{
  "commits": {
    "319243@main": {
      "author": "Zak Ridouh",
      "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64",
      "cl": "319243@main",
      "clUrl": "https://commits.webkit.org/319243@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=321123\u003e\n\u003crdar://problem/184157871\u003e\n\nReviewed by Charlie Wolfe.\n\nThe UI process sets m_fullscreenState and fullscreens the owner elements in the\nprocesses hosting ancestor frames before the web process confirms entering. Only\nbeganExitFullScreen undoes that, and the failure paths send CloseFullScreen()\ninstead of reaching it, so the page and its ancestor frames stay fullscreened for\nthe lifetime of the page.\n\nUnwind in close(), since CloseFullScreen() means fullscreen failed or is over:\nreset m_fullscreenState, exit fullscreen in the ancestor processes, and notify the\nfullscreen client. Every process hosting a frame of the page can send that\nmessage, so the handler now message checks the sender against the process that\nowns fullscreen. Rename Close() to CloseFullScreen() to keep that checked handler\ndistinct from close(), which detachFromClient and closeWithCallback call with no\nsender to validate.\n\nThe web process keeps the same state stuck: only didExitFullScreen resets\nWebPage::m_isInFullscreenMode, which selects native viewport parameters on iOS.\nReset it in WebFullScreenManager::close() too, and return early when\nwillEnterFullscreen() throws, since that path closed and then sent\nBeganEnterFullScreen anyway.\n\nperformEnterFullScreen cleans up locally when the UI process declines: nothing was\nentered there, and m_fullScreenFrameID can belong to another process.\n\n* Source/WebKit/UIProcess/WebFullScreenManagerProxy.cpp:\n(WebKit::WebFullScreenManagerProxy::closeFullScreen):\n(WebKit::WebFullScreenManagerProxy::close):\n(WebKit::WebFullScreenManagerProxy::detachFromClient):\n(WebKit::WebFullScreenManagerProxy::isFullScreenInSendingProcess const):\n* Source/WebKit/UIProcess/WebFullScreenManagerProxy.h:\n* Source/WebKit/UIProcess/WebFullScreenManagerProxy.messages.in:\n* Source/WebKit/WebProcess/FullScreen/WebFullScreenManager.cpp:\n(WebKit::WebFullScreenManager::performEnterFullScreen):\n(WebKit::WebFullScreenManager::willEnterFullScreen):\n(WebKit::WebFullScreenManager::close):\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::closeFullScreen):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/FullscreenRemoveNodeBeforeEnter.mm:\n(TestWebKitAPI::TEST):\n\nCanonical link: https://commits.webkit.org/319243@main",
      "email": "zakr@apple.com",
      "hash": "ebc2413b86622c54219f311b81a98ccdd4b7063d",
      "subject": "[Fullscreen] Unwind fullscreen state when entering fullscreen fails"
    },
    "319244@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "319244@main",
      "clUrl": "https://commits.webkit.org/319244@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=321856\u003e\n\u003crdar://185016028\u003e\n\nReviewed by Abrar Rahman Protyasha.\n\nCast the `BOOL` returned by `-magnificationGestureRecognizerCanZoom`\nto `bool` when initializing the `NativeWebGestureEvent::Init`\naggregate to fix `-Wc++11-narrowing` warning as an error.\n\nNo new tests since this is a build issue.\n\n* Source/WebKit/UIProcess/mac/AppKitGestures/WKAppKitGestureController.mm:\n(-[WKAppKitGestureController magnificationGestureRecognized:]):\n\nCanonical link: https://commits.webkit.org/319244@main",
      "email": "ddkilzer@apple.com",
      "hash": "0136fa2b7cf669ab6bc8e715727e6a78bf5f24ba",
      "subject": "REGRESSION (319224@main): Fix -Wc++11-narrowing warning in NativeWebGestureEvent::Init"
    },
    "319245@main": {
      "author": "Zak Ridouh",
      "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64",
      "cl": "319245@main",
