all three issues above.\nTests: SiteIsolation.MultiProcessBFCacheSameSiteReusedIframeNotFrozen\n SiteIsolation.MultiProcessBFCacheRestoreRerendersReattachedIframe\n SiteIsolation.MultiProcessBFCacheRepeatedSameSiteSuspendCachesEachEntry\n SiteIsolation.MultiProcessBFCacheSameSiteEvictionDoesNotCrashIframe\n\n* Source/WebCore/history/BackForwardCache.cpp:\n(WebCore::BackForwardCache::setDetachedRootFramesForFrameItem):\n* Source/WebCore/history/BackForwardCache.h:\n* Source/WebCore/history/CachedPage.h:\n* Source/WebCore/page/Frame.cpp:\n(WebCore::Frame::detachFromPage):\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::suspendWithFrameItem):\n(WebKit::WebPage::restoreWithFrameItem):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::startCountingAnimationFrames):\n(TestWebKitAPI::animationFrameCount):\n(TestWebKitAPI::expectAnimationFrameCountToIncrease):\n(TestWebKitAPI::(SiteIsolation, MultiProcessBFCacheSameSiteReusedIframeNotFrozen)):\n(TestWebKitAPI::(SiteIsolation, MultiProcessBFCacheRestoreRerendersReattachedIframe)):\n(TestWebKitAPI::(SiteIsolation, MultiProcessBFCacheRepeatedSameSiteSuspendCachesEachEntry)):\n(TestWebKitAPI::(SiteIsolation, MultiProcessBFCacheSameSiteEvictionDoesNotCrashIframe)):\n\nCanonical link: https://commits.webkit.org/318319@main", "email": "sihui_liu@apple.com", "hash": "3c248d1e5f942b73d0dc1f9cd46fb3c36e03fe56", "subject": "[Site Isolation] Cross-site iframe does not render after same-site top-level navigation" }, "318320@main": { "author": "Dan Hecht", "avatar": "https://www.gravatar.com/avatar/080f47d912b1b34d0be8293f825d132d?d=identicon\u0026s=64", "cl": "318320@main", "clUrl": "https://commits.webkit.org/318320@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320686\nrdar://183670692\n\nReviewed by Yusuke Suzuki.\n\nThe result flag means \"more memory could be returned if this was called\nagain\", accumulated across every TLC node in the iteration. The dirty\ndeallocation log case assigned to it instead of OR-ing, so it could clear a\ntrue set by an earlier node. Instead, accumulate result similarly to how it\nis handled in the other cases.\n\n* Source/bmalloc/libpas/src/libpas/pas_thread_local_cache.c:\n(pas_thread_local_cache_for_all):\n\nCanonical link: https://commits.webkit.org/318320@main", "email": "dan.hecht@apple.com", "hash": "ead6285911f66363c2654c28de293f5c773c0741", "subject": "[libpas] pas_thread_local_cache_for_all clobbers its should-go-again result" }, "318321@main": { "author": "Justin Michaud", "avatar": "https://www.gravatar.com/avatar/36e0433ee725a08f7e1122a6bc584b57?d=identicon\u0026s=64", "cl": "318321@main", "clUrl": "https://commits.webkit.org/318321@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320289\n\nReviewed by Keith Miller.\n\nIRO is pretty dumb sometimes, but it takes up a lot of compile time. Here\nI have tuned it to not pessimise any existing benchmarks, but to stop\nearly in larger functions. When we get larger functions that benefit\nfrom IRO in our benchmarks, we can reconsider this tuning (or perhaps\ndo something even more clever, such as an adjustable budget based on\ntrip count).\n\nThis saves ~20% of IRO execution time on IRO-heavy JS3 subtests, which is\n~3% of FTL compile time.\n\n* Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp:\n* Source/JavaScriptCore/dfg/DFGNodeFlowProjection.h:\n(JSC::DFG::NodeFlowProjection::hash const):\n* Source/JavaScriptCore/runtime/OptionsList.h:\n\nCanonical link: https://commits.webkit.org/318321@main", "email": "jmichaud@igalia.com", "hash": "68cde6ba2ad363f71e6c9faa71ae9ba7955b4506", "subject": "Make IRO faster" }, "318322@main": { "author": "Devin Rousso", "avatar": "https://www.gravatar.com/avatar/c9e757d973342c773f107a94b70cb9cd?d=identicon\u0026s=64", "cl": "318322@main", "clUrl": "https://commits.webkit.org/318322@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320743\n\nReviewed by Simon Fraser.\n\nThis should have been done when support for iOS 12.2 was removed.\n\n* Source/WebInspectorUI/UserInterface/Models/Canvas.js:\n(WI.Canvas.fromPayload):\n(WI.Canvas.displayNameForContextType):\n(WI.Canvas.supportsRequestContentForContextType):\n(WI.Canvas.prototype.get supportsRecording):\n* Source/WebInspectorUI/UserInterface/Views/CanvasSidebarPanel.css:\n(.sidebar \u003e .panel.navigation.canvas \u003e .content \u003e .tree-outline .item.canvas:is(.webgl, .webgl2, .webgpu) .icon): Renamed from `.sidebar \u003e .panel.navigation.canvas \u003e .content \u003e .tree-outline .item.canvas:is(.webgl, .webgl2, .webgpu, .webmetal) .icon`.\n* Source/WebInspectorUI/UserInterface/Views/GraphicsTabContentView.css:\n(.content-view.tab.graphics .navigation-bar \u003e .item .canvas:is(.webgl, .webgl2, .webgpu) .icon): Renamed from `.content-view.tab.graphics .navigation-bar \u003e .item .canvas:is(.webgl, .webgl2, .webgpu, .webmetal) .icon`.\n* Source/WebInspectorUI/Localizations/en.lproj/localizedStrings.js:\n\nCanonical link: https://commits.webkit.org/318322@main", "email": "hi@devinrousso.com", "hash": "31e173570f49e460387cabab18aa15dcb403954c", "subject": "Web Inspector: remove all references to WebMetal" }, "318323@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "318323@main", "clUrl": "https://commits.webkit.org/318323@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320706\nrdar://183692426\n\nReviewed by Yijia Huang.\n\nThis patch upgrades fast_float library to 8.2.10.\n\n* Source/WTF/wtf/fast_float/fast_float.h:\n(fast_float::fastfloat_strncasecmp3):\n(fast_float::fastfloat_strncasecmp5):\n(fast_float::fastfloat_strncasecmp):\n(fast_float::loop_parse_if_eight_digits):\n(fast_float::parse_int_string):\n\nCanonical link: https://commits.webkit.org/318323@main", "email": "ysuzuki@apple.com", "hash": "e5fa5c6044385523d1a69e39a295e2f684a7b5f3", "subject": "[WTF] Upgrade fast_float to 8.2.10" }, "318324@main": { "author": "Jessica Cheung", "avatar": "https://www.gravatar.com/avatar/5c102f093ce6bc01424466a4cfdf1d1f?d=identicon\u0026s=64", "cl": "318324@main", "clUrl": "https://commits.webkit.org/318324@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319903\nrdar://182828312\n\nReviewed by Aditya Keerthi and Abrar Rahman Protyasha.\n\nImplement `interactive-widget=resizes-content`, in which the visual\nviewport and the layout viewport should both resize as widgets\nappear on the screen (e.g. the virtual keyboard here). By default,\nthe visual viewport clamps to the top of the keyboard, so no work is\nneeded here.\n\nTo ensure the layout viewport clamps accordingly, these changes\nare necessary:\n1. The changes in _dispatchSetViewLayoutSize alter baseLayoutViewportSize,\nwhich will be utilized to report the layout viewport size.\n2. The changes in computeLayoutViewportRect alter unobscuredContentSize,\nwhich is used as the floor for the constrainedSize.\n3. Wire the interactive-widget value through PageClient.\n\nIf only the floor was clamped, computeLayoutViewportRect would have\nmax(fullBaseHeight, clampedSize) which gives us the incorrect value. If only\nthe base size was clamped, the calculation would be max(clampedSize, fullHeight)\nand the full height would take over. Thus, both changes are needed for the\nlayout viewport to actually take the height of the area between the keyboard\nand any insets. If there is a bottom inset above the keyboard, the layout viewport\nclamps accordingly to the bottom and top inset, if any.\n\nAdd layout tests that fail without the implementation changes. Ensure the tests are\ndevice-agnostic by adding support for inputViewBoundsInWebView which converts the\nkeyboard rect from window coordinates to WKWebView's coordinate space.\n\nThe layout tests cover these cases with resizes-content:\n- Zoom (disabled and enabled)\n- Obscured insets (bottom and top)\n- inputmode=none\n- Keyboard showing, hiding and scrolling\n\n* LayoutTests/fast/visual-viewport/ios/interactive-widget-resizes-content-bottom-obscured-insets-expected.txt: Added.\n* LayoutTests/fast/visual-viewport/ios/interactive-widget-resizes-content-bottom-obscured-insets.html: Added.\n* LayoutTests/fast/visual-viewport/ios/interactive-widget-resizes-content-inputmode-none-expected.txt: Added.\n* LayoutTests/fast/visual-viewport/ios/interactive-widget-resizes-content-inputmode-none.html: Added.\n* LayoutTests/fast/visual-viewport/ios/interactive-widget-resizes-content-keyboard-scroll-expected.txt: Added.\n* LayoutTests/fast/visual-viewport/ios/interactive-widget-resizes-content-keyboard-scroll.html: Added.\n* LayoutTests/fast/visual-viewport/ios/interactive-widget-resizes-content-top-obscured-insets-expected.txt: Added.\n* LayoutTests/fast/visual-viewport/ios/interactive-widget-resizes-content-top-obscured-insets.html: Added.\n* LayoutTests/fast/visual-viewport/ios/interactive-widget-resizes-content-zoom-disabled-expected.txt: Added.\n* LayoutTests/fast/visual-viewport/ios/interactive-widget-resizes-content-zoom-disabled.html: Added.\n* LayoutTests/fast/visual-viewport/ios/interactive-widget-resizes-content-zoom-enabled-expected.txt: Added.\n* LayoutTests/fast/visual-viewport/ios/interactive-widget-resizes-content-zoom-enabled.html: Added.