{ "commits": { "318744@main": { "author": "Karl Dubost", "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64", "cl": "318744@main", "clUrl": "https://commits.webkit.org/318744@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320456\nrdar://183425103\n\nReviewed by Nikolas Zimmermann.\n\n \u003cg display=\"none\"\u003e\u003crect id=\"r\" width=\"10\" height=\"10\"/\u003e\u003c/g\u003e\n r.getBoundingClientRect().width // 10, should be 0\n r.getClientRects().length // 1, should be 0\n\nNothing paints there, and the same happens in `\u003cdefs\u003e`, `\u003cmask\u003e`, `\u003cpattern\u003e`,\n`\u003cmarker\u003e`, gradients and `\u003csymbol\u003e`. Those containers keep renderers for their\ndescendants so that resources stay referenceable, and `display` does not\ninherit, so the `\u003crect\u003e` is laid out with a real bounding box.\n\nThe SVG branch of `Element::getClientRects` asks that renderer for its\n`objectBoundingBox()` directly, so CSSOM View step 1[1]\n\n return an empty list when the element has no associated box\n\nis never evaluated for SVG.\n\nFix by adding `isInNonRenderedSVGSubtree` and returning early from\n\n* `getClientRects`,\n* `boundingAbsoluteRectWithoutLayout`\n* and `boundsInRootViewSpace`.\n\nIt has to run before the branch on renderer type, which is why `\u003ctext\u003e`\nwas wrong too (it is a `RenderBlockFlow` and reports through a\ndifferent path than shapes).\n\nThe ancestor walk stops at the SVG root. `SVGForeignObjectElement`\nsuppresses the renderer for a `\u003cforeignObject\u003e` under a hidden container,\nso nothing below a root can have one above it. `\u003cforeignObject\u003e` was the\none element getting this right.\n\nA `ResizeObserver` on the same element still reports 10x10, so it now\nanswers 0x0 to `getBoundingClientRect` and 10x10 to `ResizeObserver`.\nChrome does the same, so `ResizeObservation::computeObservedSizes` is\nleft alone.\n\n[1] https://drafts.csswg.org/cssom-view-1/#dom-element-getclientrects\n\nTest: imported/w3c/web-platform-tests/svg/geometry/svg-geometry-apis-in-non-rendered-elements.html\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/svg-geometry-apis-in-non-rendered-elements-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/svg-geometry-apis-in-non-rendered-elements.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/svg-get-bounding-client-rect-in-non-rendered-elements-expected.txt:\n* Source/WebCore/dom/Element.cpp:\n(WebCore::isInNonRenderedSVGSubtree):\n(WebCore::Element::boundsInRootViewSpace):\n(WebCore::Element::getClientRects):\n(WebCore::Element::boundingAbsoluteRectWithoutLayout const):\n* Source/WebCore/rendering/RenderObject.h:\n(WebCore::RenderObject::isRenderOrLegacyRenderSVGHiddenContainer const):\n\nCanonical link: https://commits.webkit.org/318744@main", "email": "karlcow@apple.com", "hash": "6412a2d665afff31ee9fba2b6f233736798db288", "subject": "getBoundingClientRect() returns a non-zero rect for SVG elements inside hidden containers" }, "318745@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "318745@main", "clUrl": "https://commits.webkit.org/318745@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321161\n\nReviewed by Yusuke Suzuki.\n\n291345@main added tryTrimSpaces() to replaceUsingRegExpSearch() so that\n`str.replace(/^\\s+/, \"\")` and `str.replace(/\\s+$/, \"\")` avoid running the RegExp.\n293816@main then made operationStringProtoFuncReplaceRegExpEmptyStr, which DFG/FTL\nuse for a constant empty replacement, call replaceOneWithStringUsingRegExpSearch()\ndirectly, so the fast path has only been reachable from LLInt/Baseline since.\n\nThis patch moves the tryTrimSpaces() call into replaceOneWithStringUsingRegExpSearch(),\nwhich both the runtime and the DFG operation go through, and removes the now-redundant\nswitch from replaceUsingRegExpSearch().\n\n Baseline Patched\n\nstring-replace-regexp-trim-end 75.2372+-0.4670 ^ 14.5417+-0.2654 ^ definitely 5.1739x faster\nstring-replace-regexp-trim-start 61.0601+-0.8583 ^ 13.5378+-0.3125 ^ definitely 4.5103x faster\n\nTests: JSTests/microbenchmarks/string-replace-regexp-trim-end.js\n JSTests/microbenchmarks/string-replace-regexp-trim-start.js\n JSTests/stress/trim-regexp-dfg.js\n\n* JSTests/microbenchmarks/string-replace-regexp-trim-end.js: Added.\n(test):\n* JSTests/microbenchmarks/string-replace-regexp-trim-start.js: Added.\n(test):\n* JSTests/stress/trim-regexp-dfg.js: Added.\n(shouldBe):\n(testStart):\n(testEnd):\n(testOther):\n* Source/JavaScriptCore/runtime/StringPrototype.cpp:\n(JSC::replaceUsingRegExpSearch):\n* Source/JavaScriptCore/runtime/StringPrototypeInlines.h:\n(JSC::replaceOneWithStringUsingRegExpSearch):\n\nCanonical link: https://commits.webkit.org/318745@main", "email": "sosuke@bun.sh", "hash": "81a11702ef82c7a084d1a009dfa010b68e1e2981", "subject": "[JSC] RegExp trim fast path in `String#replace` is skipped once the caller tiers up to DFG/FTL" }, "318746@main": { "author": "Richard Robinson", "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64", "cl": "318746@main", "clUrl": "https://commits.webkit.org/318746@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321210\nrdar://184269279\n\nReviewed by Abrar Rahman Protyasha.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift:\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/DoubleClickGesturesTests.swift:\n\nCanonical link: https://commits.webkit.org/318746@main", "email": "richard_robinson2@apple.com", "hash": "d967cb67847526fa3fcbcba88d08b14b68ecbb8d", "subject": "[AppKit Gestures] Disable some tests that are failing, and enable some that are passing" }, "318747@main": { "author": "Basuke Suzuki", "avatar": "https://www.gravatar.com/avatar/5192a1151c7575317affb7a4633f8d63?d=identicon\u0026s=64", "cl": "318747@main", "clUrl": "https://commits.webkit.org/318747@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321176\nrdar://184224552\n\nReviewed by Brady Eidson.\n\nWebTransport::receiveDatagram handed the datagram to the source straight from IPC dispatch. IPC\ndispatches many messages per run loop turn with no microtask checkpoint in between, so a pending\nread() could not resolve and pull the next datagram mid-batch. Every arrival after the first\ntherefore evicted the previous one from the incoming queue, and only the first and last datagram of\na burst ever reached script.\n\nDeliver through the event loop instead, so a microtask checkpoint runs between datagrams and the\nreader drains one before the next is queued. Also add the m_state check that the other receive\nhandlers already have.\n\nThe incoming queue bound is unchanged. NetworkTransportSession still forwards every datagram as an\nindividual unbounded IPC, so honoring the bound there remains the real backpressure fix.\n\nCovered by existing tests: imported/w3c/web-platform-tests/webtransport/datagrams.https.any.html\nand its worker variants, un-skipped here.\n\n* LayoutTests/TestExpectations:\n* Source/WebCore/Modules/webtransport/WebTransport.cpp:\n(WebCore::WebTransport::receiveDatagram):\n\nCanonical link: https://commits.webkit.org/318747@main", "email": "basuke@apple.com", "hash": "083734c95c0b96991e4e97f1bff0de02ccb17830", "subject": "[WebTransport] Incoming datagram bursts are dropped because delivery bypasses the event loop" }, "318748@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "318748@main", "clUrl": "https://commits.webkit.org/318748@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321066\n\nReviewed by Darin Adler.\n\nWhen a global attribute's getter or setter is resolved from the global lexical\nenvironment and invoked as a bare call (e.g. `const f = descriptor.get; f();`),\nJSC hands the JSGlobalLexicalEnvironment object itself as the |this| value\nrather than undefined (bug 225397, FunctionCallResolveNode passing the resolved\nscope as |this|). For ordinary JS-function callees this is normalized away by\nthe op_to_this prologue, but host functions such as the custom getter/setter\nfunctions have no such prologue, so the raw scope leaked into castThisValue().\nThere it is neither undefined/null nor a JSGlobalProxy/global object, so the\ncast failed and we threw a TypeError (\"The Window.location getter can only be\nused on instances of Window\").\n\nNormalize this in castThisValue() by treating a leaked scope as undefined, which\nthen substitutes to the global object below. This fixes the getter and setter\npaths (which route through IDLAttribute) at a single shared point.\n\nWe must not use JSValue::toThis() to do this normalization: a global object\n(Window / RemoteDOMWindow) is itself a JSScope, so toThis(strict) would map a\nlegitimate |this| window to undefined. For a cross-origin access such as\n`crossOriginWindow.location`, JSGlobalProxy dispatches the getter/setter with\nthe target window as |this|; mapping that to undefined would substitute the\ncaller's global object, reading/writing the wrong window and defeating the\ncross-origin security check. Instead we only normalize a scope that is not\nitself a global object (i.e. the leaked JSGlobalLexicalEnvironment), leaving\nreal windows and global proxies untouched.\n\nCovered by imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/\nglobal-object-implicit-this-value.any.html (and its worker, sharedworker, and\nserviceworker variants), which now pass the previously-failing \"getter/setter\nworks when called on null / undefined\" subtests. Those tests were already\npassing in both Chrome and Firefox.\n\n* LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/global-object-implicit-this-value-cross-realm-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/global-object-implicit-this-value.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/global-object-implicit-this-value.any.serviceworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/global-object-implicit-this-value.any.sharedworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/global-object-implicit-this-value.any.worker-expected.txt:\n* Source/WebCore/bindings/js/JSDOMCastThisValue.h:\n(WebCore::castThisValue):\n\nCanonical link: https://commits.webkit.org/318748@main", "email": "cdumez@apple.com", "hash": "2118488d189965301716accec578190bb80af2cd", "subject": "Global object attribute getters/setters throw when called as bare functions from global scope" }, "318749@main": { "author": "Carlos Alberto Lopez Perez", "avatar": "https://www.gravatar.com/avatar/05326c1dbe06f486e884975e73f25179?d=identicon\u0026s=64", "cl": "318749@main", "clUrl": "https://commits.webkit.org/318749@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=316878\n\nReviewed by Adrian Taylor.\n\nOn a Release+Asserts build with Clang, every layout test crashes with\nASSERTION FAILED: !m_adoptionIsRequired at wtf/RefCountDebugger.h\n\nThe object causing the assertion is WebBackForwardListMessageForwarder, the\ngenerated C++ shim that forwards WebBackForwardList IPC messages into Swift.\nThis object is allocated from Swift by calling the inline createFromWeak()\nfunction.\n\nThe Swift compiler uses its clang importer to compile inline C++ functions.\nThe problem is that the importer was compiling the WTF headers with different\npreprocessor definitions than the regular C++ compilation.\n\nThe C++ compilation received both -DNDEBUG and -DASSERT_ENABLED=1, but only\nNDEBUG was forwarded to the importer. Because of this, PlatformEnable.h\nderived ASSERT_ENABLED as 0 for the importer. ASSERT_ENABLED controls data\nmembers in refcounted classes, so C++ and the importer ended up with different\nlayouts for the same objects:\n\n C++ TUs importer\n ASSERT_ENABLED 1 0\n CHECK_REF_COUNTED_LIFECYCLE 1 0\n ENABLE_REFTRACKER 1 0\n sizeof(RefCountedBase) 12 4\n sizeof(WebBackForwardListMessageForwarder) 48 32\n\nAs a result, the createFromWeak() generated by the importer allocated 32 bytes\nfor an object that needs 48 bytes. It also compiled adoptRef() without the\nadopted() call, leaving m_adoptionIsRequired set.\n\nAdding ASSERT_ENABLED to the hand-written list would fix this particular\ncrash, but it would not be future-proof, as any other preprocessor definition\nwould still be lost in the same way.\n\nFix this by adding _webkit_cxx_preprocessor_definitions(), which obtains the\ndefinitions from the same places used by the C++ compilation: the\nCOMPILE_DEFINITIONS directory property, CMAKE_CXX_FLAGS and\nCMAKE_CXX_FLAGS_\u003cCONFIG\u003e.\n\nThe flags are parsed with separate_arguments() so definitions with quoted\nvalues are handled correctly. Definitions from CMAKE_CXX_FLAGS are added last,\nmatching the order in the real compiler command and allowing definitions from\nCXXFLAGS to override directory definitions.\n\nFinally, this enables the Swift features again by default on GTK and WPE,\nreverting the workaround from 318624@main that disabled them because the\nbots build Release+Asserts and were hitting these crashes after switching\nthe bots to use Clang instead of GCC at 318539@main.\n\n* Source/cmake/WebKitFeatures.cmake:\n* Source/cmake/WebKitMacros.cmake:\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\nCanonical link: https://commits.webkit.org/318749@main", "email": "clopez@igalia.com", "hash": "3b87c975ae69e16933fed6cca212b4dd4b781af7", "subject": "REGRESSION(314923@main): [CMake] Give the Swift Clang importer the same global preprocessor definitions as C++" }, "318750@main": { "author": "Sihui Liu", "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64", "cl": "318750@main", "clUrl": "https://commits.webkit.org/318750@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321137\nrdar://183490258\n\nReviewed by Ryosuke Niwa.\n\nUnder Site Isolation with the shared process enabled, WebProcessProxy::m_sharedProcessDomains was\nonly populated when a shared process was first created for a BrowsingContextGroup. When the same\nshared process went on to host additional sites -- either because another site was admitted to the\ngroup's already-assigned shared process, or because the process was reused for a site via\nBrowsingContextGroup::ensureProcessForSite -- those domains were never added, so the set held at\nmost one domain no matter how many sites the process actually hosted.\n\nTwo independent checks consult this set, and the incomplete record broke both in opposite\ndirections:\n- WebProcessPool::processForSite's process-cache reuse check refuses to reuse a cached shared\nprocess that hosts a domain needing isolation. Since the recorded set couldn't see domains\nadmitted after the first, a cached process holding a domain with recorded user interaction could\nstill be reused.\n- WebProcessProxy::allowsFirstPartyAccess() denies access for a hosted domain that isn't in the\nrecorded set. Legitimately-hosted-but-unrecorded domains were therefore wrongly denied first-party\naccess (e.g. for badging).\n\nRecord every domain as it is admitted to a shared process, not just the first, and clear the set\nwhenever a process is (re)assigned as a shared process for a BrowsingContextGroup so that domains\nrecorded for a previous group's use of the process don't leak into the new assignment's isolation\ndecisions.\n\n* Source/WebKit/UIProcess/BrowsingContextGroup.cpp:\n(WebKit::BrowsingContextGroup::sharedProcessForSite):\n(WebKit::BrowsingContextGroup::ensureProcessForSite):\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::didStartUsingProcessForSiteIsolation):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, SharedProcessWebProcessCacheSharedProcessForSiteWithUserInteraction)):\nUpdated expectation for the expected behavior after change.\n\nCanonical link: https://commits.webkit.org/318750@main", "email": "sihui_liu@apple.com", "hash": "4fdc110d65b5f351867640dc68c02bf90ecc7272", "subject": "[Site Isolation] WebProcessProxy::m_sharedProcessDomains only tracks the first domain loaded in shared process" }, "318751@main": { "author": "Nikolas Zimmermann", "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64", "cl": "318751@main", "clUrl": "https://commits.webkit.org/318751@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321129\n\nReviewed by Rob Buis.\n\nCSSFilterRenderer::expandFilterRegionForSVGReferences() started from the object\nbounding box and united it with each referenced \u003cfilter\u003e region. The bounding box\nseed is only meaningful for the CSS shorthand functions, which operate on the\nsource graphic; a referenced \u003cfilter\u003e brings its own region, and that region alone\ndecides where the filter paints.\n\nFor an element with a very large bounding box and a small userSpaceOnUse filter\nregion, the union grew far past the image buffer limits, so the region was clamped\nand the resulting scale made the filter output vanish. This is what happened to\nfilterRegion_1 through filterRegion_6 in svg/batik/filters/filterRegions.svg, whose\nrects are 20000000 units wide and sit at y=3000 while the filter region is\n(20, 30, 50, 40). The legacy engine takes the region from the \u003cfilter\u003e element\nalone and does not have this problem.\n\nWhen every function in the chain is a \u003cfilter\u003e reference, drop the bounding box and\nkeep only the referenced regions. The reference box is unchanged, so objectBoundingBox\nfilter units still resolve as before. The code path is guarded by\nFilterRenderingOption::ApplyToSVGRenderer, so HTML/CSS filters are\nunaffected.\n\nFixes svg/batik/filters/filterRegions.svg.\n\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/TestExpectations:\n* Source/WebCore/rendering/CSSFilterRenderer.cpp:\n(WebCore::CSSFilterRenderer::expandFilterRegionForSVGReferences):\n\nCanonical link: https://commits.webkit.org/318751@main", "email": "nzimmermann@igalia.com", "hash": "57169084beb9ad1b37ed2ea3a1ee463f79cc46d7", "subject": "[LBSE] Do not seed the filter region with the object bounding box for pure \u003cfilter\u003e references" }, "318752@main": { "author": "Connor O'Brien", "avatar": "https://www.gravatar.com/avatar/7a0f091392993b89a71ac1f6834c7496?d=identicon\u0026s=64", "cl": "318752@main", "clUrl": "https://commits.webkit.org/318752@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321184\n\u003crdar://184242735\u003e\n\nReviewed by Abrar Rahman Protyasha.\n\nThere is a case where the first event in the synthetic momentum curve\ncan have have a height value of zero, but the resulting gesture still\nlooks as expected. In this case the\nScrollingPerformanceTestMomentumInterval signpost interval that is used\nfor scrollingPerformanceTestingEnabled() will be closed immediately.\nThis commit updates this logic to not end this interval if a non-zero\ndelta has never been seen before. The interval will now accurately\nsignpost the momentum gesture, and retain functionality to be ended\nearly at the end of the momentum gesture where a delta value of zero is\nexpected.\n\nCanonical link: https://commits.webkit.org/318752@main", "email": "cobrien22@apple.com", "hash": "14bf93938ee42f0a091ffbf58b947c43592650e2", "subject": "ScrollingPerformanceTestMomentumInterval is closed immediately if the first delta event is zero" }, "318753@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "318753@main", "clUrl": "https://commits.webkit.org/318753@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321156\nrdar://184194378\n\nReviewed by Gerald Squelart.\n\nRelative values in the canvas font shorthand ('%', 'em', 'ex', 'larger', ...) are\nresolved against the computed style of the canvas element at the time the font is\nset. CanvasRenderingContext2D::setFontWithoutUpdatingStyle() memoized that work on\nthe unparsed font string alone, so assigning the same string again was treated as a\nno-op even when the element's font-size had changed in between, leaving the context\nwith a font resolved against a stale style. Nothing else invalidates it either: the\nonly invalidation path is FontProxy::fontsNeedUpdate(), which fires for web font\nloads rather than for style changes on the canvas.\n\nThis is easy to hit in practice, because a page that varies the size through CSS has\nno reason to vary the font string:\n\n canvas.style.fontSize = \"40px\";\n ctx.font = \"100% Georgia\"; // Ignored if \"100% Georgia\" was already set.\n\nCompute the base font description before the early return and record it in the\ncanvas state, so the memoized font is only reused when both the string and the\ndescription it was resolved against still match.\n\nTest: fast/canvas/canvas-font-relative-size-restyle.html\n\n* LayoutTests/fast/canvas/canvas-font-relative-size-restyle-expected.txt: Added.\n* LayoutTests/fast/canvas/canvas-font-relative-size-restyle.html: Added.\n* Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp:\n(WebCore::CanvasRenderingContext2D::setFontWithoutUpdatingStyle):\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.h:\n\nCanonical link: https://commits.webkit.org/318753@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "b0089a4add643baa29ec693a70008a30729adaf8", "subject": "ctx.font does not re-resolve relative font sizes when set to the same string after the canvas element's style changed" }, "318754@main": { "author": "Marcus Plutowski", "avatar": "https://www.gravatar.com/avatar/0dc4fa1c337348e333de44505752edb8?d=identicon\u0026s=64", "cl": "318754@main", "clUrl": "https://commits.webkit.org/318754@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321197\nrdar://184255766\n\nReviewed by Dan Hecht.\n\nThis provides no extra semantic information, so there's no need for an\nindirection. Remove in line with our general push to de-macroify libpas'\nMTE implementation.\n\nNo new tests because this is a purely syntactic change.\n\n* Source/bmalloc/libpas/src/libpas/pas_fast_megapage_table.h:\n(pas_fast_megapage_table_get):\n* Source/bmalloc/libpas/src/libpas/pas_large_map.c:\n(pas_large_map_find):\n(pas_large_map_add):\n(pas_large_map_take):\n* Source/bmalloc/libpas/src/libpas/pas_large_sharing_pool.c:\n(pas_large_sharing_pool_boot_free):\n(pas_large_sharing_pool_free):\n(pas_large_sharing_pool_allocate_and_commit):\n(pas_large_sharing_pool_compute_summary):\n* Source/bmalloc/libpas/src/libpas/pas_megapage_cache.c:\n(megapage_cache_allocate_aligned):\n* Source/bmalloc/libpas/src/libpas/pas_mte.h:\n* Source/bmalloc/libpas/src/libpas/pas_page_header_table.c:\n(pas_page_header_table_add):\n* Source/bmalloc/libpas/src/libpas/pas_page_header_table.h:\n(pas_page_header_table_get_for_boundary):\n* Source/bmalloc/libpas/src/libpas/pas_probabilistic_guard_malloc_allocator.c:\n(pas_probabilistic_guard_malloc_allocate):\n(pas_probabilistic_guard_malloc_deallocate):\n* Source/bmalloc/libpas/src/libpas/pas_allocation_result.h:\n(pas_allocation_result_zero):\n\nCanonical link: https://commits.webkit.org/318754@main", "email": "marcus_plutowski@apple.com", "hash": "a24d4cb147c02304a9254a2a765e9f84cac19a4f", "subject": "[libpas] Inline PAS_MTE_HANDLEs which resolve to PAS_MTE_CLEAR*" }, "318755@main": { "author": "Jessica Lee", "avatar": "https://www.gravatar.com/avatar/fc717c99321d09f31fb9187418a8ffc5?d=identicon\u0026s=64", "cl": "318755@main", "clUrl": "https://commits.webkit.org/318755@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321227\nrdar://184275595\n\nReviewed by Ben Nham.\n\nThese are redundant and can be refactored for removal.\n\nNo new tests needed.\n\n* Source/WebKit/GPUProcess/media/RemoteAudioTrackProxy.cpp:\n(WebKit::RemoteAudioTrackProxy::configurationChanged):\n* Source/WebKit/GPUProcess/media/RemoteCDMProxy.cpp:\n(WebKit::RemoteCDMProxy::sharedPreferencesForWebProcess const):\n* Source/WebKit/GPUProcess/media/RemoteMediaResource.cpp:\n(WebKit::RemoteMediaResource::shutdown):\n\nCanonical link: https://commits.webkit.org/318755@main", "email": "jlee53@apple.com", "hash": "59aa7b7044602b61094f8cab64fe7f475358fdae", "subject": "Remove extraneous .get() calls from RemoteAudioTrackProxy, RemoteCDMProxy, RemoteMediaResource" }, "318756@main": { "author": "Sihui Liu", "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64", "cl": "318756@main", "clUrl": "https://commits.webkit.org/318756@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320812\nrdar://183827503\n\nReviewed by Timothy Hatcher.\n\n312231@main made WebExtensionContext::moveLocalStorageIfNeeded remove all website data for the previous base URL after\nrenaming localStorage and IndexedDB to the new one. A web extension gets a new base URL on every launch, so this runs\nonce per extension on every cold launch, with every website data type included. WebsiteDataType::DiskCache alone makes\nNetworkCache::Cache::deleteData traverse the entire network cache, decoding every record's ResourceResponse on the\nnetwork process main thread. Other types also add their own launch-time cost: ScreenTime creates an STWebHistory XPC\nconnection on the UI process main thread, and DOMCache forces NetworkSession::ensureSWServer. Extension content\ninjection waits for all of it, because load() sets m_safeToInjectContent and calls addInjectedContent from\nmoveLocalStorageIfNeeded's completion handler.\n\nThis patch ensures to delete what the rename leaves behind as part of the rename instead.\nNetworkStorageManager::moveData already calls removeOriginStorageManagerIfPossible for the source origin, which removes\nthe origin directory once it is empty, but it never became empty because only localStorage and IndexedDB were moved out\nof it. Deleting the remaining managed types there makes that existing cleanup effective and lets WebExtensionContext\ndrop its separate removal entirely.