{
  "commits": {
    "319055@main": {
      "author": "Pascoe",
      "avatar": "https://www.gravatar.com/avatar/7a6e50b09dba6a185f45250268683d71?d=identicon\u0026s=64",
      "cl": "319055@main",
      "clUrl": "https://commits.webkit.org/319055@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320919\nrdar://problem/183950595\n\nReviewed by Marcos Caceres and Abrar Rahman Protyasha.\n\nsetVirtualWalletBehaviorForTesting ignored the protocol parameter\n(hardcoded to org-iso-mdoc), making it impossible to test OpenID4VP\nthrough the virtual wallet. Parse the protocol string into the correct\nenum value, extend the BiDi schema with the three OpenID4VP identifiers,\nand fix the coordinator empty-check that rejected OpenID4VP-only request\nsets (the validator only handles mdoc, so the validated set was always\nempty for OpenID4VP).\n\nExtract digitalCredentialPresentationProtocolFromString() so the\nstring-to-enum mapping lives in one place. Refactor convertProtocolString\nto use it, with an explicit skip for openid4vp-v1-unsigned until DCQL\nparsing lands (webkit.org/b/320207).\n\n* Source/WebCore/Modules/identity/CredentialRequestCoordinator.cpp:\n(WebCore::CredentialRequestCoordinator::prepareCredentialRequests):\n* Source/WebCore/Modules/identity/DigitalCredential.cpp:\n(WebCore::convertProtocolString):\n* Source/WebCore/Modules/identity/DigitalCredentialPresentationProtocol.h:\n(WebCore::digitalCredentialPresentationProtocolFromString):\n* Source/WebKit/UIProcess/Automation/BidiDigitalCredentialsAgent.cpp:\n(WebKit::toPresentationProtocol):\n* Source/WebKit/UIProcess/Automation/protocol/BidiDigitalCredentials.json:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::setVirtualWalletBehaviorForTesting):\n* LayoutTests/http/wpt/identity/formats/openid4vp/openid4vp-roundtrip.https.html: Added.\n* LayoutTests/http/wpt/identity/formats/openid4vp/openid4vp-roundtrip.https-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/319055@main",
      "email": "pascoe@apple.com",
      "hash": "458076ee25d84e0dfac40742b70c9e32eebf0c5b",
      "subject": "Wire up the virtual wallet mock for OpenID4VP signed and multisigned protocols"
    },
    "319056@main": {
      "author": "Yulun Wu",
      "avatar": "https://www.gravatar.com/avatar/9e34d6632f4d926cdf6fe8dce07f9cb7?d=identicon\u0026s=64",
      "cl": "319056@main",
      "clUrl": "https://commits.webkit.org/319056@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321574\n\u003crdar://184683817\u003e\n\nReviewed by Sammy Gill.\n\naffectedTracksMatchingMinSizeFunction has been renamed to affectedTracks\nand updated to support space distributions across tracks' intrinsic\nmaximums and max-content maximums, steps 5 and 6 of:\n\nhttps://www.w3.org/TR/css-grid-1/#track-size-max-content-min\n\nThis refactor also updates:\n\nMinTrackSizingFunctionType -\u003e GridItemSizeContributionType\n\nand adds ForIntrinsicMaximums and ForMaxContentMaximums\nto the renamed enum class.\n\nWe have also renamed\n\nisMinTrackSizingFunctionValidForType -\u003e shouldTrackAccommodateContributionType\nisMaxTrackSizingFunctionValidForPhase -\u003e isTrackAffectedForSpaceDistributionInPhase\n\nTo better reflect the new track sizing steps we are supporting.\n\nThe affected track lists in steps 5 and 6 of:\n\nhttps://www.w3.org/TR/css-grid-1/#track-size-max-content-min\n\nAre created and temporarily marked as UNUSED_VARIABLE\n\n* Source/WebCore/layout/formattingContexts/grid/TrackSizingAlgorithm.cpp:\n(WebCore::Layout::isContributionAppliedToTrack):\n(WebCore::Layout::isTrackAffectedInPhase):\n(WebCore::Layout::affectedTracks):\n(WebCore::Layout::resolveIntrinsicTrackSizesWithSpanningItems):\n(WebCore::Layout::affectedTracksMatchingMinSizeFunction): Deleted.\n(WebCore::Layout::isTrackAffectedForSpaceDistributionInPhase):\n(WebCore::Layout::shouldTrackAccommodateContributionType):\n\nCanonical link: https://commits.webkit.org/319056@main",
      "email": "yulun_wu@apple.com",
      "hash": "a393d6c9433905905c7ccec8b904376283d4c5fd",
      "subject": "[GFC] Update affectedTracksMatchingMinSizeFunction to handle all phases"
    },
    "319057@main": {
      "author": "Karl Rackler",
      "avatar": "https://www.gravatar.com/avatar/809e306d02face15d5e29b561026f7c2?d=identicon\u0026s=64",
      "cl": "319057@main",
      "clUrl": "https://commits.webkit.org/319057@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321629\nrdar://184757188\n\nUnreviewed test gardening.\n\nAdd test expectation.\n\n* LayoutTests/platform/mac/TestExpectations:\n* LayoutTests/platform/ios/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319057@main",
      "email": "rackler@apple.com",
      "hash": "36a773d2ca4ffacddd7cfbaf69c05b78c2d9370b",
      "subject": "[Gardening]: REGRESSION(317976@main): [iOS macOS Debug] 4 imported/w3c/web-platform-tests/css/css-grid/grid-lanes/track-sizing/auto-repeat tests are constant CRASHs"
    },
    "319058@main": {
      "author": "Jean-Yves Avenard",
      "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64",
      "cl": "319058@main",
      "clUrl": "https://commits.webkit.org/319058@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=142152\nrdar://184667127\n\nReviewed by Eric Carlson.\n\nThe test plays a segment, collects the start times of the in-band cues delivered\nso far, seeks back to the beginning, plays the same segment again and compares\nthe two lists by index. It reported cue N's start time as cue N-1's, for every\ncue.\n\nWhich six cues the first pass collected depended on how far playback had got when\nits 100ms poll saw more than five of them. When the cue at 0.2002 had not been\ndelivered yet, the first pass collected 1.001 through 4.471133 instead, and the\nreplay delivered 0.2002 as the first cue, shifting every index by one. The cues\nthemselves were added once: the log shows the replay's cues being rejected by\naddGenericCue()'s duplicate check, which is what the test is named for.\n\nThe test now checks that each cue collected before the replay is present exactly\nonce afterwards, rather than at the same index, and waits for the replay to\ndeliver the last cue it collected before comparing, since that cue may not have\nbeen re-delivered when the list first reaches the collected length.\n\n* LayoutTests/media/track/track-in-band-cues-added-once.html:\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/mac/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319058@main",
      "email": "jya@apple.com",
      "hash": "faa6c20ea181f947985389d1fe82b1eabebab231",
      "subject": "media/track/track-in-band-cues-added-once.html is flaky."
    },
    "319059@main": {
      "author": "Devin Rousso",
      "avatar": "https://www.gravatar.com/avatar/c9e757d973342c773f107a94b70cb9cd?d=identicon\u0026s=64",
      "cl": "319059@main",
      "clUrl": "https://commits.webkit.org/319059@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321489\n\nReviewed by Mike Wyrzykowski.\n\n* Source/JavaScriptCore/inspector/protocol/Recording.json:\n* Source/WebCore/bindings/scripts/CodeGeneratorJS.pm:\n(GenerateImplementationFunctionCall):\n(GenerateCallTracer):\n* Source/WebCore/inspector/RecordingSwizzleType.h:\n* Source/WebCore/inspector/InspectorCanvasArguments.h:\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLType\u003e::toJSON): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLType\u003e::operator()): Added.\n(WebCore::InspectorCanvasNullableArgumentProcessor\u003cIDLType\u003e::extractValue): Added.\n(WebCore::InspectorCanvasNullableArgumentProcessor\u003cIDLType\u003e::toJSON): Added.\n(WebCore::InspectorCanvasNullableArgumentProcessor\u003cIDLType\u003e::operator()): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLNullable\u003cIDLType\u003e\u003e::operator()): Deleted.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLOptional\u003cIDLType\u003e\u003e::operator()): Deleted.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLLegacyNullToEmptyStringAdaptor\u003cIDLType\u003e\u003e::toJSON): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLEnforceRangeAdaptor\u003cIDLType\u003e\u003e::toJSON): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLAllowSharedAdaptor\u003cIDLType\u003e\u003e::toJSON): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLEnumeration\u003cIDLType\u003e\u003e::toJSON): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLDOMString\u003e::toJSON): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLBoolean\u003e::toJSON): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLType\u003e::toJSON): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLUnion\u003cIDLTypes...\u003e\u003e::toJSON): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLUnion\u003cIDLTypes...\u003e\u003e::operator()): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLSequence\u003cIDLType, inlineCapacity\u003e\u003e::toJSON): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLSequence\u003cIDLType, inlineCapacity\u003e\u003e::operator()): Added.\n* Source/WebCore/inspector/InspectorCanvasArguments.cpp:\n(WebCore::process): Added.\n(WebCore::processJSON): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLDictionary\u003cGPUComputePassDescriptor\u003e\u003e::operator()): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLDictionary\u003cGPUComputePipelineDescriptor\u003e\u003e::operator()): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLDictionary\u003cGPUCopyElementImageDestination\u003e\u003e::operator()): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLDictionary\u003cGPUCopyElementImageSource\u003e\u003e::operator()): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLDictionary\u003cGPUExternalTextureDescriptor\u003e\u003e::operator()): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLDictionary\u003cGPUImageCopyBuffer\u003e\u003e::operator()): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLDictionary\u003cGPUImageCopyExternalImage\u003e\u003e::operator()): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLDictionary\u003cGPUImageCopyTexture\u003e\u003e::operator()): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLDictionary\u003cGPUImageCopyTextureTagged\u003e\u003e::operator()): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLDictionary\u003cGPUPipelineLayoutDescriptor\u003e\u003e::operator()): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLDictionary\u003cGPURenderPassDescriptor\u003e\u003e::operator()): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLDictionary\u003cGPUBindGroupDescriptor\u003e\u003e::operator()): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLDictionary\u003cGPURenderPipelineDescriptor\u003e\u003e::operator()): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLDictionary\u003cGPUShaderModuleDescriptor\u003e\u003e::operator()): Added.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLDictionary\u003cImageDataSettings\u003e\u003e::operator()): Deleted.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLDictionary\u003cWebGLCopyElementImageConfig\u003e\u003e::operator()): Deleted.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLCanvasImageSourceUnion\u003e::operator()): Deleted.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLCanvasStyleVariantUnion\u003e::operator()): Deleted.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLCanvasPathRadiusUnion\u003e::operator()): Deleted.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLCanvasElementImageSourceUnion\u003e::operator()): Deleted.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLTexImageSourceUnion\u003e::operator()): Deleted.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLBufferDataSourceUnion\u003e::operator()): Deleted.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLFloat32ListUnion\u003e::operator()): Deleted.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLInt32ListUnion\u003e::operator()): Deleted.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLUint32ListUnion\u003e::operator()): Deleted.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLSequence\u003cIDLDOMString\u003e\u003e::operator()): Deleted.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLSequence\u003cIDLUnrestrictedDouble\u003e\u003e::operator()): Deleted.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLSequence\u003cIDLUnrestrictedFloat\u003e\u003e::operator()): Deleted.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLSequence\u003cIDLUnsignedLong\u003e\u003e::operator()): Deleted.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLSequence\u003cIDLLong\u003e\u003e::operator()): Deleted.\n(WebCore::InspectorCanvasArgumentProcessor\u003cIDLSequence\u003cIDLCanvasPathRadiusUnion\u003e\u003e::operator()): Deleted.\n* Source/WebCore/inspector/InspectorCanvasCallTracer.h:\n(WebCore::InspectorCanvasCallTracer::processArgument):\n(WebCore::InspectorCanvasCallTracer::recordActionResult): Added.\n* Source/WebCore/inspector/InspectorCanvasCallTracer.cpp:\n(WebCore::InspectorCanvasCallTracer::recordActionResult): Added.\n* Source/WebCore/inspector/agents/InspectorCanvasAgent.h:\n* Source/WebCore/inspector/agents/InspectorCanvasAgent.cpp:\n(WebCore::InspectorCanvasAgent::recordActionResult): Added.\n* Source/WebCore/inspector/InspectorCanvas.h:\n* Source/WebCore/inspector/InspectorCanvas.cpp:\n(WebCore::buildActionObject): Renamed from `buildActionReceiver`.\n(WebCore::InspectorCanvas::recordAction):\n(WebCore::InspectorCanvas::recordActionResult): Added.\n(WebCore::InspectorCanvas::appendActionSnapshotIfNeeded):\nRecord the result value of `CallTracer` calls via `CallTracer::recordActionResult` (but only if an interface).\nReplace the limited `Array` with a more generic `JSON` that can also handle objects (deduplicated by the stringified form).\nHandle non-serializable arrays via a new `ArrayOf` that contains `[index, swizzle]` pairs (vs `JSON` which is just raw values).\nHandle non-serializable objects via distinct swizzle types (e.g. `GPUBindGroupDescriptor`, `GPURenderPipelineDescriptor`, etc.).\nDrive-by: process `union` generically instead of needing an override for each `variant`.\nDrive-by: replace `DOMPointInit` with `ArrayOf` since it wasn't used correctly before anyways.\n\n* Source/WebCore/Modules/WebGPU/GPUObjectDescriptorBase.h:\n* Source/WebCore/Modules/WebGPU/GPUObjectDescriptorBase.cpp: Added.\n(WebCore::GPUObjectDescriptorBase::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUPipelineDescriptorBase.h:\n* Source/WebCore/Modules/WebGPU/GPUPipelineDescriptorBase.cpp: Added.\n(WebCore::GPUPipelineDescriptorBase::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUProgrammableStage.h:\n* Source/WebCore/Modules/WebGPU/GPUProgrammableStage.cpp: Added.\n(WebCore::GPUProgrammableStage::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUColorDict.h:\n* Source/WebCore/Modules/WebGPU/GPUColorDict.cpp: Added.\n(WebCore::GPUColorDict::toJSON const):\n(WebCore::toJSON):\n* Source/WebCore/Modules/WebGPU/GPUExtent3DDict.h:\n* Source/WebCore/Modules/WebGPU/GPUExtent3DDict.cpp: Added.\n(WebCore::GPUExtent3DDict::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUOrigin2DDict.h:\n* Source/WebCore/Modules/WebGPU/GPUOrigin2DDict.cpp: Added.\n(WebCore::GPUOrigin2DDict::toJSON const):\n(WebCore::toJSON):\n* Source/WebCore/Modules/WebGPU/GPUOrigin3DDict.h:\n* Source/WebCore/Modules/WebGPU/GPUOrigin3DDict.cpp: Added.\n(WebCore::GPUOrigin3DDict::toJSON const):\n(WebCore::toJSON):\n* Source/WebCore/Modules/WebGPU/GPUImageDataLayout.h:\n* Source/WebCore/Modules/WebGPU/GPUImageDataLayout.cpp: Added.\n(WebCore::GPUImageDataLayout::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUBufferDescriptor.h:\n* Source/WebCore/Modules/WebGPU/GPUBufferDescriptor.cpp: Added.\n(WebCore::GPUBufferDescriptor::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUQuerySetDescriptor.h:\n* Source/WebCore/Modules/WebGPU/GPUQuerySetDescriptor.cpp: Added.\n(WebCore::GPUQuerySetDescriptor::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUSamplerDescriptor.h:\n* Source/WebCore/Modules/WebGPU/GPUSamplerDescriptor.cpp: Added.\n(WebCore::GPUSamplerDescriptor::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUTextureDescriptor.h:\n* Source/WebCore/Modules/WebGPU/GPUTextureDescriptor.cpp: Added.\n(WebCore::GPUTextureDescriptor::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUTextureViewDescriptor.h:\n* Source/WebCore/Modules/WebGPU/GPUTextureViewDescriptor.cpp: Added.\n(WebCore::GPUTextureViewDescriptor::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUBufferBindingLayout.h:\n* Source/WebCore/Modules/WebGPU/GPUBufferBindingLayout.cpp: Added.\n(WebCore::GPUBufferBindingLayout::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUExternalTextureBindingLayout.h:\n* Source/WebCore/Modules/WebGPU/GPUExternalTextureBindingLayout.cpp: Added.\n(WebCore::GPUExternalTextureBindingLayout::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUSamplerBindingLayout.h:\n* Source/WebCore/Modules/WebGPU/GPUSamplerBindingLayout.cpp: Added.\n(WebCore::GPUSamplerBindingLayout::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUStorageTextureBindingLayout.h:\n* Source/WebCore/Modules/WebGPU/GPUStorageTextureBindingLayout.cpp: Added.\n(WebCore::GPUStorageTextureBindingLayout::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUTextureBindingLayout.h:\n* Source/WebCore/Modules/WebGPU/GPUTextureBindingLayout.cpp: Added.\n(WebCore::GPUTextureBindingLayout::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUBindGroupLayoutEntry.h:\n* Source/WebCore/Modules/WebGPU/GPUBindGroupLayoutEntry.cpp: Added.\n(WebCore::GPUBindGroupLayoutEntry::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUBindGroupLayoutDescriptor.h:\n* Source/WebCore/Modules/WebGPU/GPUBindGroupLayoutDescriptor.cpp: Added.\n(WebCore::GPUBindGroupLayoutDescriptor::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUBlendComponent.h:\n* Source/WebCore/Modules/WebGPU/GPUBlendComponent.cpp: Added.\n(WebCore::GPUBlendComponent::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUBlendState.h:\n* Source/WebCore/Modules/WebGPU/GPUBlendState.cpp: Added.\n(WebCore::GPUBlendState::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUColorTargetState.h:\n* Source/WebCore/Modules/WebGPU/GPUColorTargetState.cpp: Added.\n(WebCore::GPUColorTargetState::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUStencilFaceState.h:\n* Source/WebCore/Modules/WebGPU/GPUStencilFaceState.cpp: Added.\n(WebCore::GPUStencilFaceState::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUDepthStencilState.h:\n* Source/WebCore/Modules/WebGPU/GPUDepthStencilState.cpp: Added.\n(WebCore::GPUDepthStencilState::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUMultisampleState.h:\n* Source/WebCore/Modules/WebGPU/GPUMultisampleState.cpp: Added.\n(WebCore::GPUMultisampleState::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUPrimitiveState.h:\n* Source/WebCore/Modules/WebGPU/GPUPrimitiveState.cpp: Added.\n(WebCore::GPUPrimitiveState::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUVertexAttribute.h:\n* Source/WebCore/Modules/WebGPU/GPUVertexAttribute.cpp: Added.\n(WebCore::GPUVertexAttribute::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUVertexBufferLayout.h:\n* Source/WebCore/Modules/WebGPU/GPUVertexBufferLayout.cpp: Added.\n(WebCore::GPUVertexBufferLayout::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUVertexState.h:\n* Source/WebCore/Modules/WebGPU/GPUVertexState.cpp: Added.\n(WebCore::GPUVertexState::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUFragmentState.h:\n* Source/WebCore/Modules/WebGPU/GPUFragmentState.cpp: Added.\n(WebCore::GPUFragmentState::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPURenderPipelineDescriptor.h:\n* Source/WebCore/Modules/WebGPU/GPURenderPipelineDescriptor.cpp: Added.\n(WebCore::GPURenderPipelineDescriptor::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPURenderPassLayout.h:\n* Source/WebCore/Modules/WebGPU/GPURenderPassLayout.cpp: Added.\n(WebCore::GPURenderPassLayout::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPURenderBundleEncoderDescriptor.h:\n* Source/WebCore/Modules/WebGPU/GPURenderBundleEncoderDescriptor.cpp: Added.\n(WebCore::GPURenderBundleEncoderDescriptor::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUComputePassTimestampWrites.h:\n* Source/WebCore/Modules/WebGPU/GPUComputePassTimestampWrites.cpp: Added.\n(WebCore::GPUComputePassTimestampWrites::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUComputePassDescriptor.h:\n* Source/WebCore/Modules/WebGPU/GPUComputePassDescriptor.cpp: Added.\n(WebCore::GPUComputePassDescriptor::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUCopyElementImageDestination.h:\n* Source/WebCore/Modules/WebGPU/GPUCopyElementImageDestination.cpp: Added.\n(WebCore::GPUCopyElementImageDestination::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUCopyElementImageSource.h:\n* Source/WebCore/Modules/WebGPU/GPUCopyElementImageSource.cpp: Added.\n(WebCore::GPUCopyElementImageSource::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUExternalTextureDescriptor.h:\n* Source/WebCore/Modules/WebGPU/GPUExternalTextureDescriptor.cpp: Added.\n(WebCore::GPUExternalTextureDescriptor::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUImageCopyBuffer.h:\n* Source/WebCore/Modules/WebGPU/GPUImageCopyBuffer.cpp: Added.\n(WebCore::GPUImageCopyBuffer::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUImageCopyExternalImage.h:\n* Source/WebCore/Modules/WebGPU/GPUImageCopyExternalImage.cpp: Added.\n(WebCore::GPUImageCopyExternalImage::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUImageCopyTexture.h:\n* Source/WebCore/Modules/WebGPU/GPUImageCopyTexture.cpp: Added.\n(WebCore::GPUImageCopyTexture::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUImageCopyTextureTagged.h:\n* Source/WebCore/Modules/WebGPU/GPUImageCopyTextureTagged.cpp: Added.\n(WebCore::GPUImageCopyTextureTagged::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUPipelineLayoutDescriptor.h:\n* Source/WebCore/Modules/WebGPU/GPUPipelineLayoutDescriptor.cpp: Added.\n(WebCore::GPUPipelineLayoutDescriptor::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPURenderPassColorAttachment.h:\n* Source/WebCore/Modules/WebGPU/GPURenderPassColorAttachment.cpp: Added.\n(WebCore::GPURenderPassColorAttachment::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPURenderPassDepthStencilAttachment.h:\n* Source/WebCore/Modules/WebGPU/GPURenderPassDepthStencilAttachment.cpp: Added.\n(WebCore::GPURenderPassDepthStencilAttachment::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPURenderPassTimestampWrites.h:\n* Source/WebCore/Modules/WebGPU/GPURenderPassTimestampWrites.cpp: Added.\n(WebCore::GPURenderPassTimestampWrites::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPURenderPassDescriptor.h:\n* Source/WebCore/Modules/WebGPU/GPURenderPassDescriptor.cpp: Added.\n(WebCore::GPURenderPassDescriptor::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUShaderModuleCompilationHint.h:\n* Source/WebCore/Modules/WebGPU/GPUShaderModuleCompilationHint.cpp: Added.\n(WebCore::GPUShaderModuleCompilationHint::toJSON const):\n* Source/WebCore/Modules/WebGPU/GPUShaderModuleDescriptor.h:\n* Source/WebCore/Modules/WebGPU/GPUShaderModuleDescriptor.cpp: Added.\n(WebCore::GPUShaderModuleDescriptor::toJSON const):\n* Source/WebCore/dom/DOMPointInit.h:\n* Source/WebCore/dom/DOMPointInit.cpp: Added.\n(WebCore::DOMPointInit::toJSON const):\n* Source/WebCore/html/ImageDataSettings.h:\n* Source/WebCore/html/ImageDataSettings.cpp: Added.\n(WebCore::ImageDataSettings::toJSON const):\n* Source/WebCore/html/canvas/WebGLCopyElementImageConfig.h:\n* Source/WebCore/html/canvas/WebGLCopyElementImageConfig.cpp: Added.\n(WebCore::WebGLCopyElementImageConfig::toJSON const):\nAdd helpers to convert back into JSON, omitting members that are not serializable (which are handled by `InspectorCanvasArgumentProcessor`).\n\n* Source/WebInspectorUI/UserInterface/Models/Recording.js:\n(WI.Recording):\n(WI.Recording.isReferenceSwizzleType): Added.\n(WI.Recording.displayNameForSwizzleType):\n(WI.Recording.prototype.displayNameForReference): Renamed from `displayNameForReceiver`.\n(WI.Recording.prototype.swizzle):\n(WI.Recording.prototype._process):\n(WI.Recording.Swizzle):\n* Source/WebInspectorUI/UserInterface/Models/RecordingAction.js:\n(WI.RecordingAction):\n(WI.RecordingAction.fromPayload):\n(WI.RecordingAction.objectReferencesForParameter): Added.\n(WI.RecordingAction.prototype.recordingObjectIdentifiers): Renamed from `get recordingObjectIdentifiers`.\n(WI.RecordingAction.prototype.get result): Added.\n(WI.RecordingAction.prototype.swizzle):\n(WI.RecordingAction.prototype.toJSON):\n(WI.RecordingAction._objectReferenceCollectors): Added.\n* Source/WebInspectorUI/UserInterface/Models/ScriptSyntaxTree.js:\n(WI.ScriptSyntaxTree.isIdentifierName): Added.\nCollect referenced object identities incrementally during the processing pass and share stable names across arguments, receivers, and results.\n\n* Source/WebInspectorUI/UserInterface/Views/RecordingActionTreeElement.js:\n(WI.RecordingActionTreeElement._generateDOM):\n(WI.RecordingActionTreeElement._generateDOM.appendJSON): Added.\n(WI.RecordingActionTreeElement._generateDOM.createParameterElement):\n* Source/WebInspectorUI/UserInterface/Views/RecordingActionTreeElement.css:\n(.item.recording-action \u003e .titles :is(.object-handle, .receiver, .subtitle)): Renamed from `.item.recording-action \u003e .titles .parameter.object-handle`.\n(body:not(.window-inactive, .window-docked-inactive) .tree-outline:focus-within .item.recording-action.selected \u003e .titles :is(.object-handle, .parameter.swizzled, .receiver, .subtitle), body:not(.window-inactive, .window-docked-inactive) .tree-outline:focus-within .item.recording-action.selected::before): Renamed from `body:not(.window-inactive, .window-docked-inactive) .tree-outline:focus-within .item.recording-action.selected \u003e .titles .parameter.swizzled, body:not(.window-inactive, .window-docked-inactive) .tree-outline:focus-within .item.recording-action.selected::before`.\nRender `JSON` inline add special styling for referenced objects.\nDisplay the name of the returned object as the subtitle.\n\n* Source/WTF/wtf/JSONValues.h:\n(WTF::JSONImpl::ArrayOf\u003cT\u003e::setItem): Added.\n* Source/WTF/wtf/JSONValues.cpp:\n(WTF::JSONImpl::ArrayBase::setBoolean): Added.\n(WTF::JSONImpl::ArrayBase::setInteger): Added.\n(WTF::JSONImpl::ArrayBase::setDouble): Added.\n(WTF::JSONImpl::ArrayBase::setString): Added.\n(WTF::JSONImpl::ArrayBase::setValue): Added.\n(WTF::JSONImpl::ArrayBase::setObject): Added.\n(WTF::JSONImpl::ArrayBase::setArray): Added.\nAdd `JSON::ArrayOf::setItem` so a recorded action can replace a placeholder result.\n\n* Source/WebGPU/WebGPU/CommandEncoder.mm:\n(WebGPU::CommandEncoder::addOnCommitHandler):\nIgnore on-commit handlers when there is no `MTLCommandBuffer` to commit.\n\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n\n* Source/WebCore/bindings/scripts/test/TestCallTracer.idl:\n* Source/WebCore/bindings/scripts/test/JS/JSTestCallTracer.cpp:\n* Tools/TestWebKitAPI/Tests/WTF/JSONValue.cpp:\n* LayoutTests/fast/webgpu/invalid-command-encoder-clear-buffer.html: Added.\n* LayoutTests/fast/webgpu/invalid-command-encoder-clear-buffer-expected.txt: Added.\n* LayoutTests/inspector/canvas/resources/recording-2d.js:\n* LayoutTests/inspector/canvas/resources/recording-utilities.js:\n* LayoutTests/inspector/canvas/resources/recording-webgl.js:\n* LayoutTests/inspector/canvas/resources/recording-webgl2.js:\n* LayoutTests/inspector/canvas/resources/recording-webgpu.js: Added.\n* LayoutTests/inspector/canvas/recording-2d-full-expected.txt:\n* LayoutTests/inspector/canvas/recording-bitmaprenderer-full-expected.txt:\n* LayoutTests/inspector/canvas/recording-offscreen-bitmaprenderer-full-expected.txt:\n* LayoutTests/inspector/canvas/recording-offscreen-canvas-2d-full-expected.txt:\n* LayoutTests/inspector/canvas/recording-offscreen-webgl-full-expected.txt:\n* LayoutTests/inspector/canvas/recording-offscreen-webgl2-full-expected.txt:\n* LayoutTests/inspector/canvas/recording-webgl-full.html:\n* LayoutTests/inspector/canvas/recording-webgl-full-expected.txt:\n* LayoutTests/inspector/canvas/recording-webgl2-full-expected.txt:\n* LayoutTests/inspector/canvas/recording.html:\n* LayoutTests/inspector/canvas/recording-html-2d.html:\n* LayoutTests/inspector/canvas/recording-webgpu.html: Deleted.\n* LayoutTests/inspector/canvas/recording-webgpu-expected.txt: Deleted.\n* LayoutTests/inspector/canvas/console-record-webgpu.html: Added.\n* LayoutTests/inspector/canvas/console-record-webgpu-expected.txt: Added.\n* LayoutTests/inspector/canvas/recording-webgpu-frameCount.html: Added.\n* LayoutTests/inspector/canvas/recording-webgpu-frameCount-expected.txt: Added.\n* LayoutTests/inspector/canvas/recording-webgpu-full.html: Added.\n* LayoutTests/inspector/canvas/recording-webgpu-full-expected.txt: Added.\n* LayoutTests/inspector/canvas/recording-webgpu-memoryLimit.html: Added.\n* LayoutTests/inspector/canvas/recording-webgpu-memoryLimit-expected.txt: Added.\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/win/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319059@main",
      "email": "hi@devinrousso.com",
      "hash": "1240a421fe562bc191b7b82822b4cd32440bdd47",
      "subject": "Web Inspector: Canvas: record object arguments and result objects"
    },
    "319060@main": {
      "author": "Andrew Fryer",
      "avatar": "https://www.gravatar.com/avatar/693f8e74251268cad2daff9afdf907ca?d=identicon\u0026s=64",
      "cl": "319060@main",
      "clUrl": "https://commits.webkit.org/319060@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321627\nrdar://184755639\n\nReviewed by Stephanie Lewis.\n\nOur infra injects code into Speedometer that automatically starts\nrunning the benchmark (among other things). In the new Speedometer\nrunner for SP4, the start button isn't always loaded when our callback\nto click it runs. Instead of using `window.onload`, use\n`window.addEventListener(\"SpeedometerReady\"...` to be notified since\nthis always happens after the start button has loaded.\n\n* Tools/Scripts/webkitpy/benchmark_runner/data/patches/webserver/Speedometer4.patch:\n\nCanonical link: https://commits.webkit.org/319060@main",
      "email": "a_fryer@apple.com",
      "hash": "ecc0d845b198b1b21b8966c89ead308f70d83468",
      "subject": "Fix automatically starting experimental SP4 suites from run-benchmark"
    },
    "319061@main": {
      "author": "Devin Rousso",
      "avatar": "https://www.gravatar.com/avatar/c9e757d973342c773f107a94b70cb9cd?d=identicon\u0026s=64",
      "cl": "319061@main",
      "clUrl": "https://commits.webkit.org/319061@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=188287\n\u003crdar://problem/42879586\u003e\n\nReviewed by Qianlang Chen.\n\n`searchInResources` reports a result for every cached resource\n\nThen, `searchOtherRequests` reports one for every network tracked resource.\n\nAs a result, a resource present in both the memory cache and the network store is returned twice (once by URL and once with a request ID).\n\n* Source/WebCore/inspector/agents/InspectorNetworkAgent.h:\n* Source/WebCore/inspector/agents/InspectorNetworkAgent.cpp:\n(WebCore::InspectorNetworkAgent::searchOtherRequests):\n* Source/WebCore/inspector/agents/InspectorPageAgent.cpp:\n(WebCore::InspectorPageAgent::searchInResources):\nPass the set of URLs already reported by the cached resource search into `searchOtherRequests`.\n\nCanonical link: https://commits.webkit.org/319061@main",
      "email": "hi@devinrousso.com",
      "hash": "348fcf25c7cc23f440152169cbc4de865e9fb0f4",
      "subject": "Web Inspector: [Backend] Page.searchInResources sometimes returns duplicate results for a resource"
    },
    "319062@main": {
      "author": "Joanne Pan",
      "avatar": "https://www.gravatar.com/avatar/5cbbf578426a0c98cb5c977ca2dd88fc?d=identicon\u0026s=64",
      "cl": "319062@main",
