{
  "commits": {
    "319254@main": {
      "author": "Jean-Yves Avenard",
      "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64",
      "cl": "319254@main",
      "clUrl": "https://commits.webkit.org/319254@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321819\nrdar://184960798\n\nReviewed by Eric Carlson.\n\nThe test plays four videos, calling play() on the next one from the previous\nelement's 'playing' handler. videos[2] and videos[3] can't play concurrently, so\nvideos[2] should end up paused and videos[3] playing. Sometimes both were paused.\n\nSince 319099@main the 'playing' event no longer waits for the session admission, so\nvideos[3].play() runs while videos[2]'s admission is still outstanding: videos[2] had\nto activate the audio session (the first two videos have no audio) and completes from\nthe task whenSettled() queued, while videos[3]'s playability is known and resolves\nimmediately. videos[3] pauses videos[2] there, and sessionWillEndPlayback() moves videos[2]\nahead of videos[3], which isn't Playing yet; currentSession() is the front of the\nlist, so videos[2] becomes current and pauses videos[3] when its own admission task\nruns.\n\nsessionWillEndPlayback() now counts a session with preparingToPlay() as playing, as\nenforceConcurrentPlaybackRestriction() already does, so the pausing session moves to\nthe end of the list and the session that evicted it stays current.\n\nThis is a workaround. Treating the front of the session list as \"the session that\nclaimed playback last\" is fragile while two functions reorder that list and the\nclaiming session isn't Playing yet. Tracking the session whose admission started last\nis left for a follow-up.\n\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.cpp:\n(WebCore::MediaSessionManagerInterface::sessionWillEndPlayback): Treat a session whose\nadmission is in flight as playing.\n\nCanonical link: https://commits.webkit.org/319254@main",
      "email": "jya@apple.com",
      "hash": "d642eeea6966a9805e01d25cfe44c2478a412dc5",
      "subject": "REGRESSION(19099@main): [macOS iOS] media/video-multiple-concurrent-playback.html is flaky failure"
    },
    "319256@main": {
      "author": "Sean Patterson",
      "avatar": "https://www.gravatar.com/avatar/b19318d92b64ac7809b78670c03b0f1e?d=identicon\u0026s=64",
      "cl": "319256@main",
      "clUrl": "https://commits.webkit.org/319256@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=311552\nrdar://174635806\n\nReviewed by Nikolas Zimmermann.\n\nSVG 2 no longer supports the use-script, no-change and reset-size values of\ndominant-baseline [1], and they are absent from the css-inline-3 grammar that\nnow defines the property [2].\n\nAll three were already close to no-ops in WebKit: use-script mapped to\nalphabetic behind a FIXME, while no-change and reset-size deferred to the\nparent element's dominant baseline, which resolves to alphabetic for\nhorizontal text. Removing them lets the values fall back to auto, which maps\nto alphabetic in horizontal writing modes and central in vertical ones, so\nthere is no rendering change for the cases these values previously covered.\n\nsvg/custom/dominant-baseline-modes.svg and svg/custom/alignment-baseline-modes.svg\ncontinue to specify the three values, which now fall back to auto; their\nresults are unchanged for the reason above.\n\nNote that WebKit still spells the two edge baselines with their SVG 1.1 names,\ntext-before-edge and text-after-edge. css-inline-3 renames those to text-top\nand text-bottom and keeps the SVG spellings only as legacy aliases [3], and\nWebKit does not yet accept the css-inline-3 names. That gap is orthogonal to\nthis patch, which only removes values; it is tracked separately in\nwebkit.org/b/321612.\n\n[1] https://w3c.github.io/svgwg/svg2-draft/text.html#DominantBaselineProperty\n[2] https://drafts.csswg.org/css-inline-3/#propdef-dominant-baseline\n[3] https://drafts.csswg.org/css-inline/#alignment-baseline-svg-legacy\n\nTest: imported/w3c/web-platform-tests/svg/text/dominant-baseline.historical.html\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/dominant-baseline.historical-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/dominant-baseline.historical.html: Added.\n* LayoutTests/svg/css/dominant-baseline-legacy-values-expected.txt: Removed.\n* LayoutTests/svg/css/dominant-baseline-legacy-values.html: Removed.\n* Source/WebCore/css/CSSProperties.json: Also point the specification URL at SVG 2.\n* Source/WebCore/css/SVGCSSValueKeywords.in:\n* Source/WebCore/rendering/style/RenderStyleConstants.cpp:\n(WebCore::operator\u003c\u003c):\n* Source/WebCore/rendering/style/RenderStyleConstants.h:\n* Source/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.cpp:\n(WebCore::SVGTextLayoutEngineBaseline::dominantBaselineToAlignmentBaseline const):\n* Source/WebCore/style/values/primitives/StyleKeyword+Mappings.h:\n\nCanonical link: https://commits.webkit.org/319256@main",
      "email": "sean_patterson@apple.com",
      "hash": "6744dbe545664327777a5b27b2a160cabaa29238",
      "subject": "[SVG2] Remove use-script, no-change and reset-size from dominant-baseline"
    },
    "319257@main": {
      "author": "lilly",
      "avatar": "https://www.gravatar.com/avatar/d0533d52eeb271270df480f37629a407?d=identicon\u0026s=64",
      "cl": "319257@main",
      "clUrl": "https://commits.webkit.org/319257@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321194\nrdar://184258503\n\nReviewed by Simon Fraser.\n\nThis adds a shape mask for the cases the layer can clip itself, and\nrefuses the directly-composited fast paths for the cases it can't\n\n* LayoutTests/TestExpectations:\n* Source/WebCore/rendering/LayerAncestorClippingStack.h:\n* Source/WebCore/rendering/RenderLayerBacking.cpp:\n(WebCore::RenderLayerBacking::~RenderLayerBacking):\n(WebCore::RenderLayerBacking::updateBackdropFiltersGeometry):\n(WebCore::RenderLayerBacking::updateAppleVisualEffect):\n(WebCore::RenderLayerBacking::updateConfigurationAfterStyleChange):\n(WebCore::RenderLayerBacking::updateConfiguration):\n(WebCore::contentsClippingRectForCornerShape):\n(WebCore::RenderLayerBacking::updateGeometry):\n(WebCore::RenderLayerBacking::updateMaskingLayerGeometry):\n(WebCore::RenderLayerBacking::updateContentsRects):\n(WebCore::boxNeedingShapeMaskForClip):\n(WebCore::RenderLayerBacking::ensureClippingStackLayers):\n(WebCore::RenderLayerBacking::removeClippingStackLayers):\n(WebCore::RenderLayerBacking::updateClippingStackLayerGeometry):\n(WebCore::RenderLayerBacking::needsCornerShapeMask const):\n(WebCore::RenderLayerBacking::updateMaskingLayer):\n(WebCore::supportsDirectlyCompositedBoxDecorations):\n(WebCore::RenderLayerBacking::isDirectlyCompositedImage const):\n(WebCore::setContentsClipShapePath):\n* Source/WebCore/rendering/RenderLayerBacking.h:\n* Source/WebCore/rendering/style/BorderData.cpp:\n(WebCore::BorderData::hasNonRoundCornerShape const):\n(WebCore::BorderData::hasCornerShapeOutsideBorderRadius const):\n(WebCore::BorderData::hasCornerShapeOutsideRoundedRect const):\n* Source/WebCore/rendering/style/BorderData.h:\n* LayoutTests/compositing/video/corner-shape-video-expected.html: Added.\n* LayoutTests/compositing/video/corner-shape-video-overflow-expected.html: Added.\n* LayoutTests/compositing/video/corner-shape-video-overflow.html: Added.\n* LayoutTests/compositing/video/corner-shape-video.html: Added.\n* Source/WebCore/rendering/LayerAncestorClippingStack.cpp:\n(WebCore::LayerAncestorClippingStack::LayerAncestorClippingStack):\n(WebCore::LayerAncestorClippingStack::updateWithClipData):\n(WebCore::operator\u003c\u003c):\n* Source/WebCore/platform/graphics/GraphicsLayer.h:\n(WebCore::GraphicsLayer::contentsClipShapePath const):\n(WebCore::GraphicsLayer::setContentsClipShapePath):\n* Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp:\n(WebCore::contentsClipShapePathsAreEqual):\n(WebCore::GraphicsLayerCA::setContentsClipShapePath):\n(WebCore::GraphicsLayerCA::ensureStructuralLayer):\n(WebCore::GraphicsLayerCA::setShapeLayerPath):\n* Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h:\n* LayoutTests/compositing/corner-shape-ancestor-clip-expected.html: Added.\n* LayoutTests/compositing/corner-shape-ancestor-clip.html: Added.\n* LayoutTests/compositing/corner-shape-mask-layer-offset-expected.html: Added.\n* LayoutTests/compositing/corner-shape-mask-layer-offset.html: Added.\n* LayoutTests/compositing/corner-shape-ancestor-clip-shape-mask-expected.txt: Added.\n* LayoutTests/compositing/corner-shape-ancestor-clip-shape-mask.html: Added.\n* LayoutTests/fast/scrolling/corner-shape-nested-clips-overflow-scroll-expected.html: Added.\n* LayoutTests/fast/scrolling/corner-shape-nested-clips-overflow-scroll.html: Added.\n* LayoutTests/fast/scrolling/corner-shape-overflow-scroll-uneven-radii-expected.html: Added.\n* LayoutTests/fast/scrolling/corner-shape-overflow-scroll-uneven-radii.html: Added.\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.cpp:\n(WebCore::SkiaCompositingLayer::paintContents):\n(WebCore::SkiaCompositingLayer::paintSelfAndChildren):\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.h:\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.cpp:\n(WebCore::CoordinatedPlatformLayer::setContentsClipShapePath):\n(WebCore::CoordinatedPlatformLayer::flushCompositingStateOnTarget):\n(WebCore::CoordinatedPlatformLayer::flushCompositingStateOnSkiaTarget):\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.h:\n* Source/WebCore/platform/graphics/texmap/coordinated/GraphicsLayerCoordinated.cpp:\n(WebCore::GraphicsLayerCoordinated::setContentsClipShapePath):\n(WebCore::GraphicsLayerCoordinated::setShapeLayerPath):\n(WebCore::GraphicsLayerCoordinated::commitLayerChanges):\n* Source/WebCore/platform/graphics/texmap/coordinated/GraphicsLayerCoordinated.h:\n\nCanonical link: https://commits.webkit.org/319257@main",
      "email": "173393835+cupidsity@users.noreply.github.com",
      "hash": "e303a714c767cbc7d553c6297b1041713745ff82",
      "subject": "corner-shape: non-round corner shapes are ignored for composited content (\u003cvideo\u003e, images, composited descendants)"
    },
    "319258@main": {
      "author": "Karl Dubost",
      "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64",
      "cl": "319258@main",
      "clUrl": "https://commits.webkit.org/319258@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321588\nrdar://184801325\n\nReviewed by Simon Fraser.\n\nA visibility:visible child of a visibility:hidden element did not render\nwhen the child had overflow:hidden and the hidden parent was positioned.\nFirefox and Chrome render it.\n\noverflow:hidden gives the child a layer, but a statically positioned one\ndoes not paint itself, so the hidden parent is what paints it. Before\npainting, the parent checks whether anything under it is visible, and\nthat check skipped any child with a layer, assuming such a child paints\nitself.\n\nFix by skipping only children that really do paint themselves, which is\nthe test RenderBlock::paintChild already uses.\n\nThe check now reads styles it never read before, so it has to hear when\nthey change. A renderer owning a layer dirtied only that layer, leaving\na hidden ancestor that paints it with a stale answer. Add\ndirtyVisibleContentStatusIncludingAncestors(), which dirties hidden\nancestors up to the first self-painting layer, where the check stops\nlooking.\n\nTests: imported/w3c/web-platform-tests/css/CSS2/visufx/visibility-descendants-002.html\n       imported/w3c/web-platform-tests/css/CSS2/visufx/visibility-descendants-003.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/visufx/visibility-descendants-002-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/visufx/visibility-descendants-002-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/visufx/visibility-descendants-002.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/visufx/visibility-descendants-003-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/visufx/visibility-descendants-003-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/visufx/visibility-descendants-003.html: Added.\n* Source/WebCore/rendering/RenderElement.cpp:\n(WebCore::RenderElement::styleWillChange):\n* Source/WebCore/rendering/RenderLayer.cpp:\n(WebCore::RenderLayer::computeHasVisibleContent const):\n(WebCore::RenderLayer::dirtyVisibleContentStatusIncludingAncestors):\n(WebCore::RenderLayer::updateSelfPaintingLayer):\n* Source/WebCore/rendering/RenderLayer.h:\n\nCanonical link: https://commits.webkit.org/319258@main",
      "email": "karlcow@apple.com",
      "hash": "a1d6057613b92c9954bc9948da88485062d9c2b5",
      "subject": "visibility:visible child stays hidden when it has non-visible overflow"
    },
    "319259@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319259@main",
      "clUrl": "https://commits.webkit.org/319259@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321861\nrdar://185019165\n\nReviewed by Chris Dumez.\n\nTwo IDL declarations for DataTransferItemList do not match the HTML spec [1]:\n\n    readonly attribute unsigned long length;\n    getter DataTransferItem (unsigned long index);\n\n* `length` was declared `long`, even though DataTransferItemList::length()\n  returns unsigned. This is not observable from JS for realistic list sizes,\n  but the declaration was simply wrong.\n\n* The indexed property getter was declared with an identifier, `item`, which\n  the spec does not have. That exposed a WebKit-only\n  DataTransferItemList.prototype.item() operation; neither Chrome nor Firefox\n  has it. Removing the identifier also removes the nullable annotation, as the\n  pre-existing FIXME noted: nullability is implicit for an anonymous getter,\n  and keeping the identifier while dropping `?` would not compile, since\n  JSConverter\u003cIDLInterface\u003cT\u003e\u003e has no RefPtr overload.\n\nThe generated indexed getter is unaffected other than losing the prototype\nfunction: it still null-checks the result of DataTransferItemList::item()\nand unwraps it with IDLInterface\u003cDataTransferItem\u003e::extractValueFromNullable(),\nso the implementation continues to return RefPtr\u003cDataTransferItem\u003e and\nout-of-range indices continue to report the property as absent.\n\nThe only in-tree caller of the removed operation was the API test page\nDataTransferItem-getAsEntry.html, used by DragAndDropTests\nExternalSourceDataTransferItemGetFolderAsEntry and\nExternalSourceDataTransferItemGetPlainTextFileAsEntry on iOS. It now uses\nthe indexed getter, `items[index]`. Previously the TypeError from calling\nitems.item() rejected handleDrop()'s await, so the page never posted its\n\"dropped\" message and both tests timed out.\n\n[1] https://html.spec.whatwg.org/multipage/dnd.html#the-datatransferitemlist-interface\n\nTest: imported/w3c/web-platform-tests/html/editing/dnd/datastore/datatransferitemlist-indexed-getter.html\n\n* LayoutTests/imported/w3c/web-platform-tests/html/editing/dnd/datastore/datatransferitemlist-indexed-getter-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/editing/dnd/datastore/datatransferitemlist-indexed-getter.html: Added.\n* Source/WebCore/dom/DataTransferItemList.idl:\n* Tools/TestWebKitAPI/Resources/cocoa/DataTransferItem-getAsEntry.html:\n\nCanonical link: https://commits.webkit.org/319259@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "628689a39d8ee9639725c857f3526b4267e4336b",
      "subject": "DataTransferItemList's indexed property getter should be anonymous and length should be unsigned long"
    },
    "319261@main": {
      "author": "Marcos Caceres",
      "avatar": "https://www.gravatar.com/avatar/d31c9c6a3b0af558a2945682020e5b90?d=identicon\u0026s=64",
      "cl": "319261@main",
      "clUrl": "https://commits.webkit.org/319261@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321500\n\nReviewed by Ryosuke Niwa.\n\nisolatedCopy() is annotated NODELETE and alpha.webkit.NoDeleteChecker objects to it. The\nconstructor it calls assigns to members that have already been default-constructed, and each\nof those assignments destroys the previous empty value, so the checker sees a possible\ndestruction inside the body. Nothing meaningful is destroyed, but a constructor cannot itself\nbe marked NODELETE, so the annotation stays and the checker is suppressed on the definition\ninstead. Callers keep the NODELETE guarantee and do not need to take a ref.\n\nCanonical link: https://commits.webkit.org/319261@main",
      "email": "marcosc@apple.com",
      "hash": "4087bd7152027907454a2b7586d21d8069c6f1d4",
      "subject": "Suppress the NoDeleteChecker warning on IDBRequestData::isolatedCopy()"
    },
    "319262@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319262@main",