\n\nPartitions where the previous base URL is only one side of the ClientOrigin, along with MediaKeys and DeviceIdHashSalt,\nare left to a follow-up that periodically removes data for extension origins that no longer belong to a loaded\nextension: finding them requires traversing all origins, which that pass can do once instead of once per extension per\nlaunch.\n\nTest: WebKit.WebsiteDataStoreRenameOriginRemovesSourceOriginData\n\n* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp:\n(WebKit::NetworkStorageManager::moveData):\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionContextCocoa.mm:\n(WebKit::WebExtensionContext::moveLocalStorageIfNeeded):\n(WebKit::WebExtensionContext::removeWebsiteDataForOrigin): Deleted.\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebsiteDataStoreCustomPaths.mm:\n(displayNamesOfDataRecords):\n(TEST(WebKit, WebsiteDataStoreRenameOriginRemovesSourceOriginData)):\n(TEST(WebKit, NetworkCacheDirectory)):\n\nCanonical link: https://commits.webkit.org/318756@main", "email": "sihui_liu@apple.com", "hash": "7f8d70c0622228116a14f5100cf0e3e6fd333de7", "subject": "Web Extensions load with significant delay on iOS 26.6 when Safari is cold launched" }, "318757@main": { "author": "Issac Roy", "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64", "cl": "318757@main", "clUrl": "https://commits.webkit.org/318757@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321203\nrdar://184258831\n\nReviewed by Aakash Jain.\n\nCherry-picking a change you reviewed yourself shouldn't fail as\n\"cannot review their own change\".\n\n* Tools/CISupport/ews-build/steps.py:\n(ValidateCommitMessage.run):\n* Tools/CISupport/ews-build/steps_unittest.py:\n\nCanonical link: https://commits.webkit.org/318757@main", "email": "issacroy05@gmail.com", "hash": "b13e326407f8ac262d53af3560e970d749e38ff4", "subject": "[ews-build] Cherry-picking a change you reviewed fails validate-commit-message" }, "318758@main": { "author": "Megan Gardner", "avatar": "https://www.gravatar.com/avatar/b466a5bcbfabf4d82a8ecc595db5a531?d=identicon\u0026s=64", "cl": "318758@main", "clUrl": "https://commits.webkit.org/318758@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321116\nrdar://184150480\n\nReviewed by Ryosuke Niwa, Wenson Hsieh, and Abrar Rahman Protyasha.\n\nCompletes highlightsFromPoint() with shadow-tree support. A highlight range whose content\nlives inside a shadow tree is now only returned when every shadow root between that content\nand the document is listed in the options.shadowRoots argument; ranges reached through an\nunlisted shadow root are skipped. Reachability is determined by walking the range's start\ncontainer up through containingShadowRoot()/host() to the document.\n\nHit-testing also switches from RenderObject::clientBorderAndTextRects() to a new text-only\nRenderObject::clientTextRects(). Custom highlights paint over text, not element boxes,\nbut clientBorderAndTextRects() includes the border box of any fully-selected element.\nThat caused a highlight whose range spans a block-level element (such as a shadow host)\nto report a spurious hit over that element's box on a line where no text of the highlight\nis actually painted. clientTextRects() returns only the text runs, matching what is painted.\nThe new helper is an additive, guarded variant of the existing borderAndTextRects() path, so\nclientBorderAndTextRects()/absoluteBorderAndTextRects() callers are unaffected.\n\nimported/w3c/web-platform-tests/shadow-dom/HighlightRegistry-highlightsFromPoint.html\n\n* LayoutTests/imported/w3c/web-platform-tests/shadow-dom/HighlightRegistry-highlightsFromPoint-expected.txt:\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebCore/Modules/highlight/HighlightRegistry.cpp:\n(WebCore::HighlightRegistry::highlightsFromPoint):\n* Source/WebCore/rendering/RenderObject.cpp:\n(WebCore::borderAndTextRects):\n(WebCore::RenderObject::clientTextRects):\n* Source/WebCore/rendering/RenderObject.h:\n\nCanonical link: https://commits.webkit.org/318758@main", "email": "megan_gardner@apple.com", "hash": "99ba7bed33ec0c233af78158e583d78545d9a3e7", "subject": "[Custom Highlight] Support the shadowRoots option in HighlightRegistry.highlightsFromPoint()." }, "318760@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "318760@main", "clUrl": "https://commits.webkit.org/318760@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=260894\nrdar://115039851\n\nReviewed by Darin Adler.\n\nSVG2 removed the SVGPathSegList collection and the whole SVGPathSeg* family\nof interfaces (https://www.w3.org/TR/SVG2/paths.html), and both Firefox and\nChrome no longer expose them. This aligns WebKit with the spec and makes the\nimported web-platform-tests/dom/historical.html \"SVGPathSegList\" subtest pass.\nThis mirrors Blink's removal (Chromium 356063 / crbug.com/539385).\n\nThe SVGPathSeg objects were never part of rendering or animation in WebCore:\nthe \"d\" attribute is backed by an SVGPathByteStream (owned by SVGPathSegList),\nrendering reads that byte stream, and SMIL path animation operates entirely on\nbyte streams (SVGAnimationPathSegListFunction over SVGPathByteStream). The\nSVGPathSeg objects were only materialized lazily to service the DOM API. This\npatch therefore removes the DOM surface and the seg-object machinery while\nkeeping SVGPathByteStream as the source of truth.\n\nSpecifically:\n - Removes the SVGPathSeg, SVGPathSegList and all SVGPathSeg* interfaces, plus\n SVGPathElement.pathSegList, animatedPathSegList and the createSVGPathSeg*\n factory methods. SVGPathElement.getPathSegAtLength() is kept (it is\n implemented over the byte stream), matching other engines.\n - Reduces SVGPathSegList to a byte-stream holder rooted on SVGProperty. The\n class name is retained to avoid churn in the SVGAnimatedPathSegList property\n glue.\n - Keeps enum class SVGPathSegType, which is used by path parsing and by CSS\n path()/shape code, not just the DOM.\n - Deletes the now-unused SVGPathSegListBuilder / SVGPathSegListSource and the\n buildSVGPathByteStreamFromSVGPathSegList / buildSVGPathSegListFromByteStream\n helpers.\n\nExisting tests that exercised the removed DOM API are removed; interface\nlisting, constructor and idlharness expectations are updated; and the two\ntextPath-path-change-using-svg-dom tests are updated to mutate the path via\nsetAttribute(\"d\", ...).\n\nNo new tests, rebaselined existing tests.\n\n* LayoutTests/fast/dom/Window/resources/window-properties.js:\n* LayoutTests/fast/dom/Window/window-lookup-precedence-expected.txt:\n* LayoutTests/fast/svg/path-NaN-stroke-bounding-box-crash-expected.txt: Removed.\n* LayoutTests/fast/svg/path-NaN-stroke-bounding-box-crash.html: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/dom/historical-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animate-path-animation-Cc-Ss.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animate-path-animation-Mm-Aa-Z.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animate-path-animation-cC-sS-inverse.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animate-path-animation-lL-vV-hH-inverse.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animate-path-animation-mM-aA-Z-inverse.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animate-path-animation-qQ-tT-inverse.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animate-path-by-animation-accumulate-mismatch.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animate-path-by-animation-additive-mismatch.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animate-path-by-animation-empty-base.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animate-path-by-animation-mismatch.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animate-path-from-by-animation-empty-from.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animate-path-from-by-animation-mismatch.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animate-path-from-to-animation-both-empty.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animate-path-from-to-animation-empty-from.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animate-path-from-to-animation-empty-to.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animate-path-from-to-animation-mismatch-diff-seg-counts.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animate-path-from-to-animation-mismatch-same-seg-count.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animate-path-to-animation-empty-base.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/dependent-begin-on-syncbase-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/reinserting-svg-into-document-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/seeking-events-1-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/seeking-events-4-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/svgpath-animation-2.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/historical-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/path/interfaces/SVGAnimatedPathData-removed-expected.txt:\n* LayoutTests/perf/svg-path-appenditem-expected.txt: Removed.\n* LayoutTests/perf/svg-path-appenditem.html: Removed.\n* LayoutTests/platform/glib/fast/dom/Window/window-lookup-precedence-expected.txt:\n* LayoutTests/platform/glib/svg/W3C-SVG-1.1-SE/paths-dom-02-f-expected.png: Removed.\n* LayoutTests/platform/glib/svg/W3C-SVG-1.1-SE/paths-dom-02-f-expected.txt: Removed.\n* LayoutTests/platform/glib/svg/custom/svg-curve-with-relative-coordinates-expected.txt: Removed.\n* LayoutTests/platform/glib/svg/dom/SVGPathSegList-cloning-expected.txt: Removed.\n* LayoutTests/platform/glib/svg/dom/SVGPathSegList-xml-dom-synchronization2-expected.txt: Removed.\n* LayoutTests/platform/gtk/svg/custom/js-update-path-changes-expected.png: Removed.\n* LayoutTests/platform/gtk/svg/custom/js-update-path-removal-expected.png: Removed.\n* LayoutTests/platform/gtk/svg/custom/svg-curve-with-relative-coordinates-expected.png: Removed.\n* LayoutTests/platform/gtk/svg/dom/SVGPathSegList-appendItem-expected.png: Removed.\n* LayoutTests/platform/gtk/svg/dom/SVGPathSegList-clear-and-initialize-expected.png: Removed.\n* LayoutTests/platform/gtk/svg/dom/SVGPathSegList-cloning-expected.png: Removed.\n* LayoutTests/platform/gtk/svg/dom/SVGPathSegList-insertItemBefore-expected.png: Removed.\n* LayoutTests/platform/gtk/svg/dom/SVGPathSegList-removeItem-expected.png: Removed.\n* LayoutTests/platform/gtk/svg/dom/SVGPathSegList-replaceItem-expected.png: Removed.\n* LayoutTests/platform/gtk/svg/dom/SVGPathSegList-segment-modification-expected.png: Removed.\n* LayoutTests/platform/gtk/svg/dom/SVGPathSegList-xml-dom-synchronization-expected.png: Removed.\n* LayoutTests/platform/gtk/svg/dom/SVGPathSegList-xml-dom-synchronization2-expected.png: Removed.\n* LayoutTests/platform/ios/svg/W3C-SVG-1.1-SE/paths-dom-02-f-expected.txt: Removed.\n* LayoutTests/platform/ios/svg/dom/SVGPathSegList-segment-modification-expected.txt: Removed.\n* LayoutTests/platform/ios/svg/dom/SVGPathSegList-xml-dom-synchronization2-expected.txt: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1-SE/paths-dom-02-f-expected.txt: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/js-update-path-changes-expected.txt: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/js-update-path-removal-expected.txt: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/svg-curve-with-relative-coordinates-expected.txt: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dom/SVGPathSegList-cloning-expected.txt: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dom/SVGPathSegList-segment-modification-expected.txt: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dom/SVGPathSegList-xml-dom-synchronization2-expected.txt: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/W3C-SVG-1.1-SE/paths-dom-02-f-expected.png: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/custom/js-update-path-changes-expected.png: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/custom/js-update-path-removal-expected.png: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/custom/svg-curve-with-relative-coordinates-expected.png: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/dom/SVGPathSegList-appendItem-expected.png: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/dom/SVGPathSegList-clear-and-initialize-expected.png: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/dom/SVGPathSegList-cloning-expected.png: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/dom/SVGPathSegList-insertItemBefore-expected.png: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/dom/SVGPathSegList-removeItem-expected.png: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/dom/SVGPathSegList-replaceItem-expected.png: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/dom/SVGPathSegList-segment-modification-expected.png: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/dom/SVGPathSegList-xml-dom-synchronization-expected.png: Removed.\n* LayoutTests/platform/mac-tahoe-wk2-pixel/svg/dom/SVGPathSegList-xml-dom-synchronization2-expected.png: Removed.\n* LayoutTests/platform/mac-wk2/fast/dom/Window/window-lookup-precedence-expected.txt:\n* LayoutTests/platform/mac/svg/W3C-SVG-1.1-SE/paths-dom-02-f-expected.png: Removed.\n* LayoutTests/platform/mac/svg/W3C-SVG-1.1-SE/paths-dom-02-f-expected.txt: Removed.\n* LayoutTests/platform/mac/svg/custom/js-update-path-changes-expected.png: Removed.\n* LayoutTests/platform/mac/svg/custom/js-update-path-removal-expected.png: Removed.\n* LayoutTests/platform/mac/svg/custom/svg-curve-with-relative-coordinates-expected.png: Removed.\n* LayoutTests/platform/mac/svg/dom/SVGPathSegList-appendItem-expected.png: Removed.\n* LayoutTests/platform/mac/svg/dom/SVGPathSegList-clear-and-initialize-expected.png: Removed.\n* LayoutTests/platform/mac/svg/dom/SVGPathSegList-cloning-expected.png: Removed.\n* LayoutTests/platform/mac/svg/dom/SVGPathSegList-insertItemBefore-expected.png: Removed.\n* LayoutTests/platform/mac/svg/dom/SVGPathSegList-removeItem-expected.png: Removed.\n* LayoutTests/platform/mac/svg/dom/SVGPathSegList-replaceItem-expected.png: Removed.\n* LayoutTests/platform/mac/svg/dom/SVGPathSegList-segment-modification-expected.png: Removed.\n* LayoutTests/platform/mac/svg/dom/SVGPathSegList-segment-modification-expected.txt: Removed.\n* LayoutTests/platform/mac/svg/dom/SVGPathSegList-xml-dom-synchronization-expected.png: Removed.\n* LayoutTests/platform/mac/svg/dom/SVGPathSegList-xml-dom-synchronization2-expected.png: Removed.\n* LayoutTests/platform/mac/svg/dom/SVGPathSegList-xml-dom-synchronization2-expected.txt: Removed.\n* LayoutTests/platform/win/svg/custom/svg-curve-with-relative-coordinates-expected.txt: Removed.\n* LayoutTests/platform/win/svg/dom/SVGPathSegList-cloning-expected.txt: Removed.\n* LayoutTests/platform/wpe-legacy-api/svg/W3C-SVG-1.1-SE/paths-dom-02-f-expected.txt: Removed.\n* LayoutTests/svg/W3C-SVG-1.1-SE/paths-dom-02-f-expected.txt: Removed.\n* LayoutTests/svg/W3C-SVG-1.1-SE/paths-dom-02-f.svg: Removed.\n* LayoutTests/svg/animations/animate-path-animation-Cc-Ss-expected.txt: Removed.\n* LayoutTests/svg/animations/animate-path-animation-Cc-Ss.html: Removed.\n* LayoutTests/svg/animations/animate-path-animation-Ll-Vv-Hh-expected.txt: Removed.\n* LayoutTests/svg/animations/animate-path-animation-Ll-Vv-Hh.html: Removed.\n* LayoutTests/svg/animations/animate-path-animation-Qq-Tt-expected.txt: Removed.\n* LayoutTests/svg/animations/animate-path-animation-Qq-Tt.html: Removed.\n* LayoutTests/svg/animations/animate-path-animation-cC-sS-inverse-expected.txt: Removed.\n* LayoutTests/svg/animations/animate-path-animation-cC-sS-inverse.html: Removed.\n* LayoutTests/svg/animations/animate-path-animation-lL-vV-hH-inverse-expected.txt: Removed.\n* LayoutTests/svg/animations/animate-path-animation-lL-vV-hH-inverse.html: Removed.\n* LayoutTests/svg/animations/animate-path-animation-qQ-tT-inverse-expected.txt: Removed.\n* LayoutTests/svg/animations/animate-path-animation-qQ-tT-inverse.html: Removed.\n* LayoutTests/svg/animations/animate-path-to-animation-expected.txt: Removed.\n* LayoutTests/svg/animations/animate-path-to-animation.html: Removed.\n* LayoutTests/svg/animations/svgpath-animation-1-expected.txt: Removed.\n* LayoutTests/svg/animations/svgpath-animation-1.html: Removed.\n* LayoutTests/svg/custom/global-constructors-expected.txt:\n* LayoutTests/svg/custom/global-constructors.html:\n* LayoutTests/svg/custom/js-svg-constructors-expected.txt:\n* LayoutTests/svg/custom/js-svg-constructors.svg:\n* LayoutTests/svg/custom/js-update-path-changes-expected.txt: Removed.\n* LayoutTests/svg/custom/js-update-path-changes.svg: Removed.\n* LayoutTests/svg/custom/js-update-path-removal-expected.txt: Removed.\n* LayoutTests/svg/custom/js-update-path-removal.svg: Removed.\n* LayoutTests/svg/custom/path-getTotalLength-on-big-segment-crash-expected.txt: Removed.\n* LayoutTests/svg/custom/path-getTotalLength-on-big-segment-crash.svg: Removed.\n* LayoutTests/svg/custom/path-seg-nan-coordinates-linecap-crash-expected.txt: Removed.\n* LayoutTests/svg/custom/path-seg-nan-coordinates-linecap-crash.html: Removed.\n* LayoutTests/svg/custom/svg-curve-with-relative-coordinates-expected.txt: Removed.\n* LayoutTests/svg/custom/svg-curve-with-relative-coordinates.html: Removed.\n* LayoutTests/svg/custom/textPath-path-change-using-svg-dom-pattern.svg:\n* LayoutTests/svg/custom/textPath-path-change-using-svg-dom.svg:\n* LayoutTests/svg/dom/SVGPathSegList-appendItem-expected.txt: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-appendItem.xhtml: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-clear-and-initialize-expected.txt: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-clear-and-initialize.xhtml: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-cloning-expected.txt: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-cloning.html: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-crash-expected.txt: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-crash.html: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-insert-from-animating-animPathSegList-expected.txt: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-insert-from-animating-animPathSegList.svg: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-insertItemBefore-expected.txt: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-insertItemBefore.xhtml: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-length-indexed-access-expected.txt: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-length-indexed-access.xhtml: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-removeItem-expected.txt: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-removeItem.xhtml: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-replaceItem-expected.txt: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-replaceItem.xhtml: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-segment-modification-expected.txt: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-segment-modification.svg: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-xml-dom-synchronization-expected.txt: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-xml-dom-synchronization.xhtml: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-xml-dom-synchronization2-expected.txt: Removed.\n* LayoutTests/svg/dom/SVGPathSegList-xml-dom-synchronization2.xhtml: Removed.\n* LayoutTests/svg/dom/fuzz-path-parser-expected.txt: Removed.\n* LayoutTests/svg/dom/fuzz-path-parser.html: Removed.\n* LayoutTests/svg/dom/path-parser-expected.txt: Removed.\n* LayoutTests/svg/dom/path-parser.html: Removed.\n* LayoutTests/svg/dom/path-segments-expected.txt: Removed.\n* LayoutTests/svg/dom/path-segments.html: Removed.\n* LayoutTests/svg/dom/reuse-pathseg-after-changing-d-expected.txt: Removed.\n* LayoutTests/svg/dom/reuse-pathseg-after-changing-d.html: Removed.\n* LayoutTests/svg/dom/svg2-inheritance-expected.txt:\n* LayoutTests/svg/dom/svg2-inheritance.html:\n* LayoutTests/svg/dom/svglist-exception-on-out-bounds-error-expected.txt: Removed.\n* LayoutTests/svg/dom/svglist-exception-on-out-bounds-error.html: Removed.\n* LayoutTests/svg/dom/svglist-insertItemBefore-appends-expected.txt: Removed.\n* LayoutTests/svg/dom/svglist-insertItemBefore-appends.html: Removed.\n* LayoutTests/svg/dom/svgpath-out-of-bounds-getPathSeg-expected.txt: Removed.\n* LayoutTests/svg/dom/svgpath-out-of-bounds-getPathSeg.html: Removed.\n* Source/WebCore/CMakeLists.txt:\n* Source/WebCore/DerivedSources-input.xcfilelist:\n* Source/WebCore/DerivedSources-output.xcfilelist:\n* Source/WebCore/DerivedSources.make:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/WebCoreJSBindingsPrefix.h:\n* Source/WebCore/bindings/scripts/CodeGenerator.pm:\n(IsSVGPathSegTypeName): Deleted.\n(IsSVGPathSegType): Deleted.\n* Source/WebCore/bindings/scripts/CodeGeneratorJS.pm:\n(GenerateHeader):\n* Source/WebCore/svg/SVGPathElement.h:\n* Source/WebCore/svg/SVGPathElement.idl:\n* Source/WebCore/svg/SVGPathSeg.h:\n(): Deleted.\n(WebCore::SVGPathSeg::pathSegTypeForBindings const): Deleted.\n* Source/WebCore/svg/SVGPathSeg.idl: Removed.\n* Source/WebCore/svg/SVGPathSegArcAbs.idl: Removed.\n* Source/WebCore/svg/SVGPathSegArcRel.idl: Removed.\n* Source/WebCore/svg/SVGPathSegClosePath.idl: Removed.\n* Source/WebCore/svg/SVGPathSegCurvetoCubicAbs.idl: Removed.\n* Source/WebCore/svg/SVGPathSegCurvetoCubicRel.idl: Removed.\n* Source/WebCore/svg/SVGPathSegCurvetoCubicSmoothAbs.idl: Removed.\n* Source/WebCore/svg/SVGPathSegCurvetoCubicSmoothRel.idl: Removed.\n* Source/WebCore/svg/SVGPathSegCurvetoQuadraticAbs.idl: Removed.\n* Source/WebCore/svg/SVGPathSegCurvetoQuadraticRel.idl: Removed.\n* Source/WebCore/svg/SVGPathSegCurvetoQuadraticSmoothAbs.idl: Removed.\n* Source/WebCore/svg/SVGPathSegCurvetoQuadraticSmoothRel.idl: Removed.\n* Source/WebCore/svg/SVGPathSegImpl.h: Removed.\n* Source/WebCore/svg/SVGPathSegLinetoAbs.idl: Removed.\n* Source/WebCore/svg/SVGPathSegLinetoHorizontalAbs.idl: Removed.\n* Source/WebCore/svg/SVGPathSegLinetoHorizontalRel.idl: Removed.\n* Source/WebCore/svg/SVGPathSegLinetoRel.idl: Removed.\n* Source/WebCore/svg/SVGPathSegLinetoVerticalAbs.idl: Removed.\n* Source/WebCore/svg/SVGPathSegLinetoVerticalRel.idl: Removed.\n* Source/WebCore/svg/SVGPathSegList.h:\n* Source/WebCore/svg/SVGPathSegList.idl: Removed.\n* Source/WebCore/svg/SVGPathSegListBuilder.cpp: Removed.\n* Source/WebCore/svg/SVGPathSegListBuilder.h: Removed.\n* Source/WebCore/svg/SVGPathSegListSource.cpp: Removed.\n* Source/WebCore/svg/SVGPathSegListSource.h: Removed.\n* Source/WebCore/svg/SVGPathSegMovetoAbs.idl: Removed.\n* Source/WebCore/svg/SVGPathSegMovetoRel.idl: Removed.\n* Source/WebCore/svg/SVGPathSegValue.h: Removed.\n* Source/WebCore/svg/SVGPathUtilities.cpp:\n(WebCore::buildSVGPathByteStreamFromSVGPathSegList): Deleted.\n(WebCore::buildSVGPathSegListFromByteStream): Deleted.\n* Source/WebCore/svg/SVGPathUtilities.h:\n\nCanonical link: https://commits.webkit.org/318760@main", "email": "cdumez@apple.com", "hash": "b39e5174fda9493e7dcc1f25dae4dc8817baf1b4", "subject": "Remove remaining SVGPathElement's SVGPathSegList members" }, "318761@main": { "author": "Lauro Moura", "avatar": "https://www.gravatar.com/avatar/6157f52d61e04c2c63fe7ff668ba69b3?d=identicon\u0026s=64", "cl": "318761@main", "clUrl": "https://commits.webkit.org/318761@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321175\n\nReviewed by Carlos Alberto Lopez Perez.\n\nEnsure we check the whole expectation list when installing the pytest\nmarkers. Previously, only the first item was checked, effectively\nignoring flaky expectations, which have multiple expected outcomes.\n\nAs pytest has no natural flaky test marker, flakies are marked as xfail,\nwhich, in the case of a pass, currently are reported as XPASS. To avoid\npolluting the final report and hiding true XPASS cases, we also report\nthe flaky passes as regular PASS in the outer harness and resulting\njson. The same approach is used for FAIL/TIMEOUT, to avoid the empty\nxfail to mark an expected flaky timeout as a true timeout.\n\n* Tools/Scripts/webkitpy/webdriver_tests/pytest_runner.py:\n(SubtestResultRecorder.record_pass):\n(TestExpectationsMarker.pytest_collection_modifyitems):\n\nCanonical link: https://commits.webkit.org/318761@main", "email": "lmoura@igalia.com", "hash": "906e60b3d82986684b7907e52b909c4a1e6982d8", "subject": "[WebDriver][Tools] Fix pytest_collection_modifyitems to support proper flaky expectations" }, "318762@main": { "author": "Karl Dubost", "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64", "cl": "318762@main", "clUrl": "https://commits.webkit.org/318762@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318096\nrdar://180889449\n\nReviewed by Nikolas Zimmermann.\n\ncurrentScale was implemented purely as the main frame's page zoom,\ngated on the \u003csvg\u003e being the document root (frameForCurrentScale() requires\ndocument().documentElement() == this).\n\nAs a result, setting currentScale on an outermost \u003csvg\u003e embedded in HTML\n(inline, or inside a foreignObject) was silently discarded. The getter\nreturned 1, whereas SVG 2 (\"Interface SVGSVGElement\") only mandates that\nbehavior for non-outermost svg elements. Chrome and Firefox both\nround-trip the value; WebKit was the outlier.