{ "commits": { "319408@main": { "author": "Ben Nham", "avatar": "https://www.gravatar.com/avatar/dc0914eabf69047ee3397794c2d17bf7?d=identicon\u0026s=64", "cl": "319408@main", "clUrl": "https://commits.webkit.org/319408@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321769\nrdar://172301423\n\nReviewed by Sihui Liu.\n\nThe existing process count limiter depends on various codepaths maintaining an LRU list of all\nWebProcesses at navigation time. With Site Isolation enabled, this strategy doesn't work, since the\nLRU list maintenance didn't fan out to remote frame processes, so processes that should logically be\nclustered together in the LRU list ended up spread apart.\n\nThis patch replaces the LRU list of WebProcess with an LRU list of WebPageProxy. LRU in this case\nmeans:\n\n1. Non-visible pages, in order of creation time\n2. Visible pages, in order of last visible or focused time\n\nSo we upon reaching the process count limit, we first try to kill the page that was visible the\nlongest time ago.\n\nThis also contains a couple of other drive-by fixes:\n\n1. We arbitrarily raise the process count limit from 400 to 512 when Site Isolation is enabled.\n2. We stop prewarming processes if we're close to the process count limit.\n\nTests: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebContentProcessDidTerminate.mm\n\n* Source/WebKit/UIProcess/API/Cocoa/WKProcessPoolPrivate.h:\n* Source/WebKit/UIProcess/BrowsingContextGroup.cpp:\n(WebKit::BrowsingContextGroup::hasVisiblePage const):\n* Source/WebKit/UIProcess/BrowsingContextGroup.h:\n* Source/WebKit/UIProcess/ProvisionalFrameProxy.cpp:\n(WebKit::ProvisionalFrameProxy::ProvisionalFrameProxy):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::leastRecentlyVisiblePages):\n(WebKit::leastRecentlyHiddenPages):\n(WebKit::m_pageForTesting):\n(WebKit::WebPageProxy::close):\n(WebKit::WebPageProxy::loadRequestWithNavigationShared):\n(WebKit::WebPageProxy::loadFile):\n(WebKit::WebPageProxy::loadDataWithNavigationShared):\n(WebKit::WebPageProxy::loadSimulatedRequest):\n(WebKit::WebPageProxy::loadAlternateHTML):\n(WebKit::WebPageProxy::reload):\n(WebKit::WebPageProxy::goToBackForwardItem):\n(WebKit::WebPageProxy::sendGoToBackForwardItemForFrame):\n(WebKit::WebPageProxy::dispatchActivityStateChange):\n(WebKit::WebPageProxy::leastRecentlyVisiblePageToUnload):\n(WebKit::WebPageProxy::viewIsBecomingVisible):\n(WebKit::WebPageProxy::viewIsBecomingInvisible):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebProcessCache.cpp:\n(WebKit::WebProcessCache::canCacheProcess const):\n* Source/WebKit/UIProcess/WebProcessPool.cpp:\n(WebKit::WebProcessPool::prewarmProcess):\n(WebKit::WebProcessPool::didReachGoodTimeToPrewarm):\n(WebKit::WebProcessPool::reclaimIdleProcesses):\n(WebKit::WebProcessPool::handleMemoryPressureWarning):\n(WebKit::WebProcessPool::hasAnyProcessPoolUsedSiteIsolation):\n(WebKit::WebProcessPool::processForNavigation):\n* Source/WebKit/UIProcess/WebProcessPool.h:\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::maxProcessCount):\n(WebKit::WebProcessProxy::setProcessCountLimit):\n(WebKit::WebProcessProxy::runningProcessCount):\n(WebKit::WebProcessProxy::isNearingProcessCountLimit):\n(WebKit::WebProcessProxy::hasReachedProcessCountLimit):\n(WebKit::WebProcessProxy::didStartRunningProcess):\n(WebKit::WebProcessProxy::didStopRunningProcess):\n(WebKit::WebProcessProxy::create):\n(WebKit::WebProcessProxy::reclaimProcessesIfNeeded):\n(WebKit::WebProcessProxy::createForRemoteWorkers):\n(WebKit::WebProcessProxy::~WebProcessProxy):\n(WebKit::WebProcessProxy::addProvisionalPageProxy):\n(WebKit::WebProcessProxy::addRemotePageProxy):\n(WebKit::WebProcessProxy::shutDown):\n(WebKit::WebProcessProxy::addExistingWebPage):\n(WebKit::WebProcessProxy::processDidTerminateOrFailedToLaunch):\n(WebKit::WebProcessProxy::didFinishLaunching):\n(WebKit::WebProcessProxy::establishRemoteWorkerContext):\n(WebKit::liveProcessesLRU): Deleted.\n(WebKit::WebProcessProxy::markProcessAsRecentlyUsed): Deleted.\n* Source/WebKit/UIProcess/WebProcessProxy.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, ProcessLimitUnloadsAllProcessesOfLeastRecentlyVisiblePage)):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebContentProcessDidTerminate.mm:\n(TEST(WKNavigation, WebProcessLimit)):\n(TEST(WKNavigation, WebProcessLimitPrefersUnloadingNonVisiblePages)):\n\nCanonical link: https://commits.webkit.org/319408@main", "email": "nham@apple.com", "hash": "7d93638aae8d51aacdd521d4311aff523dcdc1b6", "subject": "Make process count limiter work better with Site Isolation" }, "319409@main": { "author": "Patrick Griffis", "avatar": "https://www.gravatar.com/avatar/2233c3a857004b126158572af9fe36f7?d=identicon\u0026s=64", "cl": "319409@main", "clUrl": "https://commits.webkit.org/319409@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322030\n\nReviewed by Alex Christensen.\n\nFetchOptions::encodePersistent() writes destination as its raw value, and says\nthat changes to its encoding should bump the NetworkCache Storage format\nversion. We can just avoid the change in order.\n\n* Source/WebCore/Modules/fetch/FetchRequestDestination.idl:\n* Source/WebCore/loader/FetchOptions.h:\n* Source/WebCore/loader/FetchOptionsDestination.h:\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n\nCanonical link: https://commits.webkit.org/319409@main", "email": "pgriffis@igalia.com", "hash": "3c7f0230afde14d2b886fd4236851a66580853d9", "subject": "Append CompressionDictionary to FetchOptionsDestination instead of inserting it" }, "319410@main": { "author": "Jer Noble", "avatar": "https://www.gravatar.com/avatar/6d2cde9be23b98223ca964cb3b7813a0?d=identicon\u0026s=64", "cl": "319410@main", "clUrl": "https://commits.webkit.org/319410@main", "description": "rdar://180057740\nhttps://bugs.webkit.org/show_bug.cgi?id=317430\n\nReviewed by Jean-Yves Avenard.