      "clUrl": "https://commits.webkit.org/319262@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319805\nrdar://182688059\n\nReviewed by Mike Wyrzykowski.\n\nIf IOSurfaceAcceleratorTransformSurface() fails synchronously, the\nheap-allocated completion WTF::Function and the released\ndestinationSurface raw pointer both leaked, since the completion\ncallback that would normally free them never fires. This was silent\nin release builds because ASSERT_UNUSED compiles out the check.\n\nSynchronous failure is observable rather than theoretical. The\naccelerator validates the request and can reject it before queuing\nanything, for surfaces below the hardware's minimum dimensions, for\nunsupported format or option combinations, and when it cannot acquire\nthe resources needed to wire and map the surfaces. Log the error\ninstead of asserting, since none of those are programming errors on\nour side.\n\nFix the leak by having the synchronous failure path invoke the same\ncompletionCallback that the accelerator would have invoked\nasynchronously, instead of duplicating its cleanup logic. Since that\nshared callback previously ignored its IOReturn result and always\nhanded the (possibly untransformed) destination surface to the\ncaller, also fix it to pass nullptr on failure, matching the failure\ncontract already used earlier in the function for accelerator\ncreation and destination surface creation failures. This corrects\nboth the synchronous failure this bug is about and any true\nasynchronous transform failure reported later by the OS, which can\nleave the destination surface only partially written.\n\nAlso stop ignoring a null return from\nIOSurfaceAcceleratorGetRunLoopSource(). Adding a null source to the\nmain run loop is invalid, and because the accelerator was cached in a\nstatic before it was known to be usable, every later conversion would\nhave issued a transform whose completion could never be delivered,\nleaking the WTF::Function and an entire destination surface each time\nfor the life of the process. Only cache the accelerator once it has a\nrun loop source.\n\n* Source/WebCore/platform/graphics/cocoa/IOSurface.mm:\n(WebCore::IOSurface::convertToFormat):\n\nCanonical link: https://commits.webkit.org/319262@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "8e980f978de665f7960aab424b917f4ad89c316d",
      "subject": "IOSurface::convertToFormat leaks the completion callback and destination surface when the accelerator fails"
    },
    "319263@main": {
      "author": "Dominic Mazzoni",
      "avatar": "https://www.gravatar.com/avatar/f76643c44a7ee3be45148e66d97ed8e4?d=identicon\u0026s=64",
      "cl": "319263@main",
      "clUrl": "https://commits.webkit.org/319263@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321801\nrdar://184935497\n\nReviewed by Tyler Wilcock.\n\nBuilds on this commit, which turns out to be incomplete:\nhttps://bugs.webkit.org/show_bug.cgi?id=321454 (AX: live and isolated tree don't agree on\nseveral attributes when a textarea ends in a line break)\n\nThe underlying issue is the same - when the contents of a native text control end in\na newline, the field's internal representation contains an extra newline, which was\nbeing exposed in AXNumberOfCharacters but not in AXValue, causing problems in VoiceOver\ndue to the inconsistency.\n\nThe previous fix only tested static content and didn't detect all of\nthe possible ways that the trailing newline could manifest.\n\nWhen typing, the internal representation has a lone \"\\n\" text node,\nso now we handle that.\n\nWhen using Editor::replaceSelectionWithText() (which can be triggered\nby paste, or by AXReplaceRangeWithText), the whole value is in a\nsingle text node whose text ends in the newline, which couldn't be\ndetected by isCollapsedTrailingLineBreak. Replaced with\noffsetOfCollapsedTrailingNewline(), which asks the narrower question\nthe callers actually need: within this object's text runs, is there a\ntrailing newline that the control's value doesn't include?\n\nAlso updates the line APIs.\n\nTests: accessibility/isolated-tree/mac/textarea-line-range-after-dynamic-edit.html: Added.\n       accessibility/isolated-tree/mac/textarea-line-range-with-trailing-newline.html:\n       accessibility/isolated-tree/text-marker/textarea-character-count-with-trailing-newline.html: Copied from LayoutTests/accessibility/text-marker/textarea-character-count-with-trailing-newline.html.\n       accessibility/mac/textarea-line-range-after-dynamic-edit.html: Added.\n       accessibility/mac/textarea-line-range-with-trailing-newline.html:\n       accessibility/text-marker/textarea-character-count-with-trailing-newline.html:\n\n* LayoutTests/accessibility/isolated-tree/mac/textarea-line-range-after-dynamic-edit-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/textarea-line-range-after-dynamic-edit.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/textarea-line-range-with-trailing-newline-expected.txt:\n* LayoutTests/accessibility/isolated-tree/mac/textarea-line-range-with-trailing-newline.html:\n* LayoutTests/accessibility/isolated-tree/text-marker/textarea-character-count-with-trailing-newline-expected.txt: Copied from LayoutTests/accessibility/text-marker/textarea-character-count-with-trailing-newline-expected.txt.\n* LayoutTests/accessibility/isolated-tree/text-marker/textarea-character-count-with-trailing-newline.html: Copied from LayoutTests/accessibility/text-marker/textarea-character-count-with-trailing-newline.html.\n* LayoutTests/accessibility/mac/textarea-line-range-after-dynamic-edit-expected.txt: Added.\n* LayoutTests/accessibility/mac/textarea-line-range-after-dynamic-edit.html: Added.\n* LayoutTests/accessibility/mac/textarea-line-range-with-trailing-newline-expected.txt:\n* LayoutTests/accessibility/mac/textarea-line-range-with-trailing-newline.html:\n* LayoutTests/accessibility/text-marker/textarea-character-count-with-trailing-newline-expected.txt:\n* LayoutTests/accessibility/text-marker/textarea-character-count-with-trailing-newline.html:\n* Source/WebCore/accessibility/AXCoreObject.h:\n* Source/WebCore/accessibility/AXLogger.cpp:\n(WebCore::operator\u003c\u003c):\n* Source/WebCore/accessibility/AXTextMarker.cpp:\n(WebCore::hasEmptyFinalLine):\n(WebCore::lineRangeWithoutCollapsedTrailingNewline):\n(WebCore::isOnTrailingPlaceholderBlankLine): Deleted.\n(WebCore::AXTextMarker::characterRangeForLine const):\n(WebCore::AXTextMarker::markerRangeForLineIndex const):\n(WebCore::AXTextMarker::lineNumberForIndex const):\n(WebCore::AXTextMarker::lineRange const):\n(WebCore::AXTextMarker::atLineBoundaryForDirection const):\n(WebCore::AXTextMarker::findLine const):\n(WebCore::Accessibility::enclosingNativeTextControl):\n(WebCore::Accessibility::offsetOfCollapsedTrailingNewline):\n* Source/WebCore/accessibility/AXTextMarker.h:\n* Source/WebCore/accessibility/AccessibilityObject.cpp:\n(WebCore::AccessibilityObject::isInsideNativeTextControl const):\n(WebCore::AccessibilityObject::isCollapsedTrailingLineBreak const): Deleted.\n* Source/WebCore/accessibility/AccessibilityObject.h:\n* Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.h:\n* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp:\n(WebCore::createIsolatedObjectData):\n* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.h:\n* Source/WebCore/accessibility/isolatedtree/mac/AXIsolatedObjectMac.mm:\n(WebCore::AXIsolatedObject::textMarkerRange const):\n(WebCore::AXIsolatedObject::textLength const):\n\nCanonical link: https://commits.webkit.org/319263@main",
      "email": "dm_mazzoni@apple.com",
      "hash": "4b95b757c6ded0de221c5606c06d865843529c75",
      "subject": "AX: isolated tree overcounts characters in a textarea after a dynamic edit that leaves a trailing line break"
    },
    "319264@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319264@main",
      "clUrl": "https://commits.webkit.org/319264@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320438\nrdar://183402463\n\nReviewed by Nikolas Zimmermann.\n\nThis patch aligns WebKit with Gecko / Firefox and Blink / Chromium.\n\nSVGImageElement::svgAttributeChanged() handles href in its own branch, and that branch does\nnot take an InstanceInvalidationGuard, so the \u003cuse\u003e shadow tree instances are never rebuilt\nand keep the href they were cloned with. Nothing else covers for it: an \u003cimage\u003e inside \u003cdefs\u003e\nhas no renderer of its own, so the updateSVGRendererForElementChange() call in that branch is\na no-op, and the instances are the only rendered copies. An \u003cimage\u003e in \u003cdefs\u003e whose href is\nassigned from script therefore stays blank in every \u003cuse\u003e that references it, whether directly\nor through a \u003cpattern\u003e.\n\n203463@main (Remove the SVG elements' attributes macros) replaced the single function-scope\nguard, which covered every branch including this one, with per-branch guards, and did not give\none to the href branch. Take the guard here: SVGFEImageElement and SVGMPathElement guard their\nhref branches, SVGGradientElement and SVGPatternElement cover href in the same condition as\ntheir animated properties, and SVGUseElement guards the whole of svgAttributeChanged().\n\nThe test flushes layout before assigning the href, and that ordering is load-bearing.\nSVGUseElement builds its shadow tree lazily during a style update, so an href assigned before\nthe tree exists is already in place when the instance is cloned, and the test would pass with\nor without this change. Forcing the tree to be built first guarantees the instance has been\ncloned from the empty href before it is changed.\n\nThe instance's image is loaded through the cloned element's own CachedImage request, which is\nonly started once the shadow tree has been regenerated, so it is still outstanding when the\nreferenced element's load event fires. The test therefore waits for a rendering update after\nthat event rather than sampling immediately, which was flaky on the stress and site-isolation\nqueues.\n\nTests: imported/w3c/web-platform-tests/svg/struct/reftests/use-image-href-mutating.svg\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/struct/reftests/reference/use-image-href-mutating-ref.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/struct/reftests/use-image-href-mutating-expected.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/struct/reftests/use-image-href-mutating.svg: Added.\n* Source/WebCore/svg/SVGImageElement.cpp:\n(WebCore::SVGImageElement::svgAttributeChanged):\n\nCanonical link: https://commits.webkit.org/319264@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "68a544edb81fa4c689e1e988175a9db2f2c16811",
      "subject": "Changing href on an \u003cimage\u003e referenced by \u003cuse\u003e does not update the use instances"
    },
    "319265@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "319265@main",
      "clUrl": "https://commits.webkit.org/319265@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321894\n\nReviewed by Richard Robinson.\n\nUpdate the WTF Core module's `requires` declaration from `cplusplus` to\n`cplusplus23` so the module is only built in a C++23 context, matching the\nlanguage standard WTF is now compiled with. Also bump the module cache\ninvalidation touch count (9 -\u003e 10) to force a rebuild of the module cache.\n\n* Source/WTF/wtf/module.modulemap:\n\nCanonical link: https://commits.webkit.org/319265@main",
      "email": "cdumez@apple.com",
      "hash": "f0148cf5abdb4278841e7b2dd43f38a87331c90d",
      "subject": "[WTF] Require C++23 for the WTF Core clang module"
    },
    "319266@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319266@main",
      "clUrl": "https://commits.webkit.org/319266@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321873\nrdar://185053056\n\nReviewed by Chris Dumez.\n\nBoth constructors took ownership of a UBreakIterator from the one-entry cache\n(or freshly ubrk_open()ed one) and then overwrote that pointer with the result\nof setTextForIterator(), dropping the only reference to it when setting the\ntext failed:\n\n    if ((m_iterator = getNonSharedCharacterBreakIterator()))\n        m_iterator = setTextForIterator(*m_iterator, string);\n\nNothing else owns the iterator at that point, since getNonShared*() removes it\nfrom the cache with an exchange(), so the iterator was leaked. This is\nreachable: setTextForIterator() fails for a null StringView, because\nopenLatin1UTextProvider() rejects a null data pointer with\nU_ILLEGAL_ARGUMENT_ERROR. StringView::GraphemeClusters guards against that case\nalready, but other callers do not.\n\nRather than adding a manual ubrk_close() on the failure path, make the\nownership explicit with the smart pointer WebKit already uses for ICU handles,\nstd::unique_ptr\u003cT, ICUDeleter\u003cclose\u003e\u003e, so that the leak is not expressible:\ngetNonShared*BreakIterator() now returns ownership, cacheNonShared*BreakIterator()\nnow takes it, and no function passes a raw owning UBreakIterator* around. This\nalso removes the manual ubrk_close() of the evicted cache entry and lets both\nmove constructors be defaulted. CheckedPtr and Ref are not applicable here:\nUBreakIterator is an opaque ICU C type that can be neither CanMakeCheckedPtr\nnor refcounted.\n\nAs a drive-by, setTextForIterator() skipped utext_close() when ubrk_setUText()\nfailed; use makeScopeExit() so it runs on every path out of the 8-bit branch.\nNo memory was leaked by this, because the UText is set up over a stack buffer,\nbut the provider's close hook was not being run.\n\n* Source/WTF/wtf/text/TextBreakIterator.cpp:\n(WTF::setTextForIterator):\n(WTF::getNonSharedCharacterBreakIterator):\n(WTF::cacheNonSharedCharacterBreakIterator):\n(WTF::NonSharedCharacterBreakIterator::NonSharedCharacterBreakIterator):\n(WTF::NonSharedCharacterBreakIterator::~NonSharedCharacterBreakIterator):\n(WTF::getNonSharedSentenceBreakIterator):\n(WTF::cacheNonSharedSentenceBreakIterator):\n(WTF::NonSharedSentenceBreakIterator::NonSharedSentenceBreakIterator):\n(WTF::NonSharedSentenceBreakIterator::~NonSharedSentenceBreakIterator):\n* Source/WTF/wtf/text/TextBreakIterator.h:\n(WTF::NonSharedCharacterBreakIterator::operator UBreakIterator* const):\n(WTF::NonSharedSentenceBreakIterator::operator UBreakIterator* const):\n\nCanonical link: https://commits.webkit.org/319266@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "870de4ab779eacbf74616853e81b66e9275b8fc1",
      "subject": "NonSharedCharacterBreakIterator and NonSharedSentenceBreakIterator leak their UBreakIterator when setting the text fails"
    },
    "319267@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319267@main",
      "clUrl": "https://commits.webkit.org/319267@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321841\nrdar://184988378\n\nReviewed by Chris Dumez.\n\nPer the specification [1], getData() step 6 says:\n\n    \"If format equals \"url\", change it to \"text/uri-list\" and set\n     convert-to-URL to true.\"\n\nand step 9 then acts on that flag:\n\n    \"If convert-to-URL is true, then parse result as appropriate for\n     text/uri-list data, and then set result to the first URL from the list,\n     if any, or the empty string otherwise.\"\n\nComment lines - those beginning with \"#\" per RFC 2483 [2] - are not URLs and are\nskipped when finding that first URL.\n\nWebKit implemented only half of this. normalizeType() performs the step 6 rename\nof \"url\" to \"text/uri-list\", but nothing ever performed step 9, so getData(\"url\")\nhanded back the raw list: every URL joined by its original line endings, comment\nlines included. Even a single URL followed by a trailing newline came back with\nthe newline attached.\n\nThe reason this went unnoticed for so long is that the platform read path\ncollapses to one URL by accident of implementation - urlStringsFromPasteboard()\ngoes through [NSURL URLFromPasteboard:], which yields a single absolute URL - so\ngetData(\"url\") looked correct for anything copied from another application. The\nbug was only observable for a text/uri-list a page wrote itself with setData(),\nwhich is served by the same-origin custom data path.\n\nCompute the convert-to-URL flag from the requested format before normalizeType()\ncollapses it, so text/uri-list and text/uri-list;charset=utf-8 keep returning\ntheir data verbatim, then reduce the result to its first URL.\nDataTransferItem.getAsString() reads through getDataForItem() and is left alone,\nsince the specification puts this step in getData() only.\n\nTesting across engines: Chrome matches [1] in all cases. Firefox matches except\nwhen a blank line precedes the first URL, where it returns the empty string - it\ndiscards comment lines but not blank ones. RFC 2483 [2] only specifies the\ntreatment of comment lines, so that case is under-specified; this change follows\nChrome and the \"first URL from the list\" wording of step 9, and the new test\nisolates it in its own subtest.\n\nediting/pasteboard/dataTransfer-setData-getData.html has asserted the correct\nbehavior since it was written, with five FAIL lines checked into its expected\nresults - one per convert-to-URL case. Those now pass; rebaseline.\n\n[1] https://html.spec.whatwg.org/multipage/dnd.html#dom-datatransfer-getdata\n[2] https://datatracker.ietf.org/doc/html/rfc2483#section-5\n\nTest: imported/w3c/web-platform-tests/html/editing/dnd/datastore/datatransfer-getdata-url.html\n\n* LayoutTests/editing/pasteboard/dataTransfer-setData-getData-expected.txt: Rebaselined\n* LayoutTests/imported/w3c/web-platform-tests/html/editing/dnd/datastore/datatransfer-getdata-url-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/editing/dnd/datastore/datatransfer-getdata-url.html: Added.\n* Source/WebCore/dom/DataTransfer.cpp:\n(WebCore::firstURLFromURIList):\n(WebCore::DataTransfer::getData const):\n\nCanonical link: https://commits.webkit.org/319267@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "880962714e11143450d39dae76d4b1987171369c",