      "clUrl": "https://commits.webkit.org/319245@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320262\nrdar://183186440\n\nReviewed by David Kilzer.\n\nXMLDocumentParser::end() dispatches readystatechange by calling\nDocument::setReadyState(Interactive), which can run arbitrary script, and then\nkept using document() unconditionally. Script run from that event can detach the\nparser -- for example window.stop(), which calls DocumentParser::finish()\nre-entrantly and reaches Document::finishedParsing(), or removing the frame the\nXML document is loaded in -- after which document() is null and\ndocument()-\u003efinishedParsing() dereferences it. HTMLDocumentParser already\nre-checks isDetached() after setting the ready state for this reason; do the\nsame in XMLDocumentParser::end(), and also re-check after updateLeafTextNode(),\nwhose mutation events can run script two lines before another use of document().\n\nBailing out is safe because detach() has already cleared the current node stack.\n\nTests: fast/parser/xml-parser-end-detach-crash-frame-removal.html\n       fast/parser/xml-parser-end-detach-crash-window-stop.xhtml\n\n* LayoutTests/fast/parser/resources/xml-parser-end-detach-frame.xhtml: Added.\n(document.onreadystatechange):\n* LayoutTests/fast/parser/xml-parser-end-detach-crash-frame-removal-expected.txt: Added.\n* LayoutTests/fast/parser/xml-parser-end-detach-crash-frame-removal.html: Added.\n* LayoutTests/fast/parser/xml-parser-end-detach-crash-window-stop-expected.txt: Added.\n* LayoutTests/fast/parser/xml-parser-end-detach-crash-window-stop.xhtml: Added.\n* Source/WebCore/xml/parser/XMLDocumentParser.cpp:\n(WebCore::XMLDocumentParser::end):\n\nCanonical link: https://commits.webkit.org/319245@main",
      "email": "zakr@apple.com",
      "hash": "cee623c24bfce90c11aa34ff96fa5b6dbd884e9b",
      "subject": "Null Document dereference in XMLDocumentParser::end() when readystatechange detaches the parser"
    },
    "319246@main": {
      "author": "Brady Eidson",
      "avatar": "https://www.gravatar.com/avatar/31bed81d6d8ef517f93b30add03f5651?d=identicon\u0026s=64",
      "cl": "319246@main",
      "clUrl": "https://commits.webkit.org/319246@main",
      "description": "rdar://184973318\nhttps://bugs.webkit.org/show_bug.cgi?id=321831\n\nReviewed by Timothy Hatcher.\n\nA page-scoped WKUserStyleSheet was incompatible with how ExtensionStyleSheets work with\nsite isolation enabled due to page identifier confusion and not messaging enough processes.\n\nAPI::UserStyleSheet now holds the WebPageProxy, and dataFromUserStyleSheet() derives the\nidentifier for each destination process. Orphaned page-scoped sheets are no longer sent.\n\nWe now also register a new RemotePageProxy with its BrowsingContextGroup before\ninjectPageIntoNewProcess() so process creation parameters can now resolve correctly.\n\nTests: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIScripting.mm\n       Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPITabs.mm\n\n* Source/WebKit/UIProcess/API/APIUserStyleSheet.cpp:\n(API::UserStyleSheet::UserStyleSheet):\n(API::UserStyleSheet::page const):\n* Source/WebKit/UIProcess/API/APIUserStyleSheet.h:\n* Source/WebKit/UIProcess/API/Cocoa/_WKUserStyleSheet.mm:\n(-[_WKUserStyleSheet initWithSource:forWKWebView:forMainFrameOnly:includeMatchPatternStrings:excludeMatchPatternStrings:baseURL:level:contentWorld:]):\n* Source/WebKit/UIProcess/BrowsingContextGroup.cpp:\n(WebKit::BrowsingContextGroup::addFrameProcessAndInjectPageContextIf):\n(WebKit::BrowsingContextGroup::addPage):\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionContextCocoa.mm:\n(WebKit::WebExtensionContext::didCommitLoadForFrame):\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionDynamicScriptsCocoa.mm:\n(WebKit::WebExtensionDynamicScripts::injectStyleSheets):\n* Source/WebKit/UIProcess/UserContent/WebUserContentControllerProxy.cpp:\n(WebKit::WebUserContentControllerProxy::dataFromUserStyleSheet const):\n(WebKit::WebUserContentControllerProxy::parametersForProcess const):\n(WebKit::WebUserContentControllerProxy::addUserStyleSheet):\n* Source/WebKit/UIProcess/UserContent/WebUserContentControllerProxy.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/WebExtensionUtilities.