{ "commits": { "318931@main": { "author": "Lauro Moura", "avatar": "https://www.gravatar.com/avatar/6157f52d61e04c2c63fe7ff668ba69b3?d=identicon\u0026s=64", "cl": "318931@main", "clUrl": "https://commits.webkit.org/318931@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321314\n\nReviewed by Carlos Alberto Lopez Perez.\n\nCurrently, the WebDriver service chooses the WebDriverBiDi WebSockets\nport based on the HTTP server port if the latter is not explicitly\ndefined by the user.\n\nWhile this works fine in low churn scenarios, this does not guarantee\nthat the server will pick a free port, potentially leading to fatal\nstartup errors and test failures.\n\nThis commit makes the WebDriverBiDi server let the OS provide a free\nport if the user does not provide one, reporting that port back through\nthe `webSocketURL` capability. Also, to ensure the os-provided port does\nnot clash with the explicit port requested for the HTTP server, the\nWebSocket server is now started after it.\n\nFor bidi-only connections (not yet supported, though), the user can just\nprovide the port explicitly.\n\n* Source/WebDriver/WebDriverService.cpp:\n(WebDriver::WebDriverService::run):\n* Source/WebDriver/soup/WebSocketServerSoup.cpp:\n(WebDriver::WebSocketServer::listen):\n\nCanonical link: https://commits.webkit.org/318931@main", "email": "lmoura@igalia.com", "hash": "717e0fa523368649b0d4e8acc984897c248d057d", "subject": "[WebDriver][BiDi] Use OS-provided free port instead of guessing based on the http port" }, "318932@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "318932@main", "clUrl": "https://commits.webkit.org/318932@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321421\nrdar://184489618\n\nReviewed by Eric Carlson.\n\nThe test seeked to 0.9 of a one-second resource, called play(), and expected an ended event with no\nfurther seeked event. With site isolation enabled an extra seeked arrived after ended.\ncompletePlayInternal() implements the spec's \"if playback has ended, seek to the start\" step and\nevaluated endedPlayback() when it ran, which is after the playback admission round trip. Playback\nreached the end of the media during that round trip, so endedPlayback() was true by then and\nseekInternal() ran a seek to zero the page never asked for. Without site isolation the admission\ncompleted in the same task or one runloop turn, well inside the test's 100ms margin, so endedPlayback()\nwas still false.\n\nplayInternal() now captures endedPlayback() at play() time and passes it to completePlayInternal(),\nalongside the shouldNotifyAboutPlaying and shouldResolvePromises decisions it already captures there\nfor the same reason.\n\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::completePlayInternal): Take the seek-to-start decision as a parameter.\n(WebCore::HTMLMediaElement::playInternal): Capture endedPlayback() at play() time and pass it through\nthe admission completion handler.\n* Source/WebCore/html/HTMLMediaElement.h:\n\nCanonical link: https://commits.webkit.org/318932@main", "email": "jya@apple.com", "hash": "ce9f06404fc2e96a2f0a837ac3dcfb4650f9e328", "subject": "[site-isolation] media/media-source/media-source-duplicate-seeked.html is a permanent failure" }, "318933@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "318933@main", "clUrl": "https://commits.webkit.org/318933@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321359\nrdar://184404450\n\nReviewed by Eric Carlson.\n\nRemoteMediaSessionManager::sessionWillBeginPlayback() asks the UI process whether playback can begin,\nand never ran the interruption bookkeeping that MediaSessionManagerInterface::sessionWillBeginPlayback()\ndoes: a session that was interrupted when play was requested had that interruption ended once playback\nwas granted.\n\nThe web process now ends the interruption itself when the reply grants playback.\n\n* LayoutTests/platform/ios-site-isolation/TestExpectations:\n* Source/WebKit/WebProcess/Media/RemoteMediaSessionManager.cpp:\n(WebKit::RemoteMediaSessionManager::sessionWillBeginPlayback): Record whether the session was\ninterrupted before sending, and end the interruption when the reply grants playback.\n\nCanonical link: https://commits.webkit.org/318933@main", "email": "jya@apple.com", "hash": "f3108873319e54beedb4e0bd3077d2e07fcf0479", "subject": "[site-isolation] webaudio/audiocontext-state-interrupted.html is a permanent timeout" }, "318934@main": { "author": "Richard Robinson", "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64", "cl": "318934@main", "clUrl": "https://commits.webkit.org/318934@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320972\nrdar://184002187\n\nReviewed by Pascoe, Wenson Hsieh, Lily Spiniolas, and Abrar Rahman Protyasha.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/318934@main", "email": "richard_robinson2@apple.com", "hash": "1769682218f9f30bb23afdd4424aa292face9481", "subject": "[PDF] Use the alternate PDF HUD view by default" }, "318935@main": { "author": "Jessica Lee", "avatar": "https://www.gravatar.com/avatar/fc717c99321d09f31fb9187418a8ffc5?d=identicon\u0026s=64", "cl": "318935@main", "clUrl": "https://commits.webkit.org/318935@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321219\nrdar://184271786\n\nReviewed by Per Arne Vollan and Sihui Liu.\n\nAdd iframe-loading-lazy-multiple-queued-navigations-cross-site.sub.html to the existing WPT test suite for cross-site lazy-loading.\n\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/cross-site/iframe-loading-lazy-multiple-queued-navigations-cross-site.sub-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/cross-site/iframe-loading-lazy-multiple-queued-navigations-cross-site.sub.html: Added.\n\nCanonical link: https://commits.webkit.org/318935@main", "email": "jlee53@apple.com", "hash": "64eac08d07f5828377236f04c06d2f61bc04be80", "subject": "Add iframe-loading-lazy-multiple-queued-navigations to WPT test suite" }, "318936@main": { "author": "Basuke Suzuki", "avatar": "https://www.gravatar.com/avatar/5192a1151c7575317affb7a4633f8d63?d=identicon\u0026s=64", "cl": "318936@main", "clUrl": "https://commits.webkit.org/318936@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321435\nrdar://182381982\n\nReviewed by Alex Christensen.\n\nWebKit does not move a client certificate's private key between processes. The UI process wraps the\nchosen SecIdentity in a SecKeyProxy and sends only the XPC endpoint plus the certificate chain to the\nnetwork process, which rebuilds the identity with -[SecKeyProxy createIdentityFromEndpoint:error:].\nThat call round-trips back to the UI process, so it fails whenever the private key's Keychain ACL\ndenies access - for instance a certificate provisioned by a third-party application whose ACL is bound\nto that application's Team ID.\n\nOn failure the XPC handler only logged and returned, without completing the challenge. The same was\ntrue of every other early return in the handler: a missing or non-endpoint XPC endpoint, a missing\ncertificate data array, a certificate that fails SecCertificateCreateWithData, and an out-of-range\npersistence value. Abandoning the challenge leaves the Challenge object, which owns CFNetwork's\nchallenge completion handler, in AuthenticationManager::m_challenges forever. There is no timeout and\nno fallback, so the TLS handshake keeps waiting for a client certificate and the page load stalls\nindefinitely with no error shown to the user.\n\nMove the credential reconstruction into credentialFromClientCertificateMessage() so that all of those\nfailures collapse into a single std::nullopt, and complete the challenge with PerformDefaultHandling\nwhen it returns nothing. That matches the fallback NetworkProcessProxy::processAuthenticationChallenge\nalready uses for non-server-trust schemes, and turns the hang into a reportable load failure.\n\nThe remaining early return has to stay: there is no identifier to complete, and constructing one anyway\nwould hit the RELEASE_ASSERT in ObjectIdentifier's constructor and crash the network process. Validate\nwith ObjectIdentifier::isValidIdentifier() so the guard rejects exactly what that constructor rejects,\nwhich includes the hash table deleted value as well as zero. It only gets an ASSERT_NOT_REACHED,\nmatching the message name check above it, since an invalid identifier means a malformed message rather\nthan a challenge we could fail.\n\nThis does not make client certificate authentication succeed when the ACL denies access; that denial\nis by design and needs the certificate to be provisioned with an ACL that permits the requesting\napplications.\n\nNo new tests (the failure path needs a Keychain ACL denial, which cannot be simulated in the test\nharness). The unchanged success path stays covered by TestWebKitAPI.Challenge.ClientCertificate.\n\n* Source/WebKit/NetworkProcess/Authentication/cocoa/AuthenticationManagerCocoa.mm:\n(WebKit::credentialFromClientCertificateMessage):\n(WebKit::AuthenticationManager::initializeConnection):\n\nCanonical link: https://commits.webkit.org/318936@main", "email": "basuke@apple.com", "hash": "fc7c2fa58bb93ead23f03d5120ded2fac488bb66", "subject": "[WebKit Networking] Client certificate authentication challenge is never completed when the SecKeyProxy identity cannot be created, hanging the page load" }, "318937@main": { "author": "Yulun Wu", "avatar": "https://www.gravatar.com/avatar/9e34d6632f4d926cdf6fe8dce07f9cb7?d=identicon\u0026s=64", "cl": "318937@main", "clUrl": "https://commits.webkit.org/318937@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321207\nrdar://184267254\n\nReviewed by Sammy Gill.\n\nThis PR refactors various, inlined functions used to filter grid tracks\nby their min track sizing function out into an enum class that is mapped\nto the corresponding min track sizing function.\n\nThis improves readability for increaseSizesToAccommodateSpanningItemsCrossingFlexibleTracks()\nby simplifying the calls to affectedFlexibleTracksMatchingMinSizeFunction().\n\nIntrinsic track size resolution for spanning items is done in 2 steps per spec:\n\nhttps://drafts.csswg.org/css-grid-1/#algo-content\n\nFirst resolving content sized tracks, then resolving flexible tracks. This PR parameterizes this\nto call a single function, resolveIntrinsicTrackSizesWithSpanningItems() with a phase argument to\ndistinguish what step the function is called for. A follow up refactor will extract the code that\ncan be shared between:\n\nincreaseSizesToAccommodateSpanningItemsCrossingFlexibleTracks\n\nand the notImplemented:\n\nincreaseSizesToAccommodateSpanningItemsCrossingContentSizedTracks\n\n* Source/WebCore/layout/formattingContexts/grid/TrackSizingAlgorithm.cpp:\n(WebCore::Layout::affectedFlexibleTracksMatchingMinSizeFunction):\n(WebCore::Layout::increaseSizesToAccommodateSpanningItemsCrossingContentSizedTracks):\n(WebCore::Layout::increaseSizesToAccommodateSpanningItemsCrossingFlexibleTracks):\n(WebCore::Layout::resolveIntrinsicTrackSizesWithSpanningItems):\n(WebCore::Layout::resolveIntrinsicTrackSizes):\n(WebCore::Layout::flexibleTracksMatching): Deleted.\n\nCanonical link: https://commits.webkit.org/318937@main", "email": "yulun_wu@apple.com", "hash": "20363a36ca9fa4ac58f6f962e8c576a1db3460c7", "subject": "[GFC] Refactor track filtering and phased sizing functions for intrinsic sizing" }, "318938@main": { "author": "Wenson Hsieh", "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64", "cl": "318938@main", "clUrl": "https://commits.webkit.org/318938@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321448\nrdar://184542490\n\nReviewed by Abrar Rahman Protyasha and Aditya Keerthi.\n\nAllow text search to \"succeed\" in a given target element, as long as the text matches part of the\ntarget's value, alt text, or placeholder.\n\n* LayoutTests/fast/text-extraction/debug-text-extraction-interactions-expected.txt:\n* LayoutTests/fast/text-extraction/debug-text-extraction-interactions.html:\n* Source/WebCore/page/text-extraction/TextExtraction.cpp:\n(WebCore::TextExtraction::alternativeTextForFallbackTextSearch):\n(WebCore::TextExtraction::searchTextMatchesElementLabelOrRenderedText):\n\nCanonical link: https://commits.webkit.org/318938@main", "email": "wenson_hsieh@apple.com", "hash": "a8d606d89f8c317b62922b10ae5069c3161b059e", "subject": "[Text Extraction] Interactions should not fail when specifying `text` that matches part of the target's value or alt text" }, "318939@main": { "author": "Lauro Moura", "avatar": "https://www.gravatar.com/avatar/6157f52d61e04c2c63fe7ff668ba69b3?d=identicon\u0026s=64", "cl": "318939@main", "clUrl": "https://commits.webkit.org/318939@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321465\n\nUnreviewed build fix.\n\nNon-unified builds are breaking with incomplete\nLogicalSelectionOffsetCaches type.\n\n* Source/WebCore/rendering/RenderBlockFlow.cpp:\n\nCanonical link: https://commits.webkit.org/318939@main", "email": "lmoura@igalia.com", "hash": "dec5ea7d1a1c7044a10700945cc39cc69ac000c4", "subject": "[WPE] RenderBlock.cpp is missing LogicalSelectionOffsetCaches.h include" }, "318940@main": { "author": "Yijia Huang", "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64", "cl": "318940@main", "clUrl": "https://commits.webkit.org/318940@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321414\nrdar://184478785\n\nReviewed by Yusuke Suzuki.\n\ntoPlainDate's non-ISO branch narrowed day to uint8_t, so day mod 256 decided the answer,\nand both clamps in nonISOCalendarDateToISO were one-sided, letting the wrapped 0 build a\nlive PlainDate with day 00:\n\nPlainYearMonth.from({ year: 2567, month: 1, calendar: \"buddhist\" })\n .toPlainDate({ day: 256 }) // 2024-01-00, want 2024-01-31\n\nday is saturated with clampTo\u003cuint8_t\u003e now and both clamps are two-sided. V8 and\nSpiderMonkey agree.\n\ncalendarDateAdd and calendarDateUntil queried ICU past the range where its astronomical\noutput is trustworthy, though the chinese and dangi getters already report plain ISO fields\nthere, so add({years: 1}) on {calendar: \"chinese\", year: 270000} threw on a date that\nconstructs and reads fine. Both take the ISO path past the threshold now. That range is a\ndeliberate divergence, so the values are not expected to match V8; only the absence of a\nfailure is.\n\ncalendarDateUntil passed the calendar's arithmetic year to resolveMonthCodeToOrdinal, whose\nyear argument is the related year -- for chinese and dangi a different number on ICU 76\n(4661 against 2024, 4353 against 2020) and the same one on ICU 78, so a local run cannot\ntell them apart. The snapshot carries the related year separately now, computed from the\nyear's start instant rather than read from an ICU year field, and only the source endpoint\ncomputes it because only the year loop consumes it. Comparisons still use the arithmetic\nyear, so both operands of one always come from the same field. Nothing branches on an ICU\nversion.\n\nTests: JSTests/stress/temporal-lunisolar-extreme-year-arithmetic.js\n JSTests/stress/temporal-plainyearmonth-toplaindate-day-range.js\n\nCanonical link: https://commits.webkit.org/318940@main", "email": "yijia_huang@apple.com", "hash": "284afdacfb77ee797e4874af70539b8b8b3b16d9", "subject": "[JSC][Temporal] Fix non-ISO date field resolution at the range edges" }, "318941@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "318941@main", "clUrl": "https://commits.webkit.org/318941@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321362\nrdar://184409252\n\nReviewed by Eric Carlson.\n\nThe test waited for a pause action that never arrived: MediaSession never calls PlatformMediaSession::setActive(), and\nRemoteMediaSessionManager::sessionWillBeginPlayback() did not call setCurrentSession() either, so the\nsession was in no session list and beginInterruption()'s forEachSession() never reached it.