      "subject": "DataTransfer.getData(\"url\") returns the whole text/uri-list instead of its first URL"
    },
    "319268@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319268@main",
      "clUrl": "https://commits.webkit.org/319268@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321839\nrdar://184983791\n\nReviewed by Chris Dumez.\n\nbase64EncodeInternal() and base64DecodeInternal() select between the standard\nand URL-safe lookup tables with a conditional expression bound to `auto`, which\ncopies the whole std::array into a local on every call: 64 bytes for the encode\nmap and 128 bytes for the decode map.\n\nA conditional expression over two lvalues of the same type is itself an lvalue,\nso binding with `auto\u0026` instead is sufficient to reference the constexpr table\ndirectly. The decode path in particular runs for every data: URL, WebCrypto\nbase64url operation, and WebSocket handshake key check.\n\nNo behavior change, so no new tests.\n\n* Source/WTF/wtf/text/Base64.cpp:\n(WTF::base64EncodeInternal):\n(WTF::base64DecodeInternal):\n\nCanonical link: https://commits.webkit.org/319268@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "7375405d8e932dbeff9ca85317097e79a45d0f83",
      "subject": "[WTF] Base64 encode/decode maps are copied by value on every call"
    },
    "319269@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "319269@main",
      "clUrl": "https://commits.webkit.org/319269@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321779\n\nReviewed by Tim Nguyen.\n\nResync compression tests from upstream 83b63594532f89d8949a2.\n\n* LayoutTests/imported/w3c/web-platform-tests/compression/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/compression/compression-bad-chunks.any.js:\n* LayoutTests/imported/w3c/web-platform-tests/compression/compression-constructor-error.any.js:\n* LayoutTests/imported/w3c/web-platform-tests/compression/compression-including-empty-chunk.any.js:\n* LayoutTests/imported/w3c/web-platform-tests/compression/compression-large-flush-output.any.js:\n* LayoutTests/imported/w3c/web-platform-tests/compression/compression-multiple-chunks.any.js:\n* LayoutTests/imported/w3c/web-platform-tests/compression/compression-output-length.any.js:\n* LayoutTests/imported/w3c/web-platform-tests/compression/compression-stream.any.js:\n* LayoutTests/imported/w3c/web-platform-tests/compression/compression-with-detach.any-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/compression/compression-with-detach.window-expected.txt.\n* LayoutTests/imported/w3c/web-platform-tests/compression/compression-with-detach.any.html: Copied from LayoutTests/imported/w3c/web-platform-tests/compression/compression-with-detach.window.html.\n* LayoutTests/imported/w3c/web-platform-tests/compression/compression-with-detach.any.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/compression/compression-with-detach.window.js.\n(createLargeRandomInput):\n(decompress):\n(promise_test.async const):\n* LayoutTests/imported/w3c/web-platform-tests/compression/compression-with-detach.any.serviceworker-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/compression/compression-with-detach.window-expected.txt.\n* LayoutTests/imported/w3c/web-platform-tests/compression/compression-with-detach.any.serviceworker.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/compression/decompression-with-detach.window.html.\n* LayoutTests/imported/w3c/web-platform-tests/compression/compression-with-detach.any.sharedworker-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/compression/compression-with-detach.window-expected.txt.\n* LayoutTests/imported/w3c/web-platform-tests/compression/compression-with-detach.any.sharedworker.html: Copied from LayoutTests/imported/w3c/web-platform-tests/compression/compression-with-detach.window.html.\n* LayoutTests/imported/w3c/web-platform-tests/compression/compression-with-detach.any.worker-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/compression/compression-with-detach.window-expected.txt.\n* LayoutTests/imported/w3c/web-platform-tests/compression/compression-with-detach.any.worker.html: Copied from LayoutTests/imported/w3c/web-platform-tests/compression/compression-with-detach.window.html.\n* LayoutTests/imported/w3c/web-platform-tests/compression/decompression-bad-chunks.any.js:\n* LayoutTests/imported/w3c/web-platform-tests/compression/decompression-buffersource.any.js:\n* LayoutTests/imported/w3c/web-platform-tests/compression/decompression-constructor-error.any.js:\n* LayoutTests/imported/w3c/web-platform-tests/compression/decompression-correct-input.any.js:\n* LayoutTests/imported/w3c/web-platform-tests/compression/decompression-corrupt-input.any.js:\n* LayoutTests/imported/w3c/web-platform-tests/compression/decompression-empty-input.any.js:\n* LayoutTests/imported/w3c/web-platform-tests/compression/decompression-extra-input.any.js:\n* LayoutTests/imported/w3c/web-platform-tests/compression/decompression-split-chunk.any.js:\n* LayoutTests/imported/w3c/web-platform-tests/compression/decompression-uint8array-output.any.js:\n* LayoutTests/imported/w3c/web-platform-tests/compression/decompression-with-detach.any-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/compression/decompression-with-detach.window-expected.txt.\n* LayoutTests/imported/w3c/web-platform-tests/compression/decompression-with-detach.any.html: Copied from LayoutTests/imported/w3c/web-platform-tests/compression/compression-with-detach.window.html.\n* LayoutTests/imported/w3c/web-platform-tests/compression/decompression-with-detach.any.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/compression/decompression-with-detach.window.js.\n(async createLargeCompressedInput):\n(promise_test.async const):\n* LayoutTests/imported/w3c/web-platform-tests/compression/decompression-with-detach.any.serviceworker-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/compression/decompression-with-detach.window-expected.txt.\n* LayoutTests/imported/w3c/web-platform-tests/compression/decompression-with-detach.any.serviceworker.html: Copied from LayoutTests/imported/w3c/web-platform-tests/compression/compression-with-detach.window.html.\n* LayoutTests/imported/w3c/web-platform-tests/compression/decompression-with-detach.any.sharedworker-expected.txt: Copied from LayoutTests/imported/w3c/web-platform-tests/compression/decompression-with-detach.window-expected.txt.\n* LayoutTests/imported/w3c/web-platform-tests/compression/decompression-with-detach.any.sharedworker.html: Copied from LayoutTests/imported/w3c/web-platform-tests/compression/compression-with-detach.window.html.\n* LayoutTests/imported/w3c/web-platform-tests/compression/decompression-with-detach.any.worker-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/compression/decompression-with-detach.window-expected.txt.\n* LayoutTests/imported/w3c/web-platform-tests/compression/decompression-with-detach.any.worker.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/compression/compression-with-detach.window.html.\n* LayoutTests/imported/w3c/web-platform-tests/compression/idlharness.https.any.js:\n* LayoutTests/imported/w3c/web-platform-tests/compression/resources/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/compression/third_party/pako/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/compression/w3c-import.log:\n\nCanonical link: https://commits.webkit.org/319269@main",
      "email": "cdumez@apple.com",
      "hash": "7a6a4519aebcd2873987e9bdb805bd67b6cbf6d0",
      "subject": "[WPT] Resync compression tests from upstream"
    },
    "319270@main": {
      "author": "Zak Ridouh",
      "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64",
      "cl": "319270@main",
      "clUrl": "https://commits.webkit.org/319270@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321859\nrdar://185018520\n\nReviewed by David Kilzer.\n\ntestListForChangeLog() sorted full paths and then stripped the LayoutTests\nprefix when printing, so a Tools/TestWebKitAPI test printed after the layout\ntests. Strip the prefix before sorting instead. testListForChangeLog.pl covers\nthe printed order.\n\nAmending never regenerated the section. prepare-commit-msg passed\n--no-mention-tests, so no test list was computed and the old section was copied\nthrough, leaving new tests in the file list at the end. Compute the list and\nreconcile it against the existing section.\n\nreconcile_tests() rebuilds the section sorted when every entry is a test name.\nWhen an entry carries prose, it keeps the section as written and appends only\nthe new tests, so hand-written notes keep their text and position. A name with\na space in it still counts as a path when it ends in a file extension, which\ncovers Tools/TestWebKitAPI/Tests/WebKit Swift/WebPageTests.swift.\n\nAlso fixes the ImportError fallback in amended_message(), which raised\nNameError instead of falling back to the template.\n\nAdditionally, folks will need to run `git-webkit install-hooks` to pick up\nthis new behavior.\n\n* Tools/Scripts/hooks/prepare-commit-msg:\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/commit_parser.py:\n(CommitMessageParser._test_entries):\n(CommitMessageParser):\n(CommitMessageParser._is_test_name):\n(CommitMessageParser._tests_indent):\n(CommitMessageParser._mentions_test):\n(CommitMessageParser.reconcile_tests):\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/test/commit_parser_unittest.py:\n* Tools/Scripts/prepare-ChangeLog:\n(generateNewChangeLogs):\n(testListForChangeLog):\n* Tools/Scripts/webkitperl/prepare-ChangeLog_unittest/testListForChangeLog.pl: Added.\n\nCanonical link: https://commits.webkit.org/319270@main",
      "email": "zakr@apple.com",
      "hash": "7c93fbd030b4def3bcfb152b52ea9f8aaa12073b",
      "subject": "git-webkit does not sort or update the Tests: section of a commit message"
    },
    "319271@main": {
      "author": "Kimmo Kinnunen",
      "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64",
      "cl": "319271@main",
      "clUrl": "https://commits.webkit.org/319271@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321771\nrdar://184894741\n\nReviewed by Anne van Kesteren.\n\nInvoke the CompletionHandler in public build to avoid crashes.\n\n* Source/WebKit/UIProcess/WebAuthentication/Cocoa/WebAuthenticatorCoordinatorProxy.mm:\n\nCanonical link: https://commits.webkit.org/319271@main",
      "email": "kkinnunen@apple.com",
      "hash": "33a972b9c4bd9d786643fab984bc9fc2c8b2c6d2",
      "subject": "REGRESSION(318615@main) ipc/web-authenticator-signal-main-thread.html fails in public SDK build"
    },
    "319273@main": {
      "author": "Diego Pino Garcia",
      "avatar": "https://www.gravatar.com/avatar/e8cce88637f1a6e79155e8371e24b2e8?d=identicon\u0026s=64",
      "cl": "319273@main",
      "clUrl": "https://commits.webkit.org/319273@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=225423\n\nReviewed by Nikolas Zimmermann.\n\nThis test was failing in GLIB ports because at the time of running the\ntest the required \"Ahem\" font was not loaded.\n\nSimilarly to other canvas tests such as 'fill-gradient-text-with-web-font.html',\nnow this test forces the load of the \"Ahem\" font before running the proper test.\nIn case the Ahem font could not be loaded, the test will fall quickly\ninstead of timing out.\n\nAlso, refactor other canvas tests that need to load a font and were using\n'setTimeout' to wait for the font loading. Now theses test follow the\nsame approach, async call plus await for the font loading.\n\n* LayoutTests/fast/canvas/2d.text.draw.fill.maxWidth.gradient.html:\n* LayoutTests/fast/canvas/2d.text.draw.fill.maxWidth.negative.html:\n* LayoutTests/fast/canvas/2d.text.draw.fill.maxWidth.veryLarge.html:\n* LayoutTests/fast/canvas/2d.text.draw.fill.maxWidth.verySmall.html:\n* LayoutTests/fast/canvas/canvas-composite-text-alpha.html:\n* LayoutTests/fast/canvas/font-update.html:\n* LayoutTests/platform/glib/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319273@main",
      "email": "dpino@igalia.com",
      "hash": "629cd7f94cc300a02b64912b3750515b87b01710",
      "subject": "[GLIB] fast/canvas/canvas-composite-text-alpha.html is failing since r277024"
    },
    "319274@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "319274@main",
      "clUrl": "https://commits.webkit.org/319274@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321902\nrdar://185078337\n\nReviewed by Yijia Huang.\n\nWe found that our memcpy / memmove is not efficient enough for small\ncopying, and it is commonly happening in practice. This patch moves B3's\nMemoryCopy's preceding small copying code to WTF so that we can apply\nthe same optimizations to copyElements.\n\n* Source/JavaScriptCore/b3/B3Operations.cpp:\n(JSC::B3::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):\n* Source/WTF/wtf/UnalignedAccess.h:\n(WTF::copyOverlappingEnds):\n(WTF::copyOverlappingEndPairs):\n(WTF::copySmallMemory):\n* Source/WTF/wtf/text/StringCommon.h:\n(WTF::copyElements):\n\nCanonical link: https://commits.webkit.org/319274@main",
      "email": "ysuzuki@apple.com",
      "hash": "2d0855229c8f35a87c7bca8f36456ed76f86a5fb",
      "subject": "[WTF] Add small inlined memcpy for copyElements"
    },
    "319275@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "319275@main",
      "clUrl": "https://commits.webkit.org/319275@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321895\nrdar://185073630\n\nReviewed by Sosuke Suzuki.\n\nWhen maxLength is specified (setFromBase64 case), we stop processing\nbefore touching anything[1] (see step 3). This patch correctly\nimplements it.\n\n[1]: https://tc39.es/proposal-arraybuffer-base64/spec/#sec-frombase64\n\nTest: JSTests/stress/uint8array-setFromBase64-zero-length-reads-nothing.js\n\n* JSTests/stress/uint8array-setFromBase64-zero-length-reads-nothing.js: Added.\n(shouldBe):\n(lastChunkHandling.of.lastChunkHandlings.string.of.invalidStrings.shouldThrow):\n* JSTests/test262/expectations.yaml:\n* Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructor.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n* Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototype.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n* Source/WTF/wtf/text/Base64.cpp:\n(WTF::fromBase64Impl):\n(WTF::fromBase64):\n* Source/WTF/wtf/text/Base64.h:\n\nCanonical link: https://commits.webkit.org/319275@main",
      "email": "ysuzuki@apple.com",
      "hash": "b1701b34890898dc083648cfc97f038bb6566131",
      "subject": "[JSC] Check maxLength == 0 when specified in fromBase64"
    },
    "319276@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "319276@main",
      "clUrl": "https://commits.webkit.org/319276@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321890\nrdar://185064567\n\nReviewed by Sosuke Suzuki.\n\nTest262 is updated[1] to include the latest spec change proposal\nfor Promise.try[2], which uses PromiseResolve instead of a promise\ncreated by NewPromiseCapability. This simplifies our Promise.try\nimplementation since we can just use @promiseResolve and @promiseReject\nhelpers instead. Also this removes the reference to\n@newPromiseCapability in JSC code. So we drop PromiseOperations.js and\nits JS builtins, and replace @newPromiseCapability with C++ version for\nremaining WebCore users.\n\nWebCore users can be replaced by using normal Promise + first-resolving\nhandler. This is fixed in a subsequent change.\n\n[1]: https://github.com/tc39/test262/pull/5072\n[2]: https://github.com/tc39/ecma262/pull/3883\n\n* JSTests/test262/expectations.yaml:\n* Source/JavaScriptCore/CMakeLists.txt:\n* Source/JavaScriptCore/DerivedSources-input.xcfilelist:\n* Source/JavaScriptCore/DerivedSources.make:\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/builtins/BuiltinNames.h:\n* Source/JavaScriptCore/builtins/PromiseConstructor.js:\n(try):\n* Source/JavaScriptCore/builtins/PromiseOperations.js: Removed.\n* Source/JavaScriptCore/bytecode/LinkTimeConstant.h:\n* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n(JSC::JSGlobalObject::init):\n\nCanonical link: https://commits.webkit.org/319276@main",
      "email": "ysuzuki@apple.com",
      "hash": "7f38ebbabf35e067114a9ccdd56103132c880b4f",
      "subject": "[JSC] Apply Promise.try spec change"
    },
    "319277@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319277@main",
      "clUrl": "https://commits.webkit.org/319277@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321836\nrdar://184981918\n\nReviewed by Yusuke Suzuki.\n\nBoth the 8-bit and 16-bit paths of StringImpl::replace(char16_t, char16_t)\nhand-rolled a byte-at-a-time loop to locate the first occurrence of the\ntarget before handing off to createByReplacingInCharacters(). This is the\nsame defect fixed for makeStringByReplacingAll() in bug 321055\n(6cb1077d85c8), which was applied to StringView.cpp but missed this\nsibling in StringImpl.cpp.\n\nReplace both loops with WTF::find(), which is SIMD-accelerated. Collapsing\nthe two paths into a generic lambda also lets the isLatin1(target)\nearly-out go: find(std::span\u003cconst Latin1Character\u003e, char16_t) already\nreturns notFound for a non-Latin1 target, so an 8-bit string searched for\na 16-bit character still bails out without touching the characters. No\nbehavior change.\n\n* Source/WTF/wtf/text/StringImpl.cpp:\n(WTF::StringImpl::replace):\n\nCanonical link: https://commits.webkit.org/319277@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "1969cf2d9ec209dbb6724b43c5e618cac5a4fae6",