\n\nStore the assigned value in a new SVGSVGElement::m_currentScale member\nand return it for an outermost svg element that is not the document root.\nThe document root continues to map currentScale to page zoom, so its\nrendering is unchanged.\n\nAs with Gecko, the stored value is not reflected into rendering for\nnon-root outermost elements (only Blink does that; the existing\ncurrentScale-change-repaint.html reftest indicate that area is\nunderspecified), so this change is limited to the web-observable\ngetter/setter round-trip. We need more discussions in the SVG WG.\n\nTest: imported/w3c/web-platform-tests/svg/struct/scripted/currentScale-outermost.html\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/struct/scripted/currentScale-outermost-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/struct/scripted/currentScale-outermost.html: Added.\n* Source/WebCore/svg/SVGSVGElement.cpp:\n(WebCore::SVGSVGElement::currentScale const):\n(WebCore::SVGSVGElement::setCurrentScale):\n* Source/WebCore/svg/SVGSVGElement.h:\n\nCanonical link: https://commits.webkit.org/318762@main", "email": "karlcow@apple.com", "hash": "c6bd8acdac1fdbc4f3836f5841a207e24cb2bc46", "subject": "SVGSVGElement.currentScale is a no-op on non-document-root outermost \u003csvg\u003e" }, "318763@main": { "author": "Sihui Liu", "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64", "cl": "318763@main", "clUrl": "https://commits.webkit.org/318763@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321033\nrdar://184066679\n\nReviewed by Ryosuke Niwa.\n\nSite Isolation's shared process mode puts multiple cross-site frames into one WebProcess for performance, trading away\nsome of the process-boundary protection between the co-located sites. 318135@main introduced IsolatedSiteStore to hold\nthe sites that must be kept out of that process, with autofill as the first signal. This patch adds two more signals for\nbetter coverage:\n- Signal::FirstPartyVisit is recorded in WebPageProxy::didCommitLoadForFrame when the commit is for the main frame, from\nthe committed request's URL, skipping about: and file: URLs. This is deliberately broad: it flags every site the user\nnavigated to at the top level, which might create first-party cookies.\n- Signal::FirstPartyUserGesture is recorded similar to where ITP records hadUserInteraction: in UserGestureIndicator's\nconstructor, and in EventHandler::keyEvent for a handled key event. Both recording sites are gated on\nProcessInteractionStyle::Immediate. Delayed defers recording to the caller, which records once it knows the event was\nhandled, and Never marks a gesture asserted programmatically rather than made by the user.\n\nRecording the two separately lets a future eviction policy drop the visited-only sites first, and lets us measure what\nnarrowing to gestures would cost before deciding to narrow.\n\nAPI tests: WKWebsiteDataStore.FirstPartyVisitMarksSiteAsIsolated\n WKWebsiteDataStore.FirstPartyUserGestureInSubframeDoesNotMarkSubframeSite\n\n* Source/WebCore/dom/UserGestureIndicator.cpp:\n(WebCore::UserGestureIndicator::UserGestureIndicator):\n* Source/WebCore/page/ChromeClient.h:\n(WebCore::ChromeClient::didObserveFirstPartyUserGesture):\n* Source/WebCore/page/EventHandler.cpp:\n(WebCore::EventHandler::keyEvent):\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::didObserveFirstPartyUserGesture):\n* Source/WebCore/page/Page.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStore.mm:\n(-[WKWebsiteDataStore _isolatedSiteSignalsForTesting:]):\n(-[WKWebsiteDataStore _isIsolatedSiteForTesting:]): Deleted.\n* Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::recordFirstPartyVisit):\n(WebKit::WebPageProxy::didCommitLoadForFrame):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::didObserveFirstPartyUserGesture):\n* Source/WebKit/UIProcess/WebProcessProxy.h:\n* Source/WebKit/UIProcess/WebProcessProxy.messages.in:\n* Source/WebKit/UIProcess/WebsiteData/IsolatedSiteStore.h:\n* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp:\n(WebKit::WebsiteDataStore::isolatedSiteSignalsForTesting const):\n(WebKit::WebsiteDataStore::isIsolatedSiteForTesting const): Deleted.\n* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.h:\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:\n(WebKit::WebChromeClient::didObserveFirstPartyUserGesture):\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, SharedProcessAfterKeyDown)):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/UserContentController.mm:\n(TEST(WKUserContentController, AutofillScriptingMarksSiteAsIsolated)):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebsiteDatastore.mm:\n(TestWebKitAPI::(WKWebsiteDataStore, FirstPartyVisitMarksSiteAsIsolated)):\n(TestWebKitAPI::(WKWebsiteDataStore, FirstPartyUserGestureMarksSiteAsIsolated)):\n(TestWebKitAPI::(WKWebsiteDataStore, FirstPartyUserGestureInSubframeDoesNotMarkSubframeSite)):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ios/WKWebViewAutofillTests.mm:\n(TestWebKitAPI::TEST(WKWebViewAutoFillTests, AutofillMarksSiteAsIsolated)):\n\nCanonical link: https://commits.webkit.org/318763@main", "email": "sihui_liu@apple.com", "hash": "440598309f6d34f0b5cde3e5ef519df58fc97e5c", "subject": "[Site Isolation] First-party sites should not enter shared process" }, "318764@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "318764@main", "clUrl": "https://commits.webkit.org/318764@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320966\n\nReviewed by Yusuke Suzuki.\n\nSplitting strings built at runtime (e.g. parsing CSV/log rows) is common, and such\nsubjects are not atom strings. stringSplitFast still atomized every identifier-like\nresult string and built an atom-strings array for them, even though the split cache\nonly accepts atom subjects, so the atomization was pure waste.\n\nOnly take the atomize-and-cache path when the subject is an atom, matching what\nregExpSplitFast already does. Non-atom subjects now produce plain substrings.\n\nWith this change, elements of the result array are no longer atom strings when the\nsubject is not an atom. That being a performance regression is not a common case; we\nconfirmed that no such case exists in JetStream.\n\n base patched\n\nstring-split-non-atom-subject 156.1447+-4.6023 ^ 41.2708+-0.7647 ^ definitely 3.7834x faster\n\nTest: JSTests/microbenchmarks/string-split-non-atom-subject.js\n\n* JSTests/microbenchmarks/string-split-non-atom-subject.js: Added.\n(parseRow):\n* Source/JavaScriptCore/runtime/StringPrototype.cpp:\n(JSC::stringSplitFast):\n\nCanonical link: https://commits.webkit.org/318764@main", "email": "sosuke@bun.sh", "hash": "01ea2a8eb95530c8af1ba9596658bc3acbfefc9e", "subject": "[JSC] `String#split` should not atomize the results of a non-atom subject" }, "318765@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "318765@main", "clUrl": "https://commits.webkit.org/318765@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321214\n\nReviewed by Keith Miller.\n\n318675@main added no-op fallbacks for JSC_JIT_CAGE_PROBE and\nJSC_JIT_CAGE_PROBE_IMPL for when \u003cWebKitAdditions/JITCageAdditions.h\u003e does not\nprovide them, but both had copy-paste mistakes:\n\n1. Both bodies were `(void)x` while the parameter is `v`, so any expansion\n (LLIntData.cpp) fails with an undeclared identifier.\n2. The `#ifndef JSC_JIT_CAGE_PROBE_IMPL` block defined JSC_JIT_CAGE_PROBE\n again instead of JSC_JIT_CAGE_PROBE_IMPL, leaving the latter with no\n fallback (LLIntThunks.cpp) and redefining the former if the SDK header\n only provides JSC_JIT_CAGE_PROBE.\n\nUse `(void)(v)` in both and define JSC_JIT_CAGE_PROBE_IMPL in the second block.\nNo behavior change for open-source builds since ENABLE(JIT_CAGE) is off there.\n\n* Source/JavaScriptCore/assembler/JITOperationValidation.h:\n\nCanonical link: https://commits.webkit.org/318765@main", "email": "sosuke@bun.sh", "hash": "95ffc89f5eb494d6b3918b7f6e98cc85bad52892", "subject": "[JSC] `JSC_JIT_CAGE_PROBE{,_IMPL}` fallback macros in `JITOperationValidation.h` do not compile" }, "318766@main": { "author": "Lauro Moura", "avatar": "https://www.gravatar.com/avatar/6157f52d61e04c2c63fe7ff668ba69b3?d=identicon\u0026s=64", "cl": "318766@main", "clUrl": "https://commits.webkit.org/318766@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321152\n\nUnreviewed test gardening.\n\nGardening the most persistent flakies.\n\n* WebDriverTests/TestExpectations.json:\n\nCanonical link: https://commits.webkit.org/318766@main", "email": "lmoura@igalia.com", "hash": "f261a909c8d9b0b93313035017599dee5ee7090f", "subject": "[WebDriver][WPE] Gardening W32 2026 edition" }, "318767@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "318767@main", "clUrl": "https://commits.webkit.org/318767@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321061\n\nReviewed by Basuke Suzuki.\n\nTurn on the back/forward cache for all web-platform-tests, since they\nexpect it to be on. We use to turn it on on a per-folder basis but this\nis unnecessarily cumbersome.\n\nThis PR also rebaselines WPT tests that have different output now that they\nrun with the bfcache enabled.\n\n* Tools/TestRunnerShared/TestFeatures.cpp:\n(WTR::shouldUseBackForwardCache):\n* LayoutTests/imported/w3c/web-platform-tests/IndexedDB/back-forward-cache-open-connection.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/IndexedDB/back-forward-cache-open-transaction.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-view-transitions/navigation/old_vt_promises_bfcache-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/fs/FileSystemFileHandle-sync-access-handle-back-forward-cache.https.tentative.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/fs/FileSystemFileHandle-writable-file-stream-back-forward-cache.https.tentative.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/broadcastchannel/broadcastchannel.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/broadcastchannel/dedicatedworker.tentative.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/broadcastchannel/evict-on-message.tentative.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/eligibility/broadcast-channel-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/eligibility/dedicated-worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/eligibility/inflight-fetch-1-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/eligibility/inflight-fetch-2-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/eligibility/inflight-fetch-cors-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/eligibility/inflight-fetch-redirects-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/eligibility/shared-worker-active-client.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/eligibility/shared-worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/events-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/focus-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/pagehide-event-handler-microtasks.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/pushstate.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/service-worker-client-postmessage.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/service-worker-clients-claim.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/service-worker-clients-matchall.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/service-worker-controlled-after-restore.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/service-worker-unregister.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/storage-events-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/browsers/browsing-the-web/back-forward-cache/timers-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/bfcache/embedded-html-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/bfcache/embedded-img-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/bfcache/embedded-js-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/bfcache/embedded-mp4-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/bfcache/embedded-not-found-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/bfcache/embedded-type-only-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/web-locks/bfcache/abort.tentative.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/web-locks/bfcache/held.tentative.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/web-locks/bfcache/release-across-thread.tentative.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/web-locks/bfcache/release.tentative.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/web-locks/bfcache/sharedworker-multiple.tentative.https-expected.txt:\n\nCanonical link: https://commits.webkit.org/318767@main", "email": "cdumez@apple.com", "hash": "f9278fbdddf165aeac989c670010b057d5407fb9", "subject": "Turn on the back/forward cache for all web-platform-tests" }, "318768@main": { "author": "Anthony Tarbinian", "avatar": "https://www.gravatar.com/avatar/ef46154a1a21c6a5ef593e952ebc62f4?d=identicon\u0026s=64", "cl": "318768@main", "clUrl": "https://commits.webkit.org/318768@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321009\nrdar://123701232\n\nReviewed by Sihui Liu.\n\nWith site isolation, the UIProcess is responsible for managing rendering layers which comes\nfrom frames in different processes. A web process will send the content that should be\nrendered in its iframe. Then, it's the UIProcess's job to put the rendered content in the\nright place on the screen.\n\nOn a process swap of an iframe, the UIProcess needs to receive the new content from the new\nweb process and replace the iframe's old content.\n\nThe bug is that the UIProcess only appends the iframe's new content without detaching the\niframe's old content.\n\nThis bug became visible when an iframe load is blocked by X-Frame-Options and DocumentLoader::loadErrorDocument()\ncommits an empty, transparent document. Then, the iframe's previous document\nis still visible while appearing unresponsive since the old web process isn't repainting\nthe stale layer anymore. Usually new content is opaque, which is why I suspect this wasn't\nnoticed before.\n\nThis patch updates RemoteLayerTreeHost::updateLayerTree to detach any existing layer before\nplacing the new layer.\n\nThe regression test page is blue with a 200x200 iframe. The iframe loads a\ncross-site red page from localhost, and that page then navigates itself to a URL\non web-platform.test that responds with X-Frame-Options: deny.\n\nA blank frame is transparent, so the whole page should end up blue. The reference file is\nthe same page with an \u003ciframe src=\"about:blank\"\u003e instead of the real one. Without the fix\nthe iframe is stuck as red.\n\nTest: http/tests/site-isolation/draw-after-blocked-cross-origin-navigation.html\n\n* LayoutTests/http/tests/site-isolation/draw-after-blocked-cross-origin-navigation-expected.html: Added.\n* LayoutTests/http/tests/site-isolation/draw-after-blocked-cross-origin-navigation.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/red-frame-navigating-to-x-frame-options-deny.html: Added.\n* Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeHost.mm:\n(WebKit::RemoteLayerTreeHost::updateLayerTree):\n\nCanonical link: https://commits.webkit.org/318768@main", "email": "a_tarbinian@apple.com", "hash": "3e31762de6b1e418d94bfc40abd088466c7d5c28", "subject": "[Site Isolation] Stale iframe layers are left hosted after a cross-process navigation" }, "318769@main": { "author": "Nikolas Zimmermann", "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64", "cl": "318769@main", "clUrl": "https://commits.webkit.org/318769@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321211\n\nReviewed by Carlos Garcia Campos and Fujii Hironori.\n\nThe scrollbar buffer is cleared and painted from scratch on every update, so the\nregion that changes is the union of what the previous buffer painted and what\nthis one paints. 314540@main reported only the latter, so the frame that erases\nthe faded out overlay thumb propagated no damage and left the thumb on\nscreen.\n\nIt flickers rather than just leaving a stale thumb because an empty frame damage\nmakes ThreadedCompositor::recordFrameDamage() skip setFrameDamage() altogether,\nand that is also what accumulates the frame into every swap chain target. The\ntarget being composited still repaints the thumb region, since its own\naccumulated damage covers it, but the other targets never learn that region\nchanged and keep the old thumb. The thumb then comes and goes with the target\nthat happens to be current...\n\nThis is only visible on WPE since 318729@main turned damage propagation\non by default there -- GTK was already affected.\n\nThis gives up 314540@main's optimization. Restoring it needs the previous\nbuffer's painted area tracked across updates, which is not worth it.\n\n* Source/WebCore/page/scrolling/coordinated/ScrollerCoordinated.cpp:\n(WebCore::ScrollerCoordinated::updateValues):\n* Source/WebCore/platform/adwaita/AdwaitaScrollbarPainter.cpp:\n(WebCore::AdwaitaScrollbarPainter::paint):\n* Source/WebCore/platform/adwaita/AdwaitaScrollbarPainter.h:\n* Source/WebCore/platform/adwaita/ScrollerImpAdwaita.h:\n(WebCore::ScrollerImpAdwaita::paint):\n* Source/WebCore/platform/graphics/Damage.h:\n\nCanonical link: https://commits.webkit.org/318769@main", "email": "nzimmermann@igalia.com", "hash": "3ef900755534715b0197ad55cbc13deb977236a2", "subject": "REGRESSION(314540@main): When damage propagation is turned on, scrollbars are flickering" }, "318770@main": { "author": "Carlos Garcia Campos", "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64", "cl": "318770@main", "clUrl": "https://commits.webkit.org/318770@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321254\n\nReviewed by Nikolas Zimmermann.\n\nIt caused regressions in compositing performance tests.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/318770@main", "email": "cgarcia@igalia.com", "hash": "65b9c9315250f79b3f4f63a8833527fd5f73baaf", "subject": "[GTK][WPE] Disable UseDamagingInformationForCompositing by default" }, "318771@main": { "author": "Abrar Rahman Protyasha", "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64", "cl": "318771@main", "clUrl": "https://commits.webkit.org/318771@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321223\nrdar://184273141\n\nReviewed by Richard Robinson.\n\nForthcoming changes will make it possible to synthesize work for\nViewGestureController without going through the NSResponder/NSEvent\nmachinery that drives it today. Since these paths will not have a\nbacking NSEvent, we introduce this refactor that undoes a couple of\nassumptions.\n\n1. We teach WebGestureEvent about the gesture phase. This field is\n either populated by reading the `NSEvent.phase` property, or through\n other means.\n2. We add a `Kind` enum to NativeWebGestureEvent, recording whether the\n gesture is a magnification or a rotation.\n3. We make it possible to create a NativeWebGestureEvent instance from\n either an NSEvent, or from an explicit initialization structure that\n describes the gesture. In the latter case, we will store a null\n native event field, inspired by precedent established in 303084@main.\n4. We pass around the entire NativeWebGestureEvent instance, rather than\n its native event, in the gestureEventWasNotHandledByWebCore path.\n This allows us to drive the namesake SPI when there is a backing\n event, and go straight to ViewGestureController magnification if not.\n\nThe new initialization method has no callers yet, and as such this patch\ndoes not introduce a behavior change.\n\n* Source/WebKit/Shared/NativeWebGestureEvent.h:\n* Source/WebKit/Shared/WebEvent.serialization.in:\n* Source/WebKit/Shared/mac/NativeWebGestureEventMac.mm:\n(WebKit::webEventTypeForPhase):\n(WebKit::positionInView):\n(WebKit::initForEvent):\n(WebKit::NativeWebGestureEvent::create):\n(WebKit::NativeWebGestureEvent::NativeWebGestureEvent):\n(WebKit::webEventTypeForNSEvent): Deleted.\n(WebKit::pointForEvent): Deleted.\n* Source/WebKit/Shared/mac/WebGestureEvent.h:\n(WebKit::WebGestureEvent::WebGestureEvent):\n(WebKit::WebGestureEvent::phase const):\n* Source/WebKit/UIProcess/ViewGestureController.h:\n\nAlso drop PlatformMagnificationEvent, which has no remaining users now\nthat nothing in ViewGestureController takes an NSEvent directly.\n\n* Source/WebKit/UIProcess/mac/PageClientImplMac.mm:\n(WebKit::PageClientImpl::gestureEventWasNotHandledByWebCore):\n* Source/WebKit/UIProcess/mac/ViewGestureControllerMac.mm:\n(WebKit::ViewGestureController::gestureEventWasNotHandledByWebCore): Deleted.\n* Source/WebKit/UIProcess/mac/WebViewImpl.h:\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::gestureEventWasNotHandledByWebCore):\n(WebKit::WebViewImpl::gestureEventWasNotHandledByWebCoreFromViewOnly):\n(WebKit::WebViewImpl::magnificationGestureWasNotHandledByWebCoreFromViewOnly):\n\nCanonical link: https://commits.webkit.org/318771@main", "email": "a_protyasha@apple.com", "hash": "1eb4c74604e953e73ab237cf0fca967e2cf9b188", "subject": "[macOS] Support gesture event handling without a backing NSEvent" }, "318772@main": { "author": "Phinehas Fuachie", "avatar": "https://www.gravatar.com/avatar/900d85de8c325e38975f39115c36bb75?d=identicon\u0026s=64", "cl": "318772@main", "clUrl": "https://commits.webkit.org/318772@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321224\nrdar://184078411\n\nReviewed by Jer Noble.\n\nThe frame-commit behavior the test covers is unaffected; the test was too expensive to finish in\ntime. It created five cross-origin iframes and re-inserted all five, so a run performed ten\nsite-isolated commits and launched five WebContent processes. One frame covers the same path. The\nfallback timer was also installed after frame creation, so a failure before that point reported\nnothing at all.\n\nUse a single iframe, arm the fallback first, and log steps only on failure.\n\n* LayoutTests/http/tests/site-isolation/iframe-reinsert-same-src-commits-expected.txt:\n* LayoutTests/http/tests/site-isolation/iframe-reinsert-same-src-commits.html:\n\nCanonical link: https://commits.webkit.org/318772@main", "email": "pfuachie2@apple.com", "hash": "4c31e5449bb9fda04fc539dfa87aa1e088e28a27", "subject": "[Site Isolation] http/tests/site-isolation/iframe-reinsert-same-src-commits.html times out" }, "318773@main": { "author": "Carlos Alberto Lopez Perez", "avatar": "https://www.gravatar.com/avatar/05326c1dbe06f486e884975e73f25179?d=identicon\u0026s=64", "cl": "318773@main", "clUrl": "https://commits.webkit.org/318773@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321266\n\nReviewed by Carlos Garcia Campos.\n\nCurrently for building GTK or WPE there are two ways: use the build-webkit script\nor use CMake directly. The build-webkit script is only intended for webkit\ndevelopers, for production releases or users of webkit the idea is to use cmake\ndirectly.\n\nThe problem is that we have a split on how WebKit is built. With build-webkit\nninja is used by default, but when using cmake directly it uses whatever cmake\ngenerator has as default (make usually) and that is causing issues because of\nbuild errors due to dependencies between targets, ninja has its own dependency\ngraph, but plain makefiles don't.\n\nAnd this causes issues when someone tries to use make because no one usually\ntests the make build.\n\nThis patch makes ninja mandatory for GTK and WPE ports and also changes the\nmake-dist script to use it.\n\n* Source/cmake/WebKitCommon.cmake:\n* Tools/Scripts/make-dist:\n(Distcheck.configure):\n(Distcheck.build):\n(Distcheck.install):\n\nCanonical link: https://commits.webkit.org/318773@main", "email": "clopez@igalia.com", "hash": "aa6c61fcb0020c75099f15ccbfaa14380fb55c89", "subject": "[GTK][WPE][CMake] Do not allow to build with make, require ninja instead." }, "318775@main": { "author": "Karl Dubost", "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64", "cl": "318775@main", "clUrl": "https://commits.webkit.org/318775@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321157\nrdar://181570771\n\nReviewed by Abrar Rahman Protyasha.\n\nButtons are not mouse-focusable on macOS/iOS, so a workaround records\nthat the last focus trigger was a click. 311768@main stopped that\nworkaround from running when the clicked button sits inside an ancestor\nthat can take focus, such as a \u003cdialog\u003e. Usually the ancestor is focused\ninstead and the click is recorded there, but not when it is already\nfocused. Nothing recorded the click, so the programmatic focus() that\nfollowed showed :focus-visible.\n\nmusic.apple.com opens its now-playing player as a \u003cdialog\u003e. Dismissing\nit left a red focus ring on the mini player.\n\nWalk the ancestors only up to the element that will be focused, instead\nof skipping the workaround whenever there is one.\n\nTests: fast/selectors/focus-visible-script-focus-after-dialog-dismiss.html\n fast/selectors/focus-visible-script-focus-inside-focused-ancestor.html\n\n* LayoutTests/fast/selectors/focus-visible-script-focus-after-dialog-dismiss-expected.txt: Added.\n* LayoutTests/fast/selectors/focus-visible-script-focus-after-dialog-dismiss.html: Added.\n* LayoutTests/fast/selectors/focus-visible-script-focus-inside-focused-ancestor-expected.txt: Added.\n* LayoutTests/fast/selectors/focus-visible-script-focus-inside-focused-ancestor.html: Added.