      "clUrl": "https://commits.webkit.org/319062@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321613\nrdar://184738624\n\nReviewed by Tim Nguyen.\n\nTurn CSSInheritFunctionEnabled on by default and move it to stable, matching\nCSSIfFunctionEnabled. The implementation landed in bug 320984 and all of its\nimported WPT coverage passes: inherit-function-parsing.html,\ninherit-function-basic.html, inherit-function-invalidation.html, and\ncss-mixins/local-inherit-substitution.html.\n\nKnown limitation, tracked in bug 321094: a declaration that only reads a custom\nproperty whose value came from inherit(), as in `border-color: var(--y)`, is not\nre-applied when the parent changes. That is part of a wider pre-existing gap in\nhow the cascade tracks custom property dependencies.\n\nNo new tests, the existing imported WPT coverage now runs with the feature on by\ndefault.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/319062@main",
      "email": "jpan0917@gmail.com",
      "hash": "d26c3d114bddb139439495b1096eb20c4d700de3",
      "subject": "[css-values-5] Enable inherit() by default"
    },
    "319063@main": {
      "author": "Devin Rousso",
      "avatar": "https://www.gravatar.com/avatar/c9e757d973342c773f107a94b70cb9cd?d=identicon\u0026s=64",
      "cl": "319063@main",
      "clUrl": "https://commits.webkit.org/319063@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320248\n\nReviewed by Tim Nguyen.\n\nESLint 9 defaults to the flat config format and no longer automatically loads `.eslintrc`.\n\nKeep the config in `Source/WebInspectorUI` so it does not become the configuration for unrelated JavaScript elsewhere in `Source`.\nEngineers who already have ESLint installed can opt in by running `eslint` from that directory without adding ESLint to the Web Inspector build.\nEditor integrations that resolve configs from each linted file can also discover it from broader workspace roots.\n\nKeep the config self-contained so using it only requires ESLint itself.\nInline the `eslint:recommended` rules instead of depending on `@eslint/js`.\nDeclare only the browser and worker globals that WebInspectorUI actually references instead of depending on `globals`.\n\nUse `ecmaVersion: \"latest\"` because WebInspectorUI already uses newer syntax such as private class fields.\n\nDo not carry deprecated formatting rules into the flat config.\nFocus the opt-in diagnostics on possible correctness issues and exclude external, legacy protocol, and minified sources that are not maintained as part of the Web Inspector frontend.\n\n* Source/WebInspectorUI/.eslintignore: Removed.\n* Source/WebInspectorUI/.eslintrc: Removed.\n* Source/WebInspectorUI/eslint.config.mjs: Added.\nScope the new config to maintained WebInspectorUI JavaScript.\n\nCanonical link: https://commits.webkit.org/319063@main",
      "email": "hi@devinrousso.com",
      "hash": "67e9c27f2d063965585b353972bac7ed7b89cf23",
      "subject": "Web Inspector: migrate the ESLint legacy .eslintrc to the modern eslint.config.mjs"
    },
    "319064@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "319064@main",
      "clUrl": "https://commits.webkit.org/319064@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321422\n\nReviewed by Yusuke Suzuki.\n\nCharacter classes are matched without canonicalizing the input, so a class has to\ncarry the case-folding closure of its members when ignoreCase is set. \\p{...} and\n\\P{...} handed the generated property table to PatternTerm / append() /\nappendInverted() as is, so under /iu and /iv they only matched the exact code\npoints of the property, and \\P{...} complemented before folding even in v mode,\nwhere CharacterComplement applies to the folded set [1][2]:\n\n    /\\p{Lu}/iu.test(\"a\")              // false, should be true\n    /\\P{Ll}/iv.test(\"A\")              // true, should be false\n    /[\\p{Any}\u0026\u0026\\P{Lu}]/iv.test(\"a\")   // true, should be false\n\nYarrPattern::unicodeIgnoreCaseCharacterClassFor() builds and caches the folded\nclass by feeding the table through CharacterClassConstructor::putChar()/putRange().\nFor \\P{...} in u mode, where the complement is taken before folding [3], the table\nis complemented before and after folding so that the term's invert flag and\nappendInverted() keep applying unchanged. coalesceTables() now drops matches that\nfall inside a range, since putRange() adds case variants without consulting the\nranges and appendInverted() relies on matches and ranges being disjoint.\n\nThis also unskips the two test262 regexp-modifiers tests that were disabled for\nthis bug.\n\n[1]: https://tc39.es/ecma262/#sec-maybesimplecasefolding\n[2]: https://tc39.es/ecma262/#sec-charactercomplement\n[3]: https://tc39.es/ecma262/#sec-compiletocharset\n\nTest: JSTests/stress/regexp-unicode-property-escape-ignore-case.js\n\n* JSTests/stress/regexp-unicode-property-escape-ignore-case.js: Added.\n(shouldBe):\n* JSTests/test262/config.yaml:\n* Source/JavaScriptCore/yarr/YarrPattern.cpp:\n(JSC::Yarr::CharacterClassConstructor::putUnicodeIgnoreCase):\n(JSC::Yarr::CharacterClassConstructor::coalesceTables):\n(JSC::Yarr::invertedCharacterClass):\n(JSC::Yarr::YarrPattern::unicodeIgnoreCaseCharacterClassFor):\n(JSC::Yarr::YarrPatternConstructor::atomBuiltInCharacterClass):\n(JSC::Yarr::YarrPatternConstructor::unicodePropertyCharacterClass):\n(JSC::Yarr::YarrPatternConstructor::atomCharacterClassBuiltIn):\n* Source/JavaScriptCore/yarr/YarrPattern.h:\n(JSC::Yarr::YarrPattern::resetForReparsing):\n\nCanonical link: https://commits.webkit.org/319064@main",
      "email": "sosuke@bun.sh",
      "hash": "b7fac902847a0415841fc9965941403d2a6401a5",
      "subject": "[YARR] Unicode property escapes ignore case-insensitivity in u and v modes"
    },
    "319065@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "319065@main",
      "clUrl": "https://commits.webkit.org/319065@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321468\nrdar://184557364\n\nReviewed by Keith Miller.\n\nDepending on toolchain, options etc., very naive byte-copy loop is\ngenerated instead of wasm bulk-memory operations like memory.copy /\nmemory.fill. This patch does quick pattern matching, detecting it and\nspreading MemoryCopy / MemoryFill operation with guards before the\nactual naive loop. We just prepend the fast path with MemoryCopy\nand MemoryFill since we do not know whether src and destination are\noverlapping or not at runtime easily. So we need to check them, and we\nneed to fall back to the normal loop when it is overlapping badly.\n\nThe replacement can be turned off with the useWasmByteLoopReplacement\noption.\n\nTests: JSTests/wasm/stress/byte-loop-idiom-recognition.js\n       JSTests/wasm/stress/byte-loop-idiom-loop-osr.js\n\n* JSTests/wasm/stress/byte-loop-idiom-loop-osr.js: Added.\n(async test.seed):\n(async test.assertMemoryMatches):\n(async test.copyMemmoveLike):\n(async test.copyReplicating):\n(async test.copyDownwards):\n(async test.fillRegion):\n(async test):\n* JSTests/wasm/stress/byte-loop-idiom-recognition.js: Added.\n(access):\n(modelCopyForward):\n(modelCopyBackward):\n(modelFill):\n(async test.seedWindow):\n(async test.seedEverything):\n(async test.assertMemoryMatches):\n(async test.checkEveryCase):\n(async test.assertTraps):\n(async test):\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/runtime/OptionsList.h:\n* Source/JavaScriptCore/wasm/WasmByteLoopIdiom.h: Added.\n(JSC::Wasm::ByteLoopIdiom::isFill const):\n(JSC::Wasm::ByteLoopIdiom::isBackward const):\n(JSC::Wasm::ByteLoopIdiom::match):\n(JSC::Wasm::ByteLoopIdiom::localsAreDistinct const):\n(JSC::Wasm::ByteLoopIdiom::matchCopyForward):\n(JSC::Wasm::ByteLoopIdiom::matchCopyBackward):\n(JSC::Wasm::ByteLoopIdiom::matchFill):\n* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:\n(JSC::Wasm::OMGIRGenerator::addMemoryFill):\n(JSC::Wasm::OMGIRGenerator::emitMemoryFill):\n(JSC::Wasm::OMGIRGenerator::addMemoryCopy):\n(JSC::Wasm::OMGIRGenerator::emitMemoryCopy):\n(JSC::Wasm::OMGIRGenerator::matchByteLoopIdiom):\n(JSC::Wasm::OMGIRGenerator::emitByteLoopIdiom):\n(JSC::Wasm::OMGIRGenerator::addLoop):\n\nCanonical link: https://commits.webkit.org/319065@main",
      "email": "ysuzuki@apple.com",
      "hash": "0c51f43daa3b812261b117b60bdfeeeb8aee1b7d",
      "subject": "[JSC] Quick pattern matching for byte-copy loop in OMG"
    },
    "319066@main": {
      "author": "Aditya Keerthi",
      "avatar": "https://www.gravatar.com/avatar/208766e9de08fdbc9f580c304a640e24?d=identicon\u0026s=64",
      "cl": "319066@main",
      "clUrl": "https://commits.webkit.org/319066@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313521\nrdar://175672489\n\nReviewed by Ryosuke Niwa.\n\n`DataListButtonElement` stores its owner as a raw `DataListButtonOwner\u0026 m_owner`.\nThe only `DataListButtonOwner` is `TextFieldInputType`. When the type of the\nowning input element is changed, `HTMLInputElement::updateType()` calls\n`removeShadowSubtree()`. This will null out `m_dataListDropdownIndicator` but\ndoes not clear the owner member in `DataListButtonElement`. Changing the type\ninside a `click` listener results in the `TextFieldInputType` being freed while\nevent dispatch is in progress. Eventually, `DataListButtonElement::defaultEventHandler()`\nis called, calling `m_owner.dataListButtonElementWasClicked()` after `m_owner`\nwas already freed.\n\nFix storing the owner as a `WeakPtr` and by clearing it out in\n`removeShadowSubtree()`. This matches the implementation of `SpinButtonElement`.\n\n* LayoutTests/fast/forms/datalist/datalist-button-change-input-type-on-click-crash-expected.txt: Added.\n* LayoutTests/fast/forms/datalist/datalist-button-change-input-type-on-click-crash.html: Added.\n* Source/WebCore/html/TextFieldInputType.cpp:\n(WebCore::TextFieldInputType::removeShadowSubtree):\n* Source/WebCore/html/shadow/DataListButtonElement.cpp:\n(WebCore::DataListButtonElement::defaultEventHandler):\n* Source/WebCore/html/shadow/DataListButtonElement.h:\n\nOriginally-landed-as: 305413.1011@safari-7624.5-branch (1207b71f0518). rdar://184744860\nCanonical link: https://commits.webkit.org/319066@main",
      "email": "akeerthi@apple.com",
      "hash": "be08720593705c04826f1e0804581ea8aafb2748",
      "subject": "[WebCore] Use-after-free in `DataListButtonElement::defaultEventHandler`"
    },
    "319067@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "319067@main",
      "clUrl": "https://commits.webkit.org/319067@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321496\n\nReviewed by Daniel Liu.\n\nA pattern containing a lookbehind never reached YarrJIT: RegExp::compile did not call\njitCompile for it and YarrGenerator::compile bailed out on m_containsLookbehinds, so a single\nlookbehind sent the whole pattern, including everything around it, to the interpreter.\n\nA lookbehind matches its disjunction backward, ending at the current position, which is the\nsame as matching the reversed sequence of its terms while consuming input downward. This patch\nmakes opCompileParentheticalAssertion compile a Backward assertion from a copy of its\ndisjunction in which each alternative has its terms reversed and its input positions reassigned\nthe way setupAlternativeOffsets() does (reverseDisjunctionForBackward), so the existing op\ncompilation, code generation and backtracking are reused as they are. The YarrPattern is left\nuntouched for the interpreter fallback.\n\nThe ops compiled from it are marked Backward, and only the primitives that touch the index\nregister look at the direction: index is the start of the input consumed so far, so claiming\ninput subtracts and checks index \u003e= 0, the character `offset` before index is read from\ninput[index + offset - 1], the end of input is index == 0, greedy terms consume with index -= 1\nand give back with index += 1, a capture stores its end when the parenthesis begins and its\nstart when it ends, and ^ $ \\b test the start / end of input and read the surrounding\ncharacters through canBeAtStartOfInput() and friends. The machine code generated for Forward\nops is unchanged.\n\nUnicode patterns with a lookbehind, and lookbehinds containing a backreference, a lookahead,\nor a quantified parenthesis still fall back to the interpreter, and Backward ops do not combine\nadjacent characters into a wider load yet.\n\nFollow-up patches are planned to (1) JIT the remaining lookbehind shapes above and optimize\nBackward ops further, (2) make the interpreter match lookbehinds from a reversed disjunction\nin the same way instead of its own backward bookkeeping, and then (3) have YarrPatternConstructor\nbuild the disjunction of a lookbehind in reversed form from the start, so that both tiers share\none representation and this copy goes away.\n\n                                                Baseline                  Patched\n\nregexp-lookbehind-variable                  167.9369+-2.1830     ^     34.5673+-0.2600        ^ definitely 4.8583x faster\nregexp-lookbehind-negative-alternation      470.5741+-1.4593     ^     48.5470+-0.2605        ^ definitely 9.6932x faster\nregexp-lookbehind-fixed                     233.4527+-4.8987     ^     44.8282+-0.4900        ^ definitely 5.2077x faster\nregexp-lookbehind-replace                   651.3264+-5.8342     ^     61.1449+-1.7254        ^ definitely 10.6522x faster\nregexp-exec                                  14.5383+-0.1674     ?     14.6957+-0.2200        ? might be 1.0108x slower\n\nTests: JSTests/microbenchmarks/regexp-lookbehind-fixed.js\n       JSTests/microbenchmarks/regexp-lookbehind-negative-alternation.js\n       JSTests/microbenchmarks/regexp-lookbehind-replace.js\n       JSTests/microbenchmarks/regexp-lookbehind-variable.js\n       JSTests/stress/regexp-lookbehind-jit-alternatives.js\n       JSTests/stress/regexp-lookbehind-jit-captures.js\n       JSTests/stress/regexp-lookbehind-jit-hot-loop.js\n       JSTests/stress/regexp-lookbehind-jit-large-offset.js\n       JSTests/stress/regexp-lookbehind-jit.js\n\n* JSTests/microbenchmarks/regexp-lookbehind-fixed.js: Added.\n* JSTests/microbenchmarks/regexp-lookbehind-negative-alternation.js: Added.\n* JSTests/microbenchmarks/regexp-lookbehind-replace.js: Added.\n* JSTests/microbenchmarks/regexp-lookbehind-variable.js: Added.\n* JSTests/stress/regexp-lookbehind-jit-alternatives.js: Added.\n(shouldBe):\n(matchOf):\n(shouldBe.matchOf):\n(shouldBe.matchOf.b):\n* JSTests/stress/regexp-lookbehind-jit-captures.js: Added.\n(shouldBe):\n(matchOf):\n(shouldBe.matchOf.a):\n* JSTests/stress/regexp-lookbehind-jit-hot-loop.js: Added.\n(shouldBe):\n(execConstant):\n(testVarying):\n(replaceAll):\n(searchSticky):\n* JSTests/stress/regexp-lookbehind-jit-large-offset.js: Added.\n(shouldBe):\n(matchOf):\n* JSTests/stress/regexp-lookbehind-jit.js: Added.\n(shouldBe):\n(matchOf):\n(shouldBe.matchOf):\n(string_appeared_here.string_appeared_here.repeat):\n* Source/JavaScriptCore/runtime/RegExp.cpp:\n(JSC::RegExp::compile):\n(JSC::RegExp::compileMatchOnly):\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n(JSC::Yarr::dumpCompileFailure):\n\nCanonical link: https://commits.webkit.org/319067@main",
      "email": "sosuke@bun.sh",
      "hash": "f4f06bc1151fe9f14da9f05774162f39351ed537",
      "subject": "[YARR] Compile lookbehinds in the JIT"
    },
    "319068@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319068@main",
      "clUrl": "https://commits.webkit.org/319068@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321498\nrdar://184595100\n\nReviewed by Basuke Suzuki.\n\nStep 4.2 of \"process scroll behavior\" says that if the document's indicated part\nis null, we must scroll to the beginning of the document:\nhttps://html.spec.whatwg.org/multipage/nav-history-apis.html#process-scroll-behavior\n\nWe already handled the case where the destination URL has no fragment identifier\nat all, but when the URL had a fragment that matched no anchor we returned\nwithout scrolling, leaving the scroll position untouched.\n\nInstead of duplicating the \"is there an anchor?\" check, rely on\nLocalFrameView::scrollToFragment(), which fails exactly when the document's\nindicated part is null, and scroll to the beginning of the document in that case,\nkeeping the existing behavior of restoring the saved scroll position for a\nreload. Deferring to scrollToFragment() also stops us from missing an anchor\nwhose id matches only the percent-decoded fragment, since it tries both forms,\nand a fragment holding just a text directive that matched nothing now scrolls to\nthe beginning of the document as well, matching the spec's behavior of stripping\nthe directive from the fragment.\n\nStep 1 of \"scroll to the fragment\" also requires the document's target element to\nbe null when the indicated part is null, otherwise the :target pseudo class stays\non the element matched by an earlier fragment. scrollToFragment() takes care of\nthat via resetScrollAnchor(), so only a destination URL without a fragment\nidentifier needs to clear it explicitly. This matches Chrome.\n\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/scroll-behavior/manual-scroll-clears-target-when-fragment-does-not-exist-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/scroll-behavior/manual-scroll-clears-target-when-fragment-does-not-exist.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/scroll-behavior/manual-scroll-clears-target-when-no-fragment-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/scroll-behavior/manual-scroll-clears-target-when-no-fragment.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/scroll-behavior/manual-scroll-fragment-does-not-exist-expected.txt: Progression\n* Source/WebCore/page/NavigateEvent.cpp:\n(WebCore::NavigateEvent::processScrollBehavior):\n\nCanonical link: https://commits.webkit.org/319068@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "4cb75e05600d142f19d71730baafbe0b7455d8f3",
      "subject": "[Navigation API] navigateEvent.scroll() does not scroll to the beginning of the document when the fragment does not exist"
    },
    "319069@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "319069@main",
      "clUrl": "https://commits.webkit.org/319069@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=317163\u003e\n\u003crdar://164366001\u003e\n\nReviewed by Charlie Wolfe.\n\nThe tracker-lookup callback installed by\n`configureForAdvancedPrivacyProtections()` reads the process-global\n`MemoryCompactRobinHoodHashMap` returned by `list()` on a network\nresolver dispatch thread, but the `requestTrackerDomainNamesData`\ncompletion handler inserts into that same map on every WebPrivacy\nupdate from a different thread.  Nothing serializes the two, so an\nupdate can rehash and free the map's backing store while the resolver\nthread is reading it, leaving the resolver thread reading freed memory.\n\nThe `find()` method already returns the matched entry by value, so no\nsignature change is needed.  The lock must still cover the `list().get()`\nread because the read itself races the writer's rehash.\n\nNo new tests since this is a data race with no deterministic\nreproduction.  The `WTF_REQUIRES_LOCK` annotation on the list accessor\nmakes any access that does not hold the lock a compile error, which is\nthe load-bearing guarantee that the race cannot reappear.\n\n* Source/WebKit/Platform/cocoa/WebPrivacyHelpers.mm:\n(WebKit::TrackerDomainLookupInfo::populateIfNeeded):\n(WebKit::TrackerDomainLookupInfo::find):\n(WebKit::TrackerDomainLookupInfo::list):\n\nOriginally-landed-as: 305413.967@safari-7624.4-branch (f1ce3d547a23). rdar://184745157\nCanonical link: https://commits.webkit.org/319069@main",
      "email": "ddkilzer@apple.com",
      "hash": "9950c65f596093c9eb7f4beb1276f41828089fbe",
      "subject": "Data race reading the process-global TrackerDomainLookupInfo map from the network resolver thread in WebPrivacyHelpers"
    },
    "319070@main": {
      "author": "Qianlang Chen",
      "avatar": "https://www.gravatar.com/avatar/0fd54e904334f604739d0205aa6e2130?d=identicon\u0026s=64",
      "cl": "319070@main",
      "clUrl": "https://commits.webkit.org/319070@main",
      "description": "rdar://184286094\nhttps://bugs.webkit.org/show_bug.cgi?id=321239\n\nReviewed by BJ Burg.\n\nUnder Site Isolation, Page.searchInResources is implemented by\nProxyingPageAgent in the UIProcess. It fans the search out to every\nWebContent process, and each process scans both its frames' cached\nresources and its BackendResourceDataStore, which is where the buffered\nXHR and Worker response bodies live.\n\nThe test reached the Page domain through the window.PageAgent global,\nwhich resolves to WI.mainTarget's Page agent -- that is, the page\ntarget's in-process InspectorPageAgent. That agent walks only its own\nframe tree and delegates XHR and Worker bodies to\nenabledNetworkAgent(). Under Site Isolation the legacy\nInspectorNetworkAgent is never enabled, since FrameNetworkAgentProxy\nand BackendResourceDataStore take its place, so that half of the search\nwas silently skipped: search-xhr.txt and search-worker.js were absent\nfrom every SearchAllResources result, which in turn made the four\nSearchInXHRResource cases reject.\n\nSelect the target that owns the live implementation, gating on\nWI.networkManager.enabledPageForSiteIsolation the same way\nWI.Resource.prototype.requestContentFromBackend already does. The\nreported results are identical with and without Site Isolation, so the\nexpected results are unchanged.\n\nChoosing the target per call site is a stopgap. Every window.*Agent\nglobal resolves to the page target, which is the wrong destination for\nthe Page domain under Site Isolation in general; that will be handled\nalong with the removal of the window.*Agent globals, tracked by\nwebkit.org/b/201149.\n\n* LayoutTests/inspector/page/searchInResources.html:\nNow progresses with `run-webkit-tests --site-isolation`.\n\nCanonical link: https://commits.webkit.org/319070@main",
      "email": "qianlangchen@apple.com",
      "hash": "b330d0a4e971cbdd9bdba47877d5955c420cfa00",
      "subject": "[Site Isolation] Web Inspector: searchInResources.html fails under Site Isolation"
    },
    "319071@main": {
      "author": "Mike Wyrzykowski",
      "avatar": "https://www.gravatar.com/avatar/4b1bc9e238714f95e22d5d2454c07066?d=identicon\u0026s=64",
      "cl": "319071@main",
      "clUrl": "https://commits.webkit.org/319071@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321458\nradar://180535335\n\nReviewed by Cameron McCormack.\n\nWith watchOS 27.0, we can assume \u003e= Apple5 support\nfor all watches so WebGPU can be supported there now.\n\n* Source/WTF/wtf/PlatformEnable.h:\n* Source/WebGPU/WebGPU/QuerySet.mm:\n(WebGPU::Device::createQuerySet):\n\nCanonical link: https://commits.webkit.org/319071@main",
      "email": "mwyrzykowski@apple.com",
      "hash": "09336ec21de765586331435874c58909b5ba1055",
      "subject": "Enable WebGPU for watchOS"
    },
    "319072@main": {
      "author": "Wenson Hsieh",
      "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64",
      "cl": "319072@main",
      "clUrl": "https://commits.webkit.org/319072@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321614\nrdar://184739834\n\nReviewed by Abrar Rahman Protyasha.\n\nText extraction surfaces the text of associated `label` elements for form controls (via\n`labelText()`), but interaction descriptions only consult the `aria-label` and `label` content\nattributes. A control labeled by a separate `\u003clabel for=…\u003e` is therefore described as something like\n`input under html` instead of `input labeled “Email address”`.\n\nFall back to associated label text when describing an element, keeping `aria-label` as the preferred\nsource. This is opt-in per call site, so that the descendant scan for `containing child labeled`\ndoesn't build a `LabelsNodeList` for every labelable descendant.\n\nTest: TextExtractionTests.InteractionDescriptionIncludesAssociatedLabelText\n\n* Source/WebCore/page/text-extraction/TextExtraction.cpp:\n(WebCore::TextExtraction::normalizedLabelText):\n(WebCore::TextExtraction::textDescription):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:\n(TestWebKitAPI::TEST):\n\nCanonical link: https://commits.webkit.org/319072@main",
      "email": "wenson_hsieh@apple.com",
      "hash": "d5aba4a25f108940bf5ba0d920cf9d4acfb91656",
      "subject": "[Text Extraction] Include form control element labels in interaction descriptions"
    },
    "319073@main": {
      "author": "Charlie Wolfe",
      "avatar": "https://www.gravatar.com/avatar/857b3b5ff3394c31fa2689310a93dbab?d=identicon\u0026s=64",
      "cl": "319073@main",
      "clUrl": "https://commits.webkit.org/319073@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321641\nrdar://184753008\n\nReviewed by Simon Fraser.\n\nFrameProcessIndicators returned an empty screenContentsFormats(), so on iOS a wide-gamut screen gave\nthe label layer the IOSurface-only RGB10A8 format in an extended-range color space, which its\nbacking store cannot allocate. Pin the label to RGBA8.\n\n* Source/WebCore/platform/graphics/ca/FrameProcessIndicators.cpp:\n(WebCore::FrameProcessIndicators::screenContentsFormats const):\n* Source/WebCore/platform/graphics/ca/FrameProcessIndicators.h:\n\nCanonical link: https://commits.webkit.org/319073@main",
      "email": "charliew@apple.com",
      "hash": "1d873694df24dd9d6322b5f3ad98b23c39da53c2",
      "subject": "Show frame process borders PID label does not appear on iOS"
    },
    "319074@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "319074@main",
      "clUrl": "https://commits.webkit.org/319074@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321632\nrdar://184762027\n\nReviewed by Richard Robinson and Megan Gardner.\n\nThis makes it easier to refer to (or search) the plist in Xcode.\n\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/319074@main",
      "email": "a_protyasha@apple.com",
      "hash": "d8ffb26b39e9724729d7a11f07e44b1dd250fecc",
      "subject": "Add SystemTracePoints.plist to the WebKit Xcode project"
    },
    "319075@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "319075@main",
      "clUrl": "https://commits.webkit.org/319075@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321624\nrdar://184754923\n\nReviewed by Vassili Bykov.\n\nCurrently we are seeding Air DCE worklist in a program ordering and\nforward ordering in the basic block, which is really bad for liveness\nanalysis. Just use the reversed ordering, which removes 20% of time of\nthis phase.\n\n* Source/JavaScriptCore/b3/air/AirEliminateDeadCode.cpp:\n(JSC::B3::Air::eliminateDeadCode):\n\nCanonical link: https://commits.webkit.org/319075@main",
      "email": "ysuzuki@apple.com",
      "hash": "ee4f0240590dabdfc2fd03598ded4d722c615f13",
      "subject": "[JSC] Air DCE worklist should be seeded via backward ordering"
    },
    "319076@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "319076@main",
      "clUrl": "https://commits.webkit.org/319076@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321578\nrdar://184634983\n\nReviewed by Abrar Rahman Protyasha.\n\nThe value-type-ness of WebPage.BackForwardList was flawed, since it was essentially just forwarding\neverything to a Objective-C class type. Consequently, the `Equatable` conformance was also flawed,\nwhich made observing changes to the list unreliable and incorrect.\n\nFix this by addressing multiple issues:\n\n1. Change `backForwardList` from a stored property to a computed one that snapshots the live list\non each read, so that the contents are captured eagerly.\n\n2. In addition to listening to `_webView:backForwardListItemAdded:removed:` to update the list, also\nlisten to `_webView:didUpdateHistoryTitle:forURL:`, since the title gets updated independently of the\nrest of the list.\n\n3. Make the id of each item use the actual identifier of the backing engine type, so that identity\nis no longer dependent on a pointer address nor needs to retain anything.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebPageNavigationTests.swift\n\n* Source/WebKit/Modules/Internal/module.modulemap:\n* Source/WebKit/UIProcess/API/Cocoa/WKBackForwardListItem.mm:\n(-[WKBackForwardListItem _identifier]):\n(-[WKBackForwardListItem _identifierProcess]):\n* Source/WebKit/UIProcess/API/Cocoa/WKBackForwardListItemInternal.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKHistoryDelegatePrivate.h:\n* Source/WebKit/UIProcess/API/Swift/WebPage+BackForwardList.swift:\n(backList): Deleted.\n(currentItem): Deleted.\n(forwardList): Deleted.\n(wrapped): Deleted.\n* Source/WebKit/UIProcess/API/Swift/WebPage.swift:\n(backForwardList):\n(backingWebView):\n(didChangeBackForwardList):\n* Source/WebKit/UIProcess/Cocoa/WKNavigationDelegateAdapter.swift:\n(WKNavigationDelegateAdapter._webView(_:didUpdateHistoryTitle:for:)):\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebPageNavigationTests.swift:\n(WebPageNavigationTests.backForwardListNotifiesObserversOfEveryChange):\n(WebPageNavigationTests.navigatingToBackForwardListItemNotifiesObservers):\n(WebPageNavigationTests.backForwardListItemIdentifiersAreStableAcrossSnapshots):\n(WebPageNavigationTests.backForwardListItemsReflectUpdatesToTheirContents):\n(WebPageNavigationTests.backForwardListsWithDifferingHistoriesAreNotEqual):\n(WebPageNavigationTests.backForwardListSubscriptAccessesItemsRelativeToCurrentItem):\n\nCanonical link: https://commits.webkit.org/319076@main",
      "email": "richard_robinson2@apple.com",
      "hash": "181a547a020ac7a95c32709adfeb519257ce7a8a",
      "subject": "[SwiftUI WebKit API] WebPage.backForwardList is extremely unreliable"
    },
    "319077@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "319077@main",
      "clUrl": "https://commits.webkit.org/319077@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321634\nrdar://184763021\n\nReviewed by Yijia Huang.\n\nWhen callExceptionFuzz is called, we are saving and restoring GPR\nregisters as if this call is not happening. But linkRegister is\nclobbered and not restored when it exists on the architecture (ARM64\netc.). This patch fixes this bug. Note that this is the problem only on\nthe fuzz testing environment which uses exception fuzzing.\n\n* Source/JavaScriptCore/jit/AssemblyHelpers.cpp:\n(JSC::AssemblyHelpers::callExceptionFuzz):\n\nCanonical link: https://commits.webkit.org/319077@main",
      "email": "ysuzuki@apple.com",
      "hash": "04e2383bacab0060b45b2a7a10332e325e974c5d",
      "subject": "[JSC] Fix callExceptionFuzz clobbering linkRegister"
    },
    "319078@main": {
      "author": "Elliott Williams",
      "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64",
      "cl": "319078@main",