      "subject": "[WTF] StringImpl::replace(char16_t, char16_t) scans for the target with a scalar loop instead of SIMD find()"
    },
    "319278@main": {
      "author": "Pawel Lampe",
      "avatar": "https://www.gravatar.com/avatar/3c9bf19417c230eff7ade252118deb7a?d=identicon\u0026s=64",
      "cl": "319278@main",
      "clUrl": "https://commits.webkit.org/319278@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320446\n\nReviewed by Nikolas Zimmermann.\n\nThis change introduces a command-line tool for processing sysprof\n.syscap capture files recorded from WPE/GTK WebKit. It extracts marks\n(timeline events) and counters (time-series metrics) from a capture\nand allows one to do various kinds of processing with them.\n\nCo-authored with Claude.\n\nCanonical link: https://commits.webkit.org/319278@main",
      "email": "plampe@igalia.com",
      "hash": "3d48a8280d7d4bff44a5ce97809a634a9821b3ba",
      "subject": "Implement set of tools for working with WebKit's sysprof captures"
    },
    "319279@main": {
      "author": "Jean-Yves Avenard",
      "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64",
      "cl": "319279@main",
      "clUrl": "https://commits.webkit.org/319279@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321911\nrdar://185085895\n\nReviewed by Cameron McCormack.\n\nManagedMediaSource layout tests were failing with a cmake build on mac.\nTurned out that the disableRemotePlayback attribute was never set due to\nthe missing IDL.\n\nAlso adds page/Navigator+LoginStatus.idl after searching for which IDLs were listed in\nDerivedSources.make but weren't in the CMakeLists\n\n* Source/WebCore/CMakeLists.txt:\n\nCanonical link: https://commits.webkit.org/319279@main",
      "email": "jya@apple.com",
      "hash": "93472ec12ee947b30c7ec3c176ca0e2fb6ba6ace",
      "subject": "[cmake-cocoa] ManagedMediaSource is broken when using cmake build"
    },
    "319280@main": {
      "author": "Nikolas Zimmermann",
      "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64",
      "cl": "319280@main",
      "clUrl": "https://commits.webkit.org/319280@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321675\n\nReviewed by Rob Buis.\n\ncollectGradientAttributes() and collectPatternAttributes() asked hasAttribute()\nwhether gradientTransform / patternTransform was specified. Answering that costs\na serialization of the transform list into the attribute map whenever the base\nvalue was changed through the SVG DOM, and the serialized string is never read\nback: the value itself comes from the typed accessor gradientTransform() /\npatternTransform() -\u003e answer the presence check directly instead.\n\nMove the attributes shared by \u003clinearGradient\u003e and \u003cradialGradient\u003e into\nSVGGradientElement::collectCommonGradientAttributes(), so the two copies of that\ncode cannot drift apart.\n\nTests: svg/custom/gradient-transform-empty-or-invalid-not-inherited.svg\n       svg/custom/pattern-transform-empty-or-invalid-not-inherited.svg\n\n* LayoutTests/svg/custom/gradient-transform-empty-or-invalid-not-inherited-expected.svg: Added.\n* LayoutTests/svg/custom/gradient-transform-empty-or-invalid-not-inherited.svg: Added.\n* LayoutTests/svg/custom/pattern-transform-empty-or-invalid-not-inherited-expected.svg: Added.\n* LayoutTests/svg/custom/pattern-transform-empty-or-invalid-not-inherited.svg: Added.\n* Source/WebCore/rendering/svg/RenderSVGResourceLinearGradient.cpp:\n(WebCore::RenderSVGResourceLinearGradient::collectGradientAttributesIfNeeded):\n* Source/WebCore/rendering/svg/RenderSVGResourcePattern.cpp:\n(WebCore::RenderSVGResourcePattern::collectPatternAttributesIfNeeded):\n* Source/WebCore/rendering/svg/RenderSVGResourceRadialGradient.cpp:\n(WebCore::RenderSVGResourceRadialGradient::collectGradientAttributesIfNeeded):\n* Source/WebCore/svg/SVGGradientElement.cpp:\n(WebCore::SVGGradientElement::hasGradientTransformAttribute const):\n(WebCore::SVGGradientElement::collectCommonGradientAttributes):\n* Source/WebCore/svg/SVGGradientElement.h:\n* Source/WebCore/svg/SVGLinearGradientElement.cpp:\n(WebCore::setGradientAttributes):\n* Source/WebCore/svg/SVGPatternElement.cpp:\n(WebCore::SVGPatternElement::hasPatternTransformAttribute const):\n(WebCore::SVGPatternElement::collectPatternAttributes const):\n* Source/WebCore/svg/SVGPatternElement.h:\n* Source/WebCore/svg/SVGRadialGradientElement.cpp:\n(WebCore::setGradientAttributes):\n\nCanonical link: https://commits.webkit.org/319280@main",
      "email": "nzimmermann@igalia.com",
      "hash": "cd5e57e3a9dedd146aeefa5808eb35a547297951",
      "subject": "[LBSE] Avoid serializing the gradient and pattern transform to answer a presence check"
    },
    "319281@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319281@main",
      "clUrl": "https://commits.webkit.org/319281@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=297781\nrdar://problem/158943997\n\nReviewed by Jean-Yves Avenard.\n\nWebMParser::m_currentDuration accumulates the duration of each frame consumed\nwithin a single Block, so that laced frames sharing one Matroska timecode are\nspaced out correctly. WebMParser::OnSimpleBlockBegin() and OnSimpleBlockEnd()\nreset it to zero, but OnBlockBegin() and OnBlockEnd() did not, so for Blocks\ncarried inside a BlockGroup the accumulated duration was never cleared and\nleaked into the next block's presentation time in OnFrame(), which computes\nMediaTime(block-\u003etimecode + m_currentTimecode, m_timescale) + m_currentDuration.\n\nThe error compounds: with 20ms Opus packets, 50 back-to-back frames covering one\nsecond of audio were timestamped 0, 0.04, 0.08, ... 1.96, so the track spanned\ntwo seconds instead of one and every frame after the first was out of sync.\n\nReset m_currentDuration in OnBlockBegin() and OnBlockEnd(), mirroring the\nSimpleBlock path. Only audio tracks are affected, since only\nAudioTrackData::consumeFrameData() returns a frame duration for OnFrame() to\naccumulate; VideoTrackData::consumeFrameData() returns a webm::Status.\n\nAdded a layout test that appends the same 50 Opus packets twice through the\nsynthesized WebM generator, once as bare SimpleBlocks and once wrapped in\nBlockGroups, and checks that both produce the same one-second buffered range.\nTaught webm-generator.js to emit SimpleBlock so the unaffected path can serve\nas the baseline; it previously only ever emitted BlockGroup(Block).\n\n* LayoutTests/media/media-source/media-source-real-webm-blockgroup-presentation-times-expected.txt: Added.\n* LayoutTests/media/media-source/media-source-real-webm-blockgroup-presentation-times.html: Added.\n* LayoutTests/media/media-source/webm-generator.js:\n* Source/WebCore/platform/graphics/cocoa/SourceBufferParserWebM.cpp:\n(WebCore::WebMParser::OnBlockBegin):\n(WebCore::WebMParser::OnBlockEnd):\n\nCanonical link: https://commits.webkit.org/319281@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "97b38365f939f8106f648fa6182b8de823bb83a6",
      "subject": "BlockGroup-wrapped WebM Blocks get compounding presentation times"
    },
    "319282@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "319282@main",
      "clUrl": "https://commits.webkit.org/319282@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321903\n\nReviewed by Yusuke Suzuki.\n\nm_bufferedStructures exists so that a repatching IC does not buffer the same (Structure, identifier)\ntwice while it waits for bufferingCountdown before regenerating its stub. Handler ICs never buffer:\nthey generate a handler as soon as they see a new case. But the set, its lock and the countdown lived\nin the shared base class, so every handler IC paid 24 bytes for them, plus a 64 or 256 byte Vector\nbuffer once it took the slow path twice.\n\nMove them to RepatchingPropertyInlineCache and let considerRepatchingCacheImpl() return true for\nhandler ICs after the countdown / cool-down checks. Handler ICs that fail to cache a structure now\nretry tryCache on the first few visits instead of skipping them; repatching ICs are unchanged.\nsizeof(HandlerPropertyInlineCache) 112 -\u003e 88, embedded per IC site in Baseline and DFG JITData.\n\nOctane typescript x3, libpas Common Primitive Alloc after gc(): 27,657,088 -\u003e 26,386,064 bytes (-1.27 MB).\n\n* Source/JavaScriptCore/bytecode/PropertyInlineCache.cpp:\n(JSC::RepatchingPropertyInlineCache::RepatchingPropertyInlineCache):\n(JSC::PropertyInlineCache::addAccessCase):\n(JSC::PropertyInlineCache::reset):\n(JSC::RepatchingPropertyInlineCache::visitBufferedStructures):\n(JSC::RepatchingPropertyInlineCache::pruneDeadBufferedStructures):\n(JSC::PropertyInlineCache::visitAggregateImpl):\n(JSC::PropertyInlineCache::reconcileWeakReferencesAtGCEnd):\n(JSC::HandlerPropertyInlineCache::initializeFromUnlinkedPropertyInlineCache):\n(JSC::HandlerPropertyInlineCache::initializeFromDFGUnlinkedPropertyInlineCache):\n* Source/JavaScriptCore/bytecode/PropertyInlineCache.h:\n(JSC::PropertyInlineCache::PropertyInlineCache):\n(JSC::PropertyInlineCache::considerRepatchingCacheImpl):\n(JSC::RepatchingPropertyInlineCache::considerBufferingStructure):\n(JSC::PropertyInlineCache::clearBufferedStructures): Deleted.\n\nCanonical link: https://commits.webkit.org/319282@main",
      "email": "sosuke@bun.sh",
      "hash": "70eb5015aec426e421fad75c7df80b0e82417da6",
      "subject": "[JSC] Move `PropertyInlineCache`'s buffered-structures set to `RepatchingPropertyInlineCache`"
    },
    "319283@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "319283@main",
      "clUrl": "https://commits.webkit.org/319283@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321845\n\nReviewed by Yusuke Suzuki.\n\nWhen compiling a generator or async function wrapper, BytecodeGenerator::makeFunction() passes the\nwrapper's parameter names to the body's UnlinkedFunctionExecutable so that the body does not create\nlocals shadowing them. The names were passed as std::optional\u003cVector\u003cIdentifier\u003e\u003e, and the optional\nwas engaged even when the wrapper had no parameters, so the constructor allocated a 64-byte RareData\njust to hold an empty FixedVector. Every executed `async () =\u003e { await ... }`,\n`async function f() {}` with await, or `function* g() {}` paid for it.\n\nThe only consumers call contains() on the list, so an empty list is indistinguishable from no list.\nPass a plain Vector\u003cIdentifier\u003e and only touch RareData when it is non-empty; the two consumers in\nBytecodeGenerator now treat a null list as empty instead of asserting it is present.\n\nMeasured with 100k parameterless async functions each executed once: process footprint drops by\n~6.4 MB (64 bytes per function). No change for bodies whose wrapper has parameters.\n\nTest: JSTests/stress/generator-and-async-body-without-parameters-hoisting.js\n\n* JSTests/stress/generator-and-async-body-without-parameters-hoisting.js: Added.\n(shouldBe):\n(generatorNoParams.a):\n(generatorNoParams):\n(a):\n(generatorWithParams):\n(async asyncNoParams.a):\n(async asyncNoParams):\n(async asyncWithParams):\n(asyncArrowNoParams.async a):\n* Source/JavaScriptCore/builtins/BuiltinExecutables.cpp:\n(JSC::BuiltinExecutables::createExecutable):\n* Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp:\n(JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):\n* Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h:\n* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:\n(JSC::BytecodeGenerator::BytecodeGenerator):\n(JSC::BytecodeGenerator::hoistSloppyModeFunctionIfNecessary):\n* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h:\n(JSC::BytecodeGenerator::makeFunction):\n* Source/JavaScriptCore/runtime/CodeCache.cpp:\n(JSC::CodeCache::getUnlinkedGlobalFunctionExecutable):\n\nCanonical link: https://commits.webkit.org/319283@main",
      "email": "sosuke@bun.sh",
      "hash": "ee4b2082674de598acc8179672ec2d833fdab266",
      "subject": "[JSC] Do not allocate `UnlinkedFunctionExecutable::RareData` for generator/async bodies whose wrapper has no parameters"
    },
    "319284@main": {
      "author": "Nikolas Zimmermann",
      "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64",
      "cl": "319284@main",
      "clUrl": "https://commits.webkit.org/319284@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321883\n\nReviewed by Rob Buis.\n\nA viewBox with a zero width or height disables painting of the element. Legacy\ndoes that with an early return in LegacyRenderSVGRoot::paintReplaced() and\nLegacyRenderSVGViewportContainer::paint(). LBSE has no equivalent: A nested \u003csvg\u003e\nstill rendered right, as its empty overflow clip drops the content, but the\noutermost \u003csvg\u003e is clipped by RenderSVGRoot and kept painting.\n\nAdd SVGSVGElement::viewBoxDisablesPainting() and check for it during\nin both RenderSVGViewportContainer::paint() and\nRenderLayer::paintForegroundChildrenForSVG().\nThe latter is needed because collectChildrenInDOMOrderForSVG() can flatten a\ncontainer into the root layer's child list, which bypasses its own paint()...\n\nThe four WPT tests covering this no longer need an LBSE expectation.\n\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/TestExpectations:\n* Source/WebCore/rendering/RenderLayerSVGAdditions.cpp:\n(WebCore::viewBoxDisablesPaintingForSVG):\n(WebCore::RenderLayer::paintForegroundChildrenForSVG):\n* Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp:\n(WebCore::RenderSVGViewportContainer::updateLayerTransform):\n(WebCore::RenderSVGViewportContainer::paint):\n* Source/WebCore/rendering/svg/RenderSVGViewportContainer.h:\n* Source/WebCore/svg/SVGSVGElement.cpp:\n(WebCore::SVGSVGElement::viewBoxDisablesPainting):\n* Source/WebCore/svg/SVGSVGElement.h:\n\nCanonical link: https://commits.webkit.org/319284@main",
      "email": "nzimmermann@igalia.com",
      "hash": "3797ce8cd607e61062785e52afb0170fd9319640",
      "subject": "[LBSE] An empty viewBox does not disable rendering of the outermost \u003csvg\u003e"
    },
    "319285@main": {
      "author": "Aakash Jain",
      "avatar": "https://www.gravatar.com/avatar/e82e0cafeeac3a35b7e74206ebe4c536?d=identicon\u0026s=64",
      "cl": "319285@main",
      "clUrl": "https://commits.webkit.org/319285@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321792\n\u003crdar://problem/184925566\u003e\n\nReviewed by Ryan Haddad.\n\nEWS has supported both Bugzilla patches and GitHub pull requests since PR support\nlanded in early 2022, and essentially all contributor activity has moved to PRs.\n\nRemoved from ews-app:\n- Polling Bugzilla for r? attachments and cq+ bugs, and submitting those patches to\n  buildbot via 'buildbot try'. ews-app no longer talks to bugs.webkit.org at all,\n  which also drops its mechanize, BeautifulSoup and dateutil dependencies.\n- The /submit-to-ews/ page.\n- Sending patches to the commit-queue (cq+/cq-).\n\nThe /status-bubble/ and /status/ endpoints stay, so that status bubbles on existing\nBugzilla patches keep loading their old results, including their commit-queue bubble.\nThe bubble page also works for a pull request's head hash, and ews-build's merge queues\npoll /status/.\n\nBugzilla itself remains in use for issue tracking, and pull requests keep linking to\nand commenting on bugs.\n\nFetching buildbot's queue mappings was the only remaining job of the fetch loop, so it\nnow runs every 5 minutes instead of every 30 seconds.\n\n* Tools/CISupport/ews-app/ews/common/bugzilla.py: Removed.\n* Tools/CISupport/ews-app/ews/common/buildbot.py:\n* Tools/CISupport/ews-app/ews/config.py:\n* Tools/CISupport/ews-app/ews/fetcher.py:\n* Tools/CISupport/ews-app/ews/models/patch.py:\n* Tools/CISupport/ews-app/ews/templates/statusbubble.html:\n* Tools/CISupport/ews-app/ews/templates/submittoews.html: Removed.\n* Tools/CISupport/ews-app/ews/thirdparty/BeautifulSoup.py: Removed.\n* Tools/CISupport/ews-app/ews/thirdparty/__init__.py: Removed.\n* Tools/CISupport/ews-app/ews/urls.py:\n* Tools/CISupport/ews-app/ews/views/statusbubble.py:\n* Tools/CISupport/ews-app/ews/views/submittoews.py: Removed.\n\nCanonical link: https://commits.webkit.org/319285@main",
      "email": "aakash_jain@apple.com",
      "hash": "96806318d1a178e12f5558d6e7eee89c7008b81d",
      "subject": "[EWS] Remove Bugzilla patch workflow support from ews-app"
    },
    "319286@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "319286@main",
