{ "commits": { "319203@main": { "author": "Jessica Cheung", "avatar": "https://www.gravatar.com/avatar/5c102f093ce6bc01424466a4cfdf1d1f?d=identicon\u0026s=64", "cl": "319203@main", "clUrl": "https://commits.webkit.org/319203@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321028\nrdar://184061866\n\nReviewed by Aditya Keerthi and Abrar Rahman Protyasha.\n\nAdd more comprehensive keyboard related test for overlays-content\nand resizes-content. The following new tests include these cases:\n- Hardware keyboard mode\n- Orientation rotations from portrait, to landscape, then back to portrait\n- Keyboard dismissal\n\nInclude a new `ensureVisibleContentRectAndStablePresentationUpdate`\nhelper that calls...\n- _doAfterNextVisibleContentRectUpdate: This calls _scheduleVisibleContentRectUpdate\nwhich makes the UI process rebuild the visible content rect update from the view's\npresent state (e.g. window size, obscured insets)\n- _doAfterNextStablePresentationUpdate: This either adds to\n_stableStatePresentationUpdateCallbacks, or creates the array,\nwhich only gets emptied out if the page is stable in _didCommitLayerTree.\nWait for the rotations to be finished before reading the heights of the viewports.\n\n* LayoutTests/fast/visual-viewport/ios/interactive-widget/overlays-content-hardware-keyboard-expected.txt: Added.\n* LayoutTests/fast/visual-viewport/ios/interactive-widget/overlays-content-hardware-keyboard.html: Added.\n* LayoutTests/fast/visual-viewport/ios/interactive-widget/overlays-content-orientation-rotations-expected.txt: Added.\n* LayoutTests/fast/visual-viewport/ios/interactive-widget/overlays-content-orientation-rotations.html: Added.\n* LayoutTests/fast/visual-viewport/ios/interactive-widget/overlays-content-zoom-disabled-expected.txt:\n* LayoutTests/fast/visual-viewport/ios/interactive-widget/overlays-content-zoom-disabled.html:\n* LayoutTests/fast/visual-viewport/ios/interactive-widget/resizes-content-hardware-keyboard-expected.txt: Added.\n* LayoutTests/fast/visual-viewport/ios/interactive-widget/resizes-content-hardware-keyboard.html: Added.\n* LayoutTests/fast/visual-viewport/ios/interactive-widget/resizes-content-orientation-rotations-expected.txt: Added.\n* LayoutTests/fast/visual-viewport/ios/interactive-widget/resizes-content-orientation-rotations.html: Added.\n* LayoutTests/resources/ui-helper.js:\n(window.UIHelper.ensureVisibleContentRectAndStablePresentationUpdate.return.new.Promise):\n(window.UIHelper.ensureVisibleContentRectAndStablePresentationUpdate):\n\nCanonical link: https://commits.webkit.org/319203@main", "email": "jcheung23@apple.com", "hash": "dc4953ade17ba1ac0a9fa07717071ccbc1339271", "subject": "[interactive-widget] Add more comprehensive keyboard related layout tests" }, "319204@main": { "author": "Jeffrey Xu", "avatar": "https://www.gravatar.com/avatar/102604c66589181d1a1247ea63f49964?d=identicon\u0026s=64", "cl": "319204@main", "clUrl": "https://commits.webkit.org/319204@main", "description": "rdar://181640656\n\nReviewed by Alex Christensen.\n\nThis is implemented with the libnetcore library, similar to other existing API test helpers.\nThis reuses a lot of the work added by https://github.com/WebKit/WebKit/pull/70871 for the HTTP/2 server.\n\nThis commit was partially written by Claude, with human review.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/HTTP3Server.mm\n\n* Tools/TestWebKitAPI/Helpers/cocoa/HTTPServer.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/HTTPServer.mm:\n(TestWebKitAPI::shouldDisableTLS):\n(TestWebKitAPI::attachHTTPMessagingListener):\n(TestWebKitAPI::quicListenerParameters):\n(TestWebKitAPI::HTTPServer::listenerParameters):\n(TestWebKitAPI::HTTPServer::HTTPServer):\n(TestWebKitAPI::HTTPServer::scheme const):\n* Tools/TestWebKitAPI/SourcesCocoa.txt:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/HTTP3Server.mm: Added.\n(-[HTTP3ServerSessionDelegate URLSession:task:didReceiveChallenge:completionHandler:]):\n(TestWebKitAPI::http3Request):\n(TestWebKitAPI::TEST(HTTP3Server, RoundTrip)):\n(TestWebKitAPI::TEST(HTTP3Server, RequestMethodPathAndHeaders)):\n(TestWebKitAPI::TEST(HTTP3Server, POSTBody)):\n(TestWebKitAPI::TEST(HTTP3Server, NonDefaultStatusCodeAndResponseHeader)):\n(TestWebKitAPI::TEST(HTTP3Server, MultipleRequestsOverOneConnection)):\n(TestWebKitAPI::connectRawHTTP3Client):\n(TestWebKitAPI::receiveRawHTTP3Response):\n(TestWebKitAPI::performRawHTTP3Request):\n* Tools/TestWebKitAPI/Helpers/cocoa/HTTPServer.swift:\n* Tools/TestWebKitAPI/Helpers/cocoa/NetworkSPI.h:\n\nCanonical link: https://commits.webkit.org/319204@main", "email": "jeffrey_xu2@apple.com", "hash": "136b4c7ce2ff25a0f80c20a85cc68163acd12b61", "subject": "Add an HTTP/3 server to API tests." }, "319205@main": { "author": "Tim Nguyen", "avatar": "https://www.gravatar.com/avatar/208c05ac2decdf818a4a08ada568328e?d=identicon\u0026s=64", "cl": "319205@main", "clUrl": "https://commits.webkit.org/319205@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321814\nrdar://184950973\n\nReviewed by Simon Fraser.\n\nThe work was done by Lilly Le (@cupidsity) and is now ready to be turned on.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/319205@main", "email": "ntim@apple.com", "hash": "dfeb356f15d2f71c36b3c58ccb8b66f785d19eb0", "subject": "corner-shape: enable by default" }, "319206@main": { "author": "Brian Weinstein", "avatar": "https://www.gravatar.com/avatar/2892a9aaa68f537ee65c6f95ef0768a6?d=identicon\u0026s=64", "cl": "319206@main", "clUrl": "https://commits.webkit.org/319206@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321794\nrdar://184269255\n\nReviewed by Timothy Hatcher.\n\nThis PR also has a drive-by fix to fix a missing import.\n\n* Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPIOffscreenCocoa.mm:\n(WebKit::WebExtensionContext::isOffscreenMessageAllowed):\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPINamespace.cpp:\n(WebKit::WebExtensionAPINamespace::isPropertyAllowed):\n\nCanonical link: https://commits.webkit.org/319206@main", "email": "bweinstein@apple.com", "hash": "83356db35599fb8f3c8c7beb05ec2b4a748d2adc", "subject": "Only expose the offscreen API if the feature flag is on" }, "319207@main": { "author": "Marta Darbinyan", "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64", "cl": "319207@main", "clUrl": "https://commits.webkit.org/319207@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321819\nrdar://184960798\n\nUnreviewed test Gardening\n\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319207@main", "email": "darbinyan@apple.com", "hash": "afb748eb16b8eaf7c85aad4203658349efa279b2", "subject": "[Gardening]: REGRESSION(19099@main): [macOS iOS] media/video-multiple-concurrent-playback.html is flaky failure" }, "319208@main": { "author": "Rupin Mittal", "avatar": "https://www.gravatar.com/avatar/3e3de9845931d2dc844afb00056ec94e?d=identicon\u0026s=64", "cl": "319208@main", "clUrl": "https://commits.webkit.org/319208@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321770\nrdar://184893603\n\nReviewed by Ben Nham.\n\nEnable the precommit handler by default on the same platforms that the\nNavigation API is enabled on.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/319208@main", "email": "rupin@apple.com", "hash": "a421c5a833785b36759a4361aea7cc65891eb575", "subject": "[Navigation API] Enable precommit handler by default" }, "319209@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "319209@main", "clUrl": "https://commits.webkit.org/319209@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321259\nrdar://184071471\n\nReviewed by Alan Baradlay.\n\nLineBuilder::collectShapeRanges walks the candidate content and collects the ranges of\nshapable content that span inline box boundaries. When it ran into content that cannot be\npart of the current range -either because the content is not eligible for shaping (simple\ncode path, combined text or non-RTL) or because it uses a different font- it discarded the\nentire candidate range instead of closing it.\n\nA single trailing full stop was therefore enough to lose shaping for the whole word e.g.\n\n \u003cdiv dir=rtl lang=ar\u003e\u003cspan\u003e\u0026#x671;\u003c/span\u003e...\u003cspan\u003e\u0026#x629;\u003c/span\u003e\u003cspan\u003e.\u003c/span\u003e\u003c/div\u003e\n\nHere the '.' text box takes the simple code path, so the accumulated range for the Arabic\ncontent in front of it got dropped and each character ended up being shaped on its own and\nrendered in isolated form (which also made the content measure wider than the equivalent\nplain text).\n\nContent that is not eligible for shaping should only terminate the shaping range. Let's\ncommit what we have collected so far instead of throwing it away and, when the terminating\ncontent is itself eligible for shaping (i.e. this is the font change case), start a new\nrange at it (and remember its font as the one to match against).\n\nBoth tests are reference tests so that the letter forms are checked and not just the\nresolved width. The reference has the same inline box structure as the test, except that\nthe content which has to end up in one shaping range is put in a single inline box (where\nshaping across inline boxes is not needed at all). The font change test uses the same font\nfile under two family names so that the two halves of the content have mismatching font\ncascades while still rendering identically.\n\n* Source/WebCore/layout/formattingContexts/inline/InlineLineBuilder.cpp:\n(WebCore::Layout::LineBuilder::collectShapeRanges const):\n* LayoutTests/fast/text/shaping-across-inline-boxes-with-font-change-expected.html: Added.\n* LayoutTests/fast/text/shaping-across-inline-boxes-with-font-change.html: Added.\n* LayoutTests/fast/text/shaping-across-inline-boxes-with-trailing-simple-text-expected.html: Added.\n* LayoutTests/fast/text/shaping-across-inline-boxes-with-trailing-simple-text.html: Added.\n\nCanonical link: https://commits.webkit.org/319209@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "553a9a78402334c54130e294c5d5638b8bfb3971", "subject": "[text shaping] Arabic letters in adjacent inline boxes are not joined when the content is followed by simple code path text" }, "319210@main": { "author": "Wenson Hsieh", "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64", "cl": "319210@main", "clUrl": "https://commits.webkit.org/319210@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321798\nrdar://184930246\n\nReviewed by Abrar Rahman Protyasha.\n\nAvoid decorating certain elements that \"look visually clickable\" with the `clickable` token, based\non their accessibility role or element tag.\n\n* LayoutTests/fast/text-extraction/debug-text-extraction-button-like-div-expected.txt:\n* LayoutTests/fast/text-extraction/debug-text-extraction-button-like-div.html:\n* Source/WebCore/page/text-extraction/TextExtraction.cpp:\n(WebCore::TextExtraction::isProbablyNotInteractiveBasedOnTagName):\n(WebCore::TextExtraction::isProbablyNotInteractiveBasedOnRole):\n(WebCore::TextExtraction::looksLikeButton):\n\nCanonical link: https://commits.webkit.org/319210@main", "email": "wenson_hsieh@apple.com", "hash": "28aec1ff495e7aa24391c6139290536b57a9d8e0", "subject": "[Text Extraction] activision.com: avoid adding the `clickable` token before the \"Change Your Password\" heading in account settings" }, "319211@main": { "author": "Marta Darbinyan", "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64", "cl": "319211@main", "clUrl": "https://commits.webkit.org/319211@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321823\nrdar://184962474\n\nUnreviewed test gardening\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319211@main", "email": "darbinyan@apple.com", "hash": "20eba49ee7a899dc10cb9aaba7fac4c57be182ae", "subject": "[Gardening]: [macOS Debug] imported/w3c/web-platform-tests/fullscreen/model/move-to-fullscreen-iframe.html is a flaky crashing" }, "319212@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "319212@main", "clUrl": "https://commits.webkit.org/319212@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321594\n\nReviewed by Antti Koivisto.\n\ncanUseForIntrinsicWidthComputation walks the inline content and takes text, line breaks, inline boxes, list\nmarkers, an empty atomic inline level box and fixed width content. A block level box on a line is none of those,\nso the whole container falls back to the legacy walk in computeInlineIntrinsicLogicalWidths, where the text around\nthe box is measured word by word rather than by the inline formatting context.