\n* Source/WebCore/page/EventHandler.cpp:\n(WebCore::EventHandler::dispatchMouseEvent):\n\nCanonical link: https://commits.webkit.org/318775@main", "email": "karlcow@apple.com", "hash": "a1678ffa5ff18d2173b0f871d794ba57b34d7efd", "subject": "REGRESSION(311768@main): :focus-visible incorrectly shown after focus() inside a focused ancestor" }, "318776@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "318776@main", "clUrl": "https://commits.webkit.org/318776@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321166\nrdar://184204754\n\nReviewed by Eric Carlson.\n\nThis test exposed four separate issues.\n\n1) navigator.audioSession.type read \"auto\" in a cross-site iframe: a WebContent process\n joining an existing page never received the top document's DocumentSyncData. The\n broadcast on change only reached processes that already hosted the page, and\n RemotePageParameters carried the main document URL but no sync data, so the iframe's\n Page kept a default-constructed DocumentSyncData. 100% failure whenever the iframe was\n site-isolated into its own process.\n\n2) navigator.audioSession.state read \"inactive\" there: the DOM audio session state was not\n page-scoped, so a passive iframe process consulted its own RemoteAudioSession, which\n never activated. RemoteAudioSessionConfiguration::isActive was that process's own\n activation request, and the GPU process only pushed ConfigurationChanged for mute,\n buffer size and sample rate. Also 100% failure once 1) was fixed.\n\n3) getUserMedia resolved once the audio session category had been applied but before the\n activation completed, so JS reading state right after the await could see \"inactive\" in\n any configuration. 45% failure without site isolation.\n\n4) The test only started listening for the frame's message after waiting for the frame to load.\n With the frame in another process, the message and the load notification travelled as separate\n IPCs, so a message that arrived first was dropped and the test waited forever. 8% of runs,\n reported as a timeout.\n\nDocumentSyncData is now sent in the remote page creation parameters and adopted by pages\nthat do not host the local main frame, and the audio session state joins it as a\nsynchronized, page-scoped value that remote-frame processes read and dispatch statechange\nfrom. For 3), audioCaptureSourceStateChanged() returns GenericPromise::all() of the\ncategory and the activation, so waiters (the getUserMedia promise, the track mute/unmute\nevents) see a session that is both categorised and active; activation is still requested\nsynchronously, so callers that do not wait keep observing AudioSession::isActive()\nimmediately, as 318537@main requires.\nThe test now starts listening for the message before it creates the frame.\n\n* LayoutTests/http/tests/webrtc/audioSessionInFrames.html: Listen for the frame's message\nbefore creating the frame.\n* LayoutTests/platform/ios-site-isolation/TestExpectations: Unskip the now-passing test.\n* LayoutTests/platform/mac-site-isolation/TestExpectations: Ditto.\n* Source/WebCore/Modules/audiosession/DOMAudioSession.cpp:\n(WebCore::DOMAudioSession::state const): Use the effective state.\n(WebCore::DOMAudioSession::currentState const): Read the synchronized state when the page\nhas no local main frame, otherwise compute it and publish it from the top document.\n(WebCore::DOMAudioSession::topDocumentAudioSessionStateChanged): Schedule a statechange\nevent for a state computed in another process.\n(WebCore::DOMAudioSession::scheduleStateChangeEvent): Capture the effective state.\n* Source/WebCore/Modules/audiosession/DOMAudioSession.h:\n* Source/WebCore/Modules/audiosession/NavigatorAudioSession.cpp:\n(WebCore::NavigatorAudioSession::audioSessionIfExists): Added; does not provision the\nsupplement.\n* Source/WebCore/Modules/audiosession/NavigatorAudioSession.h:\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::populateDocumentSyncDataForNewlyConstructedDocument): Handle the new\ndata type.\n* Source/WebCore/page/DocumentSyncData.in: Add AudioSessionState.\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::setAudioSessionState): Store and broadcast the page's audio session state.\n(WebCore::Page::audioSessionState const):\n(WebCore::Page::updateTopDocumentSyncData): Notify existing DOMAudioSession objects when\nthe synchronized state changes.\n* Source/WebCore/page/Page.h:\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.cpp:\n(WebCore::MediaSessionManagerInterface::audioCaptureSourceStateChanged): Return a promise\ncovering both the category and the activation; keep requesting activation synchronously.\n* Source/WebKit/Shared/WebCoreArgumentCodersMedia.serialization.in: Declare\nDOMAudioSessionState for IPC.\n* Source/WebKit/Shared/WebPageCreationParameters.h:\n* Source/WebKit/Shared/WebPageCreationParameters.serialization.in: Carry the top document's\nDocumentSyncData in RemotePageParameters.\n* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:\n(WebKit::ProvisionalPageProxy::initializeWebPage): Send fresh sync data; the provisional\npage commits a new top document.\n* Source/WebKit/UIProcess/RemotePageProxy.cpp:\n(WebKit::RemotePageProxy::injectPageIntoNewProcess): Send the current sync data.\n(WebKit::RemotePageProxy::setDrawingArea): Ditto.\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::topDocumentSyncData const): Added.\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::m_allowsImmersiveEnvironments):\n* Tools/TestWebKitAPI/Resources/getUserMedia.html: Wait for the getUserMedia promise to resolved before calling stop().\n* Tools/TestWebKitAPI/SourcesCocoa.txt: Added missing file so API test gets compiled.\n\nCanonical link: https://commits.webkit.org/318776@main", "email": "jya@apple.com", "hash": "4cdafb42e29d0fd7e0c21da6808c131d68c4bba2", "subject": "[site-isolation] http/tests/webrtc/audioSessionInFrames.html is a permanent failure" }, "318777@main": { "author": "Fujii Hironori", "avatar": "https://www.gravatar.com/avatar/ef99cb23f5e5d27977968ca097d9a85f?d=identicon\u0026s=64", "cl": "318777@main", "clUrl": "https://commits.webkit.org/318777@main", "description": "Unreviewed. Fixed a typo of LGPL version 2.1 that censused a license tool.\n\n* Source/WebCore/crypto/parameters/CryptoAlgorithmX25519ParamsInit.h:\n\nCanonical link: https://commits.webkit.org/318777@main", "email": "fujii@igalia.com", "hash": "a0c9c2ff2d1bb0fefd187e4540738c05000c4626", "subject": "CryptoAlgorithmX25519ParamsInit.h: Fix typo \"version 2,1\"" }, "318778@main": { "author": "Fady Farag", "avatar": "https://www.gravatar.com/avatar/0ac5127c69f90d0c57054173ae4c3108?d=identicon\u0026s=64", "cl": "318778@main", "clUrl": "https://commits.webkit.org/318778@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321218\nrdar://184271782\n\nReviewed by Darin Adler.\n\nPreviously, MediaRecorderPrivateWriter::writeFrames() removed the sample\nfrom m_pendingFrames before calling writeFrame(). That caused the sample\nto be destroyed instead of retried when writeFrame() returned NotReady,\ncontradicting the adjacent comment and discarding one frame. This removes\nthe sample from the deque if and only if writeFrame() returned Success,\nwhich is the intended behavior.\n\n* Source/WebCore/platform/mediarecorder/MediaRecorderPrivateWriter.cpp:\n(WebCore::MediaRecorderPrivateWriter::writeFrames):\n\nCanonical link: https://commits.webkit.org/318778@main", "email": "com.webkit.iidmsa@gmail.com", "hash": "2c529b89097add1b320d3db123d7fa9ef8456329", "subject": "MediaRecorder drops a frame whenever the writer input reports not ready" }, "318779@main": { "author": "Antti Koivisto", "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64", "cl": "318779@main", "clUrl": "https://commits.webkit.org/318779@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320716\nrdar://183702060\n\nReviewed by Alan Baradlay.\n\nImplement per-property highlight cascade per\n\nhttps://drafts.csswg.org/css-pseudo-4/#highlight-cascade\n\n\"When any supported property is not given a value by the cascade, or given a value of inherit or unset,\nits specified value is determined by inheritance from the corresponding highlight pseudo-element of its\noriginating element’s parent element. This occurs regardless of whether that property is an inherited property.\"\n\nThis requires adding highlight specific inheritance paths to style builder.\n\nTest: imported/w3c/web-platform-tests/css/css-pseudo/highlight-cascade/highlight-cascade-parent-style-change.html\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo/highlight-cascade/highlight-cascade-007-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo/highlight-cascade/highlight-cascade-parent-style-change-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo/highlight-cascade/highlight-cascade-parent-style-change.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo/highlight-cascade/highlight-cascade-shadow-boundary-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo/highlight-cascade/highlight-cascade-shadow-boundary.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo/highlight-cascade/highlight-currentcolor-computed-inheritance-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo/highlight-cascade/highlight-pseudos-inheritance-computed-001-expected.txt:\n* Source/WebCore/css/CSSProperties.json:\n* Source/WebCore/css/CSSProperty.h:\n* Source/WebCore/css/query/ContainerQueryFeatures.cpp:\n(WebCore::CQ::Features::StyleFeatureSchema::evaluateRange const):\n\nDesignated initializers for BuilderContext, so that adding a member doesn't silently shift\nthe arguments. Same for ResolutionContext in StyleTreeResolver.cpp below.\n\n* Source/WebCore/css/scripts/process-css-properties.py:\n(StylePropertyCodeGenProperties):\n(StylePropertyCodeGenProperties.from_json):\n(applies_to_highlight_pseudo_elements):\n(inherits_in_highlight_pseudo_elements):\n(GenerateCSSPropertyNames):\n* Source/WebCore/css/scripts/test/TestCSSProperties.json:\n* Source/WebCore/css/scripts/test/TestCSSPropertiesResults/CSSPropertyNames.gperf:\n* Source/WebCore/css/scripts/test/TestCSSPropertiesResults/StyleBuilderGenerated.cpp:\n(WebCore::Style::BuilderFunctions::applyHighlightInheritTestColorPropertyWithVisitedLinkSupport):\n(WebCore::Style::BuilderFunctions::applyHighlightInheritTestRenderStyleHasExplicitlySetPolicyAllAuthorOrigin):\n(WebCore::Style::BuilderGenerated::applyHighlightInheritAllProperties):\n(WebCore::Style::BuilderGenerated::applyHighlightProperty):\n\nNew applies-to-highlight-pseudo-elements codegen property. It generates the allowlist\npredicate and an applyHighlightInherit\u003cProperty\u003e() reading the parent highlight style\ninstead of the parent style. Its \"yes-without-inheritance\" value is for fill and stroke,\nwhich stay allowed but keep inheriting from the originating element: the applicable\nproperty list has 'fill-color' and 'stroke-color', which we don't support, rather than\nthe SVG paint properties.\n\nstyle-builder-custom takes HighlightInitial, HighlightInherit and HighlightValue for the\nproperties that need more than reading a value out of the parent highlight style.\n\n* Source/WebCore/rendering/style/RenderStyleConstants.h:\n\nA highlight pseudo-element exists whenever it exists for the parent element, since it\ninherits from it even with no rules of its own. The bits get propagated to the children\nso that the early return in RenderElement::resolvePseudoElementStyle() keeps working\nwithout gating out descendants that match nothing themselves.\n\n* Source/WebCore/style/MatchedDeclarationsCache.cpp:\n(WebCore::Style::MatchedDeclarationsCache::isCacheable):\n\nThe parent highlight style is not part of the cache key, and copyNonInheritedFrom() on a\nhit would drop the inherited background-color and text-decoration values.\n\n* Source/WebCore/style/PropertyAllowlist.cpp:\n(WebCore::Style::isValidHighlightStyleProperty):\n\nThe allowlist is generated now. Custom properties are not in the applicable property list\nbut are allowed, since they can be substituted into the properties that are.\n\n* Source/WebCore/style/StyleBuilder.cpp:\n(WebCore::Style::Builder::applyHighlightInheritance):\n(WebCore::Style::Builder::applyProperty):\n* Source/WebCore/style/StyleBuilder.h:\n\nA highlight style applies every property through applyHighlightProperty(), which uses the\nhighlight version of a function where there is one and otherwise falls back to\napplyProperty(), so the normal path has no highlight code in it.\n\nunset inherits instead of resolving to the initial value, which is what makes the\nnon-inherited properties like background-color participate.\n\n* Source/WebCore/style/StyleBuilderCustom.h:\n(WebCore::Style::BuilderCustom::applyHighlightInitialColor):\n(WebCore::Style::BuilderCustom::applyHighlightValueColor):\n(WebCore::Style::BuilderCustom::applyHighlightInheritColor):\n\ncurrentcolor in a highlight pseudo-element is the originating element's color, so the\nchain inherits the keyword rather than the color it resolved to. These are the only\nfunctions that write the bit for it.\n\n* Source/WebCore/style/StyleBuilderGenerated.h:\n* Source/WebCore/style/StyleBuilderState.h:\n* Source/WebCore/style/StyleBuilderStateInlines.h:\n(WebCore::Style::BuilderState::isBuildingHighlightStyle const):\n\nparentHighlightStyle() returns a pointer, since it is null at the start of the chain,\nwhere the inherited value is the initial value except for color.\n\n* Source/WebCore/style/StyleResolver.cpp:\n(WebCore::Style::Resolver::State::State):\n(WebCore::Style::Resolver::State::parentHighlightStyle const):\n(WebCore::Style::Resolver::builderContext const):\n(WebCore::Style::Resolver::unadjustedStyleForElement):\n(WebCore::Style::parentHighlightStyleIgnoringPendingUpdate):\n(WebCore::Style::Resolver::styleForPseudoElement):\n(WebCore::Style::Resolver::applyMatchedProperties):\n* Source/WebCore/style/StyleResolver.h:\n\nThe chain is resolved one level per style, each cached in the ancestor's style, and\nfollows the flat tree like the rest of inheritance, so it continues past a shadow\nboundary to the host. A highlight pseudo-element with no rules of its own now gets a\nstyle too, so that it can pass the inherited values on to its descendants.\n\nThe parent highlight style comes in with the ResolutionContext, because highlight styles\nare also re-resolved during tree resolution, where the parent's existing computed style\nis the one being replaced. The lazy paths still walk up to find it, which is correct\nthere since nothing is being resolved.\n\n* Source/WebCore/style/StyleTreeResolver.cpp:\n(WebCore::Style::TreeResolver::makeResolutionContext):\n(WebCore::Style::TreeResolver::makeResolutionContextForPseudoElement):\n(WebCore::Style::TreeResolver::makeResolutionContextForInheritedFirstLine):\n(WebCore::Style::TreeResolver::resolveAgainInDifferentContext):\n(WebCore::Style::TreeResolver::applyCascadeAfterAnimation):\n* Source/WebCore/style/computed/StyleComputedStyleBase+GettersInlines.h:\n(WebCore::Style::ComputedStyleBase::colorIsCurrentColorForHighlight const):\n(WebCore::Style::ComputedStyleBase::highlightPseudoElementTypes const):\n* Source/WebCore/style/computed/StyleComputedStyleBase+SettersInlines.h:\n(WebCore::Style::ComputedStyleBase::setColorIsCurrentColorForHighlight):\n* Source/WebCore/style/computed/StyleComputedStyleBase.h:\n* Source/WebCore/style/computed/data/StyleInheritedData.cpp:\n(WebCore::Style::InheritedData::InheritedData):\n(WebCore::Style::InheritedData::fastPathInheritedEqual const):\n(WebCore::Style::InheritedData::fastPathInheritFrom):\n(WebCore::Style::InheritedData::dumpDifferences const):\n* Source/WebCore/style/computed/data/StyleInheritedData.h:\n\nThe bit lives with the color it describes, so it travels with inheritFrom() and the fast\npath without any handling of its own.\n\n* Tools/Scripts/webkitpy/style/checkers/jsonchecker.py:\n(JSONCSSPropertiesChecker.check_codegen_properties):\n\nCanonical link: https://commits.webkit.org/318779@main", "email": "antti@apple.com", "hash": "9334b44ff7ef9b546018ba0417e9f0f0cfaddc22", "subject": "[Custom Highlight] ::highlight() pseudo-elements should inherit from the parent element's highlight." }, "318780@main": { "author": "Keith Miller", "avatar": "https://www.gravatar.com/avatar/bddc1595b29098429a6ce7c8bf4aced2?d=identicon\u0026s=64", "cl": "318780@main", "clUrl": "https://commits.webkit.org/318780@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321217\nrdar://183142160\n\nReviewed by Yusuke Suzuki.\n\nIn 313475@main we added support for Array.p.unshift in the DFG based on\nArray.push. Unlike Array.push, when relocating elements they may become\ninvisible to the GC. Since we inline the case where there is exactly\none element being prepended to the array and we don't know what the\ncontents of the array are we always have to writeBarrier the array.\n\nTest: JSTests/stress/array-unshift-moved-cell-barrier.js\nCanonical link: https://commits.webkit.org/318780@main", "email": "keith_miller@apple.com", "hash": "f641af0b8e472dd959f5e0763e18a68072bfca6e", "subject": "Add missing writeBarrier to Array.unshift" }, "318781@main": { "author": "Sihui Liu", "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64", "cl": "318781@main", "clUrl": "https://commits.webkit.org/318781@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321234\nrdar://184280149\n\nReviewed by Chris Dumez.\n\nCache::traverse decoded every visited record into an Entry before handing it to its client, and every client that\ntraverses only needs the response URL, to match the record against an origin or a registrable domain. Decoding an\nEntry deserializes the whole ResourceResponse, so each record costs a full HTTP header map rebuild plus a SecTrust\ndeserialization, which DER-decodes and hashes the response's certificate chain, and this could be costly.\n\nTo reduce the cost, this patch adds Entry::decodeStorageRecordResponseURL, which only decodes URL from response and\nstops there -- the Entry::encodeAsStorageRecord writes the response first, and Coder\u003cWebCore::ResourceResponse\u003e writes\nm_isNull followed by m_url, so the URL is at the start of the record header and is decoded early.\n\nAlso, this patch adds assertion in decodeStorageRecord to ensure the decode URL is the same as Entry::response().url(),\nso that reordering the coder's fields cannot silently turn the fast path into reading some other field as a URL.\n\nCache::traverse is replaced with Cache::traverseRecords, which hands out the undecoded Storage::Record and lets the\nclient decide what it needs, and convert the four clients that only need an origin.\n\nOne behavior difference: a record that failed to decode was previously skipped inside Cache::traverse, whichever field\nfailed. Now only a record whose URL cannot be decoded is skipped, so a record with a readable URL but a corrupt later\nfield becomes deletable, which seems more useful than keeping it around forever.\n\nThe new test WKWebsiteDataStore.RemoveDiskCacheDataForOrigin covers both directions of Cache::deleteData, that the\nrequested origin's entries are gone, and that another origin's entries are left alone.\n\n* Source/WebKit/NetworkProcess/NetworkProcess.cpp:\n(WebKit::NetworkProcess::deleteWebsiteDataForOrigin):\n* Source/WebKit/NetworkProcess/cache/NetworkCache.cpp:\n(WebKit::NetworkCache::Cache::traverseRecords):\n(WebKit::NetworkCache::Cache::fetchData):\n(WebKit::NetworkCache::Cache::deleteData):\n(WebKit::NetworkCache::Cache::deleteDataForRegistrableDomains):\n(WebKit::NetworkCache::Cache::traverse): Deleted.\n* Source/WebKit/NetworkProcess/cache/NetworkCache.h:\n* Source/WebKit/NetworkProcess/cache/NetworkCacheEntry.cpp:\n(WebKit::NetworkCache::Entry::decodeStorageRecord):\n(WebKit::NetworkCache::Entry::decodeStorageRecordResponseURL):\n* Source/WebKit/NetworkProcess/cache/NetworkCacheEntry.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebsiteDataStoreCustomPaths.mm:\n(TEST(WKWebsiteDataStore, RemoveDiskCacheDataForOrigin)):\n\nCanonical link: https://commits.webkit.org/318781@main", "email": "sihui_liu@apple.com", "hash": "db5ab4766a6212b3b8da3fc4a491f50b1ef8095c", "subject": "Network cache traversal decodes every record in full just to read its URL" }, "318782@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "318782@main", "clUrl": "https://commits.webkit.org/318782@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321198\n\nReviewed by Antti Koivisto.\n\nLineLayout::isSelfCollapsingContent() looks for the block level box on a line so it can ask whether that\nbox is self-collapsing. It iterates the line's display boxes with\n\n for (auto index = line.firstBoxIndex(); index \u003c line.lastBoxIndex(); ++index)\n\nbut lastBoxIndex() is firstBoxIndex() + boxCount() - 1, an inclusive index, so the last box on the line is\nnever examined. A block level box on a line is typically the last box on it, in which case the look-up\nreturns nullptr and the \"renderBox \u0026\u0026 !renderBox-\u003eisSelfCollapsingBlock()\" test is skipped altogether.\n\n* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:\n(WebCore::LayoutIntegration::LineLayout::isSelfCollapsingContent const):\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/block-with-table-content-is-not-self-collapsing.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/block-with-table-content-is-not-self-collapsing-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/318782@main", "email": "zalan@apple.com", "hash": "0848b3fb1bb07d7db687e1a6a60fcbe5f333e9b6", "subject": "[block-in-inline] A block whose content is a table is treated as self-collapsing" }, "318783@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "318783@main", "clUrl": "https://commits.webkit.org/318783@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321205\n\nReviewed by Antti Koivisto.\n\npreviousLinePosition() and nextLinePosition() step to the adjacent line box and put the caret on it. They\nalready skip lines that are not lines of text to land on - zero height ones, and ones with no leaf box -\nand fall back to a candidate search that walks the tree for the real position instead.\n\nA line holding a block level box belongs in that same category. The caret does not go on that line, it\ngoes on a line inside the block, which is what the candidate search finds. Accepting the line instead\nresolves the position through the block level box: closestBoxForHorizontalPosition() returns it,\neditingIgnoresContent() is true for it, and the caret ends up in front of the whole block. In\nend-of-document.html moving the caret backward by line from the end of the document lands it at the very\nstart instead of on the previous line.\n\n* Source/WebCore/editing/VisibleUnits.cpp:\n(WebCore::previousLinePosition):\n(WebCore::nextLinePosition):\n\nCanonical link: https://commits.webkit.org/318783@main", "email": "zalan@apple.com", "hash": "411d06d64c29c07e5f685564bab966a45c56caa8", "subject": "[anon-block-removal] Fix editing/selection/end-of-document.html" }, "318784@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "318784@main", "clUrl": "https://commits.webkit.org/318784@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321182\nrdar://184241045\n\nReviewed by Yijia Huang.\n\nCurrently memory64 crashes when growing a shared buffer more than 4GB.\nWe have an inconsistency in our current implementation in terms of\nsize. ArrayBuffer's maximum size is right now 4GB, but Wasm::Memory's\nmaximum reserved size is 2^37-1 pages, which is way more than the\nactually usable memory (8PB).\n\nThis patch overhauls the design and the limit of ArrayBuffer / Wasm::Memory\nsizing.\n\n1. Now ArrayBuffer max size is bumped from 4GB to 16GB, aligning to V8's\n number. Also this 16GB is aligned to the spec's limit size[1].\n \"The maximum size of a 64-bit memory is 262,144 pages (16 GiB).\"\n Because of our LARGE_TYPED_ARRAYS work, size of ArrayBuffer can be\n larger than 4GB already, so changing this is not hard. On 32bit\n environment, no threshold change is done.\n2. We introduce a limit for memory32 and memory64 based on the spec[1].\n 4GB for memory32 and 16GB for memory64.\n3. We also found that some of WebCore side is truncating size of\n ArrayBuffer to `unsinged` (32bit) while it can be 64bit size before\n this change. They are semantically incorrect but it is fine (just\n only handling small sized part), but anyway, fixing them.\n4. Also avoid calling GC while taking a lock of BufferMemoryHandle.\n5. This also revealed many of WebGL issues too, where it is not using\n `unsinged long long` while spec requires so. This patch fixes them\n too as they started becoming failures after ArrayBuffer can get\n larger size than 32bit.\n\nThree web-visible behavior changes fall out of this:\n\n1. A memory64 may now declare a maximum of at most 262144 pages, down from\n PageCount's own 2^37-1. A module declaring more used to compile and\n instantiate at its initial size and now fails WebAssembly.Module(), which\n matches V8's kV8MaxWasmMemory64Pages. JSTests/wasm/v8/memory64.js's two\n tests for this are re-enabled.\n2. A memory's buffer reports the maximum this platform could actually grow it\n to, rather than the one the address type permits declaring, so that a resize\n within maxByteLength never fails deterministically. The two differ wherever\n the Primitive address space budget is the tighter bound.