      "clUrl": "https://commits.webkit.org/319286@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321879\n\nReviewed by Antti Koivisto.\n\nboxBoundingBoxInContainer maps the anchor's box into the containing block with localToContainerQuad. For a\nRenderInline, borderBoundingBox() is a rect at the origin carrying only the size (see RenderInline.h), so\nwhat gets mapped has no position, and the position was added afterwards from linesBoundingBox().location().\nThat composes in an unflipped writing mode but not in a flipped one, where mapping through a box flips\nagainst that box's own size: the flip lands on a rect sitting at the origin. Map the line boxes' rect\ninstead, which carries the position through the flip.\n\nMeasured for a 200px wide containing block in vertical-rl, with the anchor one Ahem glyph on the second line:\nanchor(right) is 180 and the anchored element's left edge came out at 220. The error is the anchor's block\naxis offset doubled, so it grows per line: 40 with one line break, 80 with two.\n\nThe inline needs a non-zero block axis offset, which is why the last case in the test passes without this\nchange. Anonymous block generation hides the other cases where the anchor's inline content sits in an\nanonymous block of its own, because that block's block axis extent equals the inline's and flipping inside\nit is a no-op.\n\n* Source/WebCore/style/AnchorPositionEvaluator.cpp:\n(WebCore::Style::boxBoundingBoxInContainer):\n* LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/anchor-inline-box-vrl.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/anchor-inline-box-vrl-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/319286@main",
      "email": "zalan@apple.com",
      "hash": "d104e1e1f738efacc87036848494568fe29ceab1",
      "subject": "anchor(right) does not resolve to an inline anchor's right edge in vertical-rl"
    },
    "319287@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "319287@main",
      "clUrl": "https://commits.webkit.org/319287@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321874\n\nReviewed by Antti Koivisto.\n\nName from contents walks the element's children by taking its first child and then repeatedly the next\nsibling. A display: contents element has no box for its children to hang off, so the object after its last\nchild is one of the element's own siblings, and the walk carries on into it. The check meant to stop this only\ndid so when the next object had a display: contents parent of its own that differed, which the siblings do\nnot have, so nothing stopped it. Ask instead whether the next object is still a child of the element we\nstarted from.\n\nChrome and Firefox name all of the cases in the test \"x\". Whether the leak was visible depended on what\nfollowed in the markup, which is why the div at line 66 of\ncss/css-display/accessibility/display-contents-role-and-label.html reported \"x x x x\" while the same shape\nwith the link role a hundred lines later reported \"x\": the latter is followed by a display: contents list\nwhose item did trip the old check, and the two objects it had already walked into were whitespace only.\n\n* Source/WebCore/accessibility/AccessibilityObject.h:\n(WebCore::AccessibilityObject::iterator::ensureContentsParentValidity):\n* LayoutTests/imported/w3c/web-platform-tests/accname/name/comp_name_from_content_display_contents.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/accname/name/comp_name_from_content_display_contents-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/319287@main",
      "email": "zalan@apple.com",
      "hash": "dc3b7a297ecef964aaf7af889dfbacb452417bb0",
      "subject": "Accessible name of a display: contents element includes text from its siblings"
    },
    "319288@main": {
      "author": "Philippe Normand",
      "avatar": "https://www.gravatar.com/avatar/eef27203750af3510263cc29af21a16e?d=identicon\u0026s=64",
      "cl": "319288@main",
      "clUrl": "https://commits.webkit.org/319288@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321925\n\nReviewed by Claudio Saavedra.\n\n* Source/WebKit/UIProcess/API/glib/WebKitWebExtensionContext.cpp: Wrap WEBKIT_CONTEXT_ERROR_DOMAIN\nin a ifdef to avoid a unused-const-variable warning.\n\nCanonical link: https://commits.webkit.org/319288@main",
      "email": "philn@igalia.com",
      "hash": "3c32357594c526e5d129f6ab5facc47eb2e608e8",
      "subject": "[WPE][GTK] Unused const variable clang warning when WK_WEB_EXTENSIONS is disabled"
    },
    "319289@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "319289@main",
      "clUrl": "https://commits.webkit.org/319289@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321888\n\nReviewed by Antti Koivisto.\n\nA list item is handed its marker before its content, so when the block arrives parent.firstChild() is\nalready the marker and setChildrenInline(child-\u003eisInline()) is skipped; the else-if below it does not fire\nfor a block child, so childrenInline keeps the value the marker gave it and the item runs inline layout with\na block on a line. The marker then takes a line and the item is a line taller than its content. Ask whether\nthe item is empty apart from an excluded marker, so the first real child sets the flag.\n\nisExcludedMarker answered no while parent.childrenInline() was true, which is true for the same reason - a\nmarker is inline - so it denied exclusion for the very marker being asked about. Removing that also lets\nhasInlineInFlowChild stop counting an excluded marker, which is what the recompute after a child is removed\nneeds: a list item left with a block and its marker was staying on the inline path. Keep counting the marker\nwhen it is all that is left, or that item loses the line its marker sits on.\n\n* Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp:\n(WebCore::isExcludedMarker):\n(WebCore::hasInlineInFlowChild):\n(WebCore::RenderTreeBuilder::Block::attach):\n\nCanonical link: https://commits.webkit.org/319289@main",
      "email": "zalan@apple.com",
      "hash": "ba55b1b8934b7d92418eb4ab52aef125595e998c",
      "subject": "[anon-block-removal] An outside list marker keeps a line of its own when a block is appended to an empty list item"
    },
    "319290@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "319290@main",
      "clUrl": "https://commits.webkit.org/319290@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321807\n\nReviewed by Antti Koivisto.\n\nlayoutSimpleBlockContentInInline lays the block level boxes on our lines out and gives up when the result is not\nusable, but the floats that layout propagated up into us stay on our float list. Normal inline layout then lays the\nsame boxes out again and takes that list for the floats intruding from outside, so a box both avoids and stops\ncontributing the overflow of the float it places itself. Put the list back the way it was before falling back.\n\n* Source/WebCore/rendering/RenderBlockFlow.cpp:\n(WebCore::RenderBlockFlow::layoutSimpleBlockContentInInline):\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-in-block-in-inline-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-in-block-in-inline-001-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/floats/float-in-block-in-inline-001-expected.html: Added.\n\nCanonical link: https://commits.webkit.org/319290@main",
      "email": "zalan@apple.com",
      "hash": "f0fa56723043a67ea0aa5131f1cedff6c8742fb0",
      "subject": "[block-in-inline] A block level box on a line is handed its own float as an intruding float"
    },
    "319291@main": {
      "author": "Jure Triglav",
      "avatar": "https://www.gravatar.com/avatar/8318c45b3f67537fdf3c5775d98de5e1?d=identicon\u0026s=64",
      "cl": "319291@main",
      "clUrl": "https://commits.webkit.org/319291@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321676\nrdar://184823819\n\nReviewed by Mike Wyrzykowski\n\nGPUQueue.writeBuffer stages uploads by encoding copies into a queue-owned,\nblit-only MTLCommandBuffer that is committed standalone at each flush point\n(Queue::finalizeBlitCommandEncoder, called from submit()). A page that\ninterleaves writeBuffer bursts with compute submits therefore commits a\nper-frame pattern of C,SB,C,SB,C,SB,C,R (SB = staging blit CB). On Apple\nsilicon the AGX driver intermittently deadlocks the blit/DMA channel under\nthis cross-channel interleave: the newest SB completes with\nkIOGPUCommandBufferCallbackErrorHang (IOGPUCommandQueueError Code=3, encoder\nstate Affected, Metal validation clean, queue drained between frames) and its\nneighbors are discarded as innocent victims, losing the device. Traced 4/4 in\na worker+OffscreenCanvas repro (48 writes + 4 compute submits + present per\nframe); coalescing the app's writes to one blit per frame measured 0/7 deaths\nagainst an 8/10 control, implicating the standalone staging-blit interleave.\n\nThe staging command buffer's commit points cannot move: burst-k copies must be\nGPU-ordered after the submit that precedes them (anti-hazard on the\ndestination) and before the submit that follows (true dependency), and user\ncommand buffers arrive pre-encoded, so the copies cannot be prepended into\nthem either. What can move is the engine the copies run on. This change\nencodes staged writeBuffer copies as dispatches of a trivial word-copy compute\nkernel in the same queue-owned staging command buffer, at the same commit\npoints, with the same (tracked) hazard semantics - taking the per-frame hot\npath off the blit/DMA channel entirely. writeBuffer's validation guarantees\n4-byte alignment of offset and size and the staging suballocator is 64-byte\naligned, so the kernel covers every spec-reachable write.\n\nThe blit encoder path remains for writeTexture, clearBuffer, texture clears,\nICB trims, managed-buffer synchronization, and as a fallback if the copy\npipeline cannot be created; mixed bursts share one staging command buffer,\nswitching encoder types in place. Both writeBuffer backends share the channel\ndecision: the C++ path reaches it through Queue::stageBufferWrite, and the\nSwift path, which allocates its own staging buffer, hands the resulting buffer\nand byte offsets to the same Queue::encodeStagedCopy. Passing scalars rather\nthan a std::span keeps the Swift call free of span interop, so it introduces no\nnew use of 'unsafe'.\n\nTwo safety properties the staging path did not previously hold. Switching\nencoder types ends the open encoder before creating the replacement, so a null\nresult left both encoder pointers nil while the staging command buffer still\nheld encoded work; finalizeBlitCommandEncoder() keys off the encoders and would\nhave dropped it. Encoder creation failure now commits that command buffer\ninstead of orphaning it, finalize commits a live staging buffer with no encoder\nopen, and a null compute encoder falls through to the blit encoder rather than\nreturning and leaving the destination stale.\n\nThe copy kernel's loop is bounded by wordCount alone, so its argument block is a\nhand-maintained ABI with no compile-time link to the MSL struct. It is now a\nnamed StagedCopyArguments with static_asserts pinning its size and every field\noffset against the MSL declaration beside it, and encodeStagedCopy bounds-checks\nboth source and destination ranges by subtraction before dispatching.\n\nMeasured on that repro (30 s exposures, trunk f3f75e99, M3 Max, macOS 26.3):\ndevice loss falls from 8/10 and 4/4 in controls to 2 in 21 exposures. The\nremaining failures blame the staging compute command buffer with the identical\nsignature, so this is a mitigation and not a fix: the hazard is the standalone\nper-burst staging command buffer itself, on either channel. Removing it\nentirely needs deferred encoding of staged copies into the next user command\nbuffer, or per-resource idle tracking to widen the existing direct-memcpy fast\npath. writeTexture still mints per-burst staging blits and is unchanged here.\n\nCanonical link: https://commits.webkit.org/319291@main",
      "email": "juretriglav@gmail.com",
      "hash": "5fec87731f0c6d4370f2dc4cc96bc637ccb3fe61",
      "subject": "WebGPU: stage writeBuffer uploads on the compute channel, not standalone blit command buffers"
    },
    "319292@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319292@main",
      "clUrl": "https://commits.webkit.org/319292@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321906\nrdar://185079066\n\nReviewed by Antti Koivisto.\n\nThis path aligns WebKit with Gecko / Firefox and Blink / Chromium.\n\nresetComputedStyle() only cleared the DOM subtree (descendantsOfType), so cached\ncomputed style inside a shadow tree survived a recalc triggered by an inherited\nproperty change on the host, and getComputedStyle() returned the stale value. It is\nobservable on a display:none host because TreeResolver calls resetComputedStyle() on\nit and then stops, never descending into the subtree, so nothing else clears the cache\nor sets IsComputedStyleInvalidFlag. A light DOM child of the same host was already\nhandled, being a DOM descendant the old walk reached, which is why only the shadow\nsubtest of getComputedStyle-display-none-001.html was failing.\n\nWalk composedTreeDescendants() instead, which matches how computed style inherits, so\nshadow trees are reset too; equivalent when no shadow tree exists. Unslotted light DOM\nchildren drop out of the walk, but they do not inherit through the host, so no stale\ninherited value can be left behind, and their own invalidation is still honored because\ncomposedTreeLineage() includes the element itself.\n\nTest: imported/w3c/web-platform-tests/css/cssom/getComputedStyle-display-none-shadow-invalidation.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/cssom/getComputedStyle-display-none-001-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/cssom/getComputedStyle-display-none-shadow-invalidation-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/cssom/getComputedStyle-display-none-shadow-invalidation.html: Added.\n* Source/WebCore/dom/Element.cpp:\n(WebCore::Element::resetComputedStyle):\n\nCanonical link: https://commits.webkit.org/319292@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "2146a0ef0339f6ec61ed43d1004949256e1a6e1b",
      "subject": "getComputedStyle is stale in a display:none shadow tree after an inherited change on the host"
    },
    "319293@main": {
      "author": "Yury Semikhatsky",
      "avatar": "https://www.gravatar.com/avatar/d0aee26d9689e84bd1a7f0ed8f262fe1?d=identicon\u0026s=64",
      "cl": "319293@main",
      "clUrl": "https://commits.webkit.org/319293@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321747\n\nReviewed by Devin Rousso.\n\nPreserve the port and path prefix when extracting the PyPI index from\npip.conf, stripping only the trailing /simple component that AutoInstall\nappends itself. Bare-host index URLs are unaffected. Credentials in the\nindex URL are still dropped, as they were before.\n\n* Tools/Scripts/libraries/webkitcorepy/webkitcorepy/autoinstall.py:\n(_pypi_indices_from_file):\n* Tools/Scripts/libraries/webkitcorepy/setup.py:\n* Tools/Scripts/libraries/webkitcorepy/webkitcorepy/__init__.py:\n* Tools/Scripts/libraries/webkitcorepy/webkitcorepy/tests/autoinstall_unittest.py:\n(DefaultPyPIIndexTest.test_index_with_simple_suffix):\n(DefaultPyPIIndexTest):\n(DefaultPyPIIndexTest.test_index_with_path_prefix):\n(DefaultPyPIIndexTest.test_index_with_path_prefix_without_simple_suffix):\n(DefaultPyPIIndexTest.test_index_with_port):\n(DefaultPyPIIndexTest.test_index_with_credentials):\n\nCanonical link: https://commits.webkit.org/319293@main",
      "email": "yurys@chromium.org",
      "hash": "37e50b0dd84f7e560f08cee7f3f4349e6e16bd3e",
      "subject": "AutoInstall drops path prefix from pip index-url"
    },
    "319294@main": {
      "author": "Sergey Rubanov",
      "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64",
      "cl": "319294@main",
      "clUrl": "https://commits.webkit.org/319294@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321931\n\nReviewed by Yusuke Suzuki.\n\nImporting a WebAssembly.Tag and re-exporting it should return the same\nJS object. Export always created a new wrapper, so === failed.\n\nRemember the imported wrapper and return it from the export object.\nLocal tags are cached on first export so two export names share one\nobject.\n\n* JSTests/wasm/js-api/tag-import-export-identity.js: Added.\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp:\n(JSC::JSWebAssemblyInstance::visitChildrenImpl):\n(JSC::JSWebAssemblyInstance::setTagWrapper):\n(JSC::JSWebAssemblyInstance::tagWrapper):\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h:\n* Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp:\n(JSC::WebAssemblyModuleRecord::initializeImports):\n(JSC::WebAssemblyModuleRecord::initializeExports):\n\nCanonical link: https://commits.webkit.org/319294@main",
      "email": "chi187@gmail.com",
      "hash": "39de2d4eea61f947ee9ea9d364fc54715a17de84",
      "subject": "[JSC][Wasm] Re-exported imported Tag should be the same object"
    },
    "319295@main": {
      "author": "Kimmo Kinnunen",
      "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64",
      "cl": "319295@main",
      "clUrl": "https://commits.webkit.org/319295@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321915\nrdar://185088622\n\nReviewed by Said Abou-Hallawa.\n\nDue to a typo, transparency layers would always resync all the\nproperties of the context state instead of just what is changed\nbetween each draw.\n\n* Source/WebCore/platform/graphics/displaylists/DisplayListRecorder.h:\n(WebCore::DisplayList::Recorder::ContextState::cloneForTransparencyLayer const):\n\nCanonical link: https://commits.webkit.org/319295@main",