\n\nThe box's own content is the render tree's to lay out, which is what LineBuilder::handleBlockContent hands it back\nfor. Its intrinsic widths are the render tree's to answer for the same reason, so ask for them there, for the\nconstraint the intrinsic width loop is running. That keeps the box out of the box geometry, which is built for one\nconstraint only and is why this content was turned away in the first place.\n\nContent inside such a box does not damage the lines around it, so the cached minimum and maximum content sizes\nhave to go when the root's content widths are invalidated.\n\nThe width contribution the render tree answers with is a border box width, so it has the space a scrollbar takes in\nit already, while BoxGeometry::borderBoxWidth adds that space on top of the content box. Nothing reaching this\nbefore had a scrollbar, since the only box taken here without a fixed width was an empty one, and an empty box has\nnothing to overflow.\n\nThe widths in the test only move today because the legacy walk this stops using is separately wrong about word\nspacing wherever it measures text in pieces, so the test passes once either of the two is fixed.\n\n* LayoutTests/fast/css/intrinsic-width-with-preserved-whitespace-and-block-level-box-on-a-line.html: Added.\n* LayoutTests/fast/css/intrinsic-width-with-preserved-whitespace-and-block-level-box-on-a-line-expected.txt: Added.\n* Source/WebCore/layout/formattingContexts/inline/InlineLineBuilder.cpp:\n(WebCore::Layout::LineBuilder::handleBlockContent):\n* Source/WebCore/layout/integration/LayoutIntegrationCoverage.cpp:\n(WebCore::LayoutIntegration::canUseForIntrinsicWidthComputation):\n* Source/WebCore/layout/integration/LayoutIntegrationUtils.cpp:\n(WebCore::Layout::IntegrationUtils::minContentLogicalWidthContribution):\n(WebCore::Layout::IntegrationUtils::maxContentLogicalWidthContribution):\n(WebCore::Layout::IntegrationUtils::minContentLogicalWidthContribution const):\n(WebCore::Layout::IntegrationUtils::maxContentLogicalWidthContribution const):\n* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:\n(WebCore::LayoutIntegration::LineLayout::computeIntrinsicWidthConstraints):\n* Source/WebCore/layout/integration/LayoutIntegrationBoxGeometryUpdater.cpp:\n(WebCore::LayoutIntegration::BoxGeometryUpdater::updateLayoutBoxDimensions):\n\nCanonical link: https://commits.webkit.org/319212@main", "email": "zalan@apple.com", "hash": "f157dd8681ebabd624b90a8069080b87c7938187", "subject": "[block-in-inline] IFC cannot compute intrinsic widths when a line holds a block level box" }, "319213@main": { "author": "Gerald Squelart", "avatar": "https://www.gravatar.com/avatar/894904f08d85651bf2a76868a4d2f1b3?d=identicon\u0026s=64", "cl": "319213@main", "clUrl": "https://commits.webkit.org/319213@main", "description": "rdar://176886608\n\nReviewed by Mike Wyrzykowski.\n\nWebPageProxy::takeSnapshot() now uses the new\nIOSurface::createFromUntrustedSendRight(), which has stronger checks of\nthe MachSendRight-provided IOSurface, expecting a valid IOSurface as\nproduced uncompressed and uni-planar from IOSurface::create().\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/cocoa/IOSurfaceTests.mm\n* Source/WebCore/platform/graphics/cocoa/IOSurface.h:\n* Source/WebCore/platform/graphics/cocoa/IOSurface.mm:\n(WebCore::validateAndCreateFromUntrustedSurface):\n(WebCore::IOSurface::createFromUntrustedUncompressedWebKitSendRight):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::takeSnapshot):\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/IOSurfaceTests.mm:\n(TestWebKitAPI::TEST(IOSurfaceTest, createFromUntrustedUncompressedWebKitSendRightSRGB)):\n(TestWebKitAPI::TEST(IOSurfaceTest, createFromUntrustedUncompressedWebKitSendRightRGBA16F)):\n(TestWebKitAPI::TEST(IOSurfaceTest, createFromUntrustedUncompressedWebKitSendRightYUV422)):\n\nOriginally-landed-as: 305413.949@safari-7624.4-branch (5126b6a5a9e2). rdar://184745333\nCanonical link: https://commits.webkit.org/319213@main", "email": "g_squelart@apple.com", "hash": "c374428fdcece156aa09080f44a4806b7c4dceb9", "subject": "In WebPageProxy::takeSnapshot(), validate IOSurface from MachSendRight" }, "319214@main": { "author": "Zak Ridouh", "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64", "cl": "319214@main", "clUrl": "https://commits.webkit.org/319214@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321830\nrdar://184972366\n\nReviewed by Simon Fraser.\n\nWKContentExtensionStore.mm and WebsitePolicies.mm both declare a\nfile-scope `static size_t alertCount`. This has been latent since 2017\nand only breaks when the two files share a unified source bundle.\n\n319204@main added HTTP3Server.mm to SourcesCocoa.txt, which shifted the\nbundle boundary and placed both files in\nUnifiedSource-Tests-3-nonARC.mm. Xcode still builds because it uses the\ndefault bundle size of 8, which keeps the files 11 bundles apart; the\nCMake Cocoa build uses 128.\n\nRename the variable in WKContentExtensionStore.mm to match the\n`contentExtensionReceivedAlert` flag next to it. No behavior change.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKContentExtensionStore.mm:\n(-[ContentRuleListDelegate webView:runJavaScriptAlertPanelWithMessage:initiatedByFrame:completionHandler:]):\n(TEST_F(WKContentRuleListStoreTest, AddRemove)):\n\nCanonical link: https://commits.webkit.org/319214@main", "email": "zakr@apple.com", "hash": "11c7bc44b1119e68b5ea42ef21dc71b5278b5eec", "subject": "[CMake] Fix macOS build broken with redefinition of 'alertCount' in TestWebKitAPI" }, "319215@main": { "author": "Wenson Hsieh", "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64", "cl": "319215@main", "clUrl": "https://commits.webkit.org/319215@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321810\nrdar://184945791\n\nReviewed by Aditya Keerthi and Abrar Rahman Protyasha.\n\nAdd a missing null check in the case where `selectionAsAttributedString` returns `nil`.\n\n* Source/WebCore/editing/cocoa/EditorCocoa.mm:\n(WebCore::attributedStringByReplacingRemoteFrameMarkers):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ImageAnalysisTests.mm:\n(TestWebKitAPI::generalPasteboardContainsRichTextData):\n(TestWebKitAPI::stringFromGeneralPasteboard):\n(TestWebKitAPI::TEST(ImageAnalysisTests, CopyImageOverlayTextWithoutAttributedString)):\n\nCanonical link: https://commits.webkit.org/319215@main", "email": "wenson_hsieh@apple.com", "hash": "41d0d5bc00e7a614ba4a23052ae65d3935ad646e", "subject": "Adding a missing null check in WebCore::attributedStringByReplacingRemoteFrameMarkers" }, "319216@main": { "author": "Richard Robinson", "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64", "cl": "319216@main", "clUrl": "https://commits.webkit.org/319216@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321832\nrdar://184973680\n\nReviewed by Wenson Hsieh.\n\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewConfiguration+Extras.swift:\n* Source/WebKit/UIProcess/API/Swift/WebPage+Configuration.swift:\n(Configuration.backgroundTextExtractionEnabled):\n\nCanonical link: https://commits.webkit.org/319216@main", "email": "richard_robinson2@apple.com", "hash": "e3ee4ca8dbc1b7bcfdffe8cae5d97148606fe341", "subject": "[Text Extraction] Add `backgroundTextExtractionEnabled` testing SPI to `WebPage.Configuration`" }, "319217@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "319217@main", "clUrl": "https://commits.webkit.org/319217@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321514\nrdar://184624752\n\nReviewed by Rupin Mittal.\n\nThe initial about:blank document has entries and events disabled, so it has no\nNavigationHistoryEntry, and the activation for the replace navigation that\nleaves it must therefore expose a null from entry.\n\nWe instead synthesized a NavigationHistoryEntry out of the about:blank history\nitem. That used to be what the spec asked for, and\nnavigation-api/navigation-activation/activation-initial-about-blank.html\nasserted `activation.from.url === \"about:blank\"` with `from.index === -1`. The\ntest was changed upstream to assert `activation.from === null`, and it has been\nfailing since it was resynced in 316724@main.\n\n\"Update document for history step application\" [1] only sets the activation's\nold entry when all three of the following hold: navigationType is \"replace\",\npreviousEntryForActivation's document state's origin is same origin with the\ndocument's origin, and previousEntryForActivation's initial about:blank is\nfalse. We were missing that third condition, so add it. The about:blank history\nitem already has an opaque origin and so fails the same-origin check on its\nown, but spelling the condition out keeps the code aligned with the spec and\ndoes not rely on that.\n\nwasAboutBlank is also still used to force the navigation type to \"replace\".\n\n[1] https://html.spec.whatwg.org/multipage/browsing-the-web.html#update-document-for-history-step-application\n\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigation-activation/activation-initial-about-blank-expected.txt: Progression\n* Source/WebCore/page/Navigation.cpp:\n(WebCore::Navigation::setActivation):\n\nCanonical link: https://commits.webkit.org/319217@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "e147bdb27a590c121311316be163ef3bbcb8a24d", "subject": "[Navigation API] navigation.activation.from should be null when navigating away from the initial about:blank" }, "319218@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "319218@main", "clUrl": "https://commits.webkit.org/319218@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=220053\n\nReviewed by Yusuke Suzuki.\n\nWasm-to-JS import stubs always called operationConvertToI64 for an i64\nresult. If the JS value is already a HeapBigInt, convert it in the stub\nthe same way JS-to-Wasm arguments already do. Numbers still go through\nToBigInt64 and throw TypeError.\n\n* Source/JavaScriptCore/wasm/js/WasmToJS.cpp:\n* JSTests/wasm/stress/import-return-i64-bigint.js: Added.\n\nCanonical link: https://commits.webkit.org/319218@main", "email": "chi187@gmail.com", "hash": "ca730ef8b0fedfc8abb24dfef9f49a55e6bbaa85", "subject": "[JSC][Wasm] Fast-path i64 BigInt on Wasm-to-JS import returns" }, "319219@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "319219@main", "clUrl": "https://commits.webkit.org/319219@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321800\nrdar://184935071\n\nReviewed by Simon Fraser.\n\nThis patch aligns WebKit with Gecko / Firefox and Blink / Chromium.\n\nElement::scrollTo() was the only scroll-related entry point that did not ask\nlayout to descend into a content-visibility skipped subtree; scrollLeft/\nscrollTop, their setters, scrollWidth/scrollHeight and the client/offset/\ngetBoundingClientRect family all already do.\n\nWithout those options Document::updateLayout() skips\nrunForcedLayoutOnSkippedContentIfNeeded(), so the target is never laid out and\nsetScrollPosition() clamps to 0 against a zero-sized scrollable area. Affects\nelement.scroll(), scrollTo() and scrollBy(), which share this overload.\n\n* LayoutTests/TestExpectations: Unskip now passing test\n* Source/WebCore/dom/Element.cpp:\n(WebCore::Element::scrollTo):\n\nCanonical link: https://commits.webkit.org/319219@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "a1352e0bb8d4f6b7792ebf7de283b9ab3ac59f0d", "subject": "[css-contain] element.scroll()/scrollTo() does not scroll inside a content-visibility: hidden subtree" }, "319220@main": { "author": "Vitor Roriz", "avatar": "https://www.gravatar.com/avatar/5dafdad90c36e85902302c3a586a531c?d=identicon\u0026s=64", "cl": "319220@main", "clUrl": "https://commits.webkit.org/319220@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321816\nrdar://161299983\n\nReviewed by Brent Fulgham.\n\nWebKit's underline ink-skip painting exempts CJK-family scripts from per-glyph ink\ndetection. Arabic-family connected scripts like Urdu Nastaliq hit the same problem: a\nsingle glyph's ink envelope can span nearly its full width, so skip-ink treats most of\nthe underline as intersecting ink and paints only a few disconnected segments. This\nextends the CJK exception to the Arabic-family Unicode blocks.