{ "commits": { "201369@main": { "author": "BJ Burg", "avatar": "https://www.gravatar.com/avatar/7bba434e462e6f8d8c4d17f82699886e?d=identicon\u0026s=64", "cl": "201369@main", "clUrl": "https://commits.webkit.org/201369@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=296394\nrdar://178913733\n\nReviewed by Qianlang Chen and Sihui Liu.\n\nAn automation session created with siteIsolationEnabled had no way to carry that\npreference onto the pages it vends: the flag lived on the\n_WKAutomationSessionConfiguration but was never applied to a new browsing context's\nWebPreferences, so Site Isolation never engaged for automation-driven pages.\n\nStamp the configuration's siteIsolationEnabled onto WebAutomationSession at\nsession-creation time, then in createBrowsingContext() inject it into the vended\npage's WebPreferences before process assignment. Only the vended automation page is affected;\nsibling pool pages keep their own preferences.\n\nUpdate `WebProcessPool` to override keeping frames in the same process when site isolation is enabled.\nThat behavior was introduced in https://commits.webkit.org/201369@main as a guard against PSON (process swap on nagivation)\nto force keeping automation sessions working the same process.\n\nAutomation was built on a single-process-per-page assumption that predates both PSON and site isolation.\n`WebAutomationSession` (UI process) drives one `WebAutomationSessionProxy` per `WebProcess`,\nand it caches state that only means anything inside a specific WebProcess:\n- injected JS atoms,\n- element/node handles\n- the current frame handle.\n\n* Source/WebKit/UIProcess/API/Cocoa/_WKAutomationSession.mm:\n(-[_WKAutomationSession initWithConfiguration:]):\n* Source/WebKit/UIProcess/Automation/WebAutomationSession.cpp:\n(WebKit::WebAutomationSession::WebAutomationSession):\n(WebKit::WebAutomationSession::createBrowsingContext):\n* Source/WebKit/UIProcess/Automation/WebAutomationSession.h:\n* Source/WebKit/UIProcess/WebProcessPool.cpp:\n(WebKit::WebProcessPool::processForNavigationInternal):\n\nCanonical link: https://commits.webkit.org/319024@main", "email": "bburg@apple.com", "hash": "6dd9ed3d3ea1fd36f678f2652c05097f61b0caa7", "subject": "[Web Automation] Apply the session's Site Isolation preference to vended automation pages" }, "318995@main": { "author": "Marta Darbinyan", "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64", "cl": "318995@main", "clUrl": "https://commits.webkit.org/318995@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321528\nrdar://184638346\n\nUnreviewed test gardening\n\n* LayoutTests/platform/ios/TestExpectations:\n\nCanonical link: https://commits.webkit.org/318995@main", "email": "darbinyan@apple.com", "hash": "d9d8d8f18014d47db9b50346c8aa65348162b1f5", "subject": "[Gardening]: [iOS Release] imported/w3c/web-platform-tests/background-fetch/match.https.window.html is a flaky failure" }, "318996@main": { "author": "Brian Weinstein", "avatar": "https://www.gravatar.com/avatar/2892a9aaa68f537ee65c6f95ef0768a6?d=identicon\u0026s=64", "cl": "318996@main", "clUrl": "https://commits.webkit.org/318996@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321513\nrdar://184269255\n\nReviewed by Kiara Rose.\n\nThis PR does a lot of hooking up the actual offscreen WKWebView with the offscreen extension API.\n\nWhen an offscreen document is created, the corresponding web view is instantiated (if one doesn't exist already). One\nbehavior to note is that the promise isn't fulfilled until the page has finished loading. This matches Chrome and\nallows messages dispatched immediately after awaiting the creation of the offscreen web view to be delivered successfully.\n\nWhen an offscreen document is closed, the corresponding web view is unloaded (if it exists).\n\noffscreen.hasDocument just checks for the presence of the offscreen web view ivar.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIOffscreen.mm\n\n* Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPIOffscreenCocoa.mm:\n(WebKit::WebExtensionContext::offscreenCreateDocument): Create a web view, and save the completion handler for when the load finishes.\n(WebKit::WebExtensionContext::offscreenCloseDocument): Unload the web view and call the completion handler.\n(WebKit::WebExtensionContext::offscreenHasDocument): Call the completion handler with the presence of the offscreen web view.\n(WebKit::WebExtensionContext::unloadOffscreenWebView): Unloads the offscreen web view.\n(WebKit::WebExtensionContext::performTasksAfterOffscreenContentLoads): Calls all the queued completion handlers.\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionContextCocoa.mm:\n(-[_WKWebExtensionContextDelegate webView:didFailProvisionalNavigation:withError:]): Forward this call to didFailNavigation.\n(WebKit::WebExtensionContext::unload): Call unloadOffscreenWebView.\n(WebKit::WebExtensionContext::decidePolicyForNavigationAction): Update for the offscreen web view.\n(WebKit::WebExtensionContext::didFinishDocumentLoad): Ditto.\n(WebKit::WebExtensionContext::didFailNavigation): Ditto.\n(WebKit::WebExtensionContext::webViewWebContentProcessDidTerminate): Ditto.\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.h:\n(WebKit::WebExtensionContext::offscreenWebView const):\n(WebKit::WebExtensionContext::isOffscreenWebView const):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIOffscreen.mm:\n(TestWebKitAPI::TEST_F(WKWebExtensionAPIOffscreen, CreateAndHasDocument)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPIOffscreen, CreateDocumentFails)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPIOffscreen, CreateDocumentTwiceFails)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPIOffscreen, CloseDocument)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPIOffscreen, CloseDocumentWithoutOneOpenFails)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPIOffscreen, HasDocumentFalseByDefault)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPIOffscreen, DocumentContentLoads)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPIOffscreen, SendMessageToDocument)):\n\nCanonical link: https://commits.webkit.org/318996@main", "email": "bweinstein@apple.com", "hash": "1efe7e2360c84d4f08a75df6e33010839fb5e3f7", "subject": "Manage an offscreen web view when implementing the browser.offscreen extension API" }, "318997@main": { "author": "Marta Darbinyan", "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64", "cl": "318997@main", "clUrl": "https://commits.webkit.org/318997@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321544\nrdar://184655647\n\nUnreviewed test Gardening\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/318997@main", "email": "darbinyan@apple.com", "hash": "35377cdf68432a7da87e588f1205757185a9ae1f", "subject": "[Gardening]: [iOS} TestWebKitAPI.iOSMouseSupport.FractionalCoordinatesInRotatedIFrameCrossOrigin is a flaky failure" }, "318998@main": { "author": "Brent Fulgham", "avatar": "https://www.gravatar.com/avatar/c6989a65afef0d015b55c65406e37ccc?d=identicon\u0026s=64", "cl": "318998@main", "clUrl": "https://commits.webkit.org/318998@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321539\nrdar://184652193\n\nUnreviewed Interop 2026 test sync.\n\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-hint-dialog-dismisses-unrelated-auto-expected.txt: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-hint-dialog-dismisses-unrelated-auto.html: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-target-element-disabled.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-top-layer-nesting-hints.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/w3c-import.log:\n\nCanonical link: https://commits.webkit.org/318998@main", "email": "bfulgham@apple.com", "hash": "38150a6013feb5ea0e48d15d6ddeb18b4dbb5381", "subject": "[Interop] Re-sync popover test cases with upstream" }, "318999@main": { "author": "Joanne Pan", "avatar": "https://www.gravatar.com/avatar/5cbbf578426a0c98cb5c977ca2dd88fc?d=identicon\u0026s=64", "cl": "318999@main", "clUrl": "https://commits.webkit.org/318999@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320984\nrdar://184017733\n\nReviewed by Antti Koivisto.\n\nImplement the inherit() arbitrary substitution function, which resolves to the\ninherited value of a custom property, meaning the parent's computed value, with\nan optional second argument as a fallback when the first resolves to the\nguaranteed-invalid value.\n\n\u003cinherit()\u003e = inherit( \u003ccustom-property-name\u003e, \u003cdeclaration-value\u003e? )\n\nThe argument grammar is the same as attr()'s, so parsing and argument\nsubstitution are shared with it. The first argument is substituted before being\nparsed as a custom property name, and failing that parse falls through to the\nfallback rather than being an error.\n\nInside a custom function the parent is the calling context's element, whose\ncustom properties resolve lazily, so the read forces that property first.\nOtherwise the result would depend on the calling element's declaration order.\n\nThe cascade now re-applies a declaration containing inherit() when the parent's\nnon-inherited style changes, where it previously recognised only a literally\nwritten inherit keyword. This covers custom property declarations too, which\nalso fixes the pre-existing case of `--y: inherit` on a non-inherited\nregistered property. A declaration that only reads such a property, as in\n`border-color: var(--y)`, is still not re-applied; that is the more general\nproblem tracked in bug 321094.\n\nBehind the CSSInheritFunctionEnabled setting, off by default.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/local-inherit-substitution-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-properties-values-api/custom-property-explicit-inherit-invalidation-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-properties-values-api/custom-property-explicit-inherit-invalidation.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/inherit-function-basic-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/inherit-function-invalidation-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/inherit-function-parsing-expected.txt:\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebCore/css/CSSSubstitutionValue.cpp:\n(WebCore::containsInheritFunctionToken):\n(WebCore::CSSSubstitutionValue::CSSSubstitutionValue):\n* Source/WebCore/css/CSSSubstitutionValue.h:\n(WebCore::CSSSubstitutionValue::containsInheritFunction const):\n* Source/WebCore/css/parser/CSSParserContext.cpp:\n(WebCore::CSSParserContext::CSSParserContext):\n(WebCore::add):\n* Source/WebCore/css/parser/CSSParserContext.h:\n* Source/WebCore/css/parser/CSSSubstitutionParser.cpp:\n(WebCore::classifyBlock):\n(WebCore::isValidDeclarationValueAndFallback):\n* Source/WebCore/style/PropertyCascade.cpp:\n(WebCore::Style::explicitlyInheritsFromParent):\n(WebCore::Style::PropertyCascade::addMatch):\n* Source/WebCore/style/StyleSubstitutionResolver.cpp:\n(WebCore::Style::SubstitutionResolver::substituteInheritFunction):\n(WebCore::Style::SubstitutionResolver::substituteDeclarationValueAndFallback):\n(WebCore::Style::SubstitutionResolver::substituteAttrFunction):\n(WebCore::Style::SubstitutionResolver::substituteTokenRange):\n* Source/WebCore/style/StyleSubstitutionResolver.h:\n\nCanonical link: https://commits.webkit.org/318999@main", "email": "jpan0917@gmail.com", "hash": "ae3c47183d329b9d9d4c04a594cef7359dc00700", "subject": "[css-values-5 inherit()] Implement inherit() substitution function" }, "319000@main": { "author": "Marta Darbinyan", "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64", "cl": "319000@main", "clUrl": "https://commits.webkit.org/319000@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321544\nrdar://184655647\n\nUnreviewed test gardening\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/319000@main", "email": "darbinyan@apple.com", "hash": "9431e13b8f3b7d35756f7d4a59e942374850226e", "subject": "[Gardening]: [iOS} TestWebKitAPI.iOSMouseSupport.FractionalCoordinatesInRotatedIFrameCrossOrigin is a flaky failure" }, "319001@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "319001@main", "clUrl": "https://commits.webkit.org/319001@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321503\nrdar://184607025\n\nReviewed by Eric Carlson.\n\nThe test starts a second video while a first one is playing, with\nConcurrentPlaybackNotPermitted set, and expects the first to be paused. It\nasserted that from the second element's 'playing' handler. With site isolation\nenabled it read videos[0].paused as false: the 'playing' event is queued during\nplay(), while enforceConcurrentPlaybackRestriction() runs in the UI process and\nthe pause reaches the web process as ClientShouldSuspendPlayback, at least one\nIPC round trip later. Without site isolation the enforcement ran inside play()\nitself, before the queued event, so the assertion held.\n\nAsserting from the first element's 'pause' handler instead was not enough: the\nsecond element's 'playing' is only queued during play() when its readyState is\nat least HAVE_FUTURE_DATA, and otherwise arrives from a later readyState change,\nso its order against that pause varies. On a stress bot the event came after the\npause, and endTest() had already ended the test, so the logged output lost the\nline.\n\nThe test now records the second element's 'playing' and the first element's\n'pause' as they arrive and asserts once it has both, in either order. That event\nis required but no longer logged, so the output is the same whichever order they\ncome in, and a 'playing' that never arrives fails through failTestIn(500) rather\nthan passing unnoticed. The handler keys off evt.target rather than counting\nevents, so it identifies the second element rather than \"not the first\". The\n100ms setTimeout(endTest) is gone with it: it used to end the test with no\nassertions at all when the pause was late, reporting success.\n\n* LayoutTests/media/video-concurrent-playback-expected.txt:\n* LayoutTests/media/video-concurrent-playback.html:\n\nCanonical link: https://commits.webkit.org/319001@main", "email": "jya@apple.com", "hash": "9589e0808401278e9602cabd0cd575c7cc903e13", "subject": "[site-isolation] media/video-concurrent-playback.html is an intermittent failure" }, "319002@main": { "author": "Yijia Huang", "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64", "cl": "319002@main", "clUrl": "https://commits.webkit.org/319002@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321538\nrdar://184650946\n\nReviewed by Yusuke Suzuki.\n\nFour functions claimed #sec-temporal-calendardateuntil and only one held an algorithm. The\nCalendarArithmetic.cpp pass-through and the JS wrapper's iso8601 dispatch are gone; step 4's body is\nnow nonISODateUntil, so calendarDateUntil is 15 lines of dispatch. Steps 1-2 are hoisted above it as\nthe spec writes them, which also stops d.until(d) on a non-ISO calendar taking two field snapshots\nbefore noticing the dates are equal.\n\nNo behaviour change: stress suite and testapi unchanged.\n\nCanonical link: https://commits.webkit.org/319002@main", "email": "yijia_huang@apple.com", "hash": "ee16ce938a8f8535cce4d77bfc0a7150d864dc5b", "subject": "[JSC][Temporal] Give CalendarDateUntil and NonISODateUntil one home each" }, "319003@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "319003@main", "clUrl": "https://commits.webkit.org/319003@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321492\nrdar://184587691\n\nReviewed by Eric Carlson.\n\nThe test enables a video's audio track while it plays and expects the audio\nsession category to become MediaPlayback. With site isolation enabled it read\nNone. internals.audioSessionCategory() reads the category cached in the web\nprocess by RemoteAudioSession, and in that pass the web process never applied a\ncategory at all: the UI process computed MediaPlayback and the GPU process\napplied it to the audio session, while the web process hosting the page logged no\nsetCategory.