      "email": "kkinnunen@apple.com",
      "hash": "ed5aeba4d9a3523b47e64e39662a0dfc72a1d54d",
      "subject": "Transparency layers fail to reuse the context state"
    },
    "319296@main": {
      "author": "Kimmo Kinnunen",
      "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64",
      "cl": "319296@main",
      "clUrl": "https://commits.webkit.org/319296@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321910\nrdar://185084876\n\nReviewed by Mike Wyrzykowski.\n\nAvoid calling the public GraphicsContext state setter function. This\nwill modify the context state, which is not the intention of the\nstrokeRect.\nInstead, use the CGContext API directly.\n\nCurrently not possible to invoke the bug from web, but prevents future\nstate-related optimizations.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/cocoa/GraphicsContextCGTests.mm\n\n* Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp:\n(WebCore::GraphicsContextCG::strokeRect):\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/GraphicsContextCGTests.mm:\n(TestWebKitAPI::TEST(GraphicsContextTests, StrokeRectPreservesStrokeThickness)):\n(TestWebKitAPI::TEST(GraphicsContextTests, StrokeRectDoesNotDesynchroniseLineWidth)):\n\nCanonical link: https://commits.webkit.org/319296@main",
      "email": "kkinnunen@apple.com",
      "hash": "ac0b3b11540ea30b21025ae0f09143755c4e029b",
      "subject": "GraphicsContextCG::strokeRect modifies stroke thickness state"
    },
    "319297@main": {
      "author": "Kimmo Kinnunen",
      "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64",
      "cl": "319297@main",
      "clUrl": "https://commits.webkit.org/319297@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321912\nrdar://185087562\n\nReviewed by Mike Wyrzykowski.\n\nMutating the GraphicsContext state for fillRectWithRoundedHole\nimplementation. Instead, set CGContext state directly.\nThis way the GraphicsContext the flags tracking changes between\nsave/restore is preserved, making it easier to optimize save/restore\nstack.\n\n* Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp:\n(WebCore::GraphicsContextCG::fillRectWithRoundedHole):\n\nCanonical link: https://commits.webkit.org/319297@main",
      "email": "kkinnunen@apple.com",
      "hash": "8efe17ed73a3c9e559885d1e96974d9444350ba7",
      "subject": "GraphicsContextCG::fillRectWithRoundedHole changes state flags"
    },
    "319298@main": {
      "author": "Brady Eidson",
      "avatar": "https://www.gravatar.com/avatar/31bed81d6d8ef517f93b30add03f5651?d=identicon\u0026s=64",
      "cl": "319298@main",
      "clUrl": "https://commits.webkit.org/319298@main",
      "description": "rdar://185031280\nhttps://bugs.webkit.org/show_bug.cgi?id=321866\n\nReviewed by Timothy Hatcher.\n\nWith site isolation the Web Inspector frontend page and the extension's dev tools background\npage are in different web content processes. We sent the frontend page's identifier to the\nbackground page's process, where it means nothing, so the frontend page was never registered.\nPanels look up their tab through that page, so devtools.inspectedWindow.tabId returned the\n\"none\" value instead of the inspected tab.\n\nNow we send each identifier to the processes hosting the page it names, and include the frontend\npage's processes in processes(), since panels live there and listen for those events too.\n\nAlso replaced the foreground activity branch with a ProcessActivityGroup, which covers the\npage's current process and any it later spreads to.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIDevTools.mm\n\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionContextCocoa.mm:\n(WebKit::WebExtensionContext::processes const):\n(WebKit::WebExtensionContext::loadInspectorBackgroundPage):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIDevTools.mm:\n(TestWebKitAPI::TEST(WKWebExtensionAPIDevTools, PortMessagePassingFromPanelToDevToolsBackground)):\n(TestWebKitAPI::TEST(WKWebExtensionAPIDevTools, InspectedWindowTabIdFromPanel)):\n\nCanonical link: https://commits.webkit.org/319298@main",
      "email": "beidson@apple.com",
      "hash": "366e62cee33201aa57470a99cb9ecabbc0d5b7d8",
      "subject": "[Site Isolation] Web inspector extension panels cannot find the inspected tab"
    },
    "319299@main": {
      "author": "Jer Noble",
      "avatar": "https://www.gravatar.com/avatar/6d2cde9be23b98223ca964cb3b7813a0?d=identicon\u0026s=64",
      "cl": "319299@main",
      "clUrl": "https://commits.webkit.org/319299@main",
      "description": "rdar://184148295\nhttps://bugs.webkit.org/show_bug.cgi?id=321113\n\nReviewed by Jean-Yves Avenard.\n\nThe \"Test :muted matches .muted for content attribute\" sub-test tries to validate that setting\nthe \"muted\" content attribute correctly reflects to the .muted DOM property as well as the :muted\npseudo selector. However, the behavior of the \"muted\" content attribute is such that it does not\nuniversally reflect to the DOM and CSS; specifically, all three UAs will collapse the \"default\"\nmute state to an explicit value at different points. There is a proposal in whatwg/html/pull/12473\nto make this collapse point explicit: either during the load algorithm or during the post connection\nsteps.\n\nModify the sound-state.html test to validate that the :muted CSS pseudo selector matches the .muted\nIDL attribute by splitting the existing content attribute test into three separate tests. This-\nensures that the desired functionality (that the IDL and CSS match) is equally well tested both before\nthe proposed post-connection change is merged and after.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/selectors/media/sound-state-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/selectors/media/sound-state.html:\n\nCanonical link: https://commits.webkit.org/319299@main",
      "email": "jer.noble@apple.com",
      "hash": "8d269928e2774681dd44c8738b1018ae6f67145f",
      "subject": "[WPT] Fix css/selectors/media/sound-state.html"
    },
    "319300@main": {
      "author": "Phinehas Fuachie",
      "avatar": "https://www.gravatar.com/avatar/900d85de8c325e38975f39115c36bb75?d=identicon\u0026s=64",
      "cl": "319300@main",
      "clUrl": "https://commits.webkit.org/319300@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321230\nrdar://146487655\n\nReviewed by Jer Noble and Eric Carlson.\n\nThe test passes 100/100 iterations locally on mac-wk2 release (arm64), matching the generic\nbaseline's {8, 442} origins, so remove the expectation and let the bots enforce it.\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319300@main",
      "email": "pfuachie2@apple.com",
      "hash": "5850a0bb6fd5e3d7b6ee560692709b541bac9e9c",
      "subject": "[ macOS wk2 arm64 ] http/tests/site-isolation/fullscreen.html is a flaky failure"
    },
    "319301@main": {
      "author": "Wenson Hsieh",
      "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64",
      "cl": "319301@main",
      "clUrl": "https://commits.webkit.org/319301@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321881\nrdar://185061955\n\nReviewed by Aditya Keerthi and Pascoe.\n\nThe `summary` returned after performing an interaction was built from the raw description, so page-\nderived text bypassed the `replacementStrings` sanitization that 316548@main added for interaction\ndescriptions. Fix this by splitting the summary string off into the structured (non-hard-coded)\nportion, and `stringsToValidate` (which are filtered through `replacementStrings`).\n\nTest: TextExtractionTests.ReplacementStringsAppliedToInteractionDescription\n\n* Source/WebCore/page/text-extraction/TextExtraction.cpp:\n(WebCore::TextExtraction::redirectToLargeScrollableContainerIfNeeded):\n(WebCore::TextExtraction::scrollBy):\n(WebCore::TextExtraction::scrollToNextPage):\n(WebCore::TextExtraction::dispatchInteraction):\n(WebCore::TextExtraction::handleInteraction):\n* Source/WebCore/page/text-extraction/TextExtraction.h:\n* Source/WebKit/Shared/TextExtractionToStringConversion.cpp:\n(WebKit::applyReplacements): Avoid copying each key/value pair while matching.\n* Source/WebKit/UIProcess/API/Cocoa/WKWebView+TextExtraction.mm:\n(applyReplacementsToDescription): Factor out of `-_describeInteraction:...`.\n(-[WKWebView _performInteraction:inFrame:actionType:nodeIdentifier:staleNodeNote:shouldResolveStaleNodeIdentifier:completionHandler:]):\n(-[WKWebView _describeInteraction:inFrame:nodeIdentifier:staleNodeNote:shouldResolveStaleNodeIdentifier:completionHandler:]):\n* Source/WebKit/UIProcess/WebFrameProxy.cpp:\n(WebKit::WebFrameProxy::handleTextExtractionInteraction):\n* Source/WebKit/UIProcess/WebFrameProxy.h:\n* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:\n(WebKit::WebFrame::handleTextExtractionInteraction):\n* Source/WebKit/WebProcess/WebPage/WebFrame.h:\n* Source/WebKit/WebProcess/WebPage/WebFrame.messages.in:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:\n(TestWebKitAPI::TEST(TextExtractionTests, ReplacementStringsAppliedToInteractionDescription)):\n(TestWebKitAPI::TEST(TextExtractionTests, ReplacementStringsAppliedToScrollFallbackSummary)):\n\nCanonical link: https://commits.webkit.org/319301@main",
      "email": "wenson_hsieh@apple.com",
      "hash": "b56d0c9b157522fba900fc8b8b009b4729fd42de",
      "subject": "[Text Extraction] Interaction `summary` strings should not bypass client-specified `replacementStrings`"
    },
    "319302@main": {
      "author": "Kiet Ho",
      "avatar": "https://www.gravatar.com/avatar/d9058b37006dce1f55f91b8ccc82f9a3?d=identicon\u0026s=64",
      "cl": "319302@main",
      "clUrl": "https://commits.webkit.org/319302@main",
      "description": "rdar://184943650\nhttps://bugs.webkit.org/show_bug.cgi?id=321808\n\nReviewed by Tim Nguyen.\n\nCSSWG resolves in 2022 [1] to add CSSConditionRule.supports, which returns\nwhether the supports query in @supports is supported or not. In WebKit,\nCSSConditionRule wraps StyleRuleSupports, and it exposes the supported status\nvia conditionIsSupported(), so it's straightforward to expose it to CSSOM.\n\n[1]: https://github.com/w3c/csswg-drafts/issues/4240#issuecomment-1196983719\n\nTests: imported/w3c/web-platform-tests/css/css-conditional/at-supports-matches.html\n       imported/w3c/web-platform-tests/css/css-conditional/idlharness.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/at-supports-matches-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/idlharness-expected.txt:\n* Source/WebCore/css/CSSSupportsRule.cpp:\n(WebCore::CSSSupportsRule::matches const):\n* Source/WebCore/css/CSSSupportsRule.h:\n* Source/WebCore/css/CSSSupportsRule.idl:\n\nCanonical link: https://commits.webkit.org/319302@main",
      "email": "kiet.ho@apple.com",
      "hash": "1c37e97a7554ca065853b97e368e0360de153650",
      "subject": "[css-conditional] Support CSSConditionRule.supports"
    },
    "319303@main": {
      "author": "Aakash Jain",
      "avatar": "https://www.gravatar.com/avatar/e82e0cafeeac3a35b7e74206ebe4c536?d=identicon\u0026s=64",
      "cl": "319303@main",
      "clUrl": "https://commits.webkit.org/319303@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321805\n\u003crdar://problem/184941032\u003e\n\nReviewed by Ryan Haddad.\n\nPatches were submitted to EWS by setting r? on a Bugzilla attachment, and landed by the\nCommit-Queue with cq+. Both are removed here, along with the steps and Bugzilla API calls\nwhich only ran for patches, so ews-build now only processes pull requests. Every builder\nwhich the patch scheduler fed is also fed by the pull request scheduler, and the\nCommit-Queue's workers are shared with the merge queues, so no queue loses its trigger or\nits workers.\n\nBugzilla is still used for issue tracking: EWS keeps commenting on and closing the bug of\na landed pull request.\n\n* Tools/CISupport/ews-build/config.json:\n* Tools/CISupport/ews-build/events.py:\n* Tools/CISupport/ews-build/factories.py:\n* Tools/CISupport/ews-build/factories_unittest.py:\n* Tools/CISupport/ews-build/loadConfig.py:\n* Tools/CISupport/ews-build/loadConfig_unittest.py:\n* Tools/CISupport/ews-build/steps.py:\n* Tools/CISupport/ews-build/steps_unittest.py:\n\nCanonical link: https://commits.webkit.org/319303@main",
      "email": "aakash_jain@apple.com",
      "hash": "dcf824dfad72314a092e264e010d01c95b1d6876",
      "subject": "[EWS] Remove Bugzilla patch workflow support from ews-build.webkit.org"
    },
    "319304@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "319304@main",
      "clUrl": "https://commits.webkit.org/319304@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321884\nrdar://185062994\n\nReviewed by Wenson Hsieh.\n\n- Disable flaky tests\n- Disable super long tests\n- Remove some unnecessary parameterized conditions\n- Reduce some hard-coded delays\n\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift:\n(AppKitGesturesTests.tripleClickingInPDFSelectsLine):\n(AppKitGesturesTests.clickingOnPDFHUDButtonPerformsAction):\n(AppKitGesturesTests.clickingOnPDFShowsHUD):\n(AppKitGesturesTests.scrollingOnScrollBarChangesScrollPosition(_:)):\n(AppKitGesturesTests.tripleClickingInPDFSelectsLine(_:)): Deleted.\n(AppKitGesturesTests.clickingOnPDFHUDButtonPerformsAction(_:)): Deleted.\n(AppKitGesturesTests.clickingOnPDFShowsHUD(_:)): Deleted.\n(AppKitGesturesTests.scrollingOnScrollBarChangesScrollPosition(_:pressAndWait:)): Deleted.\n\nCanonical link: https://commits.webkit.org/319304@main",
      "email": "richard_robinson2@apple.com",
      "hash": "28968f31f8a3ee4dadb286441aa0b3029b51cd64",
      "subject": "[AppKit Gestures] Optimize the speed of the tests a little bit"
    },
    "319305@main": {
      "author": "Anne van Kesteren",
      "avatar": "https://www.gravatar.com/avatar/09bb44ac3625a121017cd98d0a7dc52c?d=identicon\u0026s=64",
      "cl": "319305@main",
      "clUrl": "https://commits.webkit.org/319305@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319750\n\nReviewed by Yusuke Suzuki.\n\nThe URL parser walks its input one code point at a time, and for each one\nchecks whether it is a component delimiter or a member of that component's\npercent-encode set. For the common case of long runs of ordinary characters\n(path segments, query strings, fragments) this is the dominant cost.\n\nThis patch scans those runs with SIMD to find the first code point that\nactually needs individual handling -- a delimiter, an encode-set member, a\ncontrol, or a non-ASCII code point -- and the parser then consumes the whole\npreceding run at once. Every \"trivial\" code point in such a run is copied\nverbatim, so:\n\n- When the output is unchanged from the input (canonical URLs, no syntax\n  violation), the run is simply skipped and the offsets advanced.\n- When the output buffer is being built (relative URLs and other\n  non-canonical input), the run is appended in a single bulk copy rather than\n  one code point at a time.\n\nBecause SIMD::find only vectorizes runs of at least one 16-byte stride, and\nthe bulk-append path must additionally scan a run before copying it, short\nbuffer-building runs are gated behind a one-stride length guard so they keep\nusing the existing per-code-point loop; the fast (no-copy) path is always\nscanned since its leaner loop wins even below a stride.\n\nMeasured with a same-binary A/B of the parser (SIMD scanning on vs. off):\n\n- On the corpus used by PerformanceTests/Parser/url-parser.html\n  (resources/final-url-en, 82,257 real-world absolute URLs), throughput\n  improves ~1.33x (203 -\u003e 153 ns/URL, denoised with 10 runs).\n- On a corpus of URLs extracted from the HTML Standard (66,944 hrefs,\n  ~77% relative fragments), throughput improves ~1.3-1.4x.\n- Synthetic long components (path/query/fragment of ~100 code points) improve\n  3-4x, with the win scaling with component length. Short components are\n  unchanged.\n\nCanonical link: https://commits.webkit.org/319305@main",
      "email": "annevk@annevk.nl",
      "hash": "eb44b6cfaa64548b24158a0550d3f6850a65d513",
      "subject": "Vectorize URL component parsing (path, query, fragment, opaque path)"
    },
    "319306@main": {
      "author": "Nikolas Zimmermann",
      "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64",
      "cl": "319306@main",
      "clUrl": "https://commits.webkit.org/319306@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321886\n\nReviewed by Simon Fraser.\n\nupdateScrollCoordinationForLayer runs for every composited layer on every\ncompositing update. When the layer has no coordination roles, each of the\nbranches takes its detach path, detaching a role the layer never registered\nfor. This is an expensive \"no-op\": the returned node ID is the parent one,\nunchanged, so the whole function body reduces to just returning the\nparent node ID - shortcut that.\n\nOn an embedded device running a composition heavy workload this alone\nwas responsible for ~0.4ms out of 1.6ms each cycle (checked with\n1500 composition cycles, each containing ~ 150 composited layers).\n\n* Source/WebCore/rendering/RenderLayerBacking.h:\n* Source/WebCore/rendering/RenderLayerCompositor.cpp:\n(WebCore::RenderLayerCompositor::updateScrollCoordinationForLayer):\n\nCanonical link: https://commits.webkit.org/319306@main",