\n\nTest: fast/css3-text/css3-text-decoration/text-decoration-skip/text-decoration-skip-ink-arabic.html\n\n* LayoutTests/fast/css3-text/css3-text-decoration/text-decoration-skip/resources/Litherum-arabic.svg: Added.\n* LayoutTests/fast/css3-text/css3-text-decoration/text-decoration-skip/text-decoration-skip-ink-arabic-expected.html: Added.\n* LayoutTests/fast/css3-text/css3-text-decoration/text-decoration-skip/text-decoration-skip-ink-arabic.html: Added.\n* Source/WebCore/platform/graphics/FontCascade.cpp:\n(WebCore::computeUnderlineType):\n\nCanonical link: https://commits.webkit.org/319220@main", "email": "vitor.roriz@apple.com", "hash": "e6f1dbc88e5cce50f4af716f925d6eaf14bcb617", "subject": "blog.rekhta.org: Text underline does not work properly for Urdu Text" }, "319221@main": { "author": "Dominic Mazzoni", "avatar": "https://www.gravatar.com/avatar/f76643c44a7ee3be45148e66d97ed8e4?d=identicon\u0026s=64", "cl": "319221@main", "clUrl": "https://commits.webkit.org/319221@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321681\nrdar://184826408\n\nReviewed by Tyler Wilcock.\n\nAXRangeForLine and AXLineForIndex weren't consistent in how they counted block boundaries and\nemitted newlines, leading to bugs when VoiceOver round-trips from a position to a line index\nto a line range.\n\nTests: accessibility/isolated-tree/mac/range-for-line-with-block-line-breaks.html\n accessibility/mac/range-for-line-with-block-line-breaks.html\n\n* LayoutTests/accessibility/isolated-tree/mac/range-for-line-with-block-line-breaks-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/range-for-line-with-block-line-breaks.html: Added.\n* LayoutTests/accessibility/mac/range-for-line-with-block-line-breaks-expected.txt: Added.\n* LayoutTests/accessibility/mac/range-for-line-with-block-line-breaks.html: Added.\n* Source/WebCore/accessibility/AXTextMarker.cpp:\n(WebCore::AXTextMarker::characterRangeForLine const):\n(WebCore::AXTextMarker::lineNumberForIndex const):\n\nCanonical link: https://commits.webkit.org/319221@main", "email": "dm_mazzoni@apple.com", "hash": "6e28d9c0c7722d99f7ecde619c47f8652601bc14", "subject": "AX: AXRangeForLine and AXLineForIndex don't count lines consistently in contenteditables" }, "319222@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "319222@main", "clUrl": "https://commits.webkit.org/319222@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321526\nrdar://184633618\n\nReviewed by Rupin Mittal.\n\nThe inner navigate event firing algorithm aborts the ongoing navigate event\nbefore it starts, which fires navigateerror synchronously. A navigateerror\nhandler is free to start a navigation of its own, and that nested navigation runs\nthe whole algorithm to completion, leaving its own event as navigation's ongoing\nnavigate event.\n\nThe outer navigation then overwrote that with its own event without aborting it\nfirst, so the nested navigation was silently dropped and never fired\nnavigateerror. Since the nested navigateerror handler can start yet another\nnavigation, aborting a second time is not enough either. Follow the spec and keep\naborting in a loop until there is no ongoing navigate event left, bailing out if\nabortOngoingNavigation() left the event in place because there was no global\nobject.\n\n* LayoutTests/TestExpectations: Unskip now passing tests\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/navigate-multiple-history-pushState-expected.txt: Progression\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/navigate-multiple-location-expected.txt: Ditto\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/navigate-multiple-navigation-navigate-expected.txt: Ditto\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/navigate-multiple-nested-navigateerror-expected.txt: Added\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/navigate-multiple-nested-navigateerror.html: Added\n* Source/WebCore/page/Navigation.cpp:\n(WebCore::Navigation::abortOngoingNavigationIfNeeded):\n\nCanonical link: https://commits.webkit.org/319222@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "d51804111884ac3c7870c8fc24b1e5b36056aa3f", "subject": "[Navigation API] navigateerror is not fired for a navigation started from a navigateerror handler" }, "319223@main": { "author": "Ryosuke Niwa", "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64", "cl": "319223@main", "clUrl": "https://commits.webkit.org/319223@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321838\n\nUnreviewed. Update safer C++ expectations.\n\n* Source/WebCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations:\n* Source/WebKitLegacy/SaferCPPExpectations/MemoryUnsafeCastCheckerExpectations:\n* Source/WebKitLegacy/SaferCPPExpectations/UnretainedCallArgsCheckerExpectations:\n\nCanonical link: https://commits.webkit.org/319223@main", "email": "rniwa@webkit.org", "hash": "aae4c305803761b542732255b492e28881c971df", "subject": "Update safer C++ expectations (2026-08-14)" }, "319224@main": { "author": "Abrar Rahman Protyasha", "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64", "cl": "319224@main", "clUrl": "https://commits.webkit.org/319224@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321784\nrdar://184904955\n\nReviewed by Richard Robinson.\n\nThis patch adds infrastructure to support DOM gesture events using\ngesture recognizers, complementing the existing NSResponder machinery.\n\nTo facilitate this change, we build on existing changes to WebKit's\nrepresentation of native gesture events (318771@main, 318693@main). We\ngate this behavior change behind the UseAppKitGesturesForGestureEvents\npreference, added in 319130@main. The actual event dispatch plumbing is\nmore or less the same shape as seen in the WebViewImpl namesakes.\n\nTest coverage will be added in a forthcoming patch.\n\n* Source/WebKit/Platform/spi/mac/AppKitSPI.h:\n* Source/WebKit/Shared/NativeWebGestureEvent.h:\n* Source/WebKit/Shared/mac/NativeWebGestureEventMac.mm:\n* Source/WebKit/UIProcess/mac/AppKitGestures/WKAppKitGestureController.mm:\n(toWebEventPhase):\n(-[WKAppKitGestureController setUpGestureRecognizers]):\n(-[WKAppKitGestureController setUpMagnificationGestureRecognizer]):\n(-[WKAppKitGestureController setUpRotationGestureRecognizer]):\n(-[WKAppKitGestureController addGesturesToWebView]):\n(-[WKAppKitGestureController enableGesturesIfNeeded]):\n(-[WKAppKitGestureController ensureGesturesAreNotArchived]):\n(-[WKAppKitGestureController enableGestureIfNeeded:]):\n(-[WKAppKitGestureController sendWheelEventForGesture:]):\n(-[WKAppKitGestureController _resetCaughtDeceleratingScroll]):\n(-[WKAppKitGestureController currentMagnification:atPhase:]):\n(-[WKAppKitGestureController currentRotation:atPhase:]):\n(-[WKAppKitGestureController magnificationGestureRecognized:]):\n(-[WKAppKitGestureController rotationGestureRecognized:]):\n(isBuiltInScrollViewPanGestureRecognizer):\n(-[WKAppKitGestureController gestureRecognizer:shouldRecognizeSimultaneouslyWithGestureRecognizer:]):\n(-[WKAppKitGestureController gestureRecognizerShouldBegin:]):\n(-[WKAppKitGestureController _isSomeManipulationGestureRecognizer:]):\n(-[WKAppKitGestureController _gestureRecognizer:canPreventGestureRecognizer:]):\n(toWheelEventPhase): Deleted.\n(-[WKAppKitGestureController _isScrollOrZoomGestureRecognizer:]): Deleted.\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::gestureEventWasNotHandledByWebCore):\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift:\n\nCanonical link: https://commits.webkit.org/319224@main", "email": "a_protyasha@apple.com", "hash": "59d076ef61e6fe776685d06bc408976bae040e8e", "subject": "[AppKit Gestures] Refactor gesture event handling to support gesture recognizers" }, "319225@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "319225@main", "clUrl": "https://commits.webkit.org/319225@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321837\nrdar://184981771\n\nReviewed by Abrar Rahman Protyasha.\n\nThis is empty file in WebKit and the use case of it was replaced in 313117@main.\nThis PR is to just delete empty file.\n\n* Source/WTF/wtf/text/WYHash.h: Removed.\n\nCanonical link: https://commits.webkit.org/319225@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "3089b5074c3d68ae6b908eba2499827f4cbbfdb8", "subject": "Remove empty `WYHash.h` file" }, "319226@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "319226@main", "clUrl": "https://commits.webkit.org/319226@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321656\n\nReviewed by Daniel Liu.\n\n319067@main still sent every pattern with a lookbehind and the u or v flag to the interpreter.\n\nTwo things were missing. reverseDisjunctionForBackward() now counts a fixed non-BMP character or\nclass as two code units, like setupAlternativeOffsets() does. A Backward term points at the last\ncode unit of its character, so on 16-bit subjects readCharacter() decodes it with the new\ntryReadUnicodeCharBackward(). Inside a surrogate pair it reads errorCodePoint, like the forward\nread does, so a lookbehind fails there as in V8; the interpreter is wrong at such positions and\nin several other unicode lookbehinds (bug 317275), so the new test runs on the JIT only.\n\nThe any-character class (. with the s flag, [\\s\\S]) did not reject errorCodePoint, so it matched\nhalf of a pair even before this patch, e.g. /(?!\\u{1F600})./msu.exec(\"\\u{1F600}\") gave\n[1, \"\\uDE00\"]. It now gets the same test as an inverted class.\n\n Baseline Patched\n\nregexp-lookbehind-unicode-fixed 309.45+-1.91 ^ 47.49+-0.66 ^ definitely 6.5161x faster\nregexp-lookbehind-unicode-bmp-body 215.05+-3.01 ^ 36.89+-0.69 ^ definitely 5.8299x faster\nregexp-lookbehind-unicode-variable 186.04+-1.55 ^ 35.13+-0.75 ^ definitely 5.2958x faster\nregexp-lookbehind-variable 34.26+-0.19 ? 34.58+-0.54 ?\nregexp-u-flag-dotall-greedy 40.03+-1.08 38.17+-3.94 might be 1.0488x faster\n\nTests: JSTests/microbenchmarks/regexp-lookbehind-unicode-bmp-body.js\n JSTests/microbenchmarks/regexp-lookbehind-unicode-fixed.js\n JSTests/microbenchmarks/regexp-lookbehind-unicode-variable.js\n JSTests/microbenchmarks/regexp-u-flag-dotall-greedy.js\n JSTests/stress/regexp-lookbehind-jit-unicode.js\n JSTests/stress/regexp-unicode-any-character-inside-surrogate-pair.js\n\n* JSTests/microbenchmarks/regexp-lookbehind-unicode-bmp-body.js: Added.\n* JSTests/microbenchmarks/regexp-lookbehind-unicode-fixed.js: Added.\n* JSTests/microbenchmarks/regexp-lookbehind-unicode-variable.js: Added.\n* JSTests/microbenchmarks/regexp-u-flag-dotall-greedy.js: Added.\n* JSTests/stress/regexp-lookbehind-jit-unicode.js: Added.\n(shouldBe):\n(matchOf):\n(indicesOf):\n(shouldBe.matchOf):\n* JSTests/stress/regexp-unicode-any-character-inside-surrogate-pair.js: Added.\n(shouldBe):\n(matchOf):\n(shouldBe.matchOf):\n* Source/JavaScriptCore/runtime/RegExp.cpp:\n(JSC::RegExp::compile):\n(JSC::RegExp::compileMatchOnly):\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n\nCanonical link: https://commits.webkit.org/319226@main", "email": "sosuke@bun.sh", "hash": "ddf3655422ded3195d1f6f598a504cfcb2b1370c", "subject": "[YARR] Compile lookbehinds in unicode patterns in the JIT" }, "319227@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "319227@main", "clUrl": "https://commits.webkit.org/319227@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321649\n\nReviewed by Yusuke Suzuki.\n\nJSGlobalObject::init() materializes a few builtins for every global object\neven when they are never used:\n\n1. Set is a lazy class structure, but init() installs the\n m_setPrimordialPropertiesWatchpointSet watchpoints on Set.prototype.has /\n keys via jsSetPrototype(), forcing SetPrototype and all of its functions.\n The set starts out IsWatched and is only consulted by\n setPrimordialWatchpointIsValid(), which cannot run before SetPrototype\n exists, so move the two watchpoints into installSetPrototypeWatchpoint(),\n which SetPrototype::finishCreation() already calls.\n2. WeakRef and FinalizationRegistry are in\n FOR_EACH_SIMPLE_BUILTIN_TYPE_WITH_CONSTRUCTOR, so their prototype,\n constructor and structure are created eagerly. Nothing needs them before\n first use, so move them to FOR_EACH_LAZY_BUILTIN_TYPE_WITH_DECLARATION and\n expose the constructors through globalObjectTable like WeakMap / WeakSet.