\n\nAddMediaSession replies with the current category, mode and route sharing policy,\nand the web process applies the reply, so a session's process knows the category\nfrom the moment the session registers. This follows UpdateMediaSessionStates and\nMediaSessionWillBeginPlayback, which already reply with it.\n\nThe test remains intermittent for a separate reason: webkit.org/b/184609 makes the\nnon-isolated run miss the same category change, and the comparison fails whenever\nthat happens.\n\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.cpp:\n(WebKit::RemoteMediaSessionManagerProxy::addMediaSession): Reply with the current\ncategory.\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.h:\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.messages.in:\n* Source/WebKit/WebProcess/Media/RemoteMediaSessionManager.cpp:\n(WebKit::RemoteMediaSessionManager::addSession): Apply the category the reply\ncarries.\n\nCanonical link: https://commits.webkit.org/319003@main", "email": "jya@apple.com", "hash": "3e5ac6f71459be18c1d617357a2406171b419292", "subject": "[site-isolation] platform/mac/media/audio-session-category-video-track-change.html is an intermittent failure" }, "319004@main": { "author": "Rupin Mittal", "avatar": "https://www.gravatar.com/avatar/3e3de9845931d2dc844afb00056ec94e?d=identicon\u0026s=64", "cl": "319004@main", "clUrl": "https://commits.webkit.org/319004@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321519\nrdar://184628564\n\nReviewed by Basuke Suzuki and Jessica Lee.\n\nThere is no need for NavigationInterceptHandler to be ThreadSafeRefCounted,\nit can simply be RefCounted. No behavior change.\n\n* Source/WebCore/page/NavigationInterceptHandler.h:\n\nCanonical link: https://commits.webkit.org/319004@main", "email": "rupin@apple.com", "hash": "397db1600e1af315e78fd122888718a86a01b31b", "subject": "[Navigation API] Make NavigationInterceptHandler RefCounted instead of ThreadSafeRefCounted" }, "319005@main": { "author": "Rupin Mittal", "avatar": "https://www.gravatar.com/avatar/3e3de9845931d2dc844afb00056ec94e?d=identicon\u0026s=64", "cl": "319005@main", "clUrl": "https://commits.webkit.org/319005@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321490\nrdar://184581613\n\nReviewed by Jessica Lee.\n\nThe HTML spec (https://html.spec.whatwg.org/multipage/links.html#following-hyperlinks)\nsays that sourceElement is the element responsible for the navigation (e.g. the \u003ca\u003e),\nnot the deepest node that happened to be clicked. This is already correctly set on the\nFrameLoadRequest, so we reuse it. Fall back to the event target for callers that don't\nsupply an initiating element since that is the current behavior so these callers aren't\nbroken.\n\nThis makes us match Chrome and is covered by a new layout test:\nnavigate-event-source-element-is-initiating-anchor.html\n\n* LayoutTests/navigation-api/navigate-event-source-element-is-initiating-anchor-expected.txt: Added.\n* LayoutTests/navigation-api/navigate-event-source-element-is-initiating-anchor.html: Added.\n* Source/WebCore/loader/FrameLoader.cpp:\n(WebCore::FrameLoader::dispatchNavigateEvent):\n\nCanonical link: https://commits.webkit.org/319005@main", "email": "rupin@apple.com", "hash": "d4093dea3b7cfce7d9f43f7d8c79438f2f7046e9", "subject": "[Navigation API] SourceElement is the element responsible for the navigation, not the deepest element that was clicked" }, "319006@main": { "author": "Eric Carlson", "avatar": "https://www.gravatar.com/avatar/e227ff07cc6d645fc1c69fd56c2c8cb8?d=identicon\u0026s=64", "cl": "319006@main", "clUrl": "https://commits.webkit.org/319006@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320600\nrdar://183573361\n\nReviewed by Jean-Yves Avenard.\n\nUnder site isolation one process-wide RemoteMediaSessionManagerProxy serves every web\nprocess, but it controlled audio-session activation with a single global AudioSession. A\nsecond page was denied activation once any page was active, a stop + play raced the async\ndeactivation, and a reused web process (same-origin navigation, or a lingering/stopped\nsession) kept a stale \"active\" session so sessionWillBeginPlayback skipped activating it\neven though its real audio session was inactive.\n\nTrack activation per web process, and source each web process's real audio-session state\nfrom the GPU process, which owns it. When a process's audio session becomes active or\ninactive the GPU process pushes that state to the UI process via\nGPUProcessProxy::AudioSessionActiveStateChangedForProcess and the proxy applies it to the\nper-process activation entry and to the shared session's active flag before the activation,\nso the decision reflects each process's reality and is never taken from data an untrusted\nweb process supplied. Per-process activate/deactivate is serialized, the forwarded\nconfiguration is completed, a process is deactivated on its last session removal, and its\nper-process activation state is dropped on web-process shutdown (rejecting any pending\nactivations).\n\nMake the UI process the single GPU-side activation driver without disabling the web\nprocess's local activation. The web process still activates its own AudioSession\noptimistically -- so getUserMedia's activation wait, the DOM audio-session state, and\nprocess-suspend deactivation keep working -- but under site isolation RemoteAudioSession no\nlonger sends TryToSetActive to the GPU process: it resolves the request locally and the\nUI-process proxy owns the GPU-side decision, so the two never race. RemoteMediaSessionProxy::updateState\nre-evaluates activation for a session when its state changes (WebAudio becomes audible only\nafter playback begins, so the begin-time gate can't catch it), targeting that session's\nprocess, and updateMediaSessionStates activates a process while it has active audio-capture\nsources -- the UI process can't use activeAudioSessionRequired() for capture, since the\ncapture sources live in the web process and only their count is forwarded.\n\nWhen a web process suspends it can no longer release the shared session through the GPU\nitself, so RemoteMediaSessionManager forwards processWillSuspend/processDidResume to the\nproxy, which releases that process's GPU session on suspend and re-acquires it on resume\nwhen the process still requires it.\n\nRoute the tests' reset-to-consistent-state through the manager too. Internals reached past\nthe MediaSessionManager to deactivate AudioSession directly between tests; under site\nisolation that made the web process yet another uncoordinated driver, racing the per-process\nactivation chain across iterations and flaking the stress tests. Move that logic into\nMediaSessionManagerInterface::resetToConsistentStateForTesting() -- with the GPU-side gate\nnow in RemoteAudioSession, that reset no longer reaches the GPU under site isolation. The\nnow-unused RemoteMediaSessionManager::tryToSetAudioSessionActive is removed.\n\nTests: http/tests/site-isolation/audio-session-active-capture.html\n http/tests/site-isolation/audio-session-active-in-cross-site-iframe.html\n http/tests/site-isolation/audio-session-active-in-same-site-iframe.html\n http/tests/site-isolation/audio-session-active-replay.html\n http/tests/site-isolation/audio-session-active-two-pages.html\n http/tests/site-isolation/audio-session-active-video-element-replay.html\n http/tests/site-isolation/audio-session-active-video-element-two-pages.html\n http/tests/site-isolation/audio-session-active-video-element.html\n\n* LayoutTests/http/tests/site-isolation/audio-session-active-in-cross-site-iframe-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-active-in-cross-site-iframe.html: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-active-in-same-site-iframe-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-active-in-same-site-iframe.html: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-active-replay-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-active-replay.html: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-active-two-pages-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-active-two-pages.html: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-active-video-element-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-active-video-element-replay-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-active-video-element-replay.html: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-active-video-element-two-pages-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-active-video-element-two-pages.html: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-active-video-element.html: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-active.html:\n* LayoutTests/http/tests/site-isolation/resources/audio-session-active-frame.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/report-audio-session-active.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/report-video-element-audio-session-active.html: Added.\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::couldPlayIfEnoughData const):\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.cpp:\n(WebCore::MediaSessionManagerInterface::hasActiveAudioSession const):\n(WebCore::MediaSessionManagerInterface::sessionWillBeginPlayback):\n(WebCore::MediaSessionManagerInterface::maybeDeactivateAudioSession):\n(WebCore::MediaSessionManagerInterface::removeSession):\n(WebCore::MediaSessionManagerInterface::maybeActivateAudioSession):\n(WebCore::MediaSessionManagerInterface::managesAudioSessionActivation):\n(WebCore::MediaSessionManagerInterface::audioCaptureSourceStateChanged):\n(WebCore::MediaSessionManagerInterface::resetToConsistentStateForTesting):\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.h:\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.cpp:\n(WebKit::RemoteMediaSessionManagerProxy::removeMediaSession):\n(WebKit::RemoteMediaSessionManagerProxy::webProcessWillShutDown):\n(WebKit::RemoteMediaSessionManagerProxy::setCurrentSession):\n(WebKit::RemoteMediaSessionManagerProxy::mediaSessionWillBeginPlayback):\n(WebKit::RemoteMediaSessionManagerProxy::remoteAudioConfigurationChanged):\n(WebKit::RemoteMediaSessionManagerProxy::hasActiveAudioSession const):\n(WebKit::RemoteMediaSessionManagerProxy::processForSession const):\n(WebKit::RemoteMediaSessionManagerProxy::enqueueAudioSessionActivation):\n(WebKit::RemoteMediaSessionManagerProxy::deactivateAllAudioSessions):\n(WebKit::RemoteMediaSessionManagerProxy::sendNextActivationIPC):\n(WebKit::RemoteMediaSessionManagerProxy::setAudioSessionActiveForProcess):\n(WebKit::RemoteMediaSessionManagerProxy::reevaluateAudioSessionActivation):\n(WebKit::RemoteMediaSessionManagerProxy::updateMediaSessionStates):\n(WebKit::RemoteMediaSessionManagerProxy::processRequiresAudioSession const):\n(WebKit::RemoteMediaSessionManagerProxy::remoteProcessWillSuspend):\n(WebKit::RemoteMediaSessionManagerProxy::remoteProcessDidResume):\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.h:\n* Source/WebKit/WebProcess/GPU/media/RemoteAudioSession.cpp:\n(WebKit::RemoteAudioSession::configurationChanged):\n(WebKit::RemoteAudioSession::sendNextActivationIPC):\n(WebKit::RemoteAudioSession::tryToSetActiveInternal):\n(WebKit::RemoteAudioSession::gpuProcessConnectionDidClose):\n* Source/WebKit/WebProcess/Media/RemoteMediaSessionManager.cpp:\n(WebKit::RemoteMediaSessionManager::RemoteMediaSessionManager):\n(WebKit::RemoteMediaSessionManager::sessionWillBeginPlayback):\n(WebKit::RemoteMediaSessionManager::setAudioSessionPreferredBufferSize):\n(WebKit::RemoteMediaSessionManager::tryToSetAudioSessionActive): Deleted.\n(WebKit::RemoteMediaSessionManager::processWillSuspend):\n(WebKit::RemoteMediaSessionManager::processDidResume):\n* LayoutTests/media/utilities.js:\n(playIgnoringAbort):\n(async startNearSilentAudioContext):\n(async waitForAudioSessionActiveState):\n(waitForAudioSessionActiveState):\n* Source/WebKit/GPUProcess/media/RemoteAudioSessionProxy.cpp:\n(WebKit::RemoteAudioSessionProxy::tryToSetActive):\n* Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp:\n(WebKit::GPUProcessProxy::audioSessionActiveStateChangedForProcess):\n* Source/WebKit/UIProcess/GPU/GPUProcessProxy.h:\n* Source/WebKit/UIProcess/GPU/GPUProcessProxy.messages.in:\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionProxy.cpp:\n(WebKit::RemoteMediaSessionProxy::updateState):\n* Source/WebKit/WebProcess/Media/RemoteMediaSessionManager.h:\n* LayoutTests/http/tests/site-isolation/audio-session-active-capture-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-active-capture.html: Added.\n* Source/WebCore/platform/audio/glib/MediaSessionManagerGLib.cpp:\n(WebCore::MediaSessionManagerGLib::resetToConsistentStateForTesting):\n* Source/WebCore/platform/audio/glib/MediaSessionManagerGLib.h:\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::resetToConsistentState):\n* LayoutTests/http/tests/site-isolation/audio-session-active-expected.txt:\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.messages.in:\n\nCanonical link: https://commits.webkit.org/319006@main", "email": "eric.carlson@apple.com", "hash": "267cd2e8c7072fd01bfe053e05c171a4ddbd1e60", "subject": "[Site Isolation] Activate the audio session per web process" }, "319007@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "319007@main", "clUrl": "https://commits.webkit.org/319007@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321494\nrdar://184590003\n\nReviewed by Rupin Mittal.\n\nEach of the url [1], key [2] and ID [3] concepts opens with the same step:\n\n If ... Document is not fully active, then return the empty string.\n\nAll three returned nullString() instead. Return emptyString() from each.\n\nFor url this is web-facing. It is declared `USVString?` [4], so a null String\nmarshals to JS null while an empty String marshals to \"\", and an entry whose\ndocument had been detached reported `null` where \"\" is required.\n\nkey and ID are declared `DOMString`, and jsStringWithCache() maps any zero-length\nString - null included - onto jsEmptyString(), so those two already reached script\nas \"\". The distinction is not observable internally either: key()'s only callers\ngo through Navigation::entryIndexOfKey(), which rejects the lookup with isEmpty()\nbefore comparing anything, and that covers null and empty alike. So there is\nnothing separately testable for them; entry-after-detach.html already asserts key\nand id are \"\" after detach and already passed those two assertions. Fix them\nanyway, so the getters say what the spec says instead of leaning on a\nbinding-layer coincidence.\n\nThe index concept [5] already returned -1 as required and is unchanged. Cite the\nspec algorithm inline in all four getters while here.\n\n[1] https://html.spec.whatwg.org/#dom-navigationhistoryentry-url\n[2] https://html.spec.whatwg.org/#concept-navigationhistoryentry-key\n[3] https://html.spec.whatwg.org/#concept-navigationhistoryentry-id\n[4] https://html.spec.whatwg.org/#the-navigationhistoryentry-interface\n[5] https://html.spec.whatwg.org/#concept-navigationhistoryentry-index\n\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigation-history-entry/entry-after-detach-expected.txt: Progression\n* Source/WebCore/page/NavigationHistoryEntry.cpp:\n(WebCore::NavigationHistoryEntry::url const):\n(WebCore::NavigationHistoryEntry::key const):\n(WebCore::NavigationHistoryEntry::id const):\n(WebCore::NavigationHistoryEntry::index const):\n\nCanonical link: https://commits.webkit.org/319007@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "99285ff92cc38dad904802141efe17f2885ba157", "subject": "NavigationHistoryEntry url/key/id should return the empty string, not null, when the document is not fully active" }, "319008@main": { "author": "Aleksei Marchenko", "avatar": "https://www.gravatar.com/avatar/9a469093291c12531caccfcaa6ab73b1?d=identicon\u0026s=64", "cl": "319008@main", "clUrl": "https://commits.webkit.org/319008@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321324\nrdar://182292370\n\nReviewed by Etienne Segonzac.