\n3. RTCPeerConnection.generateCertificate() reads publicExponent as the big\n endian WebCrypto BigInteger it is, rather than little endian, and accepts\n arbitrary leading zero padding. WebSocket.send() now fails the connection\n for a binary payload too large to frame instead of dropping it or crashing.\n\n[1]: https://www.w3.org/TR/wasm-js-api-2/#limits\n\nTests: JSTests/stress/array-buffer-slice-larger-than-4gb.js\n JSTests/wasm/stress/memory64-grow-past-4gb.js\n JSTests/wasm/stress/memory64-maximum-limits.js\n webrtc/generate-certificate-public-exponent.html\n\n* JSTests/stress/array-buffer-slice-larger-than-4gb.js: Added.\n(shouldBe):\n* JSTests/stress/shared-array-buffer-large-maxbytelength.js:\n(catch):\n* JSTests/stress/typedarray-canonical-numeric-index-string-past-max-array-index.js: Added.\n(shouldBe):\n(const.key.of.keys.array.key.valueOf):\n* JSTests/stress/typedarray-index-past-max-array-index.js: Added.\n(shouldBe):\n(catch):\n(array.undefined.String):\n* JSTests/wasm/js-api/memory-toResizableBuffer.js:\n(assertTrue):\n* JSTests/wasm/js-api/memory64-js-api-errors.js:\n(assert.throws):\n* JSTests/wasm/js-api/memory64-js-api.js:\n(assert.throws):\n* JSTests/wasm/stress/memory64-grow-past-4gb.js: Added.\n(catch):\n(true.try.mem.await.instantiate.module.memory):\n(true.catch):\n(true.canHostPastFourGiB.catch):\n(assert.throws.grow):\n* JSTests/wasm/stress/memory64-maximum-limits.js: Added.\n(true.try.mem.await.instantiate.module.memory):\n(true.catch):\n* JSTests/wasm/stress/memory64-oversized-limits.js:\n(moduleBytesWithMemoryLimits):\n* JSTests/wasm/v8/memory64.js:\n(BasicMemory64Tests):\n(TestBulkMemoryOperations): Deleted.\n* LayoutTests/fast/canvas/webgl/array-unit-tests.html:\n* LayoutTests/fast/canvas/webgl/webgl-array-invalid-ranges.html:\n* LayoutTests/fast/canvas/webgl/webgl2-array-buffer-view-offset-past-32-bits-expected.txt: Added.\n* LayoutTests/fast/canvas/webgl/webgl2-array-buffer-view-offset-past-32-bits.html: Added.\n* LayoutTests/http/tests/websocket/tests/hybi/bufferedAmount-past-32-bits-after-close-expected.txt: Added.\n* LayoutTests/http/tests/websocket/tests/hybi/bufferedAmount-past-32-bits-after-close.html: Added.\n* LayoutTests/webrtc/generate-certificate-public-exponent-expected.txt: Added.\n* LayoutTests/webrtc/generate-certificate-public-exponent.html: Added.\n* Source/JavaScriptCore/runtime/ArrayBuffer.cpp:\n(JSC::tryAllocateResizableMemory):\n(JSC::ArrayBuffer::resize):\n(JSC::SharedArrayBufferContents::grow):\n(JSC::SharedArrayBufferContents::tryGrow):\n* Source/JavaScriptCore/runtime/ArrayBuffer.h:\n* Source/JavaScriptCore/runtime/BufferMemoryHandle.cpp:\n(JSC::BufferMemoryHandle::fastMappedBytes):\n* Source/JavaScriptCore/runtime/BufferMemoryHandle.h:\n* Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp:\n(JSC::arrayBufferSlice):\n* Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h:\n(JSC::JSGenericTypedArrayView\u003cAdaptor\u003e::getOwnPropertySlot):\n(JSC::JSGenericTypedArrayView\u003cAdaptor\u003e::put):\n(JSC::JSGenericTypedArrayView\u003cAdaptor\u003e::defineOwnProperty):\n(JSC::JSGenericTypedArrayView\u003cAdaptor\u003e::deleteProperty):\n* Source/JavaScriptCore/runtime/PageCount.h:\n* Source/JavaScriptCore/runtime/PropertyName.h:\n(JSC::isCanonicalNumericIndexString):\n* Source/JavaScriptCore/wasm/WasmAddressType.cpp:\n* Source/JavaScriptCore/wasm/WasmAddressType.h:\n(JSC::Wasm::AddressType::AddressType):\n(JSC::Wasm::AddressType::is64Bit const):\n* Source/JavaScriptCore/wasm/WasmLimits.h:\n(JSC::Wasm::maxDeclarablePages):\n(JSC::Wasm::maxBufferByteLength):\n(JSC::Wasm::static_assert):\n* Source/JavaScriptCore/wasm/WasmMemory.cpp:\n(JSC::Wasm::maxAllocatableBytes):\n(JSC::Wasm::Memory::tryCreate):\n(JSC::Wasm::Memory::growShared):\n(JSC::Wasm::Memory::grow):\n* Source/JavaScriptCore/wasm/WasmMemory.h:\n* Source/JavaScriptCore/wasm/WasmSectionParser.cpp:\n(JSC::Wasm::SectionParser::parseMemoryHelper):\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyMemory.cpp:\n(JSC::JSWebAssemblyMemory::associateArrayBuffer):\n* Source/JavaScriptCore/wasm/js/WebAssemblyMemoryConstructor.cpp:\n(JSC::WebAssemblyMemoryConstructor::createMemoryFromDescriptor):\n* Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp:\n(WebCore::certificateTypeFromAlgorithmIdentifier):\n* Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.h:\n* Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:\n(WebCore::ThreadableWebSocketChannelClientWrapper::didUpdateBufferedAmount):\n(WebCore::ThreadableWebSocketChannelClientWrapper::didClose):\n* Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.h:\n* Source/WebCore/Modules/websockets/WebSocket.cpp:\n(WebCore::saturateAdd):\n(WebCore::isFramablePayloadSize):\n(WebCore::WebSocket::send):\n(WebCore::WebSocket::bufferedAmount const):\n(WebCore::WebSocket::didUpdateBufferedAmount):\n(WebCore::WebSocket::didClose):\n* Source/WebCore/Modules/websockets/WebSocket.h:\n* Source/WebCore/Modules/websockets/WebSocket.idl:\n* Source/WebCore/Modules/websockets/WebSocketChannelClient.h:\n* Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp:\n(WebCore::WorkerThreadableWebSocketChannel::send):\n(WebCore::WorkerThreadableWebSocketChannel::Peer::didUpdateBufferedAmount):\n(WebCore::WorkerThreadableWebSocketChannel::Peer::didClose):\n(WebCore::WorkerThreadableWebSocketChannel::Bridge::send):\n* Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.h:\n* Source/WebCore/css/FontFace.cpp:\n(WebCore::FontFace::create):\n* Source/WebCore/fileapi/NetworkSendQueue.cpp:\n(WebCore::NetworkSendQueue::enqueue):\n* Source/WebCore/fileapi/NetworkSendQueue.h:\n* Source/WebCore/html/canvas/WebGL2RenderingContext.cpp:\n(WebCore::WebGL2RenderingContext::arrayBufferViewSliceFactory):\n(WebCore::WebGL2RenderingContext::sliceArrayBufferView):\n(WebCore::WebGL2RenderingContext::bufferData):\n(WebCore::WebGL2RenderingContext::bufferSubData):\n(WebCore::WebGL2RenderingContext::getBufferSubData):\n(WebCore::WebGL2RenderingContext::texImage2D):\n(WebCore::WebGL2RenderingContext::texImage3D):\n(WebCore::WebGL2RenderingContext::texSubImage2D):\n(WebCore::WebGL2RenderingContext::texSubImage3D):\n(WebCore::WebGL2RenderingContext::compressedTexImage2D):\n(WebCore::WebGL2RenderingContext::compressedTexImage3D):\n(WebCore::WebGL2RenderingContext::compressedTexSubImage2D):\n(WebCore::WebGL2RenderingContext::compressedTexSubImage3D):\n(WebCore::WebGL2RenderingContext::uniform1uiv):\n(WebCore::WebGL2RenderingContext::uniform2uiv):\n(WebCore::WebGL2RenderingContext::uniform3uiv):\n(WebCore::WebGL2RenderingContext::uniform4uiv):\n(WebCore::WebGL2RenderingContext::uniformMatrix2x3fv):\n(WebCore::WebGL2RenderingContext::uniformMatrix3x2fv):\n(WebCore::WebGL2RenderingContext::uniformMatrix2x4fv):\n(WebCore::WebGL2RenderingContext::uniformMatrix4x2fv):\n(WebCore::WebGL2RenderingContext::uniformMatrix3x4fv):\n(WebCore::WebGL2RenderingContext::uniformMatrix4x3fv):\n(WebCore::WebGL2RenderingContext::vertexAttribI4iv):\n(WebCore::WebGL2RenderingContext::vertexAttribI4uiv):\n(WebCore::WebGL2RenderingContext::clearBufferiv):\n(WebCore::WebGL2RenderingContext::clearBufferuiv):\n(WebCore::WebGL2RenderingContext::clearBufferfv):\n(WebCore::WebGL2RenderingContext::validateClearBuffer):\n(WebCore::WebGL2RenderingContext::uniform1fv):\n(WebCore::WebGL2RenderingContext::uniform2fv):\n(WebCore::WebGL2RenderingContext::uniform3fv):\n(WebCore::WebGL2RenderingContext::uniform4fv):\n(WebCore::WebGL2RenderingContext::uniform1iv):\n(WebCore::WebGL2RenderingContext::uniform2iv):\n(WebCore::WebGL2RenderingContext::uniform3iv):\n(WebCore::WebGL2RenderingContext::uniform4iv):\n(WebCore::WebGL2RenderingContext::uniformMatrix2fv):\n(WebCore::WebGL2RenderingContext::uniformMatrix3fv):\n(WebCore::WebGL2RenderingContext::uniformMatrix4fv):\n(WebCore::WebGL2RenderingContext::readPixels):\n* Source/WebCore/html/canvas/WebGL2RenderingContext.h:\n* Source/WebCore/html/canvas/WebGL2RenderingContext.idl:\n* Source/WebCore/html/canvas/WebGLMultiDraw.cpp:\n(WebCore::WebGLMultiDraw::validateOffset):\n* Source/WebCore/html/canvas/WebGLMultiDraw.h:\n* Source/WebCore/html/canvas/WebGLMultiDrawInstancedBaseVertexBaseInstance.cpp:\n(WebCore::WebGLMultiDrawInstancedBaseVertexBaseInstance::validateOffset):\n* Source/WebCore/html/canvas/WebGLMultiDrawInstancedBaseVertexBaseInstance.h:\n* Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp:\n(WebCore::WebGLRenderingContextBase::texImageArrayBufferViewHelper):\n(WebCore::WebGLRenderingContextBase::validateTexFuncData):\n(WebCore::WebGLRenderingContextBase::validateUniformMatrixParameters):\n(WebCore::WebGLRenderingContextBase::vertexAttribfvImpl):\n* Source/WebCore/html/canvas/WebGLRenderingContextBase.h:\n(WebCore::WebGLRenderingContextBase::TypedList::length const):\n(WebCore::WebGLRenderingContextBase::validateUniformParameters):\n* Source/WebCore/platform/graphics/iso/ISOBox.cpp:\n(WebCore::isWalkableView):\n(WebCore::ISOBox::peekBox):\n(WebCore::ISOBox::parse):\n* Source/WebKit/WebProcess/Network/WebSocketChannel.cpp:\n(WebKit::WebSocketChannel::send):\n* Source/WebKit/WebProcess/Network/WebSocketChannel.h:\n* Source/WebKitLegacy/WebCoreSupport/WebSocketChannel.cpp:\n(WebCore::WebSocketChannel::send):\n* Source/WebKitLegacy/WebCoreSupport/WebSocketChannel.h:\n* Source/bmalloc/bmalloc/Gigacage.h:\n\nCanonical link: https://commits.webkit.org/318784@main", "email": "ysuzuki@apple.com", "hash": "2c2c1af3574308929fecb71bc1897b8f6b04dc2e", "subject": "[JSC] Overhaul ArrayBuffer \u0026 Wasm::Memory sizing with memory64" }, "318785@main": { "author": "Yijia Huang", "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64", "cl": "318785@main", "clUrl": "https://commits.webkit.org/318785@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321189\nrdar://184247766\n\nReviewed by Yusuke Suzuki.\n\nAdd isoDateToFields and calendarMergeFields, plus the CalendarFieldKeysPresent,\nCalendarFieldKeysToIgnore and NonISOFieldKeysToIgnore operations they rest on.\nEvery .with() entry point previously hand-fused those steps with its own\nfield-priority rules, PlainMonthDay's in 44 lines, and the MergeMode enum they\nneeded is gone. differenceYearMonth's two hand-rolled copies of\nISODateToFields(~year-month~) are converted too.\n\nCalendarFieldKeysToIgnore is what makes a year-only change correct on a\nlunisolar calendar: month and monthCode encode one field, so setting either must\ndiscard the other. Carrying the ordinal across a year change picks the wrong\nmonth once a leap month precedes it — chinese M05 is ordinal 5 in 2018, 6 in\n2020.\n\nThis also fixes PlainYearMonth.prototype.add/subtract shifting the month by a\nconstant -2 for \"buddhist\", \"roc\" and \"japanese\" when the receiver's ISO year\nwas in roughly 1..1582, confirmed pre-existing by A/B against a pre-conversion\nbuild. Root cause never established.\n\nAdd calendarDayOfWeek, calendarWeekOfYear and calendarYearOfWeek so all fifteen\nCalendarISOToDate fields reach the getters through one accessor family; the\nspec's \"undefined for calendars with no well-defined week calendar system\" rule\nwas re-derived at six getter sites and is now one std::optional. Remove the\neight forwarders this leaves unreferenced.\n\nInline TemporalPlainTime::with into its prototype, and restore\nZonedDateTime.prototype.with to spec step order: steps 9, 10-16 and 18 ran after\n19-22, so ISODateToFields could throw only after the options getters had run.\n\nTests: JSTests/stress/temporal-calendar-merge-fields-with.js\n JSTests/stress/temporal-isodatetofields-call-sites.js\n Source/JavaScriptCore/API/tests/TemporalCoreTest.cpp\n\nCanonical link: https://commits.webkit.org/318785@main", "email": "yijia_huang@apple.com", "hash": "399973c04a04c5fbd4519c6b51f28a54b1acf59a", "subject": "[JSC][Temporal] Implement ISODateToFields and CalendarMergeFields as the spec's own operations" }, "318786@main": { "author": "Marta Darbinyan", "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64", "cl": "318786@main", "clUrl": "https://commits.webkit.org/318786@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321298\nrdar://184338230\n\nUnreviewed test Gardening\n\nSkipping the crashing tests in Release.\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318786@main", "email": "darbinyan@apple.com", "hash": "e5dca40404776fba8994f658918fd4a1eaaf0f5a", "subject": "[Gardening]: REGRESSION(318767@main): [macOS Release] imported/w3c/web-platform-tests/wasm/serialization/memory/window-success.tentative.https.html is a flaky crash" }, "318787@main": { "author": "Aakash Jain", "avatar": "https://www.gravatar.com/avatar/e82e0cafeeac3a35b7e74206ebe4c536?d=identicon\u0026s=64", "cl": "318787@main", "clUrl": "https://commits.webkit.org/318787@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321296\nrdar://184338133\n\nReviewed by Ryan Haddad.\n\nRead GITHUB_HOOK_SECRET into a local and stop the master at configuration load\nwhen it is not set, instead of passing an empty value through to buildbot. The\nchange hook handler is only constructed once the first request arrives, so a\nmissing secret would otherwise go unnoticed until then.\n\n* Tools/CISupport/build-webkit-org-webserver/master.cfg:\n* Tools/CISupport/ews-build-webserver/master.cfg:\n\nCanonical link: https://commits.webkit.org/318787@main", "email": "aakash_jain@apple.com", "hash": "a06f835dc421f966f73b2bb02dcf778aae2513c4", "subject": "Fail early when buildmaster configuration is incomplete" }, "318788@main": { "author": "Justin Michaud", "avatar": "https://www.gravatar.com/avatar/36e0433ee725a08f7e1122a6bc584b57?d=identicon\u0026s=64", "cl": "318788@main", "clUrl": "https://commits.webkit.org/318788@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320929\n\nReviewed by Yusuke Suzuki.\n\nFixes some minor bugs when trying to run these tests on my machine:\n\n1) Timezones\n2) chars are unsigned on arm64 linux\n3) Flush WTF loggers like surrounding tests\n\nCanonical link: https://commits.webkit.org/318788@main", "email": "jmichaud@igalia.com", "hash": "d3ad5982fcec45b7ccadcd2df37cf917e74a6f9a", "subject": "Fix TestWTF on arm64 linux" }, "318789@main": { "author": "Per Arne Vollan", "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64", "cl": "318789@main", "clUrl": "https://commits.webkit.org/318789@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320761\nrdar://184248998\n\nReviewed by Sihui Liu.\n\nWhen useUIProcessForBackForwardItemLoading is enabled, WebPageProxy::\nframeStateForBackForwardChildFrame resolves a child frame's history\nentry by frame identifier, falling back to matching by sibling\nposition when the identifier isn't found (e.g. after session restore\nor cross-site child-frame recreation). This position-based fallback\ndidn't verify that the entry at that position actually corresponded\nto the same frame: a frame created fresh by script during a back/\nforward-classified reload (e.g. a third-party iframe inserted by an\ninline \u003cscript\u003e before the page's load event) could match, by pure\nposition, a stale entry left behind by an earlier, differently-named\niframe that occupied the same child slot. The new frame was then\nmisrouted into loading that stale entry's URL and got stuck instead\nof loading its own.\n\nThis is fixed by checking the frame name before falling back to\nposition.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n(TestWebKitAPI::TEST(SiteIsolation, GoBackReloadsDynamicallyCreated-\nCrossSiteIframe))\n\n* Source/WebKit/Shared/WebBackForwardListFrameItem.cpp:\n(WebKit::WebBackForwardListFrameItem::childItemForFrameName):\n* Source/WebKit/Shared/WebBackForwardListFrameItem.h:\n* Source/WebKit/UIProcess/WebBackForwardList.cpp:\n(WebKit::WebBackForwardList::findFrameStateInItem):\n* Source/WebKit/UIProcess/WebBackForwardList.h:\n* Source/WebKit/UIProcess/WebBackForwardList.swift:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::frameStateForBackForwardChildFrame):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::TEST(SiteIsolation, GoBackReloadsDynamicallyCreatedCrossSiteIframe)):\n\nCanonical link: https://commits.webkit.org/318789@main", "email": "pvollan@apple.com", "hash": "eb46d8c72c1f3ca11fe79ebeb31bf546bda2daba", "subject": "Dynamically created cross-site iframe gets stuck on about:blank after a back/forward reload" }, "318790@main": { "author": "Ari Young", "avatar": "https://www.gravatar.com/avatar/0cd464869823d95556c74fd9f9419f92?d=identicon\u0026s=64", "cl": "318790@main", "clUrl": "https://commits.webkit.org/318790@main", "description": "rdar://182752551\nhttps://bugs.webkit.org/show_bug.cgi?id=321128\n\nReviewed by Timothy Hatcher.\n\nThe sidebar pane was rendered per tab rather than per window: every tab was given its own\nsidebar object and its own WKWebView, even when the extension had set nothing specific to that\ntab. Switching between such tabs tore down one sidebar and built an identical one instead of\nleaving the window's sidebar in place, and changes made at the window (or global) tier were not\nreflected on the tabs that inherited them.\n\nMake each window own a single sidebar whose WKWebView is shared by every tab that sets no panel\nof its own; a tab gets its own sidebar and web view only while it overrides its own panel path.\nsidebarForTab: hands back that shared object for every non-overriding tab, so the browser can\ncompare successive results by identity to decide whether the displayed sidebar must change on a\ntab switch. A tab sidebar is discarded once it stops overriding anything, and the browser is told\nto drop it through the new didInvalidateSidebar: delegate method.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPISidebar.mm\n\n* Source/WebKit/UIProcess/API/Cocoa/WKWebExtensionContext.mm:\n(-[WKWebExtensionContext sidebarForTab:]):\n Resolve through the shared per-window sidebar rather than creating a tab-specific one.\n* Source/WebKit/UIProcess/API/Cocoa/WKWebExtensionContextPrivate.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebExtensionControllerDelegatePrivate.h:\n* Source/WebKit/UIProcess/API/Cocoa/_WKWebExtensionSidebar.h:\n* Source/WebKit/UIProcess/API/Cocoa/_WKWebExtensionSidebar.mm:\n(-[_WKWebExtensionSidebar title]):\n(-[_WKWebExtensionSidebar viewController]):\n(-[_WKWebExtensionSidebar webView]):\n(-[_WKWebExtensionSidebar willOpenSidebarFromUserInteraction:]):\n(-[_WKWebExtensionSidebar associatedWindow]):\n The sidebar's window, or its tab's window for a tab-specific sidebar.\n(-[_WKWebExtensionSidebar willOpenSidebar]): Deleted.\n* Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPISidebarCocoa.mm:\n(WebKit::WebExtensionContext::notifyDelegateOfSidebarUpdate):\n(WebKit::WebExtensionContext::notifyDelegateOfSidebarInvalidation):\n(WebKit::WebExtensionContext::sidebarOpen):\n Resolve the tab directly; creating a sidebar here would defeat per-window sharing.\n(WebKit::WebExtensionContext::sidebarClose):\n(WebKit::WebExtensionContext::sidebarIsOpen):\n(WebKit::WebExtensionContext::sidebarToggle):\n Reject when no panel is set.\n(WebKit::WebExtensionContext::sidebarSetTitle):\n(WebKit::WebExtensionContext::sidebarGetOptions):\n Use the non-creating resolver so a query never materializes a tab sidebar.\n(WebKit::WebExtensionContext::sidebarSetOptions):\n Apply path and enablement together so one call notifies the browser at most once.\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionContextCocoa.mm:\n(WebKit::WebExtensionContext::unload):\n Clear the sidebar maps, which were never cleared, leaking sidebars and web views across reloads.\n(WebKit::WebExtensionContext::getCurrentTab const):\n(WebKit::WebExtensionContext::didMoveTab):\n(WebKit::WebExtensionContext::performAction):\n(WebKit::WebExtensionContext::sidebarForTab):\n(WebKit::WebExtensionContext::addSidebarPage):\n(WebKit::WebExtensionContext::discardSidebarIfUnmodified):\n Drop a tab sidebar which overrides nothing, unlink it, and notify the delegate it is invalidated.\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionSidebarCocoa.mm:\n(-[_WKWebExtensionSidebarWebViewDelegate webView:decidePolicyForNavigationAction:decisionHandler:]):\n(WebKit::WebExtensionSidebar::hasOverriddenProperties const):\n(WebKit::WebExtensionSidebar::parent const):\n Create the window sidebar when resolving a tab's parent, so it inherits from its window rather\n than falling through to the global sidebar.\n(WebKit::WebExtensionSidebar::propertiesDidChange):\n Report this sidebar to the delegate as well as its children, so a parent-tier change reaches\n the tabs that inherit it.\n(WebKit::WebExtensionSidebar::setIconsDictionary):\n Notify when an icon override is cleared, not only when one is set.\n(WebKit::WebExtensionSidebar::setOptions):\n Replaces setSidebarPath/setEnabled: mutate both, tear down a demoted tab's web view, reload the\n shared web views, and notify at most once.\n(WebKit::WebExtensionSidebar::willOpenSidebar):\n Grant activeTab only for a user-initiated open, so an extension cannot grant itself the\n permission by changing a tab's sidebar.\n(WebKit::WebExtensionSidebar::willCloseSidebar):\n(WebKit::WebExtensionSidebar::didReceiveUserInteraction):\n(WebKit::WebExtensionSidebar::viewController):\n(WebKit::WebExtensionSidebar::webView):\n(WebKit::WebExtensionSidebar::parentPropertiesWereUpdated):\n(WebKit::WebExtensionSidebar::notifyChildrenOfPropertyUpdate):\n(WebKit::WebExtensionSidebar::notifyDelegateOfPropertyUpdate):\n(WebKit::WebExtensionSidebar::reloadDescendantWebViews):\n(WebKit::WebExtensionSidebar::setEnabled): Deleted.\n(WebKit::WebExtensionSidebar::setSidebarPath): Deleted.\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.h:\n* Source/WebKit/UIProcess/Extensions/WebExtensionSidebar.h:\n* Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPISidePanelCocoa.mm:\n(WebKit::WebExtensionAPISidePanel::setOptions):\n Reject a call that sets neither path nor enabled, and forward each only when the caller supplied it.\n(WebKit::deserializeSidebarParameters): Deleted.\n* Tools/TestWebKitAPI/Helpers/cocoa/TestWebExtensionsDelegate.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/TestWebExtensionsDelegate.mm:\n(-[TestWebExtensionsDelegate _webExtensionController:didInvalidateSidebar:forExtensionContext:]):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPISidebar.mm:\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidebarActionOpenSucceedsWithUserGesture)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidebarActionCloseSucceedsWithUserGesture)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidePanelOpenForTabSucceedsWithUserGesture)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidePanelOpenForWindowSucceedsWithUserGesture)):\n These four now assert associatedWindow rather than associatedTab, since a tab that overrides\n nothing is shown its window's sidebar.\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, TabsWithoutOverridesShareTheirWindowSidebar)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, DidInvalidateSidebarFiresWhenLastOverrideCleared)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, WillOpenSidebarWithoutUserInteractionDoesNotStartUserGesture)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidePanelSetOptionsRequiresPathOrEnabled)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, TabPanelOverrideSwapsWebViewAndRestoresIt)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, WindowPanelChangeReloadsSharedWebViewInPlace)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, ParentTitleChangeNotifiesInheritingTabSidebar)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SetOptionsNotifiesDelegateAtMostOnce)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, TabSidebarRelinksToNewWindowOnMove)):\n\nCanonical link: https://commits.webkit.org/318790@main", "email": "ari_young@apple.com", "hash": "6815dd9b127c2197d355f3bd4427b37ed9be2cde", "subject": "Web Extensions sidebar is rendered per-tab instead of per-window, even in the absence of tab-specific sidebars" }, "318791@main": { "author": "Patrick Griffis", "avatar": "https://www.gravatar.com/avatar/2233c3a857004b126158572af9fe36f7?d=identicon\u0026s=64", "cl": "318791@main", "clUrl": "https://commits.webkit.org/318791@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321204\n\nReviewed by Carlos Garcia Campos and Adrian Perez de Castro.\n\nBasically all of it was cross-port, it just wasn't hooked up and exposed.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestUIClient.cpp\n\n* Source/WebKit/PlatformWPE.cmake:\n* Source/WebKit/SourcesWPE.txt:\n* Source/WebKit/UIProcess/API/glib/WebKitAutocleanups.h.in:\n* Source/WebKit/UIProcess/API/glib/WebKitClipboardPermissionRequest.cpp:\n* Source/WebKit/UIProcess/API/glib/WebKitClipboardPermissionRequest.h.in:\n* Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp:\n(WebKitWebViewClient::requestClipboardPermission):\n* Source/WebKit/UIProcess/API/glib/webkit.h.in:\n* Source/WebKit/UIProcess/API/wpe/PageClientImpl.cpp:\n(WebKit::PageClientImpl::requestDOMPasteAccess):\n* Source/WebKit/UIProcess/API/wpe/WebKitWebViewClient.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestUIClient.cpp:\n(testWebViewClipboardPermissionRequest):\n(beforeAll):\n\nCanonical link: https://commits.webkit.org/318791@main", "email": "pgriffis@igalia.com", "hash": "062e3932bff008ef3a6c1069e561b372ad534547", "subject": "[WPE] Expose WebKitClipboardPermissionRequest API" }, "318792@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "318792@main", "clUrl": "https://commits.webkit.org/318792@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321236\n\nReviewed by Antti Koivisto.