{
  "commits": {
    "317765@main": {
      "author": "Enrique Ocaña González",
      "avatar": "https://www.gravatar.com/avatar/7c82fa40774dd34b018c3361f990a045?d=identicon\u0026s=64",
      "cl": "317765@main",
      "clUrl": "https://commits.webkit.org/317765@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321135\n\nReviewed by Xabier Rodriguez-Calvar.\n\nLanding of https://commits.webkit.org/317765@main caused regressions in\nhttps://ytlr-cert.appspot.com/2019/main.html?novp9=true. Looks like\nthose tests, when ran on an old GStreamer version (1.18), still need the\ncode that extends the samples to the beginning.\n\nThis change reintroduces the code block that extend the samples to the\nbeginning, but only applies the correction on GStreamer versions older\nthan 1.20, like the one currently used by Comcast downstream.\n\n* Source/WebCore/platform/graphics/gstreamer/MediaSampleGStreamer.cpp:\n(WebCore::MediaSampleGStreamer::extendToTheBeginning): Restored utility method as it was before 317765@main.\n* Source/WebCore/platform/graphics/gstreamer/MediaSampleGStreamer.h: Restored extendToTheBeginning().\n* Source/WebCore/platform/graphics/gstreamer/mse/AppendPipeline.cpp:\n(WebCore::AppendPipeline::appsinkNewSample): Extend the samples to the\nbeginning on GStreamer versions older than 1.20.\n\nCanonical link: https://commits.webkit.org/318708@main",
      "email": "eocanha@igalia.com",
      "hash": "1fff76c0299c8f06095f170363464e994a11eba7",
      "subject": "[MSE][GStreamer] Regressions in YouTube MSE Conformance Tests 2019"
    },
    "318666@main": {
      "author": "Cole Carley",
      "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64",
      "cl": "318666@main",
      "clUrl": "https://commits.webkit.org/318666@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321100\nrdar://184139255\n\nReviewed by Tim Nguyen and David Kilzer.\n\nMake the ValueSeparator enum in CSSValue.h an enum class\n\n* Source/WebCore/css/CSSFunctionValue.cpp:\n(WebCore::CSSFunctionValue::CSSFunctionValue):\n* Source/WebCore/css/CSSImageSetValue.cpp:\n(WebCore::CSSImageSetValue::CSSImageSetValue):\n* Source/WebCore/css/CSSTransformListValue.cpp:\n(WebCore::CSSTransformListValue::CSSTransformListValue):\n* Source/WebCore/css/CSSValue.cpp:\n(WebCore::CSSValue::separatorCSSText):\n* Source/WebCore/css/CSSValue.h:\n(WebCore::CSSValue::separator const):\n* Source/WebCore/css/CSSValueList.cpp:\n(WebCore::CSSValueList::createCommaSeparated):\n(WebCore::CSSValueList::createSlashSeparated):\n(WebCore::CSSValueList::createSpaceSeparated):\n* Source/WebCore/css/CSSValuePair.cpp:\n(WebCore::CSSValuePair::create):\n(WebCore::CSSValuePair::createSlashSeparated):\n(WebCore::CSSValuePair::createNoncoalescing):\n* Source/WebCore/css/StyleProperties.cpp:\n(WebCore::serializeLonghandValue):\n* Source/WebCore/css/values/CSSValueTypes+DeprecatedCSSOMValueCreation.cpp:\n(WebCore::CSS::makeListDeprecatedCSSOMValue\u003cSerializationSeparatorType::Space\u003e):\n(WebCore::CSS::makeListDeprecatedCSSOMValue\u003cSerializationSeparatorType::Comma\u003e):\n(WebCore::CSS::makeListDeprecatedCSSOMValue\u003cSerializationSeparatorType::Slash\u003e):\n* Source/WebCore/style/StyleCustomProperty.cpp:\n(WebCore::Style::CustomProperty::propertyValue const):\n* Source/WebCore/style/values/StyleValueTypes+CSSValueConversion.h:\n(WebCore::Style::CSSValueConversion\u003cSpaceSeparatedEnumSet\u003cT\u003e\u003e::operator()):\n(WebCore::Style::CSSValueConversion\u003cCommaSeparatedEnumSet\u003cT\u003e\u003e::operator()):\n(WebCore::Style::CSSValueConversion\u003cSpaceSeparatedFixedVector\u003cStyleType\u003e\u003e::operator()):\n(WebCore::Style::CSSValueConversion\u003cCommaSeparatedFixedVector\u003cStyleType\u003e\u003e::operator()):\n* Source/WebCore/style/values/anchor-position/StylePositionTryFallback.cpp:\n(WebCore::Style::CSSValueConversion\u003cPositionTryFallback\u003e::operator):\n\nCanonical link: https://commits.webkit.org/318666@main",
      "email": "ccarley2@apple.com",
      "hash": "0a711e1ee27f582c594afc0cf44edcaeb0215689",
      "subject": "Convert CSSValue ValueSeparator to an enum class"
    },
    "318667@main": {
      "author": "Ruthvik Konda",
      "avatar": "https://www.gravatar.com/avatar/bca33cefcce93017251a8fbc1204cdc4?d=identicon\u0026s=64",
      "cl": "318667@main",
      "clUrl": "https://commits.webkit.org/318667@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320683\nrdar://183668145\n\nReviewed by Mike Wyrzykowski.\n\nWebGPUImpl.cpp includes WebGPUDowncastConvertToBackingContext.h but never uses it. No change in behavior.\n\n* Source/WebCore/Modules/WebGPU/Implementation/WebGPUImpl.cpp:\n\nCanonical link: https://commits.webkit.org/318667@main",
      "email": "rkonda2@apple.com",
      "hash": "92f76a7abb2d5687ae41807787bc351e10252869",
      "subject": "[WebGPU] Remove unused WebGPUDowncastConvertToBackingContext.h include in WebGPUImpl"
    },
    "318668@main": {
      "author": "Devin Rousso",
      "avatar": "https://www.gravatar.com/avatar/c9e757d973342c773f107a94b70cb9cd?d=identicon\u0026s=64",
      "cl": "318668@main",
      "clUrl": "https://commits.webkit.org/318668@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320701\n\nReviewed by Mike Wyrzykowski.\n\n* Source/WebCore/Modules/WebGPU/GPUTexture.h:\n(WebCore::GPUTexture::create):\n(WebCore::GPUTexture::isCanvasBacking const): Added.\n(WebCore::GPUTexture::GPUTexture):\n* Source/WebCore/Modules/WebGPU/GPUTexture.cpp:\n(WebCore::GPUTexture::GPUTexture):\n(WebCore::GPUTexture::createView):\n* Source/WebCore/Modules/WebGPU/GPUTextureView.h:\n(WebCore::GPUTextureView::create):\n(WebCore::GPUTextureView::isCanvasBacking const): Added.\n(WebCore::GPUTextureView::GPUTextureView):\n* Source/WebCore/Modules/WebGPU/GPUTextureView.cpp:\n(WebCore::GPUTextureView::GPUTextureView):\n* Source/WebCore/Modules/WebGPU/GPUPresentationContext.cpp:\n(WebCore::GPUPresentationContext::getCurrentTexture):\nMark presentation textures and their views as canvas-backed.\n\n* Source/WebCore/Modules/WebGPU/GPUCommandEncoder.cpp:\n(WebCore::isCanvasBacking): Added.\n(WebCore::canvasColorAttachmentMaskForDescriptor): Added.\n(WebCore::GPUCommandEncoder::beginRenderPass):\nOnly highlight a multisample source when its store operation discards the modified source.\n\n* Source/WebCore/Modules/WebGPU/GPURenderPipeline.h:\n(WebCore::GPURenderPipeline::createPipelineForInspectorHighlight const): Added.\n* Source/WebCore/Modules/WebGPU/GPURenderPipeline.cpp:\n(WebCore::isInspectorHighlightableCanvasFormat): Added.\n(WebCore::usesBlendConstant): Added.\n(WebCore::GPURenderPipeline::createPipelineForInspectorHighlight const): Added.\nCreate inspector-only pipeline variants asynchronously using the page pipeline's original layout.\nBlend the inspector highlight color into supported canvas attachments without changing non-canvas-backed targets that depend on the render pass's shared blend constant.\n\n* Source/WebCore/Modules/WebGPU/GPURenderPassEncoder.h:\n(WebCore::GPURenderPassEncoder::create):\n(WebCore::GPURenderPassEncoder::GPURenderPassEncoder):\n* Source/WebCore/Modules/WebGPU/GPURenderPassEncoder.cpp:\n(WebCore::applyInspectorPipelineHighlight): Added.\n(WebCore::restorePipelineAfterInspectorHighlight): Added.\n(WebCore::GPURenderPassEncoder::GPURenderPassEncoder):\n(WebCore::GPURenderPassEncoder::setPipeline):\n(WebCore::GPURenderPassEncoder::draw):\n(WebCore::GPURenderPassEncoder::drawIndexed):\n(WebCore::GPURenderPassEncoder::drawIndirect):\n(WebCore::GPURenderPassEncoder::drawIndexedIndirect):\n(WebCore::GPURenderPassEncoder::setBlendConstant):\n(WebCore::GPURenderPassEncoder::executeBundles):\n(WebCore::GPURenderPassEncoder::end):\nRecord canvas attachment masks to temporarily apply a cached highlighted replacement for direct draws.\n\n* Source/WebCore/inspector/InspectorInstrumentation.h:\n(WebCore::InspectorInstrumentation::renderPipelineForWebGPUHighlighting): Added.\n(WebCore::InspectorInstrumentation::renderPipelineForWebGPUHighlightingImpl): Added.\n* Source/WebCore/inspector/InspectorInstrumentation.cpp:\n(WebCore::InspectorInstrumentation::renderPipelineForWebGPUHighlightingImpl): Added.\nRequest highlighted pipeline variants without doing any work when no inspector frontend is attached.\n\n* Source/WebCore/inspector/InspectorShaderProgram.h:\n(WebCore::InspectorShaderProgram::setHighlighted):\n(WebCore::InspectorShaderProgram::invalidateRenderPipelinesForHighlighting): Added.\n(WebCore::InspectorShaderProgram::prepareRenderPipelinesForHighlighting): Added.\n(WebCore::InspectorShaderProgram::requestRenderPipelineForHighlighting): Added.\n(WebCore::InspectorShaderProgram::renderPipelineForHighlighting): Added.\n* Source/WebCore/inspector/InspectorShaderProgram.cpp:\n(WebCore::InspectorShaderProgram::updateShader):\n(WebCore::InspectorShaderProgram::setHighlighted):\n(WebCore::InspectorShaderProgram::invalidateRenderPipelinesForHighlighting): Added.\n(WebCore::InspectorShaderProgram::prepareRenderPipelinesForHighlighting): Added.\n(WebCore::InspectorShaderProgram::requestRenderPipelineForHighlighting): Added.\n(WebCore::InspectorShaderProgram::renderPipelineForHighlighting): Added.\nAllow WebGL programs and WebGPU render pipelines with fragment stages to be highlighted.\n\n* Source/JavaScriptCore/inspector/protocol/Canvas.json:\n* Source/WebCore/inspector/agents/InspectorCanvasAgent.h:\n(WebCore::InspectorCanvasAgent::setShaderProgramHighlighted):\n(WebCore::InspectorCanvasAgent::renderPipelineForWebGPUHighlighting): Added.\n* Source/WebCore/inspector/agents/InspectorCanvasAgent.cpp:\n(WebCore::InspectorCanvasAgent::setShaderProgramHighlighted):\n(WebCore::InspectorCanvasAgent::renderPipelineForWebGPUHighlighting): Added.\nExpose asynchronous highlighting for supported WebGPU render pipelines.\n\n* Source/WebInspectorUI/UserInterface/Models/ShaderProgram.js:\n(WI.ShaderProgram.prototype.get supportsHighlighting): Added.\n(WI.ShaderProgram.prototype.showHighlight):\n(WI.ShaderProgram.prototype.hideHighlight):\n* Source/WebInspectorUI/UserInterface/Views/ShaderProgramTreeElement.js:\n(WI.ShaderProgramTreeElement.prototype.onattach):\nEnable hover highlighting for WebGPU render pipelines.\n\n* LayoutTests/inspector/canvas/resources/shaderProgram-utilities-webgpu.js:\n(renderAndReadPixel):\n(renderWithPipeline):\n(renderWithRenderBundle):\n(renderWithBoundPipeline):\n(releaseDeviceKeepingPipelines):\n* LayoutTests/inspector/canvas/setShaderProgramHighlighted-webgpu.html: Added.\n* LayoutTests/inspector/canvas/setShaderProgramHighlighted-webgpu-expected.txt: Added.\n* LayoutTests/inspector/canvas/shaderProgram-add-remove-webgpu.html:\n* LayoutTests/inspector/canvas/shaderProgram-add-remove-webgpu-expected.txt:\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/win/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318668@main",
      "email": "hi@devinrousso.com",
      "hash": "87399235b55a2f1bc93cdd06c68bc72d5642f9a7",
      "subject": "Web Inspector: Canvas: support highlighting WebGPU render pipelines"
    },
    "318669@main": {
      "author": "Nikolas Zimmermann",
      "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64",
      "cl": "318669@main",
      "clUrl": "https://commits.webkit.org/318669@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321122\n\nReviewed by Sam Weinig.\n\nSince 313859@main, LegacyRenderSVGForeignObject::layout() (and the LBSE\nRenderSVGForeignObject::layout()) derive the viewport geometry from the\nresolved style instead of the SVG animated properties. The x/y/width/height\nattributes are presentation attributes mapped to the CSS x/y/width/height\nproperties, so the resolved style must be invalidated when they change.\n\nSVGForeignObjectElement::svgAttributeChanged() only marked the presentational\nhint style dirty for width/height. For x/y it invalidated the renderer without\nrefreshing the presentation style, so a style recalc never happened and layout\nkept reading the stale x/y. Updating x/y via the SVG DOM property\n(x.baseVal.value = ...) therefore left the foreignObject at its old position.\n\nMark the presentational hint style dirty for all four geometry attributes,\nmatching how SVGRectElement handles its geometry attributes, and keep updating\nthe relative-lengths information for x/y.\n\nAdded new reftests to verify this functionality instead of relying on\nsvg/dynamic-updates/SVGForeignObjectElement-svgdom-x-prop.html which only\nverify the logic through pixel testing, which isn't executed by default.\n\n* LayoutTests/svg/foreignObject/foreignobject-svgdom-x-property-update-expected.html: Added.\n* LayoutTests/svg/foreignObject/foreignobject-svgdom-x-property-update.html: Added.\n* LayoutTests/svg/foreignObject/foreignobject-svgdom-y-property-update-expected.html: Added.\n* LayoutTests/svg/foreignObject/foreignobject-svgdom-y-property-update.html: Added.\n* Source/WebCore/svg/SVGForeignObjectElement.cpp:\n(WebCore::SVGForeignObjectElement::svgAttributeChanged):\n\nCanonical link: https://commits.webkit.org/318669@main",
      "email": "nzimmermann@igalia.com",
      "hash": "27a59f0ec20efd6724c6b8d6ba49d5d47baf52b8",
      "subject": "REGRESSION(313859@main): SVGForeignObjectElement dynamic x/y take no effect"
    },
    "318670@main": {
      "author": "Zak Ridouh",
      "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64",
      "cl": "318670@main",
      "clUrl": "https://commits.webkit.org/318670@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321141\nrdar://184172116\n\nReviewed by Mike Wyrzykowski.\n\n318649@main removed `private import Spatial` from\nWKDirectionalScrollLockTracker.swift and replaced it with a local Angle2D\nshim in the new SpatialShim.swift, but only added that file to\nWebKit.xcodeproj. The CMake build therefore compiled the tracker without\nAngle2D in scope and failed to build the WebKit Swift module.\n\nAdd SpatialShim.swift to the macOS source list.\n\n* Source/WebKit/PlatformCocoa.cmake:\n\nCanonical link: https://commits.webkit.org/318670@main",
      "email": "zakr@apple.com",
      "hash": "fc93b912df8a6d6c4b4da0db2fab700997364f7f",
      "subject": "[CMake] Fix the macOS build after SpatialShim.swift was added"
    },
    "318671@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "318671@main",
      "clUrl": "https://commits.webkit.org/318671@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321090\n\nReviewed by Antti Koivisto.\n\nWhen the first child is attached, RenderTreeBuilder::Block::attach seeds the container's childrenInline()\nfrom that child. An out-of-flow child is not in the flow, though, so it says nothing about whether the\ncontainer's children are inline, and letting it answer the question turns childrenInline() off for a\ncontainer that has no in-flow content at all.\n\n* Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp:\n(WebCore::RenderTreeBuilder::Block::attach):\n* LayoutTests/imported/w3c/web-platform-tests/editing/other/editing-host-with-only-out-of-flow-child.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/editing/other/editing-host-with-only-out-of-flow-child-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/318671@main",
      "email": "zalan@apple.com",
      "hash": "8f6e322587e720d15f44b5ce91eb218b3b837592",
      "subject": "[anon-block-removal] Empty editable container with only an out-of-flow child loses its line"
    },
    "318672@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "318672@main",
      "clUrl": "https://commits.webkit.org/318672@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321040\nrdar://184057419\n\nReviewed by Wenson Hsieh.\n\nAdd a few SPIs on WebView and WebPage to make dealing with attachments easier:\n\nFor handling the attachment lifecycle, a new view modifier SPI is introduced:\n\n```\nextension WebView {\n    public struct AttachmentActivityPhase {\n        public enum Kind: Sendable {\n            case inserted(_ source: String)\n\n            case removed\n\n            case dataInvalidated\n        }\n\n        public var attachment: _WKAttachment { get }\n\n        public var kind: Kind { get }\n    }\n}\n\nextension View {\n    public nonisolated func webViewOnAttachmentActivityPhase(\n        _ action: @escaping @MainActor (_ phase: WebView.AttachmentActivityPhase) -\u003e Void\n    ) -\u003e some View\n}\n```\n\nOn WebPage, new SPI is added to create an attachment and retrieve an attachment:\n\n```\nextension WebPage {\n    public func insertAttachment(fileWrapper: FileWrapper, contentType: Swift.String?) async -\u003e _WKAttachment?\n\n    public func attachment(id: Swift.String) -\u003e _WKAttachment?\n}\n```\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebViewTests.swift\n\n* Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm:\n(-[WKWebView _insertAttachmentWithFileWrapperAsync:contentType:completion:]):\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivate.h:\n* Source/WebKit/UIProcess/API/Swift/WebPage+SPI.swift:\n(AttachmentLifecycleListeners.didRemoveAttachment):\n(AttachmentLifecycleListeners.didInsertAttachment):\n(AttachmentLifecycleListeners.didInvalidateDataForAttachment):\n(WebPage.insertAttachment(_:contentType:)):\n(WebPage.attachment(_:)):\n(WebPage.setMenuBuilder(_:)): Deleted.\n* Source/WebKit/UIProcess/API/Swift/WebPage.swift:\n* Source/WebKit/UIProcess/Cocoa/WKUIDelegateAdapter.swift:\n(WKUIDelegateAdapter._webView(_:didRemove:)):\n(WKUIDelegateAdapter._webView(_:didInsert:withSource:)):\n(WKUIDelegateAdapter._webView(_:didInvalidateDataFor:)):\n* Source/WebKit/_WebKit_SwiftUI/API/View+WebViewModifiers.swift:\n* Source/WebKit/_WebKit_SwiftUI/API/WebView.swift:\n* Source/WebKit/_WebKit_SwiftUI/Implementation/EnvironmentValues+Extras.swift:\n(EnvironmentValues.webViewOnAttachmentActivityPhaseContext):\n* Source/WebKit/_WebKit_SwiftUI/Implementation/ViewModifierContexts.swift:\n* Source/WebKit/_WebKit_SwiftUI/Implementation/WebViewRepresentable.swift:\n(WebViewRepresentable.updatePlatformView(_:context:)):\n* Tools/TestWebKitAPI/Helpers/cocoa/SwiftUI+Extras.swift:\n(render(@ViewBuilder rootView: () -\u003e some View:)):\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebViewTests.swift:\n(Attachments.inserted):\n(Attachments.removed):\n(TestView.body):\n(WebViewTests.onAttachmentActivityPhaseAffectsListeners):\n(ViewModel.isEditable): Deleted.\n(ViewModel.viewportWidth): Deleted.\n(ViewModel.viewportInitialScale): Deleted.\n\nCanonical link: https://commits.webkit.org/318672@main",
      "email": "richard_robinson2@apple.com",
      "hash": "e492299027dcbe5535755c39f7cf48e6a4bfc590",
      "subject": "[SwiftUI WebKit API] WebPage needs the WKUIDelegatePrivate attachment lifecycle callbacks (didInsertAttachment:withSource:, didRemoveAttachment:, didInvalidateDataForAttachment:)"
    },
    "318673@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318673@main",