\n\nA \u003cmodel\u003e inside a `spatial: portal` has no renderer of its own, so the\nrenderer- and player-driven lifecycle paths in HTMLModelElement did nothing for\nit. The portal now drives them: its children forward visibility and suspension\nto the controller, which owns the ModelPlayer they share and saves each child's\nstate in a PlaceholderModelPlayer, so a reload resumes rather than restarts.\nResource loading stays with the element. A child now behaves as a standalone\n\u003cmodel\u003e does.\n\nTests: spatial-css/spatial-portal-lifecycle-visibility.html\n spatial-css/spatial-portal-display-none.html\n spatial-css/spatial-portal-on-hidden-page.html\n spatial-css/spatial-portal-suspend-resume.html\n spatial-css/spatial-portal-scroll-to-unload.html\n spatial-css/spatial-portal-layers-dynamic.html\n TestWebKitAPI.SpatialPortal.CleanUpOnNavigate/OnReload/OnHide\n\n* LayoutTests/model-element/model-element-suspend-resume.html:\nIts pageshow handler now declares the event parameter it was reading from the global.\n\n* LayoutTests/spatial-css/spatial-portal-action-multi-model.html:\n* LayoutTests/spatial-css/spatial-portal-display-none-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-display-none.html: Added.\n* LayoutTests/spatial-css/spatial-portal-layers-dynamic-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-layers-dynamic.html: Added.\n* LayoutTests/spatial-css/spatial-portal-lifecycle-visibility-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-lifecycle-visibility.html: Added.\n* LayoutTests/spatial-css/spatial-portal-multi-model-error.html:\n* LayoutTests/spatial-css/spatial-portal-multi-model-source-change.html:\n* LayoutTests/spatial-css/spatial-portal-on-hidden-page-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-on-hidden-page.html: Added.\n* LayoutTests/spatial-css/spatial-portal-scroll-to-load.html:\n* LayoutTests/spatial-css/spatial-portal-scroll-to-unload-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-scroll-to-unload.html: Added.\n* LayoutTests/spatial-css/spatial-portal-suspend-resume-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-suspend-resume.html: Added.\nSix new tests cover visibility unload/reload, teardown with the portal's box, the\nhidden-page and back/forward cache cases, scrolling out and back, and the layers\nleft behind when a portal's last model goes away. The four existing ones move to\nper-element internals.modelElementState().\n\n* Source/WebCore/Modules/model-element/HTMLModelElement.cpp:\n(WebCore::HTMLModelElement::suspend):\n(WebCore::HTMLModelElement::resume):\n(WebCore::HTMLModelElement::visibilityStateChanged):\n(WebCore::HTMLModelElement::createModelPlayer):\n(WebCore::HTMLModelElement::modelPlayerForAnimation const):\n(WebCore::HTMLModelElement::stop):\n(WebCore::HTMLModelElement::hasLiveModelPlayer const):\nAPI reaches the child's placeholder while it is unloaded.\n\n(WebCore::HTMLModelElement::isModelLoading const):\n(WebCore::HTMLModelElement::isModelLoaded const):\n(WebCore::HTMLModelElement::isModelUnloading const):\n(WebCore::HTMLModelElement::isModelUnloaded const):\n* Source/WebCore/Modules/model-element/HTMLModelElement.h:\n* Source/WebCore/Modules/model-element/SpatialPortalController.cpp:\n(WebCore::SpatialPortalController::~SpatialPortalController):\n(WebCore::SpatialPortalController::prepareForRemoval):\n(WebCore::SpatialPortalController::unregisterChildModel):\n(WebCore::SpatialPortalController::registerChildModel):\n(WebCore::SpatialPortalController::loadChildModelsIfReady):\n(WebCore::SpatialPortalController::loadChildModelIfReady):\n(WebCore::SpatialPortalController::childIsLoaded const):\n(WebCore::SpatialPortalController::playerForChild const):\n(WebCore::SpatialPortalController::observePortalVisibility):\n(WebCore::SpatialPortalController::stopObservingPortalVisibility):\n(WebCore::SpatialPortalController::viewportIntersectionChanged):\n(WebCore::SpatialPortalController::documentVisibilityChanged):\n(WebCore::SpatialPortalController::childVisibilityStateChanged):\n(WebCore::SpatialPortalController::unloadChildModel):\n(WebCore::SpatialPortalController::saveChildState):\n(WebCore::SpatialPortalController::unloadAllChildModels):\n(WebCore::SpatialPortalController::childWasSuspended):\n(WebCore::SpatialPortalController::configureGraphicsLayer):\n(WebCore::SpatialPortalController::modelDidUnload):\n(WebCore::SpatialPortalController::reconfigurePortalLayer):\n(WebCore::SpatialPortalController::numberOfLoadedModels const): Deleted.\nSuspension is per child; the last out deletes the shared player, after state\ncapture. The controller observes document visibility so the player hears it once.\n\n* Source/WebCore/Modules/model-element/SpatialPortalController.h:\n(WebCore::SpatialPortalController::modelPlayer const): Deleted.\n* Source/WebCore/platform/graphics/GraphicsLayer.h:\n* Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp:\n* Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h:\nremoveModelContents() is no longer immersive-only; a portal needs it too.\n\n* Source/WebCore/rendering/RenderBox.cpp:\n(WebCore::RenderBox::willBeDestroyed):\nClear the portal controller, but not while the render tree is being destroyed: the\nback/forward cache destroys it before suspending, and the player must outlive that\nfor suspend() to save state.\n\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::numberOfLoadedModelsInSpatialPortal): Deleted.\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\nmodelElementState() answers for portal children now.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SpatialPortal.mm:\n(TestWebKitAPI::enableSpatialPortalPreferences):\n(TestWebKitAPI::TEST(SpatialPortal, CleanUpOnNavigate)):\n(TestWebKitAPI::TEST(SpatialPortal, CleanUpOnReload)):\n(TestWebKitAPI::TEST(SpatialPortal, CleanUpOnHide)):\nPortal clean-up tests, mirroring ModelProcess.mm's.\n\nCanonical link: https://commits.webkit.org/319008@main", "email": "aleksei@apple.com", "hash": "6caa27b1860bcdbd79a677185a2b8246bccc291d", "subject": "Implement child model lifecycle for spatial portals" }, "319009@main": { "author": "Kiara Rose", "avatar": "https://www.gravatar.com/avatar/cbfa3709de8e533bdc6505c6c4e83e24?d=identicon\u0026s=64", "cl": "319009@main", "clUrl": "https://commits.webkit.org/319009@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321237\nrdar://184284891\n\nReviewed by Timothy Hatcher.\n\nAdd support for scripting.ExecutionWorld, which should simply return an object containing the two\ndifferent world types.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIScripting.mm\n\n* Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIScriptingCocoa.mm:\n(WebKit::WebExtensionAPIScripting::executionWorld):\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPIScripting.h:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIScripting.idl:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIScripting.mm:\n(TestWebKitAPI::TEST(WKWebExtensionAPIScripting, ExecutionWorld)):\n\nCanonical link: https://commits.webkit.org/319009@main", "email": "kiara_rose@apple.com", "hash": "132cc094ace96536261b48ffdd45c51aecc0bcf4", "subject": "Add support for scripting.ExecutionWorld" }, "319010@main": { "author": "Wenson Hsieh", "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64", "cl": "319010@main", "clUrl": "https://commits.webkit.org/319010@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321486\nrdar://168703870\n\nReviewed by Ryosuke Niwa and Abrar Rahman Protyasha.\n\nAfter the changes in 317283@main, we now include content from cross-origin frames under the top\nframe when serializing attributed string data to the pasteboard. However, this logic is broken in\nthe case where there are same-origin frames nested underneath cross-origin frames, since our current\napproach of descending into RemoteFrames and asking for their contents as attributed string doesn't\nhandle the case where we might need to later descend **back** into a subframe hosted in the same\nprocess as the main frame.\n\nTo fix this, we refactor the way in which this attributed string serialization works to handle all\npossible ways of nesting same- or cross-origin frames:\n\n1. Serialize the selected DOM content into an attributed string. Whenever we encounter a\n `RemoteFrame`, append an object replacement character to the string, marked with an internal\n attribute representing the contents of that remote frame\n (`remoteFrameIdentifierAttributeName`).\n\n2. Serialize the contents of those remote frames. The UI process walks the frame tree to find all\n remote frames in the selection (including nested descendants) and asks each web process for the\n ones it hosts, since only the UI process knows which process hosts which frame. The web process\n containing the selection is blocked waiting on this reply, so it cannot be asked for anything;\n it serializes the frames it hosts underneath a remote frame itself.\n\n3. Collate the attributed strings from [1] and [2] into a final, flattened attributed string by\n iteratively replacing each remote frame placeholder with its corresponding subframe contents.\n\nTests: SiteIsolation.ReadAttributedStringFromPasteboardAfterCopyWithCrossSiteIframe\n SiteIsolation.ReadAttributedStringFromPasteboardAfterCopyWithNestedCrossSiteIframes\n\n* Source/WebCore/editing/cocoa/EditorCocoa.mm:\n(WebCore::selectionAsAttributedString):\n(WebCore::attributedStringByReplacingRemoteFrameMarkers):\n(WebCore::populateRichTextDataIfNeeded):\n(WebCore::Editor::writeSelectionToPasteboard):\n(WebCore::Editor::dataInRTFDFormat):\n(WebCore::Editor::dataInRTFFormat):\n* Source/WebCore/editing/cocoa/NodeHTMLConverter.h:\n(WebCore::attributedString): Deleted.\n* Source/WebCore/editing/cocoa/NodeHTMLConverter.mm:\n(HTMLConverter::HTMLConverter):\n(HTMLConverter::_addRemoteFrameMarker):\n(HTMLConverter::_processElement):\n\nAdd placeholders to represent the contents of remote frames embedded in the attributed string, which\nare later removed (and replaced with attributed string data taken from their respective subframes,\nif we got data from them).\n\n(WebCore::remoteFrameIdentifierAttributeName):\n(WebCore::containsRemoteFrameContentMarkers):\n(WebCore::attributedString):\n\nAdd an option to extract cross-origin frames as placeholders in the attributed string (see above).\n\n* Source/WebCore/page/FrameTree.cpp:\n(WebCore::FrameTree::containsRemoteFrame const):\n(WebCore::FrameTree::hasRemoteFrameAncestor const):\n* Source/WebCore/page/FrameTree.h:\n* Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm:\n(WebKit::WebPageProxy::getAttributedStringsForRemoteFrames):\n* Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm:\n(WebKit::WebPage::attributedStringsForRemoteFrames):\n(WebKit::WebPage::getContentsAsAttributedStringForFrames):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, ReadAttributedStringFromPasteboardAfterCopyWithCrossSiteIframe)):\n(TestWebKitAPI::(SiteIsolation, ReadAttributedStringFromPasteboardAfterCopyWithNestedCrossSiteIframes)):\n\nCanonical link: https://commits.webkit.org/319010@main", "email": "wenson_hsieh@apple.com", "hash": "a764f514974feefcceb1f2d05fd95dd1af8f68ea", "subject": "Site Isolation: copying and pasting text as attributed strings skips content in nested cross-origin subframes" }, "319011@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "319011@main", "clUrl": "https://commits.webkit.org/319011@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321549\nrdar://184657982\n\nReviewed by Yijia Huang.\n\nCallLinkInfo::m_maxArgumentCountIncludingThisForVarargs is uint8_t so we\nshould not use branch32 with Address(). load8 first to zero-extend the byte,\nthen branch32 on registers.\n\n* Source/JavaScriptCore/jit/JITCall.cpp:\n(JSC::JIT::compileSetupFrame):\n\nCanonical link: https://commits.webkit.org/319011@main", "email": "ysuzuki@apple.com", "hash": "fbb79b137a9048f25d7a99c326d7abbb7ccfe1fe", "subject": "[JSC] Fix CallLinkInfo::m_maxArgumentCountIncludingThisForVarargs feedback collection" }, "319012@main": { "author": "David Kilzer", "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64", "cl": "319012@main", "clUrl": "https://commits.webkit.org/319012@main", "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=320431\u003e\n\u003crdar://183392744\u003e\n\nReviewed by Eric Carlson.\n\nAssert the main thread at the top of each `ensureOnMainThread()` block\nin `WebAVSampleBufferListenerPrivate` that reads the `_client` instance\nvariable. `_client` is annotated\n`WTF_GUARDED_BY_CAPABILITY(mainThread)`, and although every reader\nreaches it through `ensureOnMainThread()`, the thread-safety analyzer\ncannot infer that the dispatched block body runs on the main thread.\n`assertIsMainThread()` supplies the missing main-thread capability so\n`-Wthread-safety-analysis` can prove the guarded access is well-formed.\n\nNo new tests since no change in behavior.\n\n* Source/WebCore/platform/graphics/avfoundation/WebAVSampleBufferListener.mm:\n(-[WebAVSampleBufferListenerPrivate observeValueForKeyPath:ofObject:change:context:]):\n(-[WebAVSampleBufferListenerPrivate layerFailedToDecode:]):\n(-[WebAVSampleBufferListenerPrivate layerRequiresFlushToResumeDecodingChanged:]):\n(-[WebAVSampleBufferListenerPrivate layerReadyForDisplayChanged:]):\n(-[WebAVSampleBufferListenerPrivate audioRendererWasAutomaticallyFlushed:]):\n\nCanonical link: https://commits.webkit.org/319012@main", "email": "ddkilzer@apple.com", "hash": "6f1dd314cc55b8f8a74253ea88f0dd77b4fedfc1", "subject": "WebAVSampleBufferListener should assert the main thread when accessing _client in ensureOnMainThread blocks" }, "319013@main": { "author": "Justin Michaud", "avatar": "https://www.gravatar.com/avatar/36e0433ee725a08f7e1122a6bc584b57?d=identicon\u0026s=64", "cl": "319013@main", "clUrl": "https://commits.webkit.org/319013@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320826\n\nReviewed by Darin Adler.\n\nDrive-by fix for this log line that I saw in the bots.\n\nCanonical link: https://commits.webkit.org/319013@main", "email": "jmichaud@igalia.com", "hash": "6c51c6864dc25a9d3d22deb780da4246f37dc84c", "subject": "Fix testapi: TypeError: not all arguments converted during string formatting" }, "319014@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "319014@main", "clUrl": "https://commits.webkit.org/319014@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321488\n\nReviewed by Yusuke Suzuki.\n\nSourceProviderCacheItem stores its used-variable names in a trailing\nPackedPtr\u003cUniquedStringImpl\u003e array, whose element is 6 bytes on 64-bit\nmacOS/Linux, but create() sized the allocation with\nsizeof(UniquedStringImpl*) (8 bytes) per element, so every item carried 2\nunused bytes per used variable. These items are created for each function\nlonger than 16 characters in a parsed source and live in the VM's\nSourceProviderCache until the next full GC, so the slack accumulates.\n\nMake SourceProviderCacheItem a TrailingArray of PackedRefPtr\u003cUniquedStringImpl\u003e\nso that the allocation size, element construction and ref/deref all derive\nfrom the declared element type instead of being hand-written. Moving the\nelement count into TrailingArray::m_size also lets isBodyArrowExpression share\na word with tokenType, shrinking the fixed part from 40 to 36 bytes on\nmacOS/Linux. Parsing a 17.8 MB bundle (64,830 items, 3.56 used variables per\nitem on average) goes from 4.80 MB to 4.22 MB of malloc'd\nSourceProviderCacheItem storage after size-class rounding (4.46 MB with the\nelement size fix alone).