\n\nRegistering it was not enough. Setting playbackState to \"playing\" asked the UI process whether playback\ncould begin and completed on the reply, while the test began and ended the interruption within one task.\nbeginInterruption() sampled m_stateToRestore mid-request and recorded State::Idle, so\nendInterruption(MayResumePlaying) computed shouldResume as false and sent no play action.\n\nThe web process now registers the session with the base class setCurrentSession(), and\nbeginInterruption() records State::Playing while a playback request is in flight.\n\n* LayoutTests/platform/ios-site-isolation/TestExpectations:\n* Source/WebCore/platform/audio/PlatformMediaSession.cpp:\n(WebCore::PlatformMediaSession::beginInterruption): Restore State::Playing when a playback request is\nin flight.\n* Source/WebKit/WebProcess/Media/RemoteMediaSessionManager.cpp:\n(WebKit::RemoteMediaSessionManager::sessionWillBeginPlayback): Register the session with the base class\nsetCurrentSession().\n\nCanonical link: https://commits.webkit.org/318941@main", "email": "jya@apple.com", "hash": "1ac68abf2d3ef078ede465e86da86474faea533b", "subject": "[site-isolation] media/media-session/interruption-sends-pause-action.html is a permanent timeout" }, "318942@main": { "author": "Jamie Murphy", "avatar": "https://www.gravatar.com/avatar/6b42429f4e7db820c9d55e550001567f?d=identicon\u0026s=64", "cl": "318942@main", "clUrl": "https://commits.webkit.org/318942@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320886\n\nReviewed by Timothy Hatcher.\n\nPorts WebExtensionAPINamespace to C++, including\nWebExtensionAPIWebPageNamespace.\n\n* Source/WebKit/CMakeLists.txt:\n* Source/WebKit/DerivedSources-output.xcfilelist:\n* Source/WebKit/DerivedSources.make:\n* Source/WebKit/Sources.txt:\n* Source/WebKit/SourcesCocoa.txt:\n* Source/WebKit/UIProcess/Extensions/WebExtension.cpp:\n(WebKit::WebExtension::WebExtension):\n* Source/WebKit/UIProcess/Extensions/WebExtension.h:\n(WebKit::WebExtension::WebExtension):\n* Source/WebKit/UIProcess/Extensions/glib/WebExtensionGLib.cpp:\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIPermissionsCocoa.mm:\n(WebKit::WebExtensionAPIPermissions::verifyRequestedPermissions):\n* Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIRuntimeCocoa.mm:\n(WebKit::WebExtensionAPIRuntime::getManifest):\n(WebKit::WebExtensionAPIRuntime::getVersion):\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPINamespace.cpp: Renamed from Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPINamespaceCocoa.mm.\n(WebKit::doesDictionaryExist):\n(WebKit::doesKeyExist):\n(WebKit::WebExtensionAPINamespace::isPropertyAllowed):\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPINamespace.h:\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPIRuntime.h:\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPIWebPageNamespace.cpp: Renamed from Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIWebPageNamespaceCocoa.mm.\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPIWebPageNamespace.h:\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPIWebPageRuntime.h:\n* Source/WebKit/WebProcess/Extensions/Bindings/JSWebExtensionWrapper.h:\n(WebKit::toJSValueRefOrJSNull):\n* Source/WebKit/WebProcess/Extensions/Bindings/Scripts/CodeGeneratorExtensions.pm:\n(conditionalString):\n(platformString):\n(_generateHeaderFile):\n(_generateImplementationFile):\n(_staticValuesGetterImplementation):\n(_dynamicAttributesImplementation):\n* Source/WebKit/WebProcess/Extensions/Bindings/Scripts/IDLAttributes.json:\n* Source/WebKit/WebProcess/Extensions/Cocoa/WebExtensionContextProxyCocoa.mm:\n(WebKit::WebExtensionContextProxy::getOrCreate):\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPINamespace.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIWebPageNamespace.idl:\n* Source/WebKit/WebProcess/Extensions/WebExtensionContextProxy.h:\n\nCanonical link: https://commits.webkit.org/318942@main", "email": "jmurphy@igalia.com", "hash": "88312860c0da61c499488ed5627c2c77fc0e1df0", "subject": "Port WebExtensionAPINamespace to C++" }, "318943@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "318943@main", "clUrl": "https://commits.webkit.org/318943@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319212\nrdar://182066464\n\nReviewed by Jean-Yves Avenard.\n\nNeedsVP9FullRangeFlagQuirk (youtube.com, rdar://66242343) was meant to\ncomplete a \"vp09\" codec string that carried the optional fields but omitted\nthe trailing videoFullRangeFlag, appending \".00\" so that the\nmutually-inclusive optional group parsed. It has never done so, and it is\nno longer needed either way.\n\nIt never applied because countPeriods() in\naddVP9FullRangeVideoFlagToContentType() advanced its scan cursor by a\nsingle position after each match (++position) instead of moving past the\nindex the '.' was found at. String::find('.', position) returns the\nabsolute index of the next match at or after position, so the same period\nwas re-counted on every iteration until the cursor walked past it,\ninflating the count: \"vp09.00.41.08.01.01.01.00\" (7 periods) counts as 23,\nso the required `countPeriods(codec) != 7` check never matched and the\nquirk was a no-op from its introduction in 227853@main.\n\nIt is also moot: youtube.com serves WebKit the complete 9-field form,\nverified in Safari as \"vp09.02.51.10.01.09.16.09.00\", which already carries\nvideoFullRangeFlag. That has 8 periods rather than the 7 the quirk keyed on,\nso a repaired countPeriods() would skip it, and parseVPCodecParameters()\naccepts it unmodified. HDR VP9 (PQ/bt2020) plays at 2560x1440@60 in Safari\ntoday with the quirk inert.\n\nEight years without a report of the underlying problem and no remaining\ncodec string to complete, so remove the quirk rather than repair it. This\nis not a behavior change, and no new test is needed: rejection of the\n8-field form is already covered by\nplatform/mac/media/media-source/is-type-supported-vp9-codec-check.html.\n\ncreateSourceBufferPrivate() no longer needs to copy its ContentType\nargument, and its Document lookup is now only used by the\nMEDIA_RECORDER_WEBM Matroska quirk, so it moves inside that guard.\n\n* Source/WebCore/Modules/mediasource/MediaSource.cpp:\n(WebCore::addVP9FullRangeVideoFlagToContentType): Deleted.\n(WebCore::MediaSource::addSourceBuffer):\n(WebCore::MediaSource::isTypeSupported):\n(WebCore::MediaSource::createSourceBufferPrivate):\n* Source/WebCore/page/Quirks.cpp:\n(WebCore::Quirks::needsVP9FullRangeFlagQuirk const): Deleted.\n(WebCore::handleYouTubeQuirks):\n* Source/WebCore/page/Quirks.h:\n* Source/WebCore/page/QuirksData.h:\n\nCanonical link: https://commits.webkit.org/318943@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "1a91592d550067571bf491412e36dd1dd036a4d4", "subject": "Remove the dead NeedsVP9FullRangeFlagQuirk" }, "318944@main": { "author": "Yijia Huang", "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64", "cl": "318944@main", "clUrl": "https://commits.webkit.org/318944@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321452\nrdar://184544084\n\nReviewed by Yusuke Suzuki.\n\nappend() writes the property name as buffer()[m_length] one character at a time,\nand every store forces a reload of both members: m_dynamicBuffer has inline\ncapacity, so buffer() can point inside the object next to m_length, and a store\nthrough it may alias them. The property-name block pays 19 reloads for 9 stores.\n\nCache both in locals for the two runs of writes that sit between capacity checks,\nand publish m_length once at the end. The locals are captured after\nhasRemainingCapacity(), which can reallocate, and m_length is published before\nevery exit -- hasRemainingCapacity() computes m_capacity - m_length, so a stale\nvalue there would over-report free space and skip a needed grow.\n\nHot instantiation (Latin1, DynamicBuffer, HasGap::No): 1712 -\u003e 1648 bytes, loads\n70 -\u003e 56, member reloads 26 -\u003e 12.\n\nCanonical link: https://commits.webkit.org/318944@main", "email": "yijia_huang@apple.com", "hash": "ea3fbb33caa535e1284ece06efc997479ffe5896", "subject": "[JSC] Cache FastStringifier's buffer pointer and length across property emission" }, "318945@main": { "author": "Lauro Moura", "avatar": "https://www.gravatar.com/avatar/6157f52d61e04c2c63fe7ff668ba69b3?d=identicon\u0026s=64", "cl": "318945@main", "clUrl": "https://commits.webkit.org/318945@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321475\n\nUnreviewed test gardening.\n\n* WebDriverTests/TestExpectations.json:\n\nCanonical link: https://commits.webkit.org/318945@main", "email": "lmoura@igalia.com", "hash": "05b150a7ff4d106a57db284b1bafdacdb04d5fdb", "subject": "[WebDriver][GLIB] imported/selenium/py/test/selenium/webdriver/common/quit_tests.py::test_quit is failing" }, "318946@main": { "author": "Lauro Moura", "avatar": "https://www.gravatar.com/avatar/6157f52d61e04c2c63fe7ff668ba69b3?d=identicon\u0026s=64", "cl": "318946@main", "clUrl": "https://commits.webkit.org/318946@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321465\n\nUnreviewed build fix.\n\nInclude the Inlines.h version instead, as RenderBlockFlow.cpp also uses\nsome of them.\n\n* Source/WebCore/rendering/RenderBlockFlow.cpp:\n\nCanonical link: https://commits.webkit.org/318946@main", "email": "lmoura@igalia.com", "hash": "b306be888997ffa7eb1750615a99475944e9204b", "subject": "[WPE] RenderBlock.cpp is missing LogicalSelectionOffsetCaches.h include" }, "318947@main": { "author": "Anuj Panta", "avatar": "https://www.gravatar.com/avatar/f795b7daddea5f93c9cbb5a4a8f0db14?d=identicon\u0026s=64", "cl": "318947@main", "clUrl": "https://commits.webkit.org/318947@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=308899\nrdar://171780810\n\nReviewed by Qianlang Chen.\n\nUnder Site Isolation a cross-origin iframe runs in its own WebContent process,\nwhich has no enabled InspectorPageAgent -- the frontend's Page domain only reaches\nthe main-frame process. So Page.setShowPaintRects enabled the overlay in the\nmain-frame process only, and paints in a cross-origin subframe drew nothing.\n\nFan the toggle out and draw locally per process:\n\n- The main-frame process notifies the UIProcess (ShowPaintRectsChanged), whose\nProxyingPageAgent sends SetShowPaintRects to every WebContent process and\nremembers the state to replay to any process that registers later (e.g. a\ncross-origin navigation spawns a new one).\n\n- Each process's WebInspectorBackend drives the flag on every per-frame\nPageAgentProxy it hosts, and seeds proxies that commit later. The proxy's\ndidPaint draws in the frame's own contents coordinate space via the frame-aware\nInspectorBackendClient::showPaintRect(LocalFrame\u0026, ...); it bails when an enabled\nInspectorPageAgent is present (the main-frame process, which already drew) to\navoid a double-flash.\n\nDraw a Document overlay per local root frame. One process can host several local\nroots (same-site sibling cross-origin iframes), and a GraphicsLayer has a single\nparent, so a shared overlay root would only appear under whichever frame\ncomposited last. PageOverlay gains an associated frame; PageOverlayController\nhosts each associated overlay in that frame's own compositing tree, and\nRenderLayerCompositor gates the overlay host on isRootFrameCompositor() rather\nthan isMainFrame() so it is not orphaned across a root-layer re-attach. Overlay\ngeometry resolves from the process's local main-or-root frame, since the main\nframe can be a RemoteFrame here.\n\nTear down a frame's overlay when it detaches. The overlay is held by\nPageOverlayController, so it (and its per-frame container GraphicsLayer) would\notherwise outlive the frame and, once its associated-frame weak reference cleared,\nbe re-parented under the main frame's overlay root and draw stale layers.\n\nRulers (setShowRulers) are left unimplemented cross-process (they render via\nInspectorOverlay, which subframe processes lack, and need page-wide geometry);\ntracked as a follow-up. A local subframe nested under a local root, or reached\nthrough a remote ancestor, is positioned by frame-local coordinates only and can\ndraw at the wrong offset; documented as a FIXME.\n\nTest: http/tests/site-isolation/inspector/page/set-show-paint-rects-cross-origin-iframe.html\n\n* LayoutTests/http/tests/site-isolation/inspector/page/resources/paint-rects-frame.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/page/set-show-paint-rects-cross-origin-iframe-disabled-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/page/set-show-paint-rects-cross-origin-iframe-disabled.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/page/set-show-paint-rects-cross-origin-iframe-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/page/set-show-paint-rects-cross-origin-iframe.html: Added.\n* Source/WebCore/inspector/InspectorBackendClient.h:\n(WebCore::InspectorBackendClient::showPaintRect):\n(WebCore::InspectorBackendClient::willDestroyFrameOverlays):\n* Source/WebCore/inspector/InspectorInstrumentation.cpp:\n(WebCore::InspectorInstrumentation::didPaintImpl):\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::localMainOrRootFrame const):\n* Source/WebCore/page/Page.h:\n* Source/WebCore/page/PageOverlay.cpp:\n(WebCore::PageOverlay::setAssociatedFrame):\n(WebCore::PageOverlay::associatedFrame const):\n(WebCore::PageOverlay::frameForGeometry const):\n(WebCore::PageOverlay::bounds const):\n(WebCore::PageOverlay::viewToOverlayOffset const):\n(WebCore::PageOverlay::drawRect):\n(WebCore::PageOverlay::mouseEvent):\n* Source/WebCore/page/PageOverlay.h:\n* Source/WebCore/page/PageOverlayController.cpp:\n(WebCore::PageOverlayController::installedPageOverlaysChanged):\n(WebCore::PageOverlayController::documentOverlayRootLayerForFrame):\n(WebCore::PageOverlayController::layerWithDocumentOverlaysForFrame):\n(WebCore::PageOverlayController::willDestroyRootFrameOverlayContainer):\n(WebCore::PageOverlayController::installPageOverlay):\n(WebCore::PageOverlayController::layerWithDocumentOverlays): Deleted.\n* Source/WebCore/page/PageOverlayController.h:\n* Source/WebCore/rendering/RenderLayerCompositor.cpp:\n(WebCore::RenderLayerCompositor::appendDocumentOverlayLayers):\n(WebCore::RenderLayerCompositor::rootLayerAttachmentChanged):\n* Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.cpp:\n(Inspector::ProxyingPageAgent::enableInstrumentationForProcess):\n(Inspector::ProxyingPageAgent::disable):\n(Inspector::ProxyingPageAgent::setShowPaintRects):\n* Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.h:\n* Source/WebKit/UIProcess/Inspector/WebInspectorBackendProxy.cpp:\n(WebKit::WebInspectorBackendProxy::showPaintRectsChanged):\n* Source/WebKit/UIProcess/Inspector/WebInspectorBackendProxy.h:\n* Source/WebKit/UIProcess/Inspector/WebInspectorBackendProxy.messages.in:\n* Source/WebKit/UIProcess/Inspector/WebInspectorUIProxy.cpp:\n(WebKit::WebInspectorUIProxy::showPaintRectsChanged):\n* Source/WebKit/UIProcess/Inspector/WebInspectorUIProxy.h:\n* Source/WebKit/UIProcess/Inspector/WebPageInspectorController.cpp:\n(WebKit::WebPageInspectorController::setShowPaintRects):\n* Source/WebKit/UIProcess/Inspector/WebPageInspectorController.h:\n* Source/WebKit/WebProcess/Inspector/PageAgentProxy.cpp:\n(WebKit::PageAgentProxy::didPaint):\n* Source/WebKit/WebProcess/Inspector/PageAgentProxy.h:\n(WebKit::PageAgentProxy::setShowPaintRects):\n* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.cpp:\n(WebKit::WebInspectorBackend::showPaintRectsChanged):\n(WebKit::WebInspectorBackend::removeInstrumentationForFrame):\n(WebKit::WebInspectorBackend::ensurePageInstrumentationForFrame):\n(WebKit::WebInspectorBackend::disablePageInstrumentation):\n(WebKit::WebInspectorBackend::setShowPaintRects):\n* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.h:\n* Source/WebKit/WebProcess/Inspector/WebInspectorBackend.messages.in:\n* Source/WebKit/WebProcess/Inspector/WebInspectorBackendClient.cpp:\n(WebKit::WebInspectorBackendClient::~WebInspectorBackendClient):\n(WebKit::WebInspectorBackendClient::ensurePaintRectOverlayForFrame):\n(WebKit::WebInspectorBackendClient::showPaintRect):\n(WebKit::WebInspectorBackendClient::paintRectCount const):\n(WebKit::WebInspectorBackendClient::animationEndedForLayer):\n(WebKit::WebInspectorBackendClient::willDestroyFrameOverlays):\n(WebKit::WebInspectorBackendClient::setShowPaintRects):\n* Source/WebKit/WebProcess/Inspector/WebInspectorBackendClient.h:\n* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:\n(WebKit::WebFrame::removeFromTree):\n\nCanonical link: https://commits.webkit.org/318947@main", "email": "a_panta@apple.com", "hash": "d8e1779cc82b74f6663e2014b4e499238c553694", "subject": "Web Inspector: [Site Isolation] Show Paint Rects does not draw in cross-origin iframes" }, "318948@main": { "author": "Patrick Griffis", "avatar": "https://www.gravatar.com/avatar/2233c3a857004b126158572af9fe36f7?d=identicon\u0026s=64", "cl": "318948@main", "clUrl": "https://commits.webkit.org/318948@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321453\n\nUnreviewed gardening.