\n\nISOBoxes and their subclasses are parsed representations of ISO-BMFF media data. In addition\nto reading these boxes from files and memory, we may also want to serialize these boxes to\nmemory, for features like mp4-file authoring and editing.\n\nAdd the ability to write a box (and all its children) to memory. Each box must be able to\ncalculate its own size, so there is a new pair of methods: `partialSize` and `requiredSize`.\nBase ISOBoxes boxes need their subclasses' sizes to be fully calculated, hence the split\nbetween the two functions. Also add a `serialize` and virtual `write` method, and a convenience\ntemplate `checkedReadSequence` and `checkedWriteSequence` to support reading and writing\ndata arrays.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/ISOBox.cpp\n\n* Source/WebCore/platform/graphics/iso/ISOBox.cpp:\n(WebCore::ISOBox::ISOBox):\n(WebCore::ISOBox::peekBox):\n(WebCore::ISOBox::read):\n(WebCore::ISOBox::updateSize):\n(WebCore::ISOBox::partialSize const):\n(WebCore::ISOBox::requiredSize const):\n(WebCore::ISOBox::parse):\n(WebCore::ISOBox::write const):\n(WebCore::ISOBox::serialize const):\n(WebCore::ISOFullBox::ISOFullBox):\n(WebCore::ISOFullBox::parse):\n(WebCore::ISOFullBox::write const):\n(WebCore::ISOFullBox::parseVersionAndFlags):\n* Source/WebCore/platform/graphics/iso/ISOBox.h:\n(WebCore::ISOBox::checkedRead):\n(WebCore::ISOBox::checkedReadSequence):\n(WebCore::ISOBox::checkedWrite):\n(WebCore::ISOBox::checkedWriteSequence):\n(WebCore::ISOFullBox::setVersion):\n(WebCore::ISOFullBox::setFlags):\n* Source/WebCore/platform/graphics/iso/ISOOriginalFormatBox.cpp:\n(WebCore::ISOOriginalFormatBox::ISOOriginalFormatBox):\n(WebCore::ISOOriginalFormatBox::parse):\n* Source/WebCore/platform/graphics/iso/ISOOriginalFormatBox.h:\n* Source/WebCore/platform/graphics/iso/ISOProtectionSchemeInfoBox.cpp:\n(WebCore::ISOProtectionSchemeInfoBox::ISOProtectionSchemeInfoBox):\n(WebCore::ISOProtectionSchemeInfoBox::parse):\n(WebCore::ISOProtectionSchemeInfoBox::updateSize):\n(WebCore::ISOProtectionSchemeInfoBox::partialSize const):\n* Source/WebCore/platform/graphics/iso/ISOProtectionSchemeInfoBox.h:\n* Source/WebCore/platform/graphics/iso/ISOProtectionSystemSpecificHeaderBox.cpp:\n(WebCore::ISOProtectionSystemSpecificHeaderBox::commonSystemID const):\n(WebCore::ISOProtectionSystemSpecificHeaderBox::ISOProtectionSystemSpecificHeaderBox):\n(WebCore::ISOProtectionSystemSpecificHeaderBox::peekSystemID):\n(WebCore::ISOProtectionSystemSpecificHeaderBox::parse):\n(WebCore::ISOProtectionSystemSpecificHeaderBox::parseData):\n(WebCore::ISOProtectionSystemSpecificHeaderBox::write const):\n(WebCore::ISOProtectionSystemSpecificHeaderBox::writeData const):\n(WebCore::ISOProtectionSystemSpecificHeaderBox::partialSize const):\n* Source/WebCore/platform/graphics/iso/ISOProtectionSystemSpecificHeaderBox.h:\n* Source/WebCore/platform/graphics/iso/ISOSchemeInformationBox.cpp:\n(WebCore::ISOSchemeInformationBox::ISOSchemeInformationBox):\n(WebCore::ISOSchemeInformationBox::parse):\n(WebCore::ISOSchemeInformationBox::updateSize):\n(WebCore::ISOSchemeInformationBox::partialSize const):\n* Source/WebCore/platform/graphics/iso/ISOSchemeInformationBox.h:\n* Source/WebCore/platform/graphics/iso/ISOSchemeTypeBox.cpp:\n(WebCore::ISOSchemeTypeBox::ISOSchemeTypeBox):\n(WebCore::ISOSchemeTypeBox::parse):\n* Source/WebCore/platform/graphics/iso/ISOSchemeTypeBox.h:\n* Source/WebCore/platform/graphics/iso/ISOTrackEncryptionBox.cpp:\n(WebCore::ISOTrackEncryptionBox::ISOTrackEncryptionBox):\n(WebCore::ISOTrackEncryptionBox::parse):\n(WebCore::ISOTrackEncryptionBox::parsePayload):\n* Source/WebCore/platform/graphics/iso/ISOTrackEncryptionBox.h:\n* Source/WebCore/platform/graphics/iso/ISOVTTCue.cpp:\n(WebCore::ISOWebVTTCue::ISOWebVTTCue):\n* Source/WebCore/platform/graphics/iso/ISOVTTCue.h:\n* Tools/TestWebKitAPI/Tests/WebCore/ISOBox.cpp:\n(TestWebKitAPI::TEST(ISOBox, ISOFairPlayStreamingPsshBox)):\n(TestWebKitAPI::serializeBox):\n(TestWebKitAPI::TEST(ISOBox, FairPlay_KeyRequestInfoBox_Write)):\n(TestWebKitAPI::TEST(ISOBox, FairPlay_KeyRequestInfoBox_Roundtrip)):\n(TestWebKitAPI::TEST(ISOBox, FairPlay_InfoBox_Write)):\n(TestWebKitAPI::TEST(ISOBox, FairPlay_InfoBox_Roundtrip)):\n(TestWebKitAPI::TEST(ISOBox, FairPlay_KeyAssetIdBox_ParseAndRewrite)):\n(TestWebKitAPI::TEST(ISOBox, FairPlay_KeyRequestBox_WriteWithFkriOnly)):\n(TestWebKitAPI::TEST(ISOBox, FairPlay_KeyRequestBox_RoundtripWithAssetId)):\n(TestWebKitAPI::TEST(ISOBox, FairPlay_InitDataBox_WriteAndRoundtrip)):\n(TestWebKitAPI::TEST(ISOBox, FairPlay_PsshBox_ParseWriteParseRoundtrip)):\n(TestWebKitAPI::TEST(ISOBox, PsshBox_V1_PartialSizeIncludesSystemIDAndDataSize)):\n\nCanonical link: https://commits.webkit.org/319410@main", "email": "jer.noble@apple.com", "hash": "6446fdc8e0be049f61e48d8beb8556ee8e2e1009", "subject": "Support writing ISOBoxes as well as reading/parsing" }, "319411@main": { "author": "Taher Ali", "avatar": "https://www.gravatar.com/avatar/e104800647d8c98b8c9dbe736b5e1751?d=identicon\u0026s=64", "cl": "319411@main", "clUrl": "https://commits.webkit.org/319411@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320910\nrdar://183940963\n\nReviewed by Simon Fraser.\n\nFlips SVGExternalResourcesEnabled from preview to stable.