\n\n* Source/JavaScriptCore/parser/Parser.h:\n(JSC::Scope::restoreFromSourceProviderCache):\n* Source/JavaScriptCore/parser/SourceProviderCacheItem.h:\n(JSC::SourceProviderCacheItem::create):\n(JSC::SourceProviderCacheItem::SourceProviderCacheItem):\n(JSC::SourceProviderCacheItem::endFunctionToken const): Deleted.\n(JSC::SourceProviderCacheItem::lexicallyScopedFeatures const): Deleted.\n(JSC::SourceProviderCacheItem::usedVariables const): Deleted.\n(JSC::SourceProviderCacheItem::~SourceProviderCacheItem): Deleted.\n\nCanonical link: https://commits.webkit.org/319014@main", "email": "sosuke@bun.sh", "hash": "69b336c0ac0539338e0d764beba3da19bc58af3c", "subject": "[JSC] `SourceProviderCacheItem::create` over-allocates the trailing `PackedPtr` array" }, "319015@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "319015@main", "clUrl": "https://commits.webkit.org/319015@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321545\nrdar://184655909\n\nReviewed by Vassili Bykov.\n\nWasmGC Struct may have padding like what C++ struct is because of\nalignment requirement of fields. But since offset of fields are not\nexposed as ABI, we can fill gaps with smaller fields to compact the size\nof WasmGC structs. This is effective for example if we are interleaving\ni8 and i32.\n\n struct {\n i8;\n i32;\n i8;\n i32;\n };\n\nThis can be like,\n\n struct {\n i8;\n i8;\n i32;\n i32;\n };\n\nWe apply V8's heuristics[1]. Tracking one gap we found so far, and\nreusing this gap when we encounter a field which can fit in this gap.\n\nTo make the layout itself testable, $vm gains wasmStructFieldOffsets and\nwasmStructPayloadSize, which reflect the placement decisions of a struct\ninstance back to JS.\n\n[1]: https://chromium-review.googlesource.com/c/v8/v8/+/4092494\n\nTest: JSTests/wasm/gc/struct-field-gap-filling.js\n\n* JSTests/wasm/gc/struct-field-gap-filling.js: Added.\n* Source/JavaScriptCore/tools/JSDollarVM.cpp:\n(JSC::functionWasmStructFieldOffsets):\n(JSC::functionWasmStructPayloadSize):\n(JSC::JSDollarVM::finishCreation):\n* Source/JavaScriptCore/wasm/WasmFormat.h:\n(JSC::Wasm::placeStructField):\n* Source/JavaScriptCore/wasm/WasmTypeDefinition.cpp:\n(JSC::Wasm::TypeInformation::typeDefinitionForStruct):\n* Source/JavaScriptCore/wasm/WasmTypeDefinitionInlines.h:\n(JSC::Wasm::TypeInformation::typeDefinitionForStructFromProvider):\n\nCanonical link: https://commits.webkit.org/319015@main", "email": "ysuzuki@apple.com", "hash": "3eee8becf0b5d458f667d35392b2dc62aeb8b847", "subject": "[JSC] Fill alignment gap in WasmGC structs" }, "319016@main": { "author": "Ryan Reno", "avatar": "https://www.gravatar.com/avatar/16a1357ff2718b0348bedeec44d58812?d=identicon\u0026s=64", "cl": "319016@main", "clUrl": "https://commits.webkit.org/319016@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321532\nrdar://183145568\n\nReviewed by Mike Wyrzykowski and Vitor Roriz.\n\nThere were a few strings in the AtomString table which were no longer used anywhere. In some cases\nstrings were only being used for case-insensitive comparisons which are more efficiently done with\nASCII literals. And in other cases the strings were only meant to be used off the main thread, which\nAtomStrings don't support.\n\nThese are being removed to free up a small amount of space in the table and to prevent false-positive leak\nrepots from some memory analysis tools.\n\nNo new tests.\n\n* Source/WebCore/platform/CommonAtomStrings.h:\n\nCanonical link: https://commits.webkit.org/319016@main", "email": "rreno@apple.com", "hash": "aab1af852467d68bcc3197e6a5b1b28706a27bd9", "subject": "Remove unused AtomStrings from the AtomString table." }, "319017@main": { "author": "Kimmo Kinnunen", "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64", "cl": "319017@main", "clUrl": "https://commits.webkit.org/319017@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321502\nrdar://184606411\n\nReviewed by Keith Miller.\n\nJS accesses the handler in non-main thread. This access is sometimes the\nfirst one, binding the CanMakeWeakPtr WeakPtrFactory to the main thread.\n\nAvoid by not using WeakPtrs.\n\n* Source/WTF/wtf/MemoryPressureHandler.cpp:\n(WTF::MemoryPressureHandler::MemoryPressureHandler):\n(WTF::MemoryPressureHandler::setShouldUsePeriodicMemoryMonitor):\n* Source/WTF/wtf/MemoryPressureHandler.h:\n\nCanonical link: https://commits.webkit.org/319017@main", "email": "kkinnunen@apple.com", "hash": "957b52180beef788a5eae5231cbf6ac4b9940d31", "subject": "REGRESSION(318840@main) WeakPtr thread assert in MemoryPressureHandler" }, "319019@main": { "author": "Phinehas Fuachie", "avatar": "https://www.gravatar.com/avatar/900d85de8c325e38975f39115c36bb75?d=identicon\u0026s=64", "cl": "319019@main", "clUrl": "https://commits.webkit.org/319019@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321541\nrdar://184654127\n\nReviewed by Jean-Yves Avenard.\n\nThe attribute selects a projection, not whether the content is spatial; the two\nare independent, which is why ImmersiveVideoMetadata reports isSpatial() and\nisImmersive() separately.\n\n* Source/WebCore/Modules/modern-media-controls/media/spatial-video-support.js:\n(SpatialVideoSupport.prototype._resolveProjection):\n\nCanonical link: https://commits.webkit.org/319019@main", "email": "pfuachie2@apple.com", "hash": "f61a9b87e5704366d0cb6eaa01db8fb6dc34ad2e", "subject": "The projection attribute of the spatial video renderer is x-webkit-spatial instead of x-webkit-projection (experimental)" }, "319020@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "319020@main", "clUrl": "https://commits.webkit.org/319020@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321522\nrdar://184632964\n\nReviewed by Yijia Huang.\n\nThis patch tightens WasmGC allocations.\n\n1. While allocator is not a constant in WasmGC struct allocations (it is\n coming from JSWebAssemblyInstance field), size is constant when\n compiling. We add VariableNonNullWithConstantCellSize mode, which\n means that \"allocator is in GPR as a variable, but cell size is constant\"\n to tighten the code generation.\n2. We revisit effect model of WasmGC allocations, now it is more aligned\n to DFG's allocations (not saying write-top).\n3. We also fold WasmGC array allocations with constant size too.\n\nTests: JSTests/wasm/gc/struct-new-does-not-clobber-loads.js\n JSTests/wasm/gc/struct-new-nested-alloc-gc.js\n\n* JSTests/wasm/gc/array-new-constant-size.js: Added.\n(get return):\n(make):\n(get for):\n* JSTests/wasm/gc/struct-new-does-not-clobber-loads.js: Added.\n* JSTests/wasm/gc/struct-new-nested-alloc-gc.js: Added.\n(want):\n* Source/JavaScriptCore/b3/B3AbstractHeapRepository.cpp:\n(JSC::B3::AbstractHeapRepository::AbstractHeapRepository):\n(JSC::B3::AbstractHeapRepository::decorateWasmStructNew):\n(JSC::B3::AbstractHeapRepository::decorateWasmArrayNew):\n(JSC::B3::AbstractHeapRepository::computeRangesAndDecorateInstructions):\n* Source/JavaScriptCore/b3/B3AbstractHeapRepository.h:\n* Source/JavaScriptCore/b3/B3LowerMacros.cpp:\n* Source/JavaScriptCore/b3/B3Value.cpp:\n(JSC::B3::Value::effectsSlow const):\n* Source/JavaScriptCore/b3/B3WasmArrayNewValue.h:\n* Source/JavaScriptCore/b3/B3WasmStructNewValue.h:\n* Source/JavaScriptCore/heap/CompleteSubspace.cpp:\n(JSC::CompleteSubspace::prepareAllAllocators):\n* Source/JavaScriptCore/jit/AssemblyHelpers.cpp:\n(JSC::AssemblyHelpers::emitAllocateWithNonNullAllocator):\n(JSC::AssemblyHelpers::emitAllocate):\n* Source/JavaScriptCore/jit/JITAllocator.h:\n(JSC::JITAllocator::variableNonNullWithConstantCellSize):\n(JSC::JITAllocator::hasConstantCellSize const):\n(JSC::JITAllocator::constantCellSize const):\n* Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp:\n(JSC::Wasm::BBQJITImpl::BBQJIT::emitAllocateGCArrayUninitialized):\n(JSC::Wasm::BBQJITImpl::BBQJIT::emitAllocateGCStructUninitialized):\n* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:\n(JSC::Wasm::OMGIRGenerator::addArrayNew):\n(JSC::Wasm::OMGIRGenerator::addArrayNewDefault):\n(JSC::Wasm::OMGIRGenerator::addArrayNewFixed):\n(JSC::Wasm::OMGIRGenerator::addStructNew):\n(JSC::Wasm::OMGIRGenerator::addStructNewDefault):\n\nCanonical link: https://commits.webkit.org/319020@main", "email": "ysuzuki@apple.com", "hash": "6589b2e5c18c0a0d4180c0e77ad2fb46f4be0d46", "subject": "[JSC] Tighten WasmGC allocation" }, "319021@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "319021@main", "clUrl": "https://commits.webkit.org/319021@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321497\n\nReviewed by Yusuke Suzuki.\n\n210869@main moved m_parentScopeTDZVariables into UnlinkedFunctionExecutable::RareData\nbecause it was non-empty for only ~1% of executables at the time. That no longer holds:\nsince 230994@main, BytecodeGenerator::getVariablesUnderTDZ() returns a non-null\nTDZEnvironmentLink whenever the enclosing TDZ stack is non-empty, and in\nlet/const/class-heavy code most closures are created while some lexical binding of an\nenclosing scope is still in its TDZ (the binding being initialized in\n`const f = () =\u003e ...`, the class name for every method of a named class, any const/class\ndeclared later in the scope). As a result the 80-byte RareData is malloc'ed for a large\nfraction of the 96-byte executables just to hold this one pointer.\n\nThis patch stores m_parentScopeTDZVariables in the cell again without growing it. The 8\nbytes come from m_name/m_ecmaName: FunctionMetadataNode::ecmaName() is ident() whenever\nident() is non-null, so the two Identifiers only differ for anonymous functions. Keep a\nsingle m_ecmaName plus an m_hasName bit, which fits in the existing bit-field padding, and\nmake name() return vm().propertyNames-\u003enullIdentifier (what the parser already uses as the\nident of anonymous functions) when the bit is unset. sizeof(UnlinkedFunctionExecutable)\nstays at 96 bytes and RareData goes back to being rare (class constructors, private name\nenvironments, generator/async body wrapper parameter names, source URL directives).\n\nRareData allocations, counted at UnlinkedFunctionExecutable::ensureRareDataSlow():\n\n non-builtin RareData\n executables before after\n\n typescript.js 5.9 load + transpileModule 15979 5553 49\n JetStream2 chai-wtb 13544 4149 197\n JetStream2 prepack-wtb 13622 4061 197\n JetStream2 uglify-js-wtb 13434 4061 197\n JetStream2 coffeescript-wtb 13192 3817 197\n JetStream2 acorn-wtb 13078 3702 197\n JetStream2 WSL 2197 1476 136\n JetStream2 pdfjs 986 897 17\n JetStream2 ML 564 543 30\n JetStream2 Air 386 333 30\n JetStream2 Babylon 397 376 28\n JetStream2 FlightPlanner 223 191 37\n JetStream2 Basic 228 162 32\n JetStream2 UniPoker 135 111 21\n JetStream2 async-fs 138 110 27\n JetStream2 driver only (cdjs, gbemu, ...) ~170 88 17\n\nJetStream2 scores are neutral. Per-benchmark Score, patched/baseline over 8 alternating\nruns of cli.js: acorn-wtb 1.003, babylon-wtb 1.010, chai-wtb 0.994, coffeescript-wtb\n0.999, espree-wtb 1.006, jshint-wtb 1.002, lebab-wtb 0.994, prepack-wtb 1.000,\nuglify-js-wtb 1.006, typescript 1.001, pdfjs 0.997, first-inspector-code-load 1.012,\nmulti-inspector-code-load 1.037, WSL 1.035, Air 0.991, ML 1.053, Basic 0.997,\nasync-fs 1.028, UniPoker 1.028; all within the run-to-run confidence intervals.\n\n* Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp:\n(JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):\n(JSC::UnlinkedFunctionExecutable::name const):\n* Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h:\n* Source/JavaScriptCore/runtime/CachedTypes.cpp:\n(JSC::CachedFunctionExecutableRareData::encode):\n(JSC::CachedFunctionExecutableRareData::decode const):\n(JSC::CachedFunctionExecutable::hasName const):\n(JSC::CachedFunctionExecutable::parentScopeTDZVariables const):\n(JSC::CachedFunctionExecutable::encode):\n(JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):\n(JSC::CachedFunctionExecutable::name const): Deleted.\n\nCanonical link: https://commits.webkit.org/319021@main", "email": "sosuke@bun.sh", "hash": "8d33a8ff591daa32c3d2f441d3cfd82197f296c1", "subject": "[JSC] Move `m_parentScopeTDZVariables` into `UnlinkedFunctionExecutable` itself" }, "319022@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "319022@main", "clUrl": "https://commits.webkit.org/319022@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321228\n\nReviewed by Yusuke Suzuki.\n\n295918@main taught JSOnlyStringsAndInt32sJoiner to write Int32 elements\ndirectly into the result buffer, but fastArrayJoin's ALL_INT32_INDEXING_TYPES\ncase was not updated and still went through the generic JSStringJoiner,\nallocating a numeric string per element. Only the empty-separator case was\nfast because arrayProtoFuncJoin has its own early path, so `ids.join(\"\")`\nwas ~2x faster than `ids.join(\",\")` / `ids.toString()`.\n\nThis patch makes the ALL_INT32 case try JSOnlyStringsAndInt32sJoiner first,\nmirroring the ALL_CONTIGUOUS case, and falls back to the generic loop only\nwhen the array has holes.\n\ntryJoin is now templatized on the indexing shape so that the Int32Shape\ninstantiation only checks for holes and skips the per-element isString() checks\nthat the ContiguousShape one needs.\n\n baseline patched\n\narray-join-int32-separator 22.1538+-0.6142 ^ 10.9635+-0.7135 ^ definitely 2.0207x faster\n\nTests: JSTests/microbenchmarks/array-join-int32-separator.js\n JSTests/stress/array-join-int32-separator.js\n\n* JSTests/microbenchmarks/array-join-int32-separator.js: Added.\n(next):\n(test):\n* JSTests/stress/array-join-int32-separator.js: Added.\n(shouldBe):\n(test):\n* Source/JavaScriptCore/runtime/ArrayPrototypeInlines.h:\n(JSC::fastArrayJoin):\n\nCanonical link: https://commits.webkit.org/319022@main", "email": "sosuke@bun.sh", "hash": "a4df93500a72428a2220aa1282f4801dced50471", "subject": "[JSC] `Array#join` on Int32 arrays should use `JSOnlyStringsAndInt32sJoiner` for any separator" }, "319023@main": { "author": "Franco Vieira de Souza", "avatar": "https://www.gravatar.com/avatar/14ed77684c1591a07649be8495cc0ddb?d=identicon\u0026s=64", "cl": "319023@main", "clUrl": "https://commits.webkit.org/319023@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321119\nrdar://184152184\n\nReviewed by Tim Nguyen.\n\nAdds the (unprefixed) user-select property, gated by a new feature\nflag (CSSUserSelectEnabled). The property is completely inert - this\ncommit only adds the plumbing required for making user-select actually\naffect selectability in the future. The prefixed `-webkit-user-select`\nstill exists independently and is the only source of truth.\n\nNo changes in behavior expected. However, some tests now pass simply\nbecause the user-select property exists (though only in testing -\nfeature flag set to 'testable').\n\nCanonical link: https://commits.webkit.org/319023@main", "email": "franco_vieira@apple.com", "hash": "21f1e674ff34d7628aa80ec7628084ececdd41af", "subject": "Add unprefixed user-select (and feature flag)" }, "319025@main": { "author": "Nikolas Zimmermann", "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64", "cl": "319025@main", "clUrl": "https://commits.webkit.org/319025@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321333\n\nReviewed by Alejandro G. Castro.\n\nAn SVG document embedded through SVGImage (\u003cimg\u003e, background-image, SVG \u003cimage\u003e)\nis resized to the container size chosen by the embedder. With no viewBox,\nSVGSVGElement synthesizes one from the intrinsic size, plus a preserveAspectRatio\nof \"none\", so the content stretches to that size.