      "clUrl": "https://commits.webkit.org/319078@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321630\nrdar://184758552\n\nReviewed by Richard Robinson.\n\nSet up new SDK additions, run extract-tbds-from-internal-sdk, and fix\nbuild errors for both SDK variants. This commit does not touch the SDKDB\nbaseline; that will come in a follow-up.\n\nOne notable change this time around is that the SDKSettings plists no\nlonger depend on unversioned symlinks (e.g. `MacOSX.sdk -\u003e MacOSX27.0.sdk`)\nin the Xcode bundle. These symlinks are only present in public Xcode\nimages, so they prevented being able to build for embedded platforms\nusing the public SDK on internal Xcode.\n\n* Source/WebCore/PAL/pal/spi/ios/UIKitSPI.h:\n* Source/WebCore/WebCore_Private.modulemap:\n* Tools/Scripts/extract-tbds-from-internal-sdk:\n* Tools/TestRunnerShared/spi/UIKitSPIForTesting.h:\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/SDKSettings.plist: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/SymlinkedHeaders-output.xcfilelist: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/SymlinkedHeaders.xcfilelist: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/AppServerSupport.framework/AppServerSupport.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/AppStoreDaemon.framework/AppStoreDaemon.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/AppSupport.framework/AppSupport.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/ApplePushService.framework/ApplePushService.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/AuthKit.framework/AuthKit.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/BackBoardServices.framework/BackBoardServices.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/BaseBoard.framework/BaseBoard.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/CoreAnalytics.framework/CoreAnalytics.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/CorePrediction.framework/CorePrediction.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/FontServices.framework/libFontParser.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/FrontBoardServices.framework/FrontBoardServices.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/GameControllerUI.framework/GameControllerUI.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/GraphicsServices.framework/GraphicsServices.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/IOSurfaceAccelerator.framework/IOSurfaceAccelerator.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/IconServices.framework/IconServices.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/IdleTimerServices.framework/IdleTimerServices.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/InstallCoordination.framework/InstallCoordination.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/MobileKeyBag.framework/MobileKeyBag.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/OSEligibility.framework/OSEligibility.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/PrototypeTools.framework/PrototypeTools.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/RemotePairingDevice.framework/RemotePairingDevice.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/RunningBoardServices.framework/RunningBoardServices.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/SharedWebCredentials.framework/SharedWebCredentials.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/SpringBoardServices.framework/SpringBoardServices.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/UIIntelligenceSupport.framework/UIIntelligenceSupport.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/UIKitServices.framework/UIKitServices.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/URLFormatting.framework/URLFormatting.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/VisionKitCore.framework/VisionKitCore.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/WritingTools.framework/WritingTools.tbd: Added.\n* WebKitLibraries/SDKs/iphoneos27.0-additions.sdk/System/Library/PrivateFrameworks/WritingToolsUI.framework/WritingToolsUI.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/SDKSettings.plist: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/SymlinkedHeaders-output.xcfilelist: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/SymlinkedHeaders.xcfilelist: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/AppServerSupport.framework/AppServerSupport.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/AppStoreDaemon.framework/AppStoreDaemon.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/AppSupport.framework/AppSupport.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/ApplePushService.framework/ApplePushService.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/AuthKit.framework/AuthKit.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/BackBoardServices.framework/BackBoardServices.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/BaseBoard.framework/BaseBoard.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/CoreAnalytics.framework/CoreAnalytics.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/CorePrediction.framework/CorePrediction.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/FontServices.framework/libFontParser.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/FrontBoardServices.framework/FrontBoardServices.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/GameControllerUI.framework/GameControllerUI.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/GraphicsServices.framework/GraphicsServices.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/IconServices.framework/IconServices.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/IdleTimerServices.framework/IdleTimerServices.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/InstallCoordination.framework/InstallCoordination.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/OSEligibility.framework/OSEligibility.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/PrototypeTools.framework/PrototypeTools.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/RunningBoardServices.framework/RunningBoardServices.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/SharedWebCredentials.framework/SharedWebCredentials.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/SpringBoardServices.framework/SpringBoardServices.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/UIIntelligenceSupport.framework/UIIntelligenceSupport.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/UIKitServices.framework/UIKitServices.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/URLFormatting.framework/URLFormatting.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/VisionKitCore.framework/VisionKitCore.tbd: Added.\n* WebKitLibraries/SDKs/iphonesimulator27.0-additions.sdk/System/Library/PrivateFrameworks/WritingTools.framework/WritingTools.tbd: Added.\n\nCanonical link: https://commits.webkit.org/319078@main",
      "email": "emw@apple.com",
      "hash": "96df49dbf9566f41d1c1d4ab41a5bfaadc445e40",
      "subject": "[iOS 27] Build on the public SDK"
    },
    "319079@main": {
      "author": "Roberto Rodriguez",
      "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64",
      "cl": "319079@main",
      "clUrl": "https://commits.webkit.org/319079@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316512\nrdar://176188073\n\nReviewed by Alex Christensen.\n\nDocuments created via javascript: URL have an empty internal URL. Document::setURL() would\nnormally normalize this to aboutBlankURL(), but the call is conditionally skipped during\ndocument creation.\n\nWhen one of these documents creates a cross-origin iframe and then navigates it to about:blank,\nthe empty URL passes through NavigationRequester into NavigationAction::isEmpty(), which\nmistakes it for an action that was never set. The fallback in FrameLoader::loadWithDocumentLoader\nincorrectly rebuilds the action from the target frame's cross-origin document rather than the\noriginal initiator (the javascript: URL document). The about:blank then inherits that document's\npolicy container instead of the initiator's, leaking its CSP and referrer via\nSecurityPolicyViolationEvent.\n\nFix by normalizing empty document URLs to aboutBlankURL() in NavigationRequester::from(),\nmatching what Document::setURL() and Document::urlForBindings() already do.\n\nTests: imported/w3c/web-platform-tests/content-security-policy/inheritance/about-blank-from-javascript-url-inherits-csp-from-initiator.sub.html\n       imported/w3c/web-platform-tests/content-security-policy/inheritance/support/page-with-csp-marker.html\n\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/about-blank-from-javascript-url-inherits-csp-from-initiator.sub-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/about-blank-from-javascript-url-inherits-csp-from-initiator.sub.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/support/page-with-csp-marker.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/support/page-with-csp-marker.html.headers: Added.\n* LayoutTests/platform/ios-site-isolation/TestExpectations:\n* LayoutTests/platform/mac-site-isolation/TestExpectations:\n* Source/WebCore/loader/NavigationRequester.cpp:\n(WebCore::NavigationRequester::from):\n\nOriginally-landed-as: 305413.1051@safari-7624.5-branch (45512c517789). rdar://184744543\nCanonical link: https://commits.webkit.org/319079@main",
      "email": "roberto_rodriguez2@apple.com",
      "hash": "84ea03ded8bb54fd046a1f5c2b2379f308a3f5af",
      "subject": "about:blank inherits cross-origin policy container due to empty document URL"
    },
    "319080@main": {
      "author": "Claudio Saavedra",
      "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64",
      "cl": "319080@main",
      "clUrl": "https://commits.webkit.org/319080@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321600\n\nUnreviewed gardening.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319080@main",
      "email": "csaavedra@igalia.com",
      "hash": "35e7f7d1cd536ced890be1a434b29a0148c91758",
      "subject": "[GLIB] Gardening for August 12th, 2026"
    },
    "319081@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "319081@main",
      "clUrl": "https://commits.webkit.org/319081@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321628\nrdar://184756552\n\nReviewed by Yijia Huang.\n\nThis patch makes Air Liveness computation faster via two changes.\n\n1. Tighten WTF::Liveness\n\nLet's avoid iterating blocks unnecessarily. We do not need to have\nboundary iteration since normal iteration is also iterating the exact\nsame set of Insts. Also, avoid zeroing genStore as we are not relying on\nthe zero-ed values in genStore.\n\n2. Liveness::forEachLiveAtHeadNotLiveAtTail / Liveness::forEachLiveAtTailNotLiveAtHead\n\nBecause Liveness is maintaining head and tail liveness, it is very\nefficient for them to generate difference between these two set.\nThese two new interfaces generate the sets, which is very useful in\nAirAllocateRegistersByGreedy. We use this quick scanning of set to\nupdate live range information in AirAllocateRegistersByGreedy. Like,\nGreedyRegAlloc::buildLiveRanges is getting 17% reduction of time.\n\n* Source/JavaScriptCore/b3/air/AirAllocateRegistersByGreedy.cpp:\n(JSC::B3::Air::Greedy::GreedyAllocator::validateAssignments):\n(JSC::B3::Air::Greedy::GreedyAllocator::buildLiveRanges):\n* Source/WTF/wtf/Liveness.h:\n(WTF::Liveness::forEachLiveAtHead):\n(WTF::Liveness::forEachLiveAtTail):\n(WTF::Liveness::forEachLiveAtHeadNotLiveAtTail):\n(WTF::Liveness::forEachLiveAtTailNotLiveAtHead):\n(WTF::Liveness::computeDense):\n(WTF::Liveness::forEachInDense):\n(WTF::Liveness::forEachInSparse):\n(WTF::Liveness::forEachInDenseDifference):\n(WTF::Liveness::forEachInSparseDifference):\n\nCanonical link: https://commits.webkit.org/319081@main",
      "email": "ysuzuki@apple.com",
      "hash": "4a10860dc35cd5fd9f388244773c119a687b6313",
      "subject": "[JSC] Make Air Liveness computation faster"
    },
    "319082@main": {
      "author": "Alex Christensen",
      "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64",
      "cl": "319082@main",
      "clUrl": "https://commits.webkit.org/319082@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321619\nrdar://184749450\n\nReviewed by Yusuke Suzuki.\n\nMultiple ThreadSafeWeakPtrs can be used to safely access the same object from\ndifferent threads, but currently one ThreadSafeWeakPtr can't be safely accessed\nfrom multiple threads.  See rdar://184638719.\n\nThis moves the bit indicating weak or strong from inside the pointer to next to\nthe lock, which will allow me to re-use the TaggingTraits to store an offset,\nreducing sizeof(ThreadSafeWeakPtr) to sizeof(void*) which will allow me to make\nit atomic, fixing thread safety issues.  Moving this bit won't increase memory\nuse.\n\n* Source/JavaScriptCore/wasm/WasmCalleeGroup.cpp:\n(JSC::Wasm::CalleeGroup::tryGetBBQCalleeForLoopOSRConcurrently):\n(JSC::Wasm::CalleeGroup::releaseBBQCallee):\n(JSC::Wasm::CalleeGroup::installOptimizedCallee):\n(JSC::Wasm::CalleeGroup::updateCallsitesToCallUs):\n(JSC::Wasm::CalleeGroup::calleeIsReferenced const):\n* Source/JavaScriptCore/wasm/WasmCalleeGroup.h:\n* Source/WTF/wtf/ThreadSafeWeakPtr.h:\n(WTF::ThreadSafeWeakOrStrongPtr::status const): Deleted.\n(WTF::ThreadSafeWeakOrStrongPtr::isWeak const): Deleted.\n(WTF::ThreadSafeWeakOrStrongPtr::isStrong const): Deleted.\n(WTF::ThreadSafeWeakOrStrongPtr::get const): Deleted.\n(WTF::ThreadSafeWeakOrStrongPtr::convertToWeak): Deleted.\n(WTF::ThreadSafeWeakOrStrongPtr::tryConvertToStrong): Deleted.\n(WTF::ThreadSafeWeakOrStrongPtr::operator=): Deleted.\n(WTF::ThreadSafeWeakOrStrongPtr::ThreadSafeWeakOrStrongPtr): Deleted.\n(WTF::ThreadSafeWeakOrStrongPtr::~ThreadSafeWeakOrStrongPtr): Deleted.\n(WTF::ThreadSafeWeakOrStrongPtr::swap): Deleted.\n(WTF::ThreadSafeWeakOrStrongPtr::copyConstructFrom): Deleted.\n(WTF::ThreadSafeWeakOrStrongPtr::moveConstructFrom): Deleted.\n\nCanonical link: https://commits.webkit.org/319082@main",
      "email": "achristensen@apple.com",
      "hash": "01a43483d35fa5330f40b68da4c10a79beca26b6",
      "subject": "Remove ThreadSafeWeakOrStrongPtr"
    },
    "319083@main": {
      "author": "Elliott Williams",
      "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64",
      "cl": "319083@main",
      "clUrl": "https://commits.webkit.org/319083@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321533\nrdar://183370889\n\nReviewed by Geoffrey Garen.\n\nThe prewarm target was missing some necessary definition and search path\nflags needed to produce the same module cache key. This meant that it\nwasn't prewarming at all, and WebKit's swift task was rebuilding all\nmodules downstream of wtf. The performance impact worsened when\n317797@main added modulemaps for JavaScriptCore_Private and WebCore.\n\nFix by doing more work in WEBKIT_ADD_SWIFT_PREWARM to discover compiler\nflags. Also add the new modules we produce to our prewarm target. On an\nM5 Max, this is about a 1% (5 sec) progression.\n\nVerified that the modules are no longer being built twice by capturing\nthe swift driver invocation and re-running with `-v` to show -emit-pcm\ncommands. Confirmed that the command for WebKit does not build any\nmodules upstream of WebKit itself:\n\n    set swiftc_webkit (ninja -t commands Source/WebKit/WebKit.swiftmodule | tail -1)\n    set swiftc_prewarm (ninja -t commands Source/WebKit/SwiftPrewarmMac.swiftmodule | tail -1)\n    eval $swiftc_prewarm -v | grep -o '\\-emit-pcm.*-module-name [A-Za-z_]*'\n    eval $swiftc_webkit -v | grep -o '\\-emit-pcm.*-module-name [A-Za-z_]*'\n\nAs a drive-by, refactor how `-explicit-module-builds` is passed to\nremove duplication and apply it more consistently across the codebase.\n\n* Source/WebKit/PlatformCocoa.cmake:\n* Source/WebKit/SwiftPrewarmMac.swift:\n* Source/cmake/OptionsCocoa.cmake:\n* Source/cmake/WebKitMacros.cmake:\n* Source/cmake/WebKitSwiftPrewarm.cmake:\n* Tools/TestWebKitAPI/PlatformCocoa.cmake:\n\nCanonical link: https://commits.webkit.org/319083@main",
      "email": "emw@apple.com",
      "hash": "092eccdd01d2d8ef6a437024d3a9ba099b00c18f",
      "subject": "[CMake] Prewarmed modules not cached when compiling WebKit"
    },
    "319084@main": {
      "author": "Rupin Mittal",
      "avatar": "https://www.gravatar.com/avatar/3e3de9845931d2dc844afb00056ec94e?d=identicon\u0026s=64",
      "cl": "319084@main",
      "clUrl": "https://commits.webkit.org/319084@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321260\nrdar://184311803\n\nReviewed by Basuke Suzuki.\n\nThis patch implements the Precommit Handler of the Navigation API according\nto https://html.spec.whatwg.org/multipage/nav-history-apis.html#navigation-api.\n\nThis is guarded behind the new NavigationAPIPrecommitHandler feature flag\nwhich is currently marked as \"testable\". There are still a few tests that\nare not passing yet. Once those are fixed, we will enable the flag in stable.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/precommit-handler/precommitHandler-addHandler-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/precommit-handler/precommitHandler-addHandler-throws-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/precommit-handler/precommitHandler-back-and-forth-expected.txt: Added.\n* Source/WebCore/CMakeLists.txt:\n* Source/WebCore/DerivedSources.make:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/bindings/js/JSNavigationPrecommitControllerCustom.cpp: Added.\n(WebCore::JSNavigationPrecommitController::visitAdditionalChildrenInGCThread):\n* Source/WebCore/bindings/js/WebCoreBuiltinNames.h:\n* Source/WebCore/page/NavigateEvent.cpp:\n(WebCore::NavigateEvent::setInfo):\n(WebCore::NavigateEvent::intercept):\n* Source/WebCore/page/NavigateEvent.h:\n* Source/WebCore/page/NavigateEvent.idl:\n* Source/WebCore/page/Navigation.cpp:\n(WebCore::Navigation::documentCanHaveURLRewritten):\n(WebCore::Navigation::createTransitionForInterception):\n(WebCore::Navigation::setupInterceptionState):\n(WebCore::Navigation::runNavigatePrecommitHandlers):\n(WebCore::Navigation::innerDispatchNavigateEvent):\n(WebCore::documentCanHaveURLRewritten): Deleted.\n(WebCore::Navigation::reload):\n(WebCore::Navigation::navigate):\n(WebCore::Navigation::performTraversal):\n(WebCore::Navigation::traverseTo):\n(WebCore::Navigation::back):\n(WebCore::Navigation::forward):\n* Source/WebCore/page/Navigation.h:\n(WebCore::NavigationAPIMethodTracker::setSerializedState):\n* Source/WebCore/page/NavigationDestination.h:\n* Source/WebCore/page/NavigationPrecommitController.cpp: Added.\n(WebCore::NavigationPrecommitController::NavigationPrecommitController):\n(WebCore::NavigationPrecommitController::redirect):\n(WebCore::NavigationPrecommitController::addHandler):\n* Source/WebCore/page/NavigationPrecommitController.h: Added.\n* Source/WebCore/page/NavigationPrecommitController.idl: Added.\n* Source/WebCore/page/NavigationPrecommitHandler.h: Copied from Source/WebCore/page/NavigationDestination.h.\n(WebCore::NavigationPrecommitHandler::isJSNavigationPrecommitHandler const):\n* Source/WebCore/page/NavigationPrecommitHandler.idl: Added.\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/ordering-and-transition/navigate-intercept-precommitHandler-redirect_currententrychange-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/ordering-and-transition/navigate-intercept-precommitHandler-redirect_no-currententrychange-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/ordering-and-transition/navigate-intercept-precommitHandler-reject.tentative_currententrychange-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/ordering-and-transition/navigate-intercept-precommitHandler-reject.tentative_no-currententrychange-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/ordering-and-transition/navigate-intercept-precommitHandler_currententrychange-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/ordering-and-transition/navigate-intercept-precommitHandler_no-currententrychange-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/precommit-handler/multiple-intercept-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/precommit-handler/precommitHandler-new-navigation-before-commit-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/precommit-handler/precommitHandler-push-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/precommit-handler/precommitHandler-redirect-options-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/precommit-handler/precommitHandler-redirect-push-changed-to-replace-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/precommit-handler/precommitHandler-redirect-push-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/precommit-handler/precommitHandler-redirect-replace-changed-to-push-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/precommit-handler/precommitHandler-redirect-replace-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/precommit-handler/precommitHandler-redirect-throws-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/precommit-handler/precommitHandler-reload-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/precommit-handler/precommitHandler-replace-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/precommit-handler/precommitHandler-traversal-window-stop-before-commit-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/precommit-handler/precommitHandler-traverse-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/precommit-handler/precommitHandler-uncancelable-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/precommit-handler/precommitHandler-window-stop-before-commit-expected.txt:\n* Source/WebCore/loader/FrameLoaderTypes.h:\n* Source/WebCore/page/Navigation.idl:\n* Source/WebCore/page/NavigationHistoryBehavior.h: Added.\n* Source/WebCore/page/NavigationHistoryBehavior.idl: Added.\n* Source/WebCore/page/NavigationNavigateOptions.h: Added.\n* Source/WebCore/page/NavigationNavigateOptions.idl: Added.\n* Source/WebCore/page/NavigationOptions.h: Added.\n* Source/WebCore/page/NavigationOptions.idl: Added.\n* Source/WebCore/page/NavigationReloadOptions.h: Added.\n* Source/WebCore/page/NavigationReloadOptions.idl: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/dom/idlharness.https_exclude=(Document_Window_HTML._)-expected.txt:\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/loader/FrameLoadRequest.h:\n* Source/WebCore/loader/FrameLoader.h:\n* Source/WebCore/loader/NavigationScheduler.h:\n* Source/WebCore/page/History.h:\n* Source/WebCore/page/NavigationTransition.cpp:\n(WebCore::NavigationTransition::create):\n(WebCore::NavigationTransition::NavigationTransition):\n(WebCore::NavigationTransition::resolveCommitted):\n(WebCore::NavigationTransition::rejectPromise):\n(WebCore::NavigationTransition::committed):\n* Source/WebCore/page/NavigationTransition.h:\n* Source/WebCore/page/NavigationTransition.idl:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/ordering-and-transition/anchor-download-aborts-previous-navigation-expected.txt:\n\nCanonical link: https://commits.webkit.org/319084@main",
      "email": "rupin@apple.com",
      "hash": "45434d689d024c7f54fbf5a316f2f7559af09f4b",
      "subject": "[Navigation API] Implement Precommit Handler"
    },
    "319085@main": {
      "author": "Issac Roy",
      "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64",
      "cl": "319085@main",
      "clUrl": "https://commits.webkit.org/319085@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320031\nrdar://182965776\n\nReviewed by Aakash Jain.\n\nresultsdbpy can store EWS test results, but exposes no HTTP interface for\nclients to write or read them. Add an EWSController with three endpoints:\nPOST /api/upload/ews to register a run's per-test results (optionally tagged\nwith a flaky_type), GET /api/results-ews to query a single test's history for\none or more configurations, selecting either the failure or flaky table and\nwindowing by time, and GET /api/results-ews/tests to enumerate the recorded\ntest names. Wire the routes into APIRoutes.\n\nThe read endpoints sit beside /api/results-summary rather than under\n/api/results/, whose grammar is /results/\u003cpath:suite\u003e, so a static rule there\nwould claim URLs out of a namespace that accepts any suite name.\n\nResults are clustered by start_time, so a commit range could only be honored\nas a filter applied in Python to rows Cassandra had already truncated with\nLIMIT. Rather than answer such a query wrongly, find rejects ref, uuid,\ntimestamp, begin and end with a 400 and windows by time alone. Serving them\nneeds a by-commit table, as suite_results_by_commit is to\nsuite_results_by_start_time.\n\nResults are partitioned by configuration and test name, so they can only be\nread back for a test whose name is already known. Nothing recorded those\nnames: the shared test_names_by_suite belongs to TestContext and is not\nwritten by EWSContext. Each reported name is now recorded in an index\npartitioned by suite and by which of the two tables it belongs to, written in\nthe same batch as its results and sharing the same TTL, so a name never\noutlives the data it points at. Like test_names_by_suite, that index is not\nkeyed by configuration or branch.\n\nEWSContext was constructed without ttl_seconds, so rows in\news_failed_tests_by_start_time were written with no TTL and would never\nexpire; it now inherits default_ttl_seconds while flaky rows keep the shorter\nFLAKY_TTL_SECONDS. A TTL is applied per write, so this changes rows written\nfrom now on rather than anything already stored.\n\n* Tools/Scripts/libraries/resultsdbpy/resultsdbpy/controller/api_routes.py:\n(APIRoutes.__init__): Construct an EWSController and register the /upload/ews\n(POST), /results-ews (GET) and /results-ews/tests (GET) routes.\n* Tools/Scripts/libraries/resultsdbpy/resultsdbpy/controller/ews_controller.py: Added.\n(EWSController):\n(EWSController.__init__): Hold the commit controller and EWS context.\n(EWSController.upload): Handle POST /api/upload/ews; validate the payload\n(configuration, suite, test_results, timestamp, flaky_type, details, commits),\naborting 400 on anything missing or malformed, then record the results via\news_context. Commits are registered only once every check that can abort has\npassed.\n(EWSController.find): Handle GET /api/results-ews; query a test's results for\nthe requested configurations from the failure or flaky table, honoring recent\nand time bounds, and return them grouped by configuration (404 when none\nmatch).\n(EWSController.list_tests): Handle GET /api/results-ews/tests; return the\nrecorded test names for a suite, optionally filtered by table and name prefix.\n* Tools/Scripts/libraries/resultsdbpy/resultsdbpy/controller/ews_controller_unittest.py: Added.\n(EWSControllerTest):\n(EWSControllerTest.setup_webserver): Stand up a mock model and register the\nAPI routes.\n(EWSControllerTest.upload_ews_results): Helper that POSTs a results payload to\nthe upload endpoint.\n(EWSControllerTest.find_ews_results): Helper that GETs the results endpoint\nwith the default configuration.\n(EWSControllerTest.test_upload_and_find): Upload failures with metadata and\nread them back, asserting details round-trip.\n(EWSControllerTest.test_flaky_upload_and_find): Upload a flaky result and\nconfirm it is queryable via flaky=true, separate from the failure table.\n(EWSControllerTest.test_invalid_upload_body_is_not_an_object): A body that is\nnot a json object is rejected with 400 rather than raising AttributeError.\n(EWSControllerTest.test_invalid_upload_missing_suite): A payload without a\nsuite is rejected with 400.\n(EWSControllerTest.test_invalid_upload_malformed_columns): Values that would\notherwise reach a cqlengine column or a commit lookup are rejected with 400.\n(EWSControllerTest.test_invalid_upload_missing_commits): A payload without\ncommits is rejected with 400.\n(EWSControllerTest.test_invalid_upload_missing_test_results): A payload\nwithout test results is rejected with 400.\n(EWSControllerTest.test_no_results): Querying a test with no stored results\nreturns 404.\n(EWSControllerTest.test_find_rejects_a_commit_range): Commit-range parameters\nare rejected with 400.\n(EWSControllerTest.test_find_without_test): A query missing the test parameter\nis rejected with 400.\n(EWSControllerTest.test_upload_omitting_optional_fields): Optional fields may\nbe omitted from the payload.\n(EWSControllerTest.test_invalid_upload_non_string_suite): A payload whose\nsuite is not a string is rejected with 400.\n(EWSControllerTest.test_upload_preserves_commit_metadata): Uploading against a\nregistered commit leaves its author and message intact.\n(EWSControllerTest.test_upload_registers_an_unsynced_commit): A commit the\ndatabase has not seen is registered by the upload.\n(EWSControllerTest.test_upload_reports_the_tests_it_stored): The response\nnames the tests that were written.\n(EWSControllerTest.test_invalid_upload_partial_configuration): A configuration\nthat cannot be written is rejected with 400.\n(EWSControllerTest.test_time_window_query):\n(EWSControllerTest.test_time_window_query.start_times_after): Results are\nwindowed by after_time and before_time.\n(EWSControllerTest.test_list_tests): Recorded test names are enumerable.\n(EWSControllerTest.test_list_tests_flaky): The flaky and failure indices are\nseparate.\n(EWSControllerTest.test_list_tests_prefix): Names can be filtered by prefix.\n(EWSControllerTest.test_list_tests_honours_the_limit_across_prefixes): The\nlimit applies to the whole response, not to each prefix.\n(EWSControllerTest.test_list_tests_percent_encoded_name): A name containing a\nquery character survives percent-encoding.\n(EWSControllerTest.test_list_tests_without_suite): A query missing the suite\nparameter is rejected with 400.\n(EWSControllerTest.test_list_tests_empty): Finding no tests returns an empty\nlist rather than 404.\n* Tools/Scripts/libraries/resultsdbpy/resultsdbpy/model/ews_context.py:\n(EWSContext):\n(EWSContext.EWSTestNameBySuite): Index of test names by suite and table.\n(EWSContext.__init__): Create the index table.\n(EWSContext.record_results): Renamed from register, which named a callback\ncontract this does not keep: it returns the stored test names and raises\nrather than returning partial_status. Record each reported name once per\ntable, with the same TTL as its results, coercing that TTL to an int since\ncqlengine formats it straight into the CQL.\n(EWSContext.names): Return the recorded names, optionally restricted to a name\nprefix, as a list rather than a generator built inside the keyspace context.\n(EWSContext.find_for_test): Query a test's results, bounded by start time.\n* Tools/Scripts/libraries/resultsdbpy/resultsdbpy/model/ews_context_unittest.py:\n(EWSContextTest):\n(EWSContextTest.test_ttl_is_an_integer): Every TTL reaching Cassandra is an\nint.\n(EWSContextTest.test_record_results_reports_the_tests_it_stored):\n(EWSContextTest.test_record_results_raises_when_the_write_is_rejected):\n(EWSContextTest.test_names_enumerates_reported_tests):\n(EWSContextTest.test_names_separates_flaky_from_failed):\n(EWSContextTest.test_names_filters_by_prefix): Cover the index.\n* Tools/Scripts/libraries/resultsdbpy/resultsdbpy/model/mock_model_factory.py:\n(MockModelFactory.add_mock_ews_results): Follow the rename.\n* Tools/Scripts/libraries/resultsdbpy/resultsdbpy/model/model.py:\n(Model.__init__): Pass default_ttl_seconds to EWSContext.\n\nCanonical link: https://commits.webkit.org/319085@main",
      "email": "issacroy05@gmail.com",
      "hash": "363100839eacb5718060931341fde67887fbe01d",
      "subject": "Add results database API endpoints to upload and query EWS test results"
    },
    "319086@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "319086@main",
      "clUrl": "https://commits.webkit.org/319086@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321645\n\nReviewed by Yusuke Suzuki.\n\ncollectBoyerMooreInfoFromTerm() gave up on a lookahead or lookbehind, so a body\nalternative starting with one, such as /(?\u003c=\\$)\\d+/, got neither the Boyer-Moore\nbitmap nor the SIMD search and tried the body at every position. An assertion\nconsumes no input, so it contributes nothing to the character sets and the\nfollowing terms are collected as usual, like ^ $ and \\b already are.\n\n                                          Baseline          Patched\n\nregexp-lookbehind-fixed                   45.47+-0.70   ^   1.53+-0.04   ^ definitely 29.7674x faster\nregexp-lookbehind-negative-alternation    48.59+-0.74   ^   9.33+-0.24   ^ definitely 5.2072x faster\nregexp-lookbehind-variable                34.46+-0.40   ?  34.85+-0.69\nregexp-lookbehind-replace                 60.50+-1.19      60.46+-1.63\n\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n\nCanonical link: https://commits.webkit.org/319086@main",
      "email": "sosuke@bun.sh",
      "hash": "64243d698a349da07c92d9ab7d5b322c23faf9a0",
      "subject": "[YARR] Collect Boyer-Moore info through parenthetical assertions"
    },
    "319087@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "319087@main",
      "clUrl": "https://commits.webkit.org/319087@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321651\nrdar://184776446\n\nReviewed by Yijia Huang.\n\nThis patch uses std::ranges::remove_if and std::views::reverse, so\nVector\u003cInst*\u003e elements are just moved forward / backward to the\nlatter part of the range when it is \"removed\". And based on that we can\njust shrink the size of std::span view.\n\n* Source/JavaScriptCore/b3/air/AirEliminateDeadCode.cpp:\n(JSC::B3::Air::eliminateDeadCode):\n\nCanonical link: https://commits.webkit.org/319087@main",
      "email": "ysuzuki@apple.com",
      "hash": "ae85b80e5fbe8bf0a8a942a12636dbe6ee4b4621",
      "subject": "[JSC] AirEliminateDeadCode does not need to remove elements from Vector"
    },
    "319088@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "319088@main",