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/319411@main", "email": "taher_ali@apple.com", "hash": "d8ad5b5f9a30238fc3efd0471b09b4168fff1dc8", "subject": "Enable SVG external resources by default" }, "319412@main": { "author": "Kiet Ho", "avatar": "https://www.gravatar.com/avatar/d9058b37006dce1f55f91b8ccc82f9a3?d=identicon\u0026s=64", "cl": "319412@main", "clUrl": "https://commits.webkit.org/319412@main", "description": "rdar://183688843\nhttps://bugs.webkit.org/show_bug.cgi?id=320705\n\nReviewed by Tim Nguyen.\n\nThis patch implements parsing support for @supports named-feature().\nThe supported name features are hardcoded; it's expected that features\nwill be added rather sparingly (at most one or two yearly), and only\nwhen it's implemented in WebKit.\n\nTest: imported/w3c/web-platform-tests/css/css-conditional/at-supports-named-feature-001.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/at-supports-named-feature-001-expected.txt:\n - Test progression.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/at-supports-named-feature-001.html:\n - Add some invalid test cases.\n - Fix a bug where the test uses `Boolean.prototype.toString` to\n serialize a string, but that method returns \"false\" for every\n input, including `true`.\n\n* Source/WebCore/css/CSSValueKeywords.in:\n* Source/WebCore/css/parser/CSSSupportsParser.cpp:\n(WebCore::CSSSupportsParser::consumeSupportsFunction):\n(WebCore::CSSSupportsParser::consumeSupportsNamedFeatureFunction):\n* Source/WebCore/css/parser/CSSSupportsParser.h:\n\nCanonical link: https://commits.webkit.org/319412@main", "email": "kiet.ho@apple.com", "hash": "e7caeaf2119343d7c74b4673ff736c80298d9ae8", "subject": "[css-conditional-5] Support @supports named-feature()" }, "319413@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "319413@main", "clUrl": "https://commits.webkit.org/319413@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322011\nrdar://184545492\n\nReviewed by Eric Carlson.\n\nPlaying a trailer in the TV app on visionOS and then opening a page carrying an\nautoplaying video paused the trailer, and it did not resume.\n\nFollowing 317782@main, void MediaSessionManagerInterface::sessionCanProduceAudioChanged() unconditionally called maybeActivateAudioSession() synchronously;\nWhen the element was first loaded, and not yet known to have audible content,\nit was allowed to play and the MediaSession state became Playing,\nshortly after when the metadata was loaded and readyState moved to HAVE_METADATA\n(having canProduceAudio() now returning true but not yet actually audible\nhaving not loaded any content to render), maybeActivateAudioSession() activated\nthe AudioSession only to then immediately deny playback and pause the video.\nThis caused any other application currently playing audio on visionOS or iPadOS to be paused.\n\nThe audio session is now activated only for a session whose client would be\nallowed to begin playing. PlatformMediaSessionInterface gains playbackPermitted(),\ndefaulting to true so that AudioContext, MediaSession and MediaStream sessions are\nunaffected, and MediaElementSession answers it with\nplaybackStateChangePermitted(MediaPlaybackState::Playing).\nMediaSessionManagerInterface::audioSessionActivationRequired() is\nactiveAudioSessionRequired() plus that condition and is consulted only by\nmaybeActivateAudioSession(). maybeDeactivateAudioSession() keeps using\nactiveAudioSessionRequired(): the permission is state-dependent and can be false\nfor a session that is legitimately playing, and deactivation must stay\nconservative.\n\nAsserting that no activation happened needs the GPU process's view, as a web\nprocess's own AudioSession reports the state it asked for and reports it\noptimistically. AudioSession counts transitions from inactive to active, and the\ncount is readable through internals.systemAudioSessionActivationCount(), plumbed\nthe way systemAudioSessionCategory() already is.\n\n* LayoutTests/fast/harness/internals-object-property-access-on-window-without-frame-crash.html:\nSkip the new internals function, which sends IPC behind AllowTestOnlyIPC that this test does not set.\n* LayoutTests/media/audio-session-not-activated-for-denied-audible-element-expected.txt: Added.\n* LayoutTests/media/audio-session-not-activated-for-denied-audible-element.html: Added.\n* LayoutTests/media/audio-session-not-activated-when-unmuting-denied-element-expected.txt: Added.\n* LayoutTests/media/audio-session-not-activated-when-unmuting-denied-element.html: Added.\n* LayoutTests/platform/glib/TestExpectations: Skip both, no USE(AUDIO_SESSION) support.\n* Source/WebCore/html/MediaElementSession.h:\n* Source/WebCore/platform/audio/AudioSession.cpp:\n(WebCore::AudioSession::tryToSetActive): Count activations.\n* Source/WebCore/platform/audio/AudioSession.h:\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.cpp:\n(WebCore::MediaSessionManagerInterface::audioSessionActivationRequired const): Added.\n(WebCore::MediaSessionManagerInterface::maybeActivateAudioSession): Use it.\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.h:\n* Source/WebCore/platform/audio/PlatformMediaSessionInterface.h:\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::systemAudioSessionActivationCount): Added.\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\n* Source/WebKit/GPUProcess/media/RemoteAudioSessionProxy.cpp:\n(WebKit::RemoteAudioSessionProxy::systemActivationCountForTesting): Added.\n* Source/WebKit/GPUProcess/media/RemoteAudioSessionProxy.h:\n* Source/WebKit/GPUProcess/media/RemoteAudioSessionProxy.messages.in:\n* Source/WebKit/WebProcess/GPU/media/RemoteAudioSession.cpp:\n(WebKit::RemoteAudioSession::systemActivationCountForTesting): Added.