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318948@main", "email": "pgriffis@igalia.com", "hash": "64dbc7bdb75b1815aed7df88d5c566285da0da4f", "subject": "[GTK][WPE] Gardening of tests - 2026-08-10" }, "318949@main": { "author": "Jamie Murphy", "avatar": "https://www.gravatar.com/avatar/6b42429f4e7db820c9d55e550001567f?d=identicon\u0026s=64", "cl": "318949@main", "clUrl": "https://commits.webkit.org/318949@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321405\n\nReviewed by Michael Catanzaro and Patrick Griffis.\n\nAdd APIs for getting whether an ExtensionContext\nhas injected content (script or stylesheets),\nand for getting said injected content.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestWebKitWebExtensionContext.cpp\n\n* Source/WebKit/UIProcess/API/glib/WebKitWebExtensionContext.cpp:\n(webkitWebExtensionContextGetProperty):\n(webkit_web_extension_context_class_init):\n(webkit_web_extension_context_get_has_injected_content):\n(webkit_web_extension_context_has_injected_content_for_uri):\n* Source/WebKit/UIProcess/API/glib/WebKitWebExtensionContext.h.in:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestWebKitWebExtensionContext.cpp:\n(testContentScriptsParsing):\n(beforeAll):\n\nCanonical link: https://commits.webkit.org/318949@main", "email": "jmurphy@igalia.com", "hash": "287ba174e26687c71bdd1ade9f1145c9dfd94a17", "subject": "[GTK] Add WebKitWebExtensionContext Injected Content handlers" }, "318950@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "318950@main", "clUrl": "https://commits.webkit.org/318950@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321389\nrdar://184443879\n\nReviewed by Yijia Huang.\n\nThis patch implements import-text proposal[1]. This adds type: \"text\"\nattribute to the import statement / dynamic-import so that we can load a\ntext from the source. This is pretty similar to import-json (type: \"json\"),\nand \"text\" is just for strings. Most of the implementations is mimicking\nthe existing type: \"json\" implementations, so straightforward.\n\n[1]: https://github.com/tc39/proposal-import-text\n\n* JSTests/test262/config.yaml:\n* JSTests/test262/expectations.yaml:\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/connect-src/connect-src-text-import-allowed.sub-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/connect-src/connect-src-text-import-blocked.sub-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/fetch/api/request/destination/fetch-destination.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/fetch/metadata/generated/script-text-module-import-static.https.sub-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/metadata/generated/script-text-module-import-static.sub-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/metadata/text.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/preload/modulepreload-expected.txt:\n* LayoutTests/js/dom/modules/import-text-module-expected.txt: Added.\n* LayoutTests/js/dom/modules/import-text-module.html: Added.\n* LayoutTests/js/dom/modules/resources/module-src-text.js: Added.\n* LayoutTests/platform/ios/imported/w3c/web-platform-tests/fetch/api/request/destination/fetch-destination.https-expected.txt:\n* Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.cpp:\n(Inspector::scriptTypeForScript):\n* Source/JavaScriptCore/jsc.cpp:\n(GlobalObject::moduleLoaderFetch):\n* Source/JavaScriptCore/parser/NodesAnalyzeModule.cpp:\n(JSC::tryCreateAttributes):\n* Source/JavaScriptCore/parser/SourceProvider.h:\n(JSC::SourceProvider::isModuleType const):\n* Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp:\n(JSC::AbstractModuleRecord::AbstractModuleRecord):\n(JSC::AbstractModuleRecord::moduleType const):\n* Source/JavaScriptCore/runtime/AbstractModuleRecord.h:\n* Source/JavaScriptCore/runtime/Completion.cpp:\n(JSC::getSourceType):\n(JSC::retrieveTypeImportAttribute):\n* Source/JavaScriptCore/runtime/CyclicModuleRecord.cpp:\n(JSC::CyclicModuleRecord::CyclicModuleRecord):\n* Source/JavaScriptCore/runtime/CyclicModuleRecord.h:\n* Source/JavaScriptCore/runtime/JSModuleLoader.cpp:\n(JSC::JSModuleLoader::makeModule):\n* Source/JavaScriptCore/runtime/JSModuleRecord.cpp:\n(JSC::JSModuleRecord::JSModuleRecord):\n* Source/JavaScriptCore/runtime/ScriptFetchParameters.h:\n(JSC::ScriptFetchParameters::parseType):\n* Source/JavaScriptCore/runtime/SyntheticModuleRecord.cpp:\n(JSC::SyntheticModuleRecord::create):\n(JSC::SyntheticModuleRecord::SyntheticModuleRecord):\n(JSC::SyntheticModuleRecord::tryCreateWithExportNamesAndValues):\n(JSC::SyntheticModuleRecord::tryCreateDefaultExportSyntheticModule):\n(JSC::SyntheticModuleRecord::parseJSONModule):\n(JSC::SyntheticModuleRecord::createTextModule):\n* Source/JavaScriptCore/runtime/SyntheticModuleRecord.h:\n* Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp:\n(JSC::WebAssemblyModuleRecord::WebAssemblyModuleRecord):\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebCore/Modules/fetch/FetchRequestDestination.idl:\n* Source/WebCore/bindings/js/CachedModuleScriptLoader.cpp:\n(WebCore::CachedModuleScriptLoader::load):\n* Source/WebCore/bindings/js/CachedScriptFetcher.cpp:\n(WebCore::CachedScriptFetcher::requestScriptWithCache const):\n* Source/WebCore/bindings/js/ScriptModuleLoader.cpp:\n(WebCore::ScriptModuleLoader::importModule):\n(WebCore::ScriptModuleLoader::notifyFinished):\n* Source/WebCore/bindings/js/ScriptModuleLoader.h:\n* Source/WebCore/bindings/js/WorkerModuleScriptLoader.cpp:\n(WebCore::WorkerModuleScriptLoader::load):\n* Source/WebCore/html/parser/HTMLResourcePreloader.cpp:\n(WebCore::PreloadRequest::resourceRequest):\n* Source/WebCore/inspector/InspectorResourceUtilities.cpp:\n(Inspector::ResourceUtilities::inspectorResourceType):\n(Inspector::ResourceUtilities::cachedResourceContent):\n* Source/WebCore/loader/DefaultResourceLoadPriority.cpp:\n(WebCore::DefaultResourceLoadPriority::forResourceType):\n* Source/WebCore/loader/FetchOptions.h:\n* Source/WebCore/loader/FetchOptionsDestination.h:\n* Source/WebCore/loader/LinkLoader.cpp:\n(WebCore::LinkLoader::resourceTypeFromAsAttribute):\n(WebCore::createLinkPreloadResourceClient):\n(WebCore::LinkLoader::isSupportedType):\n(WebCore::LinkLoader::preloadIfNeeded):\n* Source/WebCore/loader/ResourceLoadInfo.cpp:\n(WebCore::ContentExtensions::toResourceType):\n* Source/WebCore/loader/SubresourceLoader.cpp:\n(WebCore::logResourceLoaded):\n* Source/WebCore/loader/archive/cf/LegacyWebArchive.cpp:\n(WebCore::LegacyWebArchive::createInternal):\n* Source/WebCore/loader/cache/CachedResource.cpp:\n(WebCore::deadDecodedDataDeletionIntervalForResourceType):\n* Source/WebCore/loader/cache/CachedResource.h:\n* Source/WebCore/loader/cache/CachedResourceLoader.cpp:\n(WebCore::createResource):\n(WebCore::CachedResourceLoader::requestScript):\n(WebCore::CachedResourceLoader::checkInsecureContent const):\n(WebCore::CachedResourceLoader::allowedByContentSecurityPolicy const):\n(WebCore::destinationForType):\n(WebCore::CachedResourceLoader::requestResource):\n(WebCore::CachedResourceLoader::preload):\n* Source/WebCore/loader/cache/CachedScript.cpp:\n(WebCore::CachedScript::CachedScript):\n* Source/WebCore/loader/cache/CachedScript.h:\n(isType):\n* Source/WebCore/loader/cache/MemoryCache.cpp:\n(WebCore::MemoryCache::getStatistics):\n* Source/WebCore/workers/WorkerScriptLoader.cpp:\n(WebCore::WorkerScriptLoader::validateWorkerResponse):\n* Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp:\n(WebKit::NetworkLoadChecker::isAllowedByContentSecurityPolicy):\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:\n(WebKit::NetworkResourceLoader::resourceLoadInfo):\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp:\n(WebKit::maximumBufferingTime):\n* Tools/Scripts/webkitpy/style/checkers/cpp.py:\n\nCanonical link: https://commits.webkit.org/318950@main", "email": "ysuzuki@apple.com", "hash": "49246d26127685998d42f9ede4f925d490e15449", "subject": "[JSC] Implement import-text" }, "318951@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "318951@main", "clUrl": "https://commits.webkit.org/318951@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321439\nReviewed by Yusuke Suzuki.\n\nOMG already skips the null check when the reference type is\nnon-nullable. BBQ still always emitted it for ref.as_non_null,\ncall_ref, and throw_ref because those emitters discarded the wasm\ntype. Keep TypedExpression and skip the check when !isNullable(),\nmatching array/struct and OMG.\n\n* JSTests/wasm/gc/elide-null-checks.js: Added.\n* Source/JavaScriptCore/wasm/WasmBBQJIT.h:\n(JSC::Wasm::BBQJITImpl::BBQJIT::addRefAsNonNull):\n(JSC::Wasm::BBQJITImpl::BBQJIT::addThrowRef):\n* Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp:\n(JSC::Wasm::BBQJITImpl::BBQJIT::addRefAsNonNull):\n(JSC::Wasm::BBQJITImpl::BBQJIT::addCallRef):\n(JSC::Wasm::BBQJITImpl::BBQJIT::addThrowRef):\n\nCanonical link: https://commits.webkit.org/318951@main", "email": "chi187@gmail.com", "hash": "4687d7ecfefad54c517d4af8e238e556ff4eefb3", "subject": "[JSC][Wasm] Elide BBQ null checks on non-nullable refs" }, "318952@main": { "author": "Mike Wyrzykowski", "avatar": "https://www.gravatar.com/avatar/4b1bc9e238714f95e22d5d2454c07066?d=identicon\u0026s=64", "cl": "318952@main", "clUrl": "https://commits.webkit.org/318952@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321430\nrdar://184529653\n\nReviewed by Dan Glastonbury.\n\nIndexed images were previously not supported correctly in the image\nupload path from GPUQueue.\n\nTest: fast/webgpu/copy-indexed-png-palette.html\n\n* LayoutTests/fast/webgpu/copy-indexed-png-palette-expected.txt: Added.\n* LayoutTests/fast/webgpu/copy-indexed-png-palette.html: Added.\n* Source/WebCore/Modules/WebGPU/GPUQueue.cpp:\n(WebCore::imageBytesForSource):\n\nCanonical link: https://commits.webkit.org/318952@main", "email": "mwyrzykowski@apple.com", "hash": "09c8c53713588fea24ef7208937b2695da950cdc", "subject": "GPUQueue.copyExternalImageToTexture() does not upload indexed PNG correctly" }, "318953@main": { "author": "Yijia Huang", "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64", "cl": "318953@main", "clUrl": "https://commits.webkit.org/318953@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321477\nrdar://184567556\n\nReviewed by Yusuke Suzuki.\n\nSites across the calendar and time zone bridges folded an ICU failure into a\nlegitimate-looking answer. No test: none of it is reachable while ICU is healthy -- extreme\nyears on all eight non-ISO calendars, hebrew year 0, PlainYearMonth diffs at both range ends\nand far-future transitions behave identically before and after.\n\nyearContainsMonthCode short-circuited on `cal \u0026\u0026`, so a failed calendar open read as \"this\nyear has no such month\" and constrainMonthCodeGivenContainment rewrote the month -- for\nhebrew a valid M05L became M06, bypassing overflow: \"reject\". monthCodeOrdinalInYear fell\nback to monthCode.monthNumber, losing the leap-month shift, and resolveMonthCodeToOrdinal\nhad three failure paths returning 1, which fed the year count in calendarDateUntil. The\nisHebrewYear0 trio folded a read failure into false, so callers skipped the hebrew\nyear-0 Kislev correction. All return optional or TemporalResult now; the genuine\nconstrain-backward exits stay distinct from the failure exits, and monthCodeOrdinalInYear's\nASSERT goes with the type change.\n\ngetTimeZoneTransition's offset check reused the UErrorCode ucal_getTimeZoneTransitionDate\nhad written, and ICU is sticky, so after any upstream failure all six calls no-oped to zero\nand it returned the transition regardless. It reuses getOffsetMsAtEpoch now. PlainYearMonth\nuntil/since and monthDayFromFields no longer fall back to a value on failure.\n\nCanonical link: https://commits.webkit.org/318953@main", "email": "yijia_huang@apple.com", "hash": "642d9211add2a4e20dbe7be9a2012d0de1916b2c", "subject": "[JSC][Temporal] Give the ICU paths an error channel instead of plausible values" }, "318954@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "318954@main", "clUrl": "https://commits.webkit.org/318954@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321133\nrdar://184165368\n\nReviewed by Jessica Cheung.\n\nWe had no coverage for how the interactive-widget viewport meta argument is\nparsed: the existing tests in fast/visual-viewport/ios/interactive-widget/ all\npass a valid value and exercise keyboard behavior. Nothing verified that a bad\nvalue is rejected, or that rejecting it leaves the rest of the viewport\narguments alone.\n\nThere is no web-exposed way to read back the parsed value, so these tests\nobserve parsing through the warning reported by parseInteractiveWidgetValue()\nand through internals.configurationForViewport(), which shows that the other\narguments still resolve as written.\n\nAdded to fast/viewport/:\n\n- interactive-widget-invalid-values.html: an unknown value, an empty value, a\n bare key with no \"=\", near misses (\"resizes\", \"resizes-contentt\",\n \"overlays_content\", \"RESize-CONTENT\"), a value with a trailing \";\", and\n \"RESIZES-VISUAL\" spelled with U+0130 to pin that keyword matching folds ASCII\n only. Each is reported and ignored, and width/initial-scale still resolve to\n 320x352 at scale 1.\n- interactive-widget-valid-values.html: the key and its values are ASCII\n case-insensitive and whitespace around \"=\" is allowed, so no warnings.\n- interactive-widget-semicolon-separator.html: \";\" is not a viewport argument\n separator, so it becomes part of the preceding value while the\n interactive-widget argument after it is still parsed.\n- interactive-widget-duplicate-key.html: a duplicated key within one content\n string is not a parse error; each occurrence is parsed in order.\n- interactive-widget-conflicting-meta-tags.html: a second viewport meta tag\n replaces the first tag's arguments entirely.\n- interactive-widget-disabled.html: with the feature disabled the key itself is\n unrecognized, even for a valid value.\n\nAdded to fast/visual-viewport/ios/interactive-widget/:\n\n- invalid-value-falls-back-to-resizes-visual.html: an invalid value falls back\n to resizes-visual rather than to some other mode, checked end to end with the\n keyboard shown: the layout viewport is left unshrunk (unlike\n resizes-content) while the visual viewport does shrink (unlike\n overlays-content).\n\nNo change in behavior.\n\n* LayoutTests/fast/viewport/interactive-widget-conflicting-meta-tags-expected.txt: Added.\n* LayoutTests/fast/viewport/interactive-widget-conflicting-meta-tags.html: Added.\n* LayoutTests/fast/viewport/interactive-widget-disabled-expected.txt: Added.