\n\nThe legacy engine gets this for free, since buildLocalToBorderBoxTransform() asks\nthe element for the viewBox transform without checking for a viewBox attribute\nfirst, as LBSE did. Fix LBSE by calling viewBoxToViewTransform() unconditionally.\nIt returns the identity transform when there is nothing to map, which makes the\nsurrounding conditions redundant.\n\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/TestExpectations:\n* Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp:\n(WebCore::RenderSVGViewportContainer::needsHasSVGTransformFlags const):\n(WebCore::RenderSVGViewportContainer::updateLayerTransform):\n(WebCore::RenderSVGViewportContainer::overflowClipRect const):\n* Source/WebCore/svg/SVGSVGElement.cpp:\n(WebCore::SVGSVGElement::hasSynthesizedViewBoxForSVGImage const):\n(WebCore::SVGSVGElement::currentViewBoxRect const):\n(WebCore::SVGSVGElement::viewBoxToViewTransform const):\n* Source/WebCore/svg/SVGSVGElement.h:\n\nCanonical link: https://commits.webkit.org/319025@main", "email": "nzimmermann@igalia.com", "hash": "04110306d8797967fe679e31fd1a34207975b63a", "subject": "[LBSE] Apply the synthesized viewBox transform for SVG documents embedded through SVGImage" }, "319026@main": { "author": "Razvan Caliman", "avatar": "https://www.gravatar.com/avatar/e35c40637d6bc28b86585f2cf1b2e1ca?d=identicon\u0026s=64", "cl": "319026@main", "clUrl": "https://commits.webkit.org/319026@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321440\nrdar://184526544\n\nReviewed by BJ Burg.\n\nElement Send Keys, Element Clear, Get Element Rect, and Element Click commands hang\nin cross-origin iframes under Site Isolation.\n\n`WebAutomationSessionProxy::computeElementLayout()` and `takeScreenshot()` reached to the page's\nmain frame to convert position coordinates, via `dynamicDowncast\u003cLocalFrame\u003e(mainFrame())`.\n\nWhen Site Isolation is enabled, the main frame of an out-of-process iframe is a RemoteFrame,\nso the downcast produces `null` and both functions early return, destroying their completion\nhandler without calling it. This prevents an IPC reply from ever being, so the automation command\nnever completes and the WebDriver client hangs until it times out.\n\nThis affects every command that computes an element's layout for an element inside a cross-origin iframe:\nElement Send Keys, Element Clear, Element Click and Get Element Rect.\n\nThis patch introduces a change to convert through the frame's local root instead of the page's main frame.\n\nThis is not a new approximation: `LocalFrameView::contentsToRootView()` already stops at the local root,\nso the existing conversion helpers produce local-root coordinates and pairing them with the local\nroot's view is consistent. Without Site Isolation the local root is the main frame, so behavior there is unchanged.\n\nWhen the local root has no view, reply with an error instead of dropping the completion handler,\nso that any future failure surfaces as a WebDriver error rather than as a hang.\n\n* Source/WebKit/WebProcess/Automation/WebAutomationSessionProxy.cpp:\n(WebKit::WebAutomationSessionProxy::computeElementLayout):\n(WebKit::WebAutomationSessionProxy::takeScreenshot):\n\nCanonical link: https://commits.webkit.org/319026@main", "email": "rcaliman@apple.com", "hash": "b0da4c18f786cf60aa8ee4b0a2d02f091627c526", "subject": "[Web Automation] WebDriver commands hang for elements in cross-origin iframes under Site Isolation" }, "319027@main": { "author": "Fady Farag", "avatar": "https://www.gravatar.com/avatar/0ac5127c69f90d0c57054173ae4c3108?d=identicon\u0026s=64", "cl": "319027@main", "clUrl": "https://commits.webkit.org/319027@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321560\nrdar://184667562\n\nReviewed by Ryosuke Niwa.\n\nThis mainly improves code readability. Lambdas also inline better.\nThis also increases Clang static analysis coverage since captures are\nvisible to SaferCPP checkers.\n\n* Source/WebCore/Modules/webaudio/MediaElementAudioSourceNode.cpp:\n(WebCore::MediaElementAudioSourceNode::updateResamplerIfNeeded):\n* Source/WebCore/Modules/webaudio/MediaStreamAudioSourceNode.cpp:\n(WebCore::MediaStreamAudioSourceNode::setFormat):\n* Source/WebCore/editing/MarkupAccumulator.cpp:\n(WebCore::MarkupAccumulator::shouldExcludeElement):\n* Source/WebCore/platform/audio/MultiChannelResampler.cpp:\n(WebCore::MultiChannelResampler::MultiChannelResampler):\n\nCanonical link: https://commits.webkit.org/319027@main", "email": "com.webkit.iidmsa@gmail.com", "hash": "a9b9cd9fbbe9a7d28e97d50bd6f53d3dcb2697ff", "subject": "Use C++14 lambdas instead of `std::bind()` in WebCore" }, "319028@main": { "author": "Adrian Taylor", "avatar": "https://www.gravatar.com/avatar/d2acb8ad2e2670ff74ae0d65fb27014c?d=identicon\u0026s=64", "cl": "319028@main", "clUrl": "https://commits.webkit.org/319028@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321577\nrdar://184689585\n\nReviewed by Ian Grunert.\n\nThis adapts the existing swiftc-wrapper.sh into a Python script called\nswiftc-wrapper.py. The intention is that it's functionally identical.\n\nThis is a pre-requisite for enabling Swift support on Windows. This PR does\nnot do that - Swift is still disabled on Windows platforms - but it gets\nus closer.\n\nThe launch mechanism is slightly subtle here. On POSIX platforms, we\ncan set CMAKE_Swift_COMPILER directly to the python script, and the\nshebang will ensure it's launched correctly. On Windows, there is no\nsuch thing as a shebang, so the most obvious option would be to launch it using\na cmd.exe invocation and perhaps a batch file. That doesn't work since our\nSwift compilation commands are too long for cmd.exe's limits. For that\nreason we use a CMake _ARG1 variable.\n\nA few other minor 'if' conditions are adjusted too, so that the Windows\nbuild most closely matches GTK and WPE and thus does not involve Cocoa-\nspecific Swift code.\n\n* CMakeLists.txt:\n* Source/WebCore/PAL/pal/CMakeLists.txt:\n* Source/cmake/OptionsWin.cmake:\n* Source/cmake/WebKitMacros.cmake:\n* Tools/Scripts/swift/swiftc-wrapper.py: Added.\n(filter_benign_warnings):\n(expand_response_file):\n(process_args):\n(main):\n* Tools/Scripts/swift/swiftc-wrapper.sh: Removed.\n\nCanonical link: https://commits.webkit.org/319028@main", "email": "adrian_taylor@apple.com", "hash": "1cbc24d90fff46d1d0cc87e6fbdd50449a46de5a", "subject": "Convert swiftc-wrapper to Python for Windows" }, "319029@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "319029@main", "clUrl": "https://commits.webkit.org/319029@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321413\n\nReviewed by Antti Koivisto.\n\napplyAfterBreak answers a forced break by moving the container's logical height to the top of the next page.\nThat is what puts the content after a block level sibling there, since the next block child starts from the\ncontainer's height. A block level box on a line is laid out through the same layoutBlockChild, so the break is\ntaken, but what comes after the box is a line, and a line takes its position from the line before it in\nlogicalTopForNextLine. Nothing reads the height the break moved, and the content stays on the first page.\n\nThe distance the break moved the height is already at hand: layoutBlockChildFromInlineLayout returns it as\ncontainerLogicalBottom. Take it as the margin after the box, so the line after it starts at the top of the\nnext page.\n\nOnly a forced break may contribute here. The collapsed margin after the box is carried by the margin state a\nfew lines below, and counting it in both places grows the container by that margin.\n\n* LayoutTests/printing/page-break-after-block-level-box-on-a-line.html: Added.\n* LayoutTests/printing/page-break-after-block-level-box-on-a-line-expected.txt: Added.\n* Source/WebCore/layout/integration/LayoutIntegrationFormattingContextLayout.cpp:\n(WebCore::LayoutIntegration::layoutWithFormattingContextForBlockInInline):\n\nCanonical link: https://commits.webkit.org/319029@main", "email": "zalan@apple.com", "hash": "eb69db24a6c4089bee0fd3fa68e1b1ffef721740", "subject": "[block-in-inline] A forced page break after a block level box on a line does not move the following content to the next page" }, "319030@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "319030@main", "clUrl": "https://commits.webkit.org/319030@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321472\n\nReviewed by Antti Koivisto.\n\nRenderBlock::positionForPoint answers a point above its content with the first child the point is above,\nwalking the children in document order. isChildHitTestCandidate takes floats, so a float that leads the\ncontainer is what a point above it resolves to.\n\nA container whose children are a mix of inline and block level content takes positionForPointWithInlineChildren\ninstead. That walks line boxes, and while PlacedFloats does record the line that placed each float, a float\nnever gets a display box, so the line box iterators cannot reach one. The caret goes to the first line's\nleading box, which for such a container is the block level box on it.\n\nAnswer from the leading floats before taking the inline children walk, and only for a container that has a\nblock level box on a line, so that a container with inline content only keeps resolving the point with its\nlines. The float walk stops at the first child that is not floating, so it only speaks for floats that come\nbefore any other content.\n\n* LayoutTests/editing/selection/caret-from-point-above-leading-float.html: Added.\n* LayoutTests/editing/selection/caret-from-point-above-leading-float-expected.txt: Added.\n* Source/WebCore/rendering/RenderBlock.cpp:\n(WebCore::RenderBlock::positionForPoint):\n\nCanonical link: https://commits.webkit.org/319030@main", "email": "zalan@apple.com", "hash": "ebc6a3e50a6dbbc291c318aeacef55cf774452e8", "subject": "[block-in-inline] A float is not offered to the caret when its container has a block level box on a line" }, "319031@main": { "author": "Antti Koivisto", "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64", "cl": "319031@main", "clUrl": "https://commits.webkit.org/319031@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321585\nrdar://184701762\n\nReviewed by Alan Baradlay.\n\nBuilderState::registeredProperty returned only the function's own registrations, so a document\n@property registration was invisible inside a function body. A name the function does not\nintroduce arrives there by inheritance, carrying the calling element's computed value, so the\nvalue was typed while the registration view said unregistered. var() reads the equivalent\ntoken sequence either way and never noticed, but if(style()) compared a typed value against a\ntoken stream and never matched.\n\nMake the function's registrations shadow the document's rather than replace them, register the\nbody's local variables with the universal syntax so a local stays untyped, and resolve the\nstyle() feature value with the same registrations as the property it is compared against.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-parameter-types.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-parameter-types.tentative.html:\nTentative because the spec wording does not address an untyped local directly.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/local-if-substitution-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/local-if-substitution.html:\n* Source/WebCore/css/query/ContainerQueryFeatures.cpp:\n(WebCore::CQ::Features::StyleFeatureSchema::localPropertyRegistry):\n(WebCore::CQ::Features::StyleFeatureSchema::evaluateRange const):\n* Source/WebCore/style/StyleBuilder.cpp:\n(WebCore::Style::Builder::applyCustomPropertyFromCallingContext):\n* Source/WebCore/style/StyleBuilderState.cpp:\n(WebCore::Style::BuilderState::registeredProperty const):\n* Source/WebCore/style/StyleBuilderState.h:\n(WebCore::Style::BuilderState::localPropertyRegistry const):\n* Source/WebCore/style/StyleSubstitutionResolver.cpp:\n(WebCore::Style::SubstitutionResolver::substituteDashedFunction):\n\nCanonical link: https://commits.webkit.org/319031@main", "email": "antti@apple.com", "hash": "52251cec00d0e89ffaca38d21f7782c0da17b0b5", "subject": "[css-mixins-1] Function body should inherit computed custom property values from the calling context" }, "319032@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "319032@main", "clUrl": "https://commits.webkit.org/319032@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321487\n\nReviewed by Antti Koivisto.\n\nA ruby is a rebuild root, so appending a child to one destroys and recreates its renderer. Detaching it from a\ngrid merges the anonymous items on either side of it, and on re-attach the box it comes before is no longer the\nmerged item's first child, so findParentAndBeforeChildForNonSibling puts the block level ruby inside that item\ninstead of next to it. It stops being a grid item and never lays out.\n\nThat misplacement is not new, but the anonymous block path used to undo it: attach ends the inline parent with\nblock child case by calling removeLeftoverAnonymousBlock, which hoists everything back into the grid.\nshouldBuildAnonymousBlock is what leads there, and it asks the parent for its display value. The parent here is\nthe anonymous item, whose display comes from the content it wraps rather than from the grid, so the answer is no\nand the box stays where it was put.\n\nAsk what an anonymous item is an item of. Inline content and a block level box may not share one item, which is\nwhat the display values already listed there stand for.\n\n* LayoutTests/fast/ruby/append-rt-to-ruby-grid-item.html: Added.\n* LayoutTests/fast/ruby/append-rt-to-ruby-grid-item-expected.txt: Added.\n* Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp:\n(WebCore::RenderTreeBuilder::Block::attach):\n\nCanonical link: https://commits.webkit.org/319032@main", "email": "zalan@apple.com", "hash": "0d64e94f2964423be2ad575d4913a8df40a0a639", "subject": "[anon-block-removal] A block level box is left inside an anonymous flex or grid item" }, "319033@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "319033@main", "clUrl": "https://commits.webkit.org/319033@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321504\n\nReviewed by Antti Koivisto.\n\nA legend that reaches past its fieldset's border edge is carried as an intrinsic border, which\nRenderBlock::borderBefore adds to the fieldset's border. The border box height the fieldset ends up with is\nmeasured with that border in it, so RenderBox::contentBoxHeight has nothing left and clamps at zero.\n\nupdateLayoutBoxDimensions builds the geometry for a box on a line from both of those: the content box height from\nthe renderer, and the border from adjustBorderForTableAndFieldset, which adds the intrinsic border again. The\nmargin box the line gets is then max(0, H - BP) + BP, which is BP rather than H whenever the legend overhangs, so\nthe fieldset takes the overhang twice and its container grows by it.\n\nThe overhang belongs to the fieldset's own content: the lines inside it start below the legend. It says nothing\nabout the box a line holds, whose inner layout the render tree does. So take it where the fieldset is the\nformatting context root and nowhere else, which leaves logicalBorder about a table's collapsed borders. The\ncontent box size comes from what is left of the border box, since the renderer's own answer is measured against a\nborder that has the overhang in it. Only the fieldset's own block axis grew, which is the container's inline axis\nwhen the two writing modes differ in orientation.\n\n* LayoutTests/imported/w3c/web-platform-tests/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-with-overhanging-legend-on-a-line.