\n\nThis saves ~6.6 KB of memory footprint (~3.7 KB of GC heap) per\nJSGlobalObject that does not touch these builtins.\n\n* Source/JavaScriptCore/runtime/CommonIdentifiers.h:\n* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:\n(JSC::JSGlobalObject::init):\n(JSC::JSGlobalObject::installSetPrototypeWatchpoint):\n* Source/JavaScriptCore/runtime/JSGlobalObject.h:\n\nCanonical link: https://commits.webkit.org/319227@main", "email": "sosuke@bun.sh", "hash": "a73e86f9a37f81647b8ebd3eab3482e3e7b038ae", "subject": "[JSC] Do not eagerly create `Set.prototype`, `WeakRef`, and `FinalizationRegistry` in `JSGlobalObject::init()`" }, "319228@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "319228@main", "clUrl": "https://commits.webkit.org/319228@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321765\n\nReviewed by Yusuke Suzuki.\n\nPropertyInlineCache keeps slowPathStartLocation and six GPRReg fields in the base class, so every\nHandlerPropertyInlineCache carries them too. Handler ICs never use slowPathStartLocation, and their\nregisters are fixed per AccessType since 281584@main. Only repatching ICs store per-site values\nfor them.\n\nThis patch moves both to RepatchingPropertyInlineCache and adds registers(), which returns the\nstored registers for repatching ICs and computes them from accessType for handler ICs, like\nusedRegisters() in 315196@main. The unlinked ICs stored the same fields without anyone reading\nthem, so they are removed as well.\n\nHandlerPropertyInlineCache shrinks from 128 to 112 bytes, BaselineUnlinkedPropertyInlineCache from\n40 to 32 bytes, and DFG::UnlinkedPropertyInlineCache from 64 to 40 bytes. Running Octane typescript,\nthis saves 465 KB of malloc'ed memory for about 16,500 Baseline and 1,700 DFG IC sites.\n\n* Source/JavaScriptCore/bytecode/AccessCase.cpp:\n(JSC::AccessCase::createTransition):\n* Source/JavaScriptCore/bytecode/InlineAccess.cpp:\n(JSC::InlineAccess::generateSelfPropertyAccess):\n(JSC::getScratchRegister):\n(JSC::InlineAccess::generateSelfPropertyReplace):\n(JSC::InlineAccess::generateArrayLength):\n(JSC::InlineAccess::generateStringLength):\n(JSC::InlineAccess::generateSelfInAccess):\n* Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp:\n(JSC::InlineCacheCompiler::succeed):\n(JSC::InlineCacheCompiler::calculateLiveRegistersForCallAndExceptionHandling):\n(JSC::InlineCacheCompiler::preserveLiveRegistersToStackForCallWithoutExceptions):\n(JSC::InlineCacheCompiler::makeDefaultScratchAllocator):\n(JSC::InlineCacheCompiler::generateWithGuard):\n(JSC::InlineCacheCompiler::generateAccessCase):\n(JSC::InlineCacheCompiler::emitDOMJITGetter):\n(JSC::InlineCacheCompiler::emitModuleNamespaceLoad):\n(JSC::InlineCacheCompiler::emitProxyObjectAccess):\n(JSC::InlineCacheCompiler::emitIntrinsicGetter):\n(JSC::InlineCacheCompiler::compile):\n(JSC::InlineCacheCompiler::compileOneAccessCaseHandler):\n(JSC::InlineCacheCompiler::compileGetByDOMJITHandler):\n* Source/JavaScriptCore/bytecode/PropertyInlineCache.cpp:\n(JSC::PropertyInlineCache::registers const):\n(JSC::HandlerPropertyInlineCache::initializeFromUnlinkedPropertyInlineCache):\n(JSC::HandlerPropertyInlineCache::initializeFromDFGUnlinkedPropertyInlineCache):\n(JSC::PropertyInlineCache::resetStubAsJumpInAccess):\n(JSC::PropertyInlineCache::initializePredefinedRegisters): Deleted.\n* Source/JavaScriptCore/bytecode/PropertyInlineCache.h:\n(JSC::PropertyInlineCache::valueRegs const):\n(JSC::PropertyInlineCache::propertyRegs const):\n(JSC::PropertyInlineCache::baseRegs const):\n(JSC::PropertyInlineCache::offsetOfCallSiteIndex):\n(JSC::PropertyInlineCache::baseGPR const):\n(JSC::PropertyInlineCache::valueGPR const):\n(JSC::PropertyInlineCache::extraGPR const):\n(JSC::PropertyInlineCache::extra2GPR const):\n(JSC::PropertyInlineCache::propertyCacheGPR const):\n(JSC::PropertyInlineCache::arrayProfileGPR const):\n(JSC::PropertyInlineCache::thisGPR const):\n(JSC::PropertyInlineCache::prototypeGPR const):\n(JSC::PropertyInlineCache::brandGPR const):\n(JSC::PropertyInlineCache::propertyGPR const):\n(JSC::PropertyInlineCache::offsetOfSlowPathStartLocation): Deleted.\n(JSC::PropertyInlineCache::setUsedRegisters): Deleted.\n(JSC::PropertyInlineCache::removeUsedRegister): Deleted.\n* Source/JavaScriptCore/dfg/DFGInlineCacheWrapperInlines.h:\n(JSC::DFG::InlineCacheWrapper\u003cGeneratorType\u003e::finalize):\n* Source/JavaScriptCore/dfg/DFGJITCode.h:\n(JSC::DFG::UnlinkedPropertyInlineCache::setUsedRegisters): Deleted.\n(JSC::DFG::UnlinkedPropertyInlineCache::removeUsedRegister): Deleted.\n* Source/JavaScriptCore/jit/JIT.cpp:\n(JSC::JIT::link):\n* Source/JavaScriptCore/jit/JITCall.cpp:\n(JSC::JIT::emitSlowIteratorOpenGeneric):\n(JSC::JIT::emitSlow_op_iterator_next):\n(JSC::JIT::emitSlow_op_instanceof):\n* Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp:\n(JSC::JITInlineCacheGenerator::finalize):\n* Source/JavaScriptCore/jit/JITInlineCacheGenerator.h:\n(JSC::JITInlineCacheGenerator::setUpPropertyInlineCacheImpl):\n(JSC::JITByIdGenerator::setUpPropertyInlineCacheImpl):\n(JSC::JITInByValGenerator::setUpPropertyInlineCache):\n(JSC::JITInlineCacheGenerator::reportBaselineDataICSlowPathBegin): Deleted.\n* Source/JavaScriptCore/jit/JITPropertyAccess.cpp:\n(JSC::JIT::generateGetByValSlowCase):\n(JSC::JIT::emitSlow_op_get_private_name):\n(JSC::JIT::emitSlow_op_set_private_brand):\n(JSC::JIT::emitSlow_op_check_private_brand):\n(JSC::JIT::generatePutByValSlowCase):\n(JSC::JIT::emitSlow_op_put_private_name):\n(JSC::JIT::emitSlow_op_del_by_id):\n(JSC::JIT::emitSlow_op_del_by_val):\n(JSC::JIT::emitSlow_op_get_by_id_direct):\n(JSC::JIT::emitSlow_op_get_by_id):\n(JSC::JIT::emitSlow_op_get_length):\n(JSC::JIT::emitSlow_op_get_by_id_with_this):\n(JSC::JIT::emitSlow_op_put_by_id):\n(JSC::JIT::emitSlow_op_in_by_id):\n(JSC::JIT::emitSlow_op_in_by_val):\n(JSC::JIT::emitHasPrivateSlow):\n(JSC::JIT::emitSlow_op_get_by_val_with_this):\n\nCanonical link: https://commits.webkit.org/319228@main", "email": "sosuke@bun.sh", "hash": "b00e0c35f823f59fd5ee06f517c2ce1fdf5c465e", "subject": "[JSC] Move repatching-only fields out of `HandlerPropertyInlineCache`" }, "319229@main": { "author": "Abrar Rahman Protyasha", "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64", "cl": "319229@main", "clUrl": "https://commits.webkit.org/319229@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321835\nrdar://184977998\n\nReviewed by Richard Robinson.\n\nWhen writing an API test like this:\n\n```\n@Test\nfunc someTest() async {\n page.setWebFeature(\"UseAppKitGesturesForGestureEvents\", enabled: true)\n ...\n}\n```\n\nI noticed that the certain preference gated functionality was broken.\nThis is because WKAppKitGestureController initialization happens\ndirectly under -[WKWebView initWithFrame:configuration:], and the\nfunctionality in question was respecting a sticky preference value read\nduring initialization.\n\nThis is further exacerbated by the fact that WebPage.setWebFeature()\ndoes not actually end up propagating preference changes to WebViewImpl,\nsince WebPageProxy::hasRunningProcess() reports that the associated web\ncontent process is terminated/not launched (before we make a -loadHTML:\ncall). Not that it would be helpful in any way, though, since we only\npick up the preference at gesture controller initialization anyway.\n\nWhile it is generally going to be useful to be able to set runtime\nWebKit features before WebPage initialization -- tracked as an API\nrequest in rdar://184981081 -- there is no inherent reason for our\ngesture controller to not reflect updated preferences. As such, we\nexpose a `-[WKAppKitGestureController preferencesDidChange]` method,\nwhich is called from both the WebViewImpl::preferencesDidChange() hook,\nand from the WebViewImpl::didRelaunchPorcess() hook. This latter call is\nsalient for this patch, since it ensures the controller is reactive to\npreference changes after the web content process is brought up.\n\n* Source/WebKit/UIProcess/mac/AppKitGestures/WKAppKitGestureController.h:\n* Source/WebKit/UIProcess/mac/AppKitGestures/WKAppKitGestureController.mm:\n(-[WKAppKitGestureController preferencesDidChange]):\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::didRelaunchProcess):\n(WebKit::WebViewImpl::preferencesDidChange):\n\nCanonical link: https://commits.webkit.org/319229@main", "email": "a_protyasha@apple.com", "hash": "7b8132883f8ee3e1845ece781612c14b7d49ce77", "subject": "[AppKit Gestures] Gesture controller may not reflect preference changes driven through WebPage.setWebFeature()" }, "319230@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "319230@main", "clUrl": "https://commits.webkit.org/319230@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321642\nrdar://184769561\n\nReviewed by Eric Carlson.\n\n301864@main removed the audio session category calculation from the content process. 303417@main made\nRemoteMediaSessionManagerProxy a MediaSessionManagerCocoa and a WebCore::AudioSession without\noverriding updateSessionState(), so the UI process computed the category and pushed it back, and\n317396@main made that proxy a singleton, so one category covered every page of every process. The\ncontent process learned its category from an asynchronous IPC reply, which caused two classes of\nproblem.\n\n1) Scripts read a stale category, since internals.audioSessionCategory() reads this process's\nAudioSession and could run before the reply arrived. Every path reading it after an await needed\nits own fix: play(), getUserMedia, track mute/unmute, the audioTracks change event, the\nnavigator.audioSession.type override, and the category recorded at the most recent playback.\n\n2) Operations with no reason to be asynchronous became asynchronous to accommodate it:\nupdateSessionState() returned a GenericPromise, three IPC replies carried (category, mode, policy),\nthe proxy pushed the category to every process, and the getUserMedia resolution and the mute/unmute\nevent dispatch were gated on a promise waiting on getting the new category.\n\nThe UI process has no information of a kind the content process lacks: the calculation reads no\nAVAudioSession, no audio route, and no interruption or application state, only media session\nbookkeeping. Its only advantage was breadth, the sessions of other content processes, and the GPU\nprocess already reconciles that by collecting the category each process reports and applying the\nhighest priority one. Every branch of the calculation tests whether at least one session is doing\nsomething, so a process seeing only its own sessions lands at or below the correct category and never\nabove it, which makes the highest-priority pick equivalent to calculating over every process's\nsessions.\n\nRemoteMediaSessionManager::updateSessionState() chains to MediaSessionManagerCocoa, applying the\ncategory in the same turn, and sends the session states and the capture count to the UI process\nwithout waiting for a reply as the UI process still needs them for playback admission and activation.\nThe proxy computes no category of its own: its updateSessionState() does nothing, and the category in\nthe AddMediaSession, UpdateMediaSessionStates and MediaSessionWillBeginPlayback replies, the\nSetAudioSessionCategory push, and the per-page override tracking are all removed. updateSessionState()\ncan now return void.\n\nDocumentSyncData already synchronized navigator.audioSession.type to every process of the page. Each\nprocess converts that type into a category override and applies it in its own calculation, so every\nprocess of a page computes with the same override.\n\nThis removes a difference that existed only with site isolation enabled. The UI process used the\noverride of any page that had set one, so navigator.audioSession.type in one page lowered the category\nfor unrelated pages in other processes. Without site isolation the override lives on the web process's\nown AudioSession and never reached a page in another process, and the GPU process's pick can only\nraise, so an override there has never lowered another process's category. The two configurations now\nbehave the same.\n\nThe tests read the category applied to the real audio session with a new\ninternals.systemAudioSessionCategory(), which returns a promise because that category lives in the\nprocess owning the session, over IPC gated on AllowTestOnlyIPC.