\n* LayoutTests/resources/ui-helper.js:\n(window.UIHelper.inputViewBoundsInWebView):\n* Source/WebKit/UIProcess/API/ios/WKWebViewIOS.h:\n* Source/WebKit/UIProcess/API/ios/WKWebViewIOS.mm:\n(-[WKWebView _dispatchSetViewLayoutSize:]):\n(-[WKWebView _viewportMetaTagInteractiveWidget]):\n(-[WKWebView _keyboardChangedWithInfo:adjustScrollView:]):\n* Source/WebKit/UIProcess/PageClient.h:\n* Source/WebKit/UIProcess/ios/PageClientImplIOS.h:\n* Source/WebKit/UIProcess/ios/PageClientImplIOS.mm:\n(WebKit::PageClientImpl::viewportMetaTagInteractiveWidget const):\n* Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm:\n(WebKit::WebPageProxy::computeLayoutViewportRect const):\n* Tools/TestRunnerShared/UIScriptContext/Bindings/UIScriptController.idl:\n* Tools/TestRunnerShared/UIScriptContext/UIScriptController.h:\n(WTR::UIScriptController::inputViewBoundsInWebView const):\n* Tools/WebKitTestRunner/ios/UIScriptControllerIOS.h:\n* Tools/WebKitTestRunner/ios/UIScriptControllerIOS.mm:\n(WTR::UIScriptControllerIOS::inputViewBoundsInWebView const):\n\nCanonical link: https://commits.webkit.org/318324@main", "email": "jcheung23@apple.com", "hash": "793fd9fdac661cae17ead6122323cc296ea552ea", "subject": "[interactive-widget] Implement logic to support resizes-content" }, "318325@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "318325@main", "clUrl": "https://commits.webkit.org/318325@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320154\n\nReviewed by Yusuke Suzuki.\n\nWhen every top-level alternative of a pattern ends with a non-multiline $\nand consumes a fixed number of code units, a match can only start at\n(input length - size). YARR nevertheless searched from the given start\noffset, bumping along the whole subject (or scanning it with the\nBoyer-Moore prefilter), so /\\.js$/.test(url) and /[0-9a-f]{40}$/.test(line)\ndid work proportional to the input length.\n\nCompute the maximum alternative size for such patterns in YarrPattern and\nadvance the start position to (length - size) at the entry of the JIT code\nand the interpreter. The match body is untouched, so captures, lastIndex and\nglobal iteration behave as before. Sticky, multiline and BOL-containing\npatterns are left alone since they either do not search or are already\nhandled by optimizeBOL().\n\nThe new field fits into existing padding of both YarrPattern and\nBytecodePattern, so neither structure grows (232 and 120 bytes, unchanged).\n\n Baseline Patched\n\nregexp-end-anchored-literal-suffix 8.9024+-0.1528 ^ 3.8347+-0.3205 ^ definitely 2.3216x faster\nregexp-end-anchored-class-run 16.7796+-0.4848 ^ 2.4783+-0.1510 ^ definitely 6.7706x faster\n\nTests: JSTests/microbenchmarks/regexp-end-anchored-class-run.js\n JSTests/microbenchmarks/regexp-end-anchored-literal-suffix.js\n JSTests/microbenchmarks/regexp-unicode-bm-search-charclass.js\n JSTests/microbenchmarks/regexp-unicode-bm-search-emoji-charclass.js\n JSTests/microbenchmarks/regexp-unicode-bm-search-nomatch-charclass.js\n JSTests/stress/regexp-end-anchored-fixed-size.js\n\n* JSTests/microbenchmarks/regexp-end-anchored-class-run.js: Added.\n* JSTests/microbenchmarks/regexp-end-anchored-literal-suffix.js: Added.\n* JSTests/microbenchmarks/regexp-unicode-bm-search-charclass.js: Added.\n* JSTests/microbenchmarks/regexp-unicode-bm-search-emoji-charclass.js: Added.\n* JSTests/microbenchmarks/regexp-unicode-bm-search-nomatch-charclass.js: Added.\n* JSTests/stress/regexp-end-anchored-fixed-size.js: Added.\n(shouldBe):\n(i.m.re.exec):\n* Source/JavaScriptCore/yarr/YarrInterpreter.cpp:\n* Source/JavaScriptCore/yarr/YarrInterpreter.h:\n(JSC::Yarr::BytecodePattern::BytecodePattern):\n(JSC::Yarr::BytecodePattern::hasEndAnchoredFixedSize const):\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n* Source/JavaScriptCore/yarr/YarrPattern.cpp:\n(JSC::Yarr::YarrPatternConstructor::computeEndAnchoredFixedSize):\n(JSC::Yarr::YarrPattern::compile):\n* Source/JavaScriptCore/yarr/YarrPattern.h:\n(JSC::Yarr::YarrPattern::hasEndAnchoredFixedSize const):\n\nCanonical link: https://commits.webkit.org/318325@main", "email": "sosuke@bun.sh", "hash": "581f1d9583295898e8569aa01753b143356913f2", "subject": "[YARR] Start matching end-anchored fixed-size regexps at the only possible position" }, "318326@main": { "author": "Carlos Garcia Campos", "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64", "cl": "318326@main", "clUrl": "https://commits.webkit.org/318326@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320734\n\nReviewed by Adrian Perez de Castro and Carlos Alberto Lopez Perez.\n\nIt helps to catch thread safety issues at build time.\n\n* Source/JavaScriptCore/CMakeLists.txt:\n* Source/WTF/wtf/CMakeLists.txt:\n* Source/WebCore/CMakeLists.txt:\n* Source/WebKit/CMakeLists.txt:\n* Source/cmake/OptionsGTK.cmake:\n* Source/cmake/WebKitCompilerFlags.cmake:\n* Source/cmake/WebKitMacros.cmake:\n* Source/cmake/OptionsWPE.cmake:\n\nCanonical link: https://commits.webkit.org/318326@main", "email": "cgarcia@igalia.com", "hash": "5daad377031ccf0ab88a4010411fd0d7999f52d6", "subject": "[GTK][WPE] Enable -Wthread-safety" }, "318327@main": { "author": "Per Arne Vollan", "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64", "cl": "318327@main", "clUrl": "https://commits.webkit.org/318327@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320740\nrdar://183734309\n\nReviewed by Sihui Liu.\n\nLog page identifier when opener is a remote frame. This can be useful information when diagnosing login\nissues with Site Isolation enabled.\n\n* Source/WebKit/Platform/LogMessages.in:\n* Source/WebKit/WebProcess/WebCoreSupport/WebResourceLoadObserver.cpp:\n(WebKit::WebResourceLoadObserver::logUserInteractionWithReducedTimeResolution):\n\nCanonical link: https://commits.webkit.org/318327@main", "email": "pvollan@apple.com", "hash": "737d57033aaebca28e8033822e64142f80548348", "subject": "Add logging in logUserInteractionWithReducedTimeResolution method for diagnostics purposes" }, "318328@main": { "author": "Jessica Lee", "avatar": "https://www.gravatar.com/avatar/fc717c99321d09f31fb9187418a8ffc5?d=identicon\u0026s=64", "cl": "318328@main", "clUrl": "https://commits.webkit.org/318328@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320685\nrdar://183674695\n\nReviewed by Sihui Liu.\n\nThese tests are failing due to a network connection. Refactor to route requests through\nlocal HTTPS proxy\n\n* TestExpectations/apitests:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ParentalControlsContentFilteringTests.mm:\n(TEST(ParentalControlsContentFilteringTests, BlockedURL)):\n(TEST(ParentalControlsContentFilteringTests, OpenBlockedPopUp)):\n(TEST(ParentalControlsContentFilteringTests, BlockedNavigationFromLinkClick)):\n\nCanonical link: https://commits.webkit.org/318328@main", "email": "jlee53@apple.com", "hash": "4f97c7d3465a08b20760d85e0f5b2f2c8dc974b6", "subject": "ParentalControlsContentFilteringTests.OpenBlockedPopUp \u0026 BlockedURL are a constant timeout" }, "318329@main": { "author": "Carlos Alberto Lopez Perez", "avatar": "https://www.gravatar.com/avatar/05326c1dbe06f486e884975e73f25179?d=identicon\u0026s=64", "cl": "318329@main", "clUrl": "https://commits.webkit.org/318329@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=306952\n\nUnreviewed test gardening.\n\nThis test was skipped for WPE/x86_64 on 306795@main but it is also failing for\nWPE/ARM64, so make the skip more generic.\n\n* JSTests/stress/many-substrings-of-rope-shouldnt-use-excessive-memory-2.js:\n\nCanonical link: https://commits.webkit.org/318329@main", "email": "clopez@igalia.com", "hash": "18b5fd469877bf19aa9157874d3f57fcb3f949b5", "subject": "[JSC] many-substrings-of-rope-shouldnt-use-excessive-memory-2.js.default fails on WPE" }, "318330@main": { "author": "Abrar Rahman Protyasha", "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64", "cl": "318330@main", "clUrl": "https://commits.webkit.org/318330@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320592\nrdar://183356213\n\nReviewed by Richard Robinson.\n\nWith site isolation enabled, if a remote parent's geometry changes (say,\nthe frame scroll position), that does not actually modify the\ncross-origin \u003ciframe\u003e plugin's local root view transform. As such, we\nneed to ask the plugin to re-report its HUD location to the UI process,\nwhich runs the main frame conversion with newer geometry. Otherwise,\nwhen the top-level page scrolls the HUD stays where it was first placed\nand drifts out of the iframe.\n\nWe hook up this \"ask the plugin\" part by keying off frame tree sync data\nand calling WebPage::updatePDFHUDLocationsAfterRemoteFrameGeometryChange,\nwhich enumerates through the tracked PDF plugins and asks them to\nproduce HUD location updates.\n\nTest: TestWebKitAPI.UnifiedPDF/EmbeddedPDFHUDSiteIsolation.HUDTracksMainFrameScroll\n\n* Source/WebKit/WebProcess/Plugins/PDF/PDFPluginBase.