      "email": "nzimmermann@igalia.com",
      "hash": "403bad6769980e4d96e3202a329797e0f364a26d",
      "subject": "Skip scroll coordination for layers that have no scrolling role"
    },
    "319307@main": {
      "author": "Nikolas Zimmermann",
      "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64",
      "cl": "319307@main",
      "clUrl": "https://commits.webkit.org/319307@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321920\n\nReviewed by Justin Michaud.\n\nAdd the remaining marks emitted along the rendering pipeline:\nRenderTreeBuild and CompositingUpdate for styling and compositing,\nFinalizeRenderingUpdate and RenderLayerTree for the rendering update,\nWaitForCompositionCompletion for the composition wait, and the tile marks\n(RecordTile, UpdateTiles, PaintTile, UpdateTile and\nSkiaBackingStoreTileUpdate).\n\nTwo of those marks carry data in their message: UpdateTiles reports how\nmany tiles it touched and PaintTile reports the dirty region, so extract\nboth as count statistics next to the durations.\n\nThe statistics tables gain mean and median columns. Both tables are now\ndriven by a single STATISTICS_COLUMNS list instead of spelling the\ncolumns out once in the header and once in the row builder. The median\ncolumn uses the exact median rather than the interpolated 50th\npercentile, since the two describe the same quantity.\n\nThree of these marks are easy to misread: StyleRecalc nests other marks,\nCompositingUpdate runs twice per rendering update, and PaintTile runs on\nthe painting threads rather than the main thread. The text report and the\nREADME now say so.\n\n* Tools/Scripts/webkit-sysprof/README.md:\n* Tools/Scripts/webkit-sysprof/tests/test_subcommands_e2e.py:\n(test_analyze_json_statistics_cover_all_relevant_marks):\n* Tools/Scripts/webkit-sysprof/webkitsysprof/analyze/__init__.py:\n(_dirty_region_pixels):\n(_render_text_report):\n\nCanonical link: https://commits.webkit.org/319307@main",
      "email": "nzimmermann@igalia.com",
      "hash": "6881be5d93f56631897bf8c341bca5203ebca5e8",
      "subject": "webkit-sysprof analyze needs to analyze more marks, to see where a frame time goes"
    },
    "319308@main": {
      "author": "Andy Estes",
      "avatar": "https://www.gravatar.com/avatar/643f10f01b26fd94d03482a2013b2ea0?d=identicon\u0026s=64",
      "cl": "319308@main",
      "clUrl": "https://commits.webkit.org/319308@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321048\nrdar://181531817\n\nReviewed by Jer Noble.\n\nMigrated WKAVContentSource conformance from AVInterfaceVideoPlaybackControllable to\nAVPlaybackUserInterfaceVideoControllable, as the former is deprecated.\n\n* Source/WebCore/Configurations/AllowedSPI.toml:\n* Source/WebCore/PAL/pal/cocoa/AVKitSoftLink.h:\n* Source/WebCore/PAL/pal/cocoa/AVKitSoftLink.mm:\n* Source/WebKit/Platform/ios/PlaybackSessionInterfaceAVKit.mm:\n(WebKit::PlaybackSessionInterfaceAVKit::durationChanged):\n(WebKit::PlaybackSessionInterfaceAVKit::currentTimeChanged):\n(WebKit::mediaSelectionOptionSource):\n* Source/WebKit/Platform/ios/WKAVContentSource.h:\n* Source/WebKit/Platform/ios/WKAVContentSource.mm:\n(emptyTimelineSegment):\n(playbackPosition):\n(-[WKAVContentSource initWithModel:]):\n(-[WKAVContentSource setSupportedSeekCapabilities:]):\n(-[WKAVContentSource setAudioOptions:]):\n(-[WKAVContentSource setLegibleOptions:]):\n(-[WKAVContentSource setMetadata:]):\n(-[WKAVContentSource setPlaybackPositionInternal:hostTime:]):\n(-[WKAVContentSource playbackPosition]):\n(-[WKAVContentSource seekToPosition:tolerance:]):\n(-[WKAVContentSource segments]):\n(-[WKAVContentSource currentSegment]):\n(-[WKAVContentSource state]):\n(-[WKAVContentSource setState:]):\n(-[WKAVContentSource supportedSeekCapabilities]):\n(-[WKAVContentSource error]):\n(-[WKAVContentSource currentAudioOption]):\n(-[WKAVContentSource setCurrentAudioOption:]):\n(-[WKAVContentSource currentAudioDescriptionOption]):\n(-[WKAVContentSource setCurrentAudioDescriptionOption:]):\n(-[WKAVContentSource currentLegibleOption]):\n(-[WKAVContentSource setCurrentLegibleOption:]):\n(-[WKAVContentSource audioOptions]):\n(-[WKAVContentSource audioDescriptionOptions]):\n(-[WKAVContentSource legibleOptions]):\n(-[WKAVContentSource metadata]):\n(createPlatformMetadata):\n(-[WKAVContentSource setCurrentPlaybackPositionInternal:]): Deleted.\n(-[WKAVContentSource currentValue]): Deleted.\n(-[WKAVContentSource setCurrentValue:]): Deleted.\n(-[WKAVContentSource currentPlaybackPosition]): Deleted.\n(-[WKAVContentSource setCurrentPlaybackPosition:]): Deleted.\n(-[WKAVContentSource playbackError]): Deleted.\n\nCanonical link: https://commits.webkit.org/319308@main",
      "email": "aestes@apple.com",
      "hash": "b7c9a68c602ec35b245b86d39ff7fb6bcf6ee179",
      "subject": "Take 2: [iOS] WKAVContentSource should conform to AVPlaybackUserInterfaceVideoControllable"
    },
    "319309@main": {
      "author": "Phinehas Fuachie",
      "avatar": "https://www.gravatar.com/avatar/900d85de8c325e38975f39115c36bb75?d=identicon\u0026s=64",
      "cl": "319309@main",
      "clUrl": "https://commits.webkit.org/319309@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321573\nrdar://164525056\n\nReviewed by Alex Christensen.\n\nThe fullscreen PiP button is hidden without a playback controls manager, and\ncanShowControlsManager() refuses one unless isElementRectMostlyInMainFrame() passes. Under Site\nIsolation both operands of that check were wrong in a subframe's process:\nboundingBoxInRootViewCoordinates() walks parent() pointers and stops at a RemoteFrame, so the\nelement rect was subframe-local; and contentsSize() on a remote main frame's view is always empty,\nsince nothing calls setContentsSize() on one.\n\nUse convertToRootViewAcrossIsolatedFrames() for the element rect, which crosses any number of\nRemoteFrames in the ancestry, and add a FrameContentsSize field to FrameTreeSyncData so a remote\nmain frame has a real size to compare against. Both branches now compute the same rect instead of\nSite Isolation taking a different path.\n\n* LayoutTests/http/tests/site-isolation/controls-manager-in-cross-origin-iframe-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/controls-manager-in-cross-origin-iframe.html: Added.\n* LayoutTests/http/tests/site-isolation/controls-manager-in-grandchild-frame-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/controls-manager-in-grandchild-frame.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/controls-manager-in-cross-origin-iframe.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/controls-manager-in-grandchild-frame-inner.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/controls-manager-in-grandchild-frame-middle.html: Added.\n* Source/WebCore/html/MediaElementSession.cpp:\n(WebCore::isElementRectMostlyInMainFrame):\n* Source/WebCore/page/FrameTreeSyncData.in:\n* Source/WebCore/page/LocalFrameView.cpp:\n(WebCore::LocalFrameView::updateContentsSizeForRemoteFrames):\n* Source/WebCore/page/LocalFrameView.h:\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::syncLocalFrameInfoToRemote):\n* Source/WebCore/page/RemoteFrameView.cpp:\n(WebCore::RemoteFrameView::frameContentsSize const):\n* Source/WebCore/page/RemoteFrameView.h:\n* Source/WebKit/UIProcess/WebFrameProxy.cpp:\n(WebKit::WebFrameProxy::calculateFrameTreeSyncData const):\n\nCanonical link: https://commits.webkit.org/319309@main",
      "email": "pfuachie2@apple.com",
      "hash": "d80918ca87e7253afebb18ca7b044fd0c3de9c0e",
      "subject": "[iOS][Site Isolation] No Picture-in-Picture button in fullscreen for video in a cross-origin iframe"
    },
    "319310@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "319310@main",
      "clUrl": "https://commits.webkit.org/319310@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321946\nrdar://185123226\n\nReviewed by Yijia Huang.\n\nThis updates simdutf to 9.0.0 which is the latest version,\nreleased 4 months ago.\n\n* Source/WTF/wtf/simdutf/simdutf_impl.cpp.h:\n(simdutf::to_string):\n(__cxa_pure_virtual):\n(simdutf::internal::get_icelake_singleton):\n(simdutf::internal::get_haswell_singleton):\n(simdutf::internal::get_westmere_singleton):\n(simdutf::internal::get_arm64_singleton):\n(simdutf::internal::get_ppc64_singleton):\n(simdutf::internal::get_rvv_singleton):\n(simdutf::internal::get_lasx_singleton):\n(simdutf::internal::get_lsx_singleton):\n(simdutf::internal::get_fallback_singleton):\n(simdutf::internal::get_unsupported_singleton):\n(simdutf::get_available_implementations):\n(simdutf::get_active_implementation):\n(simdutf::builtin_implementation):\n* Source/WTF/wtf/simdutf/simdutf_impl.h:\n(simdutf::scalar::utf16::is_high_surrogate):\n(simdutf::scalar::utf16::is_low_surrogate):\n(simdutf::to_string):\n(simdutf::literals::detail::base64_literal_helper::base64_literal_helper):\n(simdutf::literals::detail::base64_decode_literal):\n(simdutf::literals::detail::base64_make_array):\n(simdutf::literals::operator_base64):\n(simdutf::implementation::name const): Deleted.\n(simdutf::implementation::description const): Deleted.\n\nCanonical link: https://commits.webkit.org/319310@main",
      "email": "ysuzuki@apple.com",
      "hash": "71144530c1474901433fcf2ac4700888a775015c",
      "subject": "Update simdutf to 9.0.0"
    },
    "319311@main": {
      "author": "Kimmo Kinnunen",
      "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64",
      "cl": "319311@main",
      "clUrl": "https://commits.webkit.org/319311@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321772\nrdar://184895315\n\nReviewed by Charlie Wolfe and Anne van Kesteren.\n\nSerializing RequestData needs shouldBlockThirdPartyStorage property.\n\n* LayoutTests/ipc/load-image-for-decoding-file-url.html:\n\nCanonical link: https://commits.webkit.org/319311@main",
      "email": "kkinnunen@apple.com",
      "hash": "1fade3a7ef4f7da4b5f5ed513314dd28ddf32b14",
      "subject": "ipc/load-image-for-decoding-file-url.html is constant failure"
    },
    "319312@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319312@main",
      "clUrl": "https://commits.webkit.org/319312@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321905\nrdar://185078582\n\nReviewed by Simon Fraser.\n\nRenderTable::paintObject() and RenderTable::paintCollapsedBordersForRow() both\nimplement the same collapsed-border painting protocol: recalculate the collapsed\nborders, make a PaintInfo copy in PaintPhase::CollapsedTableBorders, then do one\npass per cached border value from lowest to highest precedence with\nm_currentBorder pointing at the border being painted, and finally clear\nm_currentBorder. Only the innermost step differs: paintObject() walks the\nsections bottom-up, while paintCollapsedBordersForRow() walks the row's cells.\n\nMove the shared part into a paintCollapsedBorderPasses() helper that takes the\nper-pass painting work as a NOESCAPE callable, so the m_currentBorder lifecycle\nexists in one place instead of two. Both instantiations are in RenderTable.cpp,\nso the template is defined there.\n\npaintObject() previously mutated its own PaintInfo's phase in place rather than\ncopying; the copy is equivalent because that PaintInfo is not used again\nafterwards (the outline paint below it uses the original paintInfo). The pass\nloop also becomes a range-for over m_collapsedBorders instead of an index loop.\n\nNo change in behavior.\n\n* Source/WebCore/rendering/RenderTable.cpp:\n(WebCore::RenderTable::paintObject):\n(WebCore::RenderTable::paintCollapsedBorderPasses):\n(WebCore::RenderTable::paintCollapsedBordersForRow):\n* Source/WebCore/rendering/RenderTable.h:\n\nCanonical link: https://commits.webkit.org/319312@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "4d60710e3813177c975e9b8a632555ad105ec3ca",
      "subject": "Deduplicate the collapsed-border painting pass loop between paintObject() and paintCollapsedBordersForRow()"
    },
    "319313@main": {
      "author": "Sam Sneddon",
      "avatar": "https://www.gravatar.com/avatar/99f6b56d9db9d32920dfcc56deae86fc?d=identicon\u0026s=64",
      "cl": "319313@main",
      "clUrl": "https://commits.webkit.org/319313@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316952\nrdar://179414185\n\nReviewed by Elliott Williams.\n\nTo migrate from \"Canonical link\" to \"Canonical-link\", the\ncanonicalisation script must handle both variants during the\ntransition; when we re-canonicalise following a merge we may end up\nchanging which form a given change has.\n\nWe introduce a IdentifierTrailer class with support for aliases,\nallowing us to change which variant is canonical in the future.\n\nTrailer configuration now passes through the\nWEBKITSCMPY_CANONICALIZE_IDENTIFIER_TRAILER environment variable\ninstead of command-line arguments, avoiding the need to properly\nescape structured data when passing between process invocations.\n\n* Tools/Scripts/git-webkit:\nImport and use IdentifierTrailer for identifier_template.\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/mocks/local/git.py:\n(Git.filter_branch): Change signature to use identifier_trailer parameter, parse from environment variable.\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/__init__.py:\n(main): Import IdentifierTrailer, convert string templates via from_template.\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/canonicalize/__init__.py:\n(IdentifierTrailer): Added.\n(IdentifierTrailer.from_template): Added.\n(IdentifierTrailer.from_json): Added.\n(IdentifierTrailer.to_json): Added.\n(Canonicalize.main): Updated to pass trailer via environment variable.\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/canonicalize/message.py:\n(main): Updated for IdentifierTrailer integration.\n(rewrite_message): Refactored to accept IdentifierTrailer.\n(rewrite_message.is_identifier_trailer): Added helper.\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/land.py:\n(Land.main): Updated for IdentifierTrailer integration.\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/test/canonicalize_unittest.py:\n(TestCanonicalizeProgam.test_formated_identifier): Drive-by: spelling.\n(TestCanonicalizeProgam.test_identifier_trailer_dataclass): Added.\n(TestCanonicalizeProgam.test_existing_identifier): Drive-by: spelling.\n(TestCanonicalizeProgam.test_existing_canonical_link_alias): Added.\n(TestCanonicalizeProgam.test_git_svn): Drive-by: spelling.\n(TestCanonicalizeProgam.test_git_svn_existing): Drive-by: spelling.\n(TestCanonicalizeProgam.test_git_svn_existing_merge_queue): Drive-by: spelling.\n(TestCanonicalizeProgam.test_branch_commits): Drive-by: spelling.\n(TestCanonicalizeProgam.test_number): Drive-by: spelling.\n(TestCanonicalizeProgam.test_alternate_trailer): Drive-by: spelling.\n(TestCanonicalizeMessage.assert_canonicalized_commit_message): Updated.\n(TestCanonicalizeMessage.test_canonical_link_alias): Added.\n(TestCanonicalizeMessage.test_canonical_link_alias_mirror): Added.\n(TestCanonicalizeMessage.test_canonical_link_both_spellings): Added.\n(TestCanonicalizeMessage.test_no_alias_match_appends_new_trailer): Added.\n(TestCanonicalizeMessage.test_three_existing_canonical_link_trailers): Added.\n(TestCanonicalizeMessage.test_canonical_link_alias_separated_by_other_trailer): Added.\n(TestCanonicalizeMessage.test_canonical_link_alias_followed_by_other_trailer): Added.\n(TestCanonicalizeMessage.test_canonical_link_alias_with_git_svn_id): Added.\n(TestCanonicalizeMessage.test_canonical_link_alias_blank_before_git_svn_id): Added.\n(TestCanonicalizeMessage.test_three_existing_identifier_trailers): Added.\n(TestCanonicalizeMessage.test_identifier_trailer_separated_by_other_trailer): Added.\n(TestCanonicalizeMessage.test_identifier_trailer_followed_by_other_trailer): Added.\n(TestCanonicalizeMessage.test_identifier_with_git_svn_id): Added.\n(TestCanonicalizeMessage.test_identifier_blank_before_git_svn_id): Added.\n(TestIdentifierTrailer): Added.\n(TestIdentifierTrailer.test_from_template_fields): Added.\n(TestIdentifierTrailer.test_frozen): Added.\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/test/land_unittest.py:\n(TestLand.test_canonicalize_with_identifier_trailer): Added.\n\nCanonical link: https://commits.webkit.org/319313@main",
      "email": "gsnedders@apple.com",
      "hash": "761e61f4ad964e587d617b87afec33e7a3570a9e",
      "subject": "Support both Canonical-link and Canonical link while doing canonicalisation"
    },
    "319314@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "319314@main",