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-with-overhanging-legend-on-a-line-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/rendering/non-replaced-elements/the-fieldset-and-legend-elements/fieldset-with-overhanging-legend-on-a-line-expected.html: Added.\n* Source/WebCore/layout/integration/LayoutIntegrationBoxGeometryUpdater.cpp:\n(WebCore::LayoutIntegration::adjustBorderForTable):\n(WebCore::LayoutIntegration::intrinsicBorder):\n(WebCore::LayoutIntegration::contentLogicalWidthForRenderer):\n(WebCore::LayoutIntegration::contentLogicalHeightForRenderer):\n(WebCore::LayoutIntegration::BoxGeometryUpdater::updateLayoutBoxDimensions):\n(WebCore::LayoutIntegration::BoxGeometryUpdater::setFormattingContextRootGeometry):\n(WebCore::LayoutIntegration::BoxGeometryUpdater::formattingContextConstraints):\n(WebCore::LayoutIntegration::adjustBorderForTableAndFieldset): Deleted.\n(WebCore::LayoutIntegration::BoxGeometryUpdater::logicalBorder):\n\nCanonical link: https://commits.webkit.org/319033@main", "email": "zalan@apple.com", "hash": "808795beeb2707eda80651a4770ee457729e316c", "subject": "[block-in-inline] A fieldset on a line takes its legend's overhang twice" }, "319034@main": { "author": "Antti Koivisto", "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64", "cl": "319034@main", "clUrl": "https://commits.webkit.org/319034@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321592\nrdar://184711017\n\nReviewed by Alan Baradlay.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/dashed-function-cycles-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/dashed-function-cycles.html:\n* Source/WebCore/style/StyleSubstitutionResolver.cpp:\n(WebCore::Style::SubstitutionResolver::substituteDashedFunction):\n\nMove cycle detection after argument substitution.\n\nCanonical link: https://commits.webkit.org/319034@main", "email": "antti@apple.com", "hash": "750cd66f31bc665a4cc3088d339a85e05bcb787e", "subject": "[css-mixins-1] Function arguments invoking the function should not create a cycle" }, "319035@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "319035@main", "clUrl": "https://commits.webkit.org/319035@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321576\nrdar://184684164\n\nReviewed by Chris Dumez.\n\nEnsure that data URL greater than 2MB do not cause the web content process to be killed.\n\n* LayoutTests/media/video-large-data-url-expected.txt: Added.\n* LayoutTests/media/video-large-data-url.html: Added.\n\nCanonical link: https://commits.webkit.org/319035@main", "email": "jya@apple.com", "hash": "f8c837214feb4a806add1b62761e9162dea995a1", "subject": "Test for 318045@main" }, "319036@main": { "author": "Sabith Saheb", "avatar": "https://www.gravatar.com/avatar/797f235ab64c002e72b2bb8012bec6c1?d=identicon\u0026s=64", "cl": "319036@main", "clUrl": "https://commits.webkit.org/319036@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=\n\nReviewed by Michael Catanzaro.\n\nOpenTypeVerticalData loads vertical glyph substitutions from a\ndownloaded font's GSUB table, which is attacker controlled.\nLookupTable::getSubstitutions() fills the substitution map one Coverage\nFormat 2 range at a time. from and fromEnd were uint16_t with fromEnd\nset to end + 1, so a range whose end is 0xffff wraps fromEnd to 0. The\nguard indexTo + (fromEnd - from) \u003e countTo then underflows on the\ntruncated value and passes, and the inner loop walks from start through\n0xffff before from wraps back to 0, reading\nsingleSubstitution2-\u003esubstitute[indexTo] far past its validated\nglyphCount entries. substitute is a raw pointer into the GSUB buffer, so\nthis is an unchecked heap read past the table. A reversed range with\nstart greater than end underflows the same guard.\n\nWiden from and fromEnd to unsigned so end + 1 stays exact, and reject\nfromEnd \u003c= from to drop reversed and empty ranges before the copy. Valid\nranges map the same glyphs as before.\n\n* Source/WebCore/platform/graphics/opentype/OpenTypeVerticalData.cpp:\n(WebCore::OpenType::LookupTable::getSubstitutions):\n\nCanonical link: https://commits.webkit.org/319036@main", "email": "shabi7204192361@gmail.com", "hash": "2196077a54c42c97792ab2e69a97e3661827acf6", "subject": "Out-of-bounds read in OpenType vertical GSUB coverage range fill" }, "319037@main": { "author": "Wenson Hsieh", "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64", "cl": "319037@main", "clUrl": "https://commits.webkit.org/319037@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321566\nrdar://184671350\n\nReviewed by Abrar Rahman Protyasha.\n\nMake several adjustments to further streamline resulting text extractions on zoom.us; see below for\nmore details.\n\nTest: fast/text-extraction/debug-text-extraction-bare-images.html\n\n* LayoutTests/fast/text-extraction/debug-text-extraction-bare-images-expected.txt: Added.\n* LayoutTests/fast/text-extraction/debug-text-extraction-bare-images.html: Added.\n* LayoutTests/fast/text-extraction/debug-text-extraction-basic-expected.txt:\n* LayoutTests/fast/text-extraction/debug-text-extraction-form-controls-expected.txt:\n* LayoutTests/fast/text-extraction/debug-text-extraction-lightweight-discretionary-expected.txt:\n* LayoutTests/fast/text-extraction/debug-text-extraction-lightweight-expected.txt:\n* LayoutTests/fast/text-extraction/debug-text-extraction-offscreen-password-fields-expected.txt:\n* LayoutTests/fast/text-extraction/debug-text-extraction-role-suppression-expected.txt:\n* LayoutTests/fast/text-extraction/debug-text-extraction-role-suppression.html:\n* Source/WebCore/page/text-extraction/TextExtraction.cpp:\n(WebCore::TextExtraction::extractRecursive):\n\nAvoid surfacing `tree` and `treeitem` as relevant accessibility roles.\n\n* Source/WebKit/Shared/TextExtractionToStringConversion.cpp:\n(WebKit::isUninformativeImage):\n\nExclude redundant image items with no semantically meaningful roles or attributes. For instance,\n\n```\nbutton uid=5234 label='Learn more'\n image uid=5235\n```\n\n...can simply become:\n\n```\nbutton uid=5234 label='Learn more'\n```\n\n(WebKit::isIdentityFreeContainer):\n\nEliminate interstitial container elements with no semantically meaningful roles or attributes.\n\n(WebKit::addTextRepresentationRecursive):\n\nCanonical link: https://commits.webkit.org/319037@main", "email": "wenson_hsieh@apple.com", "hash": "3e0eda365bed271d84448984bb5f392bed1e2258", "subject": "[Text Extraction] zoom.us: text extraction is unnecessarily verbose on account profile/settings pages" }, "319038@main": { "author": "Lauro Moura", "avatar": "https://www.gravatar.com/avatar/6157f52d61e04c2c63fe7ff668ba69b3?d=identicon\u0026s=64", "cl": "319038@main", "clUrl": "https://commits.webkit.org/319038@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321565\n\nUnreviewed test gardening.\n\n* Tools/TestWebKitAPI/glib/TestExpectations.json:\n\nCanonical link: https://commits.webkit.org/319038@main", "email": "lmoura@igalia.com", "hash": "79b9fc18e1e6b4348c55643c1d1281485053780b", "subject": "[WPE][ARM64] TestWebProcessExtensions:/webkit/WebKitWebProcessExtension/user-messages is timing out" }, "319039@main": { "author": "Antti Koivisto", "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64", "cl": "319039@main", "clUrl": "https://commits.webkit.org/319039@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321595\nrdar://184715508\n\nReviewed by Tim Nguyen.\n\nBut also disallow it when element context is not present.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-computed.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-in-animations.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-in-custom-function.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-in-if.tentative-expected.txt:\n* Source/WebCore/css/calc/CSSCalcTree+Parser.cpp:\n(WebCore::CSSCalc::consumeRandom):\n* Source/WebCore/css/parser/CSSPropertyParser.cpp:\n(WebCore::CSSPropertyParser::parseTypedCustomPropertyValue):\n(WebCore::CSSPropertyParser::parseTypedCustomPropertyInitialValue):\n* Source/WebCore/css/parser/CSSPropertyParserState.h:\n\nCanonical link: https://commits.webkit.org/319039@main", "email": "antti@apple.com", "hash": "a57d3936e9a5d33ed231a75a40adbcb41c51e852", "subject": "[css-values-5] Allow random() in custom properties" }, "319040@main": { "author": "Said Abou-Hallawa", "avatar": "https://www.gravatar.com/avatar/ae80a929a378a055822829ae63903296?d=identicon\u0026s=64", "cl": "319040@main", "clUrl": "https://commits.webkit.org/319040@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=315546\nrdar://177922841\n\nReviewed by Jean-Yves Avenard.\n\nWebCodecsImageDecoder[1] allows treating animated formats as temporal tracks. It\nenables seeking to and decoding individual frames directly into VideoFrame objects.\n\nDecoded image frames can be routed directly into WebGPU textures using the same\nhigh-efficiency path we provide for VideoDecoder, rather than relying on DOM-based\nfall-backs.\n\nWebCodecsImageTrackList[2] retrieves the tracks in the image. Currently the image\nAPIs do not have provide any track information. For now a single track is assumed\nper image.\n\nThis change implements the basics of this Web API. Following changes will fix the\nreset of the ImageDecoder WPT failures.\n\n[1] https://w3c.github.io/webcodecs/#imagedecoder-interface\n[2] https://w3c.github.io/webcodecs/#imagetracklist-interface\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/idlharness.https.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/idlharness.https.any.worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/image-decoder-image-orientation-none.https-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/image-decoder.crossOriginIsolated.https.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/image-decoder.crossOriginIsolated.https.any.worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/image-decoder.https.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/image-decoder.https.any.worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/transfering.https.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/transfering.https.any.worker-expected.txt:\n* Source/WebCore/Modules/webcodecs/WebCodecsImageDecoder.cpp:\n(WebCore::WebCodecsImageDecoder::WebCodecsImageDecoder):\n(WebCore::WebCodecsImageDecoder::setInternalDecoder):\n(WebCore::WebCodecsImageDecoder::buildTrackList):\n(WebCore::WebCodecsImageDecoder::queueSingleton):\n(WebCore::WebCodecsImageDecoder::createNativeImageAtIndex):\n(WebCore::WebCodecsImageDecoder::resolvePendingDecodePromises):\n(WebCore::WebCodecsImageDecoder::rejectPendingDecodePromises):\n(WebCore::WebCodecsImageDecoder::decode):\n(WebCore::WebCodecsImageDecoder::resetDecoder):\n(WebCore::WebCodecsImageDecoder::closeDecoder):\n(WebCore::WebCodecsImageDecoder::reset):\n(WebCore::WebCodecsImageDecoder::close):\n(WebCore::WebCodecsImageDecoder::isTypeSupported):\n(WebCore::WebCodecsImageDecoder::stop):\n(WebCore::WebCodecsImageDecoder::tracks const): Deleted.\n(WebCore::WebCodecsImageDecoder::createInternalDecoder):\n(WebCore::WebCodecsImageDecoder::setInternalDecoderData):\n(WebCore::WebCodecsImageDecoder::sinkStreamToInternalDecoder):\n(WebCore::WebCodecsImageDecoder::establishTrackList):\n(WebCore::WebCodecsImageDecoder::settlePendingDecodePromises):\n(WebCore::WebCodecsImageDecoder::queueDecodeRequest):\n(WebCore::WebCodecsImageDecoder::queuePendingDecodeRequests):\n(WebCore::WebCodecsImageDecoder::fulfillPendingDecodePromises):\n* Source/WebCore/Modules/webcodecs/WebCodecsImageDecoder.h:\n* Source/WebCore/Modules/webcodecs/WebCodecsImageTrackList.cpp:\n(WebCore::WebCodecsImageTrackList::create):\n(WebCore::WebCodecsImageTrackList::WebCodecsImageTrackList):\n(WebCore::WebCodecsImageTrackList::setTrackList):\n(WebCore::WebCodecsImageTrackList::closeTrackList):\n(WebCore::WebCodecsImageTrackList::clearTrackList):\n* Source/WebCore/Modules/webcodecs/WebCodecsImageTrackList.h:\n* Source/WebCore/Modules/webcodecs/WebCodecsVideoFrame.cpp:\n(WebCore::WebCodecsVideoFrame::create):\n* Source/WebCore/Modules/webcodecs/WebCodecsVideoFrame.h:\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::loadArtworkImage):\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/webcodecs/image-decoder-image-orientation-none.https-expected.txt: Added.\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/webcodecs/image-decoder.crossOriginIsolated.https.any-expected.txt: Added.\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/webcodecs/image-decoder.crossOriginIsolated.https.any.worker-expected.txt: Added.\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/webcodecs/image-decoder.https.any-expected.txt: Added.\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/webcodecs/image-decoder.https.any.worker-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/319040@main", "email": "said@apple.com", "hash": "7040d58fe3bd1070a1d68477d0fb3a397f2d2d05", "subject": "Implement WebCodecsImageDecoder" }, "319041@main": { "author": "Brady Eidson", "avatar": "https://www.gravatar.com/avatar/31bed81d6d8ef517f93b30add03f5651?d=identicon\u0026s=64", "cl": "319041@main", "clUrl": "https://commits.webkit.org/319041@main", "description": "rdar://184338230\nhttps://bugs.webkit.org/show_bug.cgi?id=321471\n\nReviewed by Chris Dumez.\n\nIf a SharedWorker's web content process dies while one of its clients is in the back/forward cache,\nit is relaunched for the sake of that client. Any message ports are then re-entangled.\n\nThe networking process only releases message port ownership in ~NetworkConnectionToWebProcess, which\ncan run long after ::didClose() starts the relaunch. This causes the re-entanglement for ports \"owned\"\nby the dead process to be message checked against the new process.\n\nWe can release port ownership in didClose() instead, and treat a port owned by a process with no live\nconnection as \"unreleased\" instead of a misbehaving sender.\n\nMessagePortChannel::closePort() also latched m_isClosed with nothing to clear it, so once the worker\nrelaunches every message the client sent it was silently dropped; entanglePortWithProcess() now clears it.\n\nNew test: MessagePortSecurity.SharedWorkerPortStillWorksAfterContextProcessDiesWithCachedClient\n\n* Source/WebCore/dom/messageports/MessagePortChannel.cpp:\n(WebCore::MessagePortChannel::entanglePortWithProcess):\n(WebCore::MessagePortChannel::disentanglePort):\n(WebCore::MessagePortChannel::closePort):\n(WebCore::MessagePortChannel::postMessageToRemote):\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:\n(WebKit::NetworkConnectionToWebProcess::~NetworkConnectionToWebProcess):\n(WebKit::NetworkConnectionToWebProcess::closeAllEntangledMessagePorts):\n(WebKit::NetworkConnectionToWebProcess::didClose):\n(WebKit::NetworkConnectionToWebProcess::entangleLocalPortInThisProcessToRemote):\n(WebKit::NetworkConnectionToWebProcess::takeAllMessagesForPort):\n(WebKit::NetworkConnectionToWebProcess::messagePortClosed):\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.h:\n* Tools/TestWebKitAPI/Resources/cocoa/MessagePortSecurity.mm:\n((MessagePortSecurity, SharedWorkerPortStillWorksAfterContextProcessDiesWithCachedClient)):\n* Source/WebCore/dom/messageports/MessagePortChannel.h:\n* Source/WebCore/dom/messageports/MessagePortChannelProviderImpl.cpp:\n(WebCore::MessagePortChannelProviderImpl::messagePortClosed):\n* Source/WebCore/dom/messageports/MessagePortChannelRegistry.cpp:\n(WebCore::MessagePortChannelRegistry::didCloseMessagePort):\n* Source/WebCore/dom/messageports/MessagePortChannelRegistry.h:\n\nCanonical link: https://commits.webkit.org/319041@main", "email": "beidson@apple.com", "hash": "900818e2cde3c693a0bfa07a2732cd6ccbd21647", "subject": "MessagePorts + SharedWorkers have a bad time with recently added message checks" }, "319042@main": { "author": "Cole Carley", "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64", "cl": "319042@main", "clUrl": "https://commits.webkit.org/319042@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321546\nrdar://184657114\n\nReviewed by Keith Miller.