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/WebExtensionUtilities.mm:\n(-[TestWebExtensionManager initForExtension:extensionControllerConfiguration:usesEnhancedSecurity:]):\n(-[TestWebExtensionTab initWithWindow:extensionController:]):\n(-[TestWebExtensionTab changeWebViewIfNeededForURL:forExtensionContext:]):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIScripting.mm:\n(TestWebKitAPI::TEST(WKWebExtensionAPIScripting, InsertAndRemoveCSS)):\n(TestWebKitAPI::TEST(WKWebExtensionAPIScripting, InsertCSSInAllFramesWithCrossSiteFrame)):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPITabs.mm:\n(TestWebKitAPI::TEST(WKWebExtensionAPITabs, InsertCSSInAllFramesWithCrossSiteFrame)):\n\nCanonical link: https://commits.webkit.org/319246@main",
      "email": "beidson@apple.com",
      "hash": "35b639797fbbd7db560b0d54791e7c01f73e02ac",
      "subject": "[Site Isolation] Fix page identifier confusion in _WKUserStyleSheet code"
    },
    "319247@main": {
      "author": "Brady Eidson",
      "avatar": "https://www.gravatar.com/avatar/31bed81d6d8ef517f93b30add03f5651?d=identicon\u0026s=64",
      "cl": "319247@main",
      "clUrl": "https://commits.webkit.org/319247@main",
      "description": "rdar://185021389\nhttps://bugs.webkit.org/show_bug.cgi?id=321864\n\nReviewed by Timothy Hatcher.\n\nThe background, popup, and tab page identifiers in WebExtensionContextParameters were built from\nwebPageIDInMainFrameProcess() then sent to every new web content process. They resolve them against\nWebProcess::webPage() - But a PageIdentifier only names a WebPage in one process. So if an extension\npage has a cross-site subframe the identifier sent to that subframe's process is missing.\n\nWhile web extensions are setup and managed by WebKit API, there is no API that can observe this today.\nHence there is no test for this patch in isolation.\nThis is construction-in-depth similar to 319246@main, and it is a prerequisite for future testable work.\n\n* Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPIOffscreenCocoa.mm:\n(WebKit::WebExtensionContext::offscreenCreateDocument):\n* Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPIRuntimeCocoa.mm:\n(WebKit::WebExtensionContext::runtimeGetBackgroundPage):\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionContextCocoa.mm:\n(WebKit::WebExtensionContext::backgroundPageIdentifier const):\n(WebKit::WebExtensionContext::backgroundPageIdentifierInOwnProcess const):\n(WebKit::WebExtensionContext::popupPageIdentifiers const):\n(WebKit::WebExtensionContext::tabPageIdentifiers const):\n(WebKit::WebExtensionContext::loadBackgroundWebView):\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.cpp:\n(WebKit::WebExtensionContext::parameters const):\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.h:\n* Source/WebKit/UIProcess/Extensions/WebExtensionController.cpp:\n(WebKit::WebExtensionController::parameters const):\n(WebKit::WebExtensionController::dispatchDidLoad):\n* Source/WebKit/UIProcess/Extensions/WebExtensionController.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::creationParameters):\n\nCanonical link: https://commits.webkit.org/319247@main",
      "email": "beidson@apple.com",
      "hash": "29769e195bc767cf5fcf19b73e677ba06c6ef31b",
      "subject": "[Site Isolation] Web extension page identifiers are built for the wrong process"
    },
    "319248@main": {
      "author": "Diego Pino Garcia",
      "avatar": "https://www.gravatar.com/avatar/e8cce88637f1a6e79155e8371e24b2e8?d=identicon\u0026s=64",
      "cl": "319248@main",
      "clUrl": "https://commits.webkit.org/319248@main",
      "description": "Unreviewed.\n\nMark tests passing after 319168@main.\nEmit GLIB baseline for recently added test.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/glib/fast/css/intrinsic-width-with-preserved-whitespace-and-block-level-box-on-a-line-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/319248@main",
      "email": "dpino@igalia.com",
      "hash": "1fc5eff4d062935fb9a78d0c4a33098fb9a1e332",
      "subject": "[GLIB] layout test gardening"
    },
    "319249@main": {
      "author": "Jean-Yves Avenard",
      "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64",