\n* LayoutTests/fast/viewport/interactive-widget-disabled.html: Added.\n* LayoutTests/fast/viewport/interactive-widget-duplicate-key-expected.txt: Added.\n* LayoutTests/fast/viewport/interactive-widget-duplicate-key.html: Added.\n* LayoutTests/fast/viewport/interactive-widget-invalid-values-expected.txt: Added.\n* LayoutTests/fast/viewport/interactive-widget-invalid-values.html: Added.\n* LayoutTests/fast/viewport/interactive-widget-semicolon-separator-expected.txt: Added.\n* LayoutTests/fast/viewport/interactive-widget-semicolon-separator.html: Added.\n* LayoutTests/fast/viewport/interactive-widget-valid-values-expected.txt: Added.\n* LayoutTests/fast/viewport/interactive-widget-valid-values.html: Added.\n* LayoutTests/fast/visual-viewport/ios/interactive-widget/invalid-value-falls-back-to-resizes-visual-expected.txt: Added.\n* LayoutTests/fast/visual-viewport/ios/interactive-widget/invalid-value-falls-back-to-resizes-visual.html: Added.\n\nCanonical link: https://commits.webkit.org/318954@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "2fea5e9c6376a50df370cf88a65fa0983616282e", "subject": "[Test Coverage] Add tests for parsing the interactive-widget viewport meta argument" }, "318955@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "318955@main", "clUrl": "https://commits.webkit.org/318955@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321423\n\nReviewed by Keith Miller.\n\n317978@main appended a 2-bit TriState bit-field to StructureRareData, whose\nmembers already filled exactly 96 bytes. The new field spilled into byte 97,\nso sizeof(StructureRareData) became 104 and its IsoSubspace cell grew from\n96 to 112 bytes.\n\nMake m_activeReplacementWatchpointSet a 30-bit bit-field so that it shares a\n32-bit word with m_cachedHasDefaultToPrimitiveFastAndNonObservable. The counter\ntracks the number of entries in m_replacementWatchpointSets, which is bounded by\nthe number of property offsets and cannot approach 2^30. Also add a\nstatic_assert on sizeof(StructureRareData) so that this does not regress\nsilently again; like the existing PropertyWatchpointMap assert it is NDEBUG-only\nbecause HashTable grows in debug builds.\n\n* Source/JavaScriptCore/runtime/StructureRareData.h:\n\nCanonical link: https://commits.webkit.org/318955@main", "email": "sosuke@bun.sh", "hash": "edd953757f9fb56212a3fd02b16b79a1e8f51d8d", "subject": "[JSC] Shrink `StructureRareData` back to 96 bytes" }, "318956@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "318956@main", "clUrl": "https://commits.webkit.org/318956@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321251\n\nReviewed by Yusuke Suzuki.\n\nIn a string-list group, a non-last alternative may branch to the group's\nsuccess target only from the comparison of its last character.\ngeneratePatternCharacterOnce() collects adjacent characters into opList but,\nwith a 16-bit subject and /u or /v, stops at a non-BMP or lone surrogate\ncharacter, which is matched by its own Term afterwards. Since 292003@main\nthe success branch was emitted on reaching the end of opList rather than the\nend of the alternative:\n\n /^(?:a\\u{1F600}|qa)/u.exec(\"azk\\u0101\") // [\"azk\"], expected null\n /^(?:a\\u{1F600}|qa)/u.exec(\"z\\u{1F600}\\u0101\") // [\"z\\u{1F600}\"], expected null\n\nOnly use lastMatchTargets when m_ops[opIndex + opList.size()] is not a Term,\nas 290791@main originally did.\n\nTest: JSTests/stress/regexp-string-list-non-bmp-alternative.js\n\n* JSTests/stress/regexp-string-list-non-bmp-alternative.js: Added.\n(shouldBe):\n(test):\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n\nCanonical link: https://commits.webkit.org/318956@main", "email": "sosuke@bun.sh", "hash": "dc35ebdb9bf4758406098b665ee7974f1b28cb76", "subject": "[YARR] JIT string-list alternative with a non-BMP character matches after only its leading characters" }, "318957@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "318957@main", "clUrl": "https://commits.webkit.org/318957@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321433\n\nReviewed by Keith Miller.\n\nperformMicrotaskCheckpoint calls the out-of-line drain() even when the queue\nis empty, which constructs and destroys a MicrotaskCallCache just to return\n`{ nullptr, true }`. Check m_queue.isEmpty() in the loop condition instead.\nAn empty VM::drainMicrotasks() goes from 12.1ns to 6.1ns in the jsc shell.\n\n* Source/JavaScriptCore/runtime/MicrotaskQueueInlines.h:\n(JSC::MicrotaskQueue::performMicrotaskCheckpoint):\n\nCanonical link: https://commits.webkit.org/318957@main", "email": "sosuke@bun.sh", "hash": "f2b02eb84f2547e9896e3b8cd892c48683cf4c19", "subject": "[JSC] `MicrotaskQueue::performMicrotaskCheckpoint` should not call `drain()` on an empty queue" }, "318958@main": { "author": "Brent Fulgham", "avatar": "https://www.gravatar.com/avatar/c6989a65afef0d015b55c65406e37ccc?d=identicon\u0026s=64", "cl": "318958@main", "clUrl": "https://commits.webkit.org/318958@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321459\nrdar://184548373\n\nReviewed by Tim Nguyen.\n\nWe now pass all WPT tests for this feature. Time to enable it.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/318958@main", "email": "bfulgham@apple.com", "hash": "6c9dd0997a279b604b6f7190e89f1962a4bbebdd", "subject": "Enable popover=hint by default" }, "318959@main": { "author": "Vassili Bykov", "avatar": "https://www.gravatar.com/avatar/73ac31c69ff9a621b733e47253103b8a?d=identicon\u0026s=64", "cl": "318959@main", "clUrl": "https://commits.webkit.org/318959@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321476\nrdar://184566236\n\nReviewed by Yusuke Suzuki.\n\nHigher JIT tiers generate a fast path for op_switch_string to perform pointer\nidentity-based inline dispatch if the scrutinee is an atom. Baseline JIT does not do that,\nso dispatch is always handled by the slow case operationSwitchStringWithUnknownKeyType,\nwhich hashes the scrutinee's characters and probes the jump table.\n\nThis patch adds support to generate a fast path in the baseline JIT tier to handle an\natomic scrutinee.\n\nTesting: added JSTests/stress/switch-string-inline-atom-dispatch.js to ensure correctness\nCanonical link: https://commits.webkit.org/318959@main", "email": "v_bykov@apple.com", "hash": "c00fd8a9713c5c2ab4a542ea533d00cd205ec8f2", "subject": "[JSC] Implement op_switch_string fast path in baseline JIT" }, "318960@main": { "author": "Joanne Pan", "avatar": "https://www.gravatar.com/avatar/5cbbf578426a0c98cb5c977ca2dd88fc?d=identicon\u0026s=64", "cl": "318960@main", "clUrl": "https://commits.webkit.org/318960@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=314234\nrdar://176395332\n\nReviewed by Tim Nguyen and Antti Koivisto.\n\nOriginal patch by fantasai in PR #64877; reworked to match the \u003crandom-key\u003e\ngrammar structure and address review feedback.\n\nrandom() and random-item() gained the property-scoped and property-index-scoped\n\u003crandom-cache-key\u003e keywords, which were added to the spec alongside the\n310532@main scoping inversion but never implemented. The \u003crandom-key\u003e is modeled\nto mirror the grammar: an optional \u003cdashed-ident\u003e name, element-scoped, and an\noptional property-scoped or property-index-scoped descriptor, with auto as a\ndistinct top-level alternative. It resolves to a caching key so that random\nfunctions sharing the same property (and, for property-index-scoped, the same\nvalue index) share a base value. Per CSS Values 5 ยง 9.4.1 these keywords are\nmeant to simplify at parse time into a \u003crandom-ua-ident\u003e; that form and its\nserialization are a follow-up, so for now they serialize as the keyword rather\nthan the canonical ua-* form.\n\nAs a side effect of making auto a distinct top-level alternative, random(auto, ...)\nis now element-scoped, matching an omitted \u003crandom-key\u003e. It was previously\ndocument-scoped, which was a bug.\n\nThis also fixes a pre-existing serialization bug: a \u003crandom-key\u003e with\nelement-scoped but no \u003cdashed-ident\u003e serialized with a stray leading space, as\nrandom( element-scoped, 0px, 100px). Two random-serialize.tentative expectations\nflip from FAIL to PASS accordingly.\n\nrandom-item() rejects an explicit property-scoped or property-index-scoped inside a\ncustom property, because cssPropertyID() is CSSPropertyCustom for every custom\nproperty and honoring the scope would collapse them onto one shared base value.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-computed.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-serialize.tentative-expected.txt:\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/css/CSSRandomKeyParser.cpp:\n(WebCore::CSSPropertyParserHelpers::consumeUnresolvedRandomKey):\n(WebCore::CSSPropertyParserHelpers::randomSharingAuto):\n* Source/WebCore/css/CSSRandomKeyParser.h:\n* Source/WebCore/css/CSSValueKeywords.in:\n* Source/WebCore/css/calc/CSSCalcRandomCachingKey.h:\n(WebCore::CSSCalc::RandomCachingKey::RandomCachingKey):\n(WebCore::CSSCalc::RandomCachingKey::isHashTableDeletedValue const):\n(WebCore::CSSCalc::RandomCachingKey::isHashTableEmptyValue const):\n(WTF::CSSCalcRandomCachingKeyHash::hash):\n(WebCore::CSSCalc::RandomCachingKey::convertToIdentifier): Deleted.\n* Source/WebCore/css/calc/CSSCalcRandomSharing.h: Renamed from Source/WebCore/css/calc/CSSCalcRandomSharingOptions.h.\n* Source/WebCore/css/calc/CSSCalcTree+Evaluation.cpp:\n(WebCore::CSSCalc::resolveRandomBaseValue):\n* Source/WebCore/css/calc/CSSCalcTree+Evaluation.h:\n* Source/WebCore/css/calc/CSSCalcTree+Parser.cpp:\n(WebCore::CSSCalc::consumeRandom):\n* Source/WebCore/css/calc/CSSCalcTree+Serialization.cpp:\n(WebCore::CSSCalc::serializeMathFunctionArguments):\n* Source/WebCore/css/calc/CSSCalcTree+Simplification.cpp:\n(WebCore::CSSCalc::simplify):\n* Source/WebCore/css/calc/CSSCalcTree.h:\n* Source/WebCore/style/StyleSubstitutionResolver.cpp:\n(WebCore::Style::randomKeyHasExplicitPropertyScope):\n(WebCore::Style::SubstitutionResolver::randomItemBaseValue):\n* Source/WebCore/style/calc/StyleCalculationTree+Conversion.cpp:\n(WebCore::Style::Calculation::toStyle):\n\nCanonical link: https://commits.webkit.org/318960@main", "email": "jpan0917@gmail.com", "hash": "93db4c27e85ed5fdde2c83fb523405b759ac223c", "subject": "Add random() property-scoped and property-index-scoped caching keywords" }, "318961@main": { "author": "Etienne Segonzac", "avatar": "https://www.gravatar.com/avatar/3566820d0ba7e035bc440dc736c17f0c?d=identicon\u0026s=64", "cl": "318961@main", "clUrl": "https://commits.webkit.org/318961@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321293\n\u003crdar://182292331\u003e\n\nReviewed by Mike Wyrzykowski.\n\nAdd initial `portal-orbit` support for Spatial Portals. Only `orbit` is\nsupported initially and it matches the `stagemode=orbit` behavior of\nHTMLModelElement.\n\nTests: spatial-css/spatial-portal-action-dynamic.html\n spatial-css/spatial-portal-action-multi-model.html\n spatial-css/spatial-portal-action-off.html\n spatial-css/spatial-portal-action-parsing.html\n spatial-css/spatial-portal-action-requires-auto-transform.html\n spatial-css/spatial-portal-action.html\n spatial-css/spatial-portal-determines-if-scroll-gesture-updates-position-information.html\n spatial-css/spatial-portal-nested-model-stagemode.html\n\n* LayoutTests/spatial-css/resources/spatial-portal-utils.js:\n(const.createPortal):\n(const.appendModel):\n* LayoutTests/spatial-css/spatial-portal-action-dynamic-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-action-dynamic.html: Added.\n* LayoutTests/spatial-css/spatial-portal-action-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-action-multi-model-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-action-multi-model.html: Added.\n* LayoutTests/spatial-css/spatial-portal-action-off-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-action-off.html: Added.\n* LayoutTests/spatial-css/spatial-portal-action-parsing-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-action-parsing.html: Added.\n* LayoutTests/spatial-css/spatial-portal-action-requires-auto-transform-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-action-requires-auto-transform.html: Added.\n* LayoutTests/spatial-css/spatial-portal-action.html: Added.\n* LayoutTests/spatial-css/spatial-portal-determines-if-scroll-gesture-updates-position-information-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-determines-if-scroll-gesture-updates-position-information.html: Added.\n* LayoutTests/spatial-css/spatial-portal-nested-model-stagemode-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-nested-model-stagemode.html: Added.\nAdd new tests covering:\n- the \"fitting\" behavior with multiple models\n- the relationship between `portal-action` and `portal-transform`\n- the relationship between `portal-action` and the HTMLModelElement\n `stagemode` attribute\n- the property parsing\n- the gesture handlers / position information\n\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Modules/model-element/PortalAction.h: Added.\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/css/CSSProperties.json:\n* Source/WebCore/css/CSSValueKeywords.in:\n* Source/WebCore/rendering/RenderBox.cpp:\n(WebCore::RenderBox::willBeDestroyed):\n(WebCore::portalTransformKind):\n(WebCore::portalActionKind):\n(WebCore::usedPortalActionKind):\n(WebCore::pushSpatialPortalProperties):\n(WebCore::updateSpatialPortalController):\n(WebCore::spatialPortalStyleDidChange):\n(WebCore::RenderBox::styleDidChange):\n* Source/WebCore/rendering/style/RenderStyleConstants.cpp:\n(WebCore::operator\u003c\u003c):\n* Source/WebCore/rendering/style/RenderStyleConstants.h:\n* Source/WebCore/style/computed/data/StyleNonInheritedRareData.cpp:\n(WebCore::Style::NonInheritedRareData::NonInheritedRareData):\n(WebCore::Style::NonInheritedRareData::operator== const):\n(WebCore::Style::NonInheritedRareData::dumpDifferences const):\n* Source/WebCore/style/computed/data/StyleNonInheritedRareData.h:\n* Source/WebCore/style/values/primitives/StyleKeyword+Mappings.h:\nIntroduce the `portal-action` CSS property, defaults to `none`.\n\n* Source/WebCore/Modules/model-element/HTMLModelElement.cpp:\n(WebCore::HTMLModelElement::lastRegisteredPortalController const):\n(WebCore::HTMLModelElement::spatialPortalContextDidChange):\n(WebCore::HTMLModelElement::stageMode const):\n`stagemode` is ignore while the model is nested inside of a portal.\n(WebCore::HTMLModelElement::updateStageMode):\nRemove superfluous calls to `didAddTouchEventHandler` /\n`didRemoveTouchEventHandler`.\n\n* Source/WebCore/Modules/model-element/HTMLModelElement.h:\n* Source/WebCore/Modules/model-element/ModelPlayer.cpp:\n(WebCore::ModelPlayer::setPortalAction):\n* Source/WebCore/Modules/model-element/ModelPlayer.h:\n* Source/WebCore/Modules/model-element/SpatialPortalController.cpp:\n(WebCore::SpatialPortalController::SpatialPortalController):\n(WebCore::SpatialPortalController::~SpatialPortalController):\n(WebCore::SpatialPortalController::prepareForRemoval):\n(WebCore::SpatialPortalController::ensureModelPlayer):\n(WebCore::SpatialPortalController::setPortalAction):\n(WebCore::SpatialPortalController::updateGestureHandling):\n(WebCore::SpatialPortalController::interactiveControllerForHitTestedElement):\n(WebCore::SpatialPortalController::supportsInteraction const):\n(WebCore::SpatialPortalController::beginStageModeTransform):\n(WebCore::SpatialPortalController::updateStageModeTransform):\n(WebCore::SpatialPortalController::endStageModeInteraction):\n* Source/WebCore/Modules/model-element/SpatialPortalController.h:\n(WebCore::SpatialPortalController::portalElement const):\nAdd PortalAction and stage mode gesture support to the\nSpatialPortalController.\nOnly configure gesture handlers / position information when the portal\nwants orbit.