      "clUrl": "https://commits.webkit.org/319088@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321637\nrdar://184764993\n\nReviewed by Yijia Huang.\n\nWe have several analysis which scans entire Air graph and populating the\nanalysis result. But scanning the graph multiple times is really costly\nsince typically Air graph is large so each analysis blows out the cache.\n\nThis patch decouples analysis and data and introducing Air::InstAnalyzer\nmechanism. Now TmpWidth and UseCounts are having TmpWidth::Builder and\nUseCounts::Builder, and each builder implements InstAnalyzer interface\ne.g. visitTmp. And then analyzeCode scans the graph once and invoking\neach analyzer to populate the information.\n\nThis patterns is currently designed for the analysis which does not\nmutate the Air::Graph in the middle (as it is saying \"analyzer\", not\n\"reducer\" etc.).\n\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/b3/air/AirAllocateRegistersByGreedy.cpp:\n(JSC::B3::Air::Greedy::GreedyAllocator::m_insertionSets):\n(JSC::B3::Air::Greedy::GreedyAllocator::validateFusedAnalyses):\n(JSC::B3::Air::Greedy::GreedyAllocator::m_tmpWidth): Deleted.\n* Source/JavaScriptCore/b3/air/AirInstAnalyzer.h: Added.\n(JSC::B3::Air::InstAnalyzer::run):\n(JSC::B3::Air::InstAnalyzer::prepare):\n(JSC::B3::Air::InstAnalyzer::startBlock):\n(JSC::B3::Air::InstAnalyzer::visitInst):\n(JSC::B3::Air::InstAnalyzer::visitTmp):\n(JSC::B3::Air::InstAnalyzer::finish):\n(JSC::B3::Air::analyzeCode):\n* Source/JavaScriptCore/b3/air/AirTmpWidth.cpp:\n(JSC::B3::Air::TmpWidth::TmpWidth):\n(JSC::B3::Air::TmpWidth::recompute):\n(JSC::B3::Air::TmpWidth::fixpointMoves):\n(JSC::B3::Air::TmpWidth::recomputeBoth): Deleted.\n* Source/JavaScriptCore/b3/air/AirTmpWidth.h:\n* Source/JavaScriptCore/b3/air/AirTmpWidthInlines.h:\n* Source/JavaScriptCore/b3/air/AirUseCounts.h:\n(JSC::B3::Air::UseCounts::UseCounts):\n\nCanonical link: https://commits.webkit.org/319088@main",
      "email": "ysuzuki@apple.com",
      "hash": "5821b05faa72aa3be5a4e4af7d2e39e0339736aa",
      "subject": "[JSC] Introduce AirInstAnalyzer"
    },
    "319089@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "319089@main",
      "clUrl": "https://commits.webkit.org/319089@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=REDACTED\nrdar://179729192\n\nReviewed by Anne van Kesteren.\n\nManualSlotAssignment::slotManualAssignmentDidChange computed effectiveCurrent\nby calling assignedNodesForSlot, which returns a raw pointer to the\ncachedAssignment Vector inside a Slot value stored directly in the m_slots\nWeakHashMap bucket array. It then called\nRenderTreeUpdater::tearDownRenderersAfterSlotChange, whose composed-tree\ntraversal can call HTMLSlotElement::assignedNodes on a sibling slot and\nre-enter ManualSlotAssignment::assignedNodesForSlot. The reentrant\nm_slots.ensure call may invoke the WeakHashMap amortized cleanup, sweep\nnull-keyed entries left by previously inserted, removed and GC-collected slot\nelements, and rehash the table, freeing the bucket array effectiveCurrent\npoints into. The stale pointer was then dereferenced in\nscheduleSlotChangeEventIfNeeded.\n\nCompute effectiveCurrent as a local Vector via effectiveAssignedNodes,\nmirroring effectivePrevious, so no pointer into m_slots is held across the\nrender-tree teardown.\n\n* LayoutTests/fast/shadow-dom/manual-slot-assign-renderer-teardown-crash-expected.txt: Added.\n* LayoutTests/fast/shadow-dom/manual-slot-assign-renderer-teardown-crash.html: Added.\n* Source/WebCore/dom/SlotAssignment.cpp:\n(WebCore::ManualSlotAssignment::slotManualAssignmentDidChange):\n\nOriginally-landed-as: 305413.1004@safari-7624.5-branch (ddc8b3fae09f). rdar://184744200\nCanonical link: https://commits.webkit.org/319089@main",
      "email": "cdumez@apple.com",
      "hash": "0bab5af95da144b45e240675e21391b3f5518a30",
      "subject": "UAF in ManualSlotAssignment via WeakHashMap rehash during reentrant composed-tree teardown"
    },
    "319090@main": {
      "author": "Ankshit Jain",
      "avatar": "https://www.gravatar.com/avatar/4f4e2b9b7caac20e68d9e6193fa39742?d=identicon\u0026s=64",
      "cl": "319090@main",
      "clUrl": "https://commits.webkit.org/319090@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=303905\nrdar://166197860\n\nReviewed by Alex Christensen.\n\nRe-enables WebTransport.CSP test on iOS\n\n* Tools/TestWebKitAPI/Tests/WebKitCocoa/WebTransport.mm:\n(TestWebKitAPI::TEST(WebTransport, CSP)):\n(TestWebKitAPI::TEST(WebTransport, DISABLED_CSP)): Deleted.\n\nCanonical link: https://commits.webkit.org/319090@main",
      "email": "ankshit_jain@apple.com",
      "hash": "fed1393c30edfa007311e685d7032427bba98fea",
      "subject": "Re-enable WebTransport.CSP test on iOS"
    },
    "319091@main": {
      "author": "Jessica Lee",
      "avatar": "https://www.gravatar.com/avatar/fc717c99321d09f31fb9187418a8ffc5?d=identicon\u0026s=64",
      "cl": "319091@main",
      "clUrl": "https://commits.webkit.org/319091@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321621\nrdar://184750792\n\nReviewed by Sihui Liu.\n\nChecking the deferred iframe's url will more robustly test that it correctly loads.\n\nSee https://github.com/WebKit/WebKit/pull/71207#discussion_r3754327384 for more detail.\n\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/cross-site/iframe-loading-lazy-cross-site.sub.html:\n\nCanonical link: https://commits.webkit.org/319091@main",
      "email": "jlee53@apple.com",
      "hash": "fe8673c31cf645e645a9ed37189c3d26414b895c",
      "subject": "Refactor iframe-loading-lazy-cross-site to check subframe's loaded URL"
    },
    "319092@main": {
      "author": "Aditya Keerthi",
      "avatar": "https://www.gravatar.com/avatar/208766e9de08fdbc9f580c304a640e24?d=identicon\u0026s=64",
      "cl": "319092@main",
      "clUrl": "https://commits.webkit.org/319092@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321663\nrdar://105809280\n\nReviewed by Richard Robinson.\n\n* Source/WebCore/PAL/pal/spi/mac/NSSpellCheckerSPI.h:\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::showInlinePredictionsForCandidate):\n\nThe AppKit SPI has existed for over 3 years now. Adopt it in place of a\nhardcoded string.\n\nCanonical link: https://commits.webkit.org/319092@main",
      "email": "akeerthi@apple.com",
      "hash": "de7446f182ad422f654d44eda331519c2719322c",
      "subject": "Adopt NSTextCheckingSoftSpaceRangeKey in WebKit"
    },
    "319093@main": {
      "author": "Karl Dubost",
      "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64",
      "cl": "319093@main",
      "clUrl": "https://commits.webkit.org/319093@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321049\nrdar://184076505\n\nReviewed by Nikolas Zimmermann.\n\nRemoving an SVG enumerated attribute, or setting it to something which is not\none of its keywords, left the DOM property reporting the previous value\ninstead of the initial one.\n\n    let e = document.createElementNS(svgNS, 'clipPath');\n    e.setAttribute('clipPathUnits', 'objectBoundingBox');  // baseVal is 2\n    e.removeAttribute('clipPathUnits');                    // baseVal is still 2, expected 1\n\nEvery attributeChanged() wrote the property only when the value parsed to a\nknown keyword. SVGPropertyTraits::fromString() returns the unknown constant\nboth for a removed attribute and for an unrecognized one, so in both cases\nnothing was written at all and the previous value survived. SVG 2 says an\nattribute which fails to parse is treated as if the initial value had been\nspecified.\n\nFix by keeping the initial value in SVGAnimatedEnumeration, which already\nreceives it when the property is constructed but did not hold on to it, and\nadding parseBaseVal() to parse and fall back to it. This replaces 24 copies of\nthe same guard, written three different ways.\n\nparseBaseVal() treats a value above the highest keyword of the attribute's\ngrammar as unrecognized too, which is the test SVGDecoratedEnumeration::setValue()\nalready applies to values arriving from the DOM. feBlend's mode needs it: the\nshared BlendMode parser also accepts plus-darker and plus-lighter, and neither is\none of the sixteen keywords of \u003cblend-mode\u003e, so both were stored above the range\nof the attribute and read back as 0, a value the IDL setter refuses. They now\nrevert to normal.\nhttps://drafts.csswg.org/filter-effects-1/#feBlendElement\nhttps://drafts.csswg.org/compositing-1/#ltblendmodegt\n\nmarker's orient keeps its own code because one attribute drives two\nproperties. It had the opposite problem: it always wrote, so an unrecognized\nvalue stored the unknown constant instead of the initial one.\n\nfeConvolveMatrix and feGaussianBlur still report an unrecognized edgeMode in\nthe console, and no longer report one when the attribute is merely removed.\n\nsvg/dom/SVGAnimatedEnumeration-case-sensitive.html asserted the old behaviour.\nIt also covered keyword parsing and case sensitivity, which the WPT tests did\nnot, so that coverage moves to SVGAnimatedEnumeration-keywords.html and the\nlocal test is removed.\n\nTests: imported/w3c/web-platform-tests/svg/types/scripted/SVGAnimatedEnumeration-invalid-values.html\n       imported/w3c/web-platform-tests/svg/types/scripted/SVGAnimatedEnumeration-keywords.html\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGAnimatedEnumeration-initial-values-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGAnimatedEnumeration-initial-values.html:\n  Adding feGaussianBlur edgeMode, whose initial value is none.\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGAnimatedEnumeration-invalid-values-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGAnimatedEnumeration-invalid-values.html: Added.\n  Empty attribute values, the content attribute keeping what was specified, and\n  feBlend rejecting the two blend modes that are not in \u003cblend-mode\u003e.\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGAnimatedEnumeration-keywords-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGAnimatedEnumeration-keywords.html: Added.\n  Every keyword of every enumerated attribute, and its rejection in the wrong case.\n* LayoutTests/svg/dom/SVGAnimatedEnumeration-case-sensitive-expected.txt: Removed.\n* LayoutTests/svg/dom/SVGAnimatedEnumeration-case-sensitive.html: Removed.\n* Source/WebCore/svg/SVGClipPathElement.cpp:\n(WebCore::SVGClipPathElement::attributeChanged):\n* Source/WebCore/svg/SVGComponentTransferFunctionElement.cpp:\n(WebCore::SVGComponentTransferFunctionElement::attributeChanged):\n* Source/WebCore/svg/SVGFEBlendElement.cpp:\n(WebCore::SVGFEBlendElement::attributeChanged):\n* Source/WebCore/svg/SVGFEColorMatrixElement.cpp:\n(WebCore::SVGFEColorMatrixElement::attributeChanged):\n* Source/WebCore/svg/SVGFECompositeElement.cpp:\n(WebCore::SVGFECompositeElement::attributeChanged):\n* Source/WebCore/svg/SVGFEConvolveMatrixElement.cpp:\n(WebCore::SVGFEConvolveMatrixElement::attributeChanged):\n* Source/WebCore/svg/SVGFEConvolveMatrixElement.h:\n  Removing SVGPropertyTraits\u003cEdgeModeType\u003e::initialValue(), which had no callers\n  and named none, while feConvolveMatrix starts at duplicate. The initial value\n  belongs to the attribute, not to the enumeration it is drawn from.\n* Source/WebCore/svg/SVGFEDisplacementMapElement.cpp:\n(WebCore::SVGFEDisplacementMapElement::attributeChanged):\n* Source/WebCore/svg/SVGFEGaussianBlurElement.cpp:\n(WebCore::SVGFEGaussianBlurElement::attributeChanged):\n* Source/WebCore/svg/SVGFEMorphologyElement.cpp:\n(WebCore::SVGFEMorphologyElement::attributeChanged):\n* Source/WebCore/svg/SVGFETurbulenceElement.cpp:\n(WebCore::SVGFETurbulenceElement::attributeChanged):\n* Source/WebCore/svg/SVGFilterElement.cpp:\n(WebCore::SVGFilterElement::attributeChanged):\n* Source/WebCore/svg/SVGGradientElement.cpp:\n(WebCore::SVGGradientElement::attributeChanged):\n* Source/WebCore/svg/SVGMarkerElement.cpp:\n(WebCore::SVGMarkerElement::attributeChanged):\n* Source/WebCore/svg/SVGMaskElement.cpp:\n(WebCore::SVGMaskElement::attributeChanged):\n* Source/WebCore/svg/SVGPatternElement.cpp:\n(WebCore::SVGPatternElement::attributeChanged):\n* Source/WebCore/svg/SVGTextContentElement.cpp:\n(WebCore::SVGTextContentElement::attributeChanged):\n* Source/WebCore/svg/SVGTextPathElement.cpp:\n(WebCore::SVGTextPathElement::attributeChanged):\n* Source/WebCore/svg/properties/SVGAnimatedDecoratedProperty.h:\n(WebCore::SVGAnimatedDecoratedProperty::create):\n  Dropping the overload which took no initial value. It had no callers, and a\n  property built through it would have restored 0, which is not a legal\n  enumeration value.\n(WebCore::SVGAnimatedDecoratedProperty::SVGAnimatedDecoratedProperty):\n(WebCore::SVGAnimatedDecoratedProperty::parseBaseVal):\n\nCanonical link: https://commits.webkit.org/319093@main",
      "email": "karlcow@apple.com",
      "hash": "d5668e13da64a23845ff1740e560274a7a4f8a15",
      "subject": "SVG enumerated attributes should revert to their initial value when removed or invalid"
    },
    "319094@main": {
      "author": "Kai Tamkun",
      "avatar": "https://www.gravatar.com/avatar/dff073cba21885df4d9f73ed3cc493c2?d=identicon\u0026s=64",
      "cl": "319094@main",
      "clUrl": "https://commits.webkit.org/319094@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314579\nrdar://176131036\n\nReviewed by Marcus Plutowski.\n\n300523@main relaxed validation so that PhantomNewArrayWithButterfly may\nreference a non-phantom NewButterflyWithSize, and taught\nFTLLowerDFGToB3::exitValueForNode to emit an ExitArgument with\nDataFormatStorage for the live butterfly. However, the FTL OSR exit\ncompiler's reboxAccordingToFormat() was never updated, so when such an\nexit is compiled it falls into RELEASE_ASSERT_NOT_REACHED().\n\nThe recovered storage value is the raw butterfly pointer that\noperationMaterializeObjectInOSR(PhantomNewArrayWithButterfly) consumes\nvia std::bit_cast\u003cButterfly*\u003e, so no boxing is required; treat it the\nsame as DataFormatJS and pass it through unchanged.\n\nTest: JSTests/stress/ftl-osr-exit-materialize-phantom-array-with-live-butterfly.js\n\n* JSTests/stress/ftl-osr-exit-materialize-phantom-array-with-live-butterfly.js: Added.\n(check):\n(main.v2):\n(main):\n* Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp:\n(JSC::FTL::reboxAccordingToFormat):\n\nOriginally-landed-as: 305413.922@safari-7624.4-branch (883cc7576689). rdar://184744946\nCanonical link: https://commits.webkit.org/319094@main",
      "email": "k_tamkun@apple.com",
      "hash": "a02f99629f76ee4bc721eb5f16a1bdf7286792c3",
      "subject": "[JSC] FTL OSR exit: handle DataFormatStorage in reboxAccordingToFormat"
    },
    "319095@main": {
      "author": "Said Abou-Hallawa",
      "avatar": "https://www.gravatar.com/avatar/ae80a929a378a055822829ae63903296?d=identicon\u0026s=64",
      "cl": "319095@main",
      "clUrl": "https://commits.webkit.org/319095@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316567\nrdar://178176596\n\nReviewed by Darin Adler.\n\nThe fix of bug 313935 was incomplete. The fix was done by adding two static Locks\nto PathCG::strokeContains() and PathCG::strokeBoundingRect(). This fix makes these\ntwo functions be thread-safe independently. But this is not enough. It is possible\nto call PathCG::strokeContains() and PathCG::strokeBoundingRect() from two\ndifferent threads at the same time.\n\nThe fix is to make scratchContext() return a thread-specific graphics context.\nSo two threads can't access the same context at the same time.\n\nTest: fast/canvas/offscreen-isPointInStroke-svg-stroke-bounds-race-crash.html\n\n* LayoutTests/fast/canvas/offscreen-isPointInStroke-svg-stroke-bounds-race-crash-expected.txt: Added.\n* LayoutTests/fast/canvas/offscreen-isPointInStroke-svg-stroke-bounds-race-crash.html: Added.\n* Source/WebCore/platform/graphics/cg/PathCG.cpp:\n(WebCore::scratchContext):\n(WebCore::PathCG::strokeContains const):\n(WebCore::PathCG::strokeBoundingRect const):\n\nOriginally-landed-as: 305413.920@safari-7624.4-branch (6ab6f0e16b4d). rdar://184744291\nCanonical link: https://commits.webkit.org/319095@main",
      "email": "said@apple.com",
      "hash": "2917a663b046e5d58a97db8eb33a938a27a49161",
      "subject": "PathCG should use thread-safe scratchContext"
    },
    "319096@main": {
      "author": "Antti Koivisto",
      "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64",
      "cl": "319096@main",
      "clUrl": "https://commits.webkit.org/319096@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321598\nrdar://184722866\n\nReviewed by Sam Weinig.\n\nCurrently all custom properties on the same element share the same random() value.\n\nA property-scoped random key carried only a CSSPropertyID, which is CSSPropertyCustom for all of\nthem. Pair the name with the id, taking it from the declaration being parsed for random() and from\nBuilderState for random-item(), which until now refused a property scope inside a custom property\nrather than share incorrectly.\n\nA key naming a function's result or local still cannot tell two functions apart.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-computed.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-in-if.tentative-expected.txt:\n* Source/WebCore/css/CSSRandomKeyParser.h:\n* Source/WebCore/css/calc/CSSCalcRandomSharing.h:\n(WebCore::CSSCalc::add):\n* Source/WebCore/css/calc/CSSCalcTree+Parser.cpp:\n(WebCore::CSSCalc::consumeRandom):\n* Source/WebCore/css/parser/CSSPropertyParser.cpp:\n(WebCore::CSSPropertyParser::parseTypedCustomPropertyValue):\n* Source/WebCore/css/parser/CSSPropertyParserState.h:\n* Source/WebCore/style/StyleBuilderState.cpp:\n(WebCore::Style::BuilderState::customPropertyName const):\n* Source/WebCore/style/StyleBuilderState.h:\n* Source/WebCore/style/StyleSubstitutionResolver.cpp:\n(WebCore::Style::SubstitutionResolver::randomItemBaseValue):\n(WebCore::Style::randomKeyHasExplicitPropertyScope): Deleted.\n\nCanonical link: https://commits.webkit.org/319096@main",
      "email": "antti@apple.com",
      "hash": "fb50bab0720850e2f8e9370afe9966af050f743f",
      "subject": "[css-values-5] Include the custom property name in the random() caching key"
    },
    "319097@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "319097@main",
      "clUrl": "https://commits.webkit.org/319097@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=316849\u003e\n\u003crdar://177901870\u003e\n\nReviewed by Simon Fraser.\n\nThe GPU process can crash while drawing the image-controls (services\nrollover) button on its per-connection RemoteRenderingBackend work\nqueues.  Each RemoteGraphicsContext installs its own per-context\nControlFactory override for the duration of a draw, so the factory\nitself is not shared across work-queue threads.\n\n`ControlFactoryMac::servicesRolloverButtonCell()` is the one cell\naccessor that defeats that isolation.  It caches the cell returned by\n`+[NSServicesRolloverButtonCell serviceRolloverButtonCellForStyle:]`,\nwhich is a process-wide singleton, so every per-context factory ends up\ncaching and drawing the SAME AppKit cell.  Configuring that shared cell\non one work-queue thread races with drawing it on another, and `NSCell`\nis not thread-safe.\n\nGive each factory a private copy of the cell, so it is only ever touched\nby that factory's single work-queue thread.  `-[NSButtonCell\ncopyWithZone:]` gives the copy a nil visual provider -- the state whose\nconcurrent mutation crashes -- so the copy shares nothing mutable with\nthe shared cell, and drawing it needs no lock.\n\nThe copy itself must be serialized under a process-wide lock because\n`-[NSButtonCell copyWithZone:]` transiently mutates its source, so\nconcurrent first-access copies of the shared cell would otherwise race.\n\nNo new tests since this change is not directly testable.\n\n* Source/WebCore/platform/graphics/mac/controls/ControlFactoryMac.mm:\n(WebCore::ControlFactoryMac::servicesRolloverButtonCell const):\n\nOriginally-landed-as: 305413.939@safari-7624.4-branch (4620ee2b5925). rdar://184744679\nCanonical link: https://commits.webkit.org/319097@main",
      "email": "ddkilzer@apple.com",
      "hash": "4c7a59d2a5e1c7ecd6b137cf3a02ba24c422b44f",
      "subject": "GPU process crash in WebCore::ControlFactoryMac::servicesRolloverButtonCell() drawing image controls"
    },
    "319098@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "319098@main",
      "clUrl": "https://commits.webkit.org/319098@main",
      "description": "rdar://181124228\n\nReviewed by Jean-Yves Avenard and David Kilzer.\n\nWe are seeing crashes when calling Event::Wait(kForever) with the following principles:\n- Event::Wait(kForever) is returning earlier than expected as the main thread should be blocked on the executing of the event task.\n- Event::Wait(kForever) is doing a 3 seconds wait, then, if not yet settled, a forever wait, but only in case the 3 seconds wait is ETIMEDOUT.\n- Some crashes show that the process lifetime was less than 3 seconds, which shows that the 3 seconds wait is returning earlier than 3 seconds, so not as ETIMEDOUT.\n\nTo prevent this, we change how wait is done.\nInstead of returning once pthread_cond_timedwait returns, we now only return if pthread_cond_timedwait returns ETIMEDOUT.\nAny other returned value will trigger a new pthread_cond_timedwait call so that we wait for the actual timeout (3 seconds or forever for instance) or for the task being executed.\nWe add some logging as this may help further investigations.\n\nLooking at Chromium code, they override the webrtc::Event class with their own version.\nAs a follow-up, we should probably do the same and use a simple BinarySemaphore approach (at least for forever calls).\n\n* Source/ThirdParty/libwebrtc/Source/webrtc/rtc_base/event.cc:\n\nOriginally-landed-as: 305413.1104@safari-7624.5-branch (3c99db1f1186). rdar://184745065\nCanonical link: https://commits.webkit.org/319098@main",
      "email": "youenn@apple.com",
      "hash": "d1ce9f5c801df2fe914a578b6c8b51e7f6aa0220",
      "subject": "Crash in libwebrtc.dylib:  void absl::internal_any_invocable::LocalInvoker\u003cfalse, void, webrtc::MethodCall\u003cwebrtc::PeerConnectionInterface, void, webrtc::CreateSessionDescriptionObserver*"
    },
    "319099@main": {
      "author": "Jean-Yves Avenard",
      "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64",
      "cl": "319099@main",
      "clUrl": "https://commits.webkit.org/319099@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321429\nrdar://184503400\n\nReviewed by Eric Carlson.\n\nREGRESSION(317782@main): HTMLMediaElement's internal play steps must run synchronously\n\nThe test seeks an ended element back to the start and calls play() while that seek is still in flight.\nIt expected play, playing, seeking, seeked, ended; with site isolation enabled it got play, seeking,\nseeked, playing, ended.\n\n317782@main moved the internal play steps' notify about playing and resolve pending play promises out\nof playInternal() and into the completion handler of clientWillBeginPlayback(). Per spec those steps\nare synchronous: HTML 4.8.11.8 \"Playing the media resource\" has the internal play steps queue the play\nevent (step 3.3) and then, depending on readyState, either queue waiting or notify about playing\n(step 3.4), all before play() returns. Once the session admission had to cross to the UI process, the\nseek the element had already enqueued completed first and fired seeking and seeked ahead of playing.\n\nThe same split, which 304036@main introduced by replacing a synchronous clientWillBeginPlayback() check\nthat already sat ahead of them, also left step 1 (invoke the resource selection algorithm), step 2 (seek\nto the earliest possible position when playback has ended) and step 5 (clear the can autoplay flag)\nrunning from the reply. None of the three depend on whether the session admits playback, so they run\nsynchronously again, in spec order. Only updatePlayState(), which starts the player, still waits for the\nreply.\n\nTo resolve the event order, we are taking a hybrid approach:\nthe play, playing and waiting events are queued synchronously, as the spec states.\nA page that needs to know playback has actually started can do what it did before play()\nreturned a promise and wait for playing followed by timeupdate. The play promises, on the other hand,\nare resolved from the admission reply. That deviates from the spec, which resolves them in the same\ntask that fires playing, but it is hard to observe: promise reactions never run synchronously, they run\nin a microtask after the promise is resolved, so a playing handler runs before the play() promise's\nreaction either way. What changes is that the promise settles a task later, and therefore its ordering\nagainst unrelated tasks.\n\nscheduleNotifyAboutPlaying() takes a ShouldResolvePlayPromises argument so the queued task can fire\nplaying while leaving the promises pending; the readyState transitions that also notify about playing\nkeep settling them. m_playRequest is renamed m_beginPlaybackRequest, since it tracks the\nclientWillBeginPlayback() reply rather than play().\n\nWe can revert 318932@main, whose shouldSeekToStart parameter carried step 2's decision across the reply:\nwith the step itself back in playInternal() there is nothing to carry, so the parameter and its plumbing are removed\nas endedPlayback() is false while currentTime is still short of the duration, so no seek is\nissued at all.\n\nQueueing the events synchronously left three kinds of work on the reply side that JS can now observe at\nthose events, which sixteen media tests caught without site isolation.\n\n1) Eleven of them reported an unhandled AbortError, or NotAllowedError for\n    media/video-main-content-allow-then-deny.html: the play promises settle from the reply, so\n    pauseInternal() rejected a promise the reply was about to resolve.\n\n2) media/video-concurrent-playback.html and media/video-multiple-concurrent-playback.html paused the\n    wrong element. A page that calls play() from a 'playing' handler leaves two admissions in flight, and\n    enforceConcurrentPlaybackRestriction() ran from each completion, so the earlier admission's\n    enforcement paused the element the later one had just started.\n\n3) Four tests read state that updatePlayState() sets from the reply: usage.isPlaying and\n    userHasPlayedAudioBefore in media/media-usage-state.html, pageMediaState() in\n    media/video-is-playing-audio-after-load.html, and webkitDisplayingFullscreen in\n    media/video-playsinline.html and media/video-fullscreen-only-playback.html.\n\nFor 1), 317907@main's m_playPromiseSettlementGuaranteed stays: pauseInternal() must not reject a promise\nthe reply will settle. For 2), a session enforces the restriction on completion only while it is still\nthe current session, and a session whose own admission is in flight counts as playing so the current one\ncan pause it. For 3), notifyAboutPlaying() reports the element as playing, playInternal() enters\nfullscreen when playback requires it, and the media usage snapshot reads the element's playing state\nrather than the session's, as the two neighbouring fields in that snapshot already do.\n\nThis fixes media/video-seek-after-end-play.html and\nplatform/mac/media/audio-session-category-video-track-change.html under site isolation; the latter's\nassert runs on the playing event, which no longer waits for the category the admission reply applies.\n\nmedia/video-multiple-concurrent-playback.html's baseline dates from webkit.org/b/162366 and omitted the\nfourth video's playing event, which recorded the behaviour of the time: another element's concurrency\npause was queued ahead of the element's own playing event. The baseline gains that event.\n\nmedia/video-is-playing-audio-after-load.html and media/video-main-content-allow-then-deny.html now catch\ntheir play promise. A load() that tears the element down and a policy denial both reject a promise that\nstays pending until the media session admits playback.\n\nmedia/ios/short-audio-now-playing.html reported an unhandled AbortError on iOS. It\ncalled play() without awaiting the promise and read the now-playing registration\nat the 'playing' event, which is now queued during the internal play steps. The\npromise was therefore still pending when the test assigned the second source, and\nload() rejected it through prepareForLoad()'s cancelPendingEventsAndCallbacks().\nThe test now awaits play(), which settles where the 'playing' event used to and\nafter MediaSessionManagerCocoa::sessionWillBeginPlayback() has scheduled the\nsession status update that registers the application.\n\nmedia/video-concurrent-playback.html still fails with site isolation enabled and is left for a follow-up:\nits assertion runs in the second element's 'playing' handler, one round trip before the UI process can\npause the first.\n\nFly-by fix: RemoteMediaSessionManagerProxy::setCurrentSession() called\nPlatformMediaSessionManager::setCurrentSession() directly, which only reorders the\nsession list. It now calls the base class, so the supported remote-control commands\nare refreshed for the session that has become current, as they are for an\nin-process manager.\n\n* LayoutTests/media/ios/short-audio-now-playing-expected.txt:\n* LayoutTests/media/ios/short-audio-now-playing.html:\n* LayoutTests/media/video-is-playing-audio-after-load-expected.txt:\n* LayoutTests/media/video-is-playing-audio-after-load.html:\n* LayoutTests/media/video-main-content-allow-then-deny.html:\n* LayoutTests/media/video-multiple-concurrent-playback-expected.txt:\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::~HTMLMediaElement):\n(WebCore::HTMLMediaElement::scheduleNotifyAboutPlaying): Optionally leave the pending play promises for\nthe caller to settle.\n(WebCore::HTMLMediaElement::notifyAboutPlaying): Report the element as playing.\n(WebCore::HTMLMediaElement::completePlayInternal): Keep only what needs the admission reply.\n(WebCore::HTMLMediaElement::playInternal): Run the resource selection, the seek to the earliest possible\nposition, the readyState-dependent event and the can autoplay flag synchronously; enter fullscreen when\nplayback requires it; settle the play promises from the admission reply.\n(WebCore::HTMLMediaElement::pauseInternal): Don't reject a promise the reply will settle.\n* Source/WebCore/html/HTMLMediaElement.h:\n* Source/WebCore/html/MediaElementSession.cpp:\n(WebCore::MediaElementSession::updateMediaUsageIfChanged): Report the element's playing state.\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.cpp:\n(WebCore::MediaSessionManagerInterface::sessionWillBeginPlayback): Enforce the concurrent playback\nrestriction only while this session is the current one.\n(WebCore::MediaSessionManagerInterface::enforceConcurrentPlaybackRestriction): Treat a session whose\nadmission is in flight as playing.\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.cpp:\n(WebKit::RemoteMediaSessionManagerProxy::setCurrentSession): Call the base cocoa class.\n\nCanonical link: https://commits.webkit.org/319099@main",
      "email": "jya@apple.com",
      "hash": "f4f72c4ed99a8af354eeb7d7005540fc43a34da3",
      "subject": "[site-isolation] media/video-seek-after-end-play.html is a permanent failure"
    },
    "319100@main": {
      "author": "Lauro Moura",
      "avatar": "https://www.gravatar.com/avatar/6157f52d61e04c2c63fe7ff668ba69b3?d=identicon\u0026s=64",
      "cl": "319100@main",
      "clUrl": "https://commits.webkit.org/319100@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318434\n\nUnreviewed test gardening.\n\nThis test has been passing since around 318630@main, and the assertions\non didReceiveReceiveMessage were related to the ipc/send-filter.html\ntest, running immediately before, sending a test message and not\nawaiting/invalidating on exit. As it also has other issues, let's also\nskip send-filter (like its \"sibling\" send-gradient.html, gardened in\n314708@main).\n\n* LayoutTests/platform/glib/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319100@main",
      "email": "lmoura@igalia.com",
      "hash": "3372d778118e724b3368bff583e98d790cb7398c",
      "subject": "[WPE][GTK] `ipc/send-gpu-GetShareableBitmap-RemoteRenderingBackend.html` is almost constant crash with assertions enabled"
    },
    "319101@main": {
      "author": "Said Abou-Hallawa",
      "avatar": "https://www.gravatar.com/avatar/ae80a929a378a055822829ae63903296?d=identicon\u0026s=64",
      "cl": "319101@main",