      "clUrl": "https://commits.webkit.org/318673@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320114\nrdar://183621577\n\nReviewed by Jean-Yves Avenard.\n\nrequestPictureInPicture() is specified to consume the transient activation right after\nchecking for it [1]. WebKit only did the check, so a page could enter both\nPicture-in-Picture and fullscreen from a single click by requesting Picture-in-Picture\nfirst, since requestFullscreen() does consume it.\n\nConsume it from a scope exit rather than where the specification does.\nMediaElementSession::fullscreenPermitted(), reached through webkitSetPresentationMode(),\nis gated on Document::processingUserGestureForMedia(), which falls back to the transient\nactivation when no user gesture token is on the stack — the usual case, since the request\ncomes from an asynchronous continuation of a click. Consuming any earlier makes\nHTMLVideoElement::setPresentationMode() return early, leaving the promise unsettled. No\nscript can run in between, so the ordering is not observable.\n\nGating on userActivationRequired keeps a re-request for the element already in\nPicture-in-Picture from consuming, as specified.\n\n[1] https://w3c.github.io/picture-in-picture/#dom-htmlvideoelement-requestpictureinpicture\n\nTest: imported/w3c/web-platform-tests/picture-in-picture/request-picture-in-picture-consumes-user-activation.html\n\n* LayoutTests/imported/w3c/web-platform-tests/picture-in-picture/request-picture-in-picture-consumes-user-activation-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/picture-in-picture/request-picture-in-picture-consumes-user-activation.html: Added.\n* LayoutTests/platform/ios/TestExpectations: Add Platform Specific Expectation\n* Source/WebCore/Modules/pictureinpicture/HTMLVideoElementPictureInPicture.cpp:\n(WebCore::HTMLVideoElementPictureInPicture::requestPictureInPicture):\n\nCanonical link: https://commits.webkit.org/318673@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "51385a5dc8bf092dee60e0a7cdc96c9ebf1fa942",
      "subject": "requestPictureInPicture() does not consume the user activation"
    },
    "318674@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318674@main",
      "clUrl": "https://commits.webkit.org/318674@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320792\nrdar://183802418\n\nReviewed by Alan Baradlay.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/a1b7d24dec7163c59f3ab5554a40b68ba5f7ccbe\n\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/tables/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/tables/reference/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/tables/support/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/tables/table-anonymous-objects-214-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/tables/table-anonymous-objects-214.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/tables/w3c-import.log:\n\nCanonical link: https://commits.webkit.org/318674@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "ca2617871d6b88628c913a1553a4e10aefe7cdd9",
      "subject": "Resync `css/CSS2/tables` from WPT Upstream"
    },
    "318675@main": {
      "author": "Marcus Plutowski",
      "avatar": "https://www.gravatar.com/avatar/0dc4fa1c337348e333de44505752edb8?d=identicon\u0026s=64",
      "cl": "318675@main",
      "clUrl": "https://commits.webkit.org/318675@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320667\nrdar://183644612\n\nReviewed by Yusuke Suzuki.\n\nAs-is, the instrumentation afforded by the JIT Cage feature is disabled\nby default on some platforms due to the overhead that comes with the\nfull instrumentation. This patch adds the hooks for a new 'relaxed' mode\nwhich will enable a cheaper alternative approach, hopefully making it\npossible for us to enable this on more platforms in the future.\n\nThis patch does not enable any of the new functionality.\n\n* Source/JavaScriptCore/assembler/MacroAssemblerARM64E.h:\n* Source/JavaScriptCore/runtime/JSCPtrTag.h:\n(JSC::tagJSCCodePtrImpl):\n* Source/WTF/wtf/PlatformEnable.h:\n* Source/JavaScriptCore/llint/LLIntData.cpp:\n(JSC::LLInt::initialize):\n* Source/JavaScriptCore/llint/LLIntThunks.cpp:\n(JSC::LLInt::jitCageProbeThunk):\n* Source/JavaScriptCore/llint/LLIntThunks.h:\n* Source/JavaScriptCore/assembler/JITOperationValidation.h:\n\nCanonical link: https://commits.webkit.org/318675@main",
      "email": "marcus_plutowski@apple.com",
      "hash": "9fcacd82ac42795b0edd38dcf02eacf8a5027b4f",
      "subject": "Implement JIT Cage Relaxation"
    },
    "318676@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318676@main",
      "clUrl": "https://commits.webkit.org/318676@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319553\nrdar://182381903\n\nReviewed by Antti Koivisto.\n\nRenderMultiColumnSet::calculateMaxColumnHeight() seeded the maximum column\nheight from the multicol block's available height and then re-clamped it by\nmax-height. But columnHeightAvailable() is already fully resolved via\ncomputeLogicalHeight() -\u003e constrainLogicalHeightByMinMax(), where min-height\nwins over max-height. Re-applying max-height on top of that resolved value\n(without ever applying min-height) discarded a min-height that exceeds\nmax-height, so a block with e.g. height:20px; max-height:40px; min-height:100px\ncapped its columns at 40px instead of the resolved 100px, overflowing content.\n\nWhen the available height is definite it is already correctly constrained, so\nreturn it directly instead of re-clamping. The max-height clamp is only needed\nin the auto-height case, where the seed is the infinite maxLogicalHeight().\n\n* LayoutTests/TestExpectations: Unskip now passing test\n* Source/WebCore/rendering/RenderMultiColumnSet.cpp:\n(WebCore::RenderMultiColumnSet::calculateMaxColumnHeight const):\n\nCanonical link: https://commits.webkit.org/318676@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "c0316c6d2b08826df91703f0970ee949f3883997",
      "subject": "Multicol column height ignores min-height when min-height exceeds max-height"
    },
    "318677@main": {
      "author": "Franco Vieira de Souza",
      "avatar": "https://www.gravatar.com/avatar/14ed77684c1591a07649be8495cc0ddb?d=identicon\u0026s=64",
      "cl": "318677@main",
      "clUrl": "https://commits.webkit.org/318677@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321055\nrdar://184083714\n\nReviewed by Wenson Hsieh and Abrar Rahman Protyasha.\n\nWe now apply the user-select override logic for recognized text overlay\nin Adjuster::adjust() instead of baking it in\nImageOverlay::updateWithTextRecognitionResult(). This ensures it gets\nrecalculated if the shadow host's value is modified after the overlay is\nbuilt.\n\nTo recognize the appropriate elements to adjust, these were tagged with\na new user-agent-part, `-internal-image-overlay-text`. This also had\nthe (desirable) side-effect of ensuring that the overlaid text isn't\nmade editable due to a contenteditable shadow host (see the preexisting\n!element-\u003euserAgentPart().isNull() check in the adjuster).\n\nNew tests:\n * fast/images/text-recognition/image-overlay-text-is-not-editable.html\n * fast/images/text-recognition/image-overlay-user-select.html\n\n* LayoutTests/fast/images/text-recognition/image-overlay-text-is-not-editable-expected.txt: Added.\n* LayoutTests/fast/images/text-recognition/image-overlay-text-is-not-editable.html: Added.\n* LayoutTests/fast/images/text-recognition/image-overlay-user-select-expected.txt: Added.\n* LayoutTests/fast/images/text-recognition/image-overlay-user-select.html: Added.\n* Source/WebCore/css/CSSPseudoSelectors.json:\n* Source/WebCore/dom/ImageOverlay.cpp:\n(WebCore::ImageOverlay::updateSubtree):\n(WebCore::ImageOverlay::updateWithTextRecognitionResult):\n* Source/WebCore/style/StyleAdjuster.cpp:\n(WebCore::Style::Adjuster::adjust const):\n\nCanonical link: https://commits.webkit.org/318677@main",
      "email": "franco_vieira@apple.com",
      "hash": "2de88792d97aa8e4f13a2e76e9613142875035dc",
      "subject": "ImageOverlay text style should be set by the style adjuster and never be editable"
    },
    "318678@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "318678@main",
      "clUrl": "https://commits.webkit.org/318678@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321086\n\nReviewed by Antti Koivisto.\n\nFloats coming out of a block level box on a line were handed to the inline formatting context at the\nline's top left, but the block's own border box does not sit there: setTopLeft() a few lines above puts it\nat { marginStart, borderBoxTop }, where borderBoxTop is its collapsed margin-before. Floats therefore\nlanded that far above where they paint, and lines below the block failed to avoid them.\n\nLineBuilder deliberately rolls the line top back by the pending margin before calling in, which is why the\noffset has to be re-added here rather than being absent from both sides.\n\nThis reproduces in the default configuration, since block-in-inline ships: with the block nested in an\ninline box the probe below the float went to offsetTop -1 and offsetLeft 0, instead of 99 and 34.\n\n* Source/WebCore/layout/integration/LayoutIntegrationFormattingContextLayout.cpp:\n(WebCore::LayoutIntegration::layoutWithFormattingContextForBlockInInline):\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-in-block-in-inline-position-001-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-in-block-in-inline-position-001.html: Added.\n\nCanonical link: https://commits.webkit.org/318678@main",
      "email": "zalan@apple.com",
      "hash": "b0169059361b8eee099b729602e46147cdf1d442",
      "subject": "[block-in-inline] Float inside a block nested in an inline box intrudes at the wrong position"
    },
    "318679@main": {
      "author": "Utku Uckun",
      "avatar": "https://www.gravatar.com/avatar/422449808fc4f6e8b91d3e02e2e60b3d?d=identicon\u0026s=64",
      "cl": "318679@main",
      "clUrl": "https://commits.webkit.org/318679@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321101\nrdar://183950889\n\nReviewed by Tyler Wilcock.\n\nVoiceOver's reported AXFrame for elements inside a WKWebView could go stale\nwhenever the view's position on screen changed for a reason other than the\ncontaining window resizing -- e.g. the window moving, or an ancestor\nNSScrollView/NSClipView repositioning the view (as Mail does when scrolling\nits unified conversation view, which hosts message bodies in WKWebViews with\ntheir own internal scrolling disabled).\n\nThe screen-space AXFrame for any element is computed by combining a\nlive, content-space rect with a cached per-frame AXFrameGeometry (screen\nposition + scale) via AccessibilityObject::convertFrameToSpace(). That\ngeometry is not recomputed automatically; it must be explicitly refreshed via\nWebPageProxy::updateAccessibilityFrameGeometry(). WebViewImpl only called\nthis from windowDidMove(), so any other path that changes the view's\nwindow-relative frame -- notably renewGState(), which AppKit calls whenever\na view's on-screen position changes for any reason, including an ancestor\nview scrolling -- never refreshed it.\n\nFix this by moving the refresh into updateWindowAndViewFrames()'s deferred\ndispatch block, which is the single chokepoint shared by every caller that\ncan change the view's window-relative frame (renewGState, windowDidMove,\nwindowDidResize, viewDidMoveToWindow, and others), rather than patching\nindividual call sites.\n\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::updateWindowAndViewFrames):\n\nCanonical link: https://commits.webkit.org/318679@main",
      "email": "utku.uckun@gmail.com",
      "hash": "dff761891a67d0fd7c8b5cffb905044f1be6d018",
      "subject": "AX: VoiceOver cursor not in sync with mail content breaking Intelligent Image Descriptions"
    },
    "318680@main": {
      "author": "shierote",
      "avatar": "https://www.gravatar.com/avatar/82baf8deb3b5542e0c13f05bdf3c03ea?d=identicon\u0026s=64",
      "cl": "318680@main",
      "clUrl": "https://commits.webkit.org/318680@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=219735\n\nReviewed by Vitor Roriz.\n\nThis completes WebKit's implementation of the CSS Fonts 4 @font-face\nascent-override, descent-override, and line-gap-override descriptors.\n316829@main added parser support, and 316933@main exposed the descriptors\nthrough FontFace and CSSFontFaceDescriptors.\n\nConvert each descriptor to a used-size factor and carry it through\nFontCreationContext. Store the factors in FontPlatformData::FontMetadata during\nconstruction, before the data can be used as a FontDataCache key. This makes\nthe overrides part of FontDataCache identity and applies them once during Font\nconstruction without cloning a cached Font.\n\nFont size adjustment reads cap height, zero width, ideogram width, or x-height,\nwhile metric overrides change only ascent, descent, line gap, and line spacing.\nConstructing FontPlatformData with the factors therefore does not affect the\nadjusted size. Font applies the factors against the final FontPlatformData size.\nPreserve the metadata through derived fonts, system fallback fonts, platform\nreconstruction, and remote rendering.\n\nTests: fast/text/font-face-metric-overrides-cache.html\n       imported/w3c/web-platform-tests/css/css-fonts/ascent-descent-override.html\n       imported/w3c/web-platform-tests/css/css-fonts/line-gap-override.html\n       imported/w3c/web-platform-tests/css/css-fonts/font-size-adjust-metrics-override.html\n       imported/w3c/web-platform-tests/css/css-fonts/font-face-unicode-range-nbsp.html\n       imported/w3c/web-platform-tests/css/css-font-loading/fontface-override-descriptors.html\n       ipc/cache-font-null-palette-colors-crash.html\n       ipc/move-to-image-buffer-cross-thread-font-crash.html\n\n* LayoutTests/TestExpectations:\nRemoved expectations for the metric override tests that now pass.\n* LayoutTests/fast/text/font-face-metric-overrides-cache-expected.txt: Added.\nAdded expected output, including the trailing blank line emitted after\nTEST COMPLETE.\n* LayoutTests/fast/text/font-face-metric-overrides-cache.html: Added.\nVerified metric overrides across local font cache entries and URL fonts, and\nthat updating loaded descriptors invalidates cached font data.\n* LayoutTests/ipc/cache-font-null-palette-colors-crash.html:\n* LayoutTests/ipc/move-to-image-buffer-cross-thread-font-crash.html:\nAdded normal metric overrides to hand-written FontMetadata payloads.\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\nAdded the new metric override types to the build.\n* Source/WebCore/css/CSSFontFace.cpp:\n(WebCore::CSSFontFace::setAscentOverride):\n(WebCore::CSSFontFace::setDescentOverride):\n(WebCore::CSSFontFace::setLineGapOverride):\nConverted descriptor percentages to factors and invalidated clients when they\nchange.\n(WebCore::CSSFontFace::font):\nPassed metric overrides through FontCreationContext.\n* Source/WebCore/css/CSSFontFace.h:\nStored the computed metric overrides.\n* Source/WebCore/platform/graphics/Font.cpp:\n(WebCore::Font::Font):\n(WebCore::Font::applyFontMetricsOverrides):\nApplied overrides against the effective FontPlatformData size after normal font\nmetrics initialization.\n* Source/WebCore/platform/graphics/Font.h:\nDeclared metric override application.\n* Source/WebCore/platform/graphics/FontCache.cpp:\n(WebCore::FontCache::cachedFontPlatformData):\nDisabled zero-bit empty keys for every platform.\n* Source/WebCore/platform/graphics/FontCreationContext.h:\n(WebCore::FontCreationContextRareData::create):\n(WebCore::FontCreationContextRareData::metricsOverrides const):\n(WebCore::FontCreationContextRareData::operator== const):\n(WebCore::FontCreationContextRareData::FontCreationContextRareData):\n(WebCore::FontCreationContext::FontCreationContext):\n(WebCore::FontCreationContext::metricsOverrides const):\n(WebCore::add):\nCarried metric overrides through font creation, equality, and hashing.\n* Source/WebCore/platform/graphics/FontMetricsOverrides.h: Added.\n(WebCore::FontMetricsOverride::isNormal const):\n(WebCore::FontMetricsOverrides::isNormal const):\n(WebCore::add):\nDefined the computed override representation and hashing, including normalized\nsigned zero.\n* Source/WebCore/platform/graphics/FontPlatformData.cpp:\n(WebCore::FontPlatformData::FontPlatformData):\n* Source/WebCore/platform/graphics/FontPlatformData.h:\n(WebCore::FontPlatformData::FontPlatformData):\n(WebCore::FontPlatformData::metricsOverrides const):\nAdded metric overrides to FontMetadata and the platform data constructors,\nmaking them part of FontPlatformData equality at construction.\n* Source/WebCore/platform/graphics/cocoa/FontCacheCoreText.cpp:\n(WebCore::FontCache::createFontPlatformData):\n(WebCore::FontCache::systemFallbackForCharacterCluster):\nPassed metric overrides through normal CoreText platform construction and\nsystem fallback fonts.\n* Source/WebCore/platform/graphics/cocoa/FontPlatformDataCocoa.mm:\n(WebCore::FontPlatformData::hash const):\nIncluded metric overrides in the Cocoa platform data hash.\n* Source/WebCore/platform/graphics/coretext/FontCoreText.cpp:\n(WebCore::createDerivativeFont):\n(WebCore::Font::createFontWithoutSynthesizableFeatures const):\n(WebCore::Font::platformCreateScaledFont const):\n(WebCore::Font::platformCreateHalfWidthFont const):\nPreserved metric overrides in CoreText derivative fonts.\n* Source/WebCore/platform/graphics/coretext/FontCustomPlatformDataCoreText.cpp:\n(WebCore::FontCustomPlatformData::fontPlatformData):\nPassed metric overrides when constructing custom CoreText platform data.\n* Source/WebCore/platform/graphics/coretext/FontPlatformDataCoreText.cpp:\n(WebCore::FontPlatformData::FontPlatformData):\nAccepted metric overrides in CoreText platform data.\n* Source/WebCore/platform/graphics/freetype/FontCacheFreeType.cpp:\n(WebCore::FontCache::createFontPlatformData):\nPassed metric overrides when constructing FreeType platform data.\n* Source/WebCore/platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp:\n(WebCore::FontCustomPlatformData::fontPlatformData):\nPassed metric overrides when constructing custom FreeType platform data.\n* Source/WebCore/platform/graphics/freetype/FontPlatformDataFreeType.cpp:\n(WebCore::FontPlatformData::FontPlatformData):\n(WebCore::FontPlatformData::create):\nPreserved metric overrides when constructing and reconstructing FreeType\nplatform data.\n* Source/WebCore/platform/graphics/freetype/SimpleFontDataFreeType.cpp:\n(WebCore::Font::platformCreateScaledFont const):\nPreserved metric overrides in scaled FreeType fonts.\n* Source/WebCore/platform/graphics/skia/FontCacheSkia.cpp:\n(WebCore::FontCache::createFontPlatformData):\nPassed metric overrides when constructing Skia platform data.\n* Source/WebCore/platform/graphics/skia/FontCustomPlatformDataSkia.cpp:\n(WebCore::FontCustomPlatformData::fontPlatformData):\nPassed metric overrides when constructing custom Skia platform data.\n* Source/WebCore/platform/graphics/skia/FontPlatformDataSkia.cpp:\n(WebCore::FontPlatformData::FontPlatformData):\n(WebCore::FontPlatformData::hash const):\nAccepted and hashed metric overrides in Skia platform data.\n* Source/WebCore/platform/graphics/skia/FontSkia.cpp:\n(WebCore::Font::platformCreateScaledFont const):\n(WebCore::Font::platformCreateHalfWidthFont const):\nPreserved metric overrides in Skia derivative fonts.\n* Source/WebCore/platform/graphics/win/FontPlatformDataWin.cpp:\n(WebCore::FontPlatformData::FontPlatformData):\n(WebCore::FontPlatformData::create):\n(WebCore::FontPlatformData::fromIPCData):\nPreserved metric overrides when constructing and reconstructing Windows\nplatform data.\n* Source/WebCore/platform/graphics/win/SimpleFontDataWin.cpp:\n(WebCore::Font::platformCreateScaledFont const):\nPreserved metric overrides in scaled Windows fonts.\n* Source/WebCore/platform/graphics/win/cairo/FontCacheWinCairo.cpp:\n(WebCore::FontCache::createFontPlatformData):\nPassed metric overrides when constructing Windows Cairo platform data.\n* Source/WebCore/platform/graphics/win/cairo/FontCustomPlatformDataWinCairo.cpp:\n(WebCore::FontCustomPlatformData::fontPlatformData):\nPassed metric overrides when constructing custom Windows Cairo platform data.\n* Source/WebCore/platform/graphics/win/cairo/FontPlatformDataWinCairo.cpp:\n(WebCore::FontPlatformData::FontPlatformData):\nAccepted metric overrides in custom Windows Cairo platform data.\n* Source/WebCore/style/values/fonts/StyleFontMetricsOverride.cpp: Added.\n(WebCore::Style::DeprecatedCSSValueConversion\u003cFontMetricsOverride\u003e::operator()):\n* Source/WebCore/style/values/fonts/StyleFontMetricsOverride.h: Added.\n(WebCore::Style::FontMetricsOverride):\nAdded the shared normal-or-nonnegative-percentage descriptor value and its CSS\nconversion.\n* Source/WebKit/Shared/WebCoreFont.serialization.in:\nSerialized metric overrides as part of FontMetadata.\n\nCanonical link: https://commits.webkit.org/318680@main",