\n\nlayoutSimpleBlockContentInInline() is the fast-path taken when a container with inline children needs\nlayout only because one of its block level boxes does. It walks the block level boxes, lays each one out,\nand takes the MarginInfo the last one leaves behind. The lines are not laid out at all.\n\nThat is fine while the block level box is the only in-flow content, since its margins are then the\ncontainer's own. A line next to the box changes that: the line consumes the adjacent margin as its own\nspacing, so nothing is left to collapse with the container. Normal line layout accounts for this in\nLineBuilder::layoutInlineContent (see updateMarginStateIfNeeded), which does two things once a line places\ncontentful inline content - it resets the margin values, and it leaves the before side of the block. The\nshortcut lays out no lines, so it has to do both itself as the walk passes contentful inline content.\n\n \u003cdiv\u003e\u003cspan\u003e\u003cdiv style=\"margin-bottom: 16px\"\u003eblock\u003c/div\u003e\u003c/span\u003eline after\u003c/div\u003e\n\nreports a 16px margin after on the container once something inside the block changes and this path runs:\nthe margin is still in MarginInfo when the caller hands it to handleAfterSideOfBlock(), so it is counted a\nsecond time.\n\n \u003cdiv\u003eline before\u003cspan\u003e\u003cdiv style=\"margin-top: 16px\"\u003eblock\u003c/div\u003e\u003c/span\u003e\u003c/div\u003e\n\nreports a 16px margin before for the same reason. Resetting the margin values is not enough here, because\ncanCollapseWithMarginBefore() reads m_atBeforeSideOfBlock rather than the values, so collapseMargins()\nstill promotes the block's own margin before into the container's collapsed margin before and the container\nis then repositioned by its parent.\n\n* Source/WebCore/rendering/RenderBlockFlow.cpp:\n(WebCore::RenderBlockFlow::layoutSimpleBlockContentInInline):\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/block-in-inline-margin-after-relayout.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/block-in-inline-margin-after-relayout-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/block-in-inline-margin-before-relayout.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/block-in-inline-margin-before-relayout-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/318792@main", "email": "zalan@apple.com", "hash": "428fd736695d230e39867fdfb6a0fc7b1dc29d68", "subject": "[block-in-inline] A block level box's margin after is counted twice when only that box needs layout" }, "318793@main": { "author": "Vassili Bykov", "avatar": "https://www.gravatar.com/avatar/73ac31c69ff9a621b733e47253103b8a?d=identicon\u0026s=64", "cl": "318793@main", "clUrl": "https://commits.webkit.org/318793@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321188\nrdar://184247644\n\nReviewed by Yusuke Suzuki.\n\nLexer::lexExpectIdentifier() is intended as the fast path for quickly parsing an\nidentifier. It was introduced a long time ago. In the meantime, the baseline\nLexer::parseIdentifier() has been vectorized and now performs better than\nlexExpectIdentifier() with its character-by-character scanning and 4 conditionals.\nRemoving lexExpectIdentifier() simplifies and shrinks hot code and improves performance.\n\nCovered by existing tests.\n\n* Source/JavaScriptCore/parser/Lexer.h:\n(JSC::Lexer\u003cT\u003e::lexExpectIdentifier): Deleted.\n* Source/JavaScriptCore/parser/Parser.cpp:\n(JSC::Parser\u003cLexerType\u003e::parseProperty):\n(JSC::Parser\u003cLexerType\u003e::parseMemberExpression):\n* Source/JavaScriptCore/parser/Parser.h:\n\nCanonical link: https://commits.webkit.org/318793@main", "email": "v_bykov@apple.com", "hash": "71c68f4b3b35d98548525c85b7d740a8c83613db", "subject": "[JSC] Retire Lexer::lexExpectIdentifier()" }, "318794@main": { "author": "Devin Rousso", "avatar": "https://www.gravatar.com/avatar/c9e757d973342c773f107a94b70cb9cd?d=identicon\u0026s=64", "cl": "318794@main", "clUrl": "https://commits.webkit.org/318794@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321150\n\nReviewed by Mike Wyrzykowski.\n\n* Source/JavaScriptCore/inspector/protocol/Canvas.json:\n* Source/WebCore/inspector/InspectorCanvas.h:\n* Source/WebCore/inspector/InspectorCanvas.cpp:\n(WebCore::InspectorCanvas::canvasElements const): Renamed from `canvasElement`.\n(WebCore::InspectorCanvas::cssCanvasClientNodes const): Renamed from `clientNodes`.\n(WebCore::InspectorCanvas::buildObjectForCanvas):\n* Source/WebCore/inspector/agents/page/PageCanvasAgent.h:\n* Source/WebCore/inspector/agents/page/PageCanvasAgent.cpp:\n(WebCore::PageCanvasAgent::requestNodes): Renamed from `requestNode`.\n(WebCore::PageCanvasAgent::requestCSSCanvasClientNodes): Renamed from `requestClientNodes`.\n(WebCore::PageCanvasAgent::frameNavigated):\n(WebCore::PageCanvasAgent::didChangeCSSCanvasClientNodes):\n(WebCore::PageCanvasAgent::didChangeGPUDeviceClientNodes):\n(WebCore::PageCanvasAgent::buildObjectForCanvas): Deleted.\n(WebCore::PageCanvasAgent::nodeIdForCanvas): Deleted.\n(WebCore::PageCanvasAgent::dispatchNodesChanged): Added.\n(WebCore::PageCanvasAgent::dispatchCSSCanvasClientNodesChanged): Renamed from `dispatchClientNodesChanged`.\n(WebCore::PageCanvasAgent::dispatchCSSCanvasNamesChanged): Added.\n* Source/WebCore/inspector/agents/worker/WorkerCanvasAgent.h:\n* Source/WebCore/inspector/agents/worker/WorkerCanvasAgent.cpp:\n(WebCore::WorkerCanvasAgent::requestNodes): Renamed from `requestNode`.\n(WebCore::WorkerCanvasAgent::requestCSSCanvasClientNodes): Renamed from `requestClientNodes`.\nReturn every `HTMLCanvasElement` configured with a `GPUDevice` from `Canvas.requestNodes`, while `Canvas.requestCSSCanvasClientNodes` only returns nodes that consume CSS canvas images.\nPush DOM nodes via `Canvas.nodesChanged` instead of including it in the initial `Canvas`.\n\n* Source/WebInspectorUI/UserInterface/Protocol/CanvasObserver.js:\n(WI.CanvasObserver.prototype.nodesChanged): Added.\n(WI.CanvasObserver.prototype.cssCanvasClientNodesChanged):\n(WI.CanvasObserver.prototype.cssCanvasNamesChanged): Added.\n(WI.CanvasObserver.prototype.clientNodesChanged):\n* Source/WebInspectorUI/UserInterface/Controllers/CanvasManager.js:\n(WI.CanvasManager.prototype.nodesChanged): Renamed from `clientNodesChanged`.\n(WI.CanvasManager.prototype.cssCanvasClientNodesChanged): Added.\n(WI.CanvasManager.prototype.cssCanvasNamesChanged): Added.\n* Source/WebInspectorUI/UserInterface/Models/Canvas.js:\n(WI.Canvas.prototype.constructor):\n(WI.Canvas.fromPayload):\n(WI.Canvas.prototype.get displayName):\n(WI.Canvas.prototype.requestNodes): Renamed from `requestNode`.\n(WI.Canvas.prototype.requestCSSCanvasClientNodes): Renamed from `requestClientNodes`.\n(WI.Canvas.prototype.highlight): Added.\n(WI.Canvas.prototype.saveIdentityToCookie):\n(WI.Canvas.prototype.nodesChanged): Renamed from `clientNodesChanged`.\n(WI.Canvas.prototype.cssCanvasClientNodesChanged): Added.\n(WI.Canvas.prototype.cssCanvasNamesChanged): Added.\n(WI.Canvas.Event):\nUpdate CSS canvas names only from `Canvas.cssCanvasNamesChanged`.\nCentralize hover highlighting logic instead of repeating it in a few places.\n\n* Source/WebInspectorUI/UserInterface/Views/CanvasContentView.js:\n(WI.CanvasContentView.prototype.constructor):\n(WI.CanvasContentView.prototype.attached):\n(WI.CanvasContentView.prototype.detached):\n(WI.CanvasContentView.prototype._populateCanvasElementButtonContextMenu):\n(WI.CanvasContentView.prototype._updateCanvasNode):\n* Source/WebInspectorUI/UserInterface/Views/CanvasDetailsSidebarPanel.js:\n(WI.CanvasDetailsSidebarPanel.prototype.constructor):\n(WI.CanvasDetailsSidebarPanel.prototype.set canvas):\n(WI.CanvasDetailsSidebarPanel.prototype.initialLayout):\n(WI.CanvasDetailsSidebarPanel.prototype._refreshSourceSection):\n(WI.CanvasDetailsSidebarPanel.prototype._refreshClientsSection):\n(WI.CanvasDetailsSidebarPanel.prototype._handleNodesChanged): Added.\n(WI.CanvasDetailsSidebarPanel.prototype._handleCSSCanvasClientNodesChanged): Renamed from `_handleClientNodesChanged`.\n(WI.CanvasDetailsSidebarPanel.prototype._handleCSSCanvasNamesChanged): Added.\n* Source/WebInspectorUI/UserInterface/Views/CanvasOverviewContentView.js:\n(WI.CanvasOverviewContentView.prototype._contentViewMouseEnter):\n* Source/WebInspectorUI/UserInterface/Views/CanvasTreeElement.js:\n(WI.CanvasTreeElement.prototype._handleMouseOver):\nDisplay every configured node in the \"Source\" section.\nRefresh the \"Source\" and \"Client\" sections from their corresponding events.\n\n* LayoutTests/inspector/canvas/requestNode.html:\n* LayoutTests/inspector/canvas/requestNode-expected.txt:\n* LayoutTests/inspector/canvas/requestClientNodes.html:\n* LayoutTests/inspector/canvas/requestClientNodes-expected.txt:\n* LayoutTests/inspector/canvas/requestClientNodes-css.html:\n* LayoutTests/inspector/canvas/requestClientNodes-css-expected.txt:\n* LayoutTests/inspector/canvas/requestClientNodes-webgpu.html:\n* LayoutTests/inspector/canvas/requestClientNodes-webgpu-expected.txt:\n* LayoutTests/inspector/canvas/worker-webgpu.html:\n* LayoutTests/inspector/canvas/worker-webgpu-expected.txt:\n\nCanonical link: https://commits.webkit.org/318794@main", "email": "hi@devinrousso.com", "hash": "af624adbb3bc34102a4e7f99703c9d1350e8fc66", "subject": "Web Inspector: Canvas: distinguish configured WebGPU `\u003ccanvas\u003e` from CSS canvas client nodes" }, "318795@main": { "author": "Issac Roy", "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64", "cl": "318795@main", "clUrl": "https://commits.webkit.org/318795@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321213\nrdar://184270445\n\nReviewed by Ryan Haddad.\n\nGive me committer status.\n\n* metadata/contributors.json:\n\nCanonical link: https://commits.webkit.org/318795@main", "email": "issacroy05@gmail.com", "hash": "ff7f28a16185100b3c1911bc1a95c9d34fa9477b", "subject": "Give Issac Roy committer status" }, "318796@main": { "author": "Ben Nham", "avatar": "https://www.gravatar.com/avatar/dc0914eabf69047ee3397794c2d17bf7?d=identicon\u0026s=64", "cl": "318796@main", "clUrl": "https://commits.webkit.org/318796@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320790\nrdar://183676310\n\nReviewed by Per Arne Vollan.\n\nWe are seeing that remote frame processes are running too long after a main frame navigation due to\nthe remote frame processes holding a page load activity through a navigation (m_networkActivity in\nWebProcessActivityState).\n\nThe reason for this is that when a PSON occurs, we try to move the page load activities from the old\nWebProcesses pre-swap to the new WebProcesses post-swap via NavigationState::didSwapWebProcesses()\n=\u003e WebPageProxy::takeNetworkActivity().\n\nThis works for the main frame because WebPageProxy's m_mainFrameProcessActivityState stays the same\nthrough the navigation.\n\nIt doesn't work for remote frames because a PSON will generally cause a BrowsingContextGroup\nswitch. So by the time WebPageProxy::takeNetworkActivity() runs, its BCG points to a new set of\nRemotePageProxy objects. WebPageProxy has no way of reaching back to the old BCG pre-swap, so it\nalso can't reach the pre-swap RemotePageProxy objects. So the page load activities associated with\nthose old RemotePageProxy objects keep running until the RemotePageProxy dies.\n\nThis becomes a problem when multi-process back/forward cache is enabled, because that can keep a\nRemotePageProxy object alive for a long time (as long as it's in cache). Previously, this wasn't\nreally an issue because RemotePageProxy objects would die soon after the PSON.\n\nMy first attempt at fixing this (318458@main) was extremely simple: I just reset m_networkActivity\ninside WebProcessActivityState::reset. However, while this works to fix this bug, it caused a large\nPLT regression through another convoluted chain of events:\n\n1. The network activity might be the last activity for the process, causing it to suspend.\n2. WebProcess::prepareToSuspend runs and thinks the process isn't in the process cache, so it dumps\nall caches (see 289156@main).\n3. We then shortly thereafter put this process in the process cache with cold caches, which leads to\na PLT regression.\n\nSo this is my second attempt at fixing the issue. Instead of preemptively dropping the network\nactivity in WebProcessActivityState::reset, we now drop the network activity when the\nRemotePageProxy enters the b/f cache (in SuspendedPageProxy::startSuspension).\n\nThis really should be cleaned up at some point, but I can't see a cleaner way of doing this without\na major refactor.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivateForTesting.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewTesting.mm:\n(+[WKWebView _suspendedRemotePageNetworkActivityCountForTesting]):\n* Source/WebKit/UIProcess/RemotePageProxy.cpp:\n(WebKit::RemotePageProxy::processDidTerminate):\n* Source/WebKit/UIProcess/SuspendedPageProxy.cpp:\n(WebKit::SuspendedPageProxy::remotePagesWithNetworkActivityCountForTesting):\n(WebKit::SuspendedPageProxy::startSuspension):\n(WebKit::SuspendedPageProxy::dropNetworkActivityOnRemotePages):\n* Source/WebKit/UIProcess/SuspendedPageProxy.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, SharedProcessDropsPageLoadActivityAfterCrossSiteNavigation)):\n\nCanonical link: https://commits.webkit.org/318796@main", "email": "nham@apple.com", "hash": "f5b7a0e8ef5d9a43f004d4c9db666408be234302", "subject": "Site-isolated iframe processes keep a page load assertion after a cross-site navigation" }, "318797@main": { "author": "Charlie Wolfe", "avatar": "https://www.gravatar.com/avatar/857b3b5ff3394c31fa2689310a93dbab?d=identicon\u0026s=64", "cl": "318797@main", "clUrl": "https://commits.webkit.org/318797@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321145\nrdar://184258237\n\nReviewed by Ryan Reno.\n\nNetscapePlugInStreamLoader left ResourceLoaderOptions::destination at its default value of the empty\nstring, so the CSP check for a plug-in stream fell back to connect-src. Per CSP3 §6.1.9 the loads an\nobject or embed element makes for its content are governed by object-src. Previously a page with\n\"object-src 'self'; connect-src 'none'\" had its PDF blocked partway through incremental loading even\nthough object-src allowed it.\n\nPlumb a FetchOptions::Destination through schedulePluginStreamLoad() to NetscapePlugInStreamLoader,\nand have PluginView report Embed or Object based on its plug-in element's tag name so the stream is\nmatched against object-src.\n\nhttps://www.w3.org/TR/CSP3/#directive-object-src\n\nTest: imported/w3c/web-platform-tests/content-security-policy/object-src/object-src-pdf-byte-range-allowed.html\n\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/object-src/object-src-pdf-byte-range-allowed-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/object-src/object-src-pdf-byte-range-allowed.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/support/incremental-pdf.py: Added.\n(main):\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/support/linearized.pdf: Added.\n* Source/WebCore/loader/NetscapePlugInStreamLoader.cpp:\n(WebCore::plugInStreamLoaderOptions):\n(WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader):\n(WebCore::NetscapePlugInStreamLoader::create):\n* Source/WebCore/loader/NetscapePlugInStreamLoader.h:\n* Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp:\n(WebKit::WebLoaderStrategy::schedulePluginStreamLoad):\n* Source/WebKit/WebProcess/Network/WebLoaderStrategy.h:\n* Source/WebKit/WebProcess/Plugins/PDF/PDFPluginBase.mm:\n(WebKit::PDFPluginBase::startByteRangeRequest):\n* Source/WebKit/WebProcess/Plugins/PluginView.cpp:\n(WebKit::PluginView::Stream::start):\n(WebKit::PluginView::fetchDestination const):\n* Source/WebKit/WebProcess/Plugins/PluginView.h:\n* Source/WebKitLegacy/WebCoreSupport/WebResourceLoadScheduler.cpp:\n(WebResourceLoadScheduler::schedulePluginStreamLoad):\n* Source/WebKitLegacy/WebCoreSupport/WebResourceLoadScheduler.h:\n\nCanonical link: https://commits.webkit.org/318797@main", "email": "charliew@apple.com", "hash": "35cfc0baa7e78315ea8453fd3239765ab652968f", "subject": "Plug-in byte-range requests are blocked by connect-src instead of being governed by object-src" }, "318798@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "318798@main", "clUrl": "https://commits.webkit.org/318798@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321261\nrdar://184312611\n\nReviewed by Sam Weinig.\n\nThe relative-size keywords may be resolved either through the absolute size keyword mapping table or\nby a simple ratio, and of the latter the specification says \"The specific ratio is unspecified, but\nshould be around 1.2-1.5\" [1].\n\nCanvas used 1.02, which is not in that range, so `ctx.font = \"larger sans-serif\"` on a canvas whose\nfont-size is 20px produced 20.4px rather than 24px, making both keywords very nearly no-ops. CSS\nresolution is unaffected and uses 1.2 (BuilderCustom::largerFontSize).\n\nThe value was a transcription typo. 283572@main moved this logic into StyleResolveForFontRaw.cpp\nwhile replacing eager evaluation of calc() in the font consumers, and turned `parentSize * 1.2f` into\n`parentSize * 1.02f` in a change that was otherwise a pure refactor. 1.02f appears nowhere else in\nthe tree.\n\nThe new test asserts the two things the specification actually constrains rather than hard coding\nWebKit's ratio: that the ratio falls in the 1.2-1.5 range, and that canvas agrees with CSS resolution\nfor the same parent font-size.\n\n[1] https://drafts.csswg.org/css-fonts-4/#typedef-relative-size\n\nTest: fast/canvas/canvas-font-size-larger-smaller.html\n\n* LayoutTests/fast/canvas/canvas-font-size-larger-smaller-expected.txt: Added.\n* LayoutTests/fast/canvas/canvas-font-size-larger-smaller.html: Added.\n* Source/WebCore/style/StyleResolveForFont.cpp:\n(WebCore::Style::fontSizeFromUnresolvedFontSize):\n\nCanonical link: https://commits.webkit.org/318798@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "b86307c97d1abc50ea819a0d102be09f3b04a73e", "subject": "REGRESSION(283572@main): Canvas ctx.font keywords larger and smaller scale by 1.02 instead of ~1.2" }, "318799@main": { "author": "Mike Wyrzykowski", "avatar": "https://www.gravatar.com/avatar/4b1bc9e238714f95e22d5d2454c07066?d=identicon\u0026s=64", "cl": "318799@main", "clUrl": "https://commits.webkit.org/318799@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320866\nrdar://183571775\n\nReviewed by Dan Glastonbury.\n\nA WebGPU canvas whose per-frame GPU work cannot finish within a single\ndisplay VSync, e.g., a complex shader, kept requesting presentation at 60Hz,\nso frames backed up and were displayed unevenly, making the animation look choppy.\n\nInstead measure the presented frame's GPU cost in the GPU process. WebGPUFramePacer\nconsumes those costs and picks the highest sustainable rate, so a single spike does\nnot change the rate. GPUCanvasContextCocoa drives the pacer and registers\nwith the page so the page's rendering update rate is clamped to the\nslowest requesting canvas.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/WebGPUFramePacer.cpp\n\n* Source/WebCore/Modules/WebGPU/GPUCompositorIntegration.h:\n(WebCore::GPUCompositorIntegration::lastFrameGPUCost const):\n* Source/WebCore/Modules/WebGPU/Implementation/WebGPUCompositorIntegrationImpl.cpp:\n(WebCore::WebGPU::CompositorIntegrationImpl::lastFrameGPUCost const):\n* Source/WebCore/Modules/WebGPU/Implementation/WebGPUCompositorIntegrationImpl.h:\n* Source/WebCore/Modules/WebGPU/Implementation/WebGPUPresentationContextImpl.cpp:\n(WebCore::WebGPU::PresentationContextImpl::lastFrameGPUCost const):\n* Source/WebCore/Modules/WebGPU/Implementation/WebGPUPresentationContextImpl.h:\n* Source/WebCore/Modules/WebGPU/InternalAPI/WebGPUCompositorIntegration.h:\n(WebCore::WebGPU::CompositorIntegration::lastFrameGPUCost const):\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/html/canvas/CanvasRenderingContext.h:\n(WebCore::CanvasRenderingContext::preferredRenderingUpdateFramesPerSecond const):\n* Source/WebCore/html/canvas/GPUCanvasContextCocoa.h:\n* Source/WebCore/html/canvas/GPUCanvasContextCocoa.mm:\n(WebCore::GPUCanvasContextCocoa::surfaceBufferToImageBuffer):\n(WebCore::GPUCanvasContextCocoa::unconfigure):\n(WebCore::GPUCanvasContextCocoa::prepareForDisplay):\n(WebCore::GPUCanvasContextCocoa::page const):\n(WebCore::GPUCanvasContextCocoa::updateFramePacing):\n(WebCore::GPUCanvasContextCocoa::preferredRenderingUpdateFramesPerSecond const):\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::preferredRenderingUpdateFramesPerSecond const):\n(WebCore::Page::addGPUCanvasRequestingRenderingUpdatePacing):\n(WebCore::Page::removeGPUCanvasRequestingRenderingUpdatePacing):\n* Source/WebCore/page/Page.h:\n* Source/WebCore/platform/graphics/WebGPUFramePacer.cpp: Added.\n(WebCore::WebGPUFramePacer::setDisplayNominalFramesPerSecond):\n(WebCore::WebGPUFramePacer::rebuildDivisorLadder):\n(WebCore::WebGPUFramePacer::reset):\n(WebCore::WebGPUFramePacer::recordFrame):\n(WebCore::WebGPUFramePacer::runController):\n(WebCore::WebGPUFramePacer::preferredFramesPerSecond const):\n* Source/WebCore/platform/graphics/WebGPUFramePacer.h: Added.\n* Source/WebGPU/WGSL/Metal/MetalFunctionWriter.cpp:\n(WGSL::Metal::FunctionDefinitionWriter::visit):\n* Source/WebGPU/WebGPU/CommandBuffer.mm:\n(WebGPU::CommandBuffer::makeInvalidDueToCommit):\n* Source/WebGPU/WebGPU/CommandEncoder.h:\n* Source/WebGPU/WebGPU/CommandEncoder.mm:\n(WebGPU::CommandEncoder::recordGPUExecutionWindowOnCanvasTextures const):\n* Source/WebGPU/WebGPU/PresentationContext.h:\n(WebGPU::PresentationContext::lastFrameGPUCost const):\n* Source/WebGPU/WebGPU/PresentationContext.mm:\n(wgpuSurfaceGetLastFrameGPUCostSeconds):\n* Source/WebGPU/WebGPU/PresentationContextIOSurface.h:\n* Source/WebGPU/WebGPU/PresentationContextIOSurface.mm:\n* Source/WebGPU/WebGPU/Texture.h:\n(WebGPU::Texture::WTF_GUARDED_BY_LOCK):\n* Source/WebGPU/WebGPU/Texture.mm:\n(WebGPU::Texture::recordGPUExecutionWindow const):\n(WebGPU::Texture::gpuFrameCost const):\n(WebGPU::Texture::resetGPUFrameCost const):\n(WebGPU::Texture::setCommandEncoder const):\n* Source/WebGPU/WebGPU/TextureView.mm:\n(WebGPU::TextureView::setCommandEncoder const):\n* Source/WebGPU/WebGPU/WebGPUExt.h:\n* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteCompositorIntegration.cpp:\n(WebKit::RemoteCompositorIntegration::prepareForDisplay):\n* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteCompositorIntegration.h:\n* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteCompositorIntegration.messages.in:\n* Source/WebKit/WebProcess/GPU/graphics/WebGPU/RemoteCompositorIntegrationProxy.cpp:\n(WebKit::WebGPU::RemoteCompositorIntegrationProxy::prepareForDisplay):\n* Source/WebKit/WebProcess/GPU/graphics/WebGPU/RemoteCompositorIntegrationProxy.h:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebCore/WebGPUFramePacer.cpp: Added.\n(TestWebKitAPI::feedFrames):\n(TestWebKitAPI::TEST(WebGPUFramePacer, NoRateBeforeWarmUp)):\n(TestWebKitAPI::TEST(WebGPUFramePacer, FullRefreshContentIsNotPaced)):\n(TestWebKitAPI::TEST(WebGPUFramePacer, ConvergesTo20For45msFrames)):\n(TestWebKitAPI::TEST(WebGPUFramePacer, ConvergesTo12For83msFrames)):\n(TestWebKitAPI::TEST(WebGPUFramePacer, ConvergedRateIsStable)):\n(TestWebKitAPI::TEST(WebGPUFramePacer, SingleSpikeDoesNotStepDown)):\n(TestWebKitAPI::TEST(WebGPUFramePacer, SustainedOverloadStepsDown)):\n(TestWebKitAPI::TEST(WebGPUFramePacer, IdleCanvasStopsPacing)):\n(TestWebKitAPI::TEST(WebGPUFramePacer, DivisorLadderFollows120HzDisplay)):\n(TestWebKitAPI::TEST(WebGPUFramePacer, ClosedLoopDoesNotRatchet)):\n(TestWebKitAPI::TEST(WebGPUFramePacer, RecoversWhenWorkloadEases)):\n\nCanonical link: https://commits.webkit.org/318799@main", "email": "mwyrzykowski@apple.com", "hash": "186929fd217c12e69cbb3e31cb40b90760b0f799", "subject": "Performance seems slower with attached shader in Safari" }, "318800@main": { "author": "Dan Hecht", "avatar": "https://www.gravatar.com/avatar/080f47d912b1b34d0be8293f825d132d?d=identicon\u0026s=64", "cl": "318800@main", "clUrl": "https://commits.webkit.org/318800@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321221\nrdar://184272837\n\nReviewed by Yusuke Suzuki.\n\nemit() manually refs a NewStringImpl's StringImpl and relies on the main-thread\nfinalization task to deref it, but several paths skip that task. When JIT\nexecutable memory runs out after code generation, both DFG and FTL bail on\nLinkBuffer::didFailToAllocate(), so the link task never runs and the finalization\ntask it would have registered never exists. Separately,\nrunMainThreadFinalizationTasks() runs inside JITFinalizer::finalize(), which\nPlan::finalize() only reaches past its isStillValidCodeBlock() check, so a\ncompilation that links successfully and is then invalidated leaks as well. A plan\ncancelled after code generation would leak the same way, which today only the\nplacement of safepoints prevents.\n\nHold the reference in a RefPtr instead, so it is released whether the task runs\nor not.