\n\n* Source/WebCore/dom/Element.cpp:\n(WebCore::Element::clearSpatialPortalController):\nMake sure we prepare (remove event handlers) before removging the\nSpatialPortalController.\n\n* Source/WebCore/dom/Element.h:\n* Source/WebCore/page/ios/EventHandlerIOS.mm:\n(WebCore::EventHandler::requestInteractiveModelElementAtPoint):\n(WebCore::EventHandler::stageModeSessionDidUpdate):\n(WebCore::EventHandler::stageModeSessionDidEnd):\n* Source/WebKit/WebProcess/WebPage/Cocoa/PositionInformationForWebPage.mm:\n(WebKit::positionInformationForWebPage):\nAdd portal support to the StageMode hit-testing code.\n\n* Source/WebKit/ModelProcess/cocoa/ModelProcessModelPlayerProxy.h:\n* Source/WebKit/ModelProcess/cocoa/ModelProcessModelPlayerProxy.messages.in:\n* Source/WebKit/ModelProcess/cocoa/ModelProcessModelPlayerProxy.mm:\n(WebKit::ModelProcessModelPlayerProxy::computeTransform):\n(WebKit::ModelProcessModelPlayerProxy::updateTransformAfterLayout):\n(WebKit::ModelProcessModelPlayerProxy::didFinishLoading):\n(WebKit::ModelProcessModelPlayerProxy::stageModeInteractionDidUpdateModel):\n(WebKit::ModelProcessModelPlayerProxy::setPortalTransform):\n(WebKit::ModelProcessModelPlayerProxy::setPortalAction):\n(WebKit::ModelProcessModelPlayerProxy::effectiveStageModeOperation const):\n(WebKit::ModelProcessModelPlayerProxy::updateForCurrentStageMode):\n(WebKit::ModelProcessModelPlayerProxy::applyStageModeOperationToDriver):\n* Source/WebKit/Scripts/webkit/messages.py:\n(headers_for_type):\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Source/WebKit/WebProcess/Model/ModelProcessModelPlayer.cpp:\n(WebKit::ModelProcessModelPlayer::setPortalAction):\n* Source/WebKit/WebProcess/Model/ModelProcessModelPlayer.h:\nImplement `portal-action` for the ModelProcessModelPlayer.\n\nCanonical link: https://commits.webkit.org/318961@main", "email": "sgz@apple.com", "hash": "6daf3354b443781966cd5717c06f7e9cc2a824d3", "subject": "Add initial `portal-action` support" }, "318962@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "318962@main", "clUrl": "https://commits.webkit.org/318962@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321416\n\nReviewed by Yusuke Suzuki.\n\nparseUnreachableExpression's CallIndirect case checked table existence and\nthe bounds of both immediates, but not that the table holds funcref or that\nthe type index names a function type, so these invalid modules compiled when\nthe call_indirect was dead code:\n\n (table 1 externref)\n (func unreachable (call_indirect (type 0))) ;; accepted\n\n (type (func)) (type (struct))\n (table 1 funcref)\n (func unreachable (call_indirect (type 1))) ;; accepted\n\nThe reachable path rejects both. Move the immediate checks into\nparseCallIndirectImmediates and use it from both parseExpression and\nparseUnreachableExpression so the two paths cannot drift again.\n\n* JSTests/wasm/stress/unreachable-immediates-validation.js:\n(moduleBytes):\n* Source/JavaScriptCore/wasm/WasmFunctionParser.h:\n(JSC::Wasm::FunctionParser\u003cContext\u003e::parseCallIndirectImmediates):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::parseExpression):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::parseUnreachableExpression):\n\nCanonical link: https://commits.webkit.org/318962@main", "email": "sosuke@bun.sh", "hash": "47f20d8cfd63af0e383c7094c03189100d3253f7", "subject": "[Wasm] `call_indirect` in unreachable code should validate the table element type and the signature kind" }, "318963@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "318963@main", "clUrl": "https://commits.webkit.org/318963@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321478\nrdar://184569273\n\nReviewed by Nikolas Zimmermann.\n\nThis patch aligns WebKit with Gecko / Firefox and Blink / Chromium.\n\npath=\"M 100 100\" is a legal motion path of length 0, so every t/dur distance\nalong it resolves to its initial point and the element should sit at (100,100)\nfor the whole animation. Instead it never moves.\n\ncalculateAnimatedValue() translated only when PathTraversalState::success() was\nset, and a zero-length path never sets it: the traversal marks a zero vector on\nthe first element and waits for a second one to resolve it, which a lone moveto\nnever provides. Both the position and the accumulated repeats were skipped, so\nthe result depended on spelling -- \"M 100 100 L 100 100\" and \"M 100 100 Z\" have\na second element and do translate to (100,100).\n\nTranslate by current() unconditionally. It already holds the initial point in\nthe failing case, and it is what successful traversals were reading anyway, so\nthose are unaffected. The angle does not change either: normalAngle() is 0 here,\nwhich is what rotate=\"auto\" already resolved to.\n\nChrome and Firefox both place the element at the initial point, and\naccumulate=\"sum\" now steps (100,100) -\u003e (200,200), as all three engines already\ndo for the two-element spelling.\n\nTests: imported/w3c/web-platform-tests/svg/animations/animateMotion-path-moveto-only.html\n imported/w3c/web-platform-tests/svg/animations/animateMotion-path-zero-length-subpaths.html\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animateMotion-path-moveto-only-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animateMotion-path-moveto-only.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animateMotion-path-zero-length-subpaths-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/animateMotion-path-zero-length-subpaths.html: Added.\n* Source/WebCore/svg/SVGAnimateMotionElement.cpp:\n(WebCore::SVGAnimateMotionElement::calculateAnimatedValue):\n\nCanonical link: https://commits.webkit.org/318963@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "ea32b77b2786ebbe88c58a70fe96072b47a405da", "subject": "\u003canimateMotion\u003e ignores a zero-length motion path" }, "318964@main": { "author": "Adrian Perez de Castro", "avatar": "https://www.gravatar.com/avatar/30ffea8cf404586741a8f5f7110c0914?d=identicon\u0026s=64", "cl": "318964@main", "clUrl": "https://commits.webkit.org/318964@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=311225\n\nReviewed by Patrick Griffis.\n\nDeprecate the old favicon public API, and edit the documentation\ncomments to refer to the new functions that may be used instead.\n\n* Source/WebKit/UIProcess/API/glib/WebKitFaviconDatabase.cpp:\n(webkit_favicon_database_class_init):\n* Source/WebKit/UIProcess/API/glib/WebKitFaviconDatabase.h.in:\n* Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp:\n(webkit_web_view_class_init):\n* Source/WebKit/UIProcess/API/glib/WebKitWebView.h.in:\n\nCanonical link: https://commits.webkit.org/318964@main", "email": "aperez@igalia.com", "hash": "848a9b915e9b3a6742bc32cf79e2eac51a136333", "subject": "[GTK4] Mark old favicon API as deprecated" }, "318965@main": { "author": "Kiet Ho", "avatar": "https://www.gravatar.com/avatar/d9058b37006dce1f55f91b8ccc82f9a3?d=identicon\u0026s=64", "cl": "318965@main", "clUrl": "https://commits.webkit.org/318965@main", "description": "rdar://183065105\nhttps://bugs.webkit.org/show_bug.cgi?id=320124\n\nReviewed by Tim Nguyen.\n\nGenericMediaQueryParser\u003cConcreteParser\u003e::consumeQueryInParens parses a\nfunction name token into a CSSValueID, then when it parses it as a\n\u003cgeneral-enclosed\u003e, the function name CSSValueID is converted back to\nstring using nameString. But nameString doesn't preserve the original\ncasing of the function name. For example, \"ScrOLL-StAte(...)\" is parsed\ninto CSSValueScrollState, then converted back to \"scroll-state\", which\ndoesn't match the original casing.\n\nFix this by saving both the function name CSSValueID and original string,\nand use the original string when parsing as \u003cgeneral-enclosed\u003e\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/scroll-state/at-container-scrollable-serialization-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/scroll-state/at-container-scrolled-serialization-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/scroll-state/at-container-snapped-serialization-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/scroll-state/at-container-stuck-serialization-expected.txt:\n - Test progression.\n\n* Source/WebCore/css/query/GenericMediaQueryParser.h:\n(WebCore::MQ::GenericMediaQueryParser\u003cConcreteParser\u003e::consumeQueryInParens):\n\nCanonical link: https://commits.webkit.org/318965@main", "email": "kiet.ho@apple.com", "hash": "5e6f6100706823c48b060671a6af5de4ba4ee235", "subject": "Media query parser: keep \u003cgeneral-enclosed\u003e name verbatim" }, "318966@main": { "author": "Fady Farag", "avatar": "https://www.gravatar.com/avatar/0ac5127c69f90d0c57054173ae4c3108?d=identicon\u0026s=64", "cl": "318966@main", "clUrl": "https://commits.webkit.org/318966@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321483\nrdar://184571470\n\nReviewed by Chris Dumez.\n\nISO C++23 does not guarantee the initialization order of lambda captures.\nThe lambda capture list here both used `isPageMutedCallback` and moved it,\nso the use and the move were unsequenced.\n\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::processCaptureStateDidChange):\n\nCanonical link: https://commits.webkit.org/318966@main", "email": "com.webkit.iidmsa@gmail.com", "hash": "78dfedf6e4f023154e5680322dbb5637591bacbd", "subject": "Potential use-after-move in `Document::processCaptureStateDidChange()`" }, "318967@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "318967@main", "clUrl": "https://commits.webkit.org/318967@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321493\n\nReviewed by Keith Miller.\n\nWebAssembly.Global.prototype.value's setter threw NotEnoughArguments\nwhen invoked with no argument. The JS API and the WPT treat a missing\nargument as undefined, same as a normal JS setter.\n\n* Source/JavaScriptCore/wasm/js/WebAssemblyGlobalPrototype.cpp:\n(webAssemblyGlobalProtoSetterFuncValue):\n* LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/global/value-get-set.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/global/value-get-set.any.worker-expected.txt:\n\nCanonical link: https://commits.webkit.org/318967@main", "email": "chi187@gmail.com", "hash": "9b3637884b68bfd82fc35fa2f59647d0f717d13a", "subject": "[JSC][Wasm] Treat missing Global value setter argument as undefined" }, "318968@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "318968@main", "clUrl": "https://commits.webkit.org/318968@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321479\nrdar://184569176\n\nReviewed by Eric Carlson.\n\nThe test plays a muted element and expects the audio session category to be None. With site isolation\nenabled it read MediaPlayback, on every run, and only when another test had run before it in the same\nUI process.\n\nupdateSessionState() does not drop straight to None: when the computed category is None and the previous\none was neither None nor PlayAndRecord, it starts a two second timer and reports the previous category\ninstead. That previous category and the timer belong to the manager instance. Without site isolation\nthat instance is the page's own MediaSessionManagerCocoa, which starts out at None for each test. With\nsite isolation the category is computed by RemoteMediaSessionManagerProxy, one instance for the whole UI\nprocess, so MediaPlayback left behind by media/audio-session-category-at-most-recent-playback.html was\nstill the previous category when this test's page computed None, and the hold outlasted the gap between\nthe two tests. The proxy's session counts confirm no session was leaking across: it saw one session at a\ntime and dropped to none between the tests, while every computation reported \"setting category =\nMediaPlayback, previous category = MediaPlayback\".\n\nremoveSession() clears the previous category and stops the timer once the last session is gone, so the\nhold only covers transitions while a session exists.\n\nCovered by existing tests.\n\n* Source/WebCore/platform/audio/cocoa/MediaSessionManagerCocoa.mm:\n(WebCore::MediaSessionManagerCocoa::removeSession): Clear the delayed category change when the last\nsession goes away.\n\nCanonical link: https://commits.webkit.org/318968@main", "email": "jya@apple.com", "hash": "dabf122e6804336f528546dc2bbb9f382e92f971", "subject": "[site-isolation] media/audio-session-category-unmute-mute.html is a permanent failure" }, "318970@main": { "author": "Ryosuke Niwa", "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64", "cl": "318970@main", "clUrl": "https://commits.webkit.org/318970@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321510\n\nUnreviewed. Update safer C++ expectations.\n\n* Source/JavaScriptCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/NoDeleteCheckerExpectations:\n\nCanonical link: https://commits.webkit.org/318970@main", "email": "rniwa@webkit.org", "hash": "8dd6b2158e44aba9646b2e793f28b436ebfe962f", "subject": "Update safer C++ expectations (2026-08-11)" }, "318971@main": { "author": "lilly", "avatar": "https://www.gravatar.com/avatar/d0533d52eeb271270df480f37629a407?d=identicon\u0026s=64", "cl": "318971@main", "clUrl": "https://commits.webkit.org/318971@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320753\nrdar://183753095\n\nReviewed by Simon Fraser.\n\nOffsetting a shaped corner outward picked between several constructions\nbased on the corner's shape, and they disagreed with one another. They\ncoincided only for a plain round corner with a single radius, so the damage\nshowed up on non-round shapes and on elliptical radii\n\nThis replaces them with the single construction from the revised algorithm,\nwhich scales the offset normal per-axis by the two corner radii so an\nelliptical corner keeps its shape when offset. box-shadow spread now uses\nthat same construction, so a shadow and an outline at the same distance stay\nparallel rather than pinching together at the corners.\n\nAdopted algorithm from https://github.com/w3c/csswg-drafts/pull/14142\n\n* Source/WebCore/platform/graphics/CornerShapeUtilities.cpp:\n(WebCore::borderContourPath):\n* Source/WebCore/platform/graphics/GeometryUtilities.cpp:\n(WebCore::findSegmentLineIntersection):\n* Source/WebCore/platform/graphics/GeometryUtilities.h:\n* Source/WebCore/rendering/BorderShape.cpp:\n(WebCore::BorderShape::shapeForOffsetRect):\n(WebCore::buildOutsetCornerInputs):\n(WebCore::addAreaExpansionOffsetContour):\n(WebCore::BorderShape::pathForOuterCornerShape const):\n(WebCore::BorderShape::pathForInnerCornerShape const):\n(WebCore::adjustedRadiusDimension):\n(WebCore::outsetAdjustedBorderRadius):\n(WebCore::expandRadiiForOutset):\n(WebCore::BorderShape::shapeWithBorderWidths const):\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-bevel-overflow.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-convex.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-bevel.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-squircle.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-bevel.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-squircle.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-box-shadow-spread-bevel-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-box-shadow-spread-bevel-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-box-shadow-spread-bevel.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-box-shadow-spread-elliptical-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-box-shadow-spread-elliptical-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-box-shadow-spread-elliptical.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-outline-offset-bevel-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-outline-offset-bevel-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-outline-offset-bevel.