      "email": "32413673+shierote@users.noreply.github.com",
      "hash": "5ee6c014d2b88cc267eacd872f63aa987bfca9ed",
      "subject": "[CSS Fonts] Apply @font-face metric override descriptors to font metrics"
    },
    "318681@main": {
      "author": "Stephan Szabo",
      "avatar": "https://www.gravatar.com/avatar/6f85e18256dcd6717adc36241025cb51?d=identicon\u0026s=64",
      "cl": "318681@main",
      "clUrl": "https://commits.webkit.org/318681@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321144\n\nUnreviewed build fix\n\nOnly check for isRenderMathMLBlock when ENABLE(MATHML)\n\n* Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp:\n(WebCore::RenderTreeBuilder::Block::attach):\n\nCanonical link: https://commits.webkit.org/318681@main",
      "email": "stephan.szabo@sony.com",
      "hash": "45afff344dfbbd8d999afd18e9dc69f933a5ca9c",
      "subject": "Build fix after 318648@main for !ENABLE(MATHML)"
    },
    "318682@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "318682@main",
      "clUrl": "https://commits.webkit.org/318682@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320982\n\nReviewed by Yusuke Suzuki.\n\nThe no-comparator string sort falls back to std::ranges::sort for buckets smaller\nthan 32 entries and past the depth cap, and std::ranges::sort is not stable. The\ndefault sort compares ToString results, which is a consistent comparator, so the\nspec requires the result to be stable [1]:\n\n    let objects = [];\n    for (let i = 0; i \u003c 30; ++i)\n        objects.push({ id: i, toString() { return \"k\" + (i % 3); } });\n    objects.sort(); // equal keys must keep their original order\n\nUse std::ranges::stable_sort instead.\n\n[1]: https://tc39.es/ecma262/#sec-sortindexedproperties\n\nTest: JSTests/stress/array-sort-default-comparator-stability.js\n\n* JSTests/stress/array-sort-default-comparator-stability.js: Added.\n(shouldBe):\n(makeEntries):\n(verifyStable):\n* Source/JavaScriptCore/runtime/ArrayPrototype.cpp:\n(JSC::sortBucketSort):\n\nCanonical link: https://commits.webkit.org/318682@main",
      "email": "sosuke@bun.sh",
      "hash": "a011564b98ab104896256b0aaffd3ecb254d744a",
      "subject": "[JSC] `Array#sort` without a comparator is not stable"
    },
    "318683@main": {
      "author": "Lauro Moura",
      "avatar": "https://www.gravatar.com/avatar/6157f52d61e04c2c63fe7ff668ba69b3?d=identicon\u0026s=64",
      "cl": "318683@main",
      "clUrl": "https://commits.webkit.org/318683@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321152\n\nUnreviewed test gardening.\n\nIncludes a few skips related to bidi tests using the event_loop\npytest-asyncio fixture, which is deprecated on the currently\nautoinstalled version 1.1.1. It'll be fixed in bug321148.\n\n* WebDriverTests/TestExpectations.json:\n\nCanonical link: https://commits.webkit.org/318683@main",
      "email": "lmoura@igalia.com",
      "hash": "8e51fe62a2a3f3dbc067f50aaf26624987fa71a6",
      "subject": "[WebDriver][WPE] Gardening W32 2026 edition"
    },
    "318684@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "318684@main",
      "clUrl": "https://commits.webkit.org/318684@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321067\n\nReviewed by Sam Weinig and Darin Adler.\n\nPer Web IDL, the interface prototype object of a [Global] interface must be\nan immutable prototype exotic object. WebKit implements this via the\nIsImmutablePrototypeExoticObjectOnPrototype IDL extended attribute, which\nDedicatedWorkerGlobalScope, ServiceWorkerGlobalScope, WorkerGlobalScope,\nEventTarget and DOMWindow all declare. SharedWorkerGlobalScope was missing\nit, so SharedWorkerGlobalScope.prototype was an ordinary extensible object\nand Object.setPrototypeOf(SharedWorkerGlobalScope.prototype, {}) succeeded\ninstead of throwing a TypeError.\n\nThis matches the behavior of Chrome and Firefox and fixes the \"Setting to a\ndifferent prototype\" subtest of global-immutable-prototype.any.sharedworker.\n\nNo new tests, rebaselined existing WPT test.\n\n* LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/global-immutable-prototype.any.sharedworker-expected.txt:\n* Source/WebCore/workers/shared/SharedWorkerGlobalScope.idl:\n\nCanonical link: https://commits.webkit.org/318684@main",
      "email": "cdumez@apple.com",
      "hash": "73b4bbb977893a1d7c47cc14940a4cc47e487c43",
      "subject": "SharedWorkerGlobalScope prototype is not an immutable prototype exotic object"
    },
    "318685@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318685@main",
      "clUrl": "https://commits.webkit.org/318685@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321106\nrdar://184144764\n\nReviewed by Chris Dumez.\n\nSeveral Web Audio classes interleave 8-byte and 4-byte members, leaving interior\nand trailing holes. Group members by alignment to close them. Sizes measured with\n-fdump-record-layouts using WebCore's Release compile flags (arm64e):\n\nAudioParamTimeline::ParamEvent88 -\u003e 80\nAudioParamTimeline::AutomationState112 -\u003e 104\nAudioNode160 -\u003e 152\nRealtimeAnalyser 120 -\u003e 112\n\n* Source/WebCore/Modules/webaudio/AudioParamTimeline.h:\n(WebCore::AudioParamTimeline::ParamEvent::ParamEvent):\nMove the Seconds/Vector/double/optional members ahead of the floats. Reordering\nalone saves nothing here (the payload lands at 81 bytes and still rounds to 88),\nso ParamEvent::Type is now explicitly uint8_t, which packs it alongside\nm_hasDefaultCancelledValue for 78 -\u003e 80. The constructor's initializer list is\nreordered to match the new declaration order.\n\nIn AutomationState, pair up time1/time2 and value1/value2 rather than\ninterleaving them, and make eventIndex a size_t instead of an int -- it indexes\nm_events, so it was the wrong type as well as the cause of the trailing hole.\n\n* Source/WebCore/Modules/webaudio/AudioParamTimeline.cpp:\n(WebCore::AudioParamTimeline::valuesForFrameRangeImpl):\nUpdate the aggregate initializer for the new member order, and drive the event\nloop with a size_t index so no conversion is needed at the AutomationState and\nprocessSetTargetFollowedByRamp() call sites. The bounds check becomes\n(WebCore::AudioParamTimeline::valuesForFrameRangeImpl):\nUpdate the aggregate initializer for the new member order, and drive the event\nloop with a size_t index so no conversion is needed at the AutomationState and\nprocessSetTargetFollowedByRamp() call sites. The bounds check becomes\n(WebCore::AudioParamTimeline::valuesForFrameRangeImpl):\nUpdate the aggregate initializer for the new member order, and drive the event\nloop with a size_t index so no conversion is needed at the AutomationState and\nprocessSetTargetFollowedByRamp() call sites. The bounds check becomes\n(WebCore::AudioParamTimeline::valuesForFrameRangeImpl):\nUpdate the aggregate initializer for the new member order, and drive the event\nloop with a size_t index so no conversion is needed at the AutomationState and\nprocessSetTargetFollowedByRamp() call sites. The bounds check becomes\ni + 1 \u003c n rather than i \u003c n - 1 to avoid underflow on an empty vector.\n(WebCore::AudioParamTimeline::processSetTargetFollowedByRamp):\nTake the event index as size_t.\n\n* Source/WebCore/Modules/webaudio/AudioNode.h:\nOrder the 8-byte members first, then the 4-byte group (the two atomic ref counts,\nm_channelCount, the two channel enums and m_nodeType), then m_isInitialized with\nthe other four bools. This closes the 3-byte hole after m_isInitialized, the\n4-byte hole before m_logger and the 4-byte trailing hole.\n\n* Source/WebCore/Modules/webaudio/AudioNode.cpp:\n(WebCore::AudioNode::AudioNode):\nReorder the initializer list to match, keeping -Wreorder quiet. m_context is\ninitialized from the constructor parameter, not from m_nodeType, so moving\nm_nodeType last is safe.\n\n* Source/WebCore/Modules/webaudio/RealtimeAnalyser.h:\nMove m_writeIndex down next to m_shouldDoFFTAnalysis and\nm_noiseInjectionPolicies, closing the 4-byte hole it left between\nm_inputBuffer and m_downmixBus.\n\nAudioBuffer is left alone: RefCountedBase is exactly 4 bytes with no tail\npadding, so m_sampleRate already occupies offset 12 for free and 48 is the\nalignment floor. Moving m_sampleRate down beside m_noiseInjectionMultiplier\npushes m_originalLength to offset 16 and grows the class to 56.\n\nThese are layout-only changes with no behavior change. The same before/after\nlayouts were checked against x86_64-pc-windows-msvc and x86_64-unknown-linux-gnu,\nwhich save the same 8 bytes per class; 32-bit x86 is size-neutral for AudioNode\nand RealtimeAnalyser and still saves 8 for the other two. No bitfields,\nno [[no_unique_address]] and no reliance on base-class tail-padding reuse are\ninvolved, and std::optional\u003cSavedEvent\u003e is value-then-flag in both libc++ and\nthe MS STL.\n\n* Source/WebCore/Modules/webaudio/AudioNode.cpp:\n* Source/WebCore/Modules/webaudio/AudioNode.h:\n* Source/WebCore/Modules/webaudio/AudioParamTimeline.cpp:\n* Source/WebCore/Modules/webaudio/AudioParamTimeline.h:\n* Source/WebCore/Modules/webaudio/RealtimeAnalyser.h:\n\nCanonical link: https://commits.webkit.org/318685@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "2c0cc9251bcd4e0e897f8d4c24fe9582a8410544",
      "subject": "[Web Audio] Reduce padding in ParamEvent, AutomationState, AudioNode and RealtimeAnalyser"
    },
    "318686@main": {
      "author": "Sihui Liu",
      "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64",
      "cl": "318686@main",
      "clUrl": "https://commits.webkit.org/318686@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320939\nrdar://183968921\n\nReviewed by Chris Dumez.\n\nThe assertion in NetworkStorageSession::addCookiesVersionChangeCallback() has its comparison backwards. A callback is\nadded only while the session lags behind the version a request requires, and setCookiesVersion() runs it once the\nsession catches up, so the callback's version should always be ahead of m_cookiesVersion rather than behind it.\n\nThe more consequential problem is that NetworkProcess::addStorageSession() never applies the cookies version to a\ntesting session, since that branch returns before reaching the setCookiesVersion() call at the end of the function. The\nsession is left at version 0 even though the UI process has already advanced past it, and short of a client setting\nanother cookie there is nothing to advance it again, so every request requiring a higher version is suspended and never\nresumed. The branch for a session that has already been added returns early for the same reason, so apply the version on\nall three paths.\n\nhttp/tests/websocket/tests/hybi/no-subprotocol.html was running into this whenever hybi/network-process-crash-error.html\nhad just relaunched the network process. Rebaseline its expectation after the issues are fixed.\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n* Source/WebCore/platform/network/NetworkStorageSession.cpp:\n(WebCore::NetworkStorageSession::addCookiesVersionChangeCallback):\n* Source/WebKit/NetworkProcess/NetworkProcess.cpp:\n(WebKit::NetworkProcess::addStorageSession):\n\nCanonical link: https://commits.webkit.org/318686@main",
      "email": "sihui_liu@apple.com",
      "hash": "5dd200e810bf7fd95f072b6a29ab0de71293cacc",
      "subject": "[macOS] ASSERTION FAILED: callback.version \u003c m_cookiesVersion /Volumes/Data/worker/macOS-Tahoe-Debug-Build-EWS/build/Source/WebCore/platform/network/NetworkStorageSession.cpp"
    },
    "318687@main": {
      "author": "Vitaly Dyachkov",
      "avatar": "https://www.gravatar.com/avatar/ab950c52088e289585a5a01580ec66a4?d=identicon\u0026s=64",
      "cl": "318687@main",
      "clUrl": "https://commits.webkit.org/318687@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321080\n\nReviewed by Yusuke Suzuki.\n\n`__builtin_addcll` and `__builtin_addc` are only available on GCC 15 and later [1].\n\n1. https://libc.llvm.org/dev/builtin_compatibility.html\n\n* Source/JavaScriptCore/runtime/JSBigInt.cpp:\n(JSC::DigitColumnAccumulator::addCarrying):\n\nCanonical link: https://commits.webkit.org/318687@main",
      "email": "vitaly@igalia.com",
      "hash": "19b7a8a4dbf67d6aa011e5e9d2e566db7432d222",
      "subject": "REGRESSION(318413@main) [WPE][GTK] Build is broken on GCC \u003c 15"
    },
    "318688@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "318688@main",
      "clUrl": "https://commits.webkit.org/318688@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321019\nrdar://184055828\n\nReviewed by Abrar Rahman Protyasha.\n\n- Remove a few unused variables\n- Use a single source of truth by keeping a single reference to the WKWebView, to avoid duplication\nand redundant null checks.\n\n* Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm:\n(-[WKWebView _initializeWithConfiguration:]):\n* Source/WebKit/UIProcess/mac/WKAppKitGestureController.h:\n* Source/WebKit/UIProcess/mac/WKAppKitGestureController.mm:\n(-[WKAppKitGestureController initWithView:]):\n(-[WKAppKitGestureController initialize]):\n(-[WKAppKitGestureController webView]):\n(-[WKAppKitGestureController addGesturesToWebView]):\n(-[WKAppKitGestureController enableGestureIfNeeded:]):\n(-[WKAppKitGestureController beginSuppressingSingleClickGestureForTextSelection]):\n(-[WKAppKitGestureController endSuppressingSingleClickGestureForTextSelection]):\n(-[WKAppKitGestureController panGestureRecognized:]):\n(-[WKAppKitGestureController singleClickGestureRecognized:]):\n(-[WKAppKitGestureController doubleClickGestureRecognized:]):\n(-[WKAppKitGestureController secondaryClickGestureRecognized:]):\n(-[WKAppKitGestureController mouseTrackingGestureRecognized:]):\n(-[WKAppKitGestureController imageAnalysisGestureRecognized:]):\n(-[WKAppKitGestureController deferringGestureRecognizer:shouldDeferOtherGestureRecognizer:]):\n(-[WKAppKitGestureController deferringGestureRecognizer:shouldDeferGesturesForEventThatWillBeginAction:]):\n(-[WKAppKitGestureController deferringGestureRecognizer:didEndActionWithEvent:]):\n(-[WKAppKitGestureController _isPointInScrollbar:]):\n(-[WKAppKitGestureController _dragPressShouldBeginAtLocation:]):\n(-[WKAppKitGestureController _panShouldBeginAtLocation:]):\n(-[WKAppKitGestureController dragPressGestureRecognized:]):\n(-[WKAppKitGestureController _handleClickBegan:]):\n(-[WKAppKitGestureController _handleClickEnded:]):\n(-[WKAppKitGestureController _handleClickCancelled]):\n(-[WKAppKitGestureController didGetClickHighlightForRequest:color:quads:topLeftRadius:topRightRadius:bottomLeftRadius:bottomRightRadius:nodeHasBuiltInClickHandling:]):\n(-[WKAppKitGestureController commitPotentialClickFailed]):\n(-[WKAppKitGestureController didCompleteSyntheticClick]):\n(-[WKAppKitGestureController didHandleClickAsHover]):\n(-[WKAppKitGestureController didNotHandleClickAsClick:]):\n(-[WKAppKitGestureController sendWheelEventForGesture:]):\n(-[WKAppKitGestureController startMomentumIfNeededForGesture:]):\n(-[WKAppKitGestureController interruptMomentumIfNeeded]):\n(-[WKAppKitGestureController setTextSelectionDragGesture:completionHandler:]):\n(-[WKAppKitGestureController setGestureDraggingSession:]):\n(-[WKAppKitGestureController gestureRecognizer:shouldRecognizeSimultaneouslyWithGestureRecognizer:]):\n(-[WKAppKitGestureController gestureRecognizer:shouldBeRequiredToFailByGestureRecognizer:]):\n(-[WKAppKitGestureController gestureRecognizer:shouldRequireFailureOfGestureRecognizer:]):\n(-[WKAppKitGestureController gestureRecognizerShouldBegin:]):\n(-[WKAppKitGestureController _gestureRecognizer:canPreventGestureRecognizer:]):\n(-[WKAppKitGestureController initWithPage:viewImpl:]): Deleted.\n* Source/WebKit/UIProcess/mac/WebViewImpl.h:\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::m_flagsChangedEventMonitorTrackingArea):\n(WebKit::WebViewImpl::initializeAppKitGestureController):\n\nCanonical link: https://commits.webkit.org/318688@main",
      "email": "richard_robinson2@apple.com",
      "hash": "37462ea769c050630fac0d302a401c873a3a3074",
      "subject": "[AppKit Gestures] Simplify WKAppKitGestureController.mm a bit"
    },
    "318689@main": {
      "author": "Karl Dubost",
      "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64",
      "cl": "318689@main",
      "clUrl": "https://commits.webkit.org/318689@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=187454\nrdar://41980917\n\nReviewed by Brent Fulgham.\n\nThe round language selector button in this bug no longer paints as a narrow\noval. 317781@main fixed it, so this change is tests only.\n\nThe page puts an atomic inline (display:inline-block) in vertical-lr inside a\nshrink-to-fit inline-block label. The vertical child's horizontal extent is its\nblock axis size, and the label has to use that as the child's inline size\ncontribution. Before 317781@main an orthogonal child that had not been laid out\nyet contributed only its border and padding, so the label collapsed to its own\n0.5em of padding and the border-radius:50% background painted narrower than the\ntext inside it.\n\northogonal-parent-shrink-to-fit-001.html already covers orthogonal block and\northogonal inline children, but not an orthogonal atomic inline, which goes\nthrough RenderBlockFlow::computeInlineIntrinsicLogicalWidths instead of\nRenderBlock::computeBlockIntrinsicLogicalWidths. A regression limited to the\ninline path would leave 001 passing. This is a sibling file rather than extra\nsubtests in 001, because 001's subtests are already mirrored one per file across\n001a to 001x and the letter suffixes are used up.\n\n12 subtests: inline-block, float and table-cell shrink-to-fit parents, each with\nand without a border on the child, each with the child direct and nested in an\ninline-block. Also checked against Safari Technology Preview 249, which predates\n317781@main: all 12 fail there, the parent measuring 0px, or 10px with the 0.5em\nborder, against a 20px child. All 12 pass on trunk.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-writing-modes/orthogonal-parent-shrink-to-fit-002.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-writing-modes/orthogonal-parent-shrink-to-fit-002-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/318689@main",
      "email": "karlcow@apple.com",
      "hash": "1f86c27b74cf2a1ad2c8d2b2b10e83892c302dfa",
      "subject": "[css-writing-modes] Add WPT coverage for orthogonal atomic inline children of shrink-to-fit boxes"
    },
    "318690@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "318690@main",
      "clUrl": "https://commits.webkit.org/318690@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321130\nrdar://problem/184164505\n\nReviewed by Alan Baradlay.\n\nThe CSSWG resolved that margin-trim will not apply to grid or flex\ncontainers in https://github.com/w3c/csswg-drafts/issues/13731\n\nRemove the code and tests associated with margin-trim on grid.\n\n* Source/WebCore/rendering/Grid.cpp:\n(WebCore::Grid::gridItemSpanIgnoringCollapsedTracks const): Deleted.\nThis function was unused after this so it get be deleted too.\n\nCanonical link: https://commits.webkit.org/318690@main",
      "email": "sammy.gill@apple.com",
      "hash": "9491626d08e2e8354ab63d180874f9f27bfe4dc5",
      "subject": "[Grid] margin-trim does not apply to grids."