\nhttp/tests/site-isolation/audio-session-category-override-does-not-affect-another-page.html covers the\nparagraph above: this page sets the type and plays nothing, a page opened in another process plays\naudible media, and that page still computes MediaPlayback while the real session takes it. Before this\nchange both pages took the category the UI process computed from the override, so both read\nAmbientSound.\n\naudio-session-category-override-and-playback.html and\naudio-session-category-override-after-playback.html cover the two ways the type reaches another process\nof the same page, the state that process is created with and the per-field DocumentSyncData broadcast,\nand assert that the override replaces the computed category in both directions. Neither enables site\nisolation, so the site-isolated run is compared against the same expectations as the ordinary one: with\nsite isolation the frames are in separate processes and the type reaches the playing one through\nDocumentSyncData, without it they share a process and its audio session.\n\naudio-session-category-capture-and-playback.html covers the reconciliation this change relies on: one\nprocess plays audible media, another captures the microphone, each computes the category for its own\nsessions, and the real audio session resolves to PlayAndRecord.\n\nplayPlayer() reads the category directly, as setState(State::Playing) notifies the manager and\nsessionStateChanged() calls updateSessionState() synchronously before clientWillBeginPlayback()'s\ncompletion reaches updatePlayState().\n\nThe wait in UserMediaRequest::allow() and on the track unmute event stays and now covers the audio\nsession activation alone: 318776@main added it for activation, which failed at 45% without site\nisolation, and activation remains asynchronous. The API tests keep their waits around unmuting for the\nsame reason, and lose those around muting and around screen capture.\n\nReverted in full: 317945@main.\nReverted in part: 301864@main, 303417@main, 317760@main, 318099@main, 318537@main, 318776@main,\n318865@main, 319003@main.\n\n* LayoutTests/http/tests/site-isolation/audio-session-category-capture-and-playback-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-category-capture-and-playback.html: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-category-override-after-playback-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-category-override-after-playback.html: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-category-override-and-playback-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-category-override-and-playback.html: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-category-override-does-not-affect-another-page-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/audio-session-category-override-does-not-affect-another-page.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/audio-session-capture-frame.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/audio-session-playback-frame.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/report-video-element-audio-session-category.html: Added.\n* LayoutTests/media/audioSession/audioSessionType.html: Use waitForAudioSessionCategory() instead of a\nlocal copy.\n* LayoutTests/media/utilities.js: Added waitForAudioSessionCategory() and\nwaitForSystemAudioSessionCategory().\n* Source/WebCore/Modules/audiosession/DOMAudioSession.cpp:\n(WebCore::DOMAudioSession::applyTypeToAudioSessionCategoryOverride): Added. Apply the category\noverride a type implies to this process's audio session.\n* Source/WebCore/Modules/audiosession/DOMAudioSession.h:\n* Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp:\n(WebCore::MediaStreamTrack::trackMutedChanged): Wait for the audio session activation only when\nunmuting an audio capture track, and queue the event directly otherwise.\n* Source/WebCore/Modules/mediastream/UserMediaRequest.cpp:\n(WebCore::UserMediaRequest::allow): Wait for the audio session activation instead of the category.\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::categoryDidChange): Deleted.\n* Source/WebCore/html/HTMLMediaElement.h:\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::updateTopDocumentSyncData): Apply the category override implied by a synchronized\naudio session type, on both the per-field and the whole-state path.\n* Source/WebCore/platform/audio/AudioSession.h:\n(WebCore::AudioSessionConfigurationChangeObserver::categoryDidChange): Deleted.\n(WebCore::AudioSession::systemCategoryForTesting): Added. Return the category of this process's audio\nsession, overridden where that session lives in another process.\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.cpp:\n(WebCore::MediaSessionManagerInterface::audioCaptureSourceStateChanged): Return a promise covering the\nactivation.\n(WebCore::MediaSessionManagerInterface::updateSessionState): Deleted; the empty body moves back to the\nheader.\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.h:\n* Source/WebCore/platform/audio/cocoa/MediaSessionManagerCocoa.h:\n* Source/WebCore/platform/audio/cocoa/MediaSessionManagerCocoa.mm:\n(WebCore::MediaSessionManagerCocoa::updateSessionState): Return void.\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::systemAudioSessionCategory): Added.\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\n* Source/WebKit/GPUProcess/media/RemoteAudioSessionProxy.cpp:\n(WebKit::RemoteAudioSessionProxy::systemCategoryForTesting): Added. Reply with the category applied to\nthe real audio session.\n* Source/WebKit/GPUProcess/media/RemoteAudioSessionProxy.h:\n* Source/WebKit/GPUProcess/media/RemoteAudioSessionProxy.messages.in:\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.cpp:\n(WebKit::RemoteMediaSessionManagerProxy::RemoteMediaSessionManagerProxy): Don't set\nshouldManageAudioSessionCategory; the UI process computes no category.\n(WebKit::RemoteMediaSessionManagerProxy::addMediaSession): Don't reply with the category.\n(WebKit::RemoteMediaSessionManagerProxy::webProcessWillShutDown): Drop the per-page override cleanup.\n(WebKit::RemoteMediaSessionManagerProxy::updateMediaSessionStates): Don't track the override, compute\nthe category or reply with it.\n(WebKit::RemoteMediaSessionManagerProxy::mediaSessionWillBeginPlayback): Reply with the admission\ndecision only.\n(WebKit::RemoteMediaSessionManagerProxy::categoryOverride): Deleted.\n(WebKit::RemoteMediaSessionManagerProxy::setCategory): Deleted.\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.h:\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.messages.in:\n* Source/WebKit/WebProcess/GPU/media/RemoteAudioSession.cpp:\n(WebKit::RemoteAudioSession::setCategory): Don't notify the configuration change observers.\n(WebKit::RemoteAudioSession::systemCategoryForTesting): Added. Ask the process owning the session.\n* Source/WebKit/WebProcess/GPU/media/RemoteAudioSession.h:\n* Source/WebKit/WebProcess/Media/RemoteMediaSessionManager.cpp:\n(WebKit::RemoteMediaSessionManager::addSession): Send without a reply.\n(WebKit::RemoteMediaSessionManager::sessionWillBeginPlayback): Take the admission decision only.\n(WebKit::RemoteMediaSessionManager::updateSessionState): Compute the category in this process.\n(WebKit::RemoteMediaSessionManager::setAudioSessionCategory): Deleted.\n* Source/WebKit/WebProcess/Media/RemoteMediaSessionManager.h:\n* Source/WebKit/WebProcess/Media/RemoteMediaSessionManager.messages.in:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/GetDisplayMediaWindowAndScreen.mm:\n(TestWebKitAPI::armActionState): Deleted.\n(TestWebKitAPI::waitForActionState): Deleted.\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/GetUserMedia.mm:\n\nCanonical link: https://commits.webkit.org/319230@main", "email": "jya@apple.com", "hash": "eca8e2cf2518a805495f9ce2ad0fce1c57b75eb1", "subject": "[site-isolation] AudioSession category should be calculated synchronously and not wait for the UI process" }, "319231@main": { "author": "Gerald Squelart", "avatar": "https://www.gravatar.com/avatar/894904f08d85651bf2a76868a4d2f1b3?d=identicon\u0026s=64", "cl": "319231@main", "clUrl": "https://commits.webkit.org/319231@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321778\nrdar://problem/184900228\n\nReviewed by Mike Wyrzykowski.\n\nMost of the plumbing was already in place.\nGPUCanvasContextCocoa::surfaceBufferToImageBuffer() and\ntransferToImageBuffer() just needed to return an ImageBuffer with the\nWebGPU canvas color space, and PixelFormat::RGBA16F if it was configured\nto show an extended color range.\n\nThe new test also revealed a small latent issue, where an obsolete\ncompositing result was output in the image buffer despite\nm_compositingResultsNeedsUpdating being true.\n\n* LayoutTests/fast/webgpu/float16-2dcanvas-drawimage-webgpu-expected.txt: Added.\n* LayoutTests/fast/webgpu/float16-2dcanvas-drawimage-webgpu.html: Added.\n* Source/WebCore/html/canvas/GPUCanvasContextCocoa.mm:\n(WebCore::readbackPixelFormat):\n(WebCore::GPUCanvasContextCocoa::surfaceBufferToImageBuffer):\n(WebCore::GPUCanvasContextCocoa::transferToImageBuffer):\n\nCanonical link: https://commits.webkit.org/319231@main", "email": "g_squelart@apple.com", "hash": "073ef61115aaf34ff86f43c902237c474255fe10", "subject": "Implement CanvasRenderingContext2DBase::drawImage() for a WebGPU source" }, "319232@main": { "author": "Frédéric Wang Nélar", "avatar": "https://www.gravatar.com/avatar/2c634be4515bda5959ed1d7138b17d48?d=identicon\u0026s=64", "cl": "319232@main", "clUrl": "https://commits.webkit.org/319232@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321780\n\nReviewed by Patrick Griffis.\n\nContentSecurityPolicySourceList::parseHost successfuly parses \"*.\" as a\nHost with hasWildcard set to true and value set to an empty string,\ninstead of treating it as invalid. This is visible in the error console,\nbecause no warning is triggered for that case.\n\n* LayoutTests/http/tests/security/contentSecurityPolicy/invalid-host-part-wildcard-dot-expected.txt: Added.\n* LayoutTests/http/tests/security/contentSecurityPolicy/invalid-host-part-wildcard-dot.html: Added.\n* Source/WebCore/page/csp/ContentSecurityPolicySourceList.cpp:\n(WebCore::ContentSecurityPolicySourceList::parseHost): return std::nullopt for \"*.\".\n\nCanonical link: https://commits.webkit.org/319232@main", "email": "fwang@igalia.com", "hash": "6627b0ce039fd9655a6754e98c1effa67241086e", "subject": "CSP source-expression *. is not treated as invalid" }, "319233@main": { "author": "Justin Michaud", "avatar": "https://www.gravatar.com/avatar/36e0433ee725a08f7e1122a6bc584b57?d=identicon\u0026s=64", "cl": "319233@main", "clUrl": "https://commits.webkit.org/319233@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321848\n\nUnreviewed build fix.\n\nCanonical link: https://commits.webkit.org/319233@main", "email": "jmichaud@igalia.com", "hash": "3c64729cefbca0dc42bfa07e6f0c301ae663fbbf", "subject": "Fix -Wthread-safety-precise and constexpr for clang 18" }, "319234@main": { "author": "Patrick Griffis", "avatar": "https://www.gravatar.com/avatar/2233c3a857004b126158572af9fe36f7?d=identicon\u0026s=64", "cl": "319234@main", "clUrl": "https://commits.webkit.org/319234@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321809\n\nReviewed by Timothy Hatcher.\n\nThis moves a big chunk of the port-neutral code to C++.\nThere should be no change in behavior.\n\nMinor tweak to where WebExtensionStorageSQLiteStore was\nused to be a reference since all call sites verify it is\nnon-null before usage.\n\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionControllerCocoa.mm:\n(WebKit::WebExtensionController::getDataRecords):\n(WebKit::WebExtensionController::getDataRecord):\n(WebKit::WebExtensionController::removeData):\n(WebKit::WebExtensionController::storageDirectory const): Deleted.\n(WebKit::WebExtensionController::calculateStorageSize): Deleted.\n(WebKit::WebExtensionController::removeStorage): Deleted.\n(WebKit::WebExtensionController::load): Deleted.\n(WebKit::WebExtensionController::unload): Deleted.\n(WebKit::WebExtensionController::unloadAll): Deleted.\n(WebKit::WebExtensionController::dispatchDidLoad): Deleted.\n(WebKit::WebExtensionController::addPage): Deleted.\n(WebKit::WebExtensionController::removePage): Deleted.