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::frameTreeSyncDataChangedInAnotherProcess):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Source/WebKit/WebProcess/WebPage/mac/WebPageMac.mm:\n(WebKit::WebPage::updatePDFHUDLocationsAfterRemoteFrameGeometryChange):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/UnifiedPDFTests.mm:\n(TestWebKitAPI::EmbeddedPDFHUDSiteIsolation::scrollableMainHTML const):\n(TestWebKitAPI::EmbeddedPDFHUDSiteIsolation::loadAndWaitForHUD):\n(TestWebKitAPI::TEST_P):\n\nWe hoist the shared test setup into SetUp() (the gtest sanctioned test\nclass initializer), which makes the main test logic easier to read.\n\nCanonical link: https://commits.webkit.org/318330@main", "email": "a_protyasha@apple.com", "hash": "9a90b5af0558a9b1bfa2f6500cfc1efcf51bd703", "subject": "[Site Isolation] PDF HUD of cross-origin \u003ciframe src=pdf\u003e gets displaced by main frame scroll offset" }, "318332@main": { "author": "Charlie Wolfe", "avatar": "https://www.gravatar.com/avatar/857b3b5ff3394c31fa2689310a93dbab?d=identicon\u0026s=64", "cl": "318332@main", "clUrl": "https://commits.webkit.org/318332@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320690\nrdar://183664485\n\nReviewed by Matthew Finkel.\n\nThird-party CNAME and IP-address cloaking are defined in terms of first-party subresources, but\n288096@main dropped the top-level navigation exemption and now installs the cookie transform for\nevery first-party request. As a result, a site whose own hostname is CNAMEd across registrable\ndomains has cookies set by its own top-level response capped to 7 days.\n\nRestore the exemption inside setCookieTransformForFirstPartyRequest().\n\nTest: http/tests/resourceLoadStatistics/cname-cloaking-top-level-navigation-not-capped.https.html\n\n* LayoutTests/http/tests/resourceLoadStatistics/cname-cloaking-top-level-navigation-not-capped.https-expected.txt: Added.\n* LayoutTests/http/tests/resourceLoadStatistics/cname-cloaking-top-level-navigation-not-capped.https.html: Added.\n* Source/WebKit/NetworkProcess/cocoa/NetworkTaskCocoa.mm:\n(WebKit::NetworkTaskCocoa::setCookieTransformForFirstPartyRequest):\n\nCanonical link: https://commits.webkit.org/318332@main", "email": "charliew@apple.com", "hash": "ee54ef0cddb03af6ebea7c38c2f2fdab1f1dd30d", "subject": "REGRESSION(288096@main): ITP may cap the expiry of cookies set by a top-level navigation's own response" }, "318333@main": { "author": "Elliott Williams", "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64", "cl": "318333@main", "clUrl": "https://commits.webkit.org/318333@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320723\nrdar://183704798\n\nReviewed by Richard Robinson and Zak Ridouh.\n\n`ninja -t cleandead` deletes files from the log that are no longer part\nof the build graph. By hacking ninja-wrapper, we can force a cleandead\nrun whenever CMake regenerates the build. This enables us to clean up\nthe PRUNE_STALE mechanism that was added to do cleaning for headers\nspecifically, in favor of a broader and more general approach.\n\nCMake used to run cleandead automatically, but it was removed because\nsome projects depended on stale content being persisted between\nrebuilds. I don't think WebKit is affected by any such use cases, so we\ncan be more aggressive here.\n\n* Source/JavaScriptCore/CMakeLists.txt:\n* Source/WTF/wtf/CMakeLists.txt:\n* Source/WebCore/CMakeLists.txt:\n* Source/WebCore/PAL/pal/CMakeLists.txt:\n* Source/WebKit/CMakeLists.txt:\n* Source/WebKitLegacy/CMakeLists.txt:\n* Source/bmalloc/CMakeLists.txt:\n* Source/cmake/WebKitMacros.cmake:\n* Source/cmake/ninja-wrapper:\n\nCanonical link: https://commits.webkit.org/318333@main", "email": "emw@apple.com", "hash": "cfb222f3c4d1632e4bb21c18f57db2117dc11c40", "subject": "[CMake] Run cleandead at the end of configuration to delete stale files" }, "318334@main": { "author": "Jeffrey Xu", "avatar": "https://www.gravatar.com/avatar/102604c66589181d1a1247ea63f49964?d=identicon\u0026s=64", "cl": "318334@main", "clUrl": "https://commits.webkit.org/318334@main", "description": "rdar://183650308\nhttps://bugs.webkit.org/show_bug.cgi?id=320671\n\nReviewed by Carlos Garcia Campos.\n\nNew processes for iframes in site isolation will be expected to call enterAcceleratedCompositingMode twice on the same drawing area, so this assert is no longer expected to be valid.\n\nNo new tests. Layout tests can't use more than two domains, so they can't trigger a process swap on a remote cross-origin iframe yet. API tests can proxy multiple domains, but they aren't run on WPE. https://github.com/WebKit/WebKit/pull/70156 adds a process swap on reload after requesting storage access, which will allow testing this more easily. (That commit includes a layout test that crashes on WPE without this change and passes with it.)\n\n* Source/WebKit/UIProcess/CoordinatedGraphics/DrawingAreaProxyCoordinatedGraphics.cpp:\n(WebKit::DrawingAreaProxyCoordinatedGraphics::enterAcceleratedCompositingMode):\n\nCanonical link: https://commits.webkit.org/318334@main", "email": "jeffrey_xu2@apple.com", "hash": "8f184a1bee4b3815392bd9ee1e7ca8ad0ab88836", "subject": "Fix crash on WPE caused by process swap on cross-origin iframe in Site Isolation due to entering compositing mode twice." }, "318335@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "318335@main", "clUrl": "https://commits.webkit.org/318335@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320730\nrdar://183715116\n\nReviewed by Jessica Cheung.\n\nViewportArguments declares its 1-byte Type member ahead of eight floats, so the\ncompiler inserts 3 bytes of padding after it, and the three trailing 1-byte\nmembers leave another byte of tail padding: sizeof() is 40 where 36 would do.\nMove `type` down beside the other small members so all four pack into the final\nword.\n\nTwo things have to move with it. The generated IPC code asserts that the member\norder in the .serialization.in description matches the declaration order -- see\nthe ShouldBeSameSizeAs and IsIncreasing static_asserts emitted by\nScripts/generate-serializers.py -- so the description is reordered to match. The\ngenerated decoder also constructs the struct positionally, so the 12-argument\nconstructor, which has no callers other than that decoder, takes `type` in its\nnew position.\n\nAlso stop passing ViewportArguments to computeViewportAttributes() by value. It\nis only read there, through the const resolve(), so a const reference is both\ncheaper and a more honest signature.\n\nNo change in behavior.\n\n* Source/WebCore/dom/ViewportArguments.cpp:\n(WebCore::computeViewportAttributes):\n* Source/WebCore/dom/ViewportArguments.h:\n(WebCore::ViewportArguments::ViewportArguments):\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n\nCanonical link: https://commits.webkit.org/318335@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "d583cf1b5117746c0c7bbf50169f8679b103f7ea", "subject": "Reduce sizeof(ViewportArguments) and stop copying it into computeViewportAttributes()" }, "318336@main": { "author": "Devin Rousso", "avatar": "https://www.gravatar.com/avatar/c9e757d973342c773f107a94b70cb9cd?d=identicon\u0026s=64", "cl": "318336@main", "clUrl": "https://commits.webkit.org/318336@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320694\n\nReviewed by Mike Wyrzykowski.\n\n* Source/WebCore/Modules/WebGPU/GPUDevice.h:\n(WebCore::GPUDevice::create):\n(WebCore::GPUDevice::instances): Added.\n(WebCore::GPUDevice::instancesLock): Added.\n(WebCore::GPUDevice::isContextThread const): Added.\n(WebCore::GPUDevice::contextDestroyed): Added.\n(WebCore::GPUDevice::scriptExecutionContext const):\n* Source/WebCore/Modules/WebGPU/GPUDevice.cpp:\n(WebCore::GPUDevice::instances): Added.\n(WebCore::GPUDevice::instancesLock): Added.\n(WebCore::GPUDevice::create):\n(WebCore::GPUDevice::GPUDevice):\n(WebCore::GPUDevice::~GPUDevice):\n(WebCore::GPUDevice::contextDestroyed): Added.\nNotify inspector after creation and before destruction.\nTrack all live `GPUDevice` so inspector can instrument them when the frontend is opened.\n\n* Source/WebCore/html/canvas/GPUCanvasContext.h:\n(WebCore::GPUCanvasContext::device const): Added.\n* Source/WebCore/html/canvas/GPUCanvasContextCocoa.h:\n(WebCore::GPUCanvasContextCocoa::~GPUCanvasContextCocoa): Added.\n(WebCore::GPUCanvasContextCocoa::device const): Added.\n* Source/WebCore/html/canvas/GPUCanvasContextCocoa.mm:\n(WebCore::GPUCanvasContextCocoa::~GPUCanvasContextCocoa): Added.\n(WebCore::GPUCanvasContextCocoa::didUpdateCanvasSizeProperties):\n(WebCore::GPUCanvasContextCocoa::configure):\n(WebCore::GPUCanvasContextCocoa::unconfigure):\nExpose the `GPUDevice` configured for a `\u003ccanvas\u003e` and notify inspector whenever a `\u003ccanvas\u003e` starts/stops using a `GPUDevice`.\n\n* Source/WebCore/inspector/InspectorCanvas.h:\n(WebCore::InspectorCanvas::create):\n(WebCore::InspectorCanvas::canvasContext const):\n(WebCore::InspectorCanvas::canvasContext): Deleted.\n(WebCore::InspectorCanvas::deviceContext const): Added.\n(WebCore::InspectorCanvas::getContentAsDataURL):\n(WebCore::InspectorCanvas::InspectorCanvas):\n* Source/WebCore/inspector/InspectorCanvas.cpp:\n(WebCore::InspectorCanvas::create):\n(WebCore::InspectorCanvas::InspectorCanvas):\n(WebCore::InspectorCanvas::canvasContext const): Added.