    },
    "318691@main": {
      "author": "Phinehas Fuachie",
      "avatar": "https://www.gravatar.com/avatar/900d85de8c325e38975f39115c36bb75?d=identicon\u0026s=64",
      "cl": "318691@main",
      "clUrl": "https://commits.webkit.org/318691@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319971\nrdar://182894970\n\nReviewed by Andy Estes.\n\nAdd an experimental renderer that displays projected/spatial (APMP) video — 360°/180°\nequirectangular, fisheye, and parametric wide-FOV — on a WebGL mesh inside the media controls,\nletting the viewer drag to look around. Gated behind the SpatialVideoRendering feature flag\n(preview, off by default).\n\nThe renderer is a MediaControllerSupport subclass. It uses a WebGL2 context so the non-power-of-two\nvideo frame can be mipmapped (with anisotropic filtering) to avoid shimmer in minified regions,\nuploads frames via requestVideoFrameCallback so that work tracks the decoded frame rate rather than\nthe display refresh, and feathers the content's outer edge so non-360 projections blend out instead\nof ending on a hard boundary.\n\nThe projection kind and horizontal field of view are read from the parsed ImmersiveVideoMetadata\nvia a MediaControlsHost accessor rather than the public VideoTrackConfiguration JS API, so enabling\nthe feature does not expose the Track Configuration API to web content. An x-webkit-spatial\nattribute (360 | 180 | fisheye | wfov) remains as an explicit override for content without\nimmersive metadata.\n\nCanonical link: https://commits.webkit.org/318691@main",
      "email": "pfuachie2@apple.com",
      "hash": "d3327c9d179d467d23ec50a3c934923310e07779",
      "subject": "Spatial/projected video rendering in macOS and iOS media controls (experimental)"
    },
    "318692@main": {
      "author": "Carlos Garcia Campos",
      "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64",
      "cl": "318692@main",
      "clUrl": "https://commits.webkit.org/318692@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321077\n\nReviewed by Tyler Wilcock.\n\nNull check AXCache we get from document and return early if it's nullptr.\n\n* Source/WebCore/accessibility/AccessibilityMenuListPopup.cpp:\n(WebCore::AccessibilityMenuListPopup::menuListOptionAccessibilityObject const):\n* Source/WebCore/SaferCPPExpectations/UncheckedCallArgsCheckerExpectations:\n\nCanonical link: https://commits.webkit.org/318692@main",
      "email": "cgarcia@igalia.com",
      "hash": "e04f9dd61dc4637b690df1bd19a66d783e332c03",
      "subject": "Crash in AccessibilityMenuListPopup::menuListOptionAccessibilityObject"
    },
    "318693@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "318693@main",
      "clUrl": "https://commits.webkit.org/318693@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321134\nrdar://184167170\n\nReviewed by Richard Robinson.\n\nThe ViewGestureController::handleMagnificationGesture[Event] entry point\nfor gesture handling currently takes an NSEvent argument, but really it\nonly does so to read off the magnification, phase, and type fields of\nthe event. As such, we change this method so that callers have to pass\nin these individual bits.\n\nThis will aid us in a forthcoming change where we need to bring up\nsupport for gesture handling without a backing NSEvent.\n\nAnother noteworthy refactor in this patch is to pull out WebWheelEvent's\nphase enum into a standalone WebEventPhase enum, which both wheel and\ngesture events can adopt.\n\n* Source/WebKit/Shared/WebEvent.serialization.in:\n* Source/WebKit/Shared/WebEventPhase.h:\n* Source/WebKit/Shared/WebWheelEvent.h:\n* Source/WebKit/Shared/mac/WebEventFactory.h:\n* Source/WebKit/Shared/mac/WebEventFactory.mm:\n(WebKit::WebEventFactory::phaseForEvent):\n(WebKit::phaseForEvent): Deleted.\n* Source/WebKit/Shared/mac/WebGestureEvent.h:\n* Source/WebKit/UIProcess/ViewGestureController.h:\n* Source/WebKit/UIProcess/mac/ViewGestureControllerMac.mm:\n(WebKit::ViewGestureController::gestureEventWasNotHandledByWebCore):\n(WebKit::ViewGestureController::handleMagnificationGesture):\n(WebKit::ViewGestureController::handleMagnificationGestureEvent): Deleted.\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::magnifyWithEvent):\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/UnifiedPDFPlugin.mm:\n(WebKit::UnifiedPDFPlugin::setPageScaleFactor):\n\nDrop the now misnamed ViewGestureController method reference and instead\njust mention the relevant codepath.\n\nCanonical link: https://commits.webkit.org/318693@main",
      "email": "a_protyasha@apple.com",
      "hash": "3807854541383b0fe6b7ac5115fd2859aedac5a1",
      "subject": "ViewGestureController magnification gesture handling should not need to be fed a NSEvent instance"
    },
    "318694@main": {
      "author": "Brent Fulgham",
      "avatar": "https://www.gravatar.com/avatar/c6989a65afef0d015b55c65406e37ccc?d=identicon\u0026s=64",
      "cl": "318694@main",
      "clUrl": "https://commits.webkit.org/318694@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321099\nrdar://184139028\n\nReviewed by Tim Nguyen.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/7b860c524151c4a5ad6b925ba48719a6e70b2464\n\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-light-dismiss-hint-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-light-dismiss-hint.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/w3c-import.log:\n\nCanonical link: https://commits.webkit.org/318694@main",
      "email": "bfulgham@apple.com",
      "hash": "afa93d4b08cc1ae7f72c0211f0ec9b138fc2031f",
      "subject": "Updated popover WPT suite to match current content"
    },
    "318695@main": {
      "author": "Fujii Hironori",
      "avatar": "https://www.gravatar.com/avatar/ef99cb23f5e5d27977968ca097d9a85f?d=identicon\u0026s=64",
      "cl": "318695@main",
      "clUrl": "https://commits.webkit.org/318695@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321149\n\nReviewed by Carlos Garcia Campos.\n\nWPE MiniBrowser crashed by clicking a search input form. 315091@main added a\nnew input purpose type WEBKIT_INPUT_PURPOSE_SEARCH.\n\n* Source/WebKit/WPEPlatform/wpe/wayland/WPEInputMethodContextWaylandV1.cpp:\n(toTextInputV1Purpose):\n* Source/WebKit/WPEPlatform/wpe/wayland/WPEInputMethodContextWaylandV3.cpp:\n(toTextInputV3Purpose):\n\nCanonical link: https://commits.webkit.org/318695@main",
      "email": "fujii@igalia.com",
      "hash": "42e02bc811e437b1f21235ad3de8eabd5a699ef1",
      "subject": "[WPEPlatform Wayland] Should handle WEBKIT_INPUT_PURPOSE_SEARCH"
    },
    "318696@main": {
      "author": "Vitaly Dyachkov",
      "avatar": "https://www.gravatar.com/avatar/ab950c52088e289585a5a01580ec66a4?d=identicon\u0026s=64",
      "cl": "318696@main",
      "clUrl": "https://commits.webkit.org/318696@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321167\n\nUnreviewed test gardening.\n\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318696@main",
      "email": "vitaly@igalia.com",
      "hash": "14ddab41bff6527018b7d573b14195b179f61063",
      "subject": "REGRESSION(318489@main) [WPE] Some accessibility tests are constant crash"
    },
    "318697@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "318697@main",
      "clUrl": "https://commits.webkit.org/318697@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321151\n\nReviewed by Yusuke Suzuki.\n\nFastStringifier bails out for any object whose prototype is not Object.prototype,\nso a single class instance in the payload reruns the whole serialization on the\nslow path. Since the prototype only matters for the toJSON lookup, allow\nFinalObjectType cells with other prototypes when mayHaveToJSON() says the chain\nhas no toJSON.\n\nThis also fixes noSideEffectMayHaveNonIndexProperty() checking\nhasNonReifiedStaticProperties() on `this` instead of the current chain entry,\nwhich missed a non-reified static toJSON (e.g. Date.prototype) in the middle of\nthe chain.\n\n                                               base                    patched\n\njson-stringify-class-instances              252.0789+-4.5854     ^     71.6873+-0.8488        ^ definitely 3.5164x faster\n\nTests: JSTests/microbenchmarks/json-stringify-class-instances.js\n       JSTests/stress/json-stringify-fast-path-custom-prototype-edge-cases.js\n       JSTests/stress/json-stringify-fast-path-custom-prototype.js\n\n* JSTests/microbenchmarks/json-stringify-class-instances.js: Added.\n(Address):\n(User):\n(User.prototype.get displayName):\n(User.prototype.greet):\n(Admin):\n* JSTests/stress/json-stringify-fast-path-custom-prototype-edge-cases.js: Added.\n(shouldBe):\n(shouldThrow):\n(warm):\n(shouldBe.C):\n(shouldBe.C.prototype.toJSON):\n(shouldBe.D):\n(shouldBe.get let):\n(shouldBe.get shouldBe):\n(get shouldBe):\n(get shouldBe.D):\n(shouldBe.prototype.let.expected.string_appeared_here.classes.map):\n(shouldBe.classes.17.prototype.toJSON):\n(C.prototype.toJSON):\n(shouldBe.JSON.stringify.C):\n(shouldBe.JSON.stringify):\n(shouldBe.let.handler.get traps):\n(C):\n(let.num2.Object.setPrototypeOf.new.Number):\n(let.str.Object.setPrototypeOf.new.String):\n(shouldBe.JSON.stringify.let.args):\n(shouldBe.undefinedAndFunctionValues.fn):\n(shouldBe.):\n* JSTests/stress/json-stringify-fast-path-custom-prototype.js: Added.\n(shouldBe):\n(shouldThrow):\n(throw.new.Error):\n(shouldBe.X):\n(prototype.method):\n(prototype.get accessor):\n(AA):\n(i.shouldBe.JSON.stringify):\n(shouldBe.JSON.stringify.C):\n(shouldBe.JSON.stringify.C.prototype.toJSON):\n(shouldBe.JSON.stringify):\n(shouldBe.D0):\n(shouldBe.D1):\n(shouldBe.E):\n(shouldBe.get for):\n(shouldBe.get let):\n(shouldBe.G):\n(Object.prototype.toJSON):\n* Source/JavaScriptCore/runtime/JSONObject.cpp:\n(JSC::bufferMode\u003e::append):\n* Source/JavaScriptCore/runtime/JSObjectInlines.h:\n(JSC::JSObject::noSideEffectMayHaveNonIndexProperty):\n\nCanonical link: https://commits.webkit.org/318697@main",
      "email": "sosuke@bun.sh",
      "hash": "4f3ecec97431e17f44f275c201a8ba068500c9e5",
      "subject": "[JSC] `JSON.stringify` fast path should accept final objects with non `Object` prototypes"
    },
    "318698@main": {
      "author": "Adrian Perez de Castro",
      "avatar": "https://www.gravatar.com/avatar/30ffea8cf404586741a8f5f7110c0914?d=identicon\u0026s=64",
      "cl": "318698@main",
      "clUrl": "https://commits.webkit.org/318698@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318247\n\nReviewed by Carlos Garcia Campos.\n\n* Source/WTF/wtf/RefCountedWithInlineWeakPtr.h: Fix the GCC builds by\n  surrounding the offendind code with IGNORE_GCC_WARNINGS_{BEGIN,END},\n  leaving a proper fix for later.\n\nCanonical link: https://commits.webkit.org/318698@main",
      "email": "aperez@igalia.com",
      "hash": "95940264e6c209134f6a9a64bd72e0e8b1ffd38b",
      "subject": "[GTK][WPE] Build failure with GCC 15: -Werror=uninitialized on m_weakCount read after ~T() in RefCountedWithInlineWeakPtr"
    },
    "318699@main": {
      "author": "shierote",
      "avatar": "https://www.gravatar.com/avatar/82baf8deb3b5542e0c13f05bdf3c03ea?d=identicon\u0026s=64",
      "cl": "318699@main",
      "clUrl": "https://commits.webkit.org/318699@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=219735\n\nReviewed by Tim Nguyen.\n\n318680@main completed WebKit's implementation of the @font-face\nascent-override, descent-override, and line-gap-override descriptors. The\nimplementation is covered by WPT, and these descriptors have shipped in Blink\nand Gecko since 2021. Enable them by default while retaining the preference\nfor debugging and rollback.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/318699@main",
      "email": "32413673+shierote@users.noreply.github.com",
      "hash": "2a7c5b4538a931ace50c5ed43517bfd681daddf2",
      "subject": "[CSS Fonts] Enable @font-face metric override descriptors by default"
    },
    "318700@main": {
      "author": "Vitaly Dyachkov",
      "avatar": "https://www.gravatar.com/avatar/ab950c52088e289585a5a01580ec66a4?d=identicon\u0026s=64",
      "cl": "318700@main",
      "clUrl": "https://commits.webkit.org/318700@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321167\n\nUnreviewed test gardening.\n\nFixed in 318692@main.\n\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318700@main",
      "email": "vitaly@igalia.com",
      "hash": "cfecee13eb357e191c2d98b7c0fd5d9cd5562a0f",
      "subject": "REGRESSION(318489@main) [WPE] Some accessibility tests are constant crash"
    },
    "318701@main": {
      "author": "Vitaly Dyachkov",
      "avatar": "https://www.gravatar.com/avatar/ab950c52088e289585a5a01580ec66a4?d=identicon\u0026s=64",
      "cl": "318701@main",
      "clUrl": "https://commits.webkit.org/318701@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321170\n\nUnreviewed test gardening.\n\n* LayoutTests/platform/glib/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318701@main",
      "email": "vitaly@igalia.com",
      "hash": "1a501aa12af4c1f6ddd5b6dcc56d881892c85b06",
      "subject": "[WPE][GTK] `imported/w3c/web-platform-tests/webrtc/RTCIceTransport.html?interop-2026` is a rare flaky crash"
    },
    "318702@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "318702@main",
      "clUrl": "https://commits.webkit.org/318702@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321124\n\nReviewed by Antti Koivisto.\n\nFollow-up to bug 321083, which fixed firstLineBaseline() only. lastLineBaseline() has the same defect and\nneeded a second change alongside it, which is why it was left out there.\n\nAn inline-block's baseline is the baseline of its last line box. When that line box holds a block level box,\nLineLayout::lastLineBaseline() returned the block's own baseline without adding the block's offset within the\ninline-block, so the content after the inline-block aligned to the *first* line instead:\n\n    \u003cdiv style=\"display: inline-block\"\u003e\u003cbr\u003e\u003cspan\u003e\u003cdiv\u003ex\u003c/div\u003e\u003c/span\u003e\u003c/div\u003eafter\n\n\"after\" sat at the top of the inline-block rather than 20px down. Legacy line layout gets this right - it\nreports 32 where modern reported 14 on the reduction this came from.\n\nTwo changes are needed together:\n\n- Add the block's logicalTop, matching RenderBlock::lastLineBaseline() and firstLineBaseline().\n- Skip lines clamped away in the block direction. A line with no visible content is not the last line with\n  content. A line holding a block level box is excluded from that skip: what is visible\n  there is decided inside that block, which runs this same look-up on its own lines.\n\n(fast/overflow/line-clamp.html \u003c- visual progression)\n\n* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:\n(WebCore::LayoutIntegration::LineLayout::lastLineBaseline const):\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/visudet/inline-block-baseline-with-block-in-inline-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/visudet/inline-block-baseline-with-block-in-inline-001-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-flexbox/alignment/flex-align-baseline-line-clamp-001.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-align-baseline-line-clamp-001.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-inline/baseline-source/baseline-source-last-001-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-inline/baseline-source/baseline-source-first-001-expected.txt:\n* LayoutTests/platform/glib/fast/overflow/line-clamp-expected.txt:\n* LayoutTests/platform/ios/fast/overflow/line-clamp-expected.txt:\n* LayoutTests/platform/mac/fast/overflow/line-clamp-expected.txt:\n\nCanonical link: https://commits.webkit.org/318702@main",
      "email": "zalan@apple.com",
      "hash": "c4816f88200580fe418bb7567bd99382eca18933",
      "subject": "[block-in-inline] Baseline of an inline-block whose last line box holds a block level box drops that line's offset"
    },
    "318703@main": {
      "author": "Vitaly Dyachkov",
      "avatar": "https://www.gravatar.com/avatar/ab950c52088e289585a5a01580ec66a4?d=identicon\u0026s=64",
      "cl": "318703@main",
      "clUrl": "https://commits.webkit.org/318703@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321168\n\nUnreviewed test gardening.\n\nUpdate baseline.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/style-range-dynamic-expected.txt:\n\nCanonical link: https://commits.webkit.org/318703@main",
      "email": "vitaly@igalia.com",
      "hash": "1c420e333b688219221a28275c5fca8f06662087",
      "subject": "REGRESSION(318680@main) `imported/w3c/web-platform-tests/css/css-conditional/container-queries/style-range-dynamic.html` is a constant failure"
    },
    "318704@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "318704@main",
      "clUrl": "https://commits.webkit.org/318704@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321117\n\nReviewed by Antti Koivisto.\n\nAn InlineLevelBox's logical top is stored relative to its parent inline box - LineBox::inlineLevelBoxAbsoluteTop\nwalks the ancestor chain adding each one up. LineBoxBuilder::constructBlockContent was assigning the same\nabsolute value to every line spanning inline box around the block:\n\n    lineSpanningInlineBox.setLogicalTop(blockGeometry.marginBefore());\n\nso the offset was counted once per nesting level. With a 16px offset, three levels of inline boxes ended up at\n16, 32 and 48, and the innermost one was stretched past its own content - taller than the box containing it,\nwhich cannot be right.\n\nOnly the outermost spanning box may carry that offset; the nested ones are already positioned relative to it.\n\nThe positions of the content were always correct - this is purely the inline boxes' reported bounds, which\nlinesBoundingBox() exposes to the render tree dump, to getBoundingClientRect() and to getClientRects().\n\n* Source/WebCore/layout/formattingContexts/inline/InlineLineBoxBuilder.cpp:\n(WebCore::Layout::LineBoxBuilder::constructBlockContent):\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/nested-inline-boxes-around-block-in-inline-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/nested-inline-boxes-around-block-in-inline-001-expected.txt: Added.\n* LayoutTests/platform/glib/fast/encoding/utf-16-big-endian-expected.txt:\n* LayoutTests/platform/glib/fast/encoding/utf-16-little-endian-expected.txt:\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug113235-3-expected.txt:\n* LayoutTests/platform/ios/tables/mozilla/bugs/bug113235-3-expected.txt:\n* LayoutTests/platform/mac/fast/encoding/utf-16-big-endian-expected.txt:\n* LayoutTests/platform/mac/fast/encoding/utf-16-little-endian-expected.txt:\n* LayoutTests/platform/mac/tables/mozilla/bugs/bug113235-3-expected.txt:\n\nCanonical link: https://commits.webkit.org/318704@main",
      "email": "zalan@apple.com",
      "hash": "6c0e799bd75417e3d6a5727f207787803f3659c1",
      "subject": "[block-in-inline] Nested inline boxes around a block level box are stretched by their nesting depth"
    },
    "318705@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "318705@main",
      "clUrl": "https://commits.webkit.org/318705@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321057\n\nReviewed by Darin Adler.\n\nWhen an exception was thrown from an AudioWorkletProcessor's process()\nmethod, the ErrorEvent dispatched to onprocessorerror was always created\nwith an empty filename and 0 for lineno / colno, even though the actual\nexception location was readily available. Chrome and Firefox populate\nthese fields from the thrown exception.\n\nCapture the exception's location via the ExceptionDetails out-param that\nreportException() already fills in, and thread it from the rendering\nthread through to the dispatched ErrorEvent so that filename, lineno and\ncolno reflect the real error site.\n\nNo new tests, rebaselined WPT test to gain test coverage.\n\n* LayoutTests/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audioworklet-interface/audioworkletnode-onerror.https.html:\nRebaseline WPT test to gain test coverage. Without this fix, the last\nsubtest was failing in WebKit (but passing in Chrome / Firefox).\n\n* Source/WebCore/Modules/webaudio/AudioWorkletNode.cpp:\n(WebCore::AudioWorkletNode::process):\n(WebCore::AudioWorkletNode::didFinishProcessingOnRenderingThread):\n(WebCore::AudioWorkletNode::fireProcessorErrorOnMainThread):\n* Source/WebCore/Modules/webaudio/AudioWorkletNode.h:\n* Source/WebCore/Modules/webaudio/AudioWorkletProcessor.cpp:\n(WebCore::AudioWorkletProcessor::process):\n* Source/WebCore/Modules/webaudio/AudioWorkletProcessor.h:\n\nCanonical link: https://commits.webkit.org/318705@main",
      "email": "cdumez@apple.com",
      "hash": "8577db2c85c6968809fd0e7375ec26ba32cf6279",
      "subject": "AudioWorkletNode processorerror event lacks filename, lineno and colno"
    },
    "318706@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "318706@main",
      "clUrl": "https://commits.webkit.org/318706@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321059\n\nReviewed by Darin Adler.\n\nThe imported WPT test mediastreamaudiosourcenode-routing.html was timing\nout. Two separate bugs were responsible:\n\n  1. Track selection did not follow the spec. Per the MediaStreamAudioSourceNode\n     constructor algorithm [1], the input track is the first audio track after\n     sorting the tracks by their id using a code unit ordering. We instead picked\n     the first track in getAudioTracks() insertion order, so with random track\n     ids we captured the wrong track roughly half the time.\n\n  2. Stopping the captured track did not silence the node. The Cocoa audio source\n     provider's trackEnded() override was empty, so once the track ended the\n     provider kept pulling samples from the still-running source instead of\n     outputting silence.\n\nNo new tests, unskipped WPT test that is now passing (used to time out).\n\n[1] https://webaudio.github.io/web-audio-api/#mediastreamaudiosourcenode\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-mediastreamaudiosourcenode-interface/mediastreamaudiosourcenode-routing-expected.txt: Added.\n* Source/WebCore/Modules/webaudio/MediaStreamAudioSourceNode.cpp:\n(WebCore::MediaStreamAudioSourceNode::create):\n* Source/WebCore/platform/mediastream/cocoa/MediaStreamTrackAudioSourceProviderCocoa.cpp:\n(WebCore::MediaStreamTrackAudioSourceProviderCocoa::trackEnded):\n(WebCore::MediaStreamTrackAudioSourceProviderCocoa::provideInput):\n* Source/WebCore/platform/mediastream/cocoa/MediaStreamTrackAudioSourceProviderCocoa.h:\n\nCanonical link: https://commits.webkit.org/318706@main",
      "email": "cdumez@apple.com",
      "hash": "c8cef76f94bc80b9d5d50e17a2074e80fbb1366d",
      "subject": "MediaStreamAudioSourceNode captures the wrong track and keeps playing after the track ends"
    },
    "318707@main": {
      "author": "Megan Gardner",
      "avatar": "https://www.gravatar.com/avatar/b466a5bcbfabf4d82a8ecc595db5a531?d=identicon\u0026s=64",
      "cl": "318707@main",
      "clUrl": "https://commits.webkit.org/318707@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321118\nrdar://184152252\n\nUnreviewed test gardening.\n\nThe css-highlight-api WPT re-sync (318645@main) marked HighlightRegistry-highlightsFromPoint.html [ Failure ],\nbut the test passes now that highlightsFromPoint() is implemented, so it was passing unexpectedly.\n\nimported/w3c/web-platform-tests/css/css-highlight-api/HighlightRegistry-highlightsFromPoint.html\n\n* LayoutTests/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318707@main",
      "email": "megan_gardner@apple.com",
      "hash": "cebda2d5fd485cc09a46d5adcac91d33fc5a4fae",
      "subject": "[Custom Highlight] Unmark HighlightRegistry-highlightsFromPoint.html as failing."