\n* Source/WebKit/WebProcess/GPU/media/RemoteAudioSession.h:\n\nCanonical link: https://commits.webkit.org/319413@main", "email": "jya@apple.com", "hash": "7fa5ab54bb881f1ea530ff0e36e1a35e1c55f6ad", "subject": "REGRESSION(317782@main) An audible video element that will not be allowed to play can interrupt play in another app" }, "319414@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "319414@main", "clUrl": "https://commits.webkit.org/319414@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321523\nrdar://184633468\n\nReviewed by Basuke Suzuki.\n\nIn 317835@main I thought there was no way to get a sec_protocol_metadata_t from a\nnw_protocol_metadata_t for WebTransport, so I introduced SecurityProtocolMetadata\nto get it from the TLS handshake and I was going to introduce a new function\nnw_webtransport_metadata_copy_sec_protocol_metadata to get it directly. In my review\nfeedback, I was informed that there's already a way to get the sec_protocol_metadata_t.\nIt's different if WebTransport is using H2 or H3, but it works both ways.\n\nI introduce a test that not only uses H2 with WebTransport for the first time in\nWebKit's tests, but it also generates keying material on the server to verify that\nthe client and the server are able to generate the exact same bytes, which is the\nwhole point of exportKeyingMaterial but it's currently not tested in wpt.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebTransport.mm\n\n* Source/WebCore/PAL/pal/spi/cocoa/NetworkSPI.h:\n* Source/WebKit/Configurations/AllowedSPI.toml:\n* Source/WebKit/NetworkProcess/cocoa/NetworkSoftLink.h:\n* Source/WebKit/NetworkProcess/cocoa/NetworkSoftLink.mm:\n* Source/WebKit/NetworkProcess/webtransport/NetworkTransportSession.h:\n(WebKit::NetworkTransportSession::SecurityProtocolMetadata::create): Deleted.\n(WebKit::NetworkTransportSession::SecurityProtocolMetadata::receivedMetadata): Deleted.\n(WebKit::NetworkTransportSession::SecurityProtocolMetadata::metadata const): Deleted.\n* Source/WebKit/NetworkProcess/webtransport/cocoa/NetworkTransportSessionCocoa.mm:\n(WebKit::NetworkTransportSession::create):\n(WebKit::NetworkTransportSession::NetworkTransportSession):\n(WebKit::createParameters):\n(WebKit::NetworkTransportSession::securityMetadata const):\n(WebKit::NetworkTransportSession::exportKeyingMaterial):\n* Tools/TestWebKitAPI/Helpers/cocoa/NetworkConnection.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/NetworkConnection.mm:\n(TestWebKitAPI::securityMetadata):\n(TestWebKitAPI::ConnectionGroup::exportKeyingMaterial const):\n* Tools/TestWebKitAPI/Helpers/cocoa/WebTransportServer.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/WebTransportServer.mm:\n(TestWebKitAPI::WebTransportServer::WebTransportServer):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebTransport.mm:\n(TestWebKitAPI::ExportKeyingMaterial)):\n\nCanonical link: https://commits.webkit.org/319414@main", "email": "achristensen@apple.com", "hash": "c9ae060aa9149e96970697c86999a606d2505840", "subject": "Remove unneeded WebTransportSession::SecurityProtocolMetadata" }, "319415@main": { "author": "Marta Darbinyan", "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64", "cl": "319415@main", "clUrl": "https://commits.webkit.org/319415@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321961\nrdar://185147134\n\nUnreviewed test gardening\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319415@main", "email": "darbinyan@apple.com", "hash": "6be48a37ffa4cdae11d0d6e1c0915f7c5dfa8431", "subject": "[Gardening]: [ macOS Debug ] imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audionode-interface/audionode-channel-rules.html is a flaky crash" }, "319416@main": { "author": "Richard Houle", "avatar": "https://www.gravatar.com/avatar/64ec1f091d2532decfc923b092c697fd?d=identicon\u0026s=64", "cl": "319416@main", "clUrl": "https://commits.webkit.org/319416@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322036\nrdar://185228555\n\nReviewed by Alex Christensen.\n\nThis patch implements a version of WKWebView._hitTest(at:inFrameCoordinates:) that allows to specify a WKContentWorld.\n\n* Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm:\n(-[WKWebView _hitTestAtPoint:inFrameCoordinateSpace:completionHandler:]):\n(-[WKWebView _hitTestAtPoint:inFrameCoordinateSpace:inContentWorld:completionHandler:]):\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivate.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::hitTestAtPoint):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:\n(WebKit::createJSHandle):\n(WebKit::WebFrame::createAndPrepareToSendJSHandle const):\n* Source/WebKit/WebProcess/WebPage/WebFrame.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::hitTestAtPoint):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.messages.in:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, HitTesting)):\n(TestWebKitAPI::(SiteIsolation, HitTestingInContentWorld)):\n\nCanonical link: https://commits.webkit.org/319416@main", "email": "rhoule@apple.com", "hash": "505138f30b39ffb43f54c527f74f4ff408ba4240", "subject": "WKWebView._hitTest(at:inFrameCoordinates:) returns JSHandle that can only be used in the WKContentWorld.pageWorld" }, "319417@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "319417@main", "clUrl": "https://commits.webkit.org/319417@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=225430\nrdar://77587091\n\nReviewed by Alexey Proskuryakov.\n\nCFNetwork was missing counting a \\r\\n of the chunked response before, but now\nwith it correctly counts them. This also matches the value of the gtk test expectations.\n\n318278@main made it happen more reliably by using the same network loader for tests as our users use.