\n(WebCore::InspectorCanvas::deviceContext const): Added.\n(WebCore::canvasContextMatchesDevice): Added.\n(WebCore::InspectorCanvas::canvasElement const):\n(WebCore::InspectorCanvas::scriptExecutionContext const):\n(WebCore::InspectorCanvas::resolveContext):\n(WebCore::InspectorCanvas::memoryCost const):\n(WebCore::InspectorCanvas::clientNodes const):\n(WebCore::InspectorCanvas::canvasChanged):\n(WebCore::InspectorCanvas::resetRecordingData):\n(WebCore::InspectorCanvas::recordAction):\n(WebCore::InspectorCanvas::buildObjectForCanvas):\n(WebCore::InspectorCanvas::releaseObjectForRecording):\n(WebCore::InspectorCanvas::getContentAsDataURL): Added.\n(WebCore::InspectorCanvas::buildInitialState):\nStore either a `CanvasRenderingContext` or a `GPUDevice` in a `Variant` instead of always assuming the former.\nExpose `features` on the `Canvas.Canvas` since they're immutable at creation (unlike `Canvas.ContextAttributes`).\n\n* Source/WebCore/inspector/InspectorInstrumentation.h:\n(WebCore::InspectorInstrumentation::didCreateWebGPUDevice): Added.\n(WebCore::InspectorInstrumentation::willDestroyWebGPUDevice): Added.\n(WebCore::InspectorInstrumentation::didChangeGPUDeviceClientNodes): Added.\n(WebCore::InspectorInstrumentation::didCreateWebGPUDeviceImpl): Added.\n(WebCore::InspectorInstrumentation::willDestroyWebGPUDeviceImpl): Added.\n(WebCore::InspectorInstrumentation::didChangeGPUDeviceClientNodesImpl): Added.\n* Source/WebCore/inspector/InspectorInstrumentation.cpp:\n(WebCore::InspectorInstrumentation::didCreateWebGPUDeviceImpl): Added.\n(WebCore::InspectorInstrumentation::willDestroyWebGPUDeviceImpl): Added.\n(WebCore::InspectorInstrumentation::didChangeGPUDeviceClientNodesImpl): Added.\nForward `GPUDevice` lifecycle and `\u003ccanvas\u003e` changes.\n\n* Source/JavaScriptCore/inspector/protocol/Canvas.json:\n* Source/WebCore/inspector/agents/InspectorCanvasAgent.h:\n(WebCore::InspectorCanvasAgent::didCreateWebGPUDevice): Added.\n(WebCore::InspectorCanvasAgent::willDestroyWebGPUDevice): Added.\n(WebCore::InspectorCanvasAgent::findInspectorCanvas): Added WebGPU overload.\n(WebCore::InspectorCanvasAgent::bindCanvas): Added WebGPU overload.\n* Source/WebCore/inspector/agents/InspectorCanvasAgent.cpp:\n(WebCore::InspectorCanvasAgent::internalEnable):\n(WebCore::InspectorCanvasAgent::resolveContext):\n(WebCore::InspectorCanvasAgent::startRecording):\n(WebCore::InspectorCanvasAgent::stopRecording):\n(WebCore::InspectorCanvasAgent::didChangeCanvasSize):\n(WebCore::InspectorCanvasAgent::didChangeCanvasMemory):\n(WebCore::InspectorCanvasAgent::didCreateWebGPUDevice): Added.\n(WebCore::InspectorCanvasAgent::willDestroyWebGPUDevice): Added.\n(WebCore::InspectorCanvasAgent::recordAction):\n(WebCore::InspectorCanvasAgent::reset):\n(WebCore::InspectorCanvasAgent::bindCanvas):\n(WebCore::InspectorCanvasAgent::unbindCanvas):\n(WebCore::InspectorCanvasAgent::findInspectorCanvas):\nDiscover existing `GPUDevice` when `Canvas` instrumentation is enabled.\n\n* Source/WebCore/inspector/agents/page/PageCanvasAgent.h:\n(WebCore::PageCanvasAgent::didChangeGPUDeviceClientNodes): Added.\n* Source/WebCore/inspector/agents/page/PageCanvasAgent.cpp:\n(WebCore::PageCanvasAgent::didChangeGPUDeviceClientNodes): Added.\nCollect every `\u003ccanvas\u003e` configured for the `GPUDevice` for `Canvas.getClientNodes`.\n\n* Source/WebInspectorUI/UserInterface/Controllers/CanvasManager.js:\n(WI.CanvasManager.prototype._handleTargetRemoved):\nRemove all `WI.Canvas` when a `WI.Target` is destroyed.\n\n* Source/WebInspectorUI/UserInterface/Models/Canvas.js:\n(WI.Canvas):\n(WI.Canvas.fromPayload):\n(WI.Canvas.prototype.features): Added.\n* Source/WebInspectorUI/UserInterface/Views/CanvasDetailsSidebarPanel.js:\n(WI.CanvasDetailsSidebarPanel.prototype.initialLayout):\n(WI.CanvasDetailsSidebarPanel.prototype.layout):\n(WI.CanvasDetailsSidebarPanel.prototype._refreshFeaturesSection): Added.\nShow a new \"Features\" panel in the details sidebar.\n\n* Source/WebInspectorUI/Localizations/en.lproj/localizedStrings.js:\n\n* LayoutTests/inspector/canvas/resources/webgpu-worker.js: Added.\n* LayoutTests/inspector/canvas/create-context-webgpu.html: Added.\n* LayoutTests/inspector/canvas/create-context-webgpu-expected.txt: Added.\n* LayoutTests/inspector/canvas/requestClientNodes-webgpu.html: Added.\n* LayoutTests/inspector/canvas/requestClientNodes-webgpu-expected.txt: Added.\n* LayoutTests/inspector/canvas/resolveContext-webgpu.html: Added.\n* LayoutTests/inspector/canvas/resolveContext-webgpu-expected.txt: Added.\n* LayoutTests/inspector/canvas/worker-webgpu.html: Added.\n* LayoutTests/inspector/canvas/worker-webgpu-expected.txt: Added.\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/win/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318336@main", "email": "hi@devinrousso.com", "hash": "f3e34dde7c9d3ed83bca6c9445800cb499bd8b5d", "subject": "Web Inspector: Canvas: instrument WebGPU devices" }, "318337@main": { "author": "Eric Carlson", "avatar": "https://www.gravatar.com/avatar/e227ff07cc6d645fc1c69fd56c2c8cb8?d=identicon\u0026s=64", "cl": "318337@main", "clUrl": "https://commits.webkit.org/318337@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320460\nrdar://183427356\n\nReviewed by Andy Estes.\n\nUnder site isolation RemoteMediaSessionManagerProxy is the UI-process shared AudioSession,\nbut its tryToSetActiveInternal() was a stub that always resolved without doing anything,\nso the real audio session -- which lives per-web-process in the GPU process -- was never\nactually activated or deactivated, and the web process's AudioSession::isActive() never\nreflected whether audio was really active.\n\nThis PR makes activation work end to end:\n\n1. Activation is routed through the MediaSessionManagerClient added in bug 320247.\nRemoteMediaSessionManagerProxy installs a client that, on activation, tells the GPU process\nto activate the audio session for the web process that owns the triggering session, and\nremembers that process so the matching deactivation targets it. The default\nPageMediaSessionManagerClient keeps activating AudioSession::singleton() directly, so\nnon-site-isolation behavior is unchanged.\n\n2. The GPU process pushes the resulting active state back to the owning web process via a\nnew RemoteAudioSessionConfiguration::isActive field, and RemoteAudioSession mirrors it, so\nAudioSession::isActive() and its observers behave the same with and without site isolation\neven though the activation is decided in the UI process when site isolation is enabled.\n\n3. Because RemoteMediaSessionManagerProxy is a process-wide singleton, it now enables\nshouldDeactivateAudioSession() itself, and drops a web process's sessions when that process\ngoes away (from WebProcessProxy::shutDown, which runs on both clean teardown and crash).\nOtherwise the shared session's \"became active\" state stayed latched on behalf of a process\nthat no longer exists, leaving the session wedged active and preventing later processes\nfrom activating.\n\nActivation is attributed to the process that owns the media session; a follow-up will attribute it\nto the page's top-level frame process (one audio-session proxy per page) so multiple\nconcurrently-playing processes each activate correctly.\n\nTest: http/tests/site-isolation/audio-session-active.html\n\n* LayoutTests/http/tests/site-isolation/audio-session-active-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-active.html: Added.\n* Source/WebCore/platform/audio/MediaSessionManagerClient.h:\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.cpp:\n(WebCore::MediaSessionManagerInterface::setClient):\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.h:\n* Source/WebKit/GPUProcess/GPUProcess.cpp:\n(WebKit::GPUProcess::tryToSetAudioSessionActiveForProcess):\n* Source/WebKit/GPUProcess/GPUProcess.h:\n* Source/WebKit/GPUProcess/GPUProcess.messages.in:\n* Source/WebKit/GPUProcess/media/RemoteAudioSessionProxy.cpp:\n(WebKit::RemoteAudioSessionProxy::configuration):\n* Source/WebKit/GPUProcess/media/RemoteAudioSessionProxy.h:\n* Source/WebKit/GPUProcess/media/RemoteAudioSessionProxyManager.cpp:\n(WebKit::RemoteAudioSessionProxyManager::tryToSetActiveForProcess):\n* Source/WebKit/GPUProcess/media/RemoteAudioSessionProxyManager.h:\n* Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp:\n(WebKit::GPUProcessProxy::tryToSetAudioSessionActiveForProcess):\n* Source/WebKit/UIProcess/GPU/GPUProcessProxy.h:\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.cpp:\n(WebKit::RemoteMediaSessionManagerProxy::singleton):\n(WebKit::RemoteMediaSessionManagerProxy::singletonIfCreated):\n(WebKit::RemoteMediaSessionManagerProxy::RemoteMediaSessionManagerProxy):\n(WebKit::RemoteMediaSessionManagerProxy::webProcessWillShutDown):\n(WebKit::RemoteMediaSessionManagerProxy::tryToSetActiveInternal):\n(WebKit::singletonWeakPtr):\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.h:\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::shutDown):\n* Source/WebKit/WebProcess/GPU/media/RemoteAudioSession.cpp:\n(WebKit::RemoteAudioSession::configurationChanged):\n* Source/WebKit/WebProcess/GPU/media/RemoteAudioSessionConfiguration.h:\n* Source/WebKit/WebProcess/GPU/media/RemoteAudioSessionConfiguration.serialization.in:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::TEST(SiteIsolation, DISABLED_PlayAudioInMultipleFrames)):\n(TestWebKitAPI::TEST(SiteIsolation, PlayAudioInMultipleFrames)): Deleted.