\n(WebKit::WebExtensionController::addProcessPool): Deleted.\n(WebKit::WebExtensionController::removeProcessPool): Deleted.\n(WebKit::WebExtensionController::addUserContentController): Deleted.\n(WebKit::WebExtensionController::removeUserContentController): Deleted.\n(WebKit::WebExtensionController::websiteDataStore const): Deleted.\n(WebKit::WebExtensionController::addWebsiteDataStore): Deleted.\n(WebKit::WebExtensionController::removeWebsiteDataStore): Deleted.\n(WebKit::WebExtensionController::cookiesDidChange): Deleted.\n(WebKit::WebExtensionController::extensionContext const): Deleted.\n(WebKit::WebExtensionController::extensions const): Deleted.\n(WebKit::WebExtensionController::stateFilePath const): Deleted.\n(WebKit::WebExtensionController::activeExtensionURLs const): Deleted.\n(WebKit::WebExtensionController::sqliteStore): Deleted.\n(WebKit::WebExtensionController::didStartProvisionalLoadForFrame): Deleted.\n(WebKit::WebExtensionController::didCommitLoadForFrame): Deleted.\n(WebKit::WebExtensionController::didFinishLoadForFrame): Deleted.\n(WebKit::WebExtensionController::didFailLoadForFrame): Deleted.\n* Source/WebKit/UIProcess/Extensions/WebExtensionController.cpp:\n(WebKit::addContextMessageReceivers):\n(WebKit::removeContextMessageReceivers):\n(WebKit::WebExtensionController::load):\n(WebKit::WebExtensionController::unload):\n(WebKit::WebExtensionController::unloadAll):\n(WebKit::WebExtensionController::dispatchDidLoad):\n(WebKit::WebExtensionController::addPage):\n(WebKit::WebExtensionController::removePage):\n(WebKit::WebExtensionController::addProcessPool):\n(WebKit::WebExtensionController::removeProcessPool):\n(WebKit::WebExtensionController::addUserContentController):\n(WebKit::WebExtensionController::removeUserContentController):\n(WebKit::WebExtensionController::websiteDataStore const):\n(WebKit::WebExtensionController::addWebsiteDataStore):\n(WebKit::WebExtensionController::removeWebsiteDataStore):\n(WebKit::WebExtensionController::didStartProvisionalLoadForFrame):\n(WebKit::WebExtensionController::didCommitLoadForFrame):\n(WebKit::WebExtensionController::didFinishLoadForFrame):\n(WebKit::WebExtensionController::didFailLoadForFrame):\n(WebKit::WebExtensionController::cookiesDidChange):\n(WebKit::WebExtensionController::extensionContext const):\n(WebKit::WebExtensionController::extensions const):\n(WebKit::WebExtensionController::storageDirectory const):\n(WebKit::WebExtensionController::stateFilePath const):\n(WebKit::WebExtensionController::activeExtensionURLs const):\n(WebKit::WebExtensionController::sqliteStore):\n(WebKit::WebExtensionController::calculateStorageSize):\n(WebKit::WebExtensionController::removeStorage):\n* Source/WebKit/UIProcess/Extensions/WebExtensionController.h:\n\nCanonical link: https://commits.webkit.org/319234@main", "email": "pgriffis@igalia.com", "hash": "2f7f667d287f31d24f0e7c2179f6ce0ad3ed754e", "subject": "Port more of WebExtensionController to C++" }, "319235@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "319235@main", "clUrl": "https://commits.webkit.org/319235@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321840\nrdar://184987223\n\nReviewed by Abrar Rahman Protyasha.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/92a794da495dde310f299d992b94ae02f47659cf\n\n* LayoutTests/imported/w3c/web-platform-tests/html/rendering/non-replaced-elements/tables/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/html/rendering/non-replaced-elements/tables/resources/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/html/rendering/non-replaced-elements/tables/table-border-attributes-computed-style-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/rendering/non-replaced-elements/tables/table-border-attributes-computed-style.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/rendering/non-replaced-elements/tables/table-border-color-not-inherited-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/rendering/non-replaced-elements/tables/table-border-color-not-inherited.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/rendering/non-replaced-elements/tables/table-rules-computed-style-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/rendering/non-replaced-elements/tables/table-rules-computed-style.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/rendering/non-replaced-elements/tables/w3c-import.log:\n\nCanonical link: https://commits.webkit.org/319235@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "1db7869c348654dc302272c7cac766027f6c20cc", "subject": "Resync `html/rendering/non-replaced-elements/tables` from WPT Upstream" }, "319236@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "319236@main", "clUrl": "https://commits.webkit.org/319236@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317427\nrdar://180054053\n\nReviewed by Sam Weinig and Darin Adler.\n\nThis patch aligns WebKit with Gecko / Firefox and Blink / Chromium.\n\nThe CSSWG resolved that `outline-offset` should be snapped to an integer number of\ndevice pixels the same way `outline-width` and `border-width` are\n(w3c/csswg-drafts#12906). WebKit used the raw, unsnapped length, so\ngetComputedStyle().outlineOffset returned values like \"0.1px\" instead of \"1px\".\n\nMove \"snap a length as a border width\"\n(https://drafts.csswg.org/css-values-4/#snap-a-length-as-a-border-width) out of\n`LineWidth` into its own file, exposing the `float` overload directly and adding\nsigned overloads for lengths that may be negative, which snap the magnitude and\nrestore the sign: zero is unchanged, a magnitude below 1 device pixel rounds away\nfrom zero, a larger magnitude rounds toward zero.\n\n`outline-offset` now snaps in the same three places `outline-width` does:\n\n - `CSSValueConversion\u003cOutlineOffset\u003e` snaps the computed value.\n - `Blending\u003cOutlineOffset\u003e` re-snaps blended values, keeping animations on device\n pixels. It also has to supply `canBlend()`, since a full specialization replaces\n the generic `ValueOrKeyword` one, which is what makes `inset` interpolate\n discretely against a length rather than blending as an empty value.\n - `Evaluation\u003cUsedOutlineOffset\u003e` re-snaps after zoom is applied, keeping the used\n value on device pixels at any page zoom. `ComputedStyle::usedOutlineOffset()`\n returns `Style::UsedOutlineOffset` so that evaluating it requires a device scale\n factor, and its callers pass one.\n\nThe manual `floorToDevicePixel()` in RenderThemeCocoa is subsumed by that used-value\nsnapping. It is not quite equivalent: for a magnitude below one device pixel, `floor`\ngave 0 while snapping rounds away from zero to 1 device pixel, so an iOS focus ring\nat a zoom below 1 now scales by the offset instead of ignoring it. That is the\nbehavior `outline-width` already has.\n\n`inset` resolves to the negated used `outline-width`, and snapping both after zoom\nmakes them cancel exactly, which they previously did not at fractional zoom.\n\n* LayoutTests/fast/borders/hidpi-outline-hairline-painting-expected.html: Rebaselined.\nThis reference was authored against unsnapped offsets, and at the 2x device scale factor\nthis test runs at, snapping the offset changes the painted outline geometry.\n* LayoutTests/fast/css/outline-offset-used-value-zoom-rounding-expected.txt: Added.\n* LayoutTests/fast/css/outline-offset-used-value-zoom-rounding.html: Added. Covers the\nused value after zoom, which needs `internals` since it is not web-exposed.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/outline-offset-rounding.tentative.html:\nThe test as imported hard-codes expectations that assume 1 device pixel is 1 CSS pixel, so its\nsub-pixel sub-tests reported FAIL at any other device scale factor even though the engine was\nbehaving as specified. Derive the expectations from window.devicePixelRatio instead, and add\nsub-tests that cross-check outline-offset against outline-width for the same input, which is a\ndirect statement of the CSSWG resolution and holds at any device scale factor. Verified all 30\nsub-tests pass at 1x, 2x and 3x. To be upstreamed.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/outline-offset-rounding.tentative-expected.txt: Progression\n* LayoutTests/imported/w3c/web-platform-tests/css/css-ui/animation/outline-offset-interpolation-rounding.tentative-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-ui/animation/outline-offset-interpolation-rounding.tentative.html: Added.\nCovers snapping of blended values, deriving expectations from window.devicePixelRatio so they hold\nat any device scale factor. The `inset` sub-test is gated on CSS.supports(), since Chromium and\nGecko do not implement it yet and drop the keyframe. To be upstreamed.\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/accessibility/AccessibilityRenderObject.cpp:\n(WebCore::AccessibilityRenderObject::elementPath const):\n* Source/WebCore/rendering/OutlinePainter.cpp:\n(WebCore::OutlinePainter::paintOutline const):\n(WebCore::OutlinePainter::paintOutlineWithLineRects const):\n(WebCore::OutlinePainter::paintFocusRing const):\n* Source/WebCore/rendering/RenderElement.cpp:\n(WebCore::RenderElement::repaintAfterLayoutIfNeeded):\n* Source/WebCore/rendering/cocoa/RenderThemeCocoa.mm:\n(WebCore::drawFocusRingForPathForVectorBasedControls):\n* Source/WebCore/style/computed/StyleComputedStyle.cpp:\n(WebCore::Style::ComputedStyle::usedOutlineOffset const):\n(WebCore::Style::ComputedStyle::usedOutlineSize const):\n* Source/WebCore/style/computed/StyleComputedStyle.h:\n* Source/WebCore/style/computed/StyleComputedStyleBase.h:\n* Source/WebCore/style/values/backgrounds/StyleLineWidth.cpp:\n(WebCore::Style::snapLengthAsBorderWidth): Deleted.\n(WebCore::Style::LineWidth::snapLengthAsBorderWidth): Deleted.\n* Source/WebCore/style/values/backgrounds/StyleLineWidth.h:\n* Source/WebCore/style/values/outline/StyleOutlineOffset.cpp:\n(WebCore::Style::CSSValueConversion\u003cOutlineOffset\u003e::operator()):\n(WebCore::Style::Blending\u003cOutlineOffset\u003e::canBlend):\n(WebCore::Style::Blending\u003cOutlineOffset\u003e::blend):\n(WebCore::Style::Evaluation\u003cUsedOutlineOffset, float\u003e::operator()):\n(WebCore::Style::Evaluation\u003cUsedOutlineOffset, LayoutUnit\u003e::operator()):\n* Source/WebCore/style/values/outline/StyleOutlineOffset.h:\n* Source/WebCore/style/values/primitives/StyleSnapLengthAsBorderWidth.cpp: Added.\n(WebCore::Style::snapLengthAsBorderWidth):\n(WebCore::Style::snapSignedLengthAsBorderWidth):\n* Source/WebCore/style/values/primitives/StyleSnapLengthAsBorderWidth.h: Added.\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::usedOutlineOffset):\n\nCanonical link: https://commits.webkit.org/319236@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "3adec8e64df0536e4d34c37902714552fbc0057d", "subject": "[css-ui] outline-offset computed value should be snapped as a line width" }, "319237@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "319237@main", "clUrl": "https://commits.webkit.org/319237@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321781\nrdar://184903374\n\nReviewed by Justin Michaud.\n\nCSE::findWasmStructValue walks every transitive predecessor block whenever a\nWasmStructGet or WasmStructSet has no match in its own block. This is\nfine for normal memory access since their range is coarse enough that\ndata.writes.overlaps(range) removes many possibilities quickly. But\nWasmGC struct fields are sparse enough so that we end up running\nanalysis to almost all blocks up to root.\n\nLet's just keep tracking how many count of struct field access we\nobserved so far. This makes looking up the blocks quickly giving up as\nwe may see count = 1 case in most of cases.\n\n* Source/JavaScriptCore/b3/B3EliminateCommonSubexpressions.cpp:\n\nCanonical link: https://commits.webkit.org/319237@main", "email": "ysuzuki@apple.com", "hash": "2ec06de15a0dfa8686509598a5d7e70d62163e66", "subject": "[JSC] Skip WasmGC struct search when nothing else holds the key" }, "319238@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "319238@main", "clUrl": "https://commits.webkit.org/319238@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321850\nrdar://185002028\n\nReviewed by Justin Michaud.\n\nAs the same to 319202@main, we do inlined small-sized memset in\noperationMemoryFill function before calling memset.