      "clUrl": "https://commits.webkit.org/319101@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316594\nrdar://171846032\n\nReviewed by Simon Fraser.\n\nHTMLCanvasElement::captureStream() allows streaming a canvas's output to a \u003cvideo\u003e\nelement. The track frames of this video is obtained from CanvasCaptureMediaStreamTrack\n::grabFrame(). This function unconditionally gets a VideoFrame by calling\nHTMLCanvasElement::toVideoFrame().\n\nIf cross-origin images are drawn into the canvas, this canvas has to be tainted.\nSo no getImageData() can see the pixels of the cross-origin images.\n\n* LayoutTests/http/tests/canvas/canvas-tainted-image-capture-video-frame-expected.html: Added.\n* LayoutTests/http/tests/canvas/canvas-tainted-image-capture-video-frame.html: Added.\n* LayoutTests/http/tests/canvas/resources/cross-origin-image-capture-video-frame.html: Added.\n* Source/WebCore/Modules/mediastream/CanvasCaptureMediaStreamTrack.cpp:\n(WebCore::CanvasCaptureMediaStreamTrack::Source::grabFrame):\n(WebCore::CanvasCaptureMediaStreamTrack::Source::captureCanvas):\n\nOriginally-landed-as: 305413.925@safari-7624.4-branch (723dbeacf061). rdar://184744428\nCanonical link: https://commits.webkit.org/319101@main",
      "email": "said@apple.com",
      "hash": "9391ef101e6d253ddb0dd0f8764eeb13d856a0bb",
      "subject": "When captured as a video frame, canvas has to be tainted if cross-origin image are drawn into it"
    },
    "319102@main": {
      "author": "Said Abou-Hallawa",
      "avatar": "https://www.gravatar.com/avatar/ae80a929a378a055822829ae63903296?d=identicon\u0026s=64",
      "cl": "319102@main",
      "clUrl": "https://commits.webkit.org/319102@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321640\nrdar://184767470\n\nReviewed by Jean-Yves Avenard.\n\nPer the spec[1], WebCodecsImageDecoder should not inherit from any base class,\nbut it still needs to implement the [[control message queue]] behavior.\n\nThis PR splits WebCodecsBase into two classes: a new WebCodecsControlMessageQueue,\nwhich holds the control-message-queue logic and does not inherit EventTarget,\nand WebCodecsBase itself, which now inherits both WebCodecsControlMessageQueue\nand EventTarget and exposes Event-dispatching methods to the other web codec\ndecoders/encoders.\n\nWebCodecsImageDecoder can now inherit WebCodecsControlMessageQueue directly,\nwithout pulling in EventTarget. Other web codec decoders/encoders still inherit\nWebCodecsBase without any change.\n\n[1] https://w3c.github.io/webcodecs/#imagedecoder-interface\n\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/idlharness.https.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/idlharness.https.any.worker-expected.txt:\n* Source/WebCore/Modules/webcodecs/WebCodecsBase.cpp:\n(WebCore::WebCodecsBase::scriptExecutionContext const):\n(WebCore::WebCodecsBase::clearControlMessageQueueAndMaybeScheduleDequeueEvent):\n(WebCore::WebCodecsBase::decrementCodecQueueSizeAndScheduleDequeueEvent):\n(WebCore::WebCodecsBase::scheduleDequeueEvent):\n(WebCore::WebCodecsBase::WebCodecsBase): Deleted.\n(WebCore::WebCodecsBase::queueControlMessageAndProcess): Deleted.\n(WebCore::WebCodecsBase::processControlMessageQueue): Deleted.\n(WebCore::WebCodecsBase::incrementCodecQueueSize): Deleted.\n(WebCore::WebCodecsBase::decrementCodecOperationCountAndMaybeProcessControlMessageQueue): Deleted.\n(WebCore::WebCodecsBase::clearControlMessageQueue): Deleted.\n(WebCore::WebCodecsBase::blockControlMessageQueue): Deleted.\n(WebCore::WebCodecsBase::unblockControlMessageQueue): Deleted.\n(WebCore::WebCodecsBase::virtualHasPendingActivity const): Deleted.\n* Source/WebCore/Modules/webcodecs/WebCodecsBase.h:\n(WebCore::WebCodecsBase::state const): Deleted.\n(WebCore::WebCodecsBase::setState): Deleted.\n(WebCore::WebCodecsBase::codecQueueSize const): Deleted.\n(WebCore::WebCodecsBase::maximumCodecOperationsEnqueued const): Deleted.\n(WebCore::WebCodecsBase::incrementCodecOperationCount): Deleted.\n(WebCore::WebCodecsBase::isCodecSaturated const): Deleted.\n* Source/WebCore/Modules/webcodecs/WebCodecsControlMessage.h:\n* Source/WebCore/Modules/webcodecs/WebCodecsControlMessageQueue.cpp: Copied from Source/WebCore/Modules/webcodecs/WebCodecsBase.cpp.\n(WebCore::WebCodecsControlMessageQueue::WebCodecsControlMessageQueue):\n(WebCore::WebCodecsControlMessageQueue::queueControlMessageAndProcess):\n(WebCore::WebCodecsControlMessageQueue::queueCodecControlMessageAndProcess):\n(WebCore::WebCodecsControlMessageQueue::processControlMessageQueue):\n(WebCore::WebCodecsControlMessageQueue::incrementCodecQueueSize):\n(WebCore::WebCodecsControlMessageQueue::decrementCodecQueueSize):\n(WebCore::WebCodecsControlMessageQueue::resetCodecQueueSize):\n(WebCore::WebCodecsControlMessageQueue::decrementCodecOperationCountAndMaybeProcessControlMessageQueue):\n(WebCore::WebCodecsControlMessageQueue::clearControlMessageQueue):\n(WebCore::WebCodecsControlMessageQueue::blockControlMessageQueue):\n(WebCore::WebCodecsControlMessageQueue::unblockControlMessageQueue):\n(WebCore::WebCodecsControlMessageQueue::virtualHasPendingActivity const):\n* Source/WebCore/Modules/webcodecs/WebCodecsControlMessageQueue.h: Copied from Source/WebCore/Modules/webcodecs/WebCodecsBase.h.\n(WebCore::WebCodecsControlMessageQueue::state const):\n(WebCore::WebCodecsControlMessageQueue::setState):\n(WebCore::WebCodecsControlMessageQueue::codecQueueSize const):\n(WebCore::WebCodecsControlMessageQueue::maximumCodecOperationsEnqueued const):\n(WebCore::WebCodecsControlMessageQueue::incrementCodecOperationCount):\n(WebCore::WebCodecsControlMessageQueue::isCodecSaturated const):\n* Source/WebCore/Modules/webcodecs/WebCodecsImageDecoder.cpp:\n(WebCore::WebCodecsImageDecoder::WebCodecsImageDecoder):\n(WebCore::WebCodecsImageDecoder::resetDecoder):\n* Source/WebCore/Modules/webcodecs/WebCodecsImageDecoder.h:\n* Source/WebCore/Modules/webcodecs/WebCodecsImageDecoder.idl:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/dom/EventTargetFactory.in:\n\nCanonical link: https://commits.webkit.org/319102@main",
      "email": "said@apple.com",
      "hash": "2e6b976d8f8364f0cb569ace2a5416f98aeb20a4",
      "subject": "WebCodecsImageDecoder should not inherit from EventTarget"
    },
    "319103@main": {
      "author": "Brent Fulgham",
      "avatar": "https://www.gravatar.com/avatar/c6989a65afef0d015b55c65406e37ccc?d=identicon\u0026s=64",
      "cl": "319103@main",
      "clUrl": "https://commits.webkit.org/319103@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=311660\nrdar://problem/174251766\n\nReviewed by Brandon Stewart.\n\nRevert 303093@main since the User Interface information to instruct the user to hold\nthe ESC key for 1.5 seconds (or longer) was not completed. This can lead to confusion\nand the possibility of spoofing users. We will reland the enablement when the UI portion\nis available.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nOriginally-landed-as: 305413.885@safari-7624.4-branch (2f7b2e8b7f9f). rdar://184744958\nCanonical link: https://commits.webkit.org/319103@main",
      "email": "bfulgham@apple.com",
      "hash": "1ab2bb4ff37e91e0143b8ff9035cb559ea73ede4",
      "subject": "Escape key no longer guarantees cancelling fullscreen (with keyboard lock) (311660)"
    },
    "319104@main": {
      "author": "Yijia Huang",
      "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64",
      "cl": "319104@main",
      "clUrl": "https://commits.webkit.org/319104@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321661\nrdar://184788558\n\nReviewed by Yusuke Suzuki.\n\nmonthDayFromFields was one function with hand-written ISO and non-ISO branches, each re-deriving the\nmonth/day clamp and reference-year logic independently. Split it so each spec AO has its own\nfunction (ecmaReferenceYearWithRegularFallback, nonISOMonthDayToISOReferenceDate,\nmonthDayToISOReferenceDate), delegating to nonISOCalendarDateToISO instead of re-deriving its logic\nby hand, and drops the ISO path's now-unnecessary leap/non-leap proxy-year substitution.\n\nAlso unifies isoToCalendarFields's roc/buddhist/japanese handling so japanese stops opening ICU only\nto discard every field it reads, and gives nonISOCalendarDateToISO an effectiveMonth fallback for\nits one caller that now supplies a monthCode with no ordinal.\n\nNo intended behavior change.\n\nCanonical link: https://commits.webkit.org/319104@main",
      "email": "yijia_huang@apple.com",
      "hash": "1375d28c26b39005f5ddbfa23087a59e120c1673",
      "subject": "[JSC][Temporal] Give CalendarMonthDayToISOReferenceDate and NonISOMonthDayToISOReferenceDate their own functions"
    },
    "319105@main": {
      "author": "Alexey Proskuryakov",
      "avatar": "https://www.gravatar.com/avatar/c66a0fa7958ae738ab34d596994091a4?d=identicon\u0026s=64",
      "cl": "319105@main",
      "clUrl": "https://commits.webkit.org/319105@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=302895\nrdar://165498647\n\nReviewed by Brady Eidson and Alex Christensen.\n\nActivating a link with a download attribute runs \"download the hyperlink\" [1], not \"navigate\", and its\nsteps run in parallel with the navigable. WebKit instead routed it through the frame's single navigation\npolicy slot, so the fragment navigation in FrameLoader::loadURL() called PolicyChecker::stopCheck(), which\nanswered every outstanding check with PolicyAction::Ignore. The download's decision then never arrived as\nPolicyAction::Download, so startDownload() was never called and nothing happened.\n\nThere are two such cancellations, in both processes, and both have to go. In the web process\nPolicyChecker::stopCheck() answers every outstanding check with Ignore. In the UI process WebFrameProxy\nkeeps one policy listener per frame and setUpPolicyListenerProxy() resolves the previous one with\nignore(), so the navigation's check displaces the download's there regardless of what the web process\ndoes. Download checks are now kept out of both.\n\nA download check therefore outlives the navigation that started it, so record the document that\ninitiated it and only honor it while that document is still the one in this frame and the frame is\nstill in a page.\n\nThe frame check avoids a crash: detaching a frame starts no navigation, so nothing else answers the check\nand the decision arrives for a frame that has left its page. The document check matters because\nPolicyChecker decides against the frame's live state, including the sandbox allow-downloads flag that\nLocalFrame::effectiveSandboxFlags() takes from the current document. Keeping the check out of the UI\nprocess cancellation is what makes that reachable: a decision can now arrive after another document has\ncommitted, and would otherwise be evaluated against it.\n\nAlso stop a late decision from tearing down a newer navigation.\n\nThe policy delegate is still consulted for these loads: WKNavigationAction's shouldPerformDownload is\nunchanged, and both Download and Allow are still honored. Allow is honored in one case where it was\npreviously dropped, since the check it belongs to is no longer cancelled.\n\nWebKitLegacy is left unfixed: its WebFrameLoaderClient::cancelPolicyCheck() invalidates a single\npolicy listener and cannot tell a download check apart.\n\n[1] https://html.spec.whatwg.org/multipage/links.html#downloading-hyperlinks\n\nTests: TestWebKitAPI.WKDownload.DownloadAttributeAllowedByClientIsANavigation\n       TestWebKitAPI.WKDownload.DownloadAttributeSurvivesLaterNavigation\n       fast/dom/HTMLAnchorElement/anchor-download-in-detached-frame.html\n       fast/dom/HTMLAnchorElement/anchor-download-not-cancelled-by-cross-document-navigation.html\n       fast/dom/HTMLAnchorElement/anchor-download-not-cancelled-by-fragment-navigation.html\n       fast/dom/HTMLAnchorElement/anchor-download-not-cancelled-by-nested-click.html\n\n* Source/WebCore/loader/FrameLoader.cpp:\n(WebCore::FrameLoader::loadWithDocumentLoader): Don't continue once a newer navigation owns the policy\ndocument loader, which hits the entry assertion in continueLoadAfterNavigationPolicy() and tears down that\nnewer navigation. Only a check that survived cancellation can get there.\n\n* Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:\n(WebKit::WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction): Record the document initiating a\ndownload attribute check.\n\n* Source/WebKit/UIProcess/WebFrameProxy.cpp:\n(WebKit::WebFrameProxy::webProcessWillShutDown): Answer download checks, which navigation no longer\ncancels, so their replies are not lost with the frame.\n(WebKit::WebFrameProxy::setUpPolicyListenerProxy): Keep download checks in their own list so they neither\ndisplace the navigation check nor are displaced by it.\n* Source/WebKit/UIProcess/WebFrameProxy.h: Added IsDownloadPolicyCheck and the list of outstanding download\nlisteners. They are keyed by an ID rather than held in a single member because, unlike navigation checks,\nseveral can be outstanding at once now that none of them displaces another.\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::decidePolicyForNavigationAction): Mark a check for an action with a download\nattribute.\n(WebKit::WebPageProxy::decidePolicyForNewWindowAction): Neither of these can be a download attribute\ncheck, so both pass No.\n(WebKit::WebPageProxy::decidePolicyForResponseShared): Ditto.\n\n* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:\n(WebKit::WebFrame::invalidate): Answer any check still outstanding, rather than destroying its\nCompletionHandler. Navigation used to have cancelled them all by this point. No test: for frame detach the\npage condition above already cancels the check first, and I could not find another path that reaches here\nwith one outstanding.\n(WebKit::WebFrame::setUpPolicyListener): Store it.\n(WebKit::WebFrame::shouldHonorDownloadAttributePolicyCheck): Added.\n(WebKit::WebFrame::invalidatePolicyListeners): Leave still-valid download attribute checks outstanding\nrather than ignoring them. Reinstate them before cancelling the rest, as cancelling can add checks back.\n(WebKit::WebFrame::didReceivePolicyDecision): Ignore a download attribute check that should no longer be\nhonored, and skip navigationID and origin-keying only when the decision is actually Download - answering\nUse for such a link makes it an ordinary navigation. Answer rather than drop a check for a frame whose\ncore frame is gone, which previously left an uncalled CompletionHandler behind.\n\n* Source/WebKit/WebProcess/WebPage/WebFrame.h: Added the initiating document to PolicyCheck and to\nsetUpPolicyListener(). It is a Markable rather than a separate flag plus an identifier so that a download\nattribute check cannot exist without the document it has to be validated against, and so that its presence\nis what tells such a check apart from a navigation one. Declared\nshouldHonorDownloadAttributePolicyCheck().\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/Download.mm:\n(TEST(WKDownload, DownloadAttributeAllowedByClientIsANavigation)): Added. Clicks a download attribute link\nthat the navigation delegate answers Use for, and checks the client is given the same non-null WKNavigation\non didStartProvisionalNavigation and didFinishNavigation. Skipping navigationID for such a check leaves the\nUI process unable to match the load to its API::Navigation, and both are null. Serves both documents from\none custom scheme so the attribute is not dropped as cross origin, and as displayable HTML so the load\ncommits rather than becoming a download at the response stage.\n(TEST(WKDownload, DownloadAttributeSurvivesLaterNavigation)): Added. The delegate does not answer the\ndownload decision when asked: it holds it until a later navigation of the same frame has been decided, then\nanswers Download, and the test checks the file is written. Holding it is what leaves the decision\noutstanding while the frame navigates, which is the state both cancellations destroy. A delegate that\nanswers immediately never reaches that state, which is also why WebKitTestRunner, and so any layout test,\ncannot cover the UI process half.\n\n* LayoutTests/fast/dom/HTMLAnchorElement/anchor-download-in-detached-frame-expected.txt: Added.\n* LayoutTests/fast/dom/HTMLAnchorElement/anchor-download-in-detached-frame.html: Added. Clicks a download\nattribute link in a subframe and then removes the subframe, and checks that nothing crashes and no download\ncallbacks are logged. The decision arrives for a frame that has left its page, which is the one thing\nnavigation no longer does for us.\n\n* LayoutTests/fast/dom/HTMLAnchorElement/anchor-download-not-cancelled-by-cross-document-navigation-expected.txt: Added.\n* LayoutTests/fast/dom/HTMLAnchorElement/anchor-download-not-cancelled-by-cross-document-navigation.html: Added.\nA subframe clicks a download attribute link and then activates a link to another document. Child frames are\ndumped, so this checks both that the download completes and that the subframe reaches the second document.\nActivating a link navigates synchronously, unlike assigning location.href, so the newer navigation owns the\npolicy document loader before the decision arrives; without the FrameLoader change that decision tears the\nnewer navigation down and trips the assertion at the top of continueLoadAfterNavigationPolicy().\n\n* LayoutTests/fast/dom/HTMLAnchorElement/anchor-download-not-cancelled-by-fragment-navigation-expected.txt: Added.\n* LayoutTests/fast/dom/HTMLAnchorElement/anchor-download-not-cancelled-by-fragment-navigation.html: Added.\nClicks a download attribute link and then sets location.hash, and checks the download still starts and\nfinishes. This is the reduced form of the bug: no nesting is involved. The hash toggles between two values\nso it stays a real fragment navigation whatever fragment the document was loaded with, which keeps the test\nworking when it is repeated.\n\n* LayoutTests/fast/dom/HTMLAnchorElement/anchor-download-not-cancelled-by-nested-click-expected.txt: Added.\n* LayoutTests/fast/dom/HTMLAnchorElement/anchor-download-not-cancelled-by-nested-click.html: Added. The form\nthe bug was reported in: a link with href=\"#\" whose click handler clicks a download attribute link, so the\nfragment navigation comes from the outer link's default action once the handler returns.\n\n* LayoutTests/fast/dom/HTMLAnchorElement/resources/anchor-download-then-navigate-frame-2.html: Added.\n* LayoutTests/fast/dom/HTMLAnchorElement/resources/anchor-download-then-navigate-frame.html: Added.\n\nCanonical link: https://commits.webkit.org/319105@main",
      "email": "ap@apple.com",
      "hash": "f3f75e999f1ddd211c21e69c3af81b978e4b92a0",
      "subject": "Same-frame fragment navigation that starts after a download attribute click, in the same task, cancels the download"
    },
    "319106@main": {
      "author": "Yulun Wu",
      "avatar": "https://www.gravatar.com/avatar/9e34d6632f4d926cdf6fe8dce07f9cb7?d=identicon\u0026s=64",
      "cl": "319106@main",
      "clUrl": "https://commits.webkit.org/319106@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321644\n\u003crdar://184769971\u003e\n\nReviewed by Sammy Gill.\n\nGFC supports fixed max-width and max-height, so we should loosen that coverage\ncheck. Tests were written to pass our avoidance checks to properly verify that\nGFC was handling these maximum sizes as expected.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-items/grid-item-fixed-max-height-001-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-items/grid-item-fixed-max-height-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-items/grid-item-fixed-max-width-001-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-items/grid-item-fixed-max-width-001.html: Added.\n* Source/WebCore/layout/formattingContexts/grid/GridLayoutUtils.cpp:\n(WebCore::Layout::GridLayoutUtils::inlineMaximumSize):\n(WebCore::Layout::GridLayoutUtils::blockMaximumSize):\n* Source/WebCore/layout/integration/grid/LayoutIntegrationGridCoverage.cpp:\n(WebCore::LayoutIntegration::printReason):\n(WebCore::LayoutIntegration::gridLayoutAvoidanceReason):\n\nCanonical link: https://commits.webkit.org/319106@main",
      "email": "yulun_wu@apple.com",
      "hash": "53f594a61dd2b5408e66fb2c27340d03b2ed05e4",
      "subject": "[GFC] Loosen the max-width and max-height avoidance reasons"
    },
    "319107@main": {
      "author": "Yury Semikhatsky",
      "avatar": "https://www.gravatar.com/avatar/d0aee26d9689e84bd1a7f0ed8f262fe1?d=identicon\u0026s=64",
      "cl": "319107@main",
      "clUrl": "https://commits.webkit.org/319107@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321525\n\nReviewed by Nikolas Zimmermann.\n\nThe GTK port no longer uses libwpe or wpebackend-fdo at all, and WPE port\nbuilds with ENABLE_WPE_PLATFORM don't need them either. Only the legacy\nAPI (ENABLE_WPE_LEGACY_API) requires them, with requirements every\nsupported distribution satisfies: libwpe with no minimum version and\nwpebackend-fdo \u003e= 1.3.0.\n\nThe minimal moduleset is meant to build only what the distribution cannot\nprovide, and these entries lack the \u003cpkg-config\u003e line that would prefer\nthe system copy, so they were always built from source. Remove them;\nlegacy-API builds pick up the distribution packages instead.\n\n* Tools/jhbuild/jhbuild-minimal.modules:\n\nCanonical link: https://commits.webkit.org/319107@main",
      "email": "yurys@chromium.org",
      "hash": "5c8e3bb7ccb66c23b5d1960f7e150b13d49d138a",
      "subject": "[JHBuild] Minimal moduleset should not build libwpe and wpebackend-fdo"
    },
    "319108@main": {
      "author": "Carlos Alberto Lopez Perez",
      "avatar": "https://www.gravatar.com/avatar/05326c1dbe06f486e884975e73f25179?d=identicon\u0026s=64",
      "cl": "319108@main",
      "clUrl": "https://commits.webkit.org/319108@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321672\n\nReviewed by Justin Michaud.\n\nWe use this env var on the CI bots to tell the test runner how much parallelism it\ncan use, so WTF::numberOfProcessorCores() should honor that if set.\n\nThe other env var honored there which is named \"WTF_numberOfProcessorCores\" was\nadded on 185692@main and I don't see it used anywhere, but I kept it out of\nprecaution and with higher priority than NUMBER_OF_PROCESSORS.\n\n* Source/WTF/wtf/NumberOfCores.cpp:\n(WTF::numberOfProcessorCores):\n\nCanonical link: https://commits.webkit.org/319108@main",
      "email": "clopez@igalia.com",
      "hash": "5fc5182bcf83571abe6b499cba9a871202086606",
      "subject": "[WTF] numberOfProcessorCores() should honor the env var NUMBER_OF_PROCESSORS if set"
    },
    "319109@main": {
      "author": "Yijia Huang",
      "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64",
      "cl": "319109@main",
      "clUrl": "https://commits.webkit.org/319109@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321622\nrdar://184750925\n\nReviewed by Yusuke Suzuki.\n\nstringCopySameType tiers by length: SIMD at the vector stride, an 8-byte SWAR\nloop below that, then a per-character loop. Short JSON property names fall into\nthe lower tiers.\n\nAdd a 4-7 byte tier: copy the first and last four bytes, packed into one 64-bit\nword and validated by the existing eightByteRangeNeedsJSONEscape. The two\nfour-byte windows overlap below 8 bytes, but they rewrite the repeated bytes\nwith the same values, and duplicates cannot change the escape verdict. Only\nBufferMode::DynamicBuffer enables the tier, leaving StaticBuffer's inlined code\nunchanged; the 16-bit site is left out since the tier is Latin1-only.\n\nWhere SIMD is compiled in, the 8-byte tier only ever sees 8-15 bytes, so its\nloop always runs exactly once. Replace it with the same two-window form in both\nstringCopySameType and stringCopyUpconvert, dropping a backedge and a tail\nbranch from each. A static_assert ties this to the SIMD threshold: two narrow\nstrides must cover whatever the SIMD tier leaves behind. narrowStride counts\nelements, so in stringCopyUpconvert one window advances the source by eight\nbytes and the destination by sixteen.\n\nAlso name that threshold condition JSON_STRING_COPY_HAS_SIMD instead of\nrepeating it three times, and hoist narrowStride to file scope as\nsizeof(uint64_t), which is what the eight-byte helpers actually operate on.\nstringCopyUpconvert now uses it in place of a bare 8.\n\nCanonical link: https://commits.webkit.org/319109@main",
      "email": "yijia_huang@apple.com",
      "hash": "da12fb32aeb97f8774681deafc767602667934e2",
      "subject": "[JSC] Improve FastStringifier's short string copy tiers"
    },
    "319110@main": {
      "author": "Anne van Kesteren",
      "avatar": "https://www.gravatar.com/avatar/09bb44ac3625a121017cd98d0a7dc52c?d=identicon\u0026s=64",
      "cl": "319110@main",
      "clUrl": "https://commits.webkit.org/319110@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319573\n\nReviewed by Brady Eidson.\n\nIt appears these were overlooked.\n\nCanonical link: https://commits.webkit.org/319110@main",
      "email": "annevk@annevk.nl",
      "hash": "d06518f22a2ff4eac1ad0d2eb429a1c9704ed37e",
      "subject": "Mark some no-op APIs as deprecated"
    },
    "319111@main": {
      "author": "Marta Darbinyan",
      "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64",
      "cl": "319111@main",
      "clUrl": "https://commits.webkit.org/319111@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321312\nrdar://184351245\n\nUnreviewed test gardening\n\n* LayoutTests/platform/ios/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319111@main",
      "email": "darbinyan@apple.com",
      "hash": "c95278b01c6426509612901d082973890104bcd9",
      "subject": "[Gardening]: [macOS iOS] imported/w3c/web-platform-tests/webrtc/RTCRtpReceiver-getSynchronizationSources.https.html is flaky failure"
    },
    "319112@main": {
      "author": "Roberto Rodriguez",
      "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64",
      "cl": "319112@main",
      "clUrl": "https://commits.webkit.org/319112@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321342\nrdar://184376301\n\nReviewed by Dan Glastonbury.\n\n313716@main hid the test windows for ANGLEEnd2EndTests. Make hidden the\ndefault for the dEQP suites on Mac too, so long test runs don't steal focus.\n\ndEQP creates its windows in tcuANGLENativeDisplayFactory.cpp from dEQP's own\n--deqp-visibility option, which defaults to windowed. Extend the existing\nSwiftShader-only check to pass --deqp-visibility=hidden on Mac as well. Skip it\nwhen the option was already given, since dEQP rejects a command line that\nspecifies the same option twice.\n\n* Source/ThirdParty/ANGLE/src/tests/deqp_support/angle_deqp_gtest.cpp:\n\nCanonical link: https://commits.webkit.org/319112@main",
      "email": "roberto_rodriguez2@apple.com",
      "hash": "1090551beb5074aa12cdd754271c6f719f8f9371",
      "subject": "[ANGLE] Avoid showing windows for dEQP tests"
    },
    "319113@main": {
      "author": "Sam Sneddon",
      "avatar": "https://www.gravatar.com/avatar/99f6b56d9db9d32920dfcc56deae86fc?d=identicon\u0026s=64",
      "cl": "319113@main",
      "clUrl": "https://commits.webkit.org/319113@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321617\nrdar://184742480\n\nReviewed by Ryan Haddad.\n\nThis exposes `git fetch`'s output when a remote fetch fails (e.g., due\nto SAML SSO enforcement, invalid credentials, or inaccessible repos),\nbecause otherwise it's hard for users to know what is wrong.\n\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/setup.py:\n(_fetch): Capture stderr and log as warning on fetch failure.\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/test/setup_unittest.py:\n(TestSetup.test_fetch_failure): Added test verifying failure message\nsurfaces at default verbosity. This uses its own mock because we don't\nwant to make the `git fetch` fail in general.\n\nCanonical link: https://commits.webkit.org/319113@main",
      "email": "gsnedders@apple.com",
      "hash": "a09cb8ae6f37d37bd0b132de20f7e60d4e8a2dd2",
      "subject": "Log git-fetch failure output as warnings during setup"
    },
    "319114@main": {
      "author": "Kimmo Kinnunen",
      "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64",
      "cl": "319114@main",
      "clUrl": "https://commits.webkit.org/319114@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321582\nrdar://problem/184699290\n\nReviewed by Nikolas Zimmermann.\n\nLock the NativeImage::m_platformImage access, since theoretically\nreplacePlatformImage could replace the image while other threads\nwould access it. The uncontended lock is very cheap. Removes false\npositives from analysis tools.\n\nThe replacement happens as a memory optimization:\n - When sending an image from WCP to GPUP, use the GPUP-shared pixel\n   data in WCP source image. Today this is not a multithreaded case,\n   but in future will be.\n - When sending the bitmap data of GPUP generated image, use the\n   shared pixel data in the GPUP generated image. This is potentially\n   multithreaded case.\n\n* Source/WebCore/platform/graphics/NativeImage.cpp:\n(WebCore::NativeImage::platformImage const):\n(WebCore::NativeImage::replacePlatformImage const):\n* Source/WebCore/platform/graphics/NativeImage.h:\n* Source/WebCore/platform/graphics/cg/NativeImageCG.cpp:\n(WebCore::NativeImage::size const):\n(WebCore::NativeImage::hasAlpha const):\n(WebCore::NativeImage::sizeInBytes const):\n(WebCore::NativeImage::colorSpace const):\n* Source/WebCore/platform/graphics/skia/NativeImageSkia.cpp:\n(WebCore::NativeImage::size const):\n(WebCore::NativeImage::hasAlpha const):\n(WebCore::NativeImage::colorSpace const):\n(WebCore::NativeImage::uniqueID const):\n* Source/WebKit/WebProcess/GPU/graphics/RemoteNativeImageProxy.cpp:\n(WebKit::RemoteNativeImageProxy::platformImage const):\n* Source/WebKit/WebProcess/GPU/graphics/RemoteNativeImageProxy.h:\n\nCanonical link: https://commits.webkit.org/319114@main",
      "email": "kkinnunen@apple.com",
      "hash": "93848dd6cac160ace5db5e827e8a30e97bfc88a5",
      "subject": "NativeImage accesses platform image without a lock"
    },
    "319115@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "319115@main",
      "clUrl": "https://commits.webkit.org/319115@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321352\nrdar://184385585\n\nReviewed by Wenson Hsieh and Abrar Rahman Protyasha.\n\nAdd support for firing the dblclick DOM event. To do this, a new passive gesture recognizer is added\nto recognize double clicks, and then forwards to WebPage to dispatch the event if a dblclick listener exists.\n\nTo facilitate keeping track of double clicks, a new `WKDOMDoubleClickGestureRecognizer` type is introduced.\nThis is necessary instead of just setting the minimum number of clicks to two because after the first click,\nAppKit prevents any other gestures from recognizing any of the following events until that two-click GR is\nhas a chance to handle them, which is undesirable.\n\nAlso clean up and de-duplicate some tests.\n\nAlso move some related files to a new `AppKitGestures` directory.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/DoubleClickGesturesTests.swift\n\n* Source/WebKit/Modules/Internal/module.modulemap:\n* Source/WebKit/SourcesCocoa.txt:\n* Source/WebKit/UIProcess/mac/AppKitGestures/WKAppKitGestureController.h: Renamed from Source/WebKit/UIProcess/mac/WKAppKitGestureController.h.\n* Source/WebKit/UIProcess/mac/AppKitGestures/WKAppKitGestureController.mm: Renamed from Source/WebKit/UIProcess/mac/WKAppKitGestureController.mm.\n(-[WKAppKitGestureController domDoubleClickGestureRecognizer]):\n(-[WKAppKitGestureController setDomDoubleClickGestureRecognizer:]):\n(-[WKAppKitGestureController setUpGestureRecognizers]):\n(-[WKAppKitGestureController addGesturesToWebView]):\n(-[WKAppKitGestureController enableGesturesIfNeeded]):\n(-[WKAppKitGestureController ensureGesturesAreNotArchived]):\n(-[WKAppKitGestureController domDoubleClickGestureRecognized:]):\n(-[WKAppKitGestureController _updateLayerTreeTransactionIdAtLastInteractionStart]):\n(-[WKAppKitGestureController _handleClickBegan:]):\n(-[WKAppKitGestureController gestureRecognizer:shouldRecognizeSimultaneouslyWithGestureRecognizer:]):\n(-[WKAppKitGestureController gestureRecognizerShouldBegin:]):\n(-[WKAppKitGestureController _gestureRecognizer:canPreventGestureRecognizer:]):\n* Source/WebKit/UIProcess/mac/AppKitGestures/WKAppKitGestureController.swift: Renamed from Source/WebKit/UIProcess/mac/WKAppKitGestureController.swift.\n(WKAppKitGestureController.setUpDOMDoubleClickGestureRecognizer):\n* Source/WebKit/UIProcess/mac/AppKitGestures/WKDOMDoubleClickGestureRecognizer.swift: Added.\n(click):\n(state):\n(isDoubleClick):\n* Source/WebKit/UIProcess/mac/AppKitGestures/WKDirectionalScrollLockTracker.swift: Renamed from Source/WebKit/UIProcess/mac/WKDirectionalScrollLockTracker.swift.\n* Source/WebKit/UIProcess/mac/AppKitGestures/WKFastScrollTracker.swift: Renamed from Source/WebKit/UIProcess/mac/WKFastScrollTracker.swift.\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/DoubleClickGesturesTests.swift:\n(AppKitGesturesTests.doubleClickWithListenerFiresDblclickAndSelectsWord):\n(AppKitGesturesTests.doubleClickWithListenerFiresDblclickRegardlessOfEditability(_:)):\n(AppKitGesturesTests.singleClickReportsDetailOne):\n(AppKitGesturesTests.clickingTwoDifferentWordsDoesNotFireDblclick):\n(AppKitGesturesTests.doubleClickInsideExistingRangeSelectionFiresDblclick):\n(AppKitGesturesTests.doubleClickWithListenerFiresDblclick): Deleted.\n(AppKitGesturesTests.doubleClickReportsDetailTwo): Deleted.\n\nCanonical link: https://commits.webkit.org/319115@main",