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-outline-offset-elliptical-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-outline-offset-elliptical-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-outline-offset-elliptical.html: Added.\n* Source/WebCore/rendering/BorderShape.h:\n(WebCore::BorderShape::shapeForOffsetRect):\n* Source/WebCore/rendering/OutlinePainter.cpp:\n(WebCore::OutlinePainter::paintOutline const):\n(WebCore::OutlinePainter::paintFocusRing const):\n* Source/WebCore/platform/graphics/BezierUtilities.cpp:\n(WebCore::addCatmullRomBeziers):\n* Source/WebCore/platform/graphics/BezierUtilities.h:\n\nCanonical link: https://commits.webkit.org/318971@main", "email": "173393835+cupidsity@users.noreply.github.com", "hash": "dc1de28bb373793ea1c6540712605960a66ea508", "subject": "corner-shape: adopt the revised contoured-path algorithm" }, "318972@main": { "author": "Jamie Murphy", "avatar": "https://www.gravatar.com/avatar/6b42429f4e7db820c9d55e550001567f?d=identicon\u0026s=64", "cl": "318972@main", "clUrl": "https://commits.webkit.org/318972@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321419\n\nReviewed by Patrick Griffis.\n\nAdds Override New Tab properties and functionality\nto WebKitWebExtensionContext to match Cocoa.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestWebKitWebExtensionContext.cpp\n\n* Source/WebKit/UIProcess/API/glib/WebKitWebExtensionContext.cpp:\n(webkitWebExtensionContextGetProperty):\n(webkit_web_extension_context_class_init):\n(webkit_web_extension_context_get_override_new_tab_page_uri):\n* Source/WebKit/UIProcess/API/glib/WebKitWebExtensionContext.h.in:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestWebKitWebExtensionContext.cpp:\n(testURIOverridesParsing):\n(beforeAll):\n\nCanonical link: https://commits.webkit.org/318972@main", "email": "jmurphy@igalia.com", "hash": "b794eab6c6050b1c7a76aaad2e1dc7e857a3c95b", "subject": "[GTK] Add New Tab Page override to WebKitWebExtensionContext" }, "318973@main": { "author": "Etienne Segonzac", "avatar": "https://www.gravatar.com/avatar/3566820d0ba7e035bc440dc736c17f0c?d=identicon\u0026s=64", "cl": "318973@main", "clUrl": "https://commits.webkit.org/318973@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321506\nrdar://184616108\n\nUnreviewed build fix.\n\nFix the include in the SpatialPortalController.\n\n* Source/WebCore/Modules/model-element/SpatialPortalController.h:\n\nCanonical link: https://commits.webkit.org/318973@main", "email": "sgz@apple.com", "hash": "5e02b82984c50dd3a26549d670b55d396af2f736", "subject": "[visionOS] Build fix after 318961@main" }, "318974@main": { "author": "Roberto Rodriguez", "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64", "cl": "318974@main", "clUrl": "https://commits.webkit.org/318974@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321327\nrdar://184363140\n\nReviewed by Kimmo Kinnunen.\n\nFour fixes found while updating ANGLE:\n\n1. The temp work repository has no local config, so it can inherit a global\n commit.gpgsign. Its synthetic identity has no signing key, so the merge\n commit fails. Set commit.gpgsign=false there.\n\n2. run_code_generation.py calls depot_tools' `git cl format --full`, which\n aborts unless it can name a commit to diff against. It normally takes one\n from the current branch's upstream, but the merge worktree is detached.\n git cl reads rietveld.upstream-branch when there is no branch, so set\n that to HEAD in the work repo's config.\n\n3. Code generation failure was a warning, so incomplete output reached finalize\n alongside hash files describing content that no longer existed. Make it\n fatal.\n\n4. Warn when CMakeLists.txt or *.cmake still name a source deleted upstream,\n which breaks the CMake ports.\n\n* Tools/Scripts/update-angle:\n(phase_prepare):\n(phase_codegen_a):\n(_check_cmake_source_refs):\n(phase_bookkeep):\n(phase_codegen_b):\n\nCanonical link: https://commits.webkit.org/318974@main", "email": "roberto_rodriguez2@apple.com", "hash": "c9066d908eb5a9ccd0198e1360b62dd88857a393", "subject": "[ANGLE] Update the update-angle script" }, "318975@main": { "author": "Roberto Rodriguez", "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64", "cl": "318975@main", "clUrl": "https://commits.webkit.org/318975@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321162\nrdar://184199049\n\nReviewed by Dan Glastonbury.\n\nRe-enable webgl/2.0.y/conformance2/textures/svg_image tests.\n\n* LayoutTests/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318975@main", "email": "roberto_rodriguez2@apple.com", "hash": "6be8cb5376c5c393b58d6c23fadbb36346e141e6", "subject": "[WebGL] Update layout test expectations for svg_image conformance2 tests" }, "318976@main": { "author": "Megan Gardner", "avatar": "https://www.gravatar.com/avatar/b466a5bcbfabf4d82a8ecc595db5a531?d=identicon\u0026s=64", "cl": "318976@main", "clUrl": "https://commits.webkit.org/318976@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321341\nrdar://184375039\n\nReviewed by Wenson Hsieh and Antti Koivisto.\n\nThe originating element's stroke width leaked into highlighted text, and the\nhighlight's own stroke was never painted.\nThree changes fix it:\n1) Mark -webkit-text-stroke-width as applying to highlight pseudo-elements so it\nresolves to its initial 0px through the highlight cascade instead of inheriting the\nelement's value\n2) Carry the pseudo's stroke width into the marked-text paint style in StyledMarkedText\n(and propagate stroke width/color through coalesceAdjacentWithSameRanges, which dropped\nthem like it once did text-shadow)\n3) Clip a stroked, partially-highlighted segment to its forward edge in TextBoxPainter\nso a non-highlighted glyph's stroke overflow no longer paints over an adjacent highlight's\nbackground.\n\nimported/w3c/web-platform-tests/css/css-highlight-api/painting/custom-highlight-painting-021.html\n\n* LayoutTests/TestExpectations:\n* Source/WebCore/rendering/StyledMarkedText.cpp:\n(WebCore::computeStyleForPseudoElementStyle):\n(WebCore::resolveStyleForMarkedText):\n(WebCore::coalesceAdjacentWithSameRanges):\n(WebCore::StyledMarkedText::subdivideAndResolve):\n* Source/WebCore/rendering/TextBoxPainter.cpp:\n(WebCore::TextBoxPainter::paintForeground):\n\nCanonical link: https://commits.webkit.org/318976@main", "email": "megan_gardner@apple.com", "hash": "77d492d396f8be3fff8542d95bb8af9eea8358a5", "subject": "[Custom Highlight] -webkit-text-stroke should apply to highlighted text." }, "318977@main": { "author": "Yulun Wu", "avatar": "https://www.gravatar.com/avatar/9e34d6632f4d926cdf6fe8dce07f9cb7?d=identicon\u0026s=64", "cl": "318977@main", "clUrl": "https://commits.webkit.org/318977@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321474\n\u003crdar://184566237\u003e\n\nReviewed by Sammy Gill.\n\nWe should parameterize resolveIntrinsicTrackSizesWithSpanningItems()\nand all the helper functions it uses instead of splitting it into two\npieces for flex and content sized tracks.\n\nThis PR removes affectedFlexibleTracksMatchingMinSizeFunction and replaces with\naffectedTracksMatchingMinSizeFunction which takes the ResolveIntrinsicTrackSizesPhase\nas a parameter, allowing it to support flex and content sized tracks.\n\nA helper function itemsToAccommodate() was added to collect the items that we need to\nsize the grid tracks for during a given phase, which currently only wraps\nitemsSpanningFlexibleTracks and does not yet support the content sizing phases.\n\nNo behavior change\n\n* Source/WebCore/layout/formattingContexts/grid/TrackSizingAlgorithm.cpp:\n(WebCore::Layout::itemsToAccommodate):\n(WebCore::Layout::affectedTracksMatchingMinSizeFunction):\n(WebCore::Layout::resolveIntrinsicTrackSizesWithSpanningItems):\n(WebCore::Layout::affectedFlexibleTracksMatchingMinSizeFunction): Deleted.\n(WebCore::Layout::increaseSizesToAccommodateSpanningItemsCrossingContentSizedTracks): Deleted.\n(WebCore::Layout::increaseSizesToAccommodateSpanningItemsCrossingFlexibleTracks): Deleted.\n\nCanonical link: https://commits.webkit.org/318977@main", "email": "yulun_wu@apple.com", "hash": "98a5bbe21fd107e71f4cffbafd8eadc6ae55a51f", "subject": "[GFC] Parameterize resolveIntrinsicTrackSizesWithSpanningItems() by intrinsic sizing phase" }, "318978@main": { "author": "Sihui Liu", "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64", "cl": "318978@main", "clUrl": "https://commits.webkit.org/318978@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321401\nrdar://184468834\n\nReviewed by Alex Christensen.\n\nRemoteLayerTreeHost::layerWillBeRemoved took the node out of m_nodes but never detached its layer, i.e. does not invoke\nremoveFromHostingNode. A CALayer is retained by its superlayer, so dropping the RemoteLayerTreeNode does not stop the\nlayer being drawn: the hosted root layer of a frame that has moved to another process stays parented to the hosting\nlayer and keeps compositing.\n\nremotePageProcessDidTerminate already called removeFromHostingNode, bit it covered this for the process-termination path\nonly -- if the process is not destroyed when layer is removed, then no one is removing it from layer tree. This patch\nfixes that by having RemoteLayerTreeHost::layerWillBeRemoved invoke removeFromHostingNode. By doing so, the call in\nremotePageProcessDidTerminate becomes redundant.\n\nThe patch also contains two drive-by fixes for issues found in RemoteLayerTreeHost::layerWillBeRemoved:\n- A LayerHostingContextIdentifier is reused across a frame's cross-process navigations, so it outlives the layers keyed\nby it and an entry may already have been reassigned to a layer in another process (e.g. the new layer of the frame is\nadded before the the old layer is removed); clearing m_hostedLayers and m_hostingLayers by identifier alone could\ntherefore discard a live entry. Both removals now confirm that the entry still refers to the layer going away before\nremoval and update.\n- When removing layer from m_hostedLayersInProcess, the key layerID is read from m_hostedLayers instead of using the\nlayerID parameter passed to the function. In the edge case mentioned above, the key stored in the map might already be\nupdated to new layer, and we will remove the new key by mistake. Now use function parameter as the key.\nThese two are races that no layout test can currently force.\n\nTest: http/tests/site-isolation/draw-after-two-cross-process-navigations.html.\n\n* LayoutTests/http/tests/site-isolation/draw-after-two-cross-process-navigations-expected.html: Added.\n* LayoutTests/http/tests/site-isolation/draw-after-two-cross-process-navigations.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/red-background.html: Added. The regression test page is blue with a\n200x200 iframe that navigates three times: a red page on localhost, a green page on a third site, and finally a URL on a\nfourth site that responds with X-Frame-Options: deny, so a transparent document commits and nothing opaque is left to\nhide a stale layer. The 1x1 #sibling frame is load-bearing: it is same-site with the red page, so that process stays\nalive after the frame leaves it and reports the red layer as destroyed. Without it the process terminates instead and\ntakes the path that was already correct, and the test passes either way.\n* Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeHost.mm:\n(WebKit::RemoteLayerTreeHost::layerWillBeRemoved):\n(WebKit::RemoteLayerTreeHost::remotePageProcessDidTerminate):\n\nCanonical link: https://commits.webkit.org/318978@main", "email": "sihui_liu@apple.com", "hash": "d4b0840eea7761c9fa3184392d4c6659d60252e3", "subject": "[Site Isolation] A destroyed hosted layer is left parented to its hosting layer" }, "318979@main": { "author": "Shu-yu Guo", "avatar": "https://www.gravatar.com/avatar/3884544eb9e557e2ec917d32c6e12720?d=identicon\u0026s=64", "cl": "318979@main", "clUrl": "https://commits.webkit.org/318979@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321339\nrdar://184187975\n\nReviewed by Yusuke Suzuki and Keith Miller.\n\nAddress -Wunused-template warnings in JSC. Mostly this is removing dead code or\nmoving templates in headers from internal to external linkage.\n\nNo tests as this is a clang warning fix.\n\n* Source/JavaScriptCore/Configurations/Base.xcconfig:\n* Source/JavaScriptCore/assembler/testmasm.cpp:\n(JSC::testLoadExtend_voidp_RegisterID):\n* Source/JavaScriptCore/b3/B3Common.h:\n(JSC::B3::chillDiv):\n(JSC::B3::chillMod):\n(JSC::B3::chillUDiv):\n(JSC::B3::chillUMod):\n(JSC::B3::rotateRight):\n(JSC::B3::rotateLeft):\n* Source/JavaScriptCore/b3/B3EliminateCommonSubexpressions.cpp:\n* Source/JavaScriptCore/b3/B3LowerToAir.cpp:\n* Source/JavaScriptCore/jsc.cpp:\n* Source/JavaScriptCore/runtime/CachedTypes.cpp:\n* Source/JavaScriptCore/wasm/WasmFunctionParser.h:\n(JSC::Wasm::isTryOrCatch):\n* Source/JavaScriptCore/wasm/debugger/tests/ExecutionHandlerTest.cpp:\n\nCanonical link: https://commits.webkit.org/318979@main", "email": "syg@apple.com", "hash": "af6d6f483e633128594fb7ceb35f5e46169aba03", "subject": "[JSC] Address -Wunused-template warnings" }, "318980@main": { "author": "Kiara Rose", "avatar": "https://www.gravatar.com/avatar/cbfa3709de8e533bdc6505c6c4e83e24?d=identicon\u0026s=64", "cl": "318980@main", "clUrl": "https://commits.webkit.org/318980@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320697\nrdar://183680404\n\nReviewed by Timothy Hatcher.\n\nThis patch extends setAccessLevel to sync and local storage areas as it's documented on MDN.\nThis behavior now matches Chrome. Firefox doesn't have an implementation for setAccessLevel for any\nstorage area.\n\nBy default, session storage availability remains defaulted to trusted contexts. Local and sync\nstorage remain defaulted to trusted and untrusted contexts, but can now be limited to trusted contexts.\n\nThis patch also introduces a new isForTrustedContext() boolean used to determine if the storage APIs\nshould be exposed to devtools extension pages.\n\nWith these changes, the current WPT tests for the browser.storage API pass.\n\nTests: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIDevTools.mm\n Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIStorage.mm\n\n* Source/WebKit/Shared/Extensions/WebExtensionContextParameters.h:\n* Source/WebKit/Shared/Extensions/WebExtensionContextParameters.serialization.in:\n* Source/WebKit/Shared/Extensions/WebExtensionDataType.h:\n(WebKit::allWebExtensionDataTypes):\n(WebKit::toWebExtensionDataType):\n* Source/WebKit/Shared/Extensions/WebExtensionStorageAccessLevel.h:\n(WebKit::defaultStorageAccessLevel):\n(WebKit::storageAccessLevel):\n(WebKit::isStorageTypeAllowedInUntrustedContexts):\n(WebKit::toAPIString):\n(WebKit::toWebExtensionStorageAccessLevel):\n* Source/WebKit/UIProcess/Extensions/API/WebExtensionContextAPIStorage.cpp:\nOnly fire storage onChanged events to content scripts if the storage area is available in untrusted\ncontexts.\n\n(WebKit::WebExtensionContext::storageSetAccessLevel):\n(WebKit::WebExtensionContext::fireStorageChangedEventIfNeeded):\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionContextCocoa.mm:\n(WebKit::WebExtensionContext::load):\n(WebKit::WebExtensionContext::invalidateStorage):\n(WebKit::WebExtensionContext::loadStorageAccessLevelsFromStorage):\n(WebKit::WebExtensionContext::saveStorageAccessLevelsToStorage):\n(WebKit::WebExtensionContext::setStorageAccessLevel):\n(WebKit::WebExtensionContext::setSessionStorageAllowedInContentScripts): Deleted.\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.cpp:\n(WebKit::WebExtensionContext::parameters const):\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.h:\n(WebKit::WebExtensionContext::storageAccessLevel const):\n(WebKit::WebExtensionContext::isStorageAllowedInUntrustedContexts const):\n(WebKit::WebExtensionContext::isSessionStorageAllowedInContentScripts const): Deleted.