\n\n* LayoutTests/platform/mac-site-isolation/TestExpectations:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n* LayoutTests/platform/mac/http/tests/inspector/network/resource-sizes-network-expected.txt:\n\nCanonical link: https://commits.webkit.org/319417@main", "email": "achristensen@apple.com", "hash": "95b5e1fc9cb8b6f4cf8236622cc19ad903fd07e2", "subject": "[ BigSur wk2 arm64 ] http/tests/inspector/network/resource-sizes-network.html is a flakey text failure" }, "319418@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "319418@main", "clUrl": "https://commits.webkit.org/319418@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320913\nrdar://183941470\n\nReviewed by Alex Christensen.\n\n318278@main turned the CFNetwork NW loader on unconditionally. For\nmultipart/x-mixed-replace it hands the network process the follow-up parts, their\ndata and the end of the load without waiting for the previous part's response\ncompletion handler, whose content-policy check is asynchronous\n(DocumentLoader::responseReceived() -\u003e checkContentPolicy() IPCs to the\nUIProcess).\n\n313118@main made NetworkResourceLoader tolerate the extra responses by queuing\nthe response completion handlers in a Deque instead of overwriting a single one,\nbut it kept forwarding every message to the WebProcess immediately. The\nWebProcess cannot process anything past a response it has not validated yet: a\nfollow-up response hits ASSERT(!m_waitingForContentPolicy) in\nDocumentLoader::responseReceived(), and a follow-up didFinishLoading() runs\nSubresourceLoader::didFinishLoading() through releaseResources(), which clears\nthe loader's identifier, so WebResourceLoader never sends\nContinueDidReceiveResponse and the load hangs.\n\nRe-serialize delivery, restoring the one-part-at-a-time semantics the legacy\nNSURLSession loader provided. didReceiveResponse() claims the pipeline via\nm_isProcessingResponse and wraps the completion handler so that it is released\nonce the response is resolved, which for a main resource is when the WebProcess\nanswers ContinueDidReceiveResponse. While the pipeline is claimed, every\nfollow-up message is held in m_deferredMessages, and it is replayed in order once\nthe response is released, stopping at the next response so it too waits.\n\nThe state is tracked explicitly rather than derived from\nm_responseCompletionHandlers for two reasons. didReceiveResponse() can take\nasynchronous steps before appending the handler (processClearSiteDataHeader()),\nand nothing may be delivered in that window. It also resolves responses without\nappending anything at all: when a main resource is blocked by CSP frame-ancestors\nor X-Frame-Options, by COOP/COEP, by NetworkLoadChecker::validateResponse(), by\ncontent filtering, or is dropped for keepalive, it answers PolicyAction::Ignore\nhaving sent no DidReceiveResponse. Messages queued behind such a response are\ndropped rather than replayed, so that WebContent is never handed the body of a\npart the network process just blocked, nor a DidReceiveData with no preceding\nDidReceiveResponse. Deferred messages are likewise dropped with\nPolicyAction::Ignore on teardown so their completion handlers are still answered,\nand the queue is bounded so a WebProcess that never answers cannot grow the\nnetwork process' memory without limit.\n\nThis is a workaround for the CFNetwork bug, so it is gated on the new\nHAVE(BROKEN_MULTIPART_RESPONSE_FLOW_CONTROL), on by default on COCOA ports. A\nFIXME points at rdar://185073080 to turn it off on platforms that have the\nCFNetwork fix.\n\nNothing outside multipart is affected: m_isProcessingResponse is false when those\nmessages arrive for subresources and for single-response loads.\n\nNo new tests, unskipped existing test.\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n* Source/WTF/wtf/PlatformHave.h:\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:\n(WebKit::NetworkResourceLoader::~NetworkResourceLoader):\n(WebKit::NetworkResourceLoader::convertToDownload):\n(WebKit::NetworkResourceLoader::didReceiveResponse):\n(WebKit::NetworkResourceLoader::didReceiveBuffer):\n(WebKit::NetworkResourceLoader::didFinishLoading):\n(WebKit::NetworkResourceLoader::didFailLoading):\n(WebKit::NetworkResourceLoader::continueDidReceiveResponse):\n(WebKit::NetworkResourceLoader::responseProcessingCompleted):\n(WebKit::NetworkResourceLoader::deliverDeferredMessages):\n(WebKit::NetworkResourceLoader::cancelDeferredMessages):\n(WebKit::NetworkResourceLoader::failDueToExcessiveDeferredMessages):\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.h:\n\nCanonical link: https://commits.webkit.org/319418@main", "email": "cdumez@apple.com", "hash": "cc7a6821b7cceb7cb9e2836a9dfc11a42691683a", "subject": "REGRESSION(318278@main?)[macOS]: ASSERTION FAILED: !m_waitingForContentPolicy /Volumes/Data/worker/Apple-Tahoe-Debug-Build/build/Source/WebCore/loader/DocumentLoader.cpp" }, "319419@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "319419@main", "clUrl": "https://commits.webkit.org/319419@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322054\nrdar://185245662\n\nReviewed by Dan Hecht.\n\nBasically applying the similar optimization to 318347@main. Let's avoid\nlexing int32 value twice in the fast path.\n\n* Source/JavaScriptCore/runtime/LiteralParser.cpp:\n(JSC::reviverMode\u003e::Lexer::lexNumber):\n\nCanonical link: https://commits.webkit.org/319419@main", "email": "ysuzuki@apple.com", "hash": "a7a9e233ce5453340b20c2023be0793de4811e21", "subject": "[JSC] JSON.parse int32 lexing should not repeat int32 materialization again" }, "319420@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "319420@main", "clUrl": "https://commits.webkit.org/319420@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322048\nrdar://185243612\n\nReviewed by Sosuke Suzuki.