    },
    "318709@main": {
      "author": "Justin Michaud",
      "avatar": "https://www.gravatar.com/avatar/36e0433ee725a08f7e1122a6bc584b57?d=identicon\u0026s=64",
      "cl": "318709@main",
      "clUrl": "https://commits.webkit.org/318709@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319535\n\nReviewed by Carlos Garcia Campos.\n\nPatch 1 of 2, the second removes sched_yield.\n\nRT threads showed a 10% win on MotionMark clamped to two cores. This\ngoes away if you turn off DVFS, so I believe the biggest mechanism\nbehind this is the increased effective clock speed.\n\nWe can recover that by setting the min clamp for DVFS directly. Most WPE\nworkloads probably won't be using DVFS (that is, they will be set to\nperformance), but this seems like the right call to me for desktop anyway.\n\nFinally, in this 2-core case, we use nice to lower the priority of the\njit workers, and this gives us a small but noticable bump on SP3.\nWe use RTKit still to raise the priority of the former RT threads, which\ngives a further small boost.\n\nCanonical link: https://commits.webkit.org/318709@main",
      "email": "jmichaud@igalia.com",
      "hash": "ef6d9ba26b17c53bfb2250c8cdc49d93f078794c",
      "subject": "[Linux] Remove RT threads"
    },
    "318710@main": {
      "author": "Sam Weinig",
      "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64",
      "cl": "318710@main",
      "clUrl": "https://commits.webkit.org/318710@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320995\n\nReviewed by Darin Adler.\n\nReplaces awkward modeling of `line-height` computed value using LengthPercentage\nwith one that mirrors the spec. This removes the unused `calc` term and makes\nthings a bit more clear to the reader.\n\nThe removal of an unnecessary multiplication by 100 then later division by 100\nthat happened due to converting from storing as Percentage to storing as a\nNumber caused a small precision change in line-height-get-computed-style.html.\n\nTo avoid other precision changes issues, the evaluation functions have been\ncarefully constructed to retain the same set of conversions to LayoutUnit as\nthe older code.\n\n* LayoutTests/fast/css/line-height-get-computed-style-expected.txt:\n* LayoutTests/fast/css/line-height-get-computed-style.html:\n* Source/WebCore/css/values/primitives/CSSPrimitiveNumericRange.h:\n* Source/WebCore/layout/formattingContexts/inline/InlineLevelBox.h:\n* Source/WebCore/page/PrintContext.cpp:\n* Source/WebCore/rendering/TextAutoSizing.cpp:\n* Source/WebCore/rendering/style/AutosizeStatus.cpp:\n* Source/WebCore/style/StyleExtractorCustom.h:\n* Source/WebCore/style/values/inline/StyleLineHeight.cpp:\n* Source/WebCore/style/values/inline/StyleLineHeight.h:\n\nCanonical link: https://commits.webkit.org/318710@main",
      "email": "sam@webkit.org",
      "hash": "acfe18ce0f1cb3f287d6f1730bd6179e8e7fa808",
      "subject": "Model computed value line-height more closely to how its specified"
    },
    "318711@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318711@main",
      "clUrl": "https://commits.webkit.org/318711@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=281976\nrdar://138495467\n\nReviewed by Antti Koivisto.\n\nTestcase:\n\n      @scope (.outer:has(.bar)) {\n        @scope (:has(:scope .baz)) {\n          .foo { color: green; }\n        }\n      }\n\n.foo is green, but \":has(:scope .baz)\" requires its anchor to be an ancestor of\n:scope, i.e. of .outer, and such an element is never in the outer scope, so the\ninner @scope should produce no scoping root at all.\n\nPer CSS Cascade 6, the prelude of a nested @scope is \"scoped by the selectors of\nthe outer one\" [1], and a scoped selector containing an explicit :scope \"is\ninterpreted as a non-relative selector (but the subject must still be in scope\nto match)\" [2], in scope meaning \"an inclusive descendant of the scoping root\"\nthat is \"not an inclusive descendant of a scoping limit\" [3].\n\nWe only implement the relative half: a nested prelude normally gets an implicit\n\":scope \" prepended, which incidentally keeps the candidate root inside the\nouter scope. That prepend is skipped when the prelude already contains :scope or\n\u0026, including inside :has(), since CSSSelector::hasExplicitPseudoClassScope()\nvisits functional pseudo-classes. Skipping it is correct, but we then never\ncheck the subject is in scope, so findScopingRoots() accepts any matching\nancestor -- here \u003cbody\u003e, which .foo descends from.\n\nReject candidate scoping roots that are not inclusive descendants of the\nenclosing scoping root. Both are on the ancestor chain of the element being\nmatched, so comparing distances is sufficient. Outer scoping limits need no\nextra check: a limit between the outer root and the inner candidate also sits on\nthe path from the element, so the outer @scope has already rejected that root.\n\n[1] https://www.w3.org/TR/css-cascade-6/#scope-scope\n[2] https://www.w3.org/TR/css-cascade-6/#scoped-rules\n[3] https://www.w3.org/TR/css-cascade-6/#in-scope\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-cascade/scope-evaluation-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-cascade/scope-evaluation.html:\n* Source/WebCore/style/ElementRuleCollector.cpp:\n(WebCore::Style::ElementRuleCollector::scopeRulesMatch):\n\nCanonical link: https://commits.webkit.org/318711@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "f5cac74bf03a3b32a3fc08adef4768745714cc55",
      "subject": "Nested @scope with :has(:scope ...) in \u003cscope-start\u003e picks scoping roots outside the outer scope"
    },
    "318712@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318712@main",
      "clUrl": "https://commits.webkit.org/318712@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320641\nrdar://183619537\n\nReviewed by Youenn Fablet.\n\nCompletes 318047@main. Making m_audioTransport a\nstd::atomic\u003cwebrtc::AudioTransport*\u003e made the pointer value race-free but\ngave no ordering against the pointee's destruction. The transport is\nAudioState::audio_transport_, a member of AudioState, so when\nWebRtcVoiceEngine::Terminate() calls StopPlayout() then\nRegisterAudioCallback(nullptr) and drops AudioState, a poll still inside\nPullRenderData() is using freed memory. StopPlayout() only stores false\ninto m_isPlaying and returns; it does not wait for the polling chain.\n\nGuard m_audioTransport with a lock that pollFromSource() holds across its\nPullRenderData() calls. RegisterAudioCallback() takes that same lock, so it\ncannot return while a poll is still using the transport it is replacing, and\nits caller is then free to destroy that transport, as\nWebRtcVoiceEngine::Terminate() does. That subsumes the atomic, which is no\nlonger needed, and WTF_GUARDED_BY_LOCK now machine-checks every access. The\nbarrier belongs here rather than in StopPlayout(), which libwebrtc reaches\nfrom BaseChannel::UpdateMediaSendRecvState_w() under\nRTC_DCHECK_DISALLOW_THREAD_BLOCKING_CALLS() on every renegotiation to\nsendonly or inactive; RegisterAudioCallback() runs only at engine init and\nterminate, where waiting for at most one in-flight poll is acceptable.\n\nKeep m_isPlaying atomic: it is written on libwebrtc's worker thread, read\non the work queue, and read via Playing() from AudioState.\n\n* Source/WebCore/platform/mediastream/libwebrtc/LibWebRTCAudioModule.cpp:\n(WebCore::LibWebRTCAudioModule::RegisterAudioCallback):\n(WebCore::LibWebRTCAudioModule::pollFromSource):\n* Source/WebCore/platform/mediastream/libwebrtc/LibWebRTCAudioModule.h:\n\nCanonical link: https://commits.webkit.org/318712@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "de6ac853eb8beed6c1a3f482e4a31d16894bfe93",
      "subject": "LibWebRTCAudioModule can use the audio transport after it is unregistered and destroyed"
    },
    "318713@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318713@main",
      "clUrl": "https://commits.webkit.org/318713@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312128\nrdar://174638256\n\nReviewed by Antti Koivisto.\n\nThis patch aligns WebKit with Gecko / Firefox and Blink / Chromium.\n\nWhen an iframe is loaded while its parent has display:none, no layout occurs.\nWhen the parent becomes visible, the iframe gets its first layout but no resize\nevent fires on its contentWindow, because willDoLayout() pre-initializes\nm_lastViewportSize to the current size, making scheduleResizeEventIfNeeded()\nsee no change.\n\nPer the CSSOM View spec [1], a resize event should fire when a document's\nviewport has had its width or height changed since the last time the resize\nsteps were run. The viewport going from 0x0 (no layout) to its actual size\nis a genuine change.\n\nFix by adding a m_loadedWhileHidden flag to LocalFrameView, set in\nDocument::dispatchWindowLoadEvent() when the document finishes loading as a\nsubframe that was never laid out and whose owner element has no renderer\n(i.e. parent had display:none). On first layout, willDoLayout() skips\npre-initializing m_lastViewportSize only when this flag is set, allowing\nscheduleResizeEventIfNeeded() to detect the 0x0 to actual size transition.\n\n[1] https://drafts.csswg.org/cssom-view/#resizing-viewports\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/dynamic-viewport-units-rule-cache-expected.txt:\n* Source/WebCore/page/LocalFrameView.cpp:\n(WebCore::LocalFrameView::willDoLayout):\n\nCanonical link: https://commits.webkit.org/318713@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "ec16a43776c20636d253cae1f0f76ee600d12bee",
      "subject": "Fire resize event when iframe viewport transitions from display:none to visible"
    },
    "318714@main": {
      "author": "Alice Tang",
      "avatar": "https://www.gravatar.com/avatar/bdf501bf22c8da1146b5fd324fd6c877?d=identicon\u0026s=64",
      "cl": "318714@main",
      "clUrl": "https://commits.webkit.org/318714@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317766\nrdar://180637489\n\nReviewed by Eric Carlson.\n\nExtends object-view-box rendering (added for img/canvas in bug 316882) to video,\ncovering inline composited playback and the fullscreen/PiP presentation paths\n\nRenderVideo/RenderLayerBacking:\n- croppedVideoBoxForCompositing() and inlineVideoBox() apply the same view-box\ncrop to the composited video layer that the software paint path already used,\naccounting for object-fit and poster-aware intrinsic size\n- updateContentsRects() special-cases RenderVideo to set contents/clip rects from\nthe cropped geometry instead of contentsBox()\n- updateVideoGravity() skips object-fit-driven video gravity when object-view-box is\nset, since the cropped rect already bakes that in\n- Bypasses the crop once a video enters Picture-in-Picture, so PiP always shows the\nfull natural frame\n\nFullscreen/PiP (HTMLMediaElement, HTMLVideoElement,\nVideoPresentationModelVideoElement, VideoPresentationManager(Proxy),\nVideoPresentationInterfaceMac):\n- New SetHasObjectViewBox IPC message plumbs whether a video has object-view-box\nset from WebProcess to UIProcess, so fullscreen/PiP can react to it changing mid-session,\nnot just at presentation-mode entry\n- Transition-anchor rect for entering/exiting fullscreen/PiP now uses the video's true\ninline box instead of the cropped compositing geometry, so the zoom animation\noriginates from where the video actually is\n\nAdds new compositing/video layout tests covering object-view-box with dynamic style\nchanges, no-poster rendering, object-position, and vertical writing modes, with\niOS-specific baselines where rendering differs from the generic expectation.\n\nTested compositing/video, video-object-fit(-change), and the WKWebView fullscreen/PiP\nTestWebKitAPI suites; no regressions. Two failures turned out to be pre-existing and\nunrelated; confirmed by reproducing them on the tree without this patch\n\n* LayoutTests/compositing/video/video-object-view-box-dynamic-change-expected.txt: Added.\n* LayoutTests/compositing/video/video-object-view-box-dynamic-change.html: Added.\n* LayoutTests/compositing/video/video-object-view-box-no-poster-expected.txt: Added.\n* LayoutTests/compositing/video/video-object-view-box-no-poster.html: Added.\n* LayoutTests/compositing/video/video-object-view-box-object-position-no-poster-expected.txt: Added.\n* LayoutTests/compositing/video/video-object-view-box-object-position-no-poster.html: Added.\n* LayoutTests/compositing/video/video-object-view-box-writing-mode-no-poster-expected.txt: Added.\n* LayoutTests/compositing/video/video-object-view-box-writing-mode-no-poster.html: Added.\n* LayoutTests/platform/gtk/TestExpectations:\n* LayoutTests/platform/ios/compositing/video/video-object-view-box-dynamic-change-expected.txt: Added.\n* LayoutTests/platform/ios/compositing/video/video-object-view-box-no-poster-expected.txt: Added.\n* LayoutTests/platform/ios/compositing/video/video-object-view-box-object-position-no-poster-expected.txt: Added.\n* LayoutTests/platform/ios/compositing/video/video-object-view-box-writing-mode-no-poster-expected.txt: Added.\n* LayoutTests/platform/wpe/TestExpectations:\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::didBecomeFullscreenElement):\n(WebCore::HTMLMediaElement::didStopBeingFullscreenElement):\n(WebCore::HTMLMediaElement::hasObjectViewBoxChanged):\n* Source/WebCore/html/HTMLMediaElement.h:\n(WebCore::HTMLMediaElementClient::hasObjectViewBoxChanged):\n* Source/WebCore/html/HTMLVideoElement.cpp:\n(WebCore::HTMLVideoElement::didEnterFullscreenOrPictureInPicture):\n(WebCore::HTMLVideoElement::didExitFullscreenOrPictureInPicture):\n* Source/WebCore/platform/cocoa/VideoPresentationModel.h:\n(WebCore::VideoPresentationModel::hasObjectViewBox const):\n(WebCore::VideoPresentationModelClient::hasObjectViewBoxChanged):\n* Source/WebCore/platform/cocoa/VideoPresentationModelVideoElement.h:\n* Source/WebCore/platform/cocoa/VideoPresentationModelVideoElement.mm:\n(WebCore::VideoPresentationModelVideoElement::updateForEventName):\n(WebCore::VideoPresentationModelVideoElement::hasObjectViewBoxChanged):\n* Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp:\n(WebCore::GraphicsLayerCA::setContentsToPlatformLayer):\n* Source/WebCore/platform/mac/VideoPresentationInterfaceMac.h:\n* Source/WebCore/platform/mac/VideoPresentationInterfaceMac.mm:\n(-[WebVideoPresentationInterfaceMacObjC setUpPIPForVideoView:withFrame:inWindow:]):\n(-[WebVideoPresentationInterfaceMacObjC exitPIP]):\n(-[WebVideoPresentationInterfaceMacObjC boundsDidChangeForVideoViewContainer:]):\n(-[WebVideoPresentationInterfaceMacObjC pipDidClose:]):\n(-[WebVideoPresentationInterfaceMacObjC pipActionStop:]):\n(WebCore::VideoPresentationInterfaceMac::setupFullscreen):\n(WebCore::VideoPresentationInterfaceMac::hasObjectViewBoxChanged):\n* Source/WebCore/rendering/RenderLayerBacking.cpp:\n(WebCore::RenderLayerBacking::updateVideoGravity):\n(WebCore::RenderLayerBacking::updateContentsRects):\n(WebCore::RenderLayerBacking::inlineVideoContentsBox const):\n* Source/WebCore/rendering/RenderLayerBacking.h:\n* Source/WebCore/rendering/RenderReplaced.cpp:\n(WebCore::RenderReplaced::hasObjectViewBoxSet const):\n(WebCore::RenderReplaced::computePaintRectForObjectViewBox const):\n* Source/WebCore/rendering/RenderReplaced.h:\n(WebCore::RenderReplaced::computePaintRectForObjectViewBox const):\n* Source/WebCore/rendering/RenderVideo.cpp:\n(WebCore::RenderVideo::posterAwareIntrinsicSize const):\n(WebCore::RenderVideo::videoBox const):\n(WebCore::RenderVideo::isBypassingObjectViewBoxForPictureInPicture const):\n(WebCore::RenderVideo::objectFitContentsRectForFullscreenCompositing const):\n(WebCore::RenderVideo::croppedVideoBoxForCompositing const):\n(WebCore::RenderVideo::inlineVideoBox const):\n(WebCore::RenderVideo::paintReplaced):\n(WebCore::RenderVideo::styleDidChange):\n(WebCore::RenderVideo::updatePlayer):\n* Source/WebCore/rendering/RenderVideo.h:\n* Source/WebKit/UIProcess/Cocoa/VideoPresentationManagerProxy.h:\n* Source/WebKit/UIProcess/Cocoa/VideoPresentationManagerProxy.messages.in:\n* Source/WebKit/UIProcess/Cocoa/VideoPresentationManagerProxy.mm:\n(WebKit::VideoPresentationModelContext::setHasObjectViewBox):\n(WebKit::VideoPresentationManagerProxy::setupFullscreenWithID):\n(WebKit::VideoPresentationManagerProxy::setHasObjectViewBox):\n* Source/WebKit/WebProcess/cocoa/VideoPresentationManager.h:\n* Source/WebKit/WebProcess/cocoa/VideoPresentationManager.mm:\n(WebKit::inlineVideoFrame):\n(WebKit::VideoPresentationInterfaceContext::hasObjectViewBoxChanged):\n(WebKit::VideoPresentationManager::enterVideoFullscreenForVideoElement):\n(WebKit::VideoPresentationManager::hasObjectViewBoxChanged):\n\nCanonical link: https://commits.webkit.org/318714@main",
      "email": "tang.alice.000@gmail.com",
      "hash": "4bbe21c2de859693c1de05b4bd98fd0560704678",
      "subject": "CSS object-view-box: implement rendering for video elements"
    },
    "318715@main": {
      "author": "Sam Weinig",
      "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64",
      "cl": "318715@main",
      "clUrl": "https://commits.webkit.org/318715@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320908\n\nReviewed by Darin Adler.\n\nConverts the two separate implementations of Style::resolveLength to using\na shared generic implementation that uses adaptors to specialize.\n\nAdds appropriate fallbacks for the direct data overload so that all units\nare now supported. This does not change any behavior, as the now supported\nunits have no callers.\n\n* Source/WebCore/style/values/primitives/StyleLengthResolution.cpp:\n\nCanonical link: https://commits.webkit.org/318715@main",
      "email": "sam@webkit.org",
      "hash": "21b4e3f65fd889f0e6ac38de214997053b0597c3",
      "subject": "Unify implementations of Style::resolveLength"
    },
    "318716@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "318716@main",
      "clUrl": "https://commits.webkit.org/318716@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321068\n\nReviewed by Simon Fraser.\n\nWhen text is selected (or a caret is placed) inside a cross-origin, site-isolated\niframe, the selection and caret were drawn in the wrong place once the main frame\nhad been scrolled -- shifted by the main frame's scroll offset.\n\nThe selection rects are computed in the subframe's process and mapped to main-frame\ncoordinates by FrameView::convertToRootViewAcrossIsolatedFrames(), whose final step\ncalls contentsToView() on the main frame's view. On iOS the local main frame's\nLocalFrameView is DelegatedToNativeScrollView (set from the drawing area in\nWebLocalFrameLoaderClient), so contentsToView() is the identity and the rects stay\nin main-frame content coordinates -- which is what UIKit expects, since the\nWKContentView is document-sized. The main frame's RemoteFrameView proxy in the\nsubframe's process, however, defaulted to NotDelegated and its scrollPosition()\nreflects the synced FrameScrollPosition, so contentsToView() subtracted the main\nframe's scroll offset. The result was a cross-origin selection rect offset by\nexactly the main-frame scroll, while a same-origin selection (which skips this\nconversion) was correct.\n\nFix this by mirroring the drawing area's delegated-scrolling mode onto the main\nframe's RemoteFrameView, so the proxy performs the same coordinate conversions as\nthe real main frame in the process that hosts it. This is correct cross-platform:\non iOS the mode is DelegatedToNativeScrollView (identity), and on macOS it is\nDelegatedToWebKit, which still subtracts scroll -- matching the local main frame\nthere. The synced childFrameOwnerToRootContentTransform is already scroll-invariant;\nonly the final contentsToView() was wrong.\n\nTest: TestWebKitAPI.SiteIsolation.SelectionInCrossOriginIframeTracksMainFrameScroll\n\n* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:\n(WebKit::WebFrame::loadDidCommitInAnotherProcess): Call\nupdateRemoteMainFrameViewDelegatedScrolling when the main frame transitions from\nlocal to remote.\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::WebPage): Call updateRemoteMainFrameViewDelegatedScrolling when\nthe page is created with a remote main frame.\n(WebKit::WebPage::updateRemoteMainFrameViewDelegatedScrolling): Added.\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, SelectionInCrossOriginIframeTracksMainFrameScroll)):\nAdded SelectionInCrossOriginIframeTracksMainFrameScroll, comparing a same-origin\niframe (reference) against a cross-origin one under main-frame scroll.\n\nCanonical link: https://commits.webkit.org/318716@main",
      "email": "rniwa@webkit.org",
      "hash": "d67629db80a219120c04862d20b6425bc267de60",
      "subject": "[Site Isolation] [iOS] Caret inside a cross-site iframe renders at a wrong location"
    },
    "318717@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "318717@main",