      "cl": "319249@main",
      "clUrl": "https://commits.webkit.org/319249@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321774\nrdar://184896873\n\nReviewed by Eric Carlson.\n\nUnder site isolation, three things ran in the UI process when then didn't have to:\n\n1) The playback admission ran in the UI process on a mirrored session:\n    RemoteMediaSessionManager::sessionWillBeginPlayback sent MediaSessionWillBeginPlayback and waited\n    for granted, which RemoteMediaSessionManagerProxy computed by running the base\n    sessionWillBeginPlayback on a RemoteMediaSessionProxy. Both inputs to that decision were in the\n    content process already: the session state, since interruptions reached it\n    from the GPU process through RemoteAudioSession::beginInterruptionRemote,\n    and the restrictions, which RemoteMediaSessionManager::addRestriction kept\n    there as well as forwarding.\n\n2) The UI process activated the audio session on behalf of each content process, per process since\n    319006@main: an activation queue and per-process state, TryToSetAudioSessionActiveForProcess to\n    the GPU process, and AudioSessionActiveStateChangedForProcess back from it. That hop decided\n    nothing. It carried a ProcessIdentifier and a bool to\n    RemoteAudioSessionProxyManager::tryToSetActiveForProcess, which a content process could reach\n    directly through its own RemoteAudioSessionProxy, and where the arbitration across processes had\n    always been.\n\n3) The check meant to stop the content process driving the GPU process at the same time read\n    sharedPreferencesForWebProcessValue().remoteMediaSessionManagerEnabled, which was false by\n    default and was not set by --site-isolation, while WebPage installed the RemoteMediaSessionManager\n    when either that preference or SiteIsolationEnabled was set. So both processes drove the same\n    process's audio session, each through its own activation chain and neither aware of the other's,\n    and resetToConsistentStateForTesting() reached the GPU process between test iterations for the\n    same reason.\n\nRemoteMediaSessionManager::sessionWillBeginPlayback now calls the base implementation, so the whole\nadmission runs where the sessions, their state and the restrictions are, and\nMediaSessionWillBeginPlayback becomes a void message, sent so that the UI process can still make\nthe session current and enforce the concurrent playback restriction across every process's\nsessions. RemoteAudioSession sends TryToSetActive to the GPU process again, so the activation\nfailure arrives on the activation reply, resolving or rejecting the waiters that\nMediaSessionManagerInterface::sessionWillBeginPlayback already reads;\nclientWillBeginPlayback's CompletionHandler is unchanged.\n\nActivation runs as it did before 318337@main: the content process's AudioSession::singleton()\nis a RemoteAudioSession, whose tryToSetActive sends TryToSetActive to that\nprocess's RemoteAudioSessionProxy in the GPU process. The proxy hands it to\nRemoteAudioSessionProxyManager, which arbitrates against the other processes'\nproxies and activates the audio session the GPU process owns.\nThe reply resolves or rejects the promise the content process is waiting on, and\nRemoteAudioSessionProxy::configurationChanged pushes the resulting state back to\nit.\n\nThe UI process no longer activates an audio session on behalf of another process, because it does\nnot need to: nothing there reads a per-process active state now, the concurrent playback\nrestriction and the current session work from PlatformMediaSession state, and the GPU process has\nthe real state first-hand. RemoteMediaSessionManagerProxy stays the UI process's shared audio\nsession, as 303417@main made it, so this process reports the configuration the content processes\nsee, and its tryToSetActiveInternal resolves without doing anything.\n\nRemoteMediaSessionManager::processWillSuspend and processDidResume are removed with the messages\nthey sent: the base versions deactivate and re-activate this process's own session, which reaches\nthe GPU process now that the check in 3) is gone.