\n\nCanonical link: https://commits.webkit.org/318337@main", "email": "eric.carlson@apple.com", "hash": "3ce5660d758653dc7dd49eef94fd38d4dcaebd6f", "subject": "[Site Isolation] Activate the audio session in the GPU process when site isolation is enabled" }, "318338@main": { "author": "Richard Robinson", "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64", "cl": "318338@main", "clUrl": "https://commits.webkit.org/318338@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320725\nrdar://183709792\n\nReviewed by Abrar Rahman Protyasha and Lily Spiniolas.\n\nThis is a generic coordinate conversion issue; a few places in `WebTouchEvent` were passing in a location\nin root view to a function that expected a location in contents view.\n\nFix by adding a transformation function that accepts a point in root view coordinates, and fix the call sites.\n\nTest: http/tests/site-isolation/touch-events/drag-nested-cross-origin-frame-in-offset-subframe.html\n\n* LayoutTests/http/tests/site-isolation/touch-events/drag-nested-cross-origin-frame-in-offset-subframe-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/touch-events/drag-nested-cross-origin-frame-in-offset-subframe.html: Added.\n* LayoutTests/http/tests/site-isolation/touch-events/resources/nested-frame-reports-touch-coordinates.html: Added.\n* LayoutTests/http/tests/site-isolation/touch-events/resources/samesite-offset-container-touch.html: Added.\n* Source/WebCore/page/RemoteFrameGeometryTransformer.cpp:\n(WebCore::RemoteFrameGeometryTransformer::transformRootViewPointToRemoteFrameCoordinates const):\n* Source/WebCore/page/RemoteFrameGeometryTransformer.h:\n* Source/WebKit/Shared/WebTouchEvent.cpp:\n(WebKit::WebTouchEvent::transformToRemoteFrameCoordinates):\n(WebKit::WebPlatformTouchPoint::transformToRemoteFrameCoordinates):\n\nCanonical link: https://commits.webkit.org/318338@main", "email": "richard_robinson2@apple.com", "hash": "20e4b95ce5e0453f3c9017d4dbe7c0255340c403", "subject": "[Site Isolation] [iOS] Drag gesture doesn't register inside cross-origin iframe (douban.com captcha)" }, "318339@main": { "author": "Zak Ridouh", "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64", "cl": "318339@main", "clUrl": "https://commits.webkit.org/318339@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320684\nrdar://183668313\n\nReviewed by Elliott Williams.\n\nThe Test* targets hand-roll their Swift flags in TESTWEBKITAPI_SWIFT_FLAGS\nrather than going through _WEBKIT_TARGET_SETUP, so they never reached the\nexplicit-module-build block that WebKit, WebGPU and PAL opt into via\n${_target}_SWIFT_EXPLICIT_MODULE_BUILD. Setting that variable here has no\neffect; the flags have to be passed directly.\n\nAll seven Test* targets compile the same five Runner/*.swift files against\nthe same C++ interop modules, so with implicit modules the first target to\nrun populates the whole Clang module cache from scratch while the rest wait\non it. Measured on a mac-dev-debug build (M3 Max), rebuilding the seven\nrunner Swift edges with a cold SwiftModuleCache:\n\n wall cold edge sum of edges module cache\n implicit modules 203s 192.3s 236.4s 985 MB / 540 PCMs\n explicit modules 38s 29.0s 71.0s 498 MB / 1448 PCMs\n\nThat is a 165s (-81%) improvement, and the cache is half the size despite\nholding finer-grained, deduplicated modules. The clean-build benchmark\ndeletes the build directory, so it always starts from a cold module cache\nand sees the full win. Warm edges are ~7s either way, so incremental builds\nare unaffected.\n\nThis matches Xcode, which already builds these targets with explicit Swift\nmodules: Tools/TestWebKitAPI/Configurations/Base.xcconfig sets\n_SWIFT_EXPLICIT_MODULES_ALLOW_CXX_INTEROP to WK_SUPPORTS_SWIFT_OBJCXX_INTEROP.\nNo SDK gating is needed -- the only setter that carves out SDKs is bmalloc,\nwhose constraint is about SDKs tc module, and this\nwhole block is already inside if (WEBKIT_SDK_IS_MACOS), where\nWK_SUPPORTS_SWIFT_OBJCXX_INTEROP\n\nThe two -Xcc experimental-attribt optional: without\nthem clang rejects the cached SwiftShims PCM with \"experimental late parsing\nof attributes was enabled in prently disabled\".\nThey mirror the other three explicit-module-build sites in the CMake build\n(WebKitMacros.cmake for WebKit/W and\n_WebKit_SwiftUI in Source/WebKit/PlatformCocoa.cmake). They are a CMake-only\nworkaround; Xcode needs neither.\n\n* Tools/TestWebKitAPI/PlatformCocoa.cmake:\n\nCanonical link: https://commits.webkit.org/318339@main", "email": "zakr@apple.com", "hash": "681430f8805ed3bd1367d1bb0cead18f5c668766", "subject": "[CMake] Enable explicit module builds for the TestWebKitAPI Swift targets" }, "318340@main": { "author": "Ryosuke Niwa", "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64", "cl": "318340@main", "clUrl": "https://commits.webkit.org/318340@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320749\n\nUnreviewed. Update safer C++ expectations.\n\n* Source/WebKit/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/WebKit/SaferCPPExpectations/UncountedCallArgsCheckerExpectations:\n\nCanonical link: https://commits.webkit.org/318340@main", "email": "rniwa@webkit.org", "hash": "b6e0db335895f69a24cbe5439efff7e921d5d77c", "subject": "Update safer C++ expectations for macOS (2026-07-31)" }, "318341@main": { "author": "David Kilzer", "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64", "cl": "318341@main", "clUrl": "https://commits.webkit.org/318341@main", "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=320324\u003e\n\u003crdar://183264359\u003e\n\nReviewed by Darin Adler, Abrar Rahman Protyasha, and Zak Ridouh.\n\nFollow-up to 317934@main, which implemented the same optimization\nat sites whose predicate was a pure function of the element. The\nsites converted here additionally perform a per-element side effect (a\nrelease log, a secondary-container update, or `std::exchange`\nbookkeeping). Because `removeIf()` visits each live entry exactly once,\nthe side effect moves into the lambda unchanged, eliminating the\ntemporary storage and the second traversal.\n\nOne candidate, `WebBackForwardCache::removeEntriesMatching()`, is\nintentionally left as a two-pass loop: its side effect can destroy a\n`SuspendedPageProxy` whose teardown re-enters the cache and mutates the\ncontainer, which a single-pass `removeIf()` would do mid-iteration.\n\nAdd `removeIf()` to `WeakHashSet` and `WeakListHashSet` so that call\nsites backed by those weak containers can use the same single-pass\nalgorithm. `HashMap`, `HashSet`, `ListHashSet`, and `WeakHashMap`\nalready provide it; the two additions delegate to the underlying\ncontainer's `removeIf()`, drop dead (null) weak references without\ninvoking the predicate, and then run the amortized cleanup, matching\n`WeakHashMap::removeIf()`.\n\nWhere the predicate reads a member guarded by a lock, the lambda calls\n`assertIsHeld()` because the Clang thread-safety analyzer does not carry\nthe caller's lock state into a lambda body.\n\nTests: WTF_WeakPtr.WeakHashSetRemoveIf\n WTF_WeakPtr.WeakListHashSetRemoveIf\n\n* Source/WTF/wtf/WeakHashSet.h:\n(WTF::WeakHashSet::removeIf): Add.\n* Source/WTF/wtf/WeakListHashSet.h:\n(WTF::WeakListHashSet::removeIf): Add.\n* Source/WebCore/Modules/gamepad/GamepadManager.cpp:\n(WebCore::GamepadManager::updateQuarantineStatus):\n* Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp:\n(WebCore::IDBObjectStore::rollbackForVersionChangeAbort):\n* Source/WebCore/Modules/indexeddb/IDBTransaction.cpp:\n(WebCore::IDBTransaction::abortInternal):\n* Source/WebCore/Modules/indexeddb/server/IndexValueStore.cpp:\n(WebCore::IDBServer::IndexValueStore::removeEntriesWithValueKey):\n* Source/WebCore/animation/StyleOriginatedTimelinesController.cpp:\n(WebCore::StyleOriginatedTimelinesController::unregisterNamedTimelinesAssociatedWithElement):\n* Source/WebCore/loader/cache/CachedResourceLoader.cpp:\n(WebCore::CachedResourceLoader::garbageCollectDocumentResources):\n* Source/WebCore/platform/graphics/cg/CGSubimageCacheWithTimer.cpp:\n(WebCore::CGSubimageCacheWithTimer::prune):\n* Source/WebCore/rendering/RenderView.cpp:\n(WebCore::RenderView::resumePausedImageAnimationsIfNeeded):\n* Source/WebKit/NetworkProcess/NetworkBroadcastChannelRegistry.cpp:\n(WebKit::NetworkBroadcastChannelRegistry::removeConnection):\n* Source/WebKit/NetworkProcess/storage/CacheStorageManager.cpp:\n(WebKit::CacheStorageManager::connectionClosed):\n* Source/WebKit/UIProcess/WebBackForwardCache.cpp:\n(WebKit::WebBackForwardCache::removeEntriesMatching):\n- Document why removeIf() can't be used.\n* Source/WebKit/UIProcess/WebProcessCache.cpp:\n(WebKit::WebProcessCache::clearAllProcessesForSession):\n* Source/WebKit/WebProcess/WebPage/WebFoundTextRangeController.cpp:\n(WebKit::WebFoundTextRangeController::decorateTextRangeWithStyle):\n* Tools/TestWebKitAPI/Tests/WTF/WeakPtr.cpp:\n(TestWebKitAPI::TEST(WTF_WeakPtr, WeakHashSetRemoveIf)): Add.