\n\n* Source/JavaScriptCore/dfg/DFGLazyJSValue.cpp:\n(JSC::DFG::EscapedLazyJSValue::EscapedLazyJSValue):\n(JSC::DFG::LazyJSValue::emit const):\n\nCanonical link: https://commits.webkit.org/318800@main", "email": "dan.hecht@apple.com", "hash": "bbab514b1010b4a0eddd2ed5c479747a0511108d", "subject": "[JSC] LazyJSValue::emit leaks a StringImpl reference when finalization is skipped" }, "318801@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "318801@main", "clUrl": "https://commits.webkit.org/318801@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321248\n\nReviewed by Darin Adler.\n\nFollow-up to the SVGPathSegList/SVGPathSeg* DOM interface removal. That patch\nkept the old class names to minimize churn, but SVGPathSegList is no longer a\nlist of segments -- it is just the owner of the SVGPathByteStream backing the\n\"d\" attribute. This renames it (and the property glue) to match its role, and\nrenames the header that now holds only enum SVGPathSegType.\n\nThe renames are:\n SVGPathSegList -\u003e SVGPath\n SVGPathSegList.h -\u003e SVGPath.h\n SVGAnimatedPathSegList -\u003e SVGAnimatedPath\n SVGAnimatedPathSegListAccessor -\u003e SVGAnimatedPathAccessor\n SVGAnimatedPathSegListAnimator -\u003e SVGAnimatedPathAnimator\n SVGAnimationPathSegListFunction -\u003e SVGAnimationPathFunction\n SVGAnimatorType::PathSegList -\u003e SVGAnimatorType::Path\n SVGPathElement::m_pathSegList -\u003e SVGPathElement::m_path\n PathSegListCache -\u003e PathCache\n SVGPathSeg.h -\u003e SVGPathSegType.h (enum SVGPathSegType unchanged)\n\nNo behavior change.\n\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/svg/SVGPath.h: Renamed from Source/WebCore/svg/SVGPathSegList.h.\n* Source/WebCore/svg/SVGPathBlender.cpp:\n* Source/WebCore/svg/SVGPathByteStreamBuilder.cpp:\n* Source/WebCore/svg/SVGPathElement.cpp:\n(WebCore::PathCache::singleton):\n(WebCore::PathCache::get const):\n(WebCore::PathCache::add):\n(WebCore::PathCache::clear):\n(WebCore::SVGPathElement::SVGPathElement):\n(WebCore::SVGPathElement::attributeChanged):\n(WebCore::SVGPathElement::clearCache):\n(WebCore::SVGPathElement::pathByteStream const):\n(WebCore::SVGPathElement::path const):\n(WebCore::SVGPathElement::collectDPresentationalHint):\n(WebCore::PathSegListCache::singleton): Deleted.\n(WebCore::PathSegListCache::get const): Deleted.\n(WebCore::PathSegListCache::add): Deleted.\n(WebCore::PathSegListCache::clear): Deleted.\n* Source/WebCore/svg/SVGPathElement.h:\n* Source/WebCore/svg/SVGPathParser.h:\n* Source/WebCore/svg/SVGPathSegType.h: Renamed from Source/WebCore/svg/SVGPathSeg.h.\n* Source/WebCore/svg/SVGPathSource.h:\n* Source/WebCore/svg/SVGTZoneImpls.cpp:\n* Source/WebCore/svg/properties/SVGAnimatedPropertyAccessorImpl.h:\n* Source/WebCore/svg/properties/SVGAnimatedPropertyAnimatorImpl.h:\n(isType):\n* Source/WebCore/svg/properties/SVGAnimatedPropertyImpl.h:\n(WebCore::SVGAnimatedPath::create):\n(WebCore::SVGAnimatedPathSegList::create): Deleted.\n(WebCore::SVGAnimatedPathSegList::currentPathByteStream): Deleted.\n(WebCore::SVGAnimatedPathSegList::currentPath): Deleted.\n(WebCore::SVGAnimatedPathSegList::approximateMemoryCost const): Deleted.\n* Source/WebCore/svg/properties/SVGAnimationAdditiveValueFunctionImpl.h:\n(WebCore::SVGAnimationPathSegListFunction::animate): Deleted.\n* Source/WebCore/svg/properties/SVGAttributeAnimator.h:\n* Source/WebCore/svg/properties/SVGPropertyOwnerRegistry.h:\n(WebCore::SVGPropertyOwnerRegistry::registerProperty):\n\nCanonical link: https://commits.webkit.org/318801@main", "email": "cdumez@apple.com", "hash": "76df1b96aaae623fa8b9ac96d3d6ac86ea99e6cb", "subject": "Rename SVGPathSegList to SVGPath to reflect its actual role" }, "318802@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "318802@main", "clUrl": "https://commits.webkit.org/318802@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321272\nrdar://184321801\n\nReviewed by Yijia Huang.\n\nIterator#chunk / Iterator#windows handles input chunk-size / window-size\ndifferently. This patch fixes them to align them to the latest spec.\n\n* JSTests/stress/iterator-prototype-chunks.js:\n(const.invalidChunkSize.of.invalidChunkSizes.shouldThrow):\n(Iterator.prototype.chunks.call):\n(validIter.chunks.const.validIter):\n(validIter.chunks):\n(const.closable.get next):\n(const.closable.return):\n(shouldThrow):\n(assert.const.closable.get next):\n(assert.const.closable.get return):\n(assert):\n* JSTests/stress/iterator-prototype-windows.js:\n(const.invalidWindowSize.of.invalidWindowSizes.shouldThrow):\n(Iterator.prototype.windows.call):\n(validIter.windows.const.validIter):\n(validIter.windows):\n(const.invalidUndersized.of.invalidUndersizedValues.shouldThrow):\n(validIter.windows.const.closable.get next):\n(assert.const.closable.get next):\n(assert.const.closable.get return):\n(assert):\n(shouldThrow.const.validIter): Deleted.\n* JSTests/test262/expectations.yaml:\n* Source/JavaScriptCore/builtins/JSIteratorPrototype.js:\n(chunks.generator):\n(chunks):\n(windows.generator):\n(windows):\n\nCanonical link: https://commits.webkit.org/318802@main", "email": "ysuzuki@apple.com", "hash": "547e1555ce4d3fc9a0b016c2cc6cd84c29fe03ce", "subject": "[JSC] Align Iterator#chunk / Iterator#windows to the latest spec" }, "318803@main": { "author": "Ryan Haddad", "avatar": "https://www.gravatar.com/avatar/b7d8cd2dec546cac2524e4b58181f9d5?d=identicon\u0026s=64", "cl": "318803@main", "clUrl": "https://commits.webkit.org/318803@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321195\nrdar://problem/184255666\n\nReviewed by Abrar Rahman Protyasha.\n\nAdd the sparse SDK additions directory for the macOS 27 SDK, copied from macOS Tahoe.\n\nHAVE_NSREFRESHCONTROLLER turns on at a macOS 27 deployment target, so\nWKWebView+RefreshControl.swift is compiled for the first time in an open source build. It\nconforms WKWebView to AppKit's NSRefreshControlHosting, which AppKit declares only as\n@_spi(RefreshControl) in Swift, so it is absent from the public SDK. Add a handwritten\nAppKit_SPI module for it, following the pattern used for SwiftUI in 300040@main.\n\nThe Objective-C protocol of the same name in AppKitSPI.h cannot serve the conformance, since it\nreaches Swift only as the internally-imported WebKit_Internal. It is still required by\nWebKit-Swift-Generated.h, so both declarations have to stay.\n\nBecause the import must be public, AppKit_SPI appears in WebKit's Swift interface, so Swift\ntargets importing WebKit need it on SWIFT_INCLUDE_PATHS.\n\n* Source/WebKit/Configurations/BaseTarget.xcconfig:\n* Source/WebKit/Platform/spi/Cocoa/AppKit_SPI.swiftinterface: Added.\n* Source/WebKit/Platform/spi/mac/AppKitSPI.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebView+RefreshControl.swift:\n* Tools/SwiftBrowser/Configurations/Base.xcconfig:\n* Tools/TestWebKitAPI/Configurations/Base.xcconfig:\n* WebKitLibraries/SDKs/macosx27.0-additions.sdk/SDKSettings.plist: Added.\n* WebKitLibraries/SDKs/macosx27.0-additions.sdk/SymlinkedHeaders-output.xcfilelist: Added.\n* WebKitLibraries/SDKs/macosx27.0-additions.sdk/SymlinkedHeaders.xcfilelist: Added.\n\nCo-Authored-By: Elliott Williams \u003cemw@apple.com\u003e\nCanonical link: https://commits.webkit.org/318803@main", "email": "ryanhaddad@apple.com", "hash": "9f9cfc195a4378ec860ec5618dcad658843acc07", "subject": "[Build] Support public builds on the macOS 27 SDK" }, "318804@main": { "author": "David Kilzer", "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64", "cl": "318804@main", "clUrl": "https://commits.webkit.org/318804@main", "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=321120\u003e\n\u003crdar://184153814\u003e\n\nReviewed by Mike Wyrzykowski, Zak Ridouh, and Charlie Wolfe.\n\nWhen an incoming IPC message fails a MESSAGE_CHECK, the receiving\nprocess asks for the process that sent it to be terminated. On macOS\nthat termination is a plain SIGKILL sent through\n`xpc_connection_kill()`, which carries no `os_reason`, so the kernel\nwrites no crash report for the killed process. run-webkit-tests marks\nthe process crashed but finds no crash log to attach and reports \"No\ncrash log found\".\n\nOn ASan builds, terminate such a process with `terminate_with_reason()`\nin the `OS_REASON_WEBKIT` namespace instead, so the kernel emits a\ncrash report attributed to the killed process. Encode the failing\n`IPC::MessageName` above the low reason-code byte so the report's\ntermination reason names which message check failed. Only\nmessage-check and watchdog terminations report this way; ordinary\ninvalidation and client-requested terminations keep the report-less\n`xpc_connection_kill()`.\n\nThe kill is always issued by the UI process. When a GPU, Networking,\nor Model process is the one that detects the invalid message, forward\nthe failing message name to the UI process through the\n`TerminateWebProcess` message so that termination occurs the same\nway.\n\nNo new tests since this change is not directly testable.\n\n* Source/WebKit/Scripts/webkit/messages.py:\n- Add `IPC::MessageName` to the `headers_for_type()` special-cases dict\n so message receivers that take an `IPC::MessageName` parameter include\n `\"MessageNames.h\"` rather than the derived (non-existent)\n `\"MessageName.h\"`.\n* Source/WebKit/Scripts/webkit/parser_unittest.py:\n(_expected_model_test_with_superclass):\n- Add the new TestMessageWithMessageName message so the expected model\n matches the TestWithSuperclass.messages.in fixture.\n* Source/WebKit/Scripts/webkit/tests/MessageArgumentDescriptions.cpp:\n* Source/WebKit/Scripts/webkit/tests/MessageNames.cpp:\n* Source/WebKit/Scripts/webkit/tests/MessageNames.h:\n* Source/WebKit/Scripts/webkit/tests/TestWithSuperclass.messages.in:\n(TestWithSuperclass::TestMessageWithMessageName): Add.\n* Source/WebKit/Scripts/webkit/tests/TestWithSuperclassMessageReceiver.cpp:\n* Source/WebKit/Scripts/webkit/tests/TestWithSuperclassMessages.h:\n* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.cpp:\n(WebKit::GPUConnectionToWebProcess::didReceiveInvalidMessage):\n(WebKit::GPUConnectionToWebProcess::terminateWebProcess):\n* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.h:\n(WebKit::GPUConnectionToWebProcess::terminateWebProcess):\n* Source/WebKit/GPUProcess/GPUProcess.cpp:\n(WebKit::GPUProcess::terminateWebProcess):\n* Source/WebKit/GPUProcess/GPUProcess.h:\n(WebKit::GPUProcess::terminateWebProcess):\n* Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGL.cpp:\n(WebKit::RemoteGraphicsContextGL::didReceiveInvalidMessage):\n* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp:\n(WebKit::RemoteRenderingBackend::didReceiveInvalidMessage):\n* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteGPU.cpp:\n(WebKit::RemoteGPU::didReceiveInvalidMessage):\n* Source/WebKit/ModelProcess/ModelConnectionToWebProcess.cpp:\n(WebKit::ModelConnectionToWebProcess::didReceiveInvalidMessage):\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:\n(WebKit::NetworkConnectionToWebProcess::didReceiveInvalidMessage):\n* Source/WebKit/Platform/IPC/Connection.h:\n(IPC::Connection::kill):\n* Source/WebKit/Platform/IPC/cocoa/ConnectionCocoa.mm:\n(IPC::Connection::kill):\n* Source/WebKit/Platform/cocoa/XPCUtilities.h:\n(WebKit::ReasonCode):\n(WebKit::terminateWithReason):\n* Source/WebKit/Platform/cocoa/XPCUtilities.mm:\n(WebKit::terminateWithReason):\n* Source/WebKit/UIProcess/AuxiliaryProcessProxy.cpp:\n(WebKit::AuxiliaryProcessProxy::terminate):\n* Source/WebKit/UIProcess/AuxiliaryProcessProxy.h:\n(WebKit::AuxiliaryProcessProxy::terminate):\n* Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp:\n(WebKit::GPUProcessProxy::didReceiveInvalidMessage):\n(WebKit::GPUProcessProxy::terminateWebProcess):\n* Source/WebKit/UIProcess/GPU/GPUProcessProxy.h:\n(WebKit::GPUProcessProxy::terminateWebProcess):\n* Source/WebKit/UIProcess/GPU/GPUProcessProxy.messages.in:\n* Source/WebKit/UIProcess/Model/ModelProcessProxy.cpp:\n(WebKit::ModelProcessProxy::terminateWebProcess):\n(WebKit::ModelProcessProxy::didReceiveInvalidMessage):\n* Source/WebKit/UIProcess/Model/ModelProcessProxy.h:\n(WebKit::ModelProcessProxy::terminateWebProcess):\n* Source/WebKit/UIProcess/Model/ModelProcessProxy.messages.in:\n* Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp:\n(WebKit::NetworkProcessProxy::terminate):\n(WebKit::NetworkProcessProxy::didReceiveInvalidMessage):\n(WebKit::NetworkProcessProxy::terminateWebProcess):\n* Source/WebKit/UIProcess/Network/NetworkProcessProxy.h:\n(WebKit::NetworkProcessProxy::terminate):\n(WebKit::NetworkProcessProxy::terminateWebProcess):\n* Source/WebKit/UIProcess/Network/NetworkProcessProxy.messages.in:\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::didReceiveInvalidMessage):\n(WebKit::WebProcessProxy::requestTermination):\n* Source/WebKit/UIProcess/WebProcessProxy.h:\n(WebKit::WebProcessProxy::requestTermination):\n\nCanonical link: https://commits.webkit.org/318804@main", "email": "ddkilzer@apple.com", "hash": "da21559d05d5532252c21c93a62a2631f3192351", "subject": "[ASan] Generate a crash log when a process is killed for a failed IPC message check" }, "318805@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "318805@main", "clUrl": "https://commits.webkit.org/318805@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321265\n\nReviewed by Darin Adler.\n\nA subframe (and any scrollable area without an asynchronous scrolling node)\nis wheel-scrolled synchronously on the main thread, driven by ScrollAnimator's\nScrollingEffectsController. When such a scroll ends, the controller calls\nScrollingEffectsControllerClient::didStopWheelEventScroll(), but ScrollAnimator\nnever overrode it, so the empty base implementation ran and ScrollableArea::\nscrollDidEnd() was never called. As a result no scrollend event was dispatched\nfor main-thread wheel scrolls, even though the scroll (and scroll events) worked\ncorrectly.\n\nAreas with an async scrolling node were unaffected because their scrollend is\ndriven by the scrolling tree delegate (ScrollingTreeScrollingNodeDelegateMac),\nwhich does implement didStopWheelEventScroll(). Programmatic/animated scrolls\nwere also fine because ScrollAnimator already overrides didStopAnimatedScroll()\nto call scrollDidEnd().\n\nFix this by overriding didStopWheelEventScroll() in ScrollAnimator to call\nscrollDidEnd(), mirroring didStopAnimatedScroll(). This covers both gesture-phase\nwheel ends and discrete mouse-wheel scrolls (via the scrollend timer). It cannot\ndouble-fire: scrollDidEnd() is guarded by isAwaitingScrollend() and only runs\nwhen a scroll actually occurred, and async-scrolled areas use a separate\nScrollingEffectsController instance.\n\nThis makes the imported WPT test scroll-cross-origin-iframes.html pass, which\npreviously timed out waiting for a scrollend handshake from the iframes.\n\nNo new tests, rebaselined existing WPT test that was previously timing out\nin WebKit. This test is passing in both Chrome and Firefox already.\n\n* LayoutTests/imported/w3c/web-platform-tests/dom/events/scrolling/scroll-cross-origin-iframes-expected.txt:\n* LayoutTests/platform/mac-site-isolation/TestExpectations:\n* Source/WebCore/platform/ScrollAnimator.cpp:\n(WebCore::ScrollAnimator::didStopWheelEventScroll):\n* Source/WebCore/platform/ScrollAnimator.h:\n\nCanonical link: https://commits.webkit.org/318805@main", "email": "cdumez@apple.com", "hash": "3c2f9abf7173b999417f7b09c02f4c91fb43615f", "subject": "scrollend event is not fired when wheel-scrolling a subframe" }, "318806@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "318806@main", "clUrl": "https://commits.webkit.org/318806@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321270\nrdar://184321382\n\nReviewed by Yijia Huang.\n\nAlign Iterator#join implementation more to the spec.\n\n1. even if undefined/null element exists, we still need to append a\n separator. This fixes a test262 failure.\n2. For efficiency, use JSRopeString::RopeBuilder.\n\n* JSTests/test262/expectations.yaml:\n* Source/JavaScriptCore/runtime/JSIteratorPrototype.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n\nCanonical link: https://commits.webkit.org/318806@main", "email": "ysuzuki@apple.com", "hash": "7417386b7da17bdb83f5c8f90aafb25234967e66", "subject": "[JSC] Align Iterator#join to the latest spec" }, "318807@main": { "author": "Patrick Griffis", "avatar": "https://www.gravatar.com/avatar/2233c3a857004b126158572af9fe36f7?d=identicon\u0026s=64", "cl": "318807@main", "clUrl": "https://commits.webkit.org/318807@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321190\n\nReviewed by Carlos Garcia Campos and Adrian Perez de Castro.\n\nThis exposes roughly the same API as GTK, just with WebKitColor,\nand shares as much internally as possible.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestUIClient.cpp\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebKit/PlatformGTK.cmake:\n* Source/WebKit/PlatformWPE.cmake:\n* Source/WebKit/SourcesGTK.txt:\n* Source/WebKit/SourcesWPE.txt:\n* Source/WebKit/UIProcess/API/glib/WebKitAutocleanups.h.in:\n* Source/WebKit/UIProcess/API/glib/WebKitColorChooserRequest.cpp: Renamed from Source/WebKit/UIProcess/API/gtk/WebKitColorChooserRequest.cpp.\n(webkitColorChooserRequestSelectedColorChanged):\n(webkitColorChooserRequestGetProperty):\n(webkitColorChooserRequestSetProperty):\n(webkit_color_chooser_request_class_init):\n(webkit_color_chooser_request_set_rgba):\n(webkit_color_chooser_request_get_element_rectangle):\n(webkit_color_chooser_request_set_color):\n(webkit_color_chooser_request_get_color):\n(webkit_color_chooser_request_cancel):\n(webkitColorChooserRequestCreate):\n* Source/WebKit/UIProcess/API/glib/WebKitColorChooserRequest.h.in: Renamed from Source/WebKit/UIProcess/API/gtk/WebKitColorChooserRequest.h.in.\n* Source/WebKit/UIProcess/API/glib/WebKitColorChooserRequestPrivate.h: Renamed from Source/WebKit/UIProcess/API/gtk/WebKitColorChooserRequestPrivate.h.\n* Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp:\n(WebKitWebViewClient::runColorChooser):\n(webkit_web_view_class_init):\n(webkitWebViewEmitRunColorChooser):\n* Source/WebKit/UIProcess/API/glib/WebKitWebView.h.in:\n* Source/WebKit/UIProcess/API/glib/WebKitWebViewPrivate.h:\n* Source/WebKit/UIProcess/API/glib/webkit.h.in:\n* Source/WebKit/UIProcess/API/gtk/WebKitColorChooser.cpp:\n(WebKit::WebKitColorChooser::showColorPicker):\n(WebKit::WebKitColorChooser::colorChooserRequestRGBAChanged): Deleted.\n* Source/WebKit/UIProcess/API/gtk/WebKitColorChooser.h:\n* Source/WebKit/UIProcess/API/gtk/WebKitColorChooserRequest.h.in: Removed.\n* Source/WebKit/UIProcess/API/gtk/WebKitWebViewGtk.cpp:\n(createRunColorChooserSignal):\n* Source/WebKit/UIProcess/API/wpe/PageClientImpl.cpp:\n(WebKit::PageClientImpl::createColorPicker):\n* Source/WebKit/UIProcess/API/wpe/WebKitColorChooser.cpp: Copied from Source/WebKit/UIProcess/API/gtk/WebKitColorChooser.cpp.\n(WebKit::WebKitColorChooser::create):\n(WebKit::WebKitColorChooser::WebKitColorChooser):\n(WebKit::WebKitColorChooser::~WebKitColorChooser):\n(WebKit::WebKitColorChooser::endPicker):\n(WebKit::WebKitColorChooser::colorChooserRequestFinished):\n(WebKit::WebKitColorChooser::showColorPicker):\n* Source/WebKit/UIProcess/API/wpe/WebKitColorChooser.h: Copied from Source/WebKit/UIProcess/API/gtk/WebKitColorChooser.h.\n* Source/WebKit/UIProcess/API/wpe/WebKitWebViewClient.h:\n* Source/WebKit/UIProcess/API/wpe/WebKitWebViewWPE.cpp:\n(createRunColorChooserSignal):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestUIClient.cpp:\n(assertColorIsEqual):\n(cancelColorChooserRequestOnColorChanged):\n(testWebViewColorChooserRequest):\n(beforeAll):\n\nCanonical link: https://commits.webkit.org/318807@main", "email": "pgriffis@igalia.com", "hash": "0496fa627ebfc60e411c0a52009387ca10b4e584", "subject": "[WPE] Add WebView::run-color-chooser API" }, "318808@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "318808@main", "clUrl": "https://commits.webkit.org/318808@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321273\nrdar://184322384\n\nReviewed by Yijia Huang.\n\nIntl.Locale's returned arrays should be sorted according to the spec[1].\n\n[1]: https://tc39.es/proposal-intl-locale-info/#sec-collations-of-locale\n\n* JSTests/stress/intl-locale-info.js:\n(shouldBe):\n* JSTests/test262/expectations.yaml:\n* Source/JavaScriptCore/runtime/IntlLocale.cpp:\n(JSC::IntlLocale::collations):\n(JSC::IntlLocale::timeZones):\n\nCanonical link: https://commits.webkit.org/318808@main", "email": "ysuzuki@apple.com", "hash": "9ef04dabf52d7432a3e7ab13f44f9d8b4bd933a0", "subject": "[JSC] Intl.Locale's collections should be sorted" }, "318810@main": { "author": "Ryosuke Niwa", "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64", "cl": "318810@main", "clUrl": "https://commits.webkit.org/318810@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320518\n\nReviewed by Geoffrey Garen.\n\nRemoved NODELETE annotations from a bunch of functions in Source/WebCore/css.\n\n* Source/WebCore/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/WebCore/css/CSSComputedStyleDeclaration.h:\n* Source/WebCore/css/CSSPropertyInitialValues.cpp:\n(WebCore::isNumber):\n* Source/WebCore/css/DOMMatrixReadOnly.h:\n* Source/WebCore/css/SelectorChecker.cpp:\n(WebCore::localContextForParent):\n* Source/WebCore/css/StyleSheetList.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+String.h:\n* Source/WebCore/css/values/color/CSSKeywordColor.cpp:\n(WebCore::CSS::isDeprecatedSystemColorKeyword):\n\nCanonical link: https://commits.webkit.org/318810@main", "email": "rniwa@webkit.org", "hash": "65b1821f100eb623205ecb3f59b961307f97dca8", "subject": "Remove incorrect NODELETE annotations from Source/WebCore/css" }, "318811@main": { "author": "Abrar Rahman Protyasha", "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64", "cl": "318811@main", "clUrl": "https://commits.webkit.org/318811@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321267\nrdar://184318736\n\nReviewed by Pascoe and Richard Robinson.\n\nSwiftBrowser consumed the async navigation sequence but it only printed\neach event and did not invoke didReceiveNavigationEvent(). This is the\nmethod responsible for syncinc displayedURL against page.url after a\nnavigation is committed. As such, the field kept whatever text was\nsubmitted, and did not reflect the final URL the page committed to.\n\nThis bug manifested itself in a stale address bar for navigations that\nproduced a known-host HTTPS upgrade (such as apple.com).\n\nTo fix this, we simply route navigation events through the correct\nhandler. We also include the event's URL in the logging to make\nnavigation state easier to follow.\n\nA couple of drive-by fixes:\n1. Mark the pre-existing \"Exported PDF to …\" log as privacy: .sensitive\n for consistency.\n2. Drop the now redundant addingProtocolIfNecessary() adjustment in\n navigateToSubmittedURL(). The userTypedString: init already applies\n scheme inference and the field is now drive entirely by page.url.\n\n* Tools/SwiftBrowser/Source/ViewModel/BrowserViewModel.swift:\n(BrowserViewModel.didReceiveNavigationEvent(_:)):\n(BrowserViewModel.navigateToSubmittedURL):\n(BrowserViewModel.didExportPDF(_:any:)):\n* Tools/SwiftBrowser/Source/Views/ContentView.swift:\n(ContentView.body):\n\nCanonical link: https://commits.webkit.org/318811@main", "email": "a_protyasha@apple.com", "hash": "acf8a9bd09120f8b9dd8974c16cc499047fd8d56", "subject": "[SwiftBrowser] URL field does not reflect the committed URL after navigation" }, "318812@main": { "author": "Patrick Griffis", "avatar": "https://www.gravatar.com/avatar/2233c3a857004b126158572af9fe36f7?d=identicon\u0026s=64", "cl": "318812@main", "clUrl": "https://commits.webkit.org/318812@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321310\n\nReviewed by Adrian Perez de Castro.\n\nThis fixes two bugs:\n\nThe commit introducing this feature used AllowDatabaseWrite::No which meant the\nin-memory cache worked but loading it would fail. The database contains a timestamp\nof when icons were last used, so it must be writable, otherwise every icon is\nconsidered not recently used and ignored.\n\nThe purpose of this API was to return multiple sizes for the same URL, however\nthe schema was `pageURL (url UNIQUE ..., iconID ...)` which meant there could\nonly be one entry per URL. Change this to `UNIQUE (url, iconID)` so the combination\nmust be unique.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestWebKitFaviconDatabase.cpp\n\n* Source/WebKit/UIProcess/API/glib/IconDatabase.cpp:\n(WebKit::IconDatabase::createTablesIfNeeded):\n* Source/WebKit/UIProcess/API/glib/WebKitFaviconDatabase.cpp:\n(webkit_favicon_database_get_page_icons):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestWebKitFaviconDatabase.cpp:\n(testFaviconDatabaseGetPageIcons):\n\nCanonical link: https://commits.webkit.org/318812@main", "email": "pgriffis@igalia.com", "hash": "b29eae826faaf0aff766c3a64a48b514fb0efb76", "subject": "[GLib] Fix webkit_favicon_database_get_page_icons() lookups" }, "318814@main": { "author": "Marta Darbinyan", "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64", "cl": "318814@main", "clUrl": "https://commits.webkit.org/318814@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321312\nrdar://184351245\n\nUnreviewed test gardening\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318814@main", "email": "darbinyan@apple.com", "hash": "d5bec83d776b775bc1a9a3e3af39faf551dd9f27", "subject": "[Gardening]: [macOS] imported/w3c/web-platform-tests/webrtc/RTCRtpReceiver-getSynchronizationSources.https.html is flaky failure" }, "318815@main": { "author": "Sam Weinig", "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64", "cl": "318815@main", "clUrl": "https://commits.webkit.org/318815@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321003\n\nReviewed by Darin Adler.