      "clUrl": "https://commits.webkit.org/318717@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321125\n\nReviewed by Wenson Hsieh and Megan Gardner.\n\nWhen a text field inside a cross-origin (site-isolated) iframe has a caret, two related\niOS behaviors were broken:\n\n1. Tapping empty (non-click-target) content in the main frame did not clear the caret in\n   the cross-origin subframe's field. commitPotentialTap()'s reportFailedTap() clears focus\n   via setFocusedElement(nullptr) only under ENABLE(FOCUS_ADJUSTMENT_IN_SYNTHETIC_CLICK),\n   which is disabled on iOS; and even when enabled, localFocusedFrame() is null while a\n   remote frame holds focus, so nothing defocused the subframe. As a result the subframe\n   stayed focused and its caret persisted.\n\n2. Focusing a text field in the main frame (after a cross-origin subframe's field was\n   focused) left the main-frame field with no caret. Focus moves in the main frame's\n   process first (ElementDidFocus), then the subframe process blurs its now-defocused\n   field and sends ElementDidBlur. That blur arrives after the main-frame field was\n   focused, and the UI process blurred it unconditionally -- wiping the new caret.\n\nFix (1) by having reportFailedTap() move focus to the local root frame when a remote frame\ncurrently holds focus, which broadcasts the focus change and defocuses the subframe\n(scoped to the remote case so local behavior, intentionally untouched when synthetic-click\nfocus adjustment is off, is unchanged).\n\nFix (2) by tracking, in the UI process, which web process reported the currently-focused\nelement (from ElementDidFocus, which already carries the connection) and ignoring an\nElementDidBlur from a different process. This is a no-op for the single-process case and\nfor focus moving to nothing (no newer ElementDidFocus, so the process still matches).\n\nAdd a regression test for (2). It focuses a cross-origin iframe field, then focuses a\nmain-frame field, and verifies (via a new _hasFocusedElementForTesting hook) that the\nmain-frame field remains focused after the subframe's stale blur has been delivered.\n(1) is verified manually; TestWebKitAPI has no way to synthesize a real tap on iOS.\n\nTest: http/tests/site-isolation/tap-main-frame-clears-caret-in-cross-origin-iframe.html\n      TestWebKitAPI.SiteIsolation.FocusingMainFrameFieldKeepsFocusAfterCrossOriginIframeField\n\n* LayoutTests/http/tests/site-isolation/resources/text-input.html:\n* LayoutTests/http/tests/site-isolation/tap-main-frame-clears-caret-in-cross-origin-iframe-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/tap-main-frame-clears-caret-in-cross-origin-iframe.html: Added.\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm:\n(WebKit::WebPageProxy::elementDidFocus): Record the reporting process.\n(WebKit::WebPageProxy::elementDidBlur): Ignore a stale blur from another process.\n* Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm:\n(WebKit::WebPage::commitPotentialTap): In reportFailedTap(), defocus a cross-origin subframe\nthat holds focus by moving focus to the local root frame.\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(-[SiteIsolationInputSessionWebView hasActiveInputSession]):\n(-[SiteIsolationInputSessionWebView didStartFormControlInteraction]):\n(-[SiteIsolationInputSessionWebView didEndFormControlInteraction]):\n(TestWebKitAPI::(SiteIsolation, FocusingMainFrameFieldKeepsFocusAfterCrossOriginIframeField)):\n\nCanonical link: https://commits.webkit.org/318717@main",
      "email": "rniwa@webkit.org",
      "hash": "9fd70490c75d5f5af1675ef73bfb7988687d2bc3",
      "subject": "[Site Isolation] [iOS] Tapping on a text field does not move the caret from a cross-site iframe"
    },
    "318718@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "318718@main",
      "clUrl": "https://commits.webkit.org/318718@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321143\n\nReviewed by Antti Koivisto.\n\n  \u003cspan style=\"-webkit-box-decoration-break: clone; border: 20px solid magenta\"\u003e\n    a\n    \u003cdiv\u003eblock\u003c/div\u003e\n    \u003cspan\u003e\u003c/span\u003e\n    \u003cdiv\u003eblock\u003c/div\u003e\n    c\n  \u003c/span\u003e\n\nThe two block level boxes should be right next to each other, the way they are in\nBlink. Instead a 20px tall line with a 40px wide magenta border box showed up\nbetween them, for the empty inline box.\nThe test case is adapted from Oriol Brufau's reduction in\nhttps://github.com/w3c/csswg-drafts/issues/14104\n\nLine::initialize hands a line spanning inline box run the width of its cloned\ndecoration, so isContentfulOrHasDecoration answered \"contentful\" on its very first\ncheck (run.logicalWidth()) and the line got a full strut. The fragment's display box\nwas then built from the border box, so all four cloned edges painted.\n\nCloned decoration wraps the content of a box fragment, so it can't make a line\ncontentful by itself. A line spanning inline box start no longer does, and on a line\nwith no inline content its display box uses the content box -the rule block lines\nalready followed. This matches Blink.\n\n* Source/WebCore/layout/formattingContexts/inline/InlineLine.cpp:\n(WebCore::Layout::Line::Run::isContentfulOrHasDecoration):\n* Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayContentBuilder.cpp:\n(WebCore::Layout::InlineDisplayContentBuilder::processNonBidiContent):\n* LayoutTests/imported/w3c/web-platform-tests/css/css-break/box-decoration-break-clone-block-in-inline-001.html: Added.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\nCanonical link: https://commits.webkit.org/318718@main",
      "email": "zalan@apple.com",
      "hash": "4b5123221d3b52683ca5d44e1728f614d2d946b5",
      "subject": "[block-in-inline] Inline box with cloned decoration generates an extra line between two block level boxes"
    },
    "318720@main": {
      "author": "Ruthvik Konda",
      "avatar": "https://www.gravatar.com/avatar/bca33cefcce93017251a8fbc1204cdc4?d=identicon\u0026s=64",
      "cl": "318720@main",
      "clUrl": "https://commits.webkit.org/318720@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321131\nrdar://184164840\n\nReviewed by Mike Wyrzykowski.\n\nLazyLoadModelObserver.cpp includes \u003climits\u003e but never uses std::numeric_limits. No change in behavior.\n\n* Source/WebCore/Modules/model-element/LazyLoadModelObserver.cpp:\n\nCanonical link: https://commits.webkit.org/318720@main",
      "email": "rkonda2@apple.com",
      "hash": "7b4c3365d1395d7aa49c6abbaad979be590a79a5",
      "subject": "[model] Remove unused \u003climits\u003e include in LazyLoadModelObserver"
    },
    "318721@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "318721@main",
      "clUrl": "https://commits.webkit.org/318721@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321164\nrdar://184200996\n\nReviewed by Sosuke Suzuki.\n\nWe remove many GPR pairs which are only used for 32bit's JSValue\nrepresentation. Also remove various DFG formats which are only used\nin 32bit. Additionally, dropping 32bit-only-related OSR entry code.\n\n* Source/JavaScriptCore/bytecode/DataFormat.h:\n(JSC::isJSFormat): Deleted.\n(JSC::isJSInt32): Deleted.\n(JSC::isJSDouble): Deleted.\n(JSC::isJSCell): Deleted.\n(JSC::isJSBoolean): Deleted.\n* Source/JavaScriptCore/bytecode/ValueRecovery.cpp:\n(JSC::ValueRecovery::dumpInContext const):\n* Source/JavaScriptCore/bytecode/ValueRecovery.h:\n(JSC::ValueRecovery::inGPR):\n(JSC::ValueRecovery::isInGPR const):\n(JSC::ValueRecovery::dataFormat const):\n(JSC::ValueRecovery::forEachReg):\n* Source/JavaScriptCore/dfg/DFGAbstractValue.h:\n* Source/JavaScriptCore/dfg/DFGGenerationInfo.h:\n(JSC::DFG::GenerationInfo::initCell):\n(JSC::DFG::GenerationInfo::fillStrictInt52):\n(JSC::DFG::GenerationInfo::initBoolean): Deleted.\n(JSC::DFG::GenerationInfo::isJSFormat): Deleted.\n(JSC::DFG::GenerationInfo::isJSInt32): Deleted.\n(JSC::DFG::GenerationInfo::isJSDouble): Deleted.\n(JSC::DFG::GenerationInfo::isJSCell): Deleted.\n(JSC::DFG::GenerationInfo::isJSBoolean): Deleted.\n(JSC::DFG::GenerationInfo::fillBoolean): Deleted.\n* Source/JavaScriptCore/dfg/DFGNode.h:\n(JSC::DFG::Node::asBoolean): Deleted.\n* Source/JavaScriptCore/dfg/DFGOSREntry.cpp:\n(JSC::DFG::prepareOSREntry):\n* Source/JavaScriptCore/dfg/DFGOSRExit.cpp:\n(JSC::DFG::OSRExit::compileExit):\n* Source/JavaScriptCore/dfg/DFGSilentRegisterSavePlan.h:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n(JSC::DFG::SpeculativeJIT::silentSavePlanForGPR):\n(JSC::DFG::SpeculativeJIT::silentSpillImpl):\n(JSC::DFG::SpeculativeJIT::silentFillImpl):\n(JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32):\n(JSC::DFG::SpeculativeJIT::compileExtractFromTuple):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:\n(JSC::DFG::SpeculativeJIT::spill):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:\n(JSC::DFG::SpeculativeJIT::fillJSValue):\n(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):\n(JSC::DFG::SpeculativeJIT::fillSpeculateCell):\n(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):\n(JSC::DFG::SpeculativeJIT::fillSpeculateBigInt32):\n* Source/JavaScriptCore/dfg/DFGUseKind.h:\n* Source/JavaScriptCore/dfg/DFGVariableEvent.h:\n* Source/JavaScriptCore/dfg/DFGVariableEventStream.cpp:\n* Source/JavaScriptCore/jit/CallFrameShuffler64.cpp:\n(JSC::CallFrameShuffler::emitStore):\n(JSC::CallFrameShuffler::emitBox):\n* Source/JavaScriptCore/jit/JIT.h:\n* Source/JavaScriptCore/jit/JITArithmetic.cpp:\n(JSC::JIT::emit_compareUnsignedAndJumpImpl):\n(JSC::JIT::emit_compareUnsignedImpl):\n* Source/JavaScriptCore/jit/JITCall.cpp:\n(JSC::JIT::compileCallDirectEval):\n(JSC::JIT::emit_op_async_iterator_next):\n(JSC::JIT::emit_op_instanceof):\n* Source/JavaScriptCore/jit/JITInlines.h:\n(JSC::JIT::emitGetVirtualRegisterPayload): Deleted.\n* Source/JavaScriptCore/jit/JITOpcodes.cpp:\n(JSC::JIT::emit_op_set_function_name):\n(JSC::JIT::emit_op_get_parent_scope):\n(JSC::JIT::emit_op_create_this):\n(JSC::JIT::emitNewFuncCommon):\n(JSC::JIT::emitNewFuncExprCommon):\n(JSC::JIT::emit_op_create_lexical_environment):\n(JSC::JIT::emit_op_create_scoped_arguments):\n(JSC::JIT::emit_op_log_shadow_chicken_prologue):\n(JSC::JIT::emit_op_log_shadow_chicken_tail):\n* Source/JavaScriptCore/jit/JITPropertyAccess.cpp:\n(JSC::JIT::emit_op_put_getter_by_id):\n(JSC::JIT::emit_op_put_setter_by_id):\n(JSC::JIT::emit_op_put_getter_setter_by_id):\n(JSC::JIT::emit_op_put_getter_by_val):\n(JSC::JIT::emit_op_put_setter_by_val):\n(JSC::JIT::emit_op_resolve_scope):\n(JSC::JIT::emitSlow_op_resolve_scope):\n(JSC::JIT::emit_op_get_from_scope):\n(JSC::JIT::emitSlow_op_get_from_scope):\n(JSC::JIT::emit_op_put_to_scope):\n(JSC::JIT::emit_op_get_from_arguments):\n(JSC::JIT::emit_op_put_to_arguments):\n(JSC::JIT::emit_op_get_internal_field):\n(JSC::JIT::emit_op_put_internal_field):\n* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:\n(JSC::Wasm::BBQJITImpl::Location::dump const):\n(JSC::Wasm::BBQJITImpl::Location::operator== const):\n(JSC::Wasm::BBQJITImpl::BBQJIT::saveValuesAcrossCallAndPassArguments):\n(JSC::Wasm::BBQJITImpl::BBQJIT::returnValuesFromCall):\n(JSC::Wasm::BBQJITImpl::BBQJIT::addFusedIfCompare):\n(JSC::Wasm::BBQJITImpl::BBQJIT::setLRUKey):\n(JSC::Wasm::BBQJITImpl::BBQJIT::allocateWithHint):\n(JSC::Wasm::BBQJITImpl::BBQJIT::bind):\n(JSC::Wasm::BBQJITImpl::BBQJIT::unbind):\n(JSC::Wasm::BBQJITImpl::Location::isGPR2 const): Deleted.\n(JSC::Wasm::BBQJITImpl::Location::asGPRlo const): Deleted.\n(JSC::Wasm::BBQJITImpl::Location::asGPRhi const): Deleted.\n* Source/JavaScriptCore/wasm/WasmBBQJIT.h:\n(JSC::Wasm::BBQJITImpl::BBQJIT::ScratchScope::initializedPreservedSet):\n* Source/JavaScriptCore/wasm/WasmBBQJIT64.h:\n(JSC::Wasm::BBQJITImpl::BBQJIT::typeNeedsGPR2): Deleted.\n\nCanonical link: https://commits.webkit.org/318721@main",
      "email": "ysuzuki@apple.com",
      "hash": "bf1dab73b14dafe56b0e5a9f987fdf8ca4f4ee66",
      "subject": "[JSC] Remove many 32bit-only concept from JIT"
    },
    "318722@main": {
      "author": "Sergio Villar Senin",
      "avatar": "https://www.gravatar.com/avatar/2d83fda649cd4acc99663f5ce5aaedee?d=identicon\u0026s=64",
      "cl": "318722@main",
      "clUrl": "https://commits.webkit.org/318722@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320898\n\nReviewed by Dan Glastonbury.\n\ncreateSwapchain() passed the view configuration's\nrecommendedSwapchainSampleCount straight through to XrSwapchainCreateInfo. That\nrecommendation is meant for applications that render into the swapchain\nimage directly. However that image is shared with the WebProcess where\nit is rendered. The WebProcess already uses a multisampled renderbuffer\nbacked by the shared image in order to support MSAA. A multisampled\nimage from the OpenXR runtime won't add anything.\n\nNo new tests as there is no change in behavior.\n\n* Source/WebKit/UIProcess/XR/openxr/PlatformXROpenXR.cpp:\n(WebKit::OpenXRCoordinator::createSwapchain const):\n\nCanonical link: https://commits.webkit.org/318722@main",
      "email": "svillar@igalia.com",
      "hash": "014926384ff3b5b83cf27f817eb431e1400eec0a",
      "subject": "[OpenXR] Swapchains might create multisampled images for no benefit"
    },
    "318723@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "318723@main",
      "clUrl": "https://commits.webkit.org/318723@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=245449\nrdar://100476630\n\nReviewed by Aditya Keerthi.\n\nThis patch aligns WebKit with Gecko / Firefox and Blink / Chromium.\n\nMerge: https://chromium.googlesource.com/chromium/src.git/+/9447bd245501e7f1abb9b51f1420e8ef4f73c4dc\n\nThis patch fixes bug where the 'color' input controls should be able to\naccessed via label irrespective of configured with 'display:none' (no\nrenderer).\n\nTest: fast/forms/color/display-none-input-color-chooser-shown.html\n\n* LayoutTests/fast/forms/color/display-none-input-color-chooser-shown-expected.txt: Added.\n* LayoutTests/fast/forms/color/display-none-input-color-chooser-shown.html: Added.\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/win/TestExpectations:\n* Source/WebCore/html/ColorInputType.cpp:\n(WebCore::ColorInputType::handleDOMActivateEvent):\n\nCanonical link: https://commits.webkit.org/318723@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "cdf87a689ae0bd70eb8fb0a82a40ba79b1d8692c",
      "subject": "Open a color input with display:none via a label"
    },
    "318724@main": {
      "author": "Luke Warlow",
      "avatar": "https://www.gravatar.com/avatar/262b456ff1e93842b93f9694d1e01a9e?d=identicon\u0026s=64",
      "cl": "318724@main",
      "clUrl": "https://commits.webkit.org/318724@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318861\n\nReviewed by Devin Rousso.\n\nAdds InspectorInstrumentation calls to ContainerNode::moveBefore(),\nthis ensures that the web inspector is kept up-to-date when elements move within the DOM.\n\nThis doesn't, however, support DOM breakpoints yet.\n\nAlso adds some tests to ensure this works as expected.\n\nTests: inspector/dom/moveBefore-protocol.html\n       inspector/dom/moveBefore.html\n\n* LayoutTests/inspector/dom/moveBefore-expected.txt: Added.\n* LayoutTests/inspector/dom/moveBefore-protocol-expected.txt: Added.\n* LayoutTests/inspector/dom/moveBefore-protocol.html: Added.\n* LayoutTests/inspector/dom/moveBefore.html: Added.\n* Source/WebCore/dom/ContainerNode.cpp:\n(WebCore::ContainerNode::moveBefore):\n\nCanonical link: https://commits.webkit.org/318724@main",
      "email": "lwarlow@igalia.com",
      "hash": "f3f3dfe8ce76fa73883a2e4d8bfdfa6688aea27c",
      "subject": "moveBefore() isn't updating web inspector"
    },
    "318725@main": {
      "author": "Luke Warlow",
      "avatar": "https://www.gravatar.com/avatar/262b456ff1e93842b93f9694d1e01a9e?d=identicon\u0026s=64",
      "cl": "318725@main",
      "clUrl": "https://commits.webkit.org/318725@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320462\n\nReviewed by Ryosuke Niwa.\n\nImplements the moving steps for source and img elements to handle when they're moved inside of or out of a picture element.\n\nThis now passes the relevant-mutations.html WPT.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/relevant-mutations-expected.txt:\n* Source/WebCore/html/HTMLImageElement.cpp:\n(WebCore::HTMLImageElement::movingSteps):\n* Source/WebCore/html/HTMLImageElement.h:\n* Source/WebCore/html/HTMLSourceElement.cpp:\n(WebCore::HTMLSourceElement::movingSteps):\n* Source/WebCore/html/HTMLSourceElement.h:\n\nCanonical link: https://commits.webkit.org/318725@main",
      "email": "lwarlow@igalia.com",
      "hash": "84e2011fd5d2387195b07cee41dac1022e5873f5",
      "subject": "Implement moving steps for source and img elements"
    },
    "318726@main": {
      "author": "Marta Darbinyan",
      "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64",
      "cl": "318726@main",
      "clUrl": "https://commits.webkit.org/318726@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321185\nrdar://184245128\n\nUnreviewed test gardening\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318726@main",
      "email": "darbinyan@apple.com",
      "hash": "fc6640b0c8d4549a3864b4713333f4826c7e574f",
      "subject": "[Gardening]: [macOS Debug] imported/w3c/web-platform-tests/wasm/core/float_exprs.wast.js.html is a flaky timeout"
    },
    "318727@main": {
      "author": "Cole Carley",
      "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64",
      "cl": "318727@main",
      "clUrl": "https://commits.webkit.org/318727@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321105\nrdar://184144435\n\nReviewed by Kiet Ho.\n\nMembers of the CSSUnitType enum follow this pattern CSS_PX. This is\noutdated and does not follow our style guide. This patch changes the\nmembers to use PascalCase.\n\n* Source/WebCore/animation/KeyframeEffect.cpp:\n(WebCore::isTimelineRangeOffsetValid):\n(WebCore::computeMissingKeyframeOffsets):\n(WebCore::specifiedOffsetForParsedKeyframe):\n* Source/WebCore/animation/WebAnimationTime.cpp:\n(WebCore::WebAnimationTime::WebAnimationTime):\n* Source/WebCore/css/CSSPrimitiveValue.cpp:\n(WebCore::CSSPrimitiveValue::CSSPrimitiveValue):\n(WebCore::CSSPrimitiveValue::~CSSPrimitiveValue):\n(WebCore::CSSPrimitiveValue::create):\n(WebCore::CSSPrimitiveValue::createInteger):\n(WebCore::CSSPrimitiveValue::serializeInternal const):\n(WebCore::CSSPrimitiveValue::customCSSText const):\n(WebCore::CSSPrimitiveValue::equals const):\n(WebCore::CSSPrimitiveValue::addDerivedHash const):\n* Source/WebCore/css/CSSPrimitiveValue.h:\n(WebCore::CSSPrimitiveValue::isFontIndependentLength):\n(WebCore::CSSPrimitiveValue::isParentFontRelativeLength):\n(WebCore::CSSPrimitiveValue::isRootFontRelativeLength):\n(WebCore::CSSPrimitiveValue::isContainerPercentageLength):\n(WebCore::CSSPrimitiveValue::isLength):\n* Source/WebCore/css/CSSPropertyInitialValues.cpp:\n(WebCore::initialValueTextForLonghand):\n* Source/WebCore/css/CSSUnits.cpp:\n(WebCore::unitCategory):\n(WebCore::canonicalUnitTypeForCategory):\n(WebCore::operator\u003c\u003c):\n(WebCore::conversionToCanonicalUnitsScaleFactor):\n(WebCore::conversionToCanonicalUnitRequiresConversionData):\n(WebCore::unitTypeString):\n* Source/WebCore/css/CSSUnits.h:\n* Source/WebCore/css/CSSValuePool.cpp:\n(WebCore::StaticCSSValuePool::StaticCSSValuePool):\n* Source/WebCore/css/ShorthandSerializer.cpp:\n(WebCore::ShorthandSerializer::serializeFont const):\n(WebCore::ShorthandSerializer::serializeSingleAnimationRange const):\n* Source/WebCore/css/calc/CSSCalcTree+NumericIdentity.h:\n(WebCore::CSSCalc::toNumericIdentity):\n* Source/WebCore/css/calc/CSSCalcTree+Parser.cpp:\n(WebCore::CSSCalc::consumeAnchorFallback):\n(WebCore::CSSCalc::parseCalcDimension):\n* Source/WebCore/css/calc/CSSCalcTree+Serialization.cpp:\n(WebCore::CSSCalc::sortPriority):\n* Source/WebCore/css/calc/CSSCalcTree+Simplification.cpp:\n(WebCore::CSSCalc::canonicalize):\n* Source/WebCore/css/calc/CSSCalcTree.cpp:\n(WebCore::CSSCalc::makeNumeric):\n* Source/WebCore/css/calc/CSSCalcTree.h:\n(WebCore::CSSCalc::toCSSUnit):\n* Source/WebCore/css/calc/CSSCalcType.cpp:\n(WebCore::CSSCalc::Type::determineType):\n* Source/WebCore/css/calc/CSSCalcValue.cpp:\n(WebCore::CSSCalc::Value::primitiveType const):\n* Source/WebCore/css/deprecated-cssom/DeprecatedCSSOMPrimitiveValue.cpp:\n(WebCore::DeprecatedCSSOMPrimitiveValue::primitiveType const):\n(WebCore::DeprecatedCSSOMPrimitiveValue::getFloatValue const):\n* Source/WebCore/css/parser/CSSParserFastPaths.cpp:\n(WebCore::parseSimpleLength):\n(WebCore::parseSimpleLengthValue):\n(WebCore::parseColorIntOrPercentage):\n(WebCore::parseNumericColor):\n(WebCore::parseTransformTranslateArguments):\n(WebCore::parseTransformNumberArguments):\n(WebCore::parseOpacity):\n* Source/WebCore/css/parser/CSSParserToken.cpp:\n(WebCore::cssPrimitiveValueUnitFromTrie):\n(WebCore::CSSParserToken::CSSParserToken):\n(WebCore::CSSParserToken::convertToPercentage):\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Background.cpp:\n(WebCore::CSSPropertyParserHelpers::consumeUnresolvedBorderImageWidth):\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+CSSPrimitiveValueResolver.