\n(TestWebKitAPI::TEST(WTF_WeakPtr, WeakListHashSetRemoveIf)): Add.\n\nCanonical link: https://commits.webkit.org/318341@main", "email": "ddkilzer@apple.com", "hash": "f7a9d16e1531496bbe9d20952252b0d28aa56061", "subject": "Add removeIf() to WeakHashSet and WeakListHashSet and adopt it to simplify more remove-matching-entries loops" }, "318342@main": { "author": "Vitaly Dyachkov", "avatar": "https://www.gravatar.com/avatar/ab950c52088e289585a5a01580ec66a4?d=identicon\u0026s=64", "cl": "318342@main", "clUrl": "https://commits.webkit.org/318342@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320449\n\nReviewed by Carlos Garcia Campos.\n\nCurrent implementation walks the layer tree and returns the first layer\nit encounters that has a scrolling node, with no check that this layer\nis actually the one visually on top at the hit point. As a result, a\nscrolling node can be chosen even when it's covered by an unrelated\nelement positioned on top of it.\n\nThis patch mirrors the `ScrollingTreeMac` implementation as closely as\npossible: layers at the hit point are collected front-to-back, and a\ncandidate scrolling node is only accepted once `isScrolledBy()` confirms\nit's actually an ancestor of the frontmost interactive layer with a\nfallback to layers further back for the case where the frontmost layer\nis itself non-interactive.\n\n* Source/WebCore/page/scrolling/coordinated/ScrollingTreeCoordinated.cpp:\n(WebCore::collectDescendantLayersAtPoint):\nWalks the layer tree under a given point and builds a flat list of every\nlayer whose bounds contain the point.\n(WebCore::isScrolledBy):\nGiven a candidate scrolling node and the actual frontmost hit layer,\nwalks up the frontmost layer's ancestor chain checking whether that\nscrolling node owns it.\n(WebCore::ScrollingTreeCoordinated::scrollingNodeForPoint):\nCollects all candidate layers front-to-back, remembers the first\n(\"frontmost\") one that is interactive, and for each candidate checks\nwhether its scrolling node is confirmed by `isScrolledBy()` against that\nfrontmost layer. If the frontmost interactive layer itself isn't\nscrollable, falls back to checking layers further behind it.\n(WebCore::ScrollingTreeCoordinated::eventListenerRegionTypesForPoint const):\n(WebCore::traverseDescendantLayersAtPoint): Deleted.\n(WebCore::layersAtPointToCheckForScrolling):\n(WebCore::layerEventRegionContainsPoint):\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.cpp:\n(WebCore::CoordinatedPlatformLayer::setChildren):\n(WebCore::CoordinatedPlatformLayer::removeFromParent):\n(WebCore::CoordinatedPlatformLayer::masksToBounds const):\n(WebCore::CoordinatedPlatformLayer::mask const):\n(WebCore::CoordinatedPlatformLayer::parent const):\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.h:\n(WebCore::CoordinatedPlatformLayer::parent const):\n* LayoutTests/platform/glib/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318342@main", "email": "vitaly@igalia.com", "hash": "10bb43f2800676df37a1c6cee6fe646e330858f9", "subject": "Improve `ScrollingTreeCoordinated` layer hit testing" }, "318343@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "318343@main", "clUrl": "https://commits.webkit.org/318343@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320406\nrdar://183366125\n\nReviewed by Simon Fraser.\n\nRe-snapping after a layout change selects a snap target per axis\nindependently. When the block-axis box and inline-axis box differ and\ncannot both be snapped (snapping to one leaves the other outside the\nsnapport), css-scroll-snap requires resolving to a single box: \"it must\nprefer the focused box, followed by the targeted box, followed by the\nblock axis if neither box is focused or targeted\" [1]. WebKit kept the\ntwo independently-selected boxes, so the scroller followed neither.\n\nDetect the conflict in resnapAfterLayout(): form the combined snap\nposition (the inline box's offset in one axis, the block box's offset in\nthe other) and check whether both areas still intersect the snapport\nthere. If they do, both boxes can be snapped and per-axis selection\nstands. If they do not, collapse both axes onto one box, preferring\nfocused, then targeted, then the block-axis box. Which physical axis is\nthe block axis depends on the snap container's writing mode, so plumb\nscrollerHasVerticalWritingMode onto LayoutScrollSnapOffsetsInfo (computed\nwhere offsets are built and serialized to the scrolling thread).\n\nResolving the conflict needs a box's snap area as well as its offset, and\nit needs the focused/targeted preference over a restricted set of boxes,\nso two lookups are factored out for it: snapOffsetAndAreaIndicesForNode()\nfinds a box's offset and its own area in one pass over the offset's areas\n(snapOffsetIndexForNode() now projects it), and flaggedNodeForAxis() finds\nan axis's focused or targeted box under a caller-supplied filter, shared\nwith focusedOrTargetedNodeForAxis() and focusedOrTargetedBox().\n\n[1] https://drafts.csswg.org/css-scroll-snap/#re-snap\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/snap-after-relayout/snap-to-different-targets-expected.txt: Progression\n* LayoutTests/imported/w3c/web-platform-tests/css/css-scroll-snap/snap-to-combination-of-two-elements-2-expected.txt: Rebaseline (matches Chrome)\n* Source/WebCore/page/scrolling/ScrollSnapOffsetsInfo.cpp:\n(WebCore::updateSnapOffsetsForScrollableArea):\n(WebCore::convertOffsetInfo):\n* Source/WebCore/page/scrolling/ScrollSnapOffsetsInfo.h:\n(WebCore::ScrollSnapOffsetsInfo::blockAxis const):\n(WebCore::ScrollSnapOffsetsInfo::isEqual const):\n* Source/WebCore/platform/ScrollSnapAnimatorState.cpp:\n(WebCore::ScrollSnapAnimatorState::snapOffsetAndAreaIndicesForNode const):\n(WebCore::ScrollSnapAnimatorState::snapOffsetIndexForNode const):\n(WebCore::ScrollSnapAnimatorState::flaggedNodeForAxis const):\n(WebCore::ScrollSnapAnimatorState::focusedOrTargetedNodeForAxis const):\n(WebCore::ScrollSnapAnimatorState::focusedOrTargetedBox const):\n(WebCore::ScrollSnapAnimatorState::snapAreaAndOffsetForNode const):\n(WebCore::ScrollSnapAnimatorState::resolvePreferredBoxForAxisConflict const):\n(WebCore::ScrollSnapAnimatorState::resnapAfterLayout):\n* Source/WebCore/platform/ScrollSnapAnimatorState.h:\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n\nCanonical link: https://commits.webkit.org/318343@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "ff1e94f74356e1ce4245e2a157e1c3e6a2889545", "subject": "[CSS Scroll Snap] Re-snap should prefer the block-axis box when the two axes conflict" }, "318344@main": { "author": "Zak Ridouh", "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64", "cl": "318344@main", "clUrl": "https://commits.webkit.org/318344@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320682\nrdar://183667606\n\nReviewed by Elliott Williams.\n\n_WEBKIT_TARGET_INTERFACE attached ${_target}_CodeSign to the interface\nlibrary that every consumer links. CMake cannot know what a utility target\nproduces, so it conservatively makes each one in a consumer's dependency\nclosure an order-only dependency of every one of that consumer's object\nfiles. Nothing in WebCore compiled until JavaScriptCore had linked and been\nsigned, nothing in WebKit until WebCore and WebKitLegacy had, and so on;\nJavaScriptCore_CodeSign alone gated 877 compile edges, 51% of the build's\ncompile work.\n\nDepend on the code signing stamp file instead, via INTERFACE_LINK_DEPENDS.\nCompiling against a framework needs its staged headers and module maps,\nwhich ${_target}_INTERFACE_DEPENDENCIES already orders; only linking reads\nthe binary that `codesign --force` rewrites in place. Depending on the stamp\nalso keeps signing ordered ahead of a directly built target, which the\nALL-ness of ${_target}_CodeSign did not guarantee. Executables sign in a\nPOST_BUILD command and have no stamp, so they keep the existing target-level\ndependency.\n\n39 of 82 cmake_object_order_depends_target_* phonies carried a *_CodeSign\ndependency before, 0 after; on iOS, 29 of 79 before, 0 after.\n\n* Source/cmake/WebKitMacros.cmake:\n\nCanonical link: https://commits.webkit.org/318344@main", "email": "zakr@apple.com", "hash": "050a60948e62dcc9d9a0c4c6028235b889aece75", "subject": "[CMake] Don't gate compiles on dependency framework code signing" }, "318345@main": { "author": "Sammy Gill", "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64", "cl": "318345@main", "clUrl": "https://commits.webkit.org/318345@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320664\nrdar://182725413\n\nReviewed by Alan Baradlay.\n\nItems which are baseline aligned have track sizing implications that we\ndo not have support for yet, but we should have the logic for every\nother type of self alignment. Let's allow this type of content to run\nthrough GFC.