\n\nThere is a lot of duplicate code that checks for overflow after\nadding the offset and size of operation. This patch consolidates\nthese checks into a helper function.\n\n* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:\n(JSC::Wasm::BBQJITImpl::BBQJIT::atomicLoad):\n(JSC::Wasm::BBQJITImpl::BBQJIT::atomicStore):\n(JSC::Wasm::BBQJITImpl::BBQJIT::atomicBinaryRMW):\n(JSC::Wasm::BBQJITImpl::BBQJIT::atomicCompareExchange):\n* Source/JavaScriptCore/wasm/WasmBBQJIT.h:\n(JSC::Wasm::BBQJITImpl::BBQJIT::emitCheckAndPreparePointer):\n* Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp:\n(JSC::Wasm::BBQJITImpl::BBQJIT::load):\n(JSC::Wasm::BBQJITImpl::BBQJIT::store):\n* Source/JavaScriptCore/wasm/WasmBBQJIT64.h:\n(JSC::Wasm::BBQJITImpl::BBQJIT::emitCheckAndPrepareAndMaterializePointerApply):\n* Source/JavaScriptCore/wasm/WasmMemoryInformation.cpp:\n(JSC::Wasm::MemoryInformation::doesAccessOverflow const):\n* Source/JavaScriptCore/wasm/WasmMemoryInformation.h:\n* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:\n(JSC::Wasm::OMGIRGenerator::emitCheckAndPreparePointer):\n(JSC::Wasm::OMGIRGenerator::load):\n(JSC::Wasm::OMGIRGenerator::store):\n(JSC::Wasm::OMGIRGenerator::atomicLoad):\n(JSC::Wasm::OMGIRGenerator::atomicStore):\n(JSC::Wasm::OMGIRGenerator::atomicBinaryRMW):\n(JSC::Wasm::OMGIRGenerator::atomicCompareExchange):\n\nCanonical link: https://commits.webkit.org/319042@main", "email": "ccarley2@apple.com", "hash": "c7c0c2f7dfaebb618e33e9f8f6ebe5748d246c9e", "subject": "[Memory64] Hoist memory64 offset sum overflow checks into a helper" }, "319043@main": { "author": "Abrar Rahman Protyasha", "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64", "cl": "319043@main", "clUrl": "https://commits.webkit.org/319043@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320072\nrdar://182995822\n\nReviewed by Richard Robinson, Mike Wyrzykowski, Tim Horton, and Aditya Keerthi.\n\nThis is a second attempt at landing 318471@main, since the original\nattempt was reverted after it broke macOS 26.4 Performance/ASAN builds.\n\n`os_variant_is_basesystem(\"WebKit\")` is found 5 times in the codebase.\nEach caller needed to remember the `\"WebKit\"` magic string; the method\nname is not necessarily the most intuitive, either.\n\nThis patch introduces a WTF::isInBaseSystem() wrapper, that lives in\nwtf/cooca/RuntimeApplicationChecksCococa.h, providing callers an easy\nand intuitive way to query if the application is running in macOS\nBaseSystem.\n\n* Source/WTF/wtf/cocoa/RuntimeApplicationChecksCocoa.h:\n* Source/WTF/wtf/cocoa/RuntimeApplicationChecksCocoa.mm:\n(WTF::isInBaseSystem):\n* Source/WebKit/UIProcess/PDF/WKPDFHUDView.swift:\n(isInRecoveryOS): Deleted.\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::m_flagsChangedEventMonitorTrackingArea):\n* Source/WebKit/WebProcess/Model/WebModelPlayerProvider.cpp:\n(WebKit::WebModelPlayerProvider::isAvailable const):\n(WebKit::isRunningInRecoveryOS): Deleted.\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/UnifiedPDFPlugin.mm:\n(WebKit::UnifiedPDFPlugin::createContextMenu const):\n(WebKit::isInRecoveryOS): Deleted.\n\nCanonical link: https://commits.webkit.org/319043@main", "email": "a_protyasha@apple.com", "hash": "939a1d177ef963c4ac1f12fc19ae350b43cf9727", "subject": "Consolidate os_variant_is_basesystem() callers to a common WTF wrapper" }, "319044@main": { "author": "Cole Carley", "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64", "cl": "319044@main", "clUrl": "https://commits.webkit.org/319044@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321542\nrdar://184653931\n\nReviewed by Yusuke Suzuki.\n\nm_cachedIsMemory64 should be named m_cachedMemory0IsMemory64 to reflect that\nIPInt only checks the cached value for memory 0.\n\n* Source/JavaScriptCore/llint/InPlaceInterpreter64.asm:\n* Source/JavaScriptCore/wasm/WasmSectionParser.cpp:\n(JSC::Wasm::SectionParser::parseMemoryHelper):\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h:\n\nCanonical link: https://commits.webkit.org/319044@main", "email": "ccarley2@apple.com", "hash": "92bcef1cb48493eb468de6af4163c783b6594fb6", "subject": "[Memory64] rename m_cachedIsMemory64" }, "319045@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "319045@main", "clUrl": "https://commits.webkit.org/319045@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321575\nrdar://184683719\n\nReviewed by Keith Miller.\n\nmaterializePointer and emitCheckAndPrepareAndMaterializePointerApply is\nasking isValidAddrForm whether the offset can be valid with Width128,\nbut we should pass the actual width instead of Width128 as smaller width\ncan represent wider variety of offset.\n\n* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:\n(JSC::Wasm::BBQJITImpl::BBQJIT::materializePointer):\n* Source/JavaScriptCore/wasm/WasmBBQJIT.h:\n* Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp:\n(JSC::Wasm::BBQJITImpl::BBQJIT::addSIMDLoadSplat):\n(JSC::Wasm::BBQJITImpl::BBQJIT::addSIMDLoadLane):\n(JSC::Wasm::BBQJITImpl::BBQJIT::addSIMDStoreLane):\n* Source/JavaScriptCore/wasm/WasmBBQJIT64.h:\n(JSC::Wasm::BBQJITImpl::BBQJIT::emitCheckAndPrepareAndMaterializePointerApply):\n\nCanonical link: https://commits.webkit.org/319045@main", "email": "ysuzuki@apple.com", "hash": "57a1c44be6ebeed6a826bddc078d71f2707845d2", "subject": "[JSC] BBQ materializePointer should take actual access width" }, "319046@main": { "author": "Cole Carley", "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64", "cl": "319046@main", "clUrl": "https://commits.webkit.org/319046@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321235\nrdar://181159812\n\nReviewed by Ryosuke Niwa.\n\nWhen the CachedMatchFinder has a cache miss, it has to rebuild it's\nbuffer using the TextIterator. It creates a vector of text runs that\nis later used to to map the start and end in the buffer to a\nSimpleRange in the DOM.\n\nDuring buffer construction, the collected text runs store the\nSimpleRanges of the current text it's adding to the buffer. This requires\ncalling TextIterator::range().\n\nAfter taking some traces of find in page on very large pages, I found\nthat a majority of the time was spent in Node::computeNodeIndex(), which\nis called from TextIterator::range(). This never had to be called before\nthe introduction of the CachedMatchFinder because we did not cache a\nflattened buffer of the DOM text before.\n\nTo combat this problem, I instead store a new TextIteratorPosition, which\nallows us to lazily evaluate to a SimpleRange only when we need it.\nThis dramatically speeds up initial buffer construction as well as other\ncache misses on pages where misses are noticeable.\n\n* Source/WebCore/editing/CachedMatchFinder.cpp:\n(WebCore::CachedMatchFinder::TextRun::resolveOffsets const):\n(WebCore::CachedMatchFinder::TextRun::start const):\n(WebCore::CachedMatchFinder::TextRun::range const):\n(WebCore::CachedMatchFinder::bufferOffsetForBoundaryPoint):\n(WebCore::CachedMatchFinder::textForScope):\n(WebCore::CachedMatchFinder::boundaryForOffset):\n* Source/WebCore/editing/CachedMatchFinder.h:\n* Source/WebCore/editing/TextIterator.cpp:\n(WebCore::TextIterator::position const):\n* Source/WebCore/editing/TextIterator.h:\n\nCanonical link: https://commits.webkit.org/319046@main", "email": "ccarley2@apple.com", "hash": "c2f2ad1536f484aba4af75fe0a9a31a4dd08808f", "subject": "Improve Find in Page on very large pages" }, "319047@main": { "author": "Roberto Rodriguez", "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64", "cl": "319047@main", "clUrl": "https://commits.webkit.org/319047@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321417\nrdar://184485974\n\nReviewed by Dan Glastonbury.\n\nThe WebGL2 bufferData()/bufferSubData() sub-source overloads count srcOffset and\nlength in elements of the source view, not bytes. The test's byte arithmetic put\nall six calls out of bounds, so each raised INVALID_VALUE and left the buffer\nempty. Update the test.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/fast/canvas/webgl/bufferData-offset-length.html:\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319047@main", "email": "roberto_rodriguez2@apple.com", "hash": "080b3f4b8fa9836436c3b613e83ef7cf727ceb52", "subject": "Update fast/canvas/webgl/bufferData-offset-length.html" }, "319048@main": { "author": "Roberto Rodriguez", "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64", "cl": "319048@main", "clUrl": "https://commits.webkit.org/319048@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320230\nrdar://183164024\n\nReviewed by Kimmo Kinnunen\n\nContains upstream commits:\n1dec433b7f49 Remove NV suffix from some internal functions\nc013713375b2 Fix FramebufferTexture2DOES validation\n1bb9d6a05849 OpenCL: Add validation for CL_IMAGE_FORMAT_NOT_SUPPORTED\neb806a08c1d5 Test passing gl_FragData to function\n3edd2c297a3b OpenCL: Set max global variable size to 0\nc1f9769be2c2 DirectX9 Backend Removal: Remove non-shader backend files\n0cb8023c01f9 Clean up leaked EGL surface in InvalidWindowVisualID test\n66fb7b57686e Test EGL image framebuffer paths\ne2a96fd6a79e Vulkan: Refactor EGL image glTex*Image paths\na9caebb18d98 [sbom-quality] Fix license path in README.chromium\ncd6d0ed6e3a5 [Production] Add macros for -Wunsafe-buffer-usage in ANGLE\n250b2d709f46 Skip flaky on Linux NVIDIA Vulkan\n02bac666c44b Roll Chromium from 67949328e199 to 215b9995626a (1108 revisions)\nc14fb3a478f3 Roll vulkan-deps from be1dae5413d9 to 8e7420f63043 (36 revisions)\na496152f6dc1 Fix BlendEquationOES validation\n7cfef2484050 Merge identical extension validation functions\nc011b27c5826 Disable program caching on Mali GPUs in ANGLE\n25a783f4b5d2 Roll VK-GL-CTS from 720ad8c06472 to cd01da613a2e (8 revisions)\nc053bf85793b Metal: Allow prebuilding internal shaders for iOS\nea467c307853 Remove unused code from entry point codegen\n5330964f2ca6 Remove redundant BVBI command aliases\n600b59f1595f Enable tests on ANGLE M2 experimental bot\nf834e3937bad Roll vulkan-deps from 245a3bb1956d to be1dae5413d9 (9 revisions)\n3c957bf0f117 Roll SwiftShader from f3e464b1e567 to 7868bf37d5b2 (2 revisions)\n1612deb7d7a2 Roll Chromium from 2dee4b7c2c4c to 67949328e199 (321 revisions)\n42ed65aca2df GL: Optimize depth robust init using PBOs\nd9ada3fa8ecd Roll VK-GL-CTS from 06ae3bf12ae5 to 720ad8c06472 (5 revisions)\nd79ac55ca634 Adjust extension command availability checks\n8e69854ca685 Loosen maxTextureBytes to 1.25Gb\n63eef6fc737e Capture/Replay: Update upgrade steps\n5824ebc5c775 Fix retracing assert regarding interleaved attribs\nf790c72a1f48 Adjust shared exponent color buffers validation\nf8abe1d15e04 Manual roll Chromium from dbee1fed4ad0 to 2dee4b7c2c4c (313 revisions)\n8912cf8fe56d Set up ANGLE M2 experimental CI and Try bots\n2328f63206ab Tests: Fix flaky errors in CapturedTest.cpp\na1c0c7acbdd5 Fix external contexts being updated on same thread\n1a339c8eb73d Roll vulkan-deps from c60153d2ad91 to 245a3bb1956d (11 revisions)\neec0f265a09f Roll Chromium from 58f1d2d55c00 to dbee1fed4ad0 (704 revisions)\n6c4783073b2e Reland: GL: Fix uninitialized textures on invalidate.\naea502e52005 Add trace script to detect interleaved client attr\n0eb63532519d Trace/Replay: Track source of GL/EGL Sync objects\n1860fb2d925d DirectX9 Backend Removal: Remove tests\nb73a728c023e Use packed enums for TexStorageAttribs target\nbe8ece69a04b Skip FramebufferTest_ES3.RenderSharedExponentWithMask on S24\n7917ee5a2ff5 Re-land of crrev.com/c/7953343 (reverted by crrev.com/c/7962277).\n5a16b9fa0b8c Roll vulkan-deps from 0af4fee9206d to c60153d2ad91 (9 revisions)\n63cc28e6cb4e Roll Chromium from 9513633ed143 to 58f1d2d55c00 (716 revisions)\n\nCanonical link: https://commits.webkit.org/319048@main", "email": "roberto_rodriguez2@apple.com", "hash": "c1cc89887139ed4e99d55797349b9b1617271aca", "subject": "Update ANGLE to 2026-07-06 (1dec433b7f49fe232f1098c7e43fdaf17149bea7)" }, "319049@main": { "author": "Antti Koivisto", "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64", "cl": "319049@main", "clUrl": "https://commits.webkit.org/319049@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321606\nrdar://184732904\n\nReviewed by Tim Nguyen.\n\nhttps://drafts.csswg.org/css-values-5/#ident\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nFlip the switch.\n\nCanonical link: https://commits.webkit.org/319049@main", "email": "antti@apple.com", "hash": "b3d0c3ede37ae3a2cb6f8f5900bfa0e2dae86932", "subject": "[css-values-5] Enable ident() by default" }, "319050@main": { "author": "Elliott Williams", "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64", "cl": "319050@main", "clUrl": "https://commits.webkit.org/319050@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321605\nrdar://184732893\n\nReviewed by Mike Wyrzykowski.\n\nHaving an orphaned source file not in a group makes the project's PIF\nnon-deterministic and results in unnecessary work during incremental\nbuilds (cf. rdar://184259116).\n\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/319050@main", "email": "emw@apple.com", "hash": "950adada99dbf197440527ad28f41d1021b4feab", "subject": "[Xcode] Fix orphaned source file in TestWebKitAPI" }, "319051@main": { "author": "Brent Fulgham", "avatar": "https://www.gravatar.com/avatar/c6989a65afef0d015b55c65406e37ccc?d=identicon\u0026s=64", "cl": "319051@main", "clUrl": "https://commits.webkit.org/319051@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321554\nrdar://184663087\n\nUnreviewed re-sync with upstream WPT.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/0e64d6885439d5a2eff75351133a46c88c572e5c1\n\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/backdrop-in-flow.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-autofocus-multiple-times.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-autofocus.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-closedby-corner-cases-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-closedby-corner-cases.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-closedby-start-open.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-focus-previous-outside-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-focus-previous-outside.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-focusing-steps-disconnected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-focusing-steps-inert.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-light-dismiss-drag-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-light-dismiss-drag.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-light-dismiss-pointer-capture-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-light-dismiss-pointer-capture.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-light-dismiss-touch-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-light-dismiss-touch.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-requestclose-5-crash.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-requestclose-6-crash.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-requestclose-closedby.tentative-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-requestclose-closedby.tentative.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-setup-cleanup-crash.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/fixed-position-child-with-fo-ancestor.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inert-focus-in-frames.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inert-node-is-not-highlighted-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inert-node-is-unfocusable.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/remove-dialog-should-unblock-document.