\n* Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIStorageAreaCocoa.mm:\n(WebKit::WebExtensionAPIStorageArea::isPropertyAllowed):\n* Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIStorageCocoa.mm:\n(WebKit::WebExtensionAPIStorage::isPropertyAllowed):\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPIObject.h:\n(WebKit::WebExtensionAPIObject::isForTrustedContext const):\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPIStorageArea.h:\n* Source/WebKit/WebProcess/Extensions/Cocoa/WebExtensionContextProxyCocoa.mm:\n(WebKit::WebExtensionContextProxy::getOrCreate):\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIStorage.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIStorageArea.idl:\nReplace MainWorldOnly with an isForTrustedContext check so setAccessLevel is available for devtools\nextension pages.\n\n* Source/WebKit/WebProcess/Extensions/WebExtensionContextProxy.cpp:\n(WebKit::WebExtensionContextProxy::setStorageAccessLevel):\n* Source/WebKit/WebProcess/Extensions/WebExtensionContextProxy.h:\n* Source/WebKit/WebProcess/Extensions/WebExtensionContextProxy.messages.in:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIDevTools.mm:\n(TestWebKitAPI::TEST(WKWebExtensionAPIDevTools, StorageAccessLevel)):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIStorage.mm:\n(TestWebKitAPI::TEST(WKWebExtensionAPIStorage, UndefinedProperties)):\n(TestWebKitAPI::TEST(WKWebExtensionAPIStorage, SetAccessLevelTrustedContexts)):\n(TestWebKitAPI::TEST(WKWebExtensionAPIStorage, DefaultAccessLevels)):\n(TestWebKitAPI::TEST(WKWebExtensionAPIStorage, MigratesLegacySessionStorageAllowedInUntrusedContextsState)):\n\nCanonical link: https://commits.webkit.org/318980@main", "email": "kiara_rose@apple.com", "hash": "a5114a1ab6dbe06a1b6fe53b9ff7fd43b69dba05", "subject": "Extend setAccessLevel to local and sync storage areas" }, "318981@main": { "author": "Alice Tang", "avatar": "https://www.gravatar.com/avatar/bdf501bf22c8da1146b5fd324fd6c877?d=identicon\u0026s=64", "cl": "318981@main", "clUrl": "https://commits.webkit.org/318981@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=277199\nrdar://132624217\n\nReviewed by Tim Nguyen.\n\nParsing, rendering, and video rendering support for object-view-box have landed and been\nverified against the CSS Images Level 5 spec and WPT test suite. Move the feature from\ntestable to stable status so it ships on by default.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/318981@main", "email": "tang.alice.000@gmail.com", "hash": "6ecf3e3cf6ad28f544f2d8cefed4c9e6a8f5af56", "subject": "Enable object-view-box CSS property by default" }, "318982@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "318982@main", "clUrl": "https://commits.webkit.org/318982@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321456\nrdar://184545561\n\nReviewed by Chris Dumez.\n\nIn 316854@main I stopped sending CertificateInfo from the web process to the UI process.\nWe can't trust the contents of the CertificateInfo from a possibly-compromised web process.\nBut in 318495@main I found that there are some circumstances where we need input from\nthe web process about whether or not to get the CertificateInfo from the network process,\nsuch as using WKWebView.loadHTMLString with the same URL as we've already loaded.\nThis sends a bool instead of a CertificateInfo indicating whether we should get the\nCertificateInfo from the network process.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebViewServerTrustKVC.mm\n\n* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:\n(WebKit::ProvisionalPageProxy::didCommitLoadForFrame):\n* Source/WebKit/UIProcess/ProvisionalPageProxy.h:\n* Source/WebKit/UIProcess/WebFrameProxy.cpp:\n(WebKit::WebFrameProxy::commitProvisionalFrame):\n(WebKit::WebFrameProxy::commitCertificateInfo):\n* Source/WebKit/UIProcess/WebFrameProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::commitProvisionalPage):\n(WebKit::WebPageProxy::didCommitLoadForFrame):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.messages.in:\n* Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp:\n(WebKit::WebLocalFrameLoaderClient::dispatchDidCommitLoad):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebViewServerTrustKVC.mm:\n(TEST(WKWebView, ServerTrustKVCWithCOOP)):\n\nCanonical link: https://commits.webkit.org/318982@main", "email": "achristensen@apple.com", "hash": "c76d70bab55fccb3f39cf66613b302cfefe237c5", "subject": "Send bool indicating presence of CertificateInfo from web process" }, "318983@main": { "author": "Karl Rackler", "avatar": "https://www.gravatar.com/avatar/809e306d02face15d5e29b561026f7c2?d=identicon\u0026s=64", "cl": "318983@main", "clUrl": "https://commits.webkit.org/318983@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321524\nrdar://184633395\n\nUnreviewed test gardening.\n\nAdd test expectation.\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318983@main", "email": "rackler@apple.com", "hash": "ff856511f4adb42eb38ab87afe8be7beffc3fd77", "subject": "[Gardening]: (REGRESSION(318767@main): [macOS Debug] imported/w3c/web-platform-tests/payment-request/rejects_if_not_active.https.html is a flaky CRASH)" }, "318984@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "318984@main", "clUrl": "https://commits.webkit.org/318984@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321445\nrdar://184538329\n\nReviewed by Basuke Suzuki.\n\nMy initial implementation used isValidHTTPToken, which checks characters according to RFC 7230, Section 3.2.6.\nChrome and Firefox both behave like RFC 8941 Section 3.3.3, which allows all characters from U+0020 to U+007E\nwith escapes for \" and \\. Though the specification doesn't seem very clear to me, let's match behavior of\nother browsers. This will make us pass new tests from https://github.com/web-platform-tests/wpt/pull/61598\n\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/connect.https.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/connect.https.any.js:\n(promise_test.async t):\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/connect.https.any.serviceworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/connect.https.any.sharedworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/connect.https.any.worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/constructor.https.sub.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/constructor.https.sub.any.js:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/constructor.https.sub.any.serviceworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/constructor.https.sub.any.sharedworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webtransport/constructor.https.sub.any.worker-expected.txt:\n* Source/WebCore/Modules/webtransport/WebTransport.cpp:\n(WebCore::WebTransport::create):\n* Source/WebCore/platform/network/RFC8941.cpp:\n(RFC8941::escapeString):\n* Source/WebCore/platform/network/RFC8941.h:\n\nCanonical link: https://commits.webkit.org/318984@main", "email": "achristensen@apple.com", "hash": "55d163721de6165adedc733fdf0ed90295df84a9", "subject": "[WebTransport] Escape WebTransportOptions.protocols according to RFC 8941" }, "318985@main": { "author": "Ruthvik Konda", "avatar": "https://www.gravatar.com/avatar/bca33cefcce93017251a8fbc1204cdc4?d=identicon\u0026s=64", "cl": "318985@main", "clUrl": "https://commits.webkit.org/318985@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321325\nrdar://184363202\n\nReviewed by Dan Glastonbury.\n\nXRGPUBinding.cpp includes WebGPUXRView.h but never uses WebGPU::XRView. No change in behavior.\n\n* Source/WebCore/Modules/webxr/XRGPUBinding.cpp:\n\nCanonical link: https://commits.webkit.org/318985@main", "email": "rkonda2@apple.com", "hash": "3b117838f80abb09560538465b3ee0e805360548", "subject": "[WebXR] Remove unused WebGPUXRView.h include in XRGPUBinding" }, "318986@main": { "author": "Phinehas Fuachie", "avatar": "https://www.gravatar.com/avatar/900d85de8c325e38975f39115c36bb75?d=identicon\u0026s=64", "cl": "318986@main", "clUrl": "https://commits.webkit.org/318986@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321262\nrdar://184313220\n\nReviewed by Jean-Yves Avenard.\n\nThe cross-origin child requested fullscreen before its parent had assigned it a frame rect.\nA site-isolated child's frame view is sized from ProvisionalFrameCreationParameters::initialRect,\nwhich the UI process only has once the parent has broadcast a FrameRect frame-tree sync\n(WebPageProxy::broadcastFrameTreeSyncData -\u003e WebFrameProxy::setRemoteFrameRect); until that\narrives the child sits at the default 800x600 viewport instead of the 300x150 given to it by the\n\u003ciframe\u003e. WebFullScreenManager::performEnterFullScreen samples the pre-transition rect with no\nbarrier against that sync, so beganEnterFullScreen() reported 800x600 when the request won the\nrace and the correct 300x150 when it lost, at a load-dependent 4-9% locally.\n\nWait for the parent-assigned size before requesting fullscreen so the pre-transition rect is\nsampled deterministically, and update the baseline to the pre-fullscreen 300x150. The previous\nbaseline recorded the raced value; the sizes now match http/tests/site-isolation/fullscreen.html\nand the non-site-isolated dumpFullScreenCallbacks() tests, which all report the element's size\nbefore the transition in initialRect.\n\n* LayoutTests/http/tests/site-isolation/fullscreen-escape-key-expected.txt:\n* LayoutTests/http/tests/site-isolation/resources/fullscreen-escape-key.html:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318986@main", "email": "pfuachie2@apple.com", "hash": "daf27727d7fd9a01b5abda9bc9c3e6a956d5e8b8", "subject": "[Site Isolation] http/tests/site-isolation/fullscreen-escape-key.html is a flaky failure" }, "318987@main": { "author": "Antti Koivisto", "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64", "cl": "318987@main", "clUrl": "https://commits.webkit.org/318987@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=284895\nrdar://142034342\n\nReviewed by Tim Nguyen.\n\nImplement ident() as an arbitrary substitution function per\n\nhttps://github.com/w3c/csswg-drafts/issues/14213#issuecomment-5205278180\n\nThis feature allows constructing identifiers from other sources of data like\n\ncolor: var(ident(--item-color- attr(item-type)))\n\nThe spec has not been updated yet but the shape of the implemenation is pretty clear.\nThere is now an argument grammar\n\n \u003cident-args\u003e = ident( \u003cdeclaration-value\u003e )\n\nthat is validated during parsing. The full grammar\n\n \u003cident()\u003e = ident( \u003cident-arg\u003e+ )\n \u003cident-arg\u003e = \u003cstring\u003e | \u003cinteger\u003e | \u003cident\u003e\n\nis validated during substitution.\n\nTest: imported/w3c/web-platform-tests/css/css-values/ident-function-substitution.html\n* LayoutTests/fast/css/ident-function-length-limit-expected.txt: Added.\n* LayoutTests/fast/css/ident-function-length-limit.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/position-try-ident-function-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/container-queries/container-ident-function-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-properties-values-api/registered-property-ident-function-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/ident-function-computed-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/ident-function-computed.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/ident-function-parsing-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/ident-function-parsing.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/ident-function-substitution-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/ident-function-substitution.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-computed.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-variables/var-ident-function-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-variables/var-ident-function.html:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/timeline-names-ident-function-expected.txt:\n\nThe one remaining failure there is Style::NameScope keeping names in a hash set, so the duplicates\nthat subtest lists collapse into one. Not about ident(): timeline-scope: --a, --a does the same.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCSSIdentFunctionEnabled moves to preview.\n\n* Source/WebCore/css/CSSValueKeywords.in:\n* Source/WebCore/css/parser/CSSSubstitutionParser.cpp:\n(WebCore::classifyBlock):\n(WebCore::isValidIdentReference):\n* Source/WebCore/style/StyleSubstitutionResolver.cpp:\n(WebCore::Style::SubstitutionResolver::substituteIdentFunction):\n\n\u003cinteger\u003e production supports math functions so resolve those too.\n\n(WebCore::Style::SubstitutionResolver::substituteTokenRange):\n* Source/WebCore/style/StyleSubstitutionResolver.h:\n\nCanonical link: https://commits.webkit.org/318987@main", "email": "antti@apple.com", "hash": "004cb05ad8d1330e7086e4a1f6ae282f52eb2fc6", "subject": "[css-values-5] Implement ident() arbitrary substitution function" }, "318988@main": { "author": "Patrick Griffis", "avatar": "https://www.gravatar.com/avatar/2233c3a857004b126158572af9fe36f7?d=identicon\u0026s=64", "cl": "318988@main", "clUrl": "https://commits.webkit.org/318988@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321516\n\nReviewed by Adrian Perez de Castro.\n\nThis fixes some simple warnings.\n\n* Source/WebKit/UIProcess/API/glib/WebKitWebExtension.cpp:\n\nThis required an upstream fix: https://gitlab.gnome.org/GNOME/gi-docgen/-/merge_requests/272\n\n* Source/WebKit/UIProcess/API/wpe/WebKitWebViewWPE.cpp:\n* Source/WebKit/WPEPlatform/docs/overview.md:\n\nWPEPlatform can't link to WebKit easily, since the dependency is\nthe reverse of that.\n\nCanonical link: https://commits.webkit.org/318988@main", "email": "pgriffis@igalia.com", "hash": "bf034981129cc532f756837d94f9a4ba60fd13e3", "subject": "[GLib] Fix documentation warnings" }, "318989@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "318989@main", "clUrl": "https://commits.webkit.org/318989@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321512\nrdar://184624051\n\nReviewed by Yijia Huang and Dan Hecht.\n\nThis patch fixes a bug that we are getting repeated VarargsOverflow,\nby suppressing Varargs inlining when we repeatedly encounter the\nVarargsOverflow OSR exits.\n\nTest: JSTests/stress/varargs-overflow-exit-site-checkpoint.js\n\n* JSTests/stress/varargs-overflow-exit-site-checkpoint.js: Added.\n(shouldBe):\n(callee):\n(caller):\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::ByteCodeParser::handleVarargsInlining):\n\nCanonical link: https://commits.webkit.org/318989@main", "email": "ysuzuki@apple.com", "hash": "7600ab4bec971aa283a234db6ba4ff6b3d5df212", "subject": "[JSC] Fix repeated OSR exit via VarargsOverflow" }, "318990@main": { "author": "Yijia Huang", "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64", "cl": "318990@main", "clUrl": "https://commits.webkit.org/318990@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321518\nrdar://184628273\n\nReviewed by Yusuke Suzuki.\n\nRelands 318944@main (ea3fbb33caa5), reverted in 318969@main (ba1d526398de) for a\nperf regression, with the property-value half dropped.\n\nea3fbb3 cached buffer() and m_length in two places: the property-name block and\nthe inlined string-value block. Dropping the value block is what recovers the\nregression. That block is also the half that grew the hot lambda's frame from\n0x50 to 0x60, which is the suspicious part: in DynamicBuffer mode append()\nrecurses once per nesting level behind a softStackLimit() check, and crossing that\ncheck abandons the whole fast path for the generic Stringifier instead of\ndegrading gradually.