      "email": "richard_robinson2@apple.com",
      "hash": "df95fbb390cb4d73277d3c40251d322473385b84",
      "subject": "[AppKit Gestures] Bring up support for DOM dblclick (take two)"
    },
    "319116@main": {
      "author": "Sihui Liu",
      "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64",
      "cl": "319116@main",
      "clUrl": "https://commits.webkit.org/319116@main",
      "description": "rdar://176773267\n\nReviewed by Chris Dumez.\n\nMany FileSystem-related messages sent to NetworkStorageManager only carries FileSystemHandleIdentifier when asking to\noperate on FileSystem storage, and NetworkStorageManager does not check whether the sender process actually has access\nto requested handle. This lets a compromised process forge FileSystemHandleIdentifier and access data from other\norigins. To fix it, this patch stores the origin in FileSystemStorageManager and adding an origin accessor to\nFileSystemStorageHandle, so that NetworkStorageManager can run isSiteAllowedForConnection in FileSystem-related message\nhandlers.\n\nAPI test: IPCTestingAPI.FileSystemForgedHandleIdentifierRejected\n\n* Source/WebKit/NetworkProcess/storage/FileSystemStorageHandle.cpp:\n(WebKit::FileSystemStorageHandle::origin const):\n* Source/WebKit/NetworkProcess/storage/FileSystemStorageHandle.h:\n* Source/WebKit/NetworkProcess/storage/FileSystemStorageManager.cpp:\n(WebKit::FileSystemStorageManager::create):\n(WebKit::FileSystemStorageManager::FileSystemStorageManager):\n* Source/WebKit/NetworkProcess/storage/FileSystemStorageManager.h:\n* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp:\n(WebKit::NetworkStorageManager::fileSystemGetDirectory):\n(WebKit::NetworkStorageManager::closeHandle):\n(WebKit::NetworkStorageManager::isSameEntry):\n(WebKit::NetworkStorageManager::move):\n(WebKit::NetworkStorageManager::getFileHandle):\n(WebKit::NetworkStorageManager::getDirectoryHandle):\n(WebKit::NetworkStorageManager::removeEntry):\n(WebKit::NetworkStorageManager::resolve):\n(WebKit::NetworkStorageManager::getFile):\n(WebKit::NetworkStorageManager::createSyncAccessHandle):\n(WebKit::NetworkStorageManager::closeSyncAccessHandle):\n(WebKit::NetworkStorageManager::requestNewCapacityForSyncAccessHandle):\n(WebKit::NetworkStorageManager::createWritable):\n(WebKit::NetworkStorageManager::closeWritable):\n(WebKit::NetworkStorageManager::executeCommandForWritable):\n(WebKit::NetworkStorageManager::getHandleNames):\n(WebKit::NetworkStorageManager::getHandle):\n(WebKit::NetworkStorageManager::addGlobalIdentifierReference):\n(WebKit::NetworkStorageManager::removeGlobalIdentifierReferences):\n(WebKit::NetworkStorageManager::resolveGlobalIdentifier):\n(WebKit::NetworkStorageManager::canConnectionAccessFileSystemHandle const):\n(WebKit::NetworkStorageManager::registerFileSystemHandleRecordsForOrigin):\n(WebKit::NetworkStorageManager::putOrAdd):\n* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.h:\n* Source/WebKit/NetworkProcess/storage/OriginStorageManager.cpp:\n(WebKit::OriginStorageManager::StorageBucket::fileSystemStorageManager):\n(WebKit::OriginStorageManager::fileSystemStorageManager):\n* Source/WebKit/NetworkProcess/storage/OriginStorageManager.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/IPCTestingAPI.mm\n(function):\n((IPCTestingAPI, FileSystemForgedHandleIdentifierRejected)):\n(NSURLWithBaseURLInNSSecureCoding)): Deleted.\n\nCanonical link: https://commits.webkit.org/319116@main",
      "email": "sihui_liu@apple.com",
      "hash": "07d83d0d699eedc4e80908d99470a5fca06acdc8",
      "subject": "Validate connection access to FileSystem storage with FileSystemHandleIdentifier"
    },
    "319117@main": {
      "author": "Sihui Liu",
      "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64",
      "cl": "319117@main",
      "clUrl": "https://commits.webkit.org/319117@main",
      "description": "rdar://176596477\n\nReviewed by Chris Dumez.\n\nIDBConnectionProxy::getAllDatabaseNamesAndVersions constructs a ClientOrigin with topOrigin and clientOrigin swapped.\nClientOrigin expects {topOrigin, clientOrigin}, but the code was passing {securityOrigin (client), topOrigin} instead.\n\nTest: IndexedDB.IndexedDBGetDatabasesFromCrossOriginIframe\n\n* Source/WebCore/Modules/indexeddb/client/IDBConnectionProxy.cpp:\n(WebCore::IDBClient::IDBConnectionProxy::getAllDatabaseNamesAndVersions):\n* Tools/TestWebKitAPI/Tests/WebKitCocoa/IndexedDBPersistence.mm:\n((IndexedDB, IndexedDBGetDatabasesFromCrossOriginIframe)):\n\nOriginally-landed-as: 305413.871@safari-7624-branch (01cef20028da). rdar://184744306\nCanonical link: https://commits.webkit.org/319117@main",
      "email": "sihui_liu@apple.com",
      "hash": "02d1cc9911d394a628668fc0b981d252211ab69d",
      "subject": "indexedDB.databases() leaks database names across storage partitions due to swapped ClientOrigin"
    },
    "319118@main": {
      "author": "Jessica Cheung",
      "avatar": "https://www.gravatar.com/avatar/5c102f093ce6bc01424466a4cfdf1d1f?d=identicon\u0026s=64",
      "cl": "319118@main",
      "clUrl": "https://commits.webkit.org/319118@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321543\nrdar://184654901\n\nReviewed by Tim Nguyen and Pascoe.\n\nEnable the interactive-widget attribute on\nthe viewport meta element.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/319118@main",
      "email": "jcheung23@apple.com",
      "hash": "44ecc0e346943c08709fe264efac0f013da97543",
      "subject": "[interactive-widget] Enable feature flag"
    },
    "319119@main": {
      "author": "Kimmo Kinnunen",
      "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64",
      "cl": "319119@main",
      "clUrl": "https://commits.webkit.org/319119@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321446\nrdar://184538684\n\nReviewed by Chris Dumez.\n\nMove mach message send and receive code to MachMessage::sendEncoder(),\nMachMessage::receive(), MachMessage::send(). This allows future commits\nuse the functionaliy in stream IPC implementation without Connection.\n\nSimplify, make more consistent and remove functionality.\n\nBefore:\nBody as SHM codepath to avoid MACH_SEND_TOO_LARGE, 308536@main\n(rdar://60344809).\n\nAfter:\nRemove body as SHM codepath. This was dead code, aqs XNU does not return\nMACH_SEND_TOO_LARGE for large bodies.  Previously big encoder bodies\nwere already encoded as out-of-line attachment. This would leave large\namounts of  attachment descriptors as the code-path to generate too\nlarge bodies. However, this would need enormous amount of attachments,\nwhich XNU rejects.\n\nInstead, implement support for sending out-of-line attachments.\nThis way wwe can send more attachments than 127 without\nMACH_SEND_TOO_LARGE.\n\nBefore:\nLarge amount of attachments would seem to induce messages larger than\n4096. This needed message buffer resize codepaths on send and receive.\nThis was dead code, as XNU would not allow WebKit to send such messages.\n\nAfter:\nUse the OOL attachments feature to guarantee that all messages can be\nsent and received without heap allocations, with the message in\nthe stack local 4096 byte buffer (+ trailer in receive part).\n\nThis simplifies by removing the heap buffer fallbacks in send and\nreceive.\n\nBefore:\nThree message type ids: inline body, out-of-line body, shm body.\n\nAfter:\nOne message type id: webkitMachMessageID. The descriptors of a message say\nwhat is in the message, the id and the descriptors can no longer\ndisagree.\n\n* Source/WebKit/Platform/IPC/Connection.h:\n* Source/WebKit/Platform/IPC/Encoder.h:\n(IPC::Encoder::attachmentCount const):\n* Source/WebKit/Platform/IPC/cocoa/ConnectionCocoa.mm:\n(IPC::Connection::platformInvalidate):\n(IPC::Connection::platformCanSendOutgoingMessages const):\n(IPC::Connection::sendOutgoingMessage):\n(IPC::Connection::resumeSendSource):\n(IPC::Connection::receiveSourceEventHandler):\n* Source/WebKit/Platform/IPC/cocoa/MachMessage.cpp:\n(IPC::sendMessage):\n(IPC::sendResult):\n(IPC::MachMessage::MachMessage):\n(IPC::MachMessage::~MachMessage):\n(IPC::MachMessage::adoptPseudoReceived):\n(IPC::MachMessage::sendEncoder):\n(IPC::MachMessage::send):\n(IPC::MachMessage::receive):\n* Source/WebKit/Platform/IPC/cocoa/MachMessage.h:\n* Source/WebKit/Scripts/IPCTestingHeaders-input.xcfilelist:\n* Source/WebKit/Scripts/IPCTestingHeaders-output.xcfilelist:\n* Source/WebKit/UIProcess/API/Cocoa/WKProcessPool.mm:\n* Source/WebKit/UIProcess/API/Cocoa/WKProcessPoolPrivate.h:\n* Tools/TestWebKitAPI/CMakeLists.txt:\n* Tools/TestWebKitAPI/SourcesCocoa.txt:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/IPC/MachMessageTests.cpp: Added.\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/IPCSharedMemoryFallback.mm: Removed.\n\nCanonical link: https://commits.webkit.org/319119@main",
      "email": "kkinnunen@apple.com",
      "hash": "9b445a294f40f95a9e2b99c5261027f0f0608de4",
      "subject": "Move mach message send/receive to MachMessage, simplify the implementation"
    },
    "319120@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "319120@main",
      "clUrl": "https://commits.webkit.org/319120@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321655\nrdar://184783026\n\nReviewed by Justin Michaud.\n\nThis patch removes unnecessary work done in JIT code generation main\nloop in Air, BBQ, and Baseline JIT.\n\n1. Disassembler's label creation\n\nCreating label is not free. It is adding label entry in the\nMacroAssembler's buffer. Let's avoid this when it is not necessary. We\nhave many labels which are only used when disassembler is enabled.\n\n2. Move some of loop invariant values\n\nLet's move some loop invariant values out of the hot loop in Air.\n\n3. Quickly check whether we have Stack / CallArg args\n\nThey are relatively rare args. Let's just scan it first, before invoking\ngeneric inst.forEachArg.\n\n* Source/JavaScriptCore/b3/air/AirAllocateRegistersAndStackAndGenerateCode.cpp:\n(JSC::B3::Air::GenerateAndAllocateRegisters::generate):\n* Source/JavaScriptCore/b3/air/AirGenerate.cpp:\n(JSC::B3::Air::generateWithAlreadyAllocatedRegisters):\n* Source/JavaScriptCore/b3/air/AirLowerStackArgs.cpp:\n(JSC::B3::Air::lowerStackArgs):\n* Source/JavaScriptCore/b3/air/AirSimplifyCFG.cpp:\n(JSC::B3::Air::simplifyCFG):\n* Source/JavaScriptCore/jit/JIT.cpp:\n(JSC::JIT::privateCompileMainPass):\n(JSC::JIT::privateCompileSlowCases):\n* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:\n(JSC::Wasm::BBQJITImpl::BBQJIT::BBQJIT):\n(JSC::Wasm::BBQJITImpl::BBQJIT::origin):\n(JSC::Wasm::BBQJITImpl::BBQJIT::recordOpcodeOrigin):\n(JSC::Wasm::BBQJITImpl::BBQJIT::willParseOpcode):\n(JSC::Wasm::BBQJITImpl::BBQJIT::willParseExtendedOpcode):\n* Source/JavaScriptCore/wasm/WasmBBQJIT.h:\n\nCanonical link: https://commits.webkit.org/319120@main",
      "email": "ysuzuki@apple.com",
      "hash": "4af3bbad9cda43c2c6a6580bc45f493fd010c161",
      "subject": "[JSC] Avoid unnecessary work in JIT code generation loop"
    },
    "319121@main": {
      "author": "Nikolas Zimmermann",
      "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64",
      "cl": "319121@main",
      "clUrl": "https://commits.webkit.org/319121@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321427\n\nReviewed by Alejandro G. Castro.\n\nA filter on an outermost \u003csvg\u003e was either dropped entirely or set up with the wrong\ngeometry under the layer-based SVG engine.\n\nRenderLayer::shouldPaintWithFilters() bailed out for any SVG root referencing a\n\u003cfilter\u003e. That is correct for the legacy engine, where LegacyRenderSVGRoot applies\nthe referenced filter itself through SVGRenderingContext::prepareToRenderSVGContent()\nand the layer must not apply it a second time. The layer-based engine has no such path,\nRenderSVGRoot relies on its layer, exactly like an HTML box with 'filter: url(...)' -\nso the filter was silently never applied. Fix that behavior for LBSE.\n\nRenderLayerFilters::beginFilterEffect() then treated RenderSVGRoot as a renderer\nwhose filter lives in SVG user space, seeding the filter region and the reference\nbox from objectBoundingBox() and scaling by the accumulated SVG ancestor transform.\nThe outermost \u003csvg\u003e is a replaced element in the CSS box tree: its filter resolves\nagainst its border box, in its container's coordinate system, not against the SVG\nuser space its children live in - fix that too.\n\nFixes svg/filters/filter-specified-on-svg-root.html and svg/filters/filter-image-ref-root.html.\n\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/TestExpectations:\n* Source/WebCore/rendering/RenderLayer.cpp:\n(WebCore::RenderLayer::shouldPaintWithFilters const):\n(WebCore::RenderLayer::paintLayerContents):\n* Source/WebCore/rendering/RenderLayerFilters.cpp:\n(WebCore::RenderLayerFilters::beginFilterEffect):\n(WebCore::RenderLayerFilters::applyFilterEffect):\n\nCanonical link: https://commits.webkit.org/319121@main",
      "email": "nzimmermann@igalia.com",
      "hash": "cb885befbe2f2f4515f045781a1ddb0f47346d29",
      "subject": "[LBSE] Apply filters specified on the outermost \u003csvg\u003e"
    },
    "319122@main": {
      "author": "Zak Ridouh",
      "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64",
      "cl": "319122@main",
      "clUrl": "https://commits.webkit.org/319122@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320020\nrdar://182952197\n\nReviewed by Kiet Ho.\n\nPage::useDarkAppearance() only applied the \"printing uses light appearance\"\nrule inside an `if (localMainFrame())` block, so under site isolation a\ncross-origin iframe (whose process has a RemoteFrame as its main frame)\nkept using dark appearance while printing. prefers-color-scheme: dark then\nstill matched inside the iframe and it painted with its dark background.\n\nThe printing flag is synced to remote main frames via SetFramePrinting, so\nconsult mainFrame().isPrinting() before the localMainFrame()-only logic.\n\niframe-dark-mode-print.html was an image-only reftest, which cannot work for a\nprinting test under site isolation. WebKitTestRunner captures the pixel result\nof a printing test in the main frame's WebContent process (a printing snapshot\ntaken in the injected bundle), and that process paints nothing for a remote\nframe; printing also forces backgrounds to white unless ShouldPrintBackgrounds\nis enabled, so the snapshot is blank white with or without this change. Convert\nit into a render tree dump test, following print-with-iframe.html: a remote\nframe's render tree is collected across processes, so the used background color\ninside the cross-origin iframe is visible in the dump (red for light appearance\nrather than green for dark).\n\n* LayoutTests/TestExpectations:\n* LayoutTests/http/tests/site-isolation/iframe-dark-mode-print-expected.html: Removed.\n* LayoutTests/http/tests/site-isolation/iframe-dark-mode-print-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/iframe-dark-mode-print.html:\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::useDarkAppearance const):\n\nCanonical link: https://commits.webkit.org/319122@main",
      "email": "zakr@apple.com",
      "hash": "a1a50b098fc374d17ffdaa715cdd949d5a659e88",
      "subject": "[Site Isolation] Dark mode is not disabled for printing when the main frame is remote"
    },
    "319123@main": {
      "author": "Marta Darbinyan",
      "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64",
      "cl": "319123@main",
      "clUrl": "https://commits.webkit.org/319123@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321691\nrdar://184838407\n\nUnreviewed test gardening\n\n* LayoutTests/platform/ios/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319123@main",
      "email": "darbinyan@apple.com",
      "hash": "f06911d36300dbef452d396d84b620f66f8ec2e2",
      "subject": "[Gardening]: [iOS] imported/w3c/web-platform-tests/web-locks/bfcache/abort.tentative.https.html is flaky crashing"
    },
    "319124@main": {
      "author": "Sam Sneddon",
      "avatar": "https://www.gravatar.com/avatar/99f6b56d9db9d32920dfcc56deae86fc?d=identicon\u0026s=64",
      "cl": "319124@main",
      "clUrl": "https://commits.webkit.org/319124@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321340\n\nReviewed by Aakash Jain.\n\nTools/CISupport/Shared/generate_s3_url.py imports boto3, but this is\nnot registered with AutoInstall when running\nTools/CISupport/run-tests.\n\nThe only existing registration is in\nTools/Scripts/libraries/resultsdbpy/resultsdbpy/__init__.py, and it is\nbecause of this that the Services EWS bot mostly succeeds in running\nthese tests: it only fails on first run (with no autoinstalled\npackages).\n\n* Tools/Scripts/webkitpy/autoinstalled/buildbot.py:\nAdd these to the end, given there is no clear order.\n\nCanonical link: https://commits.webkit.org/319124@main",
      "email": "gsnedders@apple.com",
      "hash": "f2a021692661459a1b5164e260211ae0a5fcf7be",
      "subject": "Tools/CISupport/run-tests fails due to missing AutoInstall registrations"
    },
    "319125@main": {
      "author": "Yulun Wu",
      "avatar": "https://www.gravatar.com/avatar/9e34d6632f4d926cdf6fe8dce07f9cb7?d=identicon\u0026s=64",
      "cl": "319125@main",
      "clUrl": "https://commits.webkit.org/319125@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321629\n\u003crdar://184757188\u003e\n\nReviewed by Sammy Gill.\n\n317544@main relaxed avoidance reasons check to accept auto row end\nbut left an assert behind checking for explicit row end, causing us to\nhit a debug assert. We can safely remove this assert.\n\nNote that this crash was exposed by 317976@main which made these\ntests reachable and is the observable regression point.\n\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/mac/TestExpectations:\n* Source/WebCore/layout/integration/grid/LayoutIntegrationGridCoverage.cpp:\n(WebCore::LayoutIntegration::gridLayoutAvoidanceReason):\n* LayoutTests/platform/ios/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319125@main",
      "email": "yulun_wu@apple.com",
      "hash": "ff0b9ec81236e30ebd26df8a1967e50c7665de3f",
      "subject": "[GFC] Remove stale ASSERT(rowEnd.isExplicit()) in the row placement coverage check"
    },
    "319126@main": {
      "author": "Zak Ridouh",
      "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64",
      "cl": "319126@main",
      "clUrl": "https://commits.webkit.org/319126@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321322\nrdar://184361817\n\nReviewed by David Kilzer.\n\nInteractionInformationAtPosition::textIndicator is a RefPtr that is only\npopulated when the request asked for a link indicator and the hit element produced one, but\nfour iOS consumers dereference it unchecked.\n\n-_presentationStyleForPositionInfo:elementInfo: guards only on the\nactivated element being a link, so a link whose position information carries no text indicator\ncrashes while choosing an action sheet presentation style. presentationRectForElementUsingClosestIndicatedRect checks _positionInformation but not the indicator inside it. The two UIPreviewItemController callbacks used by legacy link preview check neither.\n\nAdopt the shape already used by the correctly-guarded call sites nearby, test the RefPtr before dereferencing it, and hoist it into a local where it is used more than once, as WKActionSheetAssistant.mm:1068, WKContentViewInteraction.mm:10320 and :12009 do.\n\nNo new test: reaching these paths requires a link whose position information has no text\nindicator to arrive at legacy link preview or action sheet presentation, which TestWebKitAPI\ncannot currently drive on iOS.\n\n* Source/WebKit/UIProcess/ios/WKActionSheetAssistant.mm:\n(-[WKActionSheetAssistant presentationRectForElementUsingClosestIndicatedRect]):\n(-[WKActionSheetAssistant _presentationStyleForPositionInfo:elementInfo:]):\n* Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm:\n(-[WKContentView _presentationSnapshotForPreviewItemController:]):\n(-[WKContentView _presentationRectsForPreviewItemController:]):\n\nCanonical link: https://commits.webkit.org/319126@main",
      "email": "zakr@apple.com",
      "hash": "57e8347f3e91ae1766dadd7144f7cf32c5f86fd8",
      "subject": "[iOS] Null TextIndicator dereferences in position information consumers"
    },
    "319127@main": {
      "author": "Dominic Mazzoni",
      "avatar": "https://www.gravatar.com/avatar/f76643c44a7ee3be45148e66d97ed8e4?d=identicon\u0026s=64",
      "cl": "319127@main",
      "clUrl": "https://commits.webkit.org/319127@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321647\nrdar://184773721\n\nReviewed by Tyler Wilcock.\n\nWhen a document becomes scrollable, LocalFrameView::didAddScrollbar\ntells the AXObjectCache via onScrollbarUpdate, and\nAXObjectCache::handleScrollbarUpdate calls\nAccessibilityScrollView::updateChildrenIfNecessary, which clears and\nre-adds the scroll view's children so that the synthesized AXScrollBar\nchild appears (or disappears).\n\nThat updates the live tree only. A scroll view has neither a node nor\na renderer, so a scrollbar coming and going is not accompanied by any\nDOM or render tree mutation that would route through\nAXObjectCache::childrenChanged, and nothing ever marked the scroll\nview as needing a children update. The isolated tree therefore kept\nserving whatever children the scroll area had when it was first built,\nand the scrollbar was never exposed to an assistive technology. Note\nthat handleScrollbarUpdate also runs after\nhandleAllDeferredChildrenChanged in\nAXObjectCache::performDeferredCacheUpdate, so deferring a\nchildren-changed here would not be picked up in the same cycle.\n\nQueue the children update on the isolated tree explicitly instead.\n\nTests: accessibility/isolated-tree/scrollbar-not-created-when-revealing-content.html\n       accessibility/scrollbar-not-created-when-revealing-content.html\n\n* LayoutTests/accessibility/isolated-tree/scrollbar-not-created-when-revealing-content-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/scrollbar-not-created-when-revealing-content.html: Added.\n* LayoutTests/accessibility/scrollbar-not-created-when-revealing-content-expected.txt: Added.\n* LayoutTests/accessibility/scrollbar-not-created-when-revealing-content.html: Added.\n* Source/WebCore/accessibility/AXObjectCache.cpp:\n(WebCore::AXObjectCache::handleScrollbarUpdate):\n\nCanonical link: https://commits.webkit.org/319127@main",
      "email": "dm_mazzoni@apple.com",
      "hash": "309c7e6231d9acf39c74997b692c7f37c8ed1231",
      "subject": "AX: Document scrollbar is not exposed in the isolated tree when revealing content makes the document scrollable"
    },
    "319128@main": {
      "author": "Ian Gower",
      "avatar": "https://www.gravatar.com/avatar/cc2e677bc728b92e5463660d8b8d9ed8?d=identicon\u0026s=64",
      "cl": "319128@main",
      "clUrl": "https://commits.webkit.org/319128@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320703\nrdar://109610452\n\nReviewed by Megan Gardner.\n\nSelecting text on a line pushed below an intrusive float highlighted the float as well, so on\nparks.ca.gov selecting text under a wide float:left image filled the whole image with selection\ncolour rather than just the text.\n\nA line's selection top is inherited from the preceding line box to cover the half-leading gap\nbetween lines. That inheritance was unconditional, so a line pushed below a float inherited from a\nline box that does not reach it and started its selection at the block's content top instead. Only\ninherit when the preceding line box is adjacent, otherwise start at this line's own content top.\n\n* LayoutTests/editing/selection/selection-does-not-extend-over-preceding-float-expected.txt: Added.\n* LayoutTests/editing/selection/selection-does-not-extend-over-preceding-float.html: Added.\n* Source/WebCore/layout/integration/inline/InlineIteratorLineBoxModernPath.h:\n(WebCore::InlineIterator::LineBoxIteratorModernPath::contentLogicalTopAdjustedForPrecedingLineBox const):\n\nCanonical link: https://commits.webkit.org/319128@main",
      "email": "i_gower@apple.com",
      "hash": "d34f39ba6c661d3cdd54f1a9b56f9f681c2669cd",
      "subject": "parks.ca.gov: Text highlight is misleading when image above is a float"
    },
    "319129@main": {
      "author": "Wenson Hsieh",
      "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64",
      "cl": "319129@main",
      "clUrl": "https://commits.webkit.org/319129@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321687\nrdar://184832424\n\nReviewed by Abrar Rahman Protyasha.\n\nAdjust heuristics around extracting `form` elements, to make it easier for agents to figure out how\nto interact with the \"Change\" button in the password section on adobe.com:\n\n-   Avoid adding `uid` for forms.\n-   Elide parent `form` elements altogether, in the case where the element lacks relevant\n    accessibility attributes and only contains a single `button` element.\n\n* LayoutTests/fast/text-extraction/debug-text-extraction-all-container-uids-expected.txt:\n* LayoutTests/fast/text-extraction/debug-text-extraction-all-container-uids.html:\n* LayoutTests/fast/text-extraction/debug-text-extraction-form-controls-expected.txt:\n* LayoutTests/fast/text-extraction/debug-text-extraction-form-controls.html:\n* Source/WebCore/page/text-extraction/TextExtraction.cpp:\n(WebCore::TextExtraction::shouldIncludeNodeIdentifier):\n(WebCore::TextExtraction::isRedundantFormWrapper):\n(WebCore::TextExtraction::collapseRedundantFormWrappersRecursive):\n(WebCore::TextExtraction::extractItem):\n\nCanonical link: https://commits.webkit.org/319129@main",
      "email": "wenson_hsieh@apple.com",
      "hash": "8127f106827268c8e9c89c1048bc54a7a76856bd",
      "subject": "[Text Extraction] adobe.com: sometimes unable to click on \"Change Password\" button in account settings page"
    },
    "319130@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "319130@main",
      "clUrl": "https://commits.webkit.org/319130@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321670\nrdar://184811409\n\nReviewed by Tim Horton.\n\nAs the commit title reads, let's bring up support for gesture events\ndriven through AppKit gesture recognizers, namely for magnification\nand rotation. We kick off this bring up process in this patch by adding\na feature flag, which will be adopted in forthcoming changes.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/319130@main",
      "email": "a_protyasha@apple.com",
      "hash": "328f495900210f117e727e690e6283d62b8da56e",
      "subject": "[AppKit Gestures] Add a feature flag for gesture recognizer-driven gesture event support"
    },
    "319131@main": {
      "author": "Joanne Pan",
      "avatar": "https://www.gravatar.com/avatar/5cbbf578426a0c98cb5c977ca2dd88fc?d=identicon\u0026s=64",
      "cl": "319131@main",
      "clUrl": "https://commits.webkit.org/319131@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319266\nrdar://182135083\n\nReviewed by Tim Nguyen.\n\n319039@main allowed random() inside a custom property and 319096@main added the\ncustom property name to the caching key. Nothing pinned which random() usages\nare supposed to share a base value once that works, so add cases for the caching\nidentity: two registered \u003clength\u003e custom properties on one element, the same\ncustom property on two elements, a custom property against a non-custom one at\nthe same index, property-scoped equality across elements, two random() functions\nwithin one custom property, and an author \u003cdashed-ident\u003e that happens to name the\nproperty an implicit key is scoped to.\n\nThe @property initial-value case read the computed value with bracket access on\nthe CSSStyleDeclaration, which never resolves a custom property, so it compared\nundefined to undefined and could not fail. Read it with getPropertyValue() and\nassert the property is left unregistered.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-computed.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-computed.tentative.html:\n\nCanonical link: https://commits.webkit.org/319131@main",
      "email": "jpan0917@gmail.com",
      "hash": "c4182c1faa92daf4f2e654daff0eec1f3d4aa95f",
      "subject": "[css-values-5] Add test coverage for the random() caching key in custom properties"
    },
    "319132@main": {
      "author": "Dan Hecht",
      "avatar": "https://www.gravatar.com/avatar/080f47d912b1b34d0be8293f825d132d?d=identicon\u0026s=64",
      "cl": "319132@main",