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Color.cpp:\n(WebCore::CSSPropertyParserHelpers::consumeRelativeFunctionParameters):\n(WebCore::CSSPropertyParserHelpers::consumeRelativeAlphaColorFunction):\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+LengthDefinitions.h:\n(WebCore::CSSPropertyParserHelpers::LengthValidator::validate):\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Overflow.cpp:\n(WebCore::CSSPropertyParserHelpers::consumeOverflowClipMargin):\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Timeline.cpp:\n(WebCore::CSSPropertyParserHelpers::consumeSingleAnimationRange):\n* Source/WebCore/css/parser/CSSPropertyParserCustom.h:\n(WebCore::CSS::PropertyParserCustom::consumeFlexShorthand):\n* Source/WebCore/css/scripts/process-css-properties.py:\n(NumericLiteral.cpp_unit_type):\n* Source/WebCore/css/scripts/test/TestCSSPropertiesResults/CSSPropertyInitialValuesGeneratedInlines.h:\n(WebCore::initialValueForLonghand):\n* Source/WebCore/css/typedom/CSSNumericFactory.h:\n* Source/WebCore/css/typedom/CSSNumericValue.cpp:\n(WebCore::invert):\n(WebCore::CSSNumericValue::multiplyInternal):\n(WebCore::CSSNumericValue::reifyValue):\n(WebCore::createCSSUnitValueFromAddend):\n(WebCore::CSSNumericValue::toSum):\n* Source/WebCore/css/typedom/CSSStyleValueFactory.cpp:\n(WebCore::reifyValue):\n* Source/WebCore/css/typedom/CSSUnitValue.cpp:\n(WebCore::CSSUnitValue::parseUnit):\n(WebCore::CSSUnitValue::unit const):\n(WebCore::CSSUnitValue::create):\n(WebCore::CSSUnitValue::reifyValue):\n(WebCore::CSSUnitValue::toSumValue const):\n(WebCore::isValueOutOfRangeForProperty):\n(WebCore::calculationCategoryForProperty):\n* Source/WebCore/css/typedom/color/CSSOMColorValue.cpp:\n(WebCore::CSSOMColorValue::rectifyCSSColorPercent):\n(WebCore::CSSOMColorValue::rectifyCSSColorAngle):\n(WebCore::CSSOMColorValue::rectifyCSSColorNumber):\n* Source/WebCore/css/typedom/color/CSSRGB.cpp:\n(WebCore::CSSRGB::rectifyCSSColorRGBComp):\n* Source/WebCore/css/typedom/transform/CSSPerspective.cpp:\n(WebCore::CSSPerspective::toMatrix):\n* Source/WebCore/css/typedom/transform/CSSRotate.cpp:\n(WebCore::CSSRotate::create):\n(WebCore::CSSRotate::toMatrix):\n* Source/WebCore/css/typedom/transform/CSSScale.cpp:\n(WebCore::CSSScale::create):\n* Source/WebCore/css/typedom/transform/CSSSkew.cpp:\n(WebCore::CSSSkew::toMatrix):\n* Source/WebCore/css/typedom/transform/CSSSkewX.cpp:\n(WebCore::CSSSkewX::toMatrix):\n* Source/WebCore/css/typedom/transform/CSSSkewY.cpp:\n(WebCore::CSSSkewY::toMatrix):\n* Source/WebCore/css/typedom/transform/CSSTranslate.cpp:\n(WebCore::CSSTranslate::create):\n(WebCore::CSSTranslate::toMatrix):\n* Source/WebCore/css/values/backgrounds/CSSBorderImageWidth.cpp:\n(WebCore::CSS::BorderImageWidthValue::isLength const):\n* Source/WebCore/css/values/color/CSSRelativeAlphaColorResolver.cpp:\n(WebCore::CSS::resolve):\n(WebCore::CSS::resolveNoConversionDataRequired):\n* Source/WebCore/css/values/color/CSSRelativeColorResolver.h:\n(WebCore::CSS::resolve):\n(WebCore::CSS::resolveNoConversionDataRequired):\n* Source/WebCore/css/values/primitives/CSSPrimitiveNumericUnits.h:\n(WebCore::CSS::toCSSUnitType):\n(WebCore::CSS::toIntegerUnit):\n(WebCore::CSS::toNumberUnit):\n(WebCore::CSS::toPercentageUnit):\n(WebCore::CSS::toAngleUnit):\n(WebCore::CSS::toLengthUnit):\n(WebCore::CSS::toTimeUnit):\n(WebCore::CSS::toFrequencyUnit):\n(WebCore::CSS::toResolutionUnit):\n(WebCore::CSS::toFlexUnit):\n(WebCore::CSS::toAnglePercentageUnit):\n(WebCore::CSS::toLengthPercentageUnit):\n* Source/WebCore/dom/ConstantPropertyMap.cpp:\n(WebCore::variableDataForPositivePixelLength):\n(WebCore::variableDataForPositiveDuration):\n* Source/WebCore/dom/ImageOverlay.cpp:\n(WebCore::ImageOverlay::fitElementToQuad):\n(WebCore::ImageOverlay::updateWithTextRecognitionResult):\n* Source/WebCore/dom/ViewTransition.cpp:\n(WebCore::ViewTransition::copyElementBaseProperties):\n* Source/WebCore/editing/ApplyStyleCommand.cpp:\n(WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):\n* Source/WebCore/editing/FontAttributeChanges.cpp:\n(WebCore::FontChanges::createStyleProperties const):\n* Source/WebCore/editing/mac/EditorMac.mm:\n(WebCore::Editor::platformPasteFont):\n* Source/WebCore/html/FallbackPopupMenu.cpp:\n(WebCore::applyFontCascade):\n(WebCore::FallbackPopupMenu::buildPopupTree):\n* Source/WebCore/html/HTMLAttachmentElement.cpp:\n(WebCore::HTMLAttachmentElement::insertionSteps):\n* Source/WebCore/html/HTMLElement.cpp:\n(WebCore::HTMLElement::applyBorderAttributeToStyle):\n(WebCore::HTMLElement::addHTMLLengthToStyle):\n(WebCore::HTMLElement::addHTMLPixelLengthToStyle):\n* Source/WebCore/html/HTMLEmbedElement.cpp:\n(WebCore::HTMLEmbedElement::collectPresentationalHintsForAttribute):\n* Source/WebCore/html/HTMLHRElement.cpp:\n(WebCore::HTMLHRElement::collectPresentationalHintsForAttribute):\n* Source/WebCore/html/HTMLIFrameElement.cpp:\n(WebCore::HTMLIFrameElement::collectPresentationalHintsForAttribute):\n* Source/WebCore/html/HTMLMarqueeElement.cpp:\n(WebCore::HTMLMarqueeElement::collectPresentationalHintsForAttribute):\n* Source/WebCore/html/HTMLMeterElement.cpp:\n(WebCore::HTMLMeterElement::didChangeElementValue):\n* Source/WebCore/html/HTMLOptGroupElement.cpp:\n(WebCore::HTMLOptGroupElement::didAddUserAgentShadowRoot):\n* Source/WebCore/html/HTMLProgressElement.cpp:\n(WebCore::HTMLProgressElement::didChangeElementValue):\n* Source/WebCore/html/HTMLTableElement.cpp:\n(WebCore::HTMLTableElement::collectPresentationalHintsForAttribute):\n(WebCore::HTMLTableElement::createSharedCellStyle const):\n* Source/WebCore/html/ImageDocument.cpp:\n(WebCore::ImageDocument::createDocumentStructure):\n* Source/WebCore/html/ValidationMessage.cpp:\n(WebCore::ValidationMessage::adjustBubblePosition):\n* Source/WebCore/html/shadow/DateTimeEditElement.cpp:\n(WebCore::DateTimeEditBuilder::visitLiteral):\n* Source/WebCore/html/shadow/MediaControlTextTrackContainerElement.cpp:\n(WebCore::MediaControlTextTrackContainerElement::updateTextStrokeStyle):\n(WebCore::MediaControlTextTrackContainerElement::updateTextTrackStyle):\n* Source/WebCore/html/shadow/SpatialImageControls.cpp:\n(WebCore::SpatialImageControls::ensureSpatialControls):\n* Source/WebCore/html/shadow/TextPlaceholderElement.cpp:\n(WebCore::TextPlaceholderElement::TextPlaceholderElement):\n* Source/WebCore/html/track/VTTCue.cpp:\n(WebCore::VTTCueBox::applyCSSPropertiesWithRegion):\n(WebCore::VTTCueBox::applyCSSProperties):\n* Source/WebCore/html/track/VTTRegion.cpp:\n(WebCore::VTTRegion::displayLastTextTrackCueBox):\n(WebCore::VTTRegion::willRemoveTextTrackCueBox):\n(WebCore::VTTRegion::prepareRegionDisplayTree):\n* Source/WebCore/page/DragController.cpp:\n(WebCore::DragController::startDrag):\n* Source/WebCore/rendering/RenderLayer.cpp:\n(WebCore::RenderLayer::resize):\n* Source/WebCore/style/StyleExtractor.cpp:\n(WebCore::Style::Extractor::getFontSizeCSSValuePreferringKeyword const):\n* Source/WebCore/style/StyleSubstitutionResolver.cpp:\n(WebCore::Style::SubstitutionResolver::substituteAttrFunction):\n* Source/WebCore/style/values/primitives/StyleLengthWrapper+DeprecatedCSSOMValueCreation.h:\n(WebCore::Style::deprecatedConvertLengthWrapperFromCSSValue):\n* Source/WebCore/style/values/primitives/StylePrimitiveNumericOrKeyword+DeprecatedCSSValueConversion.h:\n(WebCore::Style::deprecatedConvertPrimitiveNumericOrKeywordFromCSSValue):\n* Source/WebCore/style/values/primitives/StylePrimitiveNumericTypes+CSSValueConversion.h:\n(WebCore::Style::convertNumericFromCSSValue):\n* Source/WebCore/style/values/primitives/StylePrimitiveNumericTypes+Conversions.h:\n* Source/WebCore/style/values/primitives/StylePrimitiveNumericTypes+DeprecatedCSSValueConversion.h:\n(WebCore::Style::deprecatedConvertNumericFromCSSValue):\n* Source/WebCore/style/values/primitives/StylePrimitiveNumericTypes+DeprecatedConversions.h:\n* Source/WebKit/WebProcess/Plugins/PDF/PDFPluginAnnotation.mm:\n(WebKit::PDFPluginAnnotation::updateGeometry):\n* Source/WebKit/WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.mm:\n(WebKit::PDFPluginChoiceAnnotation::updateGeometry):\n* Source/WebKit/WebProcess/Plugins/PDF/PDFPluginTextAnnotation.mm:\n(WebKit::PDFPluginTextAnnotation::updateGeometry):\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/UnifiedPDFPlugin.mm:\n(WebKit::UnifiedPDFPlugin::sizeToFitContentsIfNeeded):\n\nCanonical link: https://commits.webkit.org/318727@main",
      "email": "ccarley2@apple.com",
      "hash": "50401aa703436ae5da9199772561a19b7d8c82dd",
      "subject": "Fix CSSUnitType enum member names"
    },
    "318729@main": {
      "author": "Carlos Garcia Campos",
      "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64",
      "cl": "318729@main",
      "clUrl": "https://commits.webkit.org/318729@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321181\n\nReviewed by Adrian Perez de Castro.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/318729@main",
      "email": "cgarcia@igalia.com",
      "hash": "516a46e84c032f86fb8d3af80a58457f646c6979",
      "subject": "[WPE] Enable damage propagation by default"
    },
    "318730@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "318730@main",
      "clUrl": "https://commits.webkit.org/318730@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321172\nrdar://184219290\n\nReviewed by Richard Robinson.\n\nCurrently, typing a URL with only the host and not the protocol scheme\nproduces a failed provisional navigation, since WebKit expectedly does\nnot know what to do with a URL request consisting of a URL without a\nprotocol.\n\nIn this patch, we remedy the situation by following precedent set by\nMiniBrowser and (a) tacking on, as needed,  a `http://` to URLs entered\nin the address bar, and (b) passing the URL through -[NSURL\n_webkit_URLWithUserTypedString:].\n\nTo facilitate these changes, we introduce two extensions to String and\nURL, which simply provide convenient wrappers for (a) and (b).\n\n* Tools/SwiftBrowser/Source/Extensions/String+Extras.swift: Added.\n(String.addingProtocolIfNecessary):\n* Tools/SwiftBrowser/Source/Extensions/URL+Extras.swift: Added.\n* Tools/SwiftBrowser/Source/SwiftBrowser.swift:\n(SwiftBrowserApp.body):\n(SwiftBrowserApp.addProtocolIfNecessary(to:)): Deleted.\n* Tools/SwiftBrowser/Source/ViewModel/BrowserViewModel.swift:\n(BrowserViewModel.navigateToSubmittedURL):\n\nCanonical link: https://commits.webkit.org/318730@main",
      "email": "a_protyasha@apple.com",
      "hash": "ac7682f55397b55d5f1bdea768e98ed85fb29a76",
      "subject": "[SwiftBrowser] Typing webkit.org in the URL bar leads to a failed provisional navigation"
    },
    "318731@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "318731@main",
      "clUrl": "https://commits.webkit.org/318731@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321158\nrdar://184195190\n\nReviewed by Abrar Rahman Protyasha.\n\nJust adding some tests.\n\n* Tools/TestWebKitAPI/Helpers/cocoa/WebPage+Extras.swift:\n(mainFrame):\n(pageZoom):\n(pdfHUDs):\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift:\n(AppKitGesturesTests.tripleClickingInPDFSelectsLine(_:)):\n(AppKitGesturesTests.clickingOnPDFHUDButtonPerformsAction(_:)):\n(AppKitGesturesTests.clickingOnPDFShowsHUD(_:)):\n(AppKitGesturesTests.tripleClickingInPDFSelectsLine): Deleted.\n\nCanonical link: https://commits.webkit.org/318731@main",
      "email": "richard_robinson2@apple.com",
      "hash": "968a3d30b9eb13dccbbf4b52ad217e00095891db",
      "subject": "[AppKit Gestures] Add a few more API tests to test clicking the PDF HUD"
    },
    "318732@main": {
      "author": "Charlie Wolfe",
      "avatar": "https://www.gravatar.com/avatar/857b3b5ff3394c31fa2689310a93dbab?d=identicon\u0026s=64",
      "cl": "318732@main",
      "clUrl": "https://commits.webkit.org/318732@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320692\nrdar://183674995\n\nReviewed by Pascoe.\n\n* LayoutTests/ipc/loadping-firstpartyforcookies-message-check.html:\n\nCanonical link: https://commits.webkit.org/318732@main",
      "email": "charliew@apple.com",
      "hash": "a955638d79a0aa73d9287fe7ae529e1c999fc2ad",
      "subject": "[macOS iOS DEBUG]REGRESSION(317335@main): ipc/loadping-firstpartyforcookies-message-check.html (layout-tests) is a constant text failure."
    },
    "318733@main": {
      "author": "Jetzel Espinal",
      "avatar": "https://www.gravatar.com/avatar/2edd78d5d9f2f2e2e695465277634921?d=identicon\u0026s=64",
      "cl": "318733@main",
      "clUrl": "https://commits.webkit.org/318733@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320669\nrdar://183648008\n\nReviewed by Ryan Haddad.\n\nAdding myself as a committer.\n\n* metadata/contributors.json:\n\nCanonical link: https://commits.webkit.org/318733@main",
      "email": "jespinal23@apple.com",
      "hash": "87ac7bf7338ab739008d48cd592dc9319f49d78b",
      "subject": "Add committer status to Jetzel Espinal."
    },
    "318734@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "318734@main",
      "clUrl": "https://commits.webkit.org/318734@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321180\n\nReviewed by Antti Koivisto.\n\ntextRendererIsNeeded() drops collapsible white space that would be leading white space on a line, since it\ncollapses away to nothing. In\n\n    \u003cdiv\u003etext\u003cdiv\u003eblock\u003c/div\u003e\u003cdiv style=\"position: absolute\"\u003e\u003c/div\u003e \u003c/div\u003e\n\nthe trailing white space is not the first inline content in the container - 'text' is - but it is the first\ninline content after an in-flow block level box, which ended the line, so it is still trimmable.\n\n(Previously the 'text' was wrapped inside an anon block which make this lambda bail out sooner)\n\n* Source/WebCore/rendering/updating/RenderTreeUpdater.cpp:\n(WebCore::RenderTreeUpdater::textRendererIsNeeded):\n* LayoutTests/fast/text/whitespace/white-space-after-out-of-flow-or-float.html: Added.\n* LayoutTests/fast/text/whitespace/white-space-after-out-of-flow-or-float-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/318734@main",
      "email": "zalan@apple.com",
      "hash": "0e75fb8ad4c76c411646a05a2e4f89a88076474a",
      "subject": "[anon-block-removal] White space after an out-of-flow or floated box gets a stray renderer"
    },
    "318736@main": {
      "author": "Jessica Lee",
      "avatar": "https://www.gravatar.com/avatar/fc717c99321d09f31fb9187418a8ffc5?d=identicon\u0026s=64",
      "cl": "318736@main",
      "clUrl": "https://commits.webkit.org/318736@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321075\nrdar://184112467\n\nReviewed by Sihui Liu.\n\nTests are equivalent to several tests in\nLayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element\nbut iframes are now cross-site\n\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/cross-site/iframe-loading-lazy-cross-site.sub-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/cross-site/iframe-loading-lazy-cross-site.sub.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/cross-site/iframe-loading-lazy-in-scroller-cross-site.sub-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/cross-site/iframe-loading-lazy-in-scroller-cross-site.sub.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/cross-site/iframe-loading-lazy-in-scroller-far-cross-site.sub-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/cross-site/iframe-loading-lazy-in-scroller-far-cross-site.sub.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/cross-site/resources/subframe-post-msg.html: Added.\n\nCanonical link: https://commits.webkit.org/318736@main",
      "email": "jlee53@apple.com",
      "hash": "8a05d0964f4854d42b8ee3e0125de51c8bddd54f",
      "subject": "Add miscellaneous tests for lazy-loading cross-site frames"
    },
    "318737@main": {
      "author": "Yury Semikhatsky",
      "avatar": "https://www.gravatar.com/avatar/d0aee26d9689e84bd1a7f0ed8f262fe1?d=identicon\u0026s=64",
      "cl": "318737@main",
      "clUrl": "https://commits.webkit.org/318737@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321192\n\nReviewed by Devin Rousso.\n\nCommit 74bc5de83633 added pbxproj entries for InspectorStorageAgent and\nInspectorCookieStoreHelpers with hand-written 10-character object\nidentifiers AA10570001-AA10570006. sort-Xcode-project-file parses entry\nnames with regexes that require exactly 24 uppercase hex characters, so\nthese entries produce \"Use of uninitialized value\" warnings on every\ncommit that stages this project file via the pre-commit hook, and the\nsorter places them at arbitrary positions instead of alphabetical order.\n\nRename the identifiers to 24-character ones padded with zeros, matching\nthe style of existing hand-written IDs (e.g. E0E1E2E3E4E5E6E700000001),\n\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/318737@main",
      "email": "yurys@chromium.org",
      "hash": "54f47259ff2f7f1548edb30c3ce959391f589eaa",
      "subject": "sort-Xcode-project-file emits \"uninitialized value\" warnings: WebKit.xcodeproj contains object IDs shorter than 24 characters"
    },
    "318738@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "318738@main",
      "clUrl": "https://commits.webkit.org/318738@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321187\nrdar://184246441\n\nReviewed by Dan Hecht.\n\nWe found that AirReportUsedRegisters phase is taking very long time\nbecause of padInterference, RegLiveness, and entire graph scanning.\nBut this is necessary only for FTL since we do not need to report used\nregisters in Wasm OMG. But disabling this caused large performance\nregression in JetStream3/richards-wasm because we didn't remove `Nop`\n(this phase is also removing Nops) and causing large performance\nregression because of emitted `nop` instructions.\n\nBut most of Nops are inserted just for Padding in the instruction stream\nfor liveness analysis and we do not want to actually emit `nop` instructions\nexcept for a few cases. Thus we introduce Padding AirOpcode, which looks\nlike a Nop, but emits nothing at code generator phase, so purely for padding.\n\nAnd then we disable reportUsedRegisters for Wasm OMG. We may still want\nto have Padding removal scanning (since it encourages simplifyCFG etc., but\nso far, we don't see performance improvements from that.\n\n* Source/JavaScriptCore/b3/air/AirAllocateRegistersByGreedy.cpp:\n(JSC::B3::Air::Greedy::GreedyAllocator::emitSpillCodeAndEnqueueNewTmps):\n* Source/JavaScriptCore/b3/air/AirGenerate.cpp:\n(JSC::B3::Air::prepareForGeneration):\n* Source/JavaScriptCore/b3/air/AirInst.h:\n* Source/JavaScriptCore/b3/air/AirKind.h:\n* Source/JavaScriptCore/b3/air/AirOpcode.opcodes:\n* Source/JavaScriptCore/b3/air/AirPadInterference.cpp:\n(JSC::B3::Air::padInterference):\n* Source/JavaScriptCore/b3/air/AirReportUsedRegisters.cpp:\n(JSC::B3::Air::reportUsedRegisters):\n* Source/JavaScriptCore/b3/air/opcode_generator.rb:\n* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:\n(JSC::Wasm::parseAndCompileOMG):\n\nCanonical link: https://commits.webkit.org/318738@main",
      "email": "ysuzuki@apple.com",
      "hash": "74091f918bfc6bda006375c335998783b9841418",
      "subject": "[JSC] Add \"Padding\" Air opcode"
    },
    "318739@main": {
      "author": "Marta Darbinyan",
      "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64",
      "cl": "318739@main",
      "clUrl": "https://commits.webkit.org/318739@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321191\nrdar://184253301\n\nUnreviewed test gardening\n\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318739@main",
      "email": "darbinyan@apple.com",
      "hash": "e15bdc5414be6a4b19e90e71970a52ddb407adb2",
      "subject": "[Gardening]: REGRESSION(317964@main): [macOS iOS] ASSERTION FAILED: bytesSent \u003e= m_pendingStreamBytesSentByNetwork in imported/w3c/web-platform-tests/service-workers/service-worker/fetch-event.https.h2.html"
    },
    "318740@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "318740@main",
      "clUrl": "https://commits.webkit.org/318740@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321196\nrdar://184256037\n\nReviewed by Wenson Hsieh and Abrar Rahman Protyasha.\n\nImplement `show` for the alternate PDF HUD view.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift\n\n* Source/WebKit/UIProcess/PDF/WKAlternatePDFHUDView+Testing.swift:\n(WKAlternatePDFHUDView.hideForTesting):\n* Source/WebKit/UIProcess/PDF/WKAlternatePDFHUDView.swift:\n(PDFHUDControlsModel.resetSeed):\n(PDFHUDControlsModel.isVisible):\n(PDFHUDControlsModel.show):\n(PDFHUDControls.body):\n(WKAlternatePDFHUDView.show):\n(PDFHUDControls.isVisible): Deleted.\n\nExtract the state into an observable model so that the state can be affected by the outside.\n\n* Source/WebKit/UIProcess/mac/WKAppKitGestureController.mm:\n(-[WKAppKitGestureController singleClickGestureRecognized:]):\n\nSkip this workaround when using the alternate PDF HUD; it wouldn't do anything anyways, and it\nseems to work fine as-is.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift:\n\nCanonical link: https://commits.webkit.org/318740@main",
      "email": "richard_robinson2@apple.com",
      "hash": "ebe9a17c92fb3e6430085cf3ce6b6fa5b5d8d508",
      "subject": "[AppKit Gestures] Clicking on PDF does not show HUD when using the alternate PDF HUD"
    },
    "318741@main": {
      "author": "Yijia Huang",
      "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64",
      "cl": "318741@main",