      "clUrl": "https://commits.webkit.org/319314@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321396\n\u003crdar://problem/185048387\u003e\n\nReviewed by Antti Koivisto.\n\n  \u003cstyle\u003e\n  li { list-style-type: \"\\627 \\644 \" }\n  \u003c/style\u003e\n  \u003col\u003e\u003cli\u003ea\n\nThe marker should reserve the 12px its two glyphs occupy. Instead it reserved 9px, so the list item's content painted on top of the marker.\n\nThe marker had no renderers for its text, so nothing ever ran the bidi algorithm over it and\ntextRunForContent reversed the characters itself. Painting needs that reversal: drawText forces the\nembedding level, so it draws in memory order and pre-reversed text lands in the right visual order.\nMeasuring does not, because FontCascade::width lets CoreText resolve the run instead. Reversing\nright-to-left text also changes its Arabic joining forms, here forming a lam-alef ligature, so the box\nwas sized for 8.41px of ligature while 12.28px of two separate glyphs was painted. Reordering by hand\ngot text of mixed direction wrong outright.\n\nGive the marker's text renderers of its own when it needs bidi resolution, reusing the anonymous\ninline-block child that `content` markers already have, so inline layout measures and paints the same\nresolved runs. A counter style draws its fallback's text whenever it cannot represent a value, so that\ndecision walks the whole fallback chain and sends anything it cannot prove is left-to-right through\ninline layout. A disclosure triangle is no longer excluded from it either: its glyph and suffix are\nboth direction-neutral, so a right-to-left box reorders them and the suffix space used to end up on\nthe wrong side of the triangle.\n\n* Source/WebCore/rendering/RenderListMarker.cpp:\n(WebCore::RenderListMarker::isImage const):\n(WebCore::RenderListMarker::hasContentProperty const):\n(WebCore::symbolsContainStrongDirectionalityText):\n(WebCore::counterStyleChainHasStrongDirectionalitySymbols):\n(WebCore::RenderListMarker::textNeedsBidiResolution const):\n(WebCore::RenderListMarker::usesInlineLayout const):\n(WebCore::textRunForContent):\n(WebCore::RenderListMarker::paint):\n(WebCore::RenderListMarker::updateContent):\n(WebCore::RenderListMarker::updateTextRendererForInlineLayout):\n(WebCore::RenderListMarker::layoutContentContainer):\n(WebCore::RenderListMarker::computeIntrinsicLogicalWidthContributions):\n(WebCore::RenderListMarker::updateInlineMargins):\n(WebCore::RenderListMarker::relativeMarkerRect):\n(WebCore::RenderListMarker::drawsBulletShape const):\n(WebCore::RenderListMarker::hasContent const): Deleted.\n(WebCore::reversed): Deleted.\n(WebCore::RenderListMarker::widthUsesMetricsOfPrimaryFont const): Deleted.\n(WebCore::RenderListMarker::imageChanged):\n(WebCore::RenderListMarker::needsContentContainer const):\n(WebCore::RenderListMarker::updateContentContainerText):\n* Source/WebCore/rendering/RenderListMarker.h:\n* Source/WebCore/css/CSSRegisteredCounterStyle.h:\n(WebCore::CSSRegisteredCounterStyle::fallbackStyle const):\n* Source/WebCore/rendering/updating/RenderTreeBuilderList.cpp:\n(WebCore::RenderTreeBuilder::List::updateItemMarker):\n(WebCore::RenderTreeBuilder::List::buildMarkerContentRenderers):\n(WebCore::RenderTreeBuilder::List::wrapInsideMarkerInAnonymousInline):\n* LayoutTests/TestExpectations: list-style-type-string-005a, -006 and disclosure-styles pass now.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/list-style-type-string-003.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/list-marker-rtl-string-width.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/list-marker-rtl-string-width-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/list-marker-rtl-string-width-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo/marker-unicode-bidi-default.html:\n* LayoutTests/platform/ios/fast/lists/008-expected.txt:\n* LayoutTests/platform/ios/fast/lists/008-vertical-expected.txt:\n* LayoutTests/platform/mac/fast/lists/008-expected.txt:\n* LayoutTests/platform/mac/fast/lists/008-vertical-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-counter-styles/hebrew/css3-counter-styles-016.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/list-marker-counter-style-mutation-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/list-marker-counter-style-mutation-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/list-marker-counter-style-mutation.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/list-marker-counter-style-fallback-rtl.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/list-marker-counter-style-fallback-rtl-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/list-marker-counter-style-fallback-rtl-expected.html: Added.\n* LayoutTests/platform/ios/fast/lists/marker-image-error-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-writing-mode-expected.txt:\n* LayoutTests/platform/glib/fast/html/details-writing-mode-mixed-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-writing-mode-expected.txt:\n* LayoutTests/platform/ios/fast/html/details-writing-mode-mixed-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-writing-mode-expected.txt:\n* LayoutTests/platform/mac/fast/html/details-writing-mode-mixed-expected.txt:\n\nCanonical link: https://commits.webkit.org/319314@main",
      "email": "zalan@apple.com",
      "hash": "924a6596c2f80d8e923ba220dadf364430d9789b",
      "subject": "[list-marker] List marker overlaps the list item content when the marker text is right-to-left"
    },
    "319315@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319315@main",
      "clUrl": "https://commits.webkit.org/319315@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321901\nrdar://185077973\n\nReviewed by Alan Baradlay.\n\nReplace the unscoped `enum SkipEmptySectionsValue { DoNotSkipEmptySections,\nSkipEmptySections }` in RenderTable.h with `enum class SkipEmptySections : bool\n{ No, Yes }`, so the enumerators no longer leak into the WebCore namespace and\nthe underlying type is explicit.\n\nThe only clients are RenderTable itself and RenderTableCell's collapsed-border\ncomputation, so all fifteen references are updated here; no behavior change.\n\nAlso drop a stray double space in one of the comparisons in sectionBelow().\n\n* Source/WebCore/rendering/RenderTable.cpp:\n(WebCore::RenderTable::topNonEmptySection const):\n(WebCore::RenderTable::bottomNonEmptySection const):\n(WebCore::RenderTable::sectionAbove const):\n(WebCore::RenderTable::sectionBelow const):\n(WebCore::RenderTable::cellAbove const):\n(WebCore::RenderTable::cellBelow const):\n* Source/WebCore/rendering/RenderTable.h:\n* Source/WebCore/rendering/RenderTableCell.cpp:\n(WebCore::RenderTableCell::computeCollapsedBeforeBorder const):\n(WebCore::RenderTableCell::computeCollapsedAfterBorder const):\n\nCanonical link: https://commits.webkit.org/319315@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "be49eaa31fa4b97d4d39adafa618a3ab9ec5162e",
      "subject": "Convert SkipEmptySectionsValue to a scoped enum class"
    }
  },
  "date": "2026-08-17",
  "days": 1,
  "generatedAt": "2026-08-17T22:06:17Z",
  "markdown": "## Highlights\n- **Perf** URL parsing now vectorizes path, query, fragment, and opaque-path scans, which should shave hot-path cost across navigation and fetch-heavy workloads. [commit 319305@main](https://commits.webkit.org/319305@main)\n- **Web Platform** WebKit adds `CSSConditionRule.supports`, closing a gap in the CSS conditional rules surface. [commit 319302@main](https://commits.webkit.org/319302@main)\n- **GPU** WebGPU now stages `writeBuffer` uploads on the compute channel instead of standalone blit command buffers, a cleaner path for upload scheduling. [commit 319291@main](https://commits.webkit.org/319291@main)\n- **Media** Cross-origin iframe video on iOS regains the Picture-in-Picture control in fullscreen, fixing a visible Site Isolation regression. [commit 319309@main](https://commits.webkit.org/319309@main)\n- **V8** JavaScriptCore picks up the `Promise.try` spec change, keeping engine behavior aligned with the evolving JS platform. [commit 319276@main](https://commits.webkit.org/319276@main)\n- **A11y** Accessible name calculation no longer pulls sibling text into `display: contents` elements, fixing a real semantics bug for assistive tech. [commit 319287@main](https://commits.webkit.org/319287@main)\n- **Rendering** Composited content now respects non-round `corner-shape`, fixing visible clipping and corner styling failures on video, images, and composited descendants. [commit 319257@main](https://commits.webkit.org/319257@main)\n- **Perf** WebKit lands a first set of sysprof capture tools plus deeper frame-time mark analysis, making performance investigation much more actionable. [commit 319278@main](https://commits.webkit.org/319278@main) [commit 319307@main](https://commits.webkit.org/319307@main)\n- **Security** `simdutf` is updated to 9.0.0, refreshing a low-level parsing dependency used in text handling paths. [commit 319310@main](https://commits.webkit.org/319310@main)\n\n## What landed by area\n\n### Rendering and layout\n- **Rendering** Right-to-left list markers no longer overlap list item content. [commit 319314@main](https://commits.webkit.org/319314@main)\n- **Rendering** Collapsed-border painting loop logic was deduplicated between two paint paths, reducing drift in table border rendering code. [commit 319312@main](https://commits.webkit.org/319312@main)\n- **Rendering** `getComputedStyle` now updates correctly inside a `display:none` shadow tree after inherited changes on the host. [commit 319292@main](https://commits.webkit.org/319292@main)\n- **Rendering** A block-level box on a line no longer treats its own float as an intruding float in block-in-inline layout. [commit 319290@main](https://commits.webkit.org/319290@main)\n- **Rendering** Outside list markers no longer keep an unnecessary line of their own when a block is appended to an empty list item. [commit 319289@main](https://commits.webkit.org/319289@main)\n- **Rendering** `anchor(right)` now resolves correctly against an inline anchor in `vertical-rl`. [commit 319286@main](https://commits.webkit.org/319286@main)\n- **Rendering** A `visibility:visible` child no longer stays hidden just because it has non-visible overflow. [commit 319258@main](https://commits.webkit.org/319258@main)\n\n### Graphics, SVG, and compositing\n- **Rendering** `GraphicsContextCG::fillRectWithRoundedHole` no longer corrupts graphics state flags. [commit 319297@main](https://commits.webkit.org/319297@main)\n- **Rendering** `GraphicsContextCG::strokeRect` no longer mutates stroke thickness state unexpectedly. [commit 319296@main](https://commits.webkit.org/319296@main)\n- **Rendering** Transparency layers now reuse context state correctly instead of desynchronizing stateful drawing behavior. [commit 319295@main](https://commits.webkit.org/319295@main)\n- **Rendering** An empty `viewBox` no longer disables rendering of the outermost SVG. [commit 319284@main](https://commits.webkit.org/319284@main)\n- **Perf** LBSE avoids serializing gradient and pattern transforms just to answer a presence check. [commit 319280@main](https://commits.webkit.org/319280@main)\n- **Rendering** Updating `href` on an `\u003cimage\u003e` referenced by `\u003cuse\u003e` now refreshes the generated use instances. [commit 319264@main](https://commits.webkit.org/319264@main)\n- **Web Platform** SVG2 `dominant-baseline` drops `use-script`, `no-change`, and `reset-size`, matching the modern value set. [commit 319256@main](https://commits.webkit.org/319256@main)\n\n### JavaScriptCore and Wasm\n- **Web Platform** Re-exported imported Wasm `Tag` objects now preserve identity correctly. [commit 319294@main](https://commits.webkit.org/319294@main)\n- **Perf** JSC avoids allocating `UnlinkedFunctionExecutable::RareData` for some generator and async wrappers that do not need it. [commit 319283@main](https://commits.webkit.org/319283@main)\n- **Refactor** `PropertyInlineCache`'s buffered-structures set moves into `RepatchingPropertyInlineCache`, tightening ownership around cache repatching. [commit 319282@main](https://commits.webkit.org/319282@main)\n- **Web Platform** `fromBase64` now handles `maxLength == 0` correctly when specified. [commit 319275@main](https://commits.webkit.org/319275@main)\n\n### WTF and core infrastructure\n- **Perf** `StringImpl::replace(char16_t, char16_t)` gets a better target scan instead of a scalar loop. [commit 319277@main](https://commits.webkit.org/319277@main)\n- **Perf** `copyElements` gains a small inlined `memcpy` fast path. [commit 319274@main](https://commits.webkit.org/319274@main)\n- **Perf** Base64 encode and decode maps are no longer copied by value on every call. [commit 319268@main](https://commits.webkit.org/319268@main)\n- **Build** WTF Core's clang module now requires C++23. [commit 319265@main](https://commits.webkit.org/319265@main)\n- **Refactor** `SkipEmptySectionsValue` is now a scoped enum class. [commit 319315@main](https://commits.webkit.org/319315@main)\n- **Security** `NonSharedCharacterBreakIterator` and `NonSharedSentenceBreakIterator` no longer leak `UBreakIterator` when `setText` fails. [commit 319266@main](https://commits.webkit.org/319266@main)\n\n### Networking, loading, and web platform plumbing\n- **Networking** Canonicalisation now accepts both `Canonical-link` and `Canonical link`, improving header compatibility. [commit 319313@main](https://commits.webkit.org/319313@main)\n- **Web Platform** `DataTransfer.getData(\"url\")` now returns the first URL from `text/uri-list` instead of the whole payload. [commit 319267@main](https://commits.webkit.org/319267@main)\n- **Web Platform** `DataTransferItemList`'s indexed getter is now anonymous and `length` uses the correct `unsigned long` type. [commit 319259@main](https://commits.webkit.org/319259@main)\n- **Privacy** Text Extraction interaction `summary` strings no longer bypass client-specified `replacementStrings`, which keeps caller redaction in effect. [commit 319301@main](https://commits.webkit.org/319301@main)\n- **Security** A public SDK regression in `web-authenticator-signal-main-thread` was fixed. [commit 319271@main](https://commits.webkit.org/319271@main)\n- **Web Platform** Compression WPTs were resynced from upstream to keep behavior and expectations current. [commit 319269@main](https://commits.webkit.org/319269@main)\n\n### Media, GPU, and Apple platform behavior\n- **Mobile** `WKAVContentSource` now conforms to `AVPlaybackUserInterfaceVideoControllable` on iOS after a second pass at the fix. [commit 319308@main](https://commits.webkit.org/319308@main)\n- **Media** BlockGroup-wrapped WebM blocks no longer accumulate compounding presentation times. [commit 319281@main](https://commits.webkit.org/319281@main)\n- **Build** `ManagedMediaSource` is fixed for Cocoa CMake builds. [commit 319279@main](https://commits.webkit.org/319279@main)\n- **Security** `IOSurface::convertToFormat` no longer leaks the completion callback or destination surface when acceleration fails. [commit 319262@main](https://commits.webkit.org/319262@main)\n- **Media** A flaky concurrent video playback regression on macOS and iOS was addressed in testing. [commit 319254@main](https://commits.webkit.org/319254@main)\n\n### Accessibility and developer tooling\n- **A11y** The isolated accessibility tree no longer overcounts textarea characters after a dynamic edit that leaves a trailing line break. [commit 319263@main](https://commits.webkit.org/319263@main)\n- **DevTools** Web Inspector extension panels can once again find the inspected tab under Site Isolation. [commit 319298@main](https://commits.webkit.org/319298@main)\n- **DevTools** `git-webkit` now sorts and updates the `Tests:` section in commit messages. [commit 319270@main](https://commits.webkit.org/319270@main)\n- **Perf** AppKit gesture tests got a small speedup. [commit 319304@main](https://commits.webkit.org/319304@main)\n\n### Build, bots, and test stability\n- **Build** EWS build.webkit.org drops Bugzilla patch workflow support. [commit 319303@main](https://commits.webkit.org/319303@main)\n- **Build** EWS app also drops Bugzilla patch workflow support. [commit 319285@main](https://commits.webkit.org/319285@main)\n- **Build** `AutoInstall` no longer drops the path prefix from `pip index-url`. [commit 319293@main](https://commits.webkit.org/319293@main)\n- **Build** WPE GTK fixes an unused const warning when `WK_WEB_EXTENSIONS` is disabled. [commit 319288@main](https://commits.webkit.org/319288@main)\n- **Build** `IDBRequestData::isolatedCopy()` suppresses a `NoDeleteChecker` warning. [commit 319261@main](https://commits.webkit.org/319261@main)\n- **Rendering** `ipc/load-image-for-decoding-file-url.html` was fixed as a constant failure. [commit 319311@main](https://commits.webkit.org/319311@main)\n- **Media** `css/selectors/media/sound-state.html` WPT was fixed. [commit 319299@main](https://commits.webkit.org/319299@main)\n- **Mobile** A flaky Site Isolation fullscreen test on macOS wk2 arm64 was fixed. [commit 319300@main](https://commits.webkit.org/319300@main)\n- **Rendering** GLib fixed `canvas-composite-text-alpha.html`, which had been failing since [bug 225423](https://bugs.webkit.org/show_bug.cgi?id=225423). [commit 319273@main](https://commits.webkit.org/319273@main)\n\n## Reverts \u0026 Reapplies\n- **Mobile** \"Take 2\" on the iOS `WKAVContentSource` conformance fix suggests a reapplication or adjusted reland of an earlier change. [commit 319308@main](https://commits.webkit.org/319308@main)",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [
    {
      "name": "Unreviewed",
      "count": 3
    }
  ],
  "since": "2026-08-17",
  "totals": {
    "commits": 62,
    "features": 59,
    "rolls": 3
  },
  "until": "2026-08-17"
}