      "clUrl": "https://commits.webkit.org/319132@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321688\nrdar://184832952\n\nReviewed by Keith Miller.\n\nThis runs during the End phase on every marked, surviving cell and settles its\nuntraced pointers against the liveness that marking just established.\n\nTypically finalizers are called for each dead object, so this dispatches in the\nopposite direction. The \"unconditionally\" qualifier is also ambiguous.\n\nSo, make the following renames:\n\n    T::finalizeUnconditionally              -\u003e T::reconcileWeakReferencesAtGCEnd\n    Heap::finalizeUnconditionalFinalizers   -\u003e Heap::reconcileWeakReferencesAtGCEnd\n    Heap::finalizeMarkedUnconditionalFinalizers\n                                            -\u003e Heap::reconcileWeakReferencesInMarkedCells\n    IsoCellSet finalizerSet / finalizerSetFor\n                                            -\u003e weakReconciliationSet / weakReconciliationSetFor\n\n\"Reconcile\" names what the survivor does, which fits that direction, and covers the\nrange of resolutions, e.g.:\n\n    clear the pointer         JSWeakObjectRef, UnlinkedFunctionExecutable,\n                                LLInt/JIT inline caches\n    prune a container entry   WeakMapImpl, StructureTransitionTable\n    salvage derived state     ErrorInstance stringifies its stack trace while the\n                                weak frames are still readable, then drops them\n    invalidate a dependent    InferredValue fires a watchpoint; StructureRareData\n                                drops a cached special property\n    notify an owner           JSFinalizationRegistry moves registrations to a dead\n                                list and posts a cleanup job\n\nThe leaf helpers reached from here are renamed to match:\n\n    CodeBlock::finalizeLLIntInlineCaches  -\u003e reconcileLLIntInlineCachesAtGCEnd\n    CodeBlock::finalizeJITInlineCaches    -\u003e reconcileJITInlineCachesAtGCEnd\n    RecordedStatuses::finalize            -\u003e reconcileWeakReferences\n    RecordedStatuses::finalizeWithoutDeleting\n                                            -\u003e reconcileWeakReferencesWithoutDeleting\n    JITPlan::finalizeInGC                 -\u003e reconcileWeakReferencesAtGCEnd\n    ScriptExecutable::finalizeCodeBlockEdge\n                                            -\u003e jettisonCodeBlockEdgeIfDead\n\nThe suffix is dropped where the caller is adjacent and the timing is obvious.\n\nCodeBlock reconciles in multiple ways. Its inline caches are cleared outright, while\nupdateAllPredictions salvages: ValueProfile::computeUpdatedPrediction and\nArrayProfile::computeUpdatedPrediction each read an untraced EncodedJSValue or\nStructureID, fold it into a pointer-free SpeculatedType, then clear the slot.\nNeither can run after sweep. updateActivity and the per-cycle flag reset are the\nonly work in there that is not reconciliation.\n\nAlso documents stronglyVisitWeakReferences, which is easy to mistake for part of\nthis pass. A CodeBlock is live either because something marked it directly, such\nas a conservative stack scan finding it running, or because all of its code\ndependencies are still live. In the former case those dependencies have not been\nchecked by anything, and that function is what keeps them alive.\n\nNo behavior change.\n\n* Source/JavaScriptCore/bytecode/CodeBlock.cpp:\n(JSC::CodeBlock::reconcileLLIntInlineCachesAtGCEnd):\n(JSC::CodeBlock::reconcileJITInlineCachesAtGCEnd):\n(JSC::CodeBlock::reconcileWeakReferencesAtGCEnd):\n(JSC::CodeBlock::finalizeLLIntInlineCaches): Deleted.\n(JSC::CodeBlock::finalizeJITInlineCaches): Deleted.\n(JSC::CodeBlock::finalizeUnconditionally): Deleted.\n* Source/JavaScriptCore/bytecode/CodeBlock.h:\n* Source/JavaScriptCore/bytecode/RecordedStatuses.cpp:\n(JSC::RecordedStatuses::reconcileWeakReferencesWithoutDeleting):\n(JSC::RecordedStatuses::reconcileWeakReferences):\n(JSC::RecordedStatuses::finalizeWithoutDeleting): Deleted.\n(JSC::RecordedStatuses::finalize): Deleted.\n* Source/JavaScriptCore/bytecode/RecordedStatuses.h:\n* Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp:\n(JSC::UnlinkedFunctionExecutable::reconcileWeakReferencesAtGCEnd):\n(JSC::UnlinkedFunctionExecutable::finalizeUnconditionally): Deleted.\n* Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h:\n* Source/JavaScriptCore/dfg/DFGJITCode.h:\n* Source/JavaScriptCore/dfg/DFGPlan.cpp:\n(JSC::DFG::Plan::reconcileWeakReferencesAtGCEnd):\n(JSC::DFG::Plan::finalizeInGC): Deleted.\n* Source/JavaScriptCore/dfg/DFGPlan.h:\n* Source/JavaScriptCore/heap/Heap.cpp:\n(JSC::Heap::reconcileWeakReferencesInMarkedCells):\n(JSC::Heap::reconcileWeakReferencesAtGCEnd):\n(JSC::Heap::clearConcurrentRetainedDataIfPossible):\n(JSC::Heap::finalizeMarkedUnconditionalFinalizers): Deleted.\n(JSC::Heap::finalizeUnconditionalFinalizers): Deleted.\n* Source/JavaScriptCore/heap/Heap.h:\n(JSC::Heap::ScriptExecutableSpaceAndSets::ScriptExecutableSpaceAndSets):\n(JSC::Heap::ScriptExecutableSpaceAndSets::weakReconciliationSetFor):\n(JSC::Heap::ScriptExecutableSpaceAndSets::finalizerSetFor): Deleted.\n* Source/JavaScriptCore/interpreter/MicrotaskCall.h:\n* Source/JavaScriptCore/jit/JITPlan.h:\n(JSC::JITPlan::reconcileWeakReferencesAtGCEnd):\n(JSC::JITPlan::finalizeInGC): Deleted.\n* Source/JavaScriptCore/jit/JITWorklist.cpp:\n(JSC::JITWorklist::removeDeadPlans):\n* Source/JavaScriptCore/runtime/ErrorInstance.cpp:\n(JSC::ErrorInstance::reconcileWeakReferencesAtGCEnd):\n(JSC::ErrorInstance::finalizeUnconditionally): Deleted.\n* Source/JavaScriptCore/runtime/ErrorInstance.h:\n* Source/JavaScriptCore/runtime/FunctionExecutable.cpp:\n(JSC::FunctionExecutable::visitChildrenImpl):\n* Source/JavaScriptCore/runtime/FunctionExecutable.h:\n* Source/JavaScriptCore/runtime/FunctionExecutableInlines.h:\n(JSC::FunctionExecutable::reconcileWeakReferencesAtGCEnd):\n(JSC::FunctionExecutable::finalizeUnconditionally): Deleted.\n* Source/JavaScriptCore/runtime/GlobalExecutable.cpp:\n(JSC::GlobalExecutable::visitChildrenImpl):\n(JSC::GlobalExecutable::reconcileWeakReferencesAtGCEnd):\n(JSC::GlobalExecutable::finalizeUnconditionally): Deleted.\n* Source/JavaScriptCore/runtime/GlobalExecutable.h:\n* Source/JavaScriptCore/runtime/InferredValue.h:\n* Source/JavaScriptCore/runtime/InferredValueInlines.h:\n(JSC::InferredValue\u003cJSCellType\u003e::reconcileWeakReferencesAtGCEnd):\n(JSC::InferredValue\u003cJSCellType\u003e::finalizeUnconditionally): Deleted.\n* Source/JavaScriptCore/runtime/JSFinalizationRegistry.cpp:\n(JSC::JSFinalizationRegistry::finishCreation):\n(JSC::JSFinalizationRegistry::reconcileWeakReferencesAtGCEnd):\n(JSC::JSFinalizationRegistry::finalizeUnconditionally): Deleted.\n* Source/JavaScriptCore/runtime/JSFinalizationRegistry.h:\n* Source/JavaScriptCore/runtime/JSWeakObjectRef.cpp:\n(JSC::JSWeakObjectRef::reconcileWeakReferencesAtGCEnd):\n(JSC::JSWeakObjectRef::finalizeUnconditionally): Deleted.\n* Source/JavaScriptCore/runtime/JSWeakObjectRef.h:\n* Source/JavaScriptCore/runtime/ScriptExecutable.h:\n* Source/JavaScriptCore/runtime/ScriptExecutableInlines.h:\n(JSC::ScriptExecutable::jettisonCodeBlockEdgeIfDead):\n(JSC::ScriptExecutable::finalizeCodeBlockEdge): Deleted.\n* Source/JavaScriptCore/runtime/Structure.cpp:\n(JSC::Structure::reconcileWeakReferencesAtGCEnd):\n(JSC::Structure::finalizeUnconditionally): Deleted.\n* Source/JavaScriptCore/runtime/Structure.h:\n* Source/JavaScriptCore/runtime/StructureInlines.h:\n(JSC::StructureTransitionTable::reconcileWeakReferencesAtGCEnd):\n(JSC::StructureTransitionTable::finalizeUnconditionally): Deleted.\n* Source/JavaScriptCore/runtime/StructureRareData.cpp:\n(JSC::StructureRareData::reconcileWeakReferencesAtGCEnd):\n(JSC::StructureRareData::finalizeUnconditionally): Deleted.\n* Source/JavaScriptCore/runtime/StructureRareData.h:\n* Source/JavaScriptCore/runtime/StructureTransitionTable.h:\n* Source/JavaScriptCore/runtime/SymbolTable.h:\n* Source/JavaScriptCore/runtime/SymbolTableInlines.h:\n(JSC::SymbolTable::reconcileWeakReferencesAtGCEnd):\n(JSC::SymbolTable::finalizeUnconditionally): Deleted.\n* Source/JavaScriptCore/runtime/VM.cpp:\n(JSC::VM::reconcileWeakReferencesAtGCEnd):\n(JSC::VM::finalizeUnconditionally): Deleted.\n* Source/JavaScriptCore/runtime/VM.h:\n* Source/JavaScriptCore/runtime/WeakMapImpl.h:\n* Source/JavaScriptCore/runtime/WeakMapImplInlines.h:\n(JSC::WeakMapImpl\u003cWeakMapBucket\u003e::reconcileWeakReferencesAtGCEnd):\n(JSC::WeakMapImpl\u003cWeakMapBucket\u003e::rehash):\n(JSC::WeakMapImpl\u003cWeakMapBucket\u003e::finalizeUnconditionally): Deleted.\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp:\n(JSC::JSWebAssemblyInstance::reconcileWeakReferencesAtGCEnd):\n(JSC::JSWebAssemblyInstance::finalizeUnconditionally): Deleted.\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h:\n\nCanonical link: https://commits.webkit.org/319132@main",
      "email": "dan.hecht@apple.com",
      "hash": "a53d011599e7726daa97e9fd8f233b0cc95aaed5",
      "subject": "[JSC] Rename finalizeUnconditionally to reconcileWeakReferencesAtGCEnd"
    },
    "319133@main": {
      "author": "Dominic Mazzoni",
      "avatar": "https://www.gravatar.com/avatar/f76643c44a7ee3be45148e66d97ed8e4?d=identicon\u0026s=64",
      "cl": "319133@main",
      "clUrl": "https://commits.webkit.org/319133@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321454\nrdar://184544371\n\nReviewed by Tyler Wilcock.\n\nThe character count and text marker range weren't consistent between the live tree and\nisolated tree, for a textarea engine with a line break. Fix it by introducing a new\nisCollapsedTrailingLineBreak() method and corresponding isolated node property, so\nthat it can be detected and stripped from the isolated tree.\n\nTests: accessibility/isolated-tree/mac/textarea-line-range-with-trailing-newline.html\n       accessibility/mac/textarea-line-range-with-trailing-newline.html\n       accessibility/text-marker/textarea-character-count-with-trailing-newline.html\n\n* LayoutTests/accessibility/isolated-tree/mac/textarea-line-range-with-trailing-newline-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/textarea-line-range-with-trailing-newline.html: Added.\n* LayoutTests/accessibility/mac/textarea-line-range-with-trailing-newline-expected.txt: Added.\n* LayoutTests/accessibility/mac/textarea-line-range-with-trailing-newline.html: Added.\n* LayoutTests/accessibility/text-marker/textarea-character-count-with-trailing-newline-expected.txt: Added.\n* LayoutTests/accessibility/text-marker/textarea-character-count-with-trailing-newline.html: Added.\n* LayoutTests/platform/ios/TestExpectations:\n* Source/WebCore/accessibility/AXCoreObject.h:\n* Source/WebCore/accessibility/AXLogger.cpp:\n(WebCore::operator\u003c\u003c):\n* Source/WebCore/accessibility/AXObjectCache.cpp:\n(WebCore::AXObjectCache::visiblePositionForTextMarkerData):\n* Source/WebCore/accessibility/AXTextMarker.cpp:\n(WebCore::AXTextMarkerRange::forEachTextPiece const):\n(WebCore::AXTextMarkerRange::length const):\n(WebCore::AXTextMarkerRange::toString const):\n(WebCore::AXTextMarker::characterRangeForLine const):\n(WebCore::AXTextMarker::lineNumberForIndex const):\n(WebCore::AXTextMarker::atLineBoundaryForDirection const):\n(WebCore::AXTextMarker::findLine const):\n* Source/WebCore/accessibility/AXTextMarker.h:\n* Source/WebCore/accessibility/AccessibilityObject.cpp:\n(WebCore::AccessibilityObject::isCollapsedTrailingLineBreak const):\n* Source/WebCore/accessibility/AccessibilityObject.h:\n* Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.h:\n* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp:\n(WebCore::createIsolatedObjectData):\n* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.h:\n* Source/WebCore/accessibility/isolatedtree/mac/AXIsolatedObjectMac.mm:\n(WebCore::AXIsolatedObject::visibleCharacterRange const):\n(WebCore::AXIsolatedObject::textMarkerRangeForNSRange const):\n(WebCore::AXIsolatedObject::textLength const):\n* Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm:\n(handleLengthForTextMarkerRangeAttribute):\n* Tools/WebKitTestRunner/InjectedBundle/ios/AccessibilityUIElementIOS.mm:\n(WTR::AccessibilityUIElementIOS::lineTextMarkerRangeForTextMarker):\n(WTR::AccessibilityUIElementIOS::misspellingTextMarkerRange):\n(WTR::AccessibilityUIElementIOS::textMarkerRangeLength):\n(WTR::AccessibilityUIElementIOS::previousTextMarker):\n(WTR::AccessibilityUIElementIOS::nextTextMarker):\n(WTR::AccessibilityUIElementIOS::stringForTextMarkerRange):\n(WTR::AccessibilityUIElementIOS::rectsForTextMarkerRange):\n(WTR::AccessibilityUIElementIOS::textMarkerRangeForMarkers):\n(WTR::AccessibilityUIElementIOS::startTextMarkerForTextMarkerRange):\n(WTR::AccessibilityUIElementIOS::endTextMarkerForTextMarkerRange):\n(WTR::AccessibilityUIElementIOS::accessibilityElementForTextMarker):\n(WTR::AccessibilityUIElementIOS::indexForTextMarker):\n(WTR::AccessibilityUIElementIOS::textMarkerRangeMatchesTextNearMarkers):\n\nCanonical link: https://commits.webkit.org/319133@main",
      "email": "dm_mazzoni@apple.com",
      "hash": "ef1d7119a4db5d2a8bd38b5ec902625a2cd9322d",
      "subject": "AX: live and isolated tree don't agree on several attributes when a textarea ends in a line break"
    },
    "319134@main": {
      "author": "Dan Hecht",
      "avatar": "https://www.gravatar.com/avatar/080f47d912b1b34d0be8293f825d132d?d=identicon\u0026s=64",
      "cl": "319134@main",
      "clUrl": "https://commits.webkit.org/319134@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321689\nrdar://184833847\n\nReviewed by Keith Miller.\n\nHeap::finalize is the mutator-side epilogue of a collection cycle, not\nfinalization. It flushes HasOwnPropertyCache, MegamorphicCache and the string\ncaches, ages the megamorphic cache, eagerly sweeps precise allocations, and runs\nthe embedder's end-of-GC callbacks. Nothing in it operates on a dying object.\n\n    Heap::finalize          -\u003e Heap::runCollectionEpilogue\n    needFinalizeBit         -\u003e needCollectionEpilogueBit\n    setNeedFinalize         -\u003e setNeedCollectionEpilogue\n    handleNeedFinalize      -\u003e handleNeedCollectionEpilogue\n    waitWhileNeedFinalize   -\u003e waitWhileNeedCollectionEpilogue\n    Heap::sweepInFinalize   -\u003e Heap::sweepEagerlyInEpilogue\n\nsweepEagerlyInEpilogue says why it sweeps at this point -- precise allocations and\nWasm memory hold a lot of bytes -- rather than merely when.\n\nThe --logGC=1 phase label changes from \"finalize\" to \"epilogue\" to match. That\noutput has no stability contract, but anyone scraping GC logs will see it.\n\nNo behavior change.\n\n* Source/JavaScriptCore/heap/Heap.cpp:\n(JSC::Heap::clearConcurrentRetainedDataIfPossible):\n* Source/JavaScriptCore/heap/Heap.h:\n\nCanonical link: https://commits.webkit.org/319134@main",
      "email": "dan.hecht@apple.com",
      "hash": "f4da7823ee1d1dacf4b080de2986759a051003ee",
      "subject": "[JSC] Rename Heap::finalize to Heap::runCollectionEpilogue"
    },
    "319135@main": {
      "author": "Brian Weinstein",
      "avatar": "https://www.gravatar.com/avatar/2892a9aaa68f537ee65c6f95ef0768a6?d=identicon\u0026s=64",
      "cl": "319135@main",
      "clUrl": "https://commits.webkit.org/319135@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321615\nrdar://184269255\n\nReviewed by Kiara Rose.\n\nTo do this, we needed to make the existing non-dynamic APIs in the top level web extension namespace\ndynamic, and always mark them as allowed in the non-offscreen page case.\n\nThis PR also tells the Web Process which page is the offscreen page, which we will need to implement\nruntime.getContexts (https://bugs.webkit.org/show_bug.cgi?id=294456).\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIOffscreen.mm\n\n* Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPIOffscreenCocoa.mm:\n(WebKit::WebExtensionContext::offscreenCreateDocument): Tell the web process about the offscreen page identifier.\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPINamespace.cpp:\n(WebKit::WebExtensionAPINamespace::isPropertyAllowed): Move up the logic to grant the test API if we are in testing mode,\nonly grant runtime for offscreen pages, and make sure everything else is always granted.\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPINamespace.idl:\n* Source/WebKit/WebProcess/Extensions/WebExtensionContextProxy.cpp:\n(WebKit::WebExtensionContextProxy::setOffscreenPage):\n(WebKit::WebExtensionContextProxy::isOffscreenPage const):\n(WebKit::WebExtensionContextProxy::setOffscreenPageIdentifier):\n* Source/WebKit/WebProcess/Extensions/WebExtensionContextProxy.h:\n* Source/WebKit/WebProcess/Extensions/WebExtensionContextProxy.messages.in:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIOffscreen.mm:\n(TestWebKitAPI::TEST_F(WKWebExtensionAPIOffscreen, OffscreenDocumentAPIAvailability)): Check the availability for all APIs\nin the background page, and just runtime in the offscreen page.\n\nCanonical link: https://commits.webkit.org/319135@main",
      "email": "bweinstein@apple.com",
      "hash": "8a263e30ddaddc768bbe708ffe6f4ed7363518c7",
      "subject": "Only give the offscreen web view access to the browser.runtime API"
    },
    "319136@main": {
      "author": "Per Arne Vollan",
      "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64",
      "cl": "319136@main",
      "clUrl": "https://commits.webkit.org/319136@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321462\nrdar://184209098\n\nReviewed by Basuke Suzuki.\n\nGoing back/forward to a page that was suspended into the back/forward cache under site\nisolation could restore an unresponsive page. WebPage::suspendWithFrameItem removes\nthe main frame from Page::rootFrames() when suspending, since it's sent to the main\nframe's own process, not just remote subframe processes. Nothing on the restore path\nadded it back.\n\nFix this by not detaching the root frames when receiving the message in the main frame\nprocess, since it's not required in this case.\n\nTest: SiteIsolation.RestoredPageIsRenderedAfterCrossSiteBFCacheRoundTrip\n\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::suspendWithFrameItem):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, RestoredPageIsRenderedAfterCrossSiteBFCacheRoundTrip)):\n(TestWebKitAPI::(SiteIsolation, RestoredPageWithIframeIsRenderedAfterCrossSiteBFCacheRoundTrip)):\n\nCanonical link: https://commits.webkit.org/319136@main",
      "email": "pvollan@apple.com",
      "hash": "a8eecb4531dfe6d708d3dca7939798a7faec34a3",
      "subject": "[Site Isolation] google.com: Web content is unresponsive after going back to search result page"
    },
    "319138@main": {
      "author": "Sihui Liu",
      "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64",
      "cl": "319138@main",
      "clUrl": "https://commits.webkit.org/319138@main",
      "description": "rdar://176470206\n\nReviewed by Chris Dumez.\n\nMany CacheStorage-related messages sent to NetworkStorageManager only carries DOMCacheIdentifier when asking to operate\non DOMCache storage, and NetworkStorageManager does not check whether the sender process actually has access to\nrequested cache. This lets a compromised process forge DOMCacheIdentifier and access data from other origins. To fix it,\nthis patch stores the origin in CacheStorageManager and adding an origin accessor to CacheStorageCache, so that\nNetworkStorageManager can run isSiteAllowedForConnection in CacheStorage-related message handlers.\n\n* Source/WebKit/NetworkProcess/storage/CacheStorageCache.cpp:\n(WebKit::CacheStorageCache::origin const):\n* Source/WebKit/NetworkProcess/storage/CacheStorageCache.h:\n* Source/WebKit/NetworkProcess/storage/CacheStorageManager.cpp:\n(WebKit::CacheStorageManager::create):\n(WebKit::CacheStorageManager::CacheStorageManager):\n* Source/WebKit/NetworkProcess/storage/CacheStorageManager.h:\n(WebKit::CacheStorageManager::origin const):\n* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp:\n(WebKit::NetworkStorageManager::cacheStorageRemoveCache):\n(WebKit::NetworkStorageManager::cacheStorageReference):\n(WebKit::NetworkStorageManager::cacheStorageDereference):\n(WebKit::NetworkStorageManager::cacheStorageRetrieveRecords):\n(WebKit::NetworkStorageManager::cacheStorageRemoveRecords):\n(WebKit::NetworkStorageManager::cacheStoragePutRecords):\n* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.h:\n* Source/WebKit/NetworkProcess/storage/OriginStorageManager.cpp:\n(WebKit::OriginStorageManager::StorageBucket::cacheStorageManager):\n\nOriginally-landed-as: 305413.900@safari-7624-branch (1ab57a04be24). rdar://184745108\nCanonical link: https://commits.webkit.org/319138@main",
      "email": "sihui_liu@apple.com",
      "hash": "5d1be2cedef6f18889a7c6bb55899aed91c7f16f",
      "subject": "Validate connection access to DOMCache with DOMCacheIdentifier"
    },
    "319139@main": {
      "author": "Jessica Lee",
      "avatar": "https://www.gravatar.com/avatar/fc717c99321d09f31fb9187418a8ffc5?d=identicon\u0026s=64",
      "cl": "319139@main",
      "clUrl": "https://commits.webkit.org/319139@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321350\nrdar://184384527\n\nReviewed by Sihui Liu and Kiet Ho.\n\nAdding iframe-loading-lazy-siblings-cross-site and iframe-loading-lazy-nested-cross-site which\ncheck lazy-loading across 3 distinct sites.\n\nNon-deterministic IPC timing sometimes caused the intersection to be computed before layout, in which the\ntarget becomes a zero-area rect that counts as intersecting and which results in a deferred frame being\nloaded eagerly. The fix is to copy the existing guard from Document::updateIntersectionObservers() to\nDocument::updateRemoteIntersectionObservers().\n\nTests: imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/cross-site/iframe-loading-lazy-nested-cross-site.sub.html\n       imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/cross-site/iframe-loading-lazy-siblings-cross-site.sub.html\n\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/cross-site/iframe-loading-lazy-nested-cross-site.sub-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/cross-site/iframe-loading-lazy-nested-cross-site.sub.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/cross-site/iframe-loading-lazy-siblings-cross-site.sub-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/cross-site/iframe-loading-lazy-siblings-cross-site.sub.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/cross-site/resources/iframe-loading-lazy-nested-subframe.sub.html: Added.\n* LayoutTests/tests-options.json:\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::updateRemoteIntersectionObservers):\n\nCanonical link: https://commits.webkit.org/319139@main",
      "email": "jlee53@apple.com",
      "hash": "811414ccc1d605644b63daf5a173ae1463a38f8e",
      "subject": "Add tests to check lazy-loading frames from multiple, distinct cross-site sites"
    },
    "319140@main": {
      "author": "Dan Hecht",
      "avatar": "https://www.gravatar.com/avatar/080f47d912b1b34d0be8293f825d132d?d=identicon\u0026s=64",
      "cl": "319140@main",
      "clUrl": "https://commits.webkit.org/319140@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321690\nrdar://184834345\n\nReviewed by Vassili Bykov.\n\nThis is a once-per-GC embedder callback, not a finalizer: it is passed no object\nand runs at the end of every collection. It is the internal half of\nJSContextGroupAddHeapFinalizer.\n\n    HeapFinalizerCallback           -\u003e GCCompletionCallback\n    Heap::addHeapFinalizerCallback  -\u003e Heap::addGCCompletionCallback\n    Heap::removeHeapFinalizerCallback\n                                    -\u003e Heap::removeGCCompletionCallback\n    m_heapFinalizerCallbacks        -\u003e m_gcCompletionCallbacks\n\nThe exported C entry points JSContextGroupAddHeapFinalizer and\nJSContextGroupRemoveHeapFinalizer keep their names for binary compatibility.\n\nNo behavior change.\n\n* Source/JavaScriptCore/API/JSHeapFinalizerPrivate.cpp:\n(JSContextGroupAddHeapFinalizer):\n(JSContextGroupRemoveHeapFinalizer):\n* Source/JavaScriptCore/CMakeLists.txt:\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/Sources.txt:\n* Source/JavaScriptCore/heap/GCCompletionCallback.cpp: Renamed from Source/JavaScriptCore/heap/HeapFinalizerCallback.cpp.\n(JSC::GCCompletionCallback::dump const):\n(JSC::GCCompletionCallback::run const):\n* Source/JavaScriptCore/heap/GCCompletionCallback.h: Renamed from Source/JavaScriptCore/heap/HeapFinalizerCallback.h.\n(JSC::GCCompletionCallback::GCCompletionCallback):\n(JSC::GCCompletionCallback::operator bool const):\n* Source/JavaScriptCore/heap/Heap.cpp:\n(JSC::Heap::clearConcurrentRetainedDataIfPossible):\n* Source/JavaScriptCore/heap/Heap.h:\n* Source/WebCore/WebCorePrefix.h:\n\nCanonical link: https://commits.webkit.org/319140@main",
      "email": "dan.hecht@apple.com",
      "hash": "62692012c98a7e0fe29e6f44d5b059c7f5ff66f9",
      "subject": "[JSC] Rename HeapFinalizerCallback to GCCompletionCallback"
    },
    "319141@main": {
      "author": "Dominic Mazzoni",
      "avatar": "https://www.gravatar.com/avatar/f76643c44a7ee3be45148e66d97ed8e4?d=identicon\u0026s=64",
      "cl": "319141@main",
      "clUrl": "https://commits.webkit.org/319141@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321601\nrdar://184726297\n\nReviewed by Tyler Wilcock.\n\nFollow-up to: https://bugs.webkit.org/show_bug.cgi?id=320762\n\n* LayoutTests/accessibility/isolated-tree/fieldset-element-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/fieldset-element.html: Added.\n* LayoutTests/accessibility/isolated-tree/file-upload-button-stringvalue-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/file-upload-button-stringvalue.html: Added.\n* LayoutTests/accessibility/isolated-tree/file-upload-button-with-axpress-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/file-upload-button-with-axpress.html: Added.\n* LayoutTests/accessibility/isolated-tree/first-letter-single-character-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/first-letter-single-character.html: Added.\n* LayoutTests/accessibility/isolated-tree/first-letter-text-transform-causes-crash-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/first-letter-text-transform-causes-crash.html: Added.\n* LayoutTests/accessibility/isolated-tree/focus-change-id-mutation-and-removal-crash-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/focus-change-id-mutation-and-removal-crash.html: Added.\n* LayoutTests/accessibility/isolated-tree/focus-inside-modal-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/focus-inside-modal.html: Added.\n* LayoutTests/accessibility/isolated-tree/focus-new-element.html: Added.\n* LayoutTests/accessibility/isolated-tree/focus-notification-without-prior-tree-access-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/focus-notification-without-prior-tree-access.html: Added.\n* LayoutTests/accessibility/isolated-tree/focusable-ancestor-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/focusable-ancestor.html: Added.\n* LayoutTests/accessibility/isolated-tree/focusable-div-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/focusable-div.html: Added.\n* LayoutTests/accessibility/isolated-tree/focusable-inside-hidden-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/focusable-inside-hidden.html: Added.\n* LayoutTests/accessibility/isolated-tree/form-control-value-settable.html: Added.\n* LayoutTests/accessibility/isolated-tree/frame-disconnect-textmarker-cache-crash-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/full-size-kana-untransformed-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/full-size-kana-untransformed.html: Added.\n* LayoutTests/accessibility/isolated-tree/generated-content-with-display-table-crash.html: Added.\n* LayoutTests/accessibility/isolated-tree/generic-role-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/generic-role.html: Added.\n* LayoutTests/accessibility/isolated-tree/global-aria-attributes-invalidate-presentational-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/global-aria-attributes-invalidate-presentational.html: Added.\n* LayoutTests/accessibility/isolated-tree/grid-row-authoring-error-ignored.html: Added.\n* LayoutTests/accessibility/isolated-tree/grid-with-aria-owned-cells-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/grid-with-aria-owned-cells.html: Added.\n* LayoutTests/accessibility/isolated-tree/hang-in-isignored-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/hang-in-isignored.html: Added.\n* LayoutTests/accessibility/isolated-tree/heading-crash-after-hidden-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/heading-crash-after-hidden.html: Added.\n* LayoutTests/accessibility/isolated-tree/heading-level-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/heading-level.html: Added.\n* LayoutTests/accessibility/isolated-tree/heading-title-includes-links-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/heading-title-includes-links.html: Added.\n* LayoutTests/accessibility/isolated-tree/help-text-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/help-text.html: Added.\n* LayoutTests/accessibility/isolated-tree/hidden-elements-with-aria-attributes-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/hidden-elements-with-aria-attributes.html: Added.\n* LayoutTests/accessibility/isolated-tree/hidden-label-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/hidden-label.html: Added.\n* LayoutTests/accessibility/isolated-tree/hidden-object-text-value-crash-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/hidden-object-text-value-crash.html: Added.\n* LayoutTests/accessibility/isolated-tree/hidden-slot-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/hidden-slot.html: Added.\n* LayoutTests/accessibility/isolated-tree/hidden-th-still-column-header-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/hidden-th-still-column-header.html: Added.\n* LayoutTests/accessibility/isolated-tree/hidden-until-found-programmatically-revealed-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/hidden-until-found-programmatically-revealed.html: Added.\n* LayoutTests/accessibility/isolated-tree/hit-test-on-stitched-text-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/hit-test-on-stitched-text.html: Added.\n* LayoutTests/accessibility/isolated-tree/html-element-aria-hidden-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/html-element-aria-hidden.html: Added.\n* LayoutTests/accessibility/isolated-tree/html-html-element-is-ignored-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/html-html-element-is-ignored.html: Added.\n* LayoutTests/accessibility/isolated-tree/html5-required-attribute-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/html5-required-attribute.html: Added.\n* LayoutTests/accessibility/isolated-tree/iframe-bastardization-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/iframe-bastardization.html: Added.\n* LayoutTests/accessibility/isolated-tree/iframe-content-inert-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/iframe-content-inert.html: Added.\n* LayoutTests/accessibility/isolated-tree/iframe-content-remains-accessible-after-navigation-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/iframe-content-visibility-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/iframe-content-visibility.html: Added.\n* LayoutTests/accessibility/isolated-tree/iframe-display-none-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/iframe-display-none.html: Added.\n* LayoutTests/accessibility/isolated-tree/iframe-tree-update-with-dirty-layout-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/iframe-tree-update-with-dirty-layout.html: Added.\n* LayoutTests/accessibility/isolated-tree/iframe-with-role-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/iframe-with-role.html: Added.\n* LayoutTests/accessibility/isolated-tree/iframe-within-cell-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/ignore-modals-without-any-content-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/ignore-modals-without-any-content.html: Added.\n* LayoutTests/accessibility/isolated-tree/ignore-spacer-elements-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/ignore-spacer-elements.html: Added.\n* LayoutTests/accessibility/isolated-tree/ignored-aria-role-description-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/ignored-aria-role-description.html: Added.\n* LayoutTests/accessibility/isolated-tree/ignored-textfield-still-accessible-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/ignored-textfield-still-accessible.html: Added.\n* LayoutTests/accessibility/isolated-tree/image-data-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/image-data.html: Added.\n* LayoutTests/accessibility/isolated-tree/image-link-inline-cont-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/image-link-inline-cont.html: Added.\n* LayoutTests/accessibility/isolated-tree/image-load-on-delay-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/image-load-on-delay.html: Added.\n* LayoutTests/accessibility/isolated-tree/image-map-link-title-text-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/image-map-link-title-text.html: Added.\n* LayoutTests/accessibility/isolated-tree/image-map-title-causes-crash-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/image-map-title-causes-crash.html: Added.\n* LayoutTests/accessibility/isolated-tree/image-map-update-parent-crash-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/image-map-update-parent-crash.html: Added.\n* LayoutTests/accessibility/isolated-tree/image-map-with-indirect-area-crash-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/image-map-with-indirect-area-crash.html: Added.\n* LayoutTests/accessibility/isolated-tree/image-map1-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/image-map1.html: Added.\n* LayoutTests/accessibility/isolated-tree/image-map2-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/image-map2.html: Added.\n* LayoutTests/accessibility/isolated-tree/image-overlay-elements-presentational-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/image-overlay-elements-presentational.html: Added.\n* LayoutTests/accessibility/isolated-tree/image-role-is-synonomous-with-img-role-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/image-role-is-synonomous-with-img-role.html: Added.\n* LayoutTests/accessibility/isolated-tree/image-with-alt-and-map.html: Added.\n* LayoutTests/accessibility/isolated-tree/img-alt-attribute-unassigned-empty-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/img-alt-attribute-unassigned-empty.html: Added.\n* LayoutTests/accessibility/isolated-tree/img-alt-tag-only-whitespace-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/img-alt-tag-only-whitespace.html: Added.\n* LayoutTests/accessibility/isolated-tree/img-aria-button-alt-tag-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/img-aria-button-alt-tag.html: Added.\n* LayoutTests/accessibility/isolated-tree/img-fallsback-to-title.html: Added.\n* LayoutTests/accessibility/isolated-tree/img-with-empty-alt-is-ignored-without-fallbacks-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/img-with-empty-alt-is-ignored-without-fallbacks.html: Added.\n* LayoutTests/accessibility/isolated-tree/img-with-svg-source-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/indeterminate-progressbar-custom-element-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/indeterminate-progressbar-custom-element.html: Added.\n* LayoutTests/accessibility/isolated-tree/inline-block-assertion-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/inline-block-assertion.html: Added.