      "clUrl": "https://commits.webkit.org/318741@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321136\nrdar://184169471\n\nReviewed by Yusuke Suzuki.\n\nIntroduce ISO8601::TimeZoneIdentifierParseRecord, the spec's Time Zone\nIdentifier Parse Record { [[Name]], [[OffsetMinutes]] }, and return it from\nparseTimeZoneIdentifier and parseTemporalTimeZoneString. Both previously\nreturned a resolved TimeZone, which fused ParseTimeZoneIdentifier step 3's\nsyntactic check with the caller's availability check.\n\nParseTemporalTimeZoneString step 3 accepts the bracket annotation on six\nproductions; only TemporalDateTimeString[+Zoned] and TemporalInstantString\nwere tried, so \"2024-12[Europe/Berlin]\", \"--12-25[Europe/Berlin]\" and\n\"12:00[Europe/Berlin]\" were rejected. Widening that list is also what makes\nstep 2's split load-bearing: \"T12+01\" is simultaneously a TimeZoneIANAName\nand a TemporalTimeString with a UTCOffset, so once TemporalTimeString is in\nthe list, step 2 must commit to the named-zone reading on syntax alone and\nreject it as unavailable, rather than resolving eagerly and letting step 3\nyield \"+01:00\".\n\nFollow ISO8601.cpp's scanning idiom for the time zone productions: each parser\ntakes a StringParsingBuffer, consumes only on success, and returns the matched\ntext, leaving StringView at the entrypoints. parseTimeZoneIANAName replaces the\nisTimeZoneIANAName predicate, so the annotation parser no longer pre-scans for\n']' to find the token boundary; ']' is not a TZChar, so the name parse now\nfinds its own end. parseTimeZoneAnnotation delegates to\nparseTimeZoneIdentifier rather than re-implementing its two alternatives, and\nthe file reads in grammar order: TZLeadingChar/TZChar, TimeZoneIANAName,\nTimeZoneIdentifier, TimeZoneAnnotation. The parsed annotation name stays an\nowned Vector\u003cLatin1Character\u003e so a returned record never outlives a view of the\nstring it was parsed from.\n\nRestructure GetTemporalRelativeToOption to match the AO's control flow. Its\nsteps 5 and 6 do not return, they assign and fall through to a shared tail in\nsteps 7-12, which had been inlined into both branches with silently differing\narguments. The branches now only assign, and the tail runs once.\n\nReplace InterpretISODateTimeOffset's offsetHasSubMinutePrecision and\nuseStartOfDay bool parameters with MatchBehaviour and UseStartOfDay enums, and\nextract timeZoneFromIdentifierParseRecord for the tail shared by\nToTemporalTimeZoneIdentifier steps 4-9 and the Temporal.ZonedDateTime\nconstructor steps 6-7.\n\nThe annotations \"[..]\", \"[.]\", \"[./.]\", \"[../..]\" and\n\"[CocoaCappuccinoMatcha]\" move from the rejected set to the accepted one:\nproposal-temporal a8f6b0d3 (\"Editorial: Align time zone name syntax with\nIXDTF\") removed TimeZoneIANANameComponent's 14-character limit and its\nexclusion of \".\" and \"..\".\n\nTest:\n* Source/JavaScriptCore/API/tests/TemporalCoreTest.cpp:\n* JSTests/stress/temporal-plaindate.js:\n* JSTests/stress/temporal-plaindatetime.js:\n* JSTests/stress/temporal-plaintime.js:\n* JSTests/stress/temporal-timezone.js:\n\nCanonical link: https://commits.webkit.org/318741@main",
      "email": "yijia_huang@apple.com",
      "hash": "22a13eb9ee2fc782b1836cc15a906cabf3943ed6",
      "subject": "[JSC][Temporal] Align time zone identifier parsing with the spec's parse records"
    },
    "318742@main": {
      "author": "Brady Eidson",
      "avatar": "https://www.gravatar.com/avatar/31bed81d6d8ef517f93b30add03f5651?d=identicon\u0026s=64",
      "cl": "318742@main",
      "clUrl": "https://commits.webkit.org/318742@main",
      "description": "rdar://184091553\nhttps://bugs.webkit.org/show_bug.cgi?id=321060\n\nReviewed by Matthew Finkel.\n\nWebKit API clients can apply various website policies on a per navigation basis.\nThese policies are meant to apply to all documents hosted by the navigated-to page,\nincluding cross-origin iframes.\n\nUnder site isolation, some of these policies were not migrated to the new process\nhosting the cross-origin iframe, therefore breaking the intended contract.\n\nThis patch makes sure all of these policies apply to the cross-origin iframe even\nin its new process and also tests that they are applied correctly.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Scripts/SettingsTemplates/Settings.cpp.erb:\n* Source/WebCore/Scripts/SettingsTemplates/Settings.h.erb:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::advancedPrivacyProtections const):\n* Source/WebCore/loader/DocumentLoader.cpp:\n(WebCore::DocumentLoader::applyPoliciesToSettings):\n* Source/WebCore/loader/DocumentLoader.h:\n* Source/WebCore/loader/WebsitePolicies.h: Added.\n* Source/WebCore/page/Frame.h:\n* Source/WebCore/page/LocalFrame.cpp:\n(WebCore::LocalFrame::colorSchemePreference const):\n* Source/WebCore/page/LocalFrame.h:\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::useDarkAppearance const):\n* Source/WebCore/page/RemoteFrame.cpp:\n(WebCore::m_colorSchemePreference):\n(WebCore::RemoteFrame::colorSchemePreference const):\n(WebCore::m_autoplayPolicy): Deleted.\n* Source/WebCore/page/RemoteFrame.h:\n* Source/WebKit/Shared/WebsitePoliciesData.cpp:\n(WebKit::core):\n(WebKit::WebsitePoliciesData::applyToSettings):\n(WebKit::WebsitePoliciesData::applyToDocumentLoader):\n* Source/WebKit/Shared/WebsitePoliciesData.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::receivedNavigationActionPolicyDecision):\n* Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp:\n(WebKit::addParametersShared):\n* Source/WebKit/WebProcess/WebCoreSupport/WebRemoteFrameClient.cpp:\n(WebKit::WebRemoteFrameClient::applyWebsitePolicies):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, LockdownModeInheritedByCrossSiteIframeProcess)):\n(TestWebKitAPI::(SiteIsolation, EnhancedSecurityInheritedByCrossSiteIframeProcess)):\n(TestWebKitAPI::(SiteIsolation, LockdownModeSettingsInheritedByCrossSiteIframe)):\n(TestWebKitAPI::(SiteIsolation, GlobalPrivacyControlInheritedByCrossSiteIframe)):\n(TestWebKitAPI::(SiteIsolation, AdvancedPrivacyProtectionsInheritedByCrossSiteIframeDocument)):\n(TestWebKitAPI::(SiteIsolation, PushAndNotificationAPIPolicyInheritedByCrossSiteIframe)):\n(TestWebKitAPI::(SiteIsolation, ColorSchemePreferenceInheritedByCrossSiteIframe)):\n\nCanonical link: https://commits.webkit.org/318742@main",
      "email": "beidson@apple.com",
      "hash": "11a216a7fd0399dd9d93fca02a356f354ccabc2e",
      "subject": "[Site Isolation] Some website policies applied to main frame navigations don't apply to cross site iframes"
    },
    "318743@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "318743@main",
      "clUrl": "https://commits.webkit.org/318743@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317103\n\nReviewed by Yusuke Suzuki.\n\nSorting an array of strings without a comparator is common, e.g. `Object.keys(obj).sort()`.\nThe current implementation partitions entries into a StdMap\u003cchar16_t, Vector\u003e per character,\nwhich allocates map nodes and grows bucket vectors at every depth.\n\nThis patch replaces it with an in-place counting sort over the UTF-16 byte stream, allocating\nonly a single scratch buffer for the whole sort. Buckets below radixSortThreshold are finished\nwith std::ranges::sort, breaking ties on equal strings by their original index, so the result\nstays stable [1] without stable_sort's temporary buffer.\n\n[1]: https://tc39.es/ecma262/#sec-array.prototype.sort\n\n                                                   baseline                    pr1\n\nsort-custom-comparator                        118.8305+-0.4189     ^     91.7292+-2.2847        ^ definitely 1.2954x faster\narray-prototype-sort-large-array               30.0766+-0.5206     ^      7.7445+-0.1864        ^ definitely 3.8836x faster\narray-prototype-sort-string-keys               58.1619+-0.8397     ^     29.2567+-0.2513        ^ definitely 1.9880x faster\narray-prototype-sort-small-array-comparator\n                                                9.8417+-0.2049            9.7472+-0.2406\narray-prototype-sort-large-array-comparator\n                                                5.5050+-0.1057     ?      5.6815+-0.3862        ? might be 1.0321x slower\narray-prototype-sort-large-array-comparator-double\n                                                9.3065+-0.1118            9.0973+-0.2528          might be 1.0230x faster\narray-prototype-sort-medium-array-comparator\n                                               30.2638+-0.2000     ?     30.3275+-0.5047        ?\narray-prototype-sort-medium-array              45.2888+-0.4573     ^     30.9154+-0.4568        ^ definitely 1.4649x faster\narray-prototype-sort-small-array               15.3942+-0.3811     ^     12.7713+-0.2441        ^ definitely 1.2054x faster\n\nTests: JSTests/microbenchmarks/array-prototype-sort-string-keys.js\n       JSTests/stress/array-default-sort-radix-edge-cases.js\n\n* JSTests/microbenchmarks/array-prototype-sort-string-keys.js: Added.\n* JSTests/stress/array-default-sort-radix-edge-cases.js: Added.\n(ser):\n(refCmp):\n(rnd):\n(trial.i.else):\n(o.toString):\n(checkStability):\n* Source/JavaScriptCore/runtime/ArrayPrototype.cpp:\n(JSC::sortBucketSort):\n(JSC::sortImpl):\n\nCanonical link: https://commits.webkit.org/318743@main",
      "email": "sosuke@bun.sh",
      "hash": "6380373fc6a1a7651f2c4ce9159ee05093810394",
      "subject": "[JSC] Use counting sort for `Array#sort`"
    }
  },
  "date": "2026-08-06",
  "days": 1,
  "generatedAt": "2026-08-06T22:06:03Z",
  "markdown": "## Highlights\n- **V8** JavaScriptCore makes default `Array#sort` stable and switches to counting sort, improving correctness and likely speeding common integer-heavy cases. [commit 318682@main](https://commits.webkit.org/318682@main) [commit 318743@main](https://commits.webkit.org/318743@main)\n- **Security** Site Isolation closes a policy gap where protections applied to main-frame navigations did not consistently apply to cross-site iframes. [commit 318742@main](https://commits.webkit.org/318742@main)\n- **Rendering** A large cluster of inline/block layout fixes lands, addressing stray renderers, wrong baselines, bad float intrusion, extra lines, and editable-line loss across tricky formatting cases. [commit 318734@main](https://commits.webkit.org/318734@main) [commit 318718@main](https://commits.webkit.org/318718@main) [commit 318704@main](https://commits.webkit.org/318704@main) [commit 318702@main](https://commits.webkit.org/318702@main) [commit 318678@main](https://commits.webkit.org/318678@main) [commit 318671@main](https://commits.webkit.org/318671@main)\n- **Web Platform** CSS font metric override descriptors are now enabled by default and wired into actual font metrics, bringing `@font-face` behavior closer to spec. [commit 318699@main](https://commits.webkit.org/318699@main) [commit 318680@main](https://commits.webkit.org/318680@main)\n- **UI** Cross-site iframe text editing on iOS gets materially better with fixes for caret movement and caret positioning inside isolated frames. [commit 318717@main](https://commits.webkit.org/318717@main) [commit 318716@main](https://commits.webkit.org/318716@main)\n- **Media** WebKit adds experimental spatial/projected video rendering in macOS and iOS media controls, a notable step toward richer immersive playback UI. [commit 318691@main](https://commits.webkit.org/318691@main)\n- **DevTools** Web Inspector gains Canvas support for highlighting WebGPU render pipelines, making GPU debugging less opaque. [commit 318668@main](https://commits.webkit.org/318668@main)\n- **Web Platform** DOM and HTML behavior keep moving toward spec with source/img moving steps, hidden color input activation through labels, iframe resize-on-show, and `requestPictureInPicture()` correctly consuming activation. [commit 318725@main](https://commits.webkit.org/318725@main) [commit 318723@main](https://commits.webkit.org/318723@main) [commit 318713@main](https://commits.webkit.org/318713@main) [commit 318673@main](https://commits.webkit.org/318673@main)\n- **Media** Audio and realtime media fixes address a use-after-unregister risk in WebRTC audio transport plus correctness bugs in MediaStream and AudioWorklet error reporting. [commit 318712@main](https://commits.webkit.org/318712@main) [commit 318706@main](https://commits.webkit.org/318706@main) [commit 318705@main](https://commits.webkit.org/318705@main)\n\n## What landed by area\n\n### JavaScriptCore and language runtime\n- **V8** Temporal time zone identifier parsing now follows the spec's parse-record model more closely. [commit 318741@main](https://commits.webkit.org/318741@main)\n- **V8** JSC adds a new \"Padding\" Air opcode, likely groundwork for lower-level codegen and layout control in the backend. [commit 318738@main](https://commits.webkit.org/318738@main)\n- **V8** JSC removes many 32-bit-only concepts from the JIT, continuing cleanup of old backend assumptions. [commit 318721@main](https://commits.webkit.org/318721@main)\n- **V8** `JSON.stringify` fast paths now accept final objects whose prototype is not exactly `Object`, fixing an unnecessary bailout. [commit 318697@main](https://commits.webkit.org/318697@main)\n- **V8** SharedWorkerGlobalScope now has the right immutable prototype exotic object behavior. [commit 318684@main](https://commits.webkit.org/318684@main)\n- **V8** JIT Cage Relaxation lands, a significant runtime-engineering change in JSC's execution model. [commit 318675@main](https://commits.webkit.org/318675@main)\n\n### Rendering and CSS layout\n- **Rendering** `object-view-box` rendering is implemented for video elements. [commit 318714@main](https://commits.webkit.org/318714@main)\n- **Rendering** Nested `@scope` with `:has(:scope ...)` no longer selects scoping roots outside the outer scope. [commit 318711@main](https://commits.webkit.org/318711@main)\n- **Rendering** Computed `line-height` modeling is brought closer to how the property is actually specified. [commit 318710@main](https://commits.webkit.org/318710@main)\n- **Rendering** `margin-trim` now applies to grid layout. [commit 318690@main](https://commits.webkit.org/318690@main)\n- **Rendering** Multicolumn layout now respects `min-height` even when it exceeds `max-height`. [commit 318676@main](https://commits.webkit.org/318676@main)\n- **Rendering** Dynamic `x` and `y` updates on `SVGForeignObjectElement` take effect again after a regression fix. [commit 318669@main](https://commits.webkit.org/318669@main)\n- **Refactor** `Style::resolveLength` implementations are unified. [commit 318715@main](https://commits.webkit.org/318715@main)\n- **Refactor** `CSSValue::ValueSeparator` is converted to an `enum class`, tightening type safety. [commit 318666@main](https://commits.webkit.org/318666@main)\n- **Web Platform** CSS typed OM enum member names for `CSSUnitType` are corrected. [commit 318727@main](https://commits.webkit.org/318727@main)\n- **Rendering** Web Platform Test coverage expands for orthogonal atomic inline children inside shrink-to-fit boxes. [commit 318689@main](https://commits.webkit.org/318689@main)\n- **Rendering** The CSS2 tables test corpus is resynced from upstream WPT. [commit 318674@main](https://commits.webkit.org/318674@main)\n\n### DOM, HTML, frames, and editing\n- **Web Platform** `source` and `img` elements now implement the spec's moving steps. [commit 318725@main](https://commits.webkit.org/318725@main)\n- **DevTools** `moveBefore()` now updates Web Inspector correctly. [commit 318724@main](https://commits.webkit.org/318724@main)\n- **UI** A `label` can now open a `display:none` color input, matching expected activation behavior. [commit 318723@main](https://commits.webkit.org/318723@main)\n- **Web Platform** Iframes now fire `resize` when their viewport transitions from `display:none` to visible. [commit 318713@main](https://commits.webkit.org/318713@main)\n- **Rendering** ImageOverlay text style is now set by the style adjuster and is no longer editable. [commit 318677@main](https://commits.webkit.org/318677@main)\n- **Web Platform** Additional tests land for lazy-loading cross-site frames. [commit 318736@main](https://commits.webkit.org/318736@main)\n\n### Media, WebRTC, Web Audio, and video\n- **Media** WebRTC audio transport can no longer be used after unregister and destruction. [commit 318712@main](https://commits.webkit.org/318712@main)\n- **Media** `MediaStreamAudioSourceNode` now captures the right track and stops playing when that track ends. [commit 318706@main](https://commits.webkit.org/318706@main)\n- **Media** `AudioWorkletNode` `processorerror` now reports filename, line number, and column number. [commit 318705@main](https://commits.webkit.org/318705@main)\n- **Perf** Web Audio trims padding in several core structs, reducing memory footprint. [commit 318685@main](https://commits.webkit.org/318685@main)\n- **Media** MSE on GStreamer gets fixes for regressions seen in the YouTube MSE Conformance Tests 2019. [commit 317765@main](https://commits.webkit.org/317765@main)\n- **Media** Picture-in-Picture now correctly consumes user activation on `requestPictureInPicture()`. [commit 318673@main](https://commits.webkit.org/318673@main)\n\n### Site Isolation, security, and networking behavior\n- **UI** Site Isolation on iOS fixes text-field caret movement from within cross-site iframes. [commit 318717@main](https://commits.webkit.org/318717@main)\n- **UI** Site Isolation on iOS fixes caret rendering at the wrong location inside cross-site iframes. [commit 318716@main](https://commits.webkit.org/318716@main)\n- **Networking** A macOS cookie-version assertion in `NetworkStorageSession` is fixed. [commit 318686@main](https://commits.webkit.org/318686@main)\n- **Networking** A debug text failure around `loadPing` first-party-for-cookies messaging is fixed after regression [bug 320692](https://bugs.webkit.org/show_bug.cgi?id=320692). [commit 318732@main](https://commits.webkit.org/318732@main)\n- **Security** Service worker fetch-event accounting is fixed after a bytes-sent assertion regression. [commit 318739@main](https://commits.webkit.org/318739@main)\n\n### Accessibility and input\n- **A11y** VoiceOver cursor tracking is brought back in sync with Mail content, unblocking Intelligent Image Descriptions. [commit 318679@main](https://commits.webkit.org/318679@main)\n- **A11y** A crash in `AccessibilityMenuListPopup::menuListOptionAccessibilityObject` is fixed. [commit 318692@main](https://commits.webkit.org/318692@main)\n- **A11y** WPE accessibility crash regressions are fixed. [commit 318700@main](https://commits.webkit.org/318700@main)\n- **A11y** Custom Highlight testing improves with `highlightsFromPoint.html` no longer marked as failing. [commit 318707@main](https://commits.webkit.org/318707@main)\n- **Mobile** Wayland input purpose handling now includes `WEBKIT_INPUT_PURPOSE_SEARCH`. [commit 318695@main](https://commits.webkit.org/318695@main)\n\n### Platform UI and app-facing APIs\n- **UI** AppKit gesture handling now shows the PDF HUD correctly when using the alternate PDF HUD path. [commit 318740@main](https://commits.webkit.org/318740@main)\n- **UI** More API tests land for PDF HUD click behavior. [commit 318731@main](https://commits.webkit.org/318731@main)\n- **UI** `ViewGestureController` magnification handling no longer needs to be fed an `NSEvent` instance. [commit 318693@main](https://commits.webkit.org/318693@main)\n- **Mobile** SwiftBrowser fixes a failed provisional navigation when typing `webkit.org` into the URL bar. [commit 318730@main](https://commits.webkit.org/318730@main)\n- **UI** SwiftUI WebKit API gains attachment lifecycle callbacks on `WebPage` via `WKUIDelegatePrivate`. [commit 318672@main](https://commits.webkit.org/318672@main)\n- **Refactor** `WKAppKitGestureController.mm` gets a small simplification cleanup. [commit 318688@main](https://commits.webkit.org/318688@main)\n\n### GPU, graphics, and WebGPU/XR\n- **GPU** OpenXR swapchains avoid creating multisampled images when they do not help. [commit 318722@main](https://commits.webkit.org/318722@main)\n- **DevTools** Canvas inspection can now highlight WebGPU render pipelines. [commit 318668@main](https://commits.webkit.org/318668@main)\n- **Refactor** An unused WebGPU backing-context include is removed from `WebGPUImpl`. [commit 318667@main](https://commits.webkit.org/318667@main)\n\n### Linux, GTK, WPE, and build system\n- **Perf** WPE enables damage propagation by default, a meaningful rendering-path win for embedded compositing. [commit 318729@main](https://commits.webkit.org/318729@main)\n- **Build** GCC 15 uninitialized-read fallout in `RefCountedWithInlineWeakPtr` is fixed for GTK and WPE. [commit 318698@main](https://commits.webkit.org/318698@main)\n- **Build** A WPE and GTK build regression on GCC versions older than 15 is fixed. [commit 318687@main](https://commits.webkit.org/318687@main)\n- **Build** Linux removes RT threads. [commit 318709@main](https://commits.webkit.org/318709@main)\n- **Build** The macOS CMake build is fixed after adding `SpatialShim.swift`. [commit 318670@main](https://commits.webkit.org/318670@main)\n- **Build** A post-318648 build fix restores `!ENABLE(MATHML)` configurations. [commit 318681@main](https://commits.webkit.org/318681@main)\n- **Build** `sort-Xcode-project-file` is fixed to handle shorter object IDs without uninitialized-value warnings. [commit 318737@main](https://commits.webkit.org/318737@main)\n- **A11y** WPE accessibility crash fallout gets another fixup pass. [commit 318696@main](https://commits.webkit.org/318696@main)\n- **DevTools** WebDriver gardening lands for WPE in week 32 2026. [commit 318683@main](https://commits.webkit.org/318683@main)\n- **Build** A rare flaky WPE GTK WebRTC crash test is stabilized. [commit 318701@main](https://commits.webkit.org/318701@main)\n\n### Tests and gardening\n- **Web Platform** Popover WPT expectations are updated to match current content. [commit 318694@main](https://commits.webkit.org/318694@main)\n- **Build** A flaky wasm WPT timeout is gardened on macOS debug. [commit 318726@main](https://commits.webkit.org/318726@main)\n- **Build** A container-queries WPT regression is fixed after constant failures. [commit 318703@main](https://commits.webkit.org/318703@main)\n\n## Reverts \u0026 Reapplies\n\nNo reverts, reapplies, or backed out changes in the listed feature commits.",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [
    {
      "name": "Unreviewed",
      "count": 3
    }
  ],
  "since": "2026-08-06",
  "totals": {
    "commits": 78,
    "features": 75,
    "rolls": 3
  },
  "until": "2026-08-06"
}