\n\nThis patch introduces deferred Array materialization mechanism in JSON.parse.\nInstead of placing an element each time, we push it to the stack, and we\nmaterialize Array at the end of Array literal. This stack is used for\narrays nested way, so when materializing, we use the slice between\n[stackBase, end). This avoids growing and reallocating butterflies,\nwhich reduces wasted allocation during JSON.parse.\n\nAlso we do drive-by fixes,\n\n1. MarkedVector::append ends up calling slowAppend after it gets\n mallocBase(). This is inefficient and not correct. We should do it\n only when (1) expanding capacity or (2) newly registering a\n m_markSet.\n2. Accessing outOfLineCapacity requires some additional loads. But we do\n not need to care about it when offset is not reaching to\n firstOutOfLineOffset. Let's avoid loading them.\n\nTest: JSTests/stress/json-parse-array-materialization.js\n\n* JSTests/stress/json-parse-array-materialization.js: Added.\n(shouldBe):\n(shouldThrow):\n(Array.isArray):\n* Source/JavaScriptCore/runtime/LiteralParser.cpp:\n(JSC::reviverMode\u003e::materializeArray):\n(JSC::requires):\n* Source/JavaScriptCore/runtime/LiteralParser.h:\n* Source/JavaScriptCore/runtime/MarkedVector.h:\n(JSC::MarkedVector::append):\n\nCanonical link: https://commits.webkit.org/319420@main", "email": "ysuzuki@apple.com", "hash": "218421554bbbf1b029d2cd2a0484fce36a46d5dd", "subject": "[JSC] Defer Array materialization in JSON.parse" }, "319421@main": { "author": "Marcos Caceres", "avatar": "https://www.gravatar.com/avatar/d31c9c6a3b0af558a2945682020e5b90?d=identicon\u0026s=64", "cl": "319421@main", "clUrl": "https://commits.webkit.org/319421@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=313736\nrdar://182678875\n\nReviewed by Pascoe.\n\nA credential request's promise is now settled from a queued task, as the spec requires. It\nused to settle straight away, or from inside the picker's dismissal callback. The promise,\nthe abort signal and the abort algorithm also move off the per-page coordinator and onto a\nnew DigitalCredentialsSession, which belongs to the document that asked for the credential.\nThe coordinator said it was an ActiveDOMObject, but it is created before the main frame has\na document, so it was never really registered as one. That meant nothing told it when a\ndocument was stopped or suspended, which is why get-non-fully-active.https.html kept\nfailing (webkit.org/b/317884). Its mac-wk2 and ios expectations are removed.\n\nWhen the picker returns an answer we no longer ask it to dismiss, because it dismisses\nitself in the same call. The abort path still asks it to, since nothing there guarantees the\npicker is gone before the promise settles. There is no test for a document that is suspended\nand then destroyed. This also stops the picker reporting a good response twice.\n\nCanonical link: https://commits.webkit.org/319421@main", "email": "marcosc@apple.com", "hash": "04257c5b705566a06a8b9877caec36eeac51588d", "subject": "Digital Credentials: reject and resolve paths must queue a global task per spec" }, "319422@main": { "author": "Sam Weinig", "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64", "cl": "319422@main", "clUrl": "https://commits.webkit.org/319422@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322002\n\nReviewed by Darin Adler.\n\nFixes crash that happens when a StyleSingleAnimationRange's offset is a\ncalc value and the Animation.rangeStart or Animation.rangeEnd getters are\ncalled. The code was unconditionally accessing the result of tryPercentage()\nwhich returns std::nullopt in the calc case. To fix this, we use the switchOn\nform to ensure all alternatives are handled.\n\nTest: fast/animation/css-animation-range-calc-crash.html\n* LayoutTests/fast/animation/css-animation-range-calc-crash-expected.txt: Added.\n* LayoutTests/fast/animation/css-animation-range-calc-crash.html: Added.\n* Source/WebCore/style/values/animations/StyleSingleAnimationRange.cpp:\n\nCanonical link: https://commits.webkit.org/319422@main", "email": "sam@webkit.org", "hash": "55c608d2b1b46d1ac0b40d093a8c6b5a69c16907", "subject": "[scroll-animations] crash in `WebAnimation::bindingsRangeStart()`" }, "319423@main": { "author": "Wenson Hsieh", "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64", "cl": "319423@main", "clUrl": "https://commits.webkit.org/319423@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322061\nrdar://185254024\n\nReviewed by Abrar Rahman Protyasha.\n\nAdjust the string replacement heuristics for text extractions, such that it only redacts text if it\nspans word boundaries, in order to limit false positives (which may actually cause us to indirectly\nand unintentionally leak information, which the agent would not have otherwise observed).\n\nTest: TextExtractionTests.ReplacementStringsWordBoundaries\n\n* Source/WebKit/Shared/TextExtractionToStringConversion.cpp:\n(WebKit::isWordCharacter):\n(WebKit::anchorsToWordBoundary):\n(WebKit::matchIsWordBounded):\n(WebKit::applyReplacements):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:\n(TestWebKitAPI::TEST(TextExtractionTests, ReplacementStringsWordBoundaries)):\n\nCanonical link: https://commits.webkit.org/319423@main", "email": "wenson_hsieh@apple.com", "hash": "9d44026b876f9914a02c641007b9ebbe75999ce6", "subject": "[Text Extraction] Limit `replacementStrings` substitutions to word boundaries (to reduce false positives when redacting PII)" }, "319424@main": { "author": "Yury Semikhatsky", "avatar": "https://www.gravatar.com/avatar/d0aee26d9689e84bd1a7f0ed8f262fe1?d=identicon\u0026s=64", "cl": "319424@main", "clUrl": "https://commits.webkit.org/319424@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322068\n\nReviewed by Michael Catanzaro.