\n* LayoutTests/accessibility/isolated-tree/inline-continuations-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/input-file-causes-crash-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/input-file-causes-crash.html: Added.\n* LayoutTests/accessibility/isolated-tree/input-image-alt-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/input-image-alt.html: Added.\n* LayoutTests/accessibility/isolated-tree/input-type-hidden-in-aria-hidden-false-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/input-type-hidden-in-aria-hidden-false.html: Added.\n* LayoutTests/accessibility/isolated-tree/insert-children-assert-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/insert-children-assert.html: Added.\n* LayoutTests/accessibility/isolated-tree/insert-newline-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/insert-newline.html: Added.\n* LayoutTests/accessibility/isolated-tree/insert-selected-option-into-select-causes-crash-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/insert-selected-option-into-select-causes-crash.html: Added.\n* LayoutTests/accessibility/isolated-tree/insert-text-into-password-field-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/insert-text-into-password-field.html: Added.\n* LayoutTests/accessibility/isolated-tree/internal-link-anchors2-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/internal-link-anchors2.html: Added.\n* LayoutTests/accessibility/isolated-tree/invalid-inputs-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/invalid-inputs.html: Added.\n* LayoutTests/accessibility/isolated-tree/keyevents-for-actions-mimic-real-key-events-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/keyevents-for-actions-mimic-real-key-events.html: Added.\n* LayoutTests/accessibility/isolated-tree/keyevents-for-increment-actions-with-node-removal-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/keyevents-for-increment-actions-with-node-removal.html: Added.\n* LayoutTests/accessibility/isolated-tree/keyevents-posted-for-dismiss-action-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/keyevents-posted-for-dismiss-action.html: Added.\n* LayoutTests/accessibility/isolated-tree/keyevents-posted-for-increment-actions-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/keyevents-posted-for-increment-actions.html: Added.\n* LayoutTests/accessibility/isolated-tree/label-element-press-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/label-element-press.html: Added.\n* LayoutTests/accessibility/isolated-tree/label-for-control-id-change-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/label-for-control-id-change.html: Added.\n* LayoutTests/accessibility/isolated-tree/label-for-with-aria-labelledby-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/label-for-with-aria-labelledby.html: Added.\n* LayoutTests/accessibility/isolated-tree/label-static-text-path-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/label-static-text-path.html: Added.\n* LayoutTests/accessibility/isolated-tree/label-with-pseudo-elements-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/label-with-pseudo-elements.html: Added.\n* LayoutTests/accessibility/isolated-tree/language-attribute-change-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/language-attribute-change.html: Added.\n* LayoutTests/accessibility/isolated-tree/language-attribute-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/language-attribute.html: Added.\n* LayoutTests/accessibility/isolated-tree/left-right-line-range-display-table-in-flex-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/left-right-line-range-display-table-in-flex.html: Added.\n* LayoutTests/accessibility/isolated-tree/legend-children-are-visible-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/legend-children-are-visible.html: Added.\n* LayoutTests/accessibility/isolated-tree/line-range-display-table-in-flex-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/line-range-display-table-in-flex.html: Added.\n* LayoutTests/accessibility/isolated-tree/link-becomes-visited-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/link-becomes-visited.html: Added.\n* LayoutTests/accessibility/isolated-tree/link-inside-button-accessible-text-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/link-inside-button-accessible-text.html: Added.\n* LayoutTests/accessibility/isolated-tree/linked-elements-outside-aria-modal-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/linked-elements-outside-aria-modal.html: Added.\n* LayoutTests/accessibility/isolated-tree/links-activation-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/links-activation.html: Added.\n* LayoutTests/accessibility/isolated-tree/list-detection-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/list-detection.html: Added.\n* LayoutTests/accessibility/isolated-tree/list-detection2-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/list-detection2.html: Added.\n* LayoutTests/accessibility/isolated-tree/list-item-with-pseudo-element-crash-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/list-item-with-pseudo-element-crash.html: Added.\n* LayoutTests/accessibility/isolated-tree/list-marker-text-stitching-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/list-marker-text-stitching.html: Added.\n* LayoutTests/accessibility/isolated-tree/list-with-dynamically-changing-content-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/list-with-dynamically-changing-content.html: Added.\n* LayoutTests/accessibility/isolated-tree/list/list-active-element-selected-children-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/list/list-active-element-selected-children.html: Added.\n* LayoutTests/accessibility/isolated-tree/list/listbox-active-element-selected-children-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/list/listbox-active-element-selected-children.html: Added.\n* LayoutTests/accessibility/isolated-tree/listbox-clear-selection-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/listbox-clear-selection.html: Added.\n* LayoutTests/accessibility/isolated-tree/listbox-enabled-states-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/listbox-enabled-states.html: Added.\n* LayoutTests/accessibility/isolated-tree/listitem-title-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/listitem-title.html: Added.\n* LayoutTests/accessibility/isolated-tree/lists-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/lists.html: Added.\n* LayoutTests/accessibility/isolated-tree/live-region-attributes-update-after-dynamic-change-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/live-region-attributes-update-after-dynamic-change.html: Added.\n* LayoutTests/accessibility/isolated-tree/loading-iframe-sends-notification-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/loading-iframe-updates-axtree-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/loading-iframe-updates-axtree.html: Added.\n* LayoutTests/platform/mac-wk2/TestExpectations:\n* LayoutTests/platform/mac-wk2/accessibility/isolated-tree/file-upload-button-stringvalue-expected.txt: Added.\n* LayoutTests/platform/mac/TestExpectations:\n* LayoutTests/platform/mac/accessibility/isolated-tree/file-upload-button-stringvalue-expected.txt: Added.\n* LayoutTests/platform/mac/accessibility/isolated-tree/focus-new-element-expected.txt: Added.\n* LayoutTests/platform/mac/accessibility/isolated-tree/form-control-value-settable-expected.txt: Added.\n* LayoutTests/platform/mac/accessibility/isolated-tree/generated-content-with-display-table-crash-expected.txt: Added.\n* LayoutTests/platform/mac/accessibility/isolated-tree/grid-row-authoring-error-ignored-expected.txt: Added.\n* LayoutTests/platform/mac/accessibility/isolated-tree/image-with-alt-and-map-expected.txt: Added.\n* LayoutTests/platform/mac/accessibility/isolated-tree/img-fallsback-to-title-expected.txt: Added.\n* LayoutTests/platform/mac/accessibility/isolated-tree/listitem-title-expected.txt: Added.\n* LayoutTests/platform/mac/accessibility/isolated-tree/lists-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/319141@main",
      "email": "dm_mazzoni@apple.com",
      "hash": "64748f71cd12179747e0dcef96124c83a076cbe4",
      "subject": "AX: run more tests with isolated-tree flag on (3 of many)"
    },
    "319142@main": {
      "author": "Rupin Mittal",
      "avatar": "https://www.gravatar.com/avatar/3e3de9845931d2dc844afb00056ec94e?d=identicon\u0026s=64",
      "cl": "319142@main",
      "clUrl": "https://commits.webkit.org/319142@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321664\nrdar://184792753\n\nReviewed by Jessica Lee.\n\nThe spec says that NavigationTransition must have a property called \"to\"\nwhich represents the NavigationDestination of a navigation.\nhttps://html.spec.whatwg.org/multipage/nav-history-apis.html#navigationtransition\n\nThis patch implements this property. This is tested by a WPT test:\nnavigation-api/ordering-and-transition/transition-to.html\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/ordering-and-transition/transition-to-expected.txt:\n* Source/WebCore/page/Navigation.cpp:\n(WebCore::Navigation::createTransitionForInterception):\n* Source/WebCore/page/NavigationTransition.cpp:\n(WebCore::NavigationTransition::create):\n(WebCore::NavigationTransition::NavigationTransition):\n* Source/WebCore/page/NavigationTransition.h:\n* Source/WebCore/page/NavigationTransition.idl:\n\nCanonical link: https://commits.webkit.org/319142@main",
      "email": "rupin@apple.com",
      "hash": "cd40dc9c0d7265e263eb3204d763b5d510d953df",
      "subject": "[Navigation API] Implement NavigationTransition's to property"
    },
    "319143@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "319143@main",
      "clUrl": "https://commits.webkit.org/319143@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321650\nrdar://184776089\n\nReviewed by Tim Horton.\n\n318029@main introduced support for directional scroll locking for\ndiagonal scrolls. This is generally the mode in which we want to\npropagate gesture-driven scroll deltas. However, certain flows\nnecessitate that we opt out of locking. WKDirectionalScrollTracker does\nnot offer any API escape hatch for these cases, though, so that is what\nwe teach it in this patch.\n\nTest: AppKitGesturesTests/Basic/diagonallySwipingBetweenSpacesScrollsBothAxes()\n\n* Source/WebKit/UIProcess/mac/WKAppKitGestureController.mm:\n(-[WKAppKitGestureController sendWheelEventForGesture:]):\n(-[WKAppKitGestureController startMomentumIfNeededForGesture:]):\n* Source/WebKit/UIProcess/mac/WKDirectionalScrollLockTracker.swift:\n(WKDirectionalScrollLockTracker.update(_:canScrollHorizontally:canScrollVertically:prefersUnlocked:time:)):\n(WKDirectionalScrollLockTracker.filterVelocity(_:prefersUnlocked:)):\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift:\n\nCanonical link: https://commits.webkit.org/319143@main",
      "email": "a_protyasha@apple.com",
      "hash": "e29b63174052d82929fcc8e1081f06573ffb9583",
      "subject": "[AppKit Gestures] Certain diagonal scrolls should be able to bypass directional locking"
    },
    "319144@main": {
      "author": "Diego Pino Garcia",
      "avatar": "https://www.gravatar.com/avatar/e8cce88637f1a6e79155e8371e24b2e8?d=identicon\u0026s=64",
      "cl": "319144@main",
      "clUrl": "https://commits.webkit.org/319144@main",
      "description": "Unreviewed.\n\nRemove duplicated baselines.\n\n* LayoutTests/platform/glib/editing/inserting/insert-3851164-fix-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/backgrounds/animated-svg-as-mask-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/backgrounds/repeat/noRepeatCorrectClip-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/block/float/br-with-clear-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/block/float/dynamic-unfloat-pref-width-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/borders/borderRadiusArcs01-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/borders/borderRadiusDouble01-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/borders/borderRadiusDouble02-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/borders/borderRadiusDouble03-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/borders/borderRadiusGroove01-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/borders/borderRadiusGroove02-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/borders/borderRadiusInset01-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/borders/borderRadiusOutset01-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/borders/borderRadiusRidge01-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/borders/table-borders-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/css/hsla-color-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/css/outline-narrowLine-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/dom/HTMLProgressElement/indeterminate-progress-001-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/dom/SelectorAPI/resig-SelectorsAPI-test-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/dynamic/010-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/events/onload-re-entry-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/gradients/simple-gradients-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/multicol/pagination/nested-transforms-expected.png: Removed.\n* LayoutTests/platform/glib/fast/multicol/pagination/nested-transforms-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/table/006-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/table/013-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/table/auto-with-percent-height-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/table/dynamic-cellpadding-expected.txt: Removed.\n* LayoutTests/platform/glib/fast/table/empty-table-percent-height-expected.txt: Removed.\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/css/css-transitions/properties-value-inherit-001-expected.txt: Removed.\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/encrypted-media/clearkey-mp4-playback-temporary-clear-encrypted-segmented.https-expected.txt: Removed.\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/html/anonymous-iframe/require-corp-embed-anonymous-iframe.tentative.https.window-expected.txt: Removed.\n* LayoutTests/platform/glib/mathml/presentation/menclose-notation-default-longdiv-expected.txt: Removed.\n* LayoutTests/platform/glib/svg/custom/svg-fonts-segmented-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug10039-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug1220-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug1261-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug133948-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug139524-1-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug139524-3-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug139524-4-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug15933-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug1818-1-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug1818-2-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug1818-4-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug1818-5-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug2123-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug219693-1-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug219693-2-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug46944-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug53690-1-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug53690-2-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug54450-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug55789-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug641-1-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug641-2-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug8361-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla/bugs/bug88524-expected.txt: Removed.\n* LayoutTests/platform/glib/tables/mozilla_expected_failures/bugs/bug1262-expected.txt: Removed.\n* LayoutTests/platform/wpe/imported/w3c/web-platform-tests/dom/nodes/Document-createEvent-touchevent.window-expected.txt: Removed.\n\nCanonical link: https://commits.webkit.org/319144@main",
      "email": "dpino@igalia.com",
      "hash": "3be3f925a9b6012cd11d03d60fba94f1350d27db",
      "subject": "[GLIB] layout test gardening"
    }
  },
  "date": "2026-08-13",
  "days": 1,
  "generatedAt": "2026-08-13T22:06:51Z",
  "markdown": "## Highlights\n- **Security** Fixed a UAF in manual slot assignment during reentrant composed-tree teardown, closing a nasty DOM lifetime bug. [commit 319089@main](https://commits.webkit.org/319089@main)\n- **Privacy** Stopped `indexedDB.databases()` from leaking database names across storage partitions, a real cross-partition data exposure bug. [commit 319117@main](https://commits.webkit.org/319117@main)\n- **Security** Locked down extension exposure so only the offscreen web view can access `browser.runtime`. [commit 319135@main](https://commits.webkit.org/319135@main)\n- **Web Platform** Turned on CSS `inherit()` by default, moving css-values-5 forward for authors. [commit 319062@main](https://commits.webkit.org/319062@main)\n- **Web Platform** Landed Navigation API precommit handling, a core piece of the new navigation lifecycle. [commit 319084@main](https://commits.webkit.org/319084@main)\n- **V8** JSC's regex engine can now JIT compile lookbehinds, with related Unicode and Boyer-Moore fixes improving modern regexp support. [commit 319067@main](https://commits.webkit.org/319067@main)\n- **GPU** Enabled WebGPU on watchOS, expanding the platform surface for GPU-backed web content. [commit 319071@main](https://commits.webkit.org/319071@main)\n- **Perf** JSC landed a tight cluster of Air and JIT optimizer improvements that cut compiler work in hot paths. [commit 319081@main](https://commits.webkit.org/319081@main)\n- **Rendering** Fixed outermost SVG filters so top-level `\u003csvg\u003e` filter effects actually apply as specified. [commit 319121@main](https://commits.webkit.org/319121@main)\n\n## What landed by area\n\n### JavaScriptCore and RegExp\n- **Perf** Avoided unnecessary work in the JIT code generation loop to trim compiler overhead. [commit 319120@main](https://commits.webkit.org/319120@main)\n- **Perf** Improved FastStringifier short-string copy tiering for faster serialization paths. [commit 319109@main](https://commits.webkit.org/319109@main)\n- **Perf** Made Air liveness computation faster in the backend optimizer. [commit 319081@main](https://commits.webkit.org/319081@main)\n- **Perf** Seeded the Air dead-code-elimination worklist in backward order for better optimizer behavior. [commit 319075@main](https://commits.webkit.org/319075@main)\n- **Perf** Added quick pattern matching for byte-copy loops in OMG. [commit 319065@main](https://commits.webkit.org/319065@main)\n- **Refactor** Introduced `AirInstAnalyzer`, likely setting up more structured Air analysis passes. [commit 319088@main](https://commits.webkit.org/319088@main)\n- **Refactor** Simplified Air DCE by dropping unnecessary `Vector` element removals. [commit 319087@main](https://commits.webkit.org/319087@main)\n- **Security** Fixed `callExceptionFuzz` clobbering `linkRegister`, a correctness bug in low-level JSC codegen. [commit 319077@main](https://commits.webkit.org/319077@main)\n- **V8** Taught FTL OSR exit to handle `DataFormatStorage` in `reboxAccordingToFormat`. [commit 319094@main](https://commits.webkit.org/319094@main)\n- **V8** JIT-compiled lookbehinds in YARR, a meaningful step up for advanced regexp performance and coverage. [commit 319067@main](https://commits.webkit.org/319067@main)\n- **Web Platform** Fixed Unicode property escapes so case-insensitive behavior works in `u` and `v` modes. [commit 319064@main](https://commits.webkit.org/319064@main)\n- **Perf** Extended Boyer-Moore info collection through parenthetical assertions in YARR. [commit 319086@main](https://commits.webkit.org/319086@main)\n- **Web Platform** Split Temporal month-day ISO reference-date helpers into dedicated functions for clearer semantics. [commit 319104@main](https://commits.webkit.org/319104@main)\n- **Refactor** Renamed `HeapFinalizerCallback` to `GCCompletionCallback` for clearer GC lifecycle naming. [commit 319140@main](https://commits.webkit.org/319140@main)\n- **Refactor** Renamed `Heap::finalize` to `Heap::runCollectionEpilogue` to better describe GC end-phase work. [commit 319134@main](https://commits.webkit.org/319134@main)\n- **Refactor** Renamed `finalizeUnconditionally` to `reconcileWeakReferencesAtGCEnd` to make weak-reference handling explicit. [commit 319132@main](https://commits.webkit.org/319132@main)\n\n### Web platform APIs, DOM, and standards\n- **Web Platform** Implemented `NavigationTransition.to`, filling in another Navigation API surface. [commit 319142@main](https://commits.webkit.org/319142@main)\n- **Web Platform** Implemented the Navigation API precommit handler, shaping interception before commit. [commit 319084@main](https://commits.webkit.org/319084@main)\n- **Web Platform** Fixed `navigateEvent.scroll()` so missing fragments scroll to the top of the document. [commit 319068@main](https://commits.webkit.org/319068@main)\n- **Web Platform** Enabled the `interactive-widget` feature flag. [commit 319118@main](https://commits.webkit.org/319118@main)\n- **Web Platform** Enabled CSS `inherit()` by default. [commit 319062@main](https://commits.webkit.org/319062@main)\n- **Web Platform** Fixed `random()` caching by including the custom property name in the cache key. [commit 319096@main](https://commits.webkit.org/319096@main)\n- **Web Platform** Added coverage for the `random()` caching key in custom properties. [commit 319131@main](https://commits.webkit.org/319131@main)\n- **Web Platform** Made SVG enumerated attributes fall back to their initial value when removed or invalid. [commit 319093@main](https://commits.webkit.org/319093@main)\n- **Web Platform** Marked some no-op APIs as deprecated, which should reduce spec drift and dead surface. [commit 319110@main](https://commits.webkit.org/319110@main)\n- **Media** `WebCodecsImageDecoder` no longer inherits from `EventTarget`, aligning the API shape with reality. [commit 319102@main](https://commits.webkit.org/319102@main)\n- **Security** Made canvas tainting propagate when cross-origin images are drawn and the canvas is captured as a video frame. [commit 319101@main](https://commits.webkit.org/319101@main)\n- **Web Platform** Same-task fragment navigation after a `download` click now cancels the download instead of racing it. [commit 319105@main](https://commits.webkit.org/319105@main)\n- **Web Platform** Wired the virtual wallet mock for OpenID4VP signed and multisigned protocols. [commit 319055@main](https://commits.webkit.org/319055@main)\n- **Networking** Re-enabled the WebTransport CSP test on iOS. [commit 319090@main](https://commits.webkit.org/319090@main)\n\n### Security, privacy, and storage isolation\n- **Privacy** Fixed `indexedDB.databases()` leaking names across storage partitions because of a swapped `ClientOrigin`. [commit 319117@main](https://commits.webkit.org/319117@main)\n- **Security** Added connection validation for DOMCache access using `DOMCacheIdentifier`. [commit 319138@main](https://commits.webkit.org/319138@main)\n- **Security** Added connection validation for FileSystem storage using `FileSystemHandleIdentifier`. [commit 319116@main](https://commits.webkit.org/319116@main)\n- **Security** Fixed `about:blank` incorrectly inheriting a cross-origin policy container from an empty document URL. [commit 319079@main](https://commits.webkit.org/319079@main)\n- **Security** Fixed a UAF in `DataListButtonElement::defaultEventHandler`. [commit 319066@main](https://commits.webkit.org/319066@main)\n- **Privacy** Fixed a data race in `WebPrivacyHelpers` around the process-global tracker-domain lookup map. [commit 319069@main](https://commits.webkit.org/319069@main)\n- **Security** Restricted `browser.runtime` access to the offscreen web view. [commit 319135@main](https://commits.webkit.org/319135@main)\n\n### Site isolation, navigation, and process model\n- **UI** Fixed google.com becoming unresponsive after going back to search results under Site Isolation. [commit 319136@main](https://commits.webkit.org/319136@main)\n- **Rendering** Fixed printing so dark mode is disabled even when the main frame is remote. [commit 319122@main](https://commits.webkit.org/319122@main)\n- **DevTools** Fixed `searchInResources.html` failures under Site Isolation in Web Inspector. [commit 319070@main](https://commits.webkit.org/319070@main)\n- **Media** Marked `media/video-seek-after-end-play.html` as a permanent Site Isolation failure while the underlying issue remains. [commit 319099@main](https://commits.webkit.org/319099@main)\n- **Web Platform** Added lazy-loading frame coverage across multiple distinct cross-site origins. [commit 319139@main](https://commits.webkit.org/319139@main)\n- **Refactor** Refactored the lazy cross-site iframe test to verify the subframe's loaded URL directly. [commit 319091@main](https://commits.webkit.org/319091@main)\n\n### Rendering, graphics, and media\n- **Rendering** Applied filters specified on the outermost `\u003csvg\u003e`, fixing a visible SVG correctness gap. [commit 319121@main](https://commits.webkit.org/319121@main)\n- **Rendering** Loosened GFC max-width and max-height avoidance reasons, likely improving grid layout decisions. [commit 319106@main](https://commits.webkit.org/319106@main)\n- **Rendering** Updated `affectedTracksMatchingMinSizeFunction` to handle all phases in GFC. [commit 319056@main](https://commits.webkit.org/319056@main)\n- **Rendering** Removed a stale `ASSERT(rowEnd.isExplicit())` in grid row placement coverage checks. [commit 319125@main](https://commits.webkit.org/319125@main)\n- **Rendering** Fixed misleading text highlights when floated images sit above content on parks.ca.gov. [commit 319128@main](https://commits.webkit.org/319128@main)\n- **Security** Made `PathCG` use a thread-safe `scratchContext`, closing a graphics threading hazard. [commit 319095@main](https://commits.webkit.org/319095@main)\n- **Security** Fixed `NativeImage` touching the platform image without a lock. [commit 319114@main](https://commits.webkit.org/319114@main)\n- **GPU** Fixed a GPU process crash while drawing image controls in `servicesRolloverButtonCell()`. [commit 319097@main](https://commits.webkit.org/319097@main)\n- **Media** Fixed a crash in `libwebrtc.dylib` in peer connection session description flow. [commit 319098@main](https://commits.webkit.org/319098@main)\n- **Media** Fixed a flaky in-band text track cue test. [commit 319058@main](https://commits.webkit.org/319058@main)\n- **GPU** Enabled WebGPU for watchOS. [commit 319071@main](https://commits.webkit.org/319071@main)\n\n### Accessibility, text extraction, and input\n- **A11y** Ran more tests with the isolated-tree flag enabled, continuing the push toward isolated accessibility coverage. [commit 319141@main](https://commits.webkit.org/319141@main)\n- **A11y** Fixed isolated-tree attribute mismatches when a textarea ends with a line break. [commit 319133@main](https://commits.webkit.org/319133@main)\n- **A11y** Exposed the document scrollbar in the isolated tree when revealing content makes the page scrollable. [commit 319127@main](https://commits.webkit.org/319127@main)\n- **UI** Made certain diagonal AppKit scroll gestures bypass directional locking. [commit 319143@main](https://commits.webkit.org/319143@main)\n- **UI** Added a feature flag for gesture recognizer-driven gesture event support on AppKit. [commit 319130@main](https://commits.webkit.org/319130@main)\n- **UI** Brought back DOM `dblclick` support for AppKit gesture recognizer paths. [commit 319115@main](https://commits.webkit.org/319115@main)\n- **UI** Adopted `NSTextCheckingSoftSpaceRangeKey` in WebKit text handling. [commit 319092@main](https://commits.webkit.org/319092@main)\n- **UI** Fullscreen cancel behavior now reflects keyboard lock semantics instead of always letting Escape win. [commit 319103@main](https://commits.webkit.org/319103@main)\n- **A11y** Fixed text extraction so adobe.com's \"Change Password\" button is clickable in account settings. [commit 319129@main](https://commits.webkit.org/319129@main)\n- **A11y** Included form control labels in text-extraction interaction descriptions. [commit 319072@main](https://commits.webkit.org/319072@main)\n- **Mobile** Fixed null `TextIndicator` dereferences in iOS position information consumers. [commit 319126@main](https://commits.webkit.org/319126@main)\n\n### Web Inspector, tooling, and build\n- **DevTools** Canvas recording now captures object arguments and result objects, improving replay fidelity. [commit 319059@main](https://commits.webkit.org/319059@main)\n- **DevTools** Fixed `Page.searchInResources` returning duplicate matches for a resource. [commit 319061@main](https://commits.webkit.org/319061@main)\n- **DevTools** Migrated Web Inspector from legacy `.eslintrc` to modern `eslint.config.mjs`. [commit 319063@main](https://commits.webkit.org/319063@main)\n- **Build** Fixed CMake prewarmed modules not being cached during WebKit builds. [commit 319083@main](https://commits.webkit.org/319083@main)\n- **Build** Added results database API endpoints for uploading and querying EWS test results. [commit 319085@main](https://commits.webkit.org/319085@main)\n- **Build** Fixed `Tools/CISupport/run-tests` when AutoInstall registrations are missing. [commit 319124@main](https://commits.webkit.org/319124@main)\n- **Build** Logged `git-fetch` setup failures as warnings with output, making infra breakage easier to diagnose. [commit 319113@main](https://commits.webkit.org/319113@main)\n- **Perf** `numberOfProcessorCores()` now honors the `NUMBER_OF_PROCESSORS` environment variable. [commit 319108@main](https://commits.webkit.org/319108@main)\n- **Build** Stopped the JHBuild minimal moduleset from building `libwpe` and `wpebackend-fdo`. [commit 319107@main](https://commits.webkit.org/319107@main)\n- **Build** Fixed `run-benchmark` auto-starting experimental SP4 suites. [commit 319060@main](https://commits.webkit.org/319060@main)\n- **GPU** Kept ANGLE dEQP tests from showing windows. [commit 319112@main](https://commits.webkit.org/319112@main)\n- **Mobile** Added `SystemTracePoints.plist` to the Xcode project. [commit 319074@main](https://commits.webkit.org/319074@main)\n- **Mobile** Fixed missing PID labels when showing frame process borders on iOS. [commit 319073@main](https://commits.webkit.org/319073@main)\n- **Mobile** Updated WebKit to build against the public iOS 27 SDK. [commit 319078@main](https://commits.webkit.org/319078@main)\n- **UI** Fixed SwiftUI `WebPage.backForwardList` reliability. [commit 319076@main](https://commits.webkit.org/319076@main)\n- **Refactor** Removed `ThreadSafeWeakOrStrongPtr`. [commit 319082@main](https://commits.webkit.org/319082@main)\n- **Refactor** Moved Mach message send and receive into `MachMessage` and simplified the implementation. [commit 319119@main](https://commits.webkit.org/319119@main)\n\n### Test gardening and platform stability\n- **Build** GLib layout test gardening landed. [commit 319144@main](https://commits.webkit.org/319144@main)\n- **Build** GLib gardening for August 12 landed. [commit 319080@main](https://commits.webkit.org/319080@main)\n- **Build** Marked `web-locks/bfcache/abort.tentative.https.html` flaky crashing on iOS. [commit 319123@main](https://commits.webkit.org/319123@main)\n- **Build** Marked `RTCRtpReceiver-getSynchronizationSources.https.html` flaky on macOS and iOS. [commit 319111@main](https://commits.webkit.org/319111@main)\n- **Build** Fixed constant crash expectations for four imported CSS grid auto-repeat tests after a regression. [commit 319057@main](https://commits.webkit.org/319057@main)\n- **Build** Fixed a near-constant assertion crash in WPE GTK remote rendering backend GPU IPC testing. [commit 319100@main](https://commits.webkit.org/319100@main)\n\n## Reverts \u0026 Reapplies\nNone.",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [
    {
      "name": "Unreviewed",
      "count": 1
    }
  ],
  "since": "2026-08-13",
  "totals": {
    "commits": 90,
    "features": 89,
    "rolls": 1
  },
  "until": "2026-08-13"
}