\nWe do not do the same to MemoryCopy about paired approach as using FPR\netc. would be costly in filling case than copying case.\n\n* Source/JavaScriptCore/b3/B3Operations.cpp:\n(JSC::B3::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):\n\nCanonical link: https://commits.webkit.org/319238@main", "email": "ysuzuki@apple.com", "hash": "31f35870966c055d8ffb5cac2be896174cd513c1", "subject": "[JSC] Add small-sized fast fill before memset in operationMemoryFill" }, "319239@main": { "author": "David Kilzer", "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64", "cl": "319239@main", "clUrl": "https://commits.webkit.org/319239@main", "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=321735\u003e\n\u003crdar://184788659\u003e\n\nReviewed by Said Abou-Hallawa.\n\nBitmapImageSource tracks its decoded size by adding a frame's\nsizeInBytes() when its NativeImage is cached and subtracting the same\nmeasurement when the frame is cleared, both read live from\nNativeImage::sizeInBytes(). When drawing goes through the GPU process,\nRemoteResourceCacheProxy::recordNativeImageUse() replaces the platform\nimage with a memory-saving ShareableBitmap of a different size, so the\nsize subtracted at clear time no longer matches the size added at\ncache time. When the replacement is larger, m_decodedSize underflows\nand decodedSizeReset() asserts.\n\nRoute BitmapImage::draw() through a new ImageSource::drawNativeImage()\nvirtual. BitmapImageSource overrides it to measure the NativeImage\naround the draw and fold the difference into its decoded-size\naccounting; the replacement happens synchronously as the draw is\nrecorded, so the running total tracks the real size and matches what\nthe frame subtracts when it is cleared. The base implementation just\ndraws.\n\nFold the difference only while the current frame still owns the drawn\nNativeImage. BitmapImage::draw() reads the frame's orientation and\nheadroom after obtaining the image, and for a still-incomplete\n(progressively-loading) frame that clears the frame and has already\ndropped its size from m_decodedSize, leaving the NativeImage alive only\non the caller's stack. Folding then would corrupt the total; while the\nframe still owns the image, m_decodedSize includes its pre-draw size,\nso the adjustment stays balanced against the eventual clear.\n\nTests: fast/images/destroy-decoded-data-accounting.html\n http/tests/images/destroy-decoded-data-accounting-incomplete-frame.html\n\n* LayoutTests/fast/images/destroy-decoded-data-accounting-expected.txt: Add.\n* LayoutTests/fast/images/destroy-decoded-data-accounting.html: Add.\n* LayoutTests/http/tests/images/destroy-decoded-data-accounting-incomplete-frame-expected.txt: Add.\n* LayoutTests/http/tests/images/destroy-decoded-data-accounting-incomplete-frame.html: Add.\n* LayoutTests/http/tests/resources/load-and-stall.py:\n- Document that a test repeated in one web process may need a\n cache-busting query parameter to avoid stalling its own later loads.\n* Source/WebCore/platform/graphics/BitmapImage.cpp:\n(WebCore::BitmapImage::draw):\n* Source/WebCore/platform/graphics/BitmapImageSource.cpp:\n(WebCore::BitmapImageSource::drawNativeImage): Add.\n* Source/WebCore/platform/graphics/BitmapImageSource.h:\n* Source/WebCore/platform/graphics/ImageFrame.h:\n(WebCore::ImageFrame::hasNativeImage): Add.\n* Source/WebCore/platform/graphics/ImageSource.cpp:\n(WebCore::ImageSource::drawNativeImage): Add.\n* Source/WebCore/platform/graphics/ImageSource.h:\n\nCanonical link: https://commits.webkit.org/319239@main", "email": "ddkilzer@apple.com", "hash": "e1d90aba37f5ef0b38d954bf715feebb2cae92d5", "subject": "[WebCore] ASSERT(m_decodedSize \u003e= decodedSize) in BitmapImageSource::decodedSizeReset()" }, "319240@main": { "author": "Taher Ali", "avatar": "https://www.gravatar.com/avatar/e104800647d8c98b8c9dbe736b5e1751?d=identicon\u0026s=64", "cl": "319240@main", "clUrl": "https://commits.webkit.org/319240@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321208\nrdar://184267962\n\nReviewed by Sam Weinig.\n\nThe link-parameters property sets named values on the external resources an\nelement references, which the resource reads with env():\n\nimg { link-parameters: param(--color, green); }\n\nThis PR parses, computes and serializes the property. The computed value is not\nused yet, so it has no rendering effect. That follows seperately.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-link-params/inheritance-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-link-params/link-parameters-computed-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-link-params/link-parameters-substitution-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-link-params/link-parameters-substitution.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-link-params/link-parameters-valid-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/rendering/widgets/shadow-dom-expected.txt:\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:\n\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/html/rendering/widgets/shadow-dom-expected.txt:\n* LayoutTests/platform/ios/imported/w3c/web-platform-tests/html/rendering/widgets/shadow-dom-expected.txt:\n\nRebaseline the already failed test. The test asserts getComputedStyle(child).length is 0\nfor an element outside the flat tree; WebKit returns the property count instead.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebCore/CMakeLists.txt:\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/NoUncountedMemberCheckerExpectations:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/css/CSSParamValue.cpp: Added.\n(WebCore::CSSParamValue::CSSParamValue):\n(WebCore::CSSParamValue::equals const):\n(WebCore::CSSParamValue::customCSSText const):\n* Source/WebCore/css/CSSParamValue.h: Added.\n* Source/WebCore/css/CSSProperties.json:\n* Source/WebCore/css/CSSValue.cpp:\n(WebCore::CSSValue::visitDerived):\n* Source/WebCore/css/CSSValue.h:\n(WebCore::CSSValue::isParamValue const):\n* Source/WebCore/css/CSSValueKeywords.in:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+LinkParameters.cpp: Added.\n(WebCore::CSSPropertyParserHelpers::consumeParamFunction):\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+LinkParameters.h: Added.\n* Source/WebCore/css/parser/CSSPropertyParserCustom.h:\n* Source/WebCore/css/values/link-params/CSSLinkParameter.h: Added.\n(WebCore::CSS::get):\n* Source/WebCore/css/values/primitives/CSSDeclarationValue.cpp: Added.\n(WebCore::CSS::DeclarationValue::operator== const):\n(WebCore::CSS::Serialize\u003cDeclarationValue\u003e::operator):\n(WebCore::CSS::operator\u003c\u003c):\n* Source/WebCore/css/values/primitives/CSSDeclarationValue.h: Added.\n(WebCore::CSS::ComputedStyleDependenciesCollector\u003cDeclarationValue\u003e::operator()):\n(WebCore::CSS::CSSValueChildrenVisitor\u003cDeclarationValue\u003e::operator()):\n* Source/WebCore/style/computed/StyleComputedStyleBase.h:\n* Source/WebCore/style/computed/data/StyleNonInheritedRareData.cpp:\n(WebCore::Style::NonInheritedRareData::NonInheritedRareData):\n(WebCore::Style::NonInheritedRareData::operator== const):\n(WebCore::Style::NonInheritedRareData::dumpDifferences const):\n* Source/WebCore/style/computed/data/StyleNonInheritedRareData.h:\n* Source/WebCore/style/values/link-params/StyleLinkParameters.cpp: Added.\n(WebCore::Style::CSSValueConversion\u003cLinkParameter\u003e::operator):\n(WebCore::Style::CSSValueCreation\u003cLinkParameter\u003e::operator):\n* Source/WebCore/style/values/link-params/StyleLinkParameters.h: Added.\n(WebCore::Style::get):\n* Source/WebCore/style/values/primitives/StyleDeclarationValue.cpp: Added.\n(WebCore::Style::DeclarationValue::operator== const):\n(WebCore::Style::ToCSS\u003cDeclarationValue\u003e::operator):\n(WebCore::Style::ToStyle\u003cCSS::DeclarationValue\u003e::operator):\n(WebCore::Style::Serialize\u003cDeclarationValue\u003e::operator):\n(WebCore::Style::operator\u003c\u003c):\n* Source/WebCore/style/values/primitives/StyleDeclarationValue.h: Added.\n\nCanonical link: https://commits.webkit.org/319240@main", "email": "taher_ali@apple.com", "hash": "fc282b23c3fea8cf575b8ed8d6f43141b6fd655f", "subject": "[css-link-params] Add the link-parameters property" }, "319241@main": { "author": "Patrick Kettner", "avatar": "https://www.gravatar.com/avatar/20de23ea2d7e8a55b593d98066fa3f51?d=identicon\u0026s=64", "cl": "319241@main", "clUrl": "https://commits.webkit.org/319241@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321740\n\nReviewed by Timothy Hatcher.\n\nThe WebExtension IDL files declare dictionary parameters as untyped any\nvalues, with the expected keys and types defined only in Cocoa parse\nfunctions and validateDictionary tables. This adds WebIDL dictionary and\nenum declarations matching the existing C++ and Objective-C parameter\nvalidation for 21 extension interfaces, describing the current\nimplementation without changing runtime behavior.\n\nThe declarations are not referenced by operation parameters.\nCodeGeneratorExtensions.pm:1481 maps a named parameter type to a wrapped\nC++ class, so [NSDictionary] WebExtensionTabCreateProperties would emit a\ncall to toWebExtensionTabCreateProperties() and an include for\nWebExtensionTabCreateProperties.h, neither of which exist. Parameters stay\n[NSDictionary] any for that reason.\n\nGenerated bindings are byte-identical. CodeGeneratorExtensions.pm processes\nonly interface operations and ignores top-level dictionary definitions, so\nrunning generate-bindings.pl across all modified IDL files produces\nidentical C++ headers and implementation files.\n\nTools/Scripts/verify-webextension-declarations checks that dictionary keys,\ntypes, and optionality declared in WebExtension IDL match the corresponding\nvalidateDictionary tables in Source/WebKit/WebProcess/Extensions/API/, so the\ntwo cannot drift apart silently. It currently covers 16 input parameter\ndictionaries validated in the Cocoa and C++ parse functions; the return entity\ndictionaries built by the toWebAPI() serializers are not yet covered.\n\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIAction.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIAlarms.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIBookmarks.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPICommands.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPICookies.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIDeclarativeNetRequest.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIDevToolsInspectedWindow.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIExtension.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPILocalization.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIMenus.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIOffscreen.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIPermissions.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIRuntime.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIScripting.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPISidePanel.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPISidebarAction.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIStorageArea.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPITabs.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIWebNavigation.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIWebRequest.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIWindows.idl:\n* Tools/Scripts/verify-webextension-declarations: Added.\n* Tools/Scripts/webkitpy/webextensions/__init__.py: Added.\n* Tools/Scripts/webkitpy/webextensions/verify_webextension_declarations_unittest.py: Added.\n\nCanonical link: https://commits.webkit.org/319241@main", "email": "patrickkettner@google.com", "hash": "c691177463029c907b78c21215a9ca3aab6ce499", "subject": "Declare WebExtension dictionary and enum types in WebIDL" }, "319242@main": { "author": "Rupin Mittal", "avatar": "https://www.gravatar.com/avatar/3e3de9845931d2dc844afb00056ec94e?d=identicon\u0026s=64", "cl": "319242@main", "clUrl": "https://commits.webkit.org/319242@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=300006\nrdar://161203519\n\nReviewed by Basuke Suzuki.