\n\nCommits 318337@main and 319006@main are reverted apart from their tests.\n\n* Source/WebCore/platform/audio/MediaSessionManagerClient.h:\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.cpp:\n(WebCore::PageMediaSessionManagerClient::tryToSetAudioSessionActive): Deleted.\n* Source/WebKit/GPUProcess/GPUProcess.cpp:\n(WebKit::GPUProcess::tryToSetAudioSessionActiveForProcess): Deleted.\n* Source/WebKit/GPUProcess/GPUProcess.h:\n* Source/WebCore/platform/audio/MediaSessionManagerClient.h:\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.cpp:\n(WebCore::PageMediaSessionManagerClient::tryToSetAudioSessionActive): Deleted.\n* Source/WebKit/GPUProcess/GPUProcess.cpp:\n(WebKit::GPUProcess::tryToSetAudioSessionActiveForProcess): Deleted.\n* Source/WebKit/GPUProcess/GPUProcess.h:\n* Source/WebKit/GPUProcess/GPUProcess.messages.in:\n* Source/WebKit/GPUProcess/media/RemoteAudioSessionProxy.cpp:\n(WebKit::RemoteAudioSessionProxy::tryToSetActive): Stop telling the UI process about this process's\nactive state.\n* Source/WebKit/GPUProcess/media/RemoteAudioSessionProxyManager.cpp:\n(WebKit::RemoteAudioSessionProxyManager::tryToSetActiveForProcess): Deleted the ProcessIdentifier\noverload, which existed for a caller with no proxy of its own. The RemoteAudioSessionProxy overload,\nwhich every activation goes through and which holds the arbitration, is unchanged.\n* Source/WebKit/GPUProcess/media/RemoteAudioSessionProxyManager.h:\n* Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp:\n(WebKit::GPUProcessProxy::tryToSetAudioSessionActiveForProcess): Deleted.\n(WebKit::GPUProcessProxy::audioSessionActiveStateChangedForProcess): Deleted.\n* Source/WebKit/UIProcess/GPU/GPUProcessProxy.h:\n* Source/WebKit/UIProcess/GPU/GPUProcessProxy.messages.in:\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.cpp:\n(WebKit::RemoteMediaSessionManagerProxyClient): Deleted.\n(WebKit::RemoteMediaSessionManagerProxy::RemoteMediaSessionManagerProxy): Keep this manager as the\nshared audio session, and stop making it the deactivation authority.\n(WebKit::RemoteMediaSessionManagerProxy::removeMediaSession): No per-process activation to drop.\n(WebKit::RemoteMediaSessionManagerProxy::webProcessWillShutDown): Ditto.\n(WebKit::RemoteMediaSessionManagerProxy::updateMediaSessionStates): Stop activating a process while\nit has audio capture sources; the content process does that from its own capture count.\n(WebKit::RemoteMediaSessionManagerProxy::mediaSessionWillBeginPlayback): Run only the part that\nneeds every process's sessions.\n(WebKit::RemoteMediaSessionManagerProxy::tryToSetActiveInternal): Resolve without doing anything.\n(WebKit::RemoteMediaSessionManagerProxy::remoteAudioConfigurationChanged): Take the descriptive\nconfiguration only.\n(WebKit::RemoteMediaSessionManagerProxy::setAudioSessionActiveForProcess): Deleted.\n(WebKit::RemoteMediaSessionManagerProxy::reevaluateAudioSessionActivation): Deleted.\n(WebKit::RemoteMediaSessionManagerProxy::enqueueAudioSessionActivation): Deleted.\n(WebKit::RemoteMediaSessionManagerProxy::sendNextActivationIPC): Deleted.\n(WebKit::RemoteMediaSessionManagerProxy::deactivateAllAudioSessions): Deleted.\n(WebKit::RemoteMediaSessionManagerProxy::hasActiveAudioSession const): Deleted.\n(WebKit::RemoteMediaSessionManagerProxy::processForSession const): Deleted.\n(WebKit::RemoteMediaSessionManagerProxy::processRequiresAudioSession const): Deleted.\n(WebKit::RemoteMediaSessionManagerProxy::remoteProcessWillSuspend): Deleted.\n(WebKit::RemoteMediaSessionManagerProxy::remoteProcessDidResume): Deleted.\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.h:\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.messages.in:\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionProxy.cpp:\n(WebKit::RemoteMediaSessionProxy::updateState): Stop re-evaluating activation from the UI process.\n* Source/WebKit/WebProcess/GPU/media/RemoteAudioSession.cpp:\n(WebKit::RemoteAudioSession::sendNextActivationIPC): Always send the activation to the GPU process.\n(WebKit::RemoteAudioSession::configurationChanged): Forward the configuration to the UI process on a\nmuted, buffer size, sample rate or routing change only.\n* Source/WebKit/WebProcess/Media/RemoteMediaSessionManager.cpp:\n(WebKit::RemoteMediaSessionManager::sessionWillBeginPlayback): Decide here, and tell the UI process\nwhen playback may begin.\n(WebKit::RemoteMediaSessionManager::processWillSuspend): Deleted.\n(WebKit::RemoteMediaSessionManager::processDidResume): Deleted.\n* Source/WebKit/WebProcess/Media/RemoteMediaSessionManager.h:\n\nCanonical link: https://commits.webkit.org/319249@main",