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/resources/common.js:\n(waitUntilLoadedAndAutofocused):\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/resources/showmodal-frame.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/resources/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/show-modal-focusing-steps.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/w3c-import.log:\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-closedby-corner-cases-expected.txt:\n* LayoutTests/platform/ios/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-light-dismiss-pointer-capture-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/319051@main", "email": "bfulgham@apple.com", "hash": "bd11dfe61f6e52206cef9b21dd234188645fd988", "subject": "[Interop] Re-sync WPT for html/semantics/interactive-elements/the-dialog-element" }, "319052@main": { "author": "Sam Weinig", "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64", "cl": "319052@main", "clUrl": "https://commits.webkit.org/319052@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320744\n\nReviewed by Antti Koivisto.\n\nUpdates length conversion to check for all `font-*` properties, not just `font-size`\nwhen deciding which font metrics to use for font-relative units.\n\nThe spec is a bit unclear on which properties this should really cover with discussion\nhappening in https://github.com/w3c/csswg-drafts/issues/14306.\n\nTo allow length conversion to check for all the `font-*` properties, we now always\nset the CSSPropertyID in CSSToLengthConversionData to the property that is currently\nbeing applied via a new BuilderStatePropertyScope class. Due to always setting the\nproperty, we can remove `copyForFontSize()` and `copyForLineHeight()`.\n\nTest: imported/w3c/web-platform-tests/css/css-values/using-font-relative-units-in-font-properties.html\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/using-font-relative-units-in-font-properties-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/using-font-relative-units-in-font-properties.html: Added.\n* Source/WebCore/css/CSSToLengthConversionData.h:\n* Source/WebCore/style/StyleBuilder.cpp:\n* Source/WebCore/style/StyleBuilderCustom.h:\n* Source/WebCore/style/StyleBuilderState.h:\n* Source/WebCore/style/values/inline/StyleLineHeight.cpp:\n* Source/WebCore/style/values/primitives/StyleLengthResolution.cpp:\n\nCanonical link: https://commits.webkit.org/319052@main", "email": "sam@webkit.org", "hash": "c64b47e336944e9e3b62964c2eb0ee90a74c23e4", "subject": "font-* properties should use the metrics of the parent element's font for font-relative unit resolution" }, "319053@main": { "author": "Marta Darbinyan", "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64", "cl": "319053@main", "clUrl": "https://commits.webkit.org/319053@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321524\nrdar://184633395\n\nUnreviewed test gardening\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319053@main", "email": "darbinyan@apple.com", "hash": "5dc7bc19680b41b02fd1865d48ae4d74871332ac", "subject": "[Gardening]: REGRESSION(318767@main): [macOS Debug] imported/w3c/web-platform-tests/payment-request/rejects_if_not_active.https.html is a flaky CRASH" }, "319054@main": { "author": "Roy Reapor", "avatar": "https://www.gravatar.com/avatar/bcb83d9f4fea3f6823d1b8f01e888053?d=identicon\u0026s=64", "cl": "319054@main", "clUrl": "https://commits.webkit.org/319054@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321550\nrdar://184658236\n\nReviewed by Stephanie Lewis.\n\n* Tools/Scripts/webkitpy/__init__.py:\n\nCanonical link: https://commits.webkit.org/319054@main", "email": "rreapor@apple.com", "hash": "7f2facdf4c15f703eeb17c41cd1478f436dd841c", "subject": "`webkitpy` should use `typing_extensions` 4.13.2" } }, "date": "2026-08-12", "days": 1, "generatedAt": "2026-08-12T22:05:54Z", "markdown": "## Highlights\n- **Media** WebCodecs gained an ImageDecoder implementation, a meaningful step toward broader in-browser media pipeline coverage. [commit 319040@main](https://commits.webkit.org/319040@main)\n- **Security** Fixed an out-of-bounds read in OpenType vertical GSUB coverage range fill, closing a real parser safety bug in font handling. [commit 319036@main](https://commits.webkit.org/319036@main)\n- **Web Platform** Added unprefixed `user-select` behind a feature flag, moving a long-used prefixed behavior closer to standards. [commit 319023@main](https://commits.webkit.org/319023@main)\n- **Web Platform** Enabled CSS `ident()` by default, expanding css-values-5 support in shipping builds. [commit 319049@main](https://commits.webkit.org/319049@main)\n- **Web Platform** Implemented CSS `inherit()` substitution, another visible chunk of css-values-5 landing for authors. [commit 318999@main](https://commits.webkit.org/318999@main)\n- **Perf** Find in Page was improved for very large pages, targeting a common pain point in document-scale browsing. [commit 319046@main](https://commits.webkit.org/319046@main)\n- **GPU** ANGLE rolled forward to the 2026-07-06 snapshot, bringing a sizable WebGL and graphics stack refresh. [commit 319048@main](https://commits.webkit.org/319048@main)\n- **A11y** Site Isolation text copy and extraction both improved, fixing skipped nested cross-origin content and reducing verbose extraction on Zoom settings pages. [commit 319010@main](https://commits.webkit.org/319010@main) [commit 319037@main](https://commits.webkit.org/319037@main)\n- **Mobile** Spatial and immersive work kept moving with spatial portal lifecycle support and a corrected experimental projection attribute name for spatial video rendering. [commit 319008@main](https://commits.webkit.org/319008@main) [commit 319019@main](https://commits.webkit.org/319019@main)\n\n## What landed by area\n\n### CSS and layout\n- **Web Platform** CSS `random()` is now allowed in custom properties, widening authoring patterns for generated values. [commit 319039@main](https://commits.webkit.org/319039@main)\n- **Web Platform** CSS mixin recursion handling was fixed so self-invoking function arguments do not spuriously create cycles. [commit 319034@main](https://commits.webkit.org/319034@main)\n- **Web Platform** CSS mixin function bodies now inherit computed custom property values from the calling context, matching expected author semantics. [commit 319031@main](https://commits.webkit.org/319031@main)\n- **Rendering** Font-relative unit resolution for `font-*` properties now uses the parent element's font metrics, fixing incorrect sizing behavior. [commit 319052@main](https://commits.webkit.org/319052@main) [bug 320744](https://bugs.webkit.org/show_bug.cgi?id=320744)\n- **Rendering** A fieldset on a line no longer applies its legend overhang twice in block-in-inline layout. [commit 319033@main](https://commits.webkit.org/319033@main)\n- **Rendering** Anonymous flex and grid items no longer retain stray block-level boxes after anonymous block removal. [commit 319032@main](https://commits.webkit.org/319032@main)\n- **Rendering** Caret placement now correctly considers floats when their container has a block-level box on a line. [commit 319030@main](https://commits.webkit.org/319030@main)\n- **Rendering** Forced page breaks after block-level boxes on a line now push following content to the next page correctly. [commit 319029@main](https://commits.webkit.org/319029@main)\n\n### JavaScriptCore and Wasm\n- **V8** JSC's BBQ `materializePointer` now takes the actual access width, tightening low-level codegen correctness. [commit 319045@main](https://commits.webkit.org/319045@main)\n- **V8** Memory64 offset sum overflow checks were hoisted into a helper, cleaning up Wasm bounds logic. [commit 319042@main](https://commits.webkit.org/319042@main)\n- **V8** Memory64 cached state naming was cleaned up, a small but useful readability pass in Wasm support. [commit 319044@main](https://commits.webkit.org/319044@main)\n- **Perf** `Array#join` on Int32 arrays now uses `JSOnlyStringsAndInt32sJoiner` for any separator, improving a hot-path builtin. [commit 319022@main](https://commits.webkit.org/319022@main)\n- **Refactor** `m_parentScopeTDZVariables` moved into `UnlinkedFunctionExecutable`, simplifying JSC executable state ownership. [commit 319021@main](https://commits.webkit.org/319021@main)\n- **Security** WasmGC allocation was tightened, reducing risk around object allocation behavior in emerging Wasm features. [commit 319020@main](https://commits.webkit.org/319020@main)\n- **V8** WasmGC struct layout now fills alignment gaps explicitly, making generated layouts tighter and more predictable. [commit 319015@main](https://commits.webkit.org/319015@main)\n- **Security** `SourceProviderCacheItem::create` no longer over-allocates its trailing `PackedPtr` array, fixing a concrete memory sizing bug. [commit 319014@main](https://commits.webkit.org/319014@main)\n- **V8** Varargs feedback collection now tracks `CallLinkInfo::m_maxArgumentCountIncludingThisForVarargs` correctly. [commit 319011@main](https://commits.webkit.org/319011@main)\n- **V8** Temporal's `CalendarDateUntil` and `NonISODateUntil` were separated cleanly, reducing overlap in date operation homes. [commit 319002@main](https://commits.webkit.org/319002@main)\n\n### Navigation, DOM, workers, and APIs\n- **Web Platform** MessagePorts and SharedWorkers were fixed up after stricter message checks caused bad interactions. [commit 319041@main](https://commits.webkit.org/319041@main)\n- **Web Platform** NavigationHistoryEntry `url`, `key`, and `id` now return empty strings instead of `null` when the document is not fully active. [commit 319007@main](https://commits.webkit.org/319007@main)\n- **Web Platform** Navigation API source element reporting now points at the element responsible for navigation instead of the deepest clicked descendant. [commit 319005@main](https://commits.webkit.org/319005@main)\n- **Refactor** Navigation API's `NavigationInterceptHandler` now uses `RefCounted` instead of `ThreadSafeRefCounted`, tightening ownership to actual threading needs. [commit 319004@main](https://commits.webkit.org/319004@main)\n- **Web Platform** Added support for `scripting.ExecutionWorld`, extending extension and script-injection surface area. [commit 319009@main](https://commits.webkit.org/319009@main)\n- **UI** Offscreen web view management landed for the `browser.offscreen` extension API implementation. [commit 318996@main](https://commits.webkit.org/318996@main)\n\n### Site Isolation, automation, and text handling\n- **DevTools** WebDriver commands no longer hang on elements inside cross-origin iframes when Site Isolation is enabled. [commit 319026@main](https://commits.webkit.org/319026@main)\n- **DevTools** Automation pages now inherit the session's Site Isolation preference, making test environments match session behavior. [commit 201369@main](https://commits.webkit.org/201369@main)\n- **A11y** Copying and pasting attributed text under Site Isolation now preserves content from nested cross-origin subframes. [commit 319010@main](https://commits.webkit.org/319010@main)\n- **Media** Audio session activation now happens per web process under Site Isolation, improving process-local media behavior. [commit 319006@main](https://commits.webkit.org/319006@main)\n\n### Graphics, SVG, and media\n- **Rendering** SVG documents embedded through `SVGImage` now apply the synthesized `viewBox` transform, fixing LBSE rendering behavior. [commit 319025@main](https://commits.webkit.org/319025@main)\n- **Mobile** Spatial video renderer projection metadata now uses `x-webkit-projection` instead of the incorrect `x-webkit-spatial` experimental attribute. [commit 319019@main](https://commits.webkit.org/319019@main)\n- **Mobile** Spatial portals gained child model lifecycle handling, another building block for immersive scene management. [commit 319008@main](https://commits.webkit.org/319008@main)\n- **Media** Added a regression test for [commit 318045@main](https://commits.webkit.org/318045@main), strengthening media coverage around a prior fix. [commit 319035@main](https://commits.webkit.org/319035@main)\n- **Media** `WebAVSampleBufferListener` now asserts main-thread access to `_client` inside `ensureOnMainThread` blocks, hardening thread assumptions. [commit 319012@main](https://commits.webkit.org/319012@main)\n- **GPU** WebGL test coverage was updated for `bufferData` offset and length handling. [commit 319047@main](https://commits.webkit.org/319047@main)\n\n### Interop and test syncing\n- **Web Platform** Dialog element WPTs were re-synced with upstream as part of ongoing Interop work. [commit 319051@main](https://commits.webkit.org/319051@main)\n- **Web Platform** Popover test cases were re-synced with upstream, keeping behavior aligned with current WPT expectations. [commit 318998@main](https://commits.webkit.org/318998@main)\n\n### Build, platform, and infrastructure\n- **Build** `webkitpy` now targets `typing_extensions` 4.13.2. [commit 319054@main](https://commits.webkit.org/319054@main)\n- **Build** An orphaned source file reference in TestWebKitAPI's Xcode project was fixed. [commit 319050@main](https://commits.webkit.org/319050@main)\n- **Build** `swiftc-wrapper` was converted to Python on Windows, reducing platform-specific wrapper friction. [commit 319028@main](https://commits.webkit.org/319028@main)\n- **Refactor** WebCore replaced `std::bind()` usage with C++14 lambdas, modernizing callback code. [commit 319027@main](https://commits.webkit.org/319027@main)\n- **Refactor** `os_variant_is_basesystem()` callers were consolidated behind a common WTF wrapper. [commit 319043@main](https://commits.webkit.org/319043@main)\n- **Perf** Unused AtomStrings were removed from the AtomString table, trimming a bit of string table waste. [commit 319016@main](https://commits.webkit.org/319016@main)\n- **Security** Fixed a WeakPtr thread assert regression in `MemoryPressureHandler`, addressing thread-safety fallout from an earlier change. [commit 319017@main](https://commits.webkit.org/319017@main)\n- **Build** Fixed `testapi` string formatting that threw `TypeError: not all arguments converted during string formatting`. [commit 319013@main](https://commits.webkit.org/319013@main)\n\n### Stability and gardening\n- **Build** Fixed a flaky crash in `payment-request/rejects_if_not_active.https.html` on macOS Debug. [commit 319053@main](https://commits.webkit.org/319053@main)\n- **Build** Fixed a WPE ARM64 timeout in `TestWebProcessExtensions` user-messages coverage. [commit 319038@main](https://commits.webkit.org/319038@main)\n- **A11y** Reduced overly verbose text extraction on Zoom account profile and settings pages. [commit 319037@main](https://commits.webkit.org/319037@main)\n- **Build** Fixed an intermittent Site Isolation failure in `audio-session-category-video-track-change.html`. [commit 319003@main](https://commits.webkit.org/319003@main)\n- **Build** Fixed an intermittent Site Isolation failure in `media/video-concurrent-playback.html`. [commit 319001@main](https://commits.webkit.org/319001@main)\n- **Build** Addressed a flaky iOS mouse support failure for fractional coordinates in rotated cross-origin iframes. [commit 319000@main](https://commits.webkit.org/319000@main)\n- **Build** Addressed the same flaky iOS mouse support failure in a follow-up landing. [commit 318997@main](https://commits.webkit.org/318997@main)\n- **Build** Fixed a flaky iOS Release failure in `background-fetch/match.https.window.html`. [commit 318995@main](https://commits.webkit.org/318995@main)", "repo": "webkit", "repoDisplay": "WebKit", "rollGroups": [ { "name": "Unreviewed", "count": 1 } ], "since": "2026-08-12", "totals": { "commits": 60, "features": 59, "rolls": 1 }, "until": "2026-08-12" }