\n\nThe very last assert in this test is failing: assert_true(navigate_called);\n\nFor a cross-document traversal of the top-level frame, the navigate event must be\nfired on the document being navigated away from, right after beforeunload. Currently,\nif the document being navigated to is being restored from the BFCache, dispatch is\ndeferred until after CachedPage::restore(). By then m_frame-\u003edocument() is the restored\ndocument, so the event landed on that document's Navigation object. This means that the\nnavigate event is (wrongly) never fired on the document that we navigated away from.\n\nWe fix this by not deferring the firing of the navigate event:\n(1) FrameLoader::continueLoadAfterNavigationPolicy() no longer leaves\n m_pendingNavigationAPIItem set if the item we're navigating to comes from the BFCache.\n It fires the navigate event.\n(2) FrameLoader::commitProvisionalLoad() no longer has to check if a pending item is set\n and fire the navigate event.\n\nAfter we make this change, the navigate event is correctly fired on the document that\nwe're navigating away from. Our test passes and another test defer-back.html is also fixed.\n\nBut running the test shows that there is a unhandled AbortError. This is preexisting but\nneeds to be fixed as well.\n\nAccording to the spec \"For cross-document navigations ... both promises will never settle.\"\nBut FrameLoader::closeURL() (which is called when we navigate away from a document) calls\nFrameLoader::stopLoading() with UnloadEventPolicy::UnloadOnly and then stopLoading() calls\nabortOngoingNavigationIfNeeded() which rejects the promises (and leads to the AbortError).\n\nTo fix this we:\n(1) Amend the condition in FrameLoader::stopLoading() not abort the ongoing navigation if\n the document is going into the BFCache.\n(2) This leaves a live ongoing navigation on the cached document, and when the document is\n reactivated, the next time a navigate event is fired on it, that stale ongoing navigation\n will be aborted (Navigation::innerDispatchNavigateEvent() calls\n abortOngoingNavigationIfNeeded()). So the AbortError is simply deferred. To fix this,\n we discard this ongoing navigation and related state when caching the document.\n(3) A document can be navigated away from and put into the back/forward cache while a\n different, earlier navigation of its own is still in flight — one that called intercept(),\n and is therefore same-document (The new in-flight layout test covers this). Those promises\n should reject rather than hang: that navigation was genuinely pending and can\n never complete now the document is being deactivated. So for this case we abort rather than\n discard, which rejects the tracker's promises and also rejects and clears\n navigation.transition.\n\n The abort cannot happen in discardOngoingNavigationForBackForwardCache() because this\n runs from CachedFrame's constructor inside a ScriptDisallowedScope, and sborting\n dispatches events, which is not allowed. So the abort happens in a later function,\n FrameLoader::stopLoading().\n\nThese changes break different-origin-entries-removed-after-bfcache.html because\nit was wrongly depending on the navigate event to be fired on the navigated-to\ndocument. So we amend it to not depend on that wrong behavior and also to test\nthat the navigate event is not fired on the document being navigated to.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/http/tests/navigation-api/different-origin-entries-removed-after-bfcache.html:\n* LayoutTests/http/tests/navigation-api/different-origin-entries-removed-after-bfcache-expected.txt:\n* LayoutTests/http/tests/navigation-api/in-flight-navigation-aborted-when-entering-bfcache-expected.txt: Added.\n* LayoutTests/http/tests/navigation-api/in-flight-navigation-aborted-when-entering-bfcache.html: Added.\n* LayoutTests/http/tests/navigation-api/resources/in-flight-navigation-popup.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/defer/tentative/defer-back-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/navigation-back-cross-document-preventDefault-expected.txt:\n* Source/WebCore/loader/FrameLoader.cpp:\n(WebCore::FrameLoader::stopLoading):\n(WebCore::FrameLoader::commitProvisionalLoad):\n(WebCore::FrameLoader::continueLoadAfterNavigationPolicy):\n(WebCore::FrameLoader::continueLoadAfterNewWindowPolicy): Deleted.\n* Source/WebCore/page/LocalDOMWindow.cpp:\n(WebCore::LocalDOMWindow::suspendForBackForwardCache):\n* Source/WebCore/page/Navigation.cpp:\n(WebCore::Navigation::discardOngoingNavigationForBackForwardCache):\n* Source/WebCore/page/Navigation.h:\n\nCanonical link: https://commits.webkit.org/319242@main", "email": "rupin@apple.com", "hash": "c2efc73ec496407f393d9b8edb6f8e7fca48241c", "subject": "[Navigation API] navigation-back-cross-document-preventDefault.html is failing" } }, "date": "2026-08-15", "days": 1, "generatedAt": "2026-08-15T22:05:39Z", "markdown": "## Highlights\n- **Web Platform** Navigation API precommit handling is now on by default, a meaningful step toward broader spec-compliant navigation interception behavior. [commit 319208@main](https://commits.webkit.org/319208@main)\n- **UI** `corner-shape` is now enabled by default, expanding the CSS surface area available to sites without flags. [commit 319205@main](https://commits.webkit.org/319205@main)\n- **Security** WebKit now validates `IOSurface` objects received via `MachSendRight` during page snapshots, tightening a sensitive cross-process boundary. [commit 319213@main](https://commits.webkit.org/319213@main)\n- **Networking** API tests gained an HTTP/3 server, which should make transport-layer coverage a lot more realistic. [commit 319204@main](https://commits.webkit.org/319204@main)\n- **GPU** Canvas 2D `drawImage()` can now consume a WebGPU source, closing an important graphics pipeline gap. [commit 319231@main](https://commits.webkit.org/319231@main)\n- **V8** JavaScriptCore added a small-size fast path before `memset` in `operationMemoryFill`, shaving overhead from a hot low-level primitive. [commit 319238@main](https://commits.webkit.org/319238@main)\n- **Media** Audio session category calculation is now synchronous under site isolation, reducing lag and category mismatches around media startup. [commit 319230@main](https://commits.webkit.org/319230@main)\n- **Security** CSP now treats the invalid source expression `*.` correctly, fixing a policy parsing hole with real security impact. [commit 319232@main](https://commits.webkit.org/319232@main)\n- **A11y** Accessibility line mapping in contenteditables is now consistent between range and index queries, fixing navigation and reading mismatches. [commit 319221@main](https://commits.webkit.org/319221@main)\n\n## What landed by area\n\n### Navigation API and page lifecycle\n- **Web Platform** Fixed a failing cross-document back-navigation test around `preventDefault()`, continuing Navigation API stabilization. [commit 319242@main](https://commits.webkit.org/319242@main)\n- **Web Platform** `navigateerror` now fires correctly for a navigation started from a `navigateerror` handler. [commit 319222@main](https://commits.webkit.org/319222@main)\n- **Web Platform** `navigation.activation.from` is now null when navigating away from the initial `about:blank`, matching expected semantics. [commit 319217@main](https://commits.webkit.org/319217@main)\n\n### CSS, layout, and rendering\n- **Web Platform** Added the `link-parameters` property for `css-link-params`, moving another CSS feature forward. [commit 319240@main](https://commits.webkit.org/319240@main)\n- **Rendering** `outline-offset` computed values are now snapped like line widths, improving CSS UI consistency. [commit 319236@main](https://commits.webkit.org/319236@main)\n- **Rendering** Resynced WPT coverage for table rendering under `html/rendering/non-replaced-elements/tables`. [commit 319235@main](https://commits.webkit.org/319235@main)\n- **Rendering** `element.scroll()` and `scrollTo()` now work correctly inside `content-visibility: hidden` subtrees. [commit 319219@main](https://commits.webkit.org/319219@main)\n- **Rendering** IFC intrinsic width computation now handles a line containing a block-level box. [commit 319212@main](https://commits.webkit.org/319212@main)\n- **Rendering** Fixed Arabic joining across adjacent inline boxes when followed by text on the simple code path. [commit 319209@main](https://commits.webkit.org/319209@main)\n- **Mobile** Added more comprehensive keyboard-related layout tests for `interactive-widget`. [commit 319203@main](https://commits.webkit.org/319203@main)\n- **Rendering** Fixed Urdu text underline rendering on blog.rekhta.org. [commit 319220@main](https://commits.webkit.org/319220@main)\n\n### JavaScriptCore, Wasm, and regex\n- **V8** WasmGC struct lookup now gets skipped when nothing else retains the key, trimming wasted work in JSC internals. [commit 319237@main](https://commits.webkit.org/319237@main)\n- **Refactor** Repatch-only fields were moved out of `HandlerPropertyInlineCache`, slimming that JSC structure. [commit 319228@main](https://commits.webkit.org/319228@main)\n- **Perf** `JSGlobalObject::init()` no longer eagerly creates `Set.prototype`, `WeakRef`, and `FinalizationRegistry`, reducing startup work. [commit 319227@main](https://commits.webkit.org/319227@main)\n- **Perf** YARR now JIT-compiles lookbehinds in Unicode regex patterns. [commit 319226@main](https://commits.webkit.org/319226@main)\n- **Perf** Wasm-to-JS import returns now use a fast path for `i64` BigInt values. [commit 319218@main](https://commits.webkit.org/319218@main)\n\n### Extensions, platform API gating, and embedders\n- **Web Platform** WebExtension dictionary and enum types are now declared in WebIDL, improving API definition hygiene. [commit 319241@main](https://commits.webkit.org/319241@main)\n- **Refactor** More of `WebExtensionController` was ported to C++, continuing the shift out of higher-level glue. [commit 319234@main](https://commits.webkit.org/319234@main)\n- **Privacy** The offscreen API is now exposed only when its feature flag is enabled, reducing accidental surface area. [commit 319206@main](https://commits.webkit.org/319206@main)\n- **UI** AppKit gesture controllers now properly react to preference changes driven through `WebPage.setWebFeature()`. [commit 319229@main](https://commits.webkit.org/319229@main)\n- **Refactor** Gesture event handling was reworked to support gesture recognizers on AppKit. [commit 319224@main](https://commits.webkit.org/319224@main)\n\n### Media, graphics, and images\n- **Media** `BitmapImageSource::decodedSizeReset()` got an assertion fix around decoded size accounting. [commit 319239@main](https://commits.webkit.org/319239@main)\n\n### Accessibility and text extraction\n- **A11y** Added a missing null check in `attributedStringByReplacingRemoteFrameMarkers`, hardening attributed string extraction paths. [commit 319215@main](https://commits.webkit.org/319215@main)\n- **A11y** Added `backgroundTextExtractionEnabled` testing SPI to `WebPage.Configuration`. [commit 319216@main](https://commits.webkit.org/319216@main)\n- **A11y** Text extraction for activision.com no longer injects the `clickable` token before the \"Change Your Password\" heading. [commit 319210@main](https://commits.webkit.org/319210@main)\n\n### Build, toolchain, and project hygiene\n- **Build** Fixed `-Wthread-safety-precise` and `constexpr` issues for clang 18. [commit 319233@main](https://commits.webkit.org/319233@main)\n- **Build** Updated safer C++ expectations to the 2026-08-14 baseline. [commit 319223@main](https://commits.webkit.org/319223@main)\n- **Build** Fixed a macOS CMake build break caused by `alertCount` redefinition in TestWebKitAPI. [commit 319214@main](https://commits.webkit.org/319214@main)\n- **Refactor** Removed an empty `WYHash.h` file. [commit 319225@main](https://commits.webkit.org/319225@main)\n\n### Test gardening and stability\n- **Build** Fixed a flaky crash in fullscreen iframe WPT coverage on macOS Debug bots. [commit 319211@main](https://commits.webkit.org/319211@main)\n- **Media** Fixed a flaky failure in `media/video-multiple-concurrent-playback.html` on macOS and iOS. [commit 319207@main](https://commits.webkit.org/319207@main)", "repo": "webkit", "repoDisplay": "WebKit", "rollGroups": [], "since": "2026-08-15", "totals": { "commits": 40, "features": 40, "rolls": 0 }, "until": "2026-08-15" }