      "email": "jya@apple.com",
      "hash": "a2aebcb3a8edd1d1eff788e4fe509dbdb758e026",
      "subject": "[site-isolation] The content process should decide whether playback may begin and activate the audio session itself"
    },
    "319250@main": {
      "author": "Diego Pino Garcia",
      "avatar": "https://www.gravatar.com/avatar/e8cce88637f1a6e79155e8371e24b2e8?d=identicon\u0026s=64",
      "cl": "319250@main",
      "clUrl": "https://commits.webkit.org/319250@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=225499\n\nReviewed by Carlos Garcia Campos.\n\nThis test turns font feature 'dlig' (discretionary ligatures) ON and OFF\nseveral times. The former code only turned ON this feature, but it never\nturned it OFF again. As a result of that, the test was failing because it shown\nsome characters with ligatures enabled when it shouldn't.\n\nNow the 'dlig' and 'hlig' features are always disabled when\n'shouldDisableLigaturesForSpacing' is true. Otherwise, those feature tags\nare added if each corresponding feature is enabled.\n\n* Source/WebCore/platform/graphics/skia/FontCacheSkia.cpp:\n(WebCore::FontCache::computeFeatures):\n* LayoutTests/platform/glib/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319250@main",
      "email": "dpino@igalia.com",
      "hash": "96e4dba01e0addf7ec87e81103891bb066a1db3b",
      "subject": "[GLIB] imported/w3c/web-platform-tests/css/css-fonts/font-feature-resolution-002.html is failing"
    },
    "319251@main": {
      "author": "Karl Dubost",
      "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64",
      "cl": "319251@main",
      "clUrl": "https://commits.webkit.org/319251@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=138673\nrdar://185001852\n\nReviewed by Zak Ridouh.\n\nClicking a link with a download attribute in Mac MiniBrowser saves nothing: the\npage navigates to the file, or goes blank. Same for a response carrying\nContent-Disposition: attachment, and for Download Linked File in the context menu.\n\nThree things were missing, each one enough on its own.\ndecidePolicyForNavigationAction returned Allow for anything _canHandleRequest,\nwhich is true for the http and https URLs a download attribute points at. There\nwas no WKDownloadDelegate, so a download that did start was never told where to\nwrite. And MiniBrowser is sandboxed with no entitlement for the download folder.\n\nThis answers download for a download attribute, and for a response that is an\nattachment or a MIME type we cannot display in the main frame. It saves under a\nname that is still free, since WebKit refuses a destination that already exists.\n\nNote the WK1 window is untouched; the download attribute is off by default there.\n\nTest: ManualTests/download-triggers.html\n\n* ManualTests/download-triggers.html: Added.\n* Tools/MiniBrowser/MiniBrowser.entitlements:\n* Tools/MiniBrowser/mac/WK2BrowserWindowController.m:\n(responseIsAttachment):\n(-[WK2BrowserWindowController webView:decidePolicyForNavigationAction:preferences:decisionHandler:]):\n(-[WK2BrowserWindowController webView:decidePolicyForNavigationResponse:decisionHandler:]):\n(-[WK2BrowserWindowController webView:navigationAction:didBecomeDownload:]):\n(-[WK2BrowserWindowController webView:navigationResponse:didBecomeDownload:]):\n(-[WK2BrowserWindowController _webView:contextMenuDidCreateDownload:]):\n(availableDownloadURLWithFilename):\n(-[WK2BrowserWindowController download:decideDestinationUsingResponse:suggestedFilename:completionHandler:]):\n(-[WK2BrowserWindowController downloadDidFinish:]):\n(-[WK2BrowserWindowController download:didFailWithError:resumeData:]):\n\nCanonical link: https://commits.webkit.org/319251@main",