\n\nThis reland keeps only the property-name block, which is where the reloads are\nconcentrated (19 for 9 stores). The frame is back to 0x50 and stack traffic\nmatches baseline. The discipline is unchanged: locals are captured after\nhasRemainingCapacity(), which can reallocate; m_length is published before\nappendNewLineAndIndentUnchecked(), which reads and advances it, and before every\nbail-out.\n\nHot instantiation (Latin1, DynamicBuffer, HasGap::No): 1712 -\u003e 1660 bytes, loads\n70 -\u003e 61, member reloads 26 -\u003e 17.\n\nNote the reverted version was better on every one of those counters -- 1648\nbytes, 56 loads, 12 reloads -- and still regressed. Reload count is a proxy, not\nthe objective.\n\nCanonical link: https://commits.webkit.org/318990@main", "email": "yijia_huang@apple.com", "hash": "8b5e6ebb64e65a4aefd8c9de48916c7da5438841", "subject": "[JSC] Reland: cache FastStringifier's buffer pointer and length across property-name emission" }, "318991@main": { "author": "Yijia Huang", "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64", "cl": "318991@main", "clUrl": "https://commits.webkit.org/318991@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321521\nrdar://184631238\n\nReviewed by Yusuke Suzuki.\n\nlunarCalendarExtendedYearFor1972 has no callers. constrainMonthCodeInternal now reads the year\nfield positionCalendarToYearStart writes back. Adds coverage for monthCode coercion, relativeTo\nfield order and PlainDate.prototype.with option order.\n\nTests: JSTests/stress/temporal-monthcode-wrong-type.js\n JSTests/stress/temporal-plaindate-with-option-order.js\n JSTests/stress/temporal-relativeto-field-order.js\n\nCanonical link: https://commits.webkit.org/318991@main", "email": "yijia_huang@apple.com", "hash": "f6c491404f2de22f0215652f915ff852bef51043", "subject": "[JSC][Temporal] Adopt three audit tests and remove a dead ICU epoch probe" }, "318992@main": { "author": "Brent Fulgham", "avatar": "https://www.gravatar.com/avatar/c6989a65afef0d015b55c65406e37ccc?d=identicon\u0026s=64", "cl": "318992@main", "clUrl": "https://commits.webkit.org/318992@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321042\n\u003crdar://181140244\u003e\n\nReviewed by Jean-Yves Avenard.\n\nBecause of the quirk added in Bug 172881, WebKit does not populate the duration and currentTime\ncomponents of the NowPlaying struct used by the Live Activities feature (e.g., see the\n\"Now Playing\" widget in the control center on macOS Tahoe or newer).\n\nWe can retain the `supportsSeeking == false` behavior needed to avoid the issues that led\nto the original Netflix Quirk while truthfully populating the NowPlaying struct so that\nLive Activities shows the current play position.\n\nScrubbing in the Live Activities view (and TouchBar on relevant machine) is still disabled\nfor Netflix.\n\nTest: media/now-playing-info-position-without-seeking-support.html\n\n* LayoutTests/media/now-playing-info-position-without-seeking-support-expected.txt: Added.\n* LayoutTests/media/now-playing-info-position-without-seeking-support.html: Added.\n* Source/WebCore/html/MediaElementSession.cpp:\n(WebCore::MediaElementSession::computeNowPlayingInfo const):\n* Source/WebCore/platform/audio/cocoa/MediaSessionManagerCocoa.mm:\n(WebCore::MediaSessionManagerCocoa::setNowPlayingInfo):\n(WebCore::MediaSessionManagerCocoa::shouldUpdateNowPlaying):\n(WebCore::MediaSessionManagerCocoa::updateNowPlayingInfo):\n* Source/WebCore/platform/audio/glib/MediaSessionManagerGLib.cpp:\n(WebCore::MediaSessionManagerGLib::updateNowPlayingInfo):\n\nCanonical link: https://commits.webkit.org/318992@main", "email": "bfulgham@apple.com", "hash": "9323c3a2d44fe82b73da2d3feecce5ea971faa4c", "subject": "Support Live Activities for Netflix.com" }, "318993@main": { "author": "Karl Rackler", "avatar": "https://www.gravatar.com/avatar/809e306d02face15d5e29b561026f7c2?d=identicon\u0026s=64", "cl": "318993@main", "clUrl": "https://commits.webkit.org/318993@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321534\nrdar://184648367\n\nUnreviewed test gardening.\n\nAdd test expectation.\n\n* LayoutTests/platform/mac/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318993@main", "email": "rackler@apple.com", "hash": "d7ce94bae5c9ab2928c494066afef90a646d7b57", "subject": "[Gardening]: (New Test(316184@main): [macOS Debug] fast/mediastream/applyConstraints-with-takePhoto.html is a flaky CRASH)" }, "318994@main": { "author": "Alice Tang", "avatar": "https://www.gravatar.com/avatar/bdf501bf22c8da1146b5fd324fd6c877?d=identicon\u0026s=64", "cl": "318994@main", "clUrl": "https://commits.webkit.org/318994@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321467\nrdar://184557440\n\nUnreviewed test gardening.\n\n* LayoutTests/platform/ios/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318994@main", "email": "tang.alice.000@gmail.com", "hash": "b11e8b5ae63acd38c8223545362d7e0900df51fc", "subject": "[iOS] object-view-box view-transition overflow-visible path off by 1 device pixel" } }, "date": "2026-08-11", "days": 1, "generatedAt": "2026-08-11T22:06:18Z", "markdown": "## Highlights\n- **Web Platform** WebKit flipped on `object-view-box` by default, pushing a new CSS image framing primitive into everyday web content. [commit 318981@main](https://commits.webkit.org/318981@main)\n- **Web Platform** `popover=hint` is now enabled by default, expanding the modern popover model for lightweight contextual UI. [commit 318958@main](https://commits.webkit.org/318958@main)\n- **UI** PDF now uses the alternate HUD view by default, a visible viewer UI change rather than another under-the-hood tweak. [commit 318934@main](https://commits.webkit.org/318934@main)\n- **Mobile** WebKit added Live Activities support for Netflix.com, a notable iOS integration win for media playback surfaces. [commit 318992@main](https://commits.webkit.org/318992@main)\n- **V8** JavaScriptCore landed a baseline JIT fast path for `switch` on strings, targeting a very common control-flow shape. [commit 318959@main](https://commits.webkit.org/318959@main)\n- **Networking** Client certificate auth no longer hangs page loads when SecKeyProxy cannot create an identity, closing a nasty failure mode in TLS auth flows. [commit 318936@main](https://commits.webkit.org/318936@main)\n- **Security** A potential use-after-move in `Document::processCaptureStateDidChange()` was fixed, exactly the kind of lifetime bug you want gone early. [commit 318966@main](https://commits.webkit.org/318966@main)\n- **Web Platform** CSS gained `ident()` arbitrary substitution, another step toward more expressive values plumbing in css-values-5. [commit 318987@main](https://commits.webkit.org/318987@main)\n- **Web Platform** Initial `portal-action` support landed, adding early plumbing for a new interaction surface. [commit 318961@main](https://commits.webkit.org/318961@main)\n\n## What landed by area\n\n### JavaScriptCore and Wasm\n- **V8** FastStringifier pointer and length caching was relanded for property-name emission, revisiting a serializer hot path. [commit 318990@main](https://commits.webkit.org/318990@main)\n- **V8** Repeated OSR exits triggered by `VarargsOverflow` were fixed, reducing churn in optimized execution. [commit 318989@main](https://commits.webkit.org/318989@main)\n- **Build** `-Wunused-template` warnings were cleaned up in JSC. [commit 318979@main](https://commits.webkit.org/318979@main)\n- **V8** Wasm `Global` setter handling now treats a missing argument as `undefined`, aligning behavior more closely with JS expectations. [commit 318967@main](https://commits.webkit.org/318967@main)\n- **V8** Wasm validation now checks `call_indirect` table element type and signature kind even in unreachable code. [commit 318962@main](https://commits.webkit.org/318962@main)\n- **V8** Empty microtask checkpoints no longer call `drain()`, trimming useless queue work. [commit 318957@main](https://commits.webkit.org/318957@main)\n- **V8** YARR fixed a JIT matching bug where non-BMP alternatives could match after only leading characters. [commit 318956@main](https://commits.webkit.org/318956@main)\n- **Perf** `StructureRareData` was shrunk back to 96 bytes, a nice memory-footprint correction. [commit 318955@main](https://commits.webkit.org/318955@main)\n- **V8** Temporal ICU paths now report through an explicit error channel instead of returning plausible-looking values. [commit 318953@main](https://commits.webkit.org/318953@main)\n- **V8** BBQ null checks are elided on non-nullable Wasm refs. [commit 318951@main](https://commits.webkit.org/318951@main)\n- **V8** JSC implemented `import-text`. [commit 318950@main](https://commits.webkit.org/318950@main)\n- **V8** FastStringifier buffer caching also landed earlier for general property emission, before the reland refinement above. [commit 318944@main](https://commits.webkit.org/318944@main)\n- **V8** Temporal fixed non-ISO date field resolution at range edges. [commit 318940@main](https://commits.webkit.org/318940@main)\n- **V8** Temporal adopted three audit tests and removed a dead ICU epoch probe. [commit 318991@main](https://commits.webkit.org/318991@main)\n\n### CSS, layout, and rendering\n- **Rendering** An iOS pixel-off-by-one in the `object-view-box` view-transition overflow-visible path was fixed. [commit 318994@main](https://commits.webkit.org/318994@main)\n- **Rendering** Grid formatting code now parameterizes `resolveIntrinsicTrackSizesWithSpanningItems()` by intrinsic sizing phase. [commit 318977@main](https://commits.webkit.org/318977@main)\n- **Rendering** `-webkit-text-stroke` now applies to Custom Highlight text. [commit 318976@main](https://commits.webkit.org/318976@main)\n- **Rendering** `corner-shape` adopted the revised contoured-path algorithm. [commit 318971@main](https://commits.webkit.org/318971@main)\n- **Web Platform** The media query parser now preserves the `\u003cgeneral-enclosed\u003e` name verbatim. [commit 318965@main](https://commits.webkit.org/318965@main)\n- **Rendering** SVG `\u003canimateMotion\u003e` now handles zero-length motion paths instead of ignoring them. [commit 318963@main](https://commits.webkit.org/318963@main)\n- **Web Platform** CSS `random()` gained property-scoped and property-index-scoped caching keywords. [commit 318960@main](https://commits.webkit.org/318960@main)\n- **Refactor** Grid formatting intrinsic sizing code got a broader refactor around track filtering and phased sizing. [commit 318937@main](https://commits.webkit.org/318937@main)\n\n### Web platform APIs and developer-facing behavior\n- **Networking** WebTransport now escapes `WebTransportOptions.protocols` per RFC 8941. [commit 318984@main](https://commits.webkit.org/318984@main)\n- **Privacy** `setAccessLevel` was extended to local and sync storage areas, expanding storage access control coverage. [commit 318980@main](https://commits.webkit.org/318980@main)\n- **GPU** WebXR removed an unused `WebGPUXRView.h` include in `XRGPUBinding`, a small cleanup in XR and GPU plumbing. [commit 318985@main](https://commits.webkit.org/318985@main)\n- **GPU** `GPUQueue.copyExternalImageToTexture()` now correctly uploads indexed PNG inputs. [commit 318952@main](https://commits.webkit.org/318952@main)\n- **A11y** Text Extraction interactions no longer fail when the requested `text` only matches part of a target value or alt text. [commit 318938@main](https://commits.webkit.org/318938@main)\n- **Web Platform** A WPT for multiple queued lazy iframe navigations was added, strengthening coverage around lazy loading semantics. [commit 318935@main](https://commits.webkit.org/318935@main)\n- **Web Platform** Parsing coverage was added for the `interactive-widget` viewport meta argument. [commit 318954@main](https://commits.webkit.org/318954@main)\n\n### Networking, security, and site isolation\n- **Security** The web process now sends an explicit bool for CertificateInfo presence, tightening certificate state handling across process boundaries. [commit 318982@main](https://commits.webkit.org/318982@main)\n- **Rendering** Site Isolation fixed a case where a destroyed hosted layer remained parented to its hosting layer. [commit 318978@main](https://commits.webkit.org/318978@main)\n- **Build** Safer C++ expectations were updated for 2026-08-11. [commit 318970@main](https://commits.webkit.org/318970@main)\n\n### Platform ports, extensions, and product surfaces\n- **Build** GLib documentation warnings were fixed. [commit 318988@main](https://commits.webkit.org/318988@main)\n- **Build** visionOS picked up a follow-up build fix after `portal-action` landed. [commit 318973@main](https://commits.webkit.org/318973@main)\n- **UI** GTK added a New Tab Page override on `WebKitWebExtensionContext`. [commit 318972@main](https://commits.webkit.org/318972@main)\n- **UI** GTK4 marked the old favicon API as deprecated. [commit 318964@main](https://commits.webkit.org/318964@main)\n- **UI** GTK added Injected Content handlers on `WebKitWebExtensionContext`. [commit 318949@main](https://commits.webkit.org/318949@main)\n- **Refactor** `WebExtensionAPINamespace` was ported to C++. [commit 318942@main](https://commits.webkit.org/318942@main)\n- **Build** WPE needed a missing `LogicalSelectionOffsetCaches.h` include in `RenderBlock.cpp`. [commit 318946@main](https://commits.webkit.org/318946@main)\n- **Build** The same WPE include fix also landed in a duplicate follow-up commit. [commit 318939@main](https://commits.webkit.org/318939@main)\n- **GPU** ANGLE's `update-angle` script was updated. [commit 318974@main](https://commits.webkit.org/318974@main)\n- **Media** A dead VP9 full-range quirk was removed. [commit 318943@main](https://commits.webkit.org/318943@main)\n\n### DevTools, WebDriver, and test infrastructure\n- **DevTools** Web Inspector fixed Show Paint Rects for cross-origin iframes under Site Isolation. [commit 318947@main](https://commits.webkit.org/318947@main)\n- **DevTools** WebDriver BiDi now asks the OS for a free port instead of guessing from the HTTP port. [commit 318931@main](https://commits.webkit.org/318931@main)\n- **Build** WebDriver GLib fixed a failing Selenium quit test. [commit 318945@main](https://commits.webkit.org/318945@main)\n- **Build** GTK and WPE test gardening landed for the 2026-08-10 batch. [commit 318948@main](https://commits.webkit.org/318948@main)\n- **Build** A flaky crash in `fast/mediastream/applyConstraints-with-takePhoto.html` got a new test entry. [commit 318993@main](https://commits.webkit.org/318993@main)\n- **Build** A regression-induced flaky crash in Payment Request active-state coverage was gardened. [commit 318983@main](https://commits.webkit.org/318983@main)\n- **Build** Site Isolation's `fullscreen-escape-key.html` was marked down as a flaky failure. [commit 318986@main](https://commits.webkit.org/318986@main)\n- **Build** `media/audio-session-category-unmute-mute.html` was identified as a permanent Site Isolation failure. [commit 318968@main](https://commits.webkit.org/318968@main)\n- **Build** `media/media-session/interruption-sends-pause-action.html` was marked as a permanent Site Isolation timeout. [commit 318941@main](https://commits.webkit.org/318941@main)\n- **Build** `webaudio/audiocontext-state-interrupted.html` was marked as a permanent Site Isolation timeout. [commit 318933@main](https://commits.webkit.org/318933@main)\n- **Build** `media/media-source/media-source-duplicate-seeked.html` was marked as a permanent Site Isolation failure. [commit 318932@main](https://commits.webkit.org/318932@main)\n\n## Reverts \u0026 Reapplies\n- **Refactor** FastStringifier buffer caching was explicitly relanded after the earlier version, with the follow-up narrowed to property-name emission. [commit 318990@main](https://commits.webkit.org/318990@main)", "repo": "webkit", "repoDisplay": "WebKit", "rollGroups": [ { "name": "Unreviewed", "count": 1 } ], "since": "2026-08-11", "totals": { "commits": 64, "features": 63, "rolls": 1 }, "until": "2026-08-11" }