\n\nRestrict length values passed via script for the WebAnimation rangeStart/rangeEnd attributes\nto computationally independent values.\n\nThis was resolved on by the CSSWG in https://github.com/w3c/csswg-drafts/issues/13853.\n\nTest: imported/w3c/web-platform-tests/web-animations/interfaces/Animation/animation-range-invalid.html\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/scroll-timelines/scroll-timeline-range-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/scroll-timelines/scroll-timeline-range-with-zoom.html:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/scroll-timelines/scroll-timeline-range.html:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/view-timelines/view-timeline-range.html:\n* LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Animation/animation-range-invalid-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Animation/animation-range-invalid.html: Added.\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/animation/CSSAnimation.cpp:\n* Source/WebCore/animation/CSSAnimation.h:\n* Source/WebCore/animation/TimelineRangeValue.cpp:\n* Source/WebCore/animation/TimelineRangeValue.h:\n* Source/WebCore/animation/WebAnimation.cpp:\n* Source/WebCore/animation/WebAnimation.h:\n* Source/WebCore/animation/WebAnimation.idl:\n* Source/WebCore/css/calc/CSSCalcTree+ComputedStyleDependencies.cpp:\n* Source/WebCore/css/calc/CSSCalcTree+ComputedStyleDependencies.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Timeline.cpp:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Timeline.h:\n* Source/WebCore/css/typedom/numeric/CSSMathValue.cpp:\n* Source/WebCore/css/typedom/numeric/CSSMathValue.h:\n* Source/WebCore/dom/Element.cpp:\n* Source/WebCore/style/calc/StyleCalculationTree+Conversion.cpp:\n* Source/WebCore/style/values/animations/StyleSingleAnimationRange.h:\n* Source/WebCore/style/values/primitives/StyleLengthResolution.cpp:\n* Source/WebCore/style/values/primitives/StyleLengthResolution.h:\n\nCanonical link: https://commits.webkit.org/318815@main", "email": "sam@webkit.org", "hash": "87958571e8999a561412d8bdffd67dca08733f39", "subject": "Restrict length values passed via script for the WebAnimation rangeStart/rangeEnd attributes to computationally independent values" }, "318816@main": { "author": "Nikolas Zimmermann", "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64", "cl": "318816@main", "clUrl": "https://commits.webkit.org/318816@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321289\n\nReviewed by Simon Fraser.\n\nRenderSVGResourceMasker sizes and draws its mask image over\nenclosingIntRect(absoluteTransform.mapRect(decoratedBounds)), the enclosing\ninteger rect of the mask content bounds in device space. Perform the clip for\nthe transparency layer in the same way, otherwise the edge pixels of the masked\ncontent are lost. SVG content below the SVG root is not snapped to device\npixels and its bound is in the local coordinate system that the CTM scales, so\ndo the rounding in the context's device space. The same applies to a clipper\napplied as a mask.\n\nThe bound was wrong for SVG in a second way. An SVG renderer that is a box\n(\u003ctext\u003e, \u003cforeignObject\u003e) used the CSS mask clip rect, which comes from the\nborder box and leaves out the SVG content that spills outside it. The visual\noverflow rect already covers the mask resource, so use that instead.\n\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/masking-mask-01-b-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/masking-path-01-b-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/absolute-sized-content-with-resources-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/grayscale-gradient-mask-2-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/grayscale-gradient-mask-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/transforms/text-with-mask-with-svg-transform-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/page/zoom-mask-with-percentages-expected.png:\n* Source/WebCore/rendering/RenderLayer.cpp:\n(WebCore::clipRectForTransparencyLayer):\n(WebCore::RenderLayer::beginTransparencyLayers):\n(WebCore::RenderLayer::calculateClipRects const):\n\nCanonical link: https://commits.webkit.org/318816@main", "email": "nzimmermann@igalia.com", "hash": "49d0165dc35c18492fe0b1ac841f86ec583a7bc0", "subject": "[LBSE] Masked SVG content is cut off at the edges of the transparency layer bound" }, "318817@main": { "author": "Nikolas Zimmermann", "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64", "cl": "318817@main", "clUrl": "https://commits.webkit.org/318817@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321215\n\nReviewed by Simon Fraser.\n\nRenderSVGResourceMasker cancelled 'adjustedPaintOffset' against\nobjectBoundingBox() instead of nominalSVGLayoutLocation(), displacing the mask\nof any target whose children carry transforms. It also ignored the mask region\ngiven by x/y/width/height, so mask content reaching past it was not cut off and\na mask covering nothing left its target fully visible. Confining the image also\nmakes painting clip to that region, and a rectangular clip is not antialiased,\nso a fractional region rounds the outermost row and column of the mask away.\nRound it _outwards_ to the whole pixels the image is rasterized over.\n\nTwo problems concerned the cached mask image: nothing dropped it on layout, so\na resized viewport went on masking with an image rasterized for the percentage\nlengths of the old one. It was also allocated through ImageBuffer::create()\nrather than through the context, which in the GPU process leaves the context\nwithout a handle to it, so every paint has to upload the mask again...\n\nFinally, SVGMaskElement::calculateMaskContentRepaintRect() skipped mask\nchildren with 'visibility: hidden', whose descendants can turn visibility back\non.\n\nThe fixes combined, fix all remaining issues with SVG masks in LBSE.\n\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/TestExpectations:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-dom-height-attr-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-dom-maskContentUnits-attr-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-dom-maskUnits-attr-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-dom-width-attr-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-dom-x-attr-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-dom-y-attr-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-svgdom-height-prop-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-svgdom-maskContentUnits-prop-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-svgdom-maskUnits-prop-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-svgdom-width-prop-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-svgdom-x-prop-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/dynamic-updates/SVGMaskElement-svgdom-y-prop-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/repaint/mask-clip-target-transform-expected.png: Added.\n* Source/WebCore/rendering/svg/RenderSVGResourceMasker.cpp:\n(WebCore::createImageBuffer):\n(WebCore::RenderSVGResourceMasker::applyMask):\n(WebCore::RenderSVGResourceMasker::maskBoundsInLocalCoordinates):\n(WebCore::RenderSVGResourceMasker::resourceBoundingBox):\n* Source/WebCore/rendering/svg/RenderSVGResourceMasker.h:\n* Source/WebCore/svg/SVGMaskElement.cpp:\n(WebCore::SVGMaskElement::calculateMaskContentRepaintRect):\n\nCanonical link: https://commits.webkit.org/318817@main", "email": "nzimmermann@igalia.com", "hash": "6050a91d396cdfc1200117dbe456ea291e64860c", "subject": "[LBSE] Fix remaining mask issues" } }, "date": "2026-08-07", "days": 1, "generatedAt": "2026-08-07T22:06:27Z", "markdown": "## Highlights\n- **Rendering** SVG masking got a substantial LBSE cleanup, fixing edge clipping and remaining mask correctness bugs that affect real SVG content. [commit 318816@main](https://commits.webkit.org/318816@main) [bug 321289](https://bugs.webkit.org/show_bug.cgi?id=321289)\n- **Web Platform** Back/forward cache is now enabled across all web-platform-tests, a notable step toward broader BFCache confidence and interop. [commit 318767@main](https://commits.webkit.org/318767@main) [bug 321061](https://bugs.webkit.org/show_bug.cgi?id=321061)\n- **V8** JavaScriptCore landed a big memory64-oriented overhaul for ArrayBuffer and Wasm::Memory sizing, tightening WebAssembly support for larger memory models. [commit 318784@main](https://commits.webkit.org/318784@main) [bug 321182](https://bugs.webkit.org/show_bug.cgi?id=321182)\n- **Security** CSP handling for plug-in byte-range requests now uses object-src instead of connect-src, fixing policy enforcement in a security-sensitive path. [commit 318797@main](https://commits.webkit.org/318797@main) [bug 321145](https://bugs.webkit.org/show_bug.cgi?id=321145)\n- **Networking** Network cache traversal no longer fully decodes every record just to read its URL, which should cut overhead in cache inspection paths. [commit 318781@main](https://commits.webkit.org/318781@main) [bug 321234](https://bugs.webkit.org/show_bug.cgi?id=321234)\n- **Media** MediaRecorder now avoids dropping frames when the writer input temporarily reports not ready, improving recording stability under backpressure. [commit 318778@main](https://commits.webkit.org/318778@main) [bug 321218](https://bugs.webkit.org/show_bug.cgi?id=321218)\n- **DevTools** Web Inspector now distinguishes configured WebGPU canvas elements from CSS canvas client nodes, reducing confusion when debugging GPU-backed canvas content. [commit 318794@main](https://commits.webkit.org/318794@main) [bug 321150](https://bugs.webkit.org/show_bug.cgi?id=321150)\n- **UI** Web Extensions got two user-visible fixes: sidebars now behave per-window instead of per-tab, and cold-launch loading on iOS 26.6 is much faster. [commit 318790@main](https://commits.webkit.org/318790@main) [bug 321128](https://bugs.webkit.org/show_bug.cgi?id=321128)\n- **Rendering** Custom Highlight support moved forward with inherited highlight styling and shadowRoots support in highlightsFromPoint(), improving richer text annotation behavior. [commit 318779@main](https://commits.webkit.org/318779@main) [bug 320716](https://bugs.webkit.org/show_bug.cgi?id=320716)\n\n## What landed by area\n\n### Rendering and layout\n- **Rendering** LBSE fixed the remaining SVG mask issues, continuing the new engine's mask correctness push. [commit 318817@main](https://commits.webkit.org/318817@main) [bug 321215](https://bugs.webkit.org/show_bug.cgi?id=321215)\n- **Rendering** LBSE stopped clipping masked SVG content at transparency layer bounds, fixing visible edge cutoffs. [commit 318816@main](https://commits.webkit.org/318816@main) [bug 321289](https://bugs.webkit.org/show_bug.cgi?id=321289)\n- **Rendering** block-in-inline layout no longer double-counts a block box's trailing margin in partial layout. [commit 318792@main](https://commits.webkit.org/318792@main) [bug 321236](https://bugs.webkit.org/show_bug.cgi?id=321236)\n- **Rendering** anon-block-removal work fixed editing selection behavior at end of document. [commit 318783@main](https://commits.webkit.org/318783@main) [bug 321205](https://bugs.webkit.org/show_bug.cgi?id=321205)\n- **Rendering** block-in-inline no longer treats blocks containing tables as self-collapsing. [commit 318782@main](https://commits.webkit.org/318782@main) [bug 321198](https://bugs.webkit.org/show_bug.cgi?id=321198)\n- **Rendering** Custom Highlight pseudo-elements now inherit from the parent element's highlight, matching expected styling semantics. [commit 318779@main](https://commits.webkit.org/318779@main) [bug 320716](https://bugs.webkit.org/show_bug.cgi?id=320716)\n- **A11y** :focus-visible no longer appears incorrectly after focus() inside an already focused ancestor. [commit 318775@main](https://commits.webkit.org/318775@main) [bug 321157](https://bugs.webkit.org/show_bug.cgi?id=321157)\n- **Rendering** Damage propagation scrollbar flicker was fixed after a regression in compositing updates. [commit 318769@main](https://commits.webkit.org/318769@main) [bug 321211](https://bugs.webkit.org/show_bug.cgi?id=321211)\n- **Rendering** SVG currentScale now works for non-document-root outermost svg elements instead of being a no-op. [commit 318762@main](https://commits.webkit.org/318762@main) [bug 318096](https://bugs.webkit.org/show_bug.cgi?id=318096)\n- **Rendering** highlightsFromPoint() gained shadowRoots support for Custom Highlight queries across shadow DOM boundaries. [commit 318758@main](https://commits.webkit.org/318758@main) [bug 321116](https://bugs.webkit.org/show_bug.cgi?id=321116)\n- **Rendering** LBSE stopped seeding filter regions with object bounding boxes for pure filter references, improving SVG filter behavior. [commit 318751@main](https://commits.webkit.org/318751@main) [bug 321129](https://bugs.webkit.org/show_bug.cgi?id=321129)\n- **Rendering** getBoundingClientRect() no longer returns a non-zero rect for SVG content inside hidden containers. [commit 318744@main](https://commits.webkit.org/318744@main) [bug 320456](https://bugs.webkit.org/show_bug.cgi?id=320456)\n\n### JavaScriptCore and WebAssembly\n- **V8** Intl.Locale collections are now sorted, aligning JSC behavior with spec expectations. [commit 318808@main](https://commits.webkit.org/318808@main) [bug 321273](https://bugs.webkit.org/show_bug.cgi?id=321273)\n- **V8** Iterator#join was aligned to the latest spec. [commit 318806@main](https://commits.webkit.org/318806@main) [bug 321270](https://bugs.webkit.org/show_bug.cgi?id=321270)\n- **Refactor** JSC retired Lexer::lexExpectIdentifier(), simplifying parser internals. [commit 318793@main](https://commits.webkit.org/318793@main) [bug 321188](https://bugs.webkit.org/show_bug.cgi?id=321188)\n- **V8** Temporal now implements ISODateToFields and CalendarMergeFields as standalone spec operations. [commit 318785@main](https://commits.webkit.org/318785@main) [bug 321189](https://bugs.webkit.org/show_bug.cgi?id=321189)\n- **V8** ArrayBuffer and Wasm::Memory sizing were overhauled for memory64 support. [commit 318784@main](https://commits.webkit.org/318784@main) [bug 321182](https://bugs.webkit.org/show_bug.cgi?id=321182)\n- **Security** Array.unshift now installs a missing writeBarrier, fixing a GC correctness hole. [commit 318780@main](https://commits.webkit.org/318780@main) [bug 321217](https://bugs.webkit.org/show_bug.cgi?id=321217)\n- **Build** JITOperationValidation fallback probe macros now compile correctly again. [commit 318765@main](https://commits.webkit.org/318765@main) [bug 321214](https://bugs.webkit.org/show_bug.cgi?id=321214)\n- **Perf** String#split no longer atomizes results when the input string is non-atom, avoiding unnecessary interned strings. [commit 318764@main](https://commits.webkit.org/318764@main) [bug 320966](https://bugs.webkit.org/show_bug.cgi?id=320966)\n- **Perf** The RegExp trim fast path in String#replace now survives caller tier-up into DFG and FTL. [commit 318745@main](https://commits.webkit.org/318745@main) [bug 321161](https://bugs.webkit.org/show_bug.cgi?id=321161)\n- **Security** LazyJSValue::emit no longer leaks a StringImpl reference when finalization is skipped. [commit 318800@main](https://commits.webkit.org/318800@main) [bug 321221](https://bugs.webkit.org/show_bug.cgi?id=321221)\n\n### Site isolation, navigation, and process model\n- **Security** Site-isolated iframe processes no longer keep a stale page load assertion after cross-site navigation. [commit 318796@main](https://commits.webkit.org/318796@main) [bug 320790](https://bugs.webkit.org/show_bug.cgi?id=320790)\n- **Security** Dynamically created cross-site iframes no longer get stuck on about:blank after back/forward reload. [commit 318789@main](https://commits.webkit.org/318789@main) [bug 320761](https://bugs.webkit.org/show_bug.cgi?id=320761)\n- **Security** Stale iframe layers are now cleaned up after cross-process navigation instead of staying hosted. [commit 318768@main](https://commits.webkit.org/318768@main) [bug 321009](https://bugs.webkit.org/show_bug.cgi?id=321009)\n- **Security** First-party sites are no longer allowed to enter the shared process. [commit 318763@main](https://commits.webkit.org/318763@main) [bug 321033](https://bugs.webkit.org/show_bug.cgi?id=321033)\n- **Security** Shared-process domain tracking now handles more than the first loaded domain. [commit 318750@main](https://commits.webkit.org/318750@main) [bug 321137](https://bugs.webkit.org/show_bug.cgi?id=321137)\n- **Web Platform** scrollend now fires when wheel-scrolling a subframe, closing an event delivery gap. [commit 318805@main](https://commits.webkit.org/318805@main) [bug 321265](https://bugs.webkit.org/show_bug.cgi?id=321265)\n- **Web Platform** BFCache was enabled for all WPT coverage, raising baseline navigation test coverage. [commit 318767@main](https://commits.webkit.org/318767@main) [bug 321061](https://bugs.webkit.org/show_bug.cgi?id=321061)\n\n### Web APIs, DOM, CSS, and SVG\n- **Web Platform** WebAnimation rangeStart and rangeEnd now reject script-provided length values unless they are computationally independent. [commit 318815@main](https://commits.webkit.org/318815@main) [bug 321003](https://bugs.webkit.org/show_bug.cgi?id=321003)\n- **Web Platform** SVGPathSegList was renamed to SVGPath to match its actual role. [commit 318801@main](https://commits.webkit.org/318801@main) [bug 321248](https://bugs.webkit.org/show_bug.cgi?id=321248)\n- **Web Platform** Remaining SVGPathElement SVGPathSegList members were removed, continuing cleanup of obsolete path segment APIs. [commit 318760@main](https://commits.webkit.org/318760@main) [bug 260894](https://bugs.webkit.org/show_bug.cgi?id=260894)\n- **Web Platform** Global object attribute getters and setters no longer throw when called as bare functions from global scope. [commit 318748@main](https://commits.webkit.org/318748@main) [bug 321066](https://bugs.webkit.org/show_bug.cgi?id=321066)\n\n### Media, WebRTC, GPU, and graphics\n- **Media** MediaRecorder no longer drops a frame whenever its writer input briefly reports not ready. [commit 318778@main](https://commits.webkit.org/318778@main) [bug 321218](https://bugs.webkit.org/show_bug.cgi?id=321218)\n- **GPU** Attached shader performance regressions in Safari were addressed, targeting a slow path in graphics workloads. [commit 318799@main](https://commits.webkit.org/318799@main) [bug 320866](https://bugs.webkit.org/show_bug.cgi?id=320866)\n- **DevTools** Web Inspector Canvas tooling now differentiates configured WebGPU canvas nodes from CSS canvas clients. [commit 318794@main](https://commits.webkit.org/318794@main) [bug 321150](https://bugs.webkit.org/show_bug.cgi?id=321150)\n- **Networking** WebTransport incoming datagram bursts are now delivered through the event loop instead of being dropped. [commit 318747@main](https://commits.webkit.org/318747@main) [bug 321176](https://bugs.webkit.org/show_bug.cgi?id=321176)\n\n### Networking, storage, and security policy\n- **Networking** GLib favicon database page icon lookups were fixed, restoring correct icon fetch behavior. [commit 318812@main](https://commits.webkit.org/318812@main) [bug 321310](https://bugs.webkit.org/show_bug.cgi?id=321310)\n- **Security** ASan builds now generate a crash log when a process is killed for a failed IPC message check, making bad-message failures easier to root-cause. [commit 318804@main](https://commits.webkit.org/318804@main) [bug 321120](https://bugs.webkit.org/show_bug.cgi?id=321120)\n- **Security** Plug-in byte-range CSP checks now correctly fall under object-src instead of connect-src. [commit 318797@main](https://commits.webkit.org/318797@main) [bug 321145](https://bugs.webkit.org/show_bug.cgi?id=321145)\n- **Networking** Network cache traversal avoids decoding full records just to inspect URLs. [commit 318781@main](https://commits.webkit.org/318781@main) [bug 321234](https://bugs.webkit.org/show_bug.cgi?id=321234)\n- **Refactor** Extraneous .get() calls were removed from RemoteAudioTrackProxy, RemoteCDMProxy, and RemoteMediaResource. [commit 318755@main](https://commits.webkit.org/318755@main) [bug 321227](https://bugs.webkit.org/show_bug.cgi?id=321227)\n- **Security** libpas now inlines PAS_MTE_HANDLE variants that resolve to PAS_MTE_CLEAR paths. [commit 318754@main](https://commits.webkit.org/318754@main) [bug 321197](https://bugs.webkit.org/show_bug.cgi?id=321197)\n- **Refactor** CryptoAlgorithmX25519ParamsInit.h got a version typo fix. [commit 318777@main](https://commits.webkit.org/318777@main)\n\n### UI, extensions, and platform ports\n- **Mobile** SwiftBrowser's URL field now updates to the committed URL after navigation. [commit 318811@main](https://commits.webkit.org/318811@main) [bug 321267](https://bugs.webkit.org/show_bug.cgi?id=321267)\n- **UI** WPE gained a WebView::run-color-chooser API. [commit 318807@main](https://commits.webkit.org/318807@main) [bug 321190](https://bugs.webkit.org/show_bug.cgi?id=321190)\n- **Privacy** GTK and WPE now expose a WebKitClipboardPermissionRequest API. [commit 318791@main](https://commits.webkit.org/318791@main) [bug 321204](https://bugs.webkit.org/show_bug.cgi?id=321204)\n- **UI** Web Extensions sidebars now render per-window instead of per-tab unless tab-specific sidebars exist. [commit 318790@main](https://commits.webkit.org/318790@main) [bug 321128](https://bugs.webkit.org/show_bug.cgi?id=321128)\n- **Mobile** macOS now supports gesture event handling without a backing NSEvent. [commit 318771@main](https://commits.webkit.org/318771@main) [bug 321223](https://bugs.webkit.org/show_bug.cgi?id=321223)\n- **GPU** GTK and WPE now disable UseDamagingInformationForCompositing by default. [commit 318770@main](https://commits.webkit.org/318770@main) [bug 321254](https://bugs.webkit.org/show_bug.cgi?id=321254)\n- **Mobile** Web Extensions on iOS 26.6 no longer load with a large delay after a cold Safari launch. [commit 318756@main](https://commits.webkit.org/318756@main) [bug 320812](https://bugs.webkit.org/show_bug.cgi?id=320812)\n- **UI** AppKit gesture test expectations were refreshed by disabling failing cases and re-enabling fixed ones. [commit 318746@main](https://commits.webkit.org/318746@main) [bug 321210](https://bugs.webkit.org/show_bug.cgi?id=321210)\n\n### Build, tooling, and test infrastructure\n- **Build** Public builds now support the macOS 27 SDK. [commit 318803@main](https://commits.webkit.org/318803@main) [bug 321195](https://bugs.webkit.org/show_bug.cgi?id=321195)\n- **Build** TestWTF was fixed on arm64 Linux. [commit 318788@main](https://commits.webkit.org/318788@main) [bug 320929](https://bugs.webkit.org/show_bug.cgi?id=320929)\n- **Build** Buildmaster now fails early when configuration is incomplete. [commit 318787@main](https://commits.webkit.org/318787@main) [bug 321296](https://bugs.webkit.org/show_bug.cgi?id=321296)\n- **Build** GTK and WPE CMake builds now require ninja instead of make. [commit 318773@main](https://commits.webkit.org/318773@main) [bug 321266](https://bugs.webkit.org/show_bug.cgi?id=321266)\n- **Build** The Swift Clang importer now receives the same global preprocessor definitions as C++. [commit 318749@main](https://commits.webkit.org/318749@main) [bug 316878](https://bugs.webkit.org/show_bug.cgi?id=316878)\n- **Build** EWS validate-commit-message no longer rejects cherry-picks of changes you already reviewed. [commit 318757@main](https://commits.webkit.org/318757@main) [bug 321203](https://bugs.webkit.org/show_bug.cgi?id=321203)\n\n### Test gardening and flake fixes\n- **Refactor** A flaky macOS WebRTC synchronization sources WPT was gardened. [commit 318814@main](https://commits.webkit.org/318814@main) [bug 321312](https://bugs.webkit.org/show_bug.cgi?id=321312)\n- **Refactor** A flaky wasm serialization crash regression in macOS Release testing was gardened. [commit 318786@main](https://commits.webkit.org/318786@main) [bug 321298](https://bugs.webkit.org/show_bug.cgi?id=321298)\n- **Refactor** A permanent site-isolation WebRTC audio session failure was marked and handled in testing. [commit 318776@main](https://commits.webkit.org/318776@main) [bug 321166](https://bugs.webkit.org/show_bug.cgi?id=321166)\n- **Refactor** A site-isolation iframe reinsert timeout was addressed in test coverage. [commit 318772@main](https://commits.webkit.org/318772@main) [bug 321224](https://bugs.webkit.org/show_bug.cgi?id=321224)\n- **Refactor** WebDriver WPE gardening updated flaky expectations for the 2026 W32 cycle. [commit 318766@main](https://commits.webkit.org/318766@main) [bug 321152](https://bugs.webkit.org/show_bug.cgi?id=321152)\n- **Refactor** WebDriver tools now let pytest_collection_modifyitems honor flaky expectations correctly. [commit 318761@main](https://commits.webkit.org/318761@main) [bug 321175](https://bugs.webkit.org/show_bug.cgi?id=321175)\n\n## Reverts \u0026 Reapplies\n\nNo revert, reapply, or backed out changes landed in this window.", "repo": "webkit", "repoDisplay": "WebKit", "rollGroups": [ { "name": "Unreviewed", "count": 4 } ], "since": "2026-08-07", "totals": { "commits": 74, "features": 70, "rolls": 4 }, "until": "2026-08-07" }