      "email": "karlcow@apple.com",
      "hash": "619a552127eb2f2f6e9383823edd3dccb81f008a",
      "subject": "MiniBrowser should support downloads for testing purposes"
    },
    "319252@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319252@main",
      "clUrl": "https://commits.webkit.org/319252@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321865\nrdar://185027124\n\nReviewed by Devin Rousso.\n\nWI.DOMTreeElementPathComponent builds its title from the WI.DOMNode, but the\nCDATA_SECTION_NODE case calls truncateEnd() on the node instead of on the node's\nvalue. truncateEnd() is a String.prototype extension, so selecting a CDATA\nsection throws a TypeError out of the constructor, which leaves\nContentBrowser._updateContentViewSelectionPathNavigationItem() half done and\ntakes down the frontend. XML documents are the only ones that parse CDATA\nsections, so this is reachable by selecting the CSS inside \u003cstyle\u003e when\ninspecting an SVG document.\n\nWI.DOMSearchMatchObject.titleForDOMNode() has the same mistake in its\nCDATA_SECTION_NODE case, where it concatenates the WI.DOMNode itself and\nproduces \"\u003c![CDATA[[object Object]]]\u003e\" as the search result title.\n\n* Source/WebInspectorUI/UserInterface/Models/DOMSearchMatchObject.js:\n(WI.DOMSearchMatchObject.titleForDOMNode):\n* Source/WebInspectorUI/UserInterface/Views/DOMTreeElementPathComponent.js:\n(WI.DOMTreeElementPathComponent):\n\nCanonical link: https://commits.webkit.org/319252@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "3b7282ac21bbb0cbe93af6bf69cca280968fa183",
      "subject": "Web Inspector: selecting a CDATA section in the DOM tree throws \"node.truncateEnd is not a function\""
    },
    "319253@main": {
      "author": "Sam Weinig",
      "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64",
      "cl": "319253@main",
      "clUrl": "https://commits.webkit.org/319253@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317315\n\nReviewed by Geoffrey Garen.\n\nReplace adhoc out-of-line Style::ComputedStyleProperties getters added in 315023@main\nwith generated ones.\n\nNow, in addition to the existing getters, each property has a getter with an additional\nsuffix, \"OutOfLine\", that is implemented in StyleComputedStyleProperties.cpp forwards to\nthe existing inline getter.\n\nIn addition, added an accessor, Style::ComputedStyleBase::primaryFont(), which returns\n`fontCascade().primaryFont()`, to simplify a few call sites.\n\n* Source/WebCore/accessibility/AccessibilityScrollView.cpp:\n* Source/WebCore/accessibility/cocoa/AccessibilityObjectCocoa.mm:\n* Source/WebCore/accessibility/ios/AccessibilityObjectIOS.mm:\n* Source/WebCore/css/CSSProperties.json:\n* Source/WebCore/css/scripts/process-css-properties.py:\n* Source/WebCore/css/scripts/test/TestCSSProperties.json:\n* Source/WebCore/css/scripts/test/TestCSSPropertiesResults/StyleComputedStyleProperties.cpp:\n* Source/WebCore/css/scripts/test/TestCSSPropertiesResults/StyleComputedStyleProperties.h:\n* Source/WebCore/page/writing-tools/WritingToolsController.mm:\n* Source/WebCore/style/computed/StyleComputedStyle.cpp:\n* Source/WebCore/style/computed/StyleComputedStyle.h:\n* Source/WebCore/style/computed/StyleComputedStyleBase.cpp:\n* Source/WebCore/style/computed/StyleComputedStyleBase.h:\n* Source/WebKitLegacy/mac/DOM/DOM.mm:\n* Source/WebKitLegacy/mac/WebView/WebView.mm:\n\nCanonical link: https://commits.webkit.org/319253@main",
      "email": "sam@webkit.org",
      "hash": "47f7250137c67d9e4cfeb72a38e5238782ea4f5e",
      "subject": "Generate \"out-of-line\" variants of Style::ComputedStyleProperties getters to allow some callers to avoid unnecessary includes"
    }
  },
  "date": "2026-08-16",
  "days": 1,
  "generatedAt": "2026-08-16T22:05:20Z",