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-self-alignment-fit-content-001-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-self-alignment-fit-content-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-self-alignment-positional-values-001-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-self-alignment-positional-values-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-self-alignment-unsafe-overflow-001-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-self-alignment-unsafe-overflow-001.html: Added.\nSome tests to help cover these cases since it did not seem like WPT had\nany tests that covered what we currently support now.\n\nCanonical link: https://commits.webkit.org/318345@main", "email": "sammy.gill@apple.com", "hash": "e9d9335369a32827e394d49a82a1466f1b2ce18a", "subject": "[GFC][Integration] Allow every non-baseline self-alignment value" }, "318346@main": { "author": "Youenn Fablet", "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64", "cl": "318346@main", "clUrl": "https://commits.webkit.org/318346@main", "description": "rdar://183529369\nhttps://bugs.webkit.org/show_bug.cgi?id=320562\n\nReviewed by Alex Christensen.\n\nBefore this PR, whenever the service worker was starting to read the upload body, we would send upload data as fast as possible to the service worker.\nWebResourceLoader is now sending only a first burst of data (64ko) and waits for the service worker to acknowledge that it has received this data.\nService worker is registering a drained handler on the service worker stream upload.\nWhenever the web page reads enough data to trigger the drained handler, the service worker will send IPC to network process,\nthat will forward the IPC to WebResourceLoader, which will send another burst of data (64ko) before waiting for a new message from service worker.\n\nWe need to tie the fetch body stream backpressure mechanism to the PendingStreamState backpressure.\nTo do so, we make FormDataConsumer wait for a signal from FetchBodySource to actually draing the PendingStreamState.\nWe introduce FormDataConsumer::resume, which takes the pull promise.\nThe pull promise gets resolved when some chunks are pushed in the fetch body stream.\nOnce the JS reads sufficient data, FetchBodySource::pull will be called again, which will resume FormDataConsumer.\n\nCovered by updated test.\n\n* LayoutTests/http/wpt/service-workers/upload-stream-backpressure-worker.js:\n(event.event.respondWith.async await):\n(event.event.respondWith):\n(event.url.searchParams): Deleted.\n* LayoutTests/http/wpt/service-workers/upload-stream-backpressure.https-expected.txt:\n* LayoutTests/http/wpt/service-workers/upload-stream-backpressure.https.html:\n* Source/WebCore/Modules/fetch/FetchBodyConsumer.cpp:\n(WebCore::FetchBodyConsumer::consumeFormDataAsStream):\n* Source/WebCore/Modules/fetch/FetchBodySource.cpp:\n(WebCore::FetchBodySource::pull):\n(WebCore::FetchBodySource::setFormDataConsumer):\n(WebCore::FetchBodySource::isPulling const):\n(WebCore::FetchBodySource::resolvePullPromise):\n* Source/WebCore/Modules/fetch/FetchBodySource.h:\n* Source/WebCore/Modules/fetch/FormDataConsumer.cpp:\n(WebCore::FormDataConsumer::consumePendingStream):\n(WebCore::FormDataConsumer::drainPendingStream):\n(WebCore::FormDataConsumer::resume):\n* Source/WebCore/Modules/fetch/FormDataConsumer.h:\n(WebCore::FormDataConsumer::hasPendingPull const):\n* Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerToContextConnection.cpp:\n(WebKit::WebSWServerToContextConnection::pendingStreamUploadNeedData):\n* Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerToContextConnection.h:\n* Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerToContextConnection.messages.in:\n* Source/WebKit/WebProcess/Network/WebResourceLoader.cpp:\n(WebKit::WebResourceLoader::drainPendingStreamIfPossible):\n(WebKit::WebResourceLoader::serviceWorkerPendingStreamForwardingNeedData):\n* Source/WebKit/WebProcess/Network/WebResourceLoader.h:\n* Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.cpp:\n(WebKit::WebSWContextManagerConnection::startFetch):\n\nCanonical link: https://commits.webkit.org/318346@main", "email": "youenn@apple.com", "hash": "9baf1695f93dd8f0e7abb02a6b0f9076dcdd8323", "subject": "Support stream upload back pressure in case of service worker reading the upload data" } }, "date": "2026-07-31", "days": 1, "generatedAt": "2026-07-31T22:06:08Z", "markdown": "## Highlights\n- **Networking** Stream upload now applies back pressure when a service worker reads request bodies, reducing buffering bugs and making upload streaming behave correctly under interception. [commit 318346@main](https://commits.webkit.org/318346@main)\n- **Privacy** Intelligent Tracking Prevention no longer wrongly caps cookie expiry on a top-level navigation's own response, fixing a real regression in first-party cookie handling. [commit 318332@main](https://commits.webkit.org/318332@main)\n- **DevTools** Web Inspector can now instrument WebGPU devices for canvas inspection, a meaningful step toward first-class GPU debugging. [commit 318336@main](https://commits.webkit.org/318336@main)\n- **Mobile** Site isolation on iOS fixed two major input failures in cross-origin iframes: drag gestures and long-press text selection now register correctly. [commit 318338@main](https://commits.webkit.org/318338@main) [commit 318296@main](https://commits.webkit.org/318296@main)\n- **Rendering** Cross-site iframe rendering got a solid round of stability fixes, including blank iframes after navigation, stuck about:blank after reinsertion, and PDF HUD positioning inside isolated frames. [commit 318319@main](https://commits.webkit.org/318319@main) [commit 318289@main](https://commits.webkit.org/318289@main) [commit 318330@main](https://commits.webkit.org/318330@main)\n- **Security** WebKit added sandbox syscall telemetry and tightened Enhanced Security state tracking to the latest navigation action, giving security debugging and policy decisions better signal. [commit 317594@main](https://commits.webkit.org/317594@main) [commit 318304@main](https://commits.webkit.org/318304@main)\n- **V8** JavaScriptCore landed a strong perf and correctness batch: faster regexp execution, broader Comba multiplication deployment, and safer optimizer assumptions around array enumeration and module import attributes. [commit 318325@main](https://commits.webkit.org/318325@main) [commit 318298@main](https://commits.webkit.org/318298@main) [commit 318293@main](https://commits.webkit.org/318293@main) [commit 318292@main](https://commits.webkit.org/318292@main)\n- **A11y** PDF accessibility work started with new foundation for PDF accessibility modes, signaling deeper document accessibility support on the way. [commit 318307@main](https://commits.webkit.org/318307@main)\n\n## What landed by area\n\n### Site Isolation and frame lifecycle\n- **Rendering** Fixed a WPE crash during process swap on a cross-origin iframe caused by entering compositing mode twice. [commit 318334@main](https://commits.webkit.org/318334@main)\n- **Rendering** Cross-site iframes now render again after same-site top-level navigation instead of disappearing. [commit 318319@main](https://commits.webkit.org/318319@main)\n- **Rendering** Cross-origin iframes no longer get stuck at about:blank after removal and re-insertion. [commit 318289@main](https://commits.webkit.org/318289@main)\n- **UI** PDF HUD positioning inside cross-origin PDF iframes now stays aligned when the main frame scrolls. [commit 318330@main](https://commits.webkit.org/318330@main)\n- **Mobile** Drag gestures inside cross-origin iframes now register correctly on iOS, fixing a visible captcha interaction bug. [commit 318338@main](https://commits.webkit.org/318338@main)\n- **Mobile** Long tap now selects words inside cross-origin iframes on iOS. [commit 318296@main](https://commits.webkit.org/318296@main)\n- **Media** The GPU process now activates the audio session when site isolation is enabled, avoiding broken audio behavior in that mode. [commit 318337@main](https://commits.webkit.org/318337@main)\n\n### CSS, layout, scrolling, and rendering\n- **Web Platform** Grid and flex self-alignment now allow every non-baseline self-alignment value under GFC integration. [commit 318345@main](https://commits.webkit.org/318345@main)\n- **Web Platform** CSS Scroll Snap re-snap logic now prefers the block-axis box when axes conflict, improving spec compliance. [commit 318343@main](https://commits.webkit.org/318343@main)\n- **Rendering** ScrollingTreeCoordinated layer hit testing was improved, which should help input targeting under coordinated graphics. [commit 318342@main](https://commits.webkit.org/318342@main)\n- **Perf** ViewportArguments got smaller and stopped being copied into computeViewportAttributes(), shaving overhead in a hot path. [commit 318335@main](https://commits.webkit.org/318335@main)\n- **Web Platform** interactive-widget gained resizes-content behavior, bringing viewport resizing behavior closer to the platform model expected by authors. [commit 318324@main](https://commits.webkit.org/318324@main)\n- **Refactor** Length unit conversion was factored into standalone functions, cleaning up unit handling in layout code. [commit 318317@main](https://commits.webkit.org/318317@main)\n- **Rendering** corner-shape rendering was fixed