  "markdown": "## Highlights\n- **Security** Fixes a null `Document` dereference in `XMLDocumentParser::end()` when `readystatechange` detaches the parser, closing a crashy parser edge case. [commit 319245@main](https://commits.webkit.org/319245@main)\n- **Security** Corrects web extension page identifiers under Site Isolation so pages are attributed to the right process. [commit 319247@main](https://commits.webkit.org/319247@main)\n- **Security** Fixes page identifier confusion in `_WKUserStyleSheet` under Site Isolation, reducing cross-process mixups in injected styling paths. [commit 319246@main](https://commits.webkit.org/319246@main)\n- **Media** Moves autoplay gating and audio session activation decisions into the content process under Site Isolation, tightening process ownership around playback. [commit 319249@main](https://commits.webkit.org/319249@main)\n- **UI** Fullscreen now unwinds state correctly when entering fullscreen fails, avoiding stuck or half-entered fullscreen transitions. [commit 319243@main](https://commits.webkit.org/319243@main)\n- **DevTools** Fixes a Web Inspector crash path when selecting a CDATA section in the DOM tree. [commit 319252@main](https://commits.webkit.org/319252@main)\n- **UI** MiniBrowser gains download support for testing, making it more useful as a lightweight harness for browser behavior. [commit 319251@main](https://commits.webkit.org/319251@main)\n- **Build** `Style::ComputedStyleProperties` getters get out-of-line variants so some callers can drop heavy includes and compile cleaner. [commit 319253@main](https://commits.webkit.org/319253@main)\n\n## What landed by area\n\n### Site Isolation\n- **Security** Web extension page identifiers are now built for the correct process under Site Isolation, fixing process attribution bugs. [commit 319247@main](https://commits.webkit.org/319247@main)\n- **Security** `_WKUserStyleSheet` now uses the right page identifier model under Site Isolation, preventing identifier confusion in style injection code. [commit 319246@main](https://commits.webkit.org/319246@main)\n- **Media** Playback permission and audio session activation now originate in the content process, aligning media startup with Site Isolation boundaries. [commit 319249@main](https://commits.webkit.org/319249@main)\n\n### DOM, XML, and Fullscreen\n- **Security** `XMLDocumentParser::end()` now handles parser detachment during `readystatechange` without dereferencing a null `Document`. [commit 319245@main](https://commits.webkit.org/319245@main)\n- **UI** Fullscreen entry failure now properly unwinds fullscreen state instead of leaving the page in an inconsistent state. [commit 319243@main](https://commits.webkit.org/319243@main)\n\n### Developer Tools and Testing Apps\n- **DevTools** Web Inspector no longer throws `node.truncateEnd is not a function` when a CDATA node is selected in the DOM tree. [commit 319252@main](https://commits.webkit.org/319252@main)\n- **UI** MiniBrowser now supports downloads for testing, covering a missing browser-level behavior in the test app. [commit 319251@main](https://commits.webkit.org/319251@main)\n\n### CSS and Rendering Infrastructure\n- **Build** `Style::ComputedStyleProperties` getters now have out-of-line variants so callers can avoid unnecessary includes and reduce header coupling. [commit 319253@main](https://commits.webkit.org/319253@main)\n\n### GLib and WPT\n- **Rendering** Fixes the imported WPT `css-fonts/font-feature-resolution-002.html` failure on GLib, improving cross-platform test parity. [commit 319250@main](https://commits.webkit.org/319250@main)\n- **Refactor** GLib layout test gardening cleans up expected results and test state after recent churn. [commit 319248@main](https://commits.webkit.org/319248@main)\n\n### Build and Compiler Cleanups\n- **Build** Fixes a `-Wc++11-narrowing` regression in `NativeWebGestureEvent::Init`, restoring clean builds after [bug 321856](https://bugs.webkit.org/show_bug.cgi?id=321856). [commit 319244@main](https://commits.webkit.org/319244@main)",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [],
  "since": "2026-08-16",
  "totals": {
    "commits": 11,
    "features": 11,
    "rolls": 0
  },
  "until": "2026-08-16"
}