for outlines and box-shadow spread where corners were misplaced or malformed. [commit 318287@main](https://commits.webkit.org/318287@main)\n- **Rendering** feDropShadow now respects stdDeviation Y updates when X changes. [commit 318281@main](https://commits.webkit.org/318281@main)\n- **Rendering** Angle normalization in GeometryUtilities now handles values above 270 degrees correctly. [commit 318279@main](https://commits.webkit.org/318279@main)\n- **Rendering** Repaint artifacts seen on techmeme.com after back navigation were fixed. [commit 318277@main](https://commits.webkit.org/318277@main)\n- **Web Platform** Passing Custom Highlight painting tests had stale ImageOnlyFailure expectations removed. [commit 318290@main](https://commits.webkit.org/318290@main)\n- **Web Platform** The css-conditional WPT import was refreshed. [commit 318285@main](https://commits.webkit.org/318285@main)\n- **Web Platform** Lazy image loading tests in cross-origin iframes are now passing. [commit 315227@main](https://commits.webkit.org/315227@main)\n\n### JavaScriptCore, Wasm, and low-level runtime\n- **Perf** YARR now starts matching end-anchored fixed-size regexps at the only possible position, cutting wasted work. [commit 318325@main](https://commits.webkit.org/318325@main)\n- **V8** YARR stopped saving sibling and ancestor sibling frame slots for ParenContext, reducing regexp engine overhead. [commit 318318@main](https://commits.webkit.org/318318@main)\n- **Perf** IRO got faster. [commit 318321@main](https://commits.webkit.org/318321@main)\n- **V8** JSC deployed Comba multiplication more broadly for bigint-related arithmetic speedups. [commit 318298@main](https://commits.webkit.org/318298@main)\n- **V8** EnumeratorNextUpdateIndexAndMode now requires the original array structure before using InBoundsSaneChain, tightening optimizer correctness. [commit 318293@main](https://commits.webkit.org/318293@main)\n- **Web Platform** hostResolveImportedModule now respects a module request's import attribute type. [commit 318292@main](https://commits.webkit.org/318292@main)\n- **V8** Wasm IPInt entry support added DEFINE_IPINT_THUNK_FOR_ENTRY plumbing. [commit 318286@main](https://commits.webkit.org/318286@main)\n- **Web Platform** Memory64 now expands declared memory limits correctly. [commit 318282@main](https://commits.webkit.org/318282@main)\n- **Web Platform** Wasm table imports now verify that address types match in Memory64 cases. [commit 318280@main](https://commits.webkit.org/318280@main)\n- **Perf** fast_float was upgraded to 8.2.10. [commit 318323@main](https://commits.webkit.org/318323@main)\n- **Perf** libpas fixed pas_thread_local_cache_for_all clobbering its should-go-again result. [commit 318320@main](https://commits.webkit.org/318320@main)\n- **Build** many-substrings-of-rope-shouldnt-use-excessive-memory-2.js.default was fixed on WPE. [commit 318329@main](https://commits.webkit.org/318329@main)\n- **Build** clang static analyzer builds now use __builtin_trap instead of inline asm. [commit 318284@main](https://commits.webkit.org/318284@main)\n- **Security** PGM allocator no longer reads uninitialized free_status and misclassifies live-allocation OOB as UAF. [commit 318272@main](https://commits.webkit.org/318272@main)\n\n### Networking, storage, and web APIs\n- **Networking** XHR stopped recomputing the final response charset for every received data chunk. [commit 318297@main](https://commits.webkit.org/318297@main)\n- **Web Platform** FileReader.abort() now works on a reused reader after a prior read completes instead of being silently ignored. [commit 318288@main](https://commits.webkit.org/318288@main)\n- **Networking** Infrastructure for enabling the new network loader was cleaned up. [commit 318278@main](https://commits.webkit.org/318278@main)\n- **Privacy** Added logging in logUserInteractionWithReducedTimeResolution for diagnostics around reduced-resolution interaction tracking. [commit 318327@main](https://commits.webkit.org/318327@main)\n- **Security** \"Continue with Google\" sign-in no longer redirects to a blank page. [commit 318314@main](https://commits.webkit.org/318314@main)\n- **Security** Enhanced Security state changes now track the latest navigation action when making decisions. [commit 318304@main](https://commits.webkit.org/318304@main)\n\n### Media, GPU, audio, and inspector\n- **DevTools** Web Inspector removed the last references to WebMetal. [commit 318322@main](https://commits.webkit.org/318322@main)\n- **Media** GStreamer MSE made some append pipeline and msesrc debug dumps opt-in, reducing noisy diagnostics by default. [commit 318299@main](https://commits.webkit.org/318299@main)\n- **Media** AudioContext no longer leaves its media session registered after frame teardown. [commit 318283@main](https://commits.webkit.org/318283@main)\n- **Media** MediaSessionManagerInterface::sessionWillEndPlayback no longer reorders a copy of the session set. [commit 318276@main](https://commits.webkit.org/318276@main)\n- **GPU** WGSL token copy-assignment no longer leaks Identifier StringImpl on every token advance. [commit 318274@main](https://commits.webkit.org/318274@main)\n- **GPU** WGSL textureDimensions(t, level) codegen no longer clamps mip level one past the last valid LOD. [commit 318273@main](https://commits.webkit.org/318273@main)\n\n### MathML, SVG, DOM, and accessibility\n- **Refactor** MathMLPresentationElement::parseMathMLLength now takes a StringView. [commit 318309@main](https://commits.webkit.org/318309@main)\n- **Rendering** MathMLOperatorElement::OperatorProperties::flags no longer reads uninitialized data. [commit 318308@main](https://commits.webkit.org/318308@main)\n- **Refactor** MathML menclose notation parsing now uses SpaceSplitString instead of a hand-rolled tokenizer. [commit 318306@main](https://commits.webkit.org/318306@main)\n- **Web Platform** MathML and SVG elements now reset tabIndex correctly when tabindex becomes invalid. [commit 318303@main](https://commits.webkit.org/318303@main)\n- **Perf** MathMLOperatorElement::parseOperatorChar() no longer allocates a String just to trim whitespace. [commit 318301@main](https://commits.webkit.org/318301@main)\n- **Refactor** Duplicated mathvariant invalidation was removed from MathMLMathElement::attributeChanged. [commit 318310@main](https://commits.webkit.org/318310@main)\n- **Refactor** Dead SVGAltGlyphElement::hasValidGlyphElements() code was dropped. [commit 318275@main](https://commits.webkit.org/318275@main)\n- **A11y** PDF accessibility modes got foundational support. [commit 318307@main](https://commits.webkit.org/318307@main)\n\n### GTK, WPE, coordinated graphics, and test gardening\n- **Build** GTK and WPE enabled -Wthread-safety. [commit 318326@main](https://commits.webkit.org/318326@main)\n- **Build** More GTK and WPE issues caught by -Wthread-safety were fixed. [commit 318316@main](https://commits.webkit.org/318316@main)\n- **Build** More thread-safety issues found by -Wthread-safety were fixed for GTK and WPE. [commit 318300@main](https://commits.webkit.org/318300@main)\n- **Refactor** CoordinatedGraphics removed unused m_transformedVisibleRect from CoordinatedPlatformLayer. [commit 318313@main](https://commits.webkit.org/318313@main)\n- **Rendering** CoordinatedPlatformLayer now correctly resets some pending changes that were previously left stale. [commit 318312@main](https://commits.webkit.org/318312@main)\n- **Build** WPE and GTK test262 failures were gardened. [commit 318302@main](https://commits.webkit.org/318302@main)\n- **Build** WPE and GTK now use a separate expectations file for test262. [commit 318294@main](https://commits.webkit.org/318294@main)\n- **Build** ParentalControlsContentFilteringTests.OpenBlockedPopUp and BlockedURL were fixed after constant timeouts. [commit 318328@main](https://commits.webkit.org/318328@main)\n- **Build** A failing digital-credential-openid4vp request parsing test was gardened after a regression from [commit 318122@main](https://commits.webkit.org/318122@main). [commit 318311@main](https://commits.webkit.org/318311@main)\n\n### Build system, tooling, and project hygiene\n- **Build** CMake no longer gates compiles on dependency framework code signing. [commit 318344@main](https://commits.webkit.org/318344@main)\n- **Build** CMake enabled explicit module builds for TestWebKitAPI Swift targets. [commit 318339@main](https://commits.webkit.org/318339@main)\n- **Build** CMake now runs cleandead at the end of configuration to remove stale files. [commit 318333@main](https://commits.webkit.org/318333@main)\n- **Refactor** WeakHashSet and WeakListHashSet gained removeIf(), simplifying remove-matching-entries loops. [commit 318341@main](https://commits.webkit.org/318341@main)\n- **Build** Safer C++ expectations for macOS were updated. [commit 318340@main](https://commits.webkit.org/318340@main)\n\n## Reverts \u0026 Reapplies\n\nNone.", "repo": "webkit", "repoDisplay": "WebKit", "rollGroups": [ { "name": "Unreviewed", "count": 1 } ], "since": "2026-07-31", "totals": { "commits": 75, "features": 74, "rolls": 1 }, "until": "2026-07-31" }