\n\nnce an authentication challenge has been answered for a host, libsoup's\nSoupAuthManager stamps the cached credentials onto every later request in that\nprotection space, replacing an Authorization header the page had set itself.\nThe Fetch standard uses the cached credential only \"If httpRequest's header\nlist does not contain `Authorization`\", and the Cocoa and curl ports already\nbehave that way.\n\nSet SOUP_MESSAGE_DO_NOT_USE_AUTH_CACHE, libsoup's per-message opt-out, when the\nrequest already carries an Authorization header. A challenge still reaches the\nauthentication handler and the retry authenticates as before.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestAuthentication.cpp\n\n* Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp:\n(WebKit::NetworkDataTaskSoup::createRequest):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestAuthentication.cpp:\n(testWebViewAuthenticationPageProvidedAuthorizationHeader):\n(serverCallback):\n(beforeAll):\n\nCanonical link: https://commits.webkit.org/319424@main", "email": "yurys@chromium.org", "hash": "f76f30efcb689ec60174addc19d38b9150b67c69", "subject": "[SOUP] An Authorization header set by the page is replaced by cached credentials" }, "319425@main": { "author": "Sean Patterson", "avatar": "https://www.gravatar.com/avatar/b19318d92b64ac7809b78670c03b0f1e?d=identicon\u0026s=64", "cl": "319425@main", "clUrl": "https://commits.webkit.org/319425@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321051\nrdar://175191840\n\nReviewed by Matt Woodrow.\n\nScrollingTree keeps two active node sets, m_activePositionedNodes and\nm_activeOverflowScrollProxyNodes, which hold Ref\u003c\u003e. Their only cleanup was a\nframe-scoped removeIf in commitTreeStateInternal() that drops entries whose\nframeIdentifier() matches the committing frame.\n\nA node removed without its owning frame committing therefore leaked into those\nsets permanently: the Ref keeps it alive while nodeForID() can no longer\nresolve it. establishLayerTreeScrollingRelations() then walked the stale entry\nand failed MESSAGE_CHECK_BASE. Under site isolation WebPageProxy sets\nsetShouldCrashOnMessageCheckFailure(true), so this terminated the UI process\nrather than the web process.\n\nThe dominant path is hosted subtree teardown: every node in a hosted subtree is\nregistered as a hosted child, and ScrollingTreeFrameHostingNode::\nremoveHostedChildren() calls removeNode() for each one without the committing\nframe ever being the iframe's own frame. Removing a cross-origin iframe,\nnavigating it cross-origin, or committing it empty all reach this.\n\nAdd ScrollingTree::removeFromActiveNodes(), called from removeNode(). It drops\nthe removed node itself, and also any active node that *references* a removed\noverflow scrolling node -- the latter is what the failing check actually reads,\nsince it resolves the proxy's overflowScrollingNodeID() rather than the proxy\nitself. removeAllNodes() clears both sets outright.\n\nTwo supporting changes were needed to make this testable at all:\n\n- The active sets are only dumped under ScrollingStateTreeAsTextBehavior::\n IncludeNodeIDs, which no test-reachable API passed. Add\n scrollingTreeIncludingNodeIDsAsText() -\u003e\n -[WKWebView _scrollingTreeIncludingNodeIDsAsText] -\u003e\n uiController.scrollingTreeIncludingNodeIDsAsText.\n\n- That dump sat inside #if ENABLE(SCROLLING_THREAD), which is mac-only, while\n both sets are declared and populated unconditionally. Remove the guard so the\n state is observable everywhere; without this the new layout test is a\n permanent no-op off mac. The unrelated SCROLLING_THREAD guard around\n synchronousScrollingNodes is left alone.\n\nNote a single-process layout test cannot cover this: removing content from the\nframe that owns the nodes makes that frame commit, so the frame-scoped removeIf\ncleans up correctly. The test uses a cross-origin iframe so the removal happens\nwith no commit from the iframe's process.\n\nBoth tests were verified in both directions -- they pass with the fix and crash\nwithout it. (On Release a MESSAGE_CHECK_BASE failure calls CRASH(), since\nCRASH_IF_TESTING is only compiled out under ENABLE(IPC_TESTING_API).) Also\nverified against the live repro: saratogasun.com -\u003e Obituaries in a private\nwindow with site isolation on crashed twice before the fix and survived eight\nnavigation cycles after.\n\n* LayoutTests/http/tests/site-isolation/scrolling/remove-iframe-with-active-scroll-proxy-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/scrolling/remove-iframe-with-active-scroll-proxy.html: Added.\n* LayoutTests/http/tests/site-isolation/scrolling/resources/scroll-proxy-iframe.html: Added.\n* Source/WebCore/page/scrolling/ScrollingTree.cpp:\n(WebCore::ScrollingTree::removeNode):\n(WebCore::ScrollingTree::removeFromActiveNodes):\n(WebCore::ScrollingTree::removeAllNodes):\n(WebCore::ScrollingTree::scrollingTreeAsText):\n* Source/WebCore/page/scrolling/ScrollingTree.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivateForTesting.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewTesting.mm:\n(-[WKWebView _scrollingTreeIncludingNodeIDsAsText]):\n* Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.cpp:\n(WebKit::RemoteScrollingCoordinatorProxy::scrollingTreeIncludingNodeIDsAsText const):\n* Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.h:\n* Tools/TestRunnerShared/UIScriptContext/Bindings/UIScriptController.idl:\n* Tools/TestRunnerShared/UIScriptContext/UIScriptController.h:\n(WTR::UIScriptController::scrollingTreeIncludingNodeIDsAsText const):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::TEST(SiteIsolation, RemoveIframeWithActiveScrollProxyNodes)):\n* Tools/WebKitTestRunner/cocoa/UIScriptControllerCocoa.h:\n* Tools/WebKitTestRunner/cocoa/UIScriptControllerCocoa.mm:\n(WTR::UIScriptControllerCocoa::scrollingTreeIncludingNodeIDsAsText const):\n\nCanonical link: https://commits.webkit.org/319425@main", "email": "sean_patterson@apple.com", "hash": "4a0a8eee54a492f3059110adfb08ed46ba356f5e", "subject": "[Site isolation] Stale ScrollingTree active nodes crash the UI process in establishLayerTreeScrollingRelations()" }, "319426@main": { "author": "Sam Weinig", "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64", "cl": "319426@main", "clUrl": "https://commits.webkit.org/319426@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322039\n\nReviewed by Darin Adler.\n\nRemove a few unused overloads that take CSSToLengthConversionData.\n\n* Source/WebCore/style/values/color/StyleColor.cpp:\n* Source/WebCore/style/values/color/StyleColor.h:\n* Source/WebCore/style/values/primitives/StyleLengthResolution.cpp:\n* Source/WebCore/style/values/primitives/StyleLengthResolution.h:\n\nCanonical link: https://commits.webkit.org/319426@main", "email": "sam@webkit.org", "hash": "7247fcb1ca9690c80edd9cba7cbe915418987484", "subject": "[Cleanup] Remove unused overloads that take CSSToLengthConversionData" }, "319427@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "319427@main", "clUrl": "https://commits.webkit.org/319427@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321692\n\nReviewed by Keith Miller.\n\nThe type field on WebAssembly.Module.imports and exports descriptors\ncomes from the unfinished js-types proposal, not the core JS API.\nPrototype type() methods are already behind Options::useWasmJSTypes\n(default false). Gate the remaining surface the same way so default\ndescriptors match the standard shape and do not throw on unrepresentable\nref types.\n\n* Source/JavaScriptCore/wasm/js/WebAssemblyModuleConstructor.cpp:\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* JSTests/wasm/js-api/Module.exports.js:\n* JSTests/wasm/js-api/Module.imports.js:\n* JSTests/wasm/js-api/Module.imports-exports-no-type.js: Added.\n* JSTests/wasm/js-api/type-reflection-concrete-types.js:\n* JSTests/wasm/js-api/type-reflection-exports.js:\n* JSTests/wasm/js-api/type-reflection-imports.js:\n* JSTests/wasm/stress/table-oversized-initial-reflection.js:\n\nCanonical link: https://commits.webkit.org/319427@main", "email": "chi187@gmail.com", "hash": "010e57fb4b9313bfec1d36d9d1ddfaf19f215002", "subject": "[JSC] Gate Module.imports/exports type field behind useWasmJSTypes" }, "319428@main": { "author": "Jessica Cheung", "avatar": "https://www.gravatar.com/avatar/5c102f093ce6bc01424466a4cfdf1d1f?d=identicon\u0026s=64", "cl": "319428@main", "clUrl": "https://commits.webkit.org/319428@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322049\nrdar://185243406\n\nReviewed by Wenson Hsieh and Aditya Keerthi.\n\nAdd more comprehensive layout tests that cover this case:\n- Starting from a page with a non-default interactive-widget\nvalue, then navigating to a page that does not specify any\ninteractive-widget value. In this case, the page should revert\nto default resizes-visual behavior instead of having a stale\nvalue while ensuring the previous page had the correct\nnon-default value behavior.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/http/tests/visual-viewport/ios/interactive-widget/overlays-content-process-swap-navigation-reset-expected.txt: Added.\n* LayoutTests/http/tests/visual-viewport/ios/interactive-widget/overlays-content-process-swap-navigation-reset.html: Added.\n* LayoutTests/http/tests/visual-viewport/ios/interactive-widget/resizes-content-process-swap-navigation-reset-expected.txt: Added.\n* LayoutTests/http/tests/visual-viewport/ios/interactive-widget/resizes-content-process-swap-navigation-reset.html: Added.\n* LayoutTests/http/tests/visual-viewport/ios/interactive-widget/resources/no-interactive-widget-after-overlays-content.html: Added.\n* LayoutTests/http/tests/visual-viewport/ios/interactive-widget/resources/no-interactive-widget-after-resizes-content.html: Added.\n* LayoutTests/platform/ios/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319428@main", "email": "jcheung23@apple.com", "hash": "659a232072da77997988099d907b528b08e0dd8a", "subject": "[interactive-widget] Add navigation related layout tests" }, "319429@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "319429@main", "clUrl": "https://commits.webkit.org/319429@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=296371\n\nReviewed by Yusuke Suzuki.\n\nStack overflow during JS-to-Wasm or Wasm-to-JS can invoke\noperationWasmToJSException while DECLARE_WASM_CALL_FRAME still points at\na JS callee. Debug then called asNativeCallee() and crashed.\n\nSkip the callee-group check unless the frame is a NativeCallee.\n\n* JSTests/wasm/stress/js-callee-stack-overflow.js: Added.\n* Source/JavaScriptCore/wasm/WasmOperations.cpp:\n(JSC::Wasm::assertCalleeIsReferenced):\n\nCanonical link: https://commits.webkit.org/319429@main", "email": "chi187@gmail.com", "hash": "4cc12fa76b1f68595032ab541295f237462665e6", "subject": "[JSC][Wasm] Don't assert NativeCallee on JS frames in wasm exception paths" }, "319430@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "319430@main", "clUrl": "https://commits.webkit.org/319430@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=283476\n\nReviewed by Yusuke Suzuki.\n\nWhen multiple functions fail validation under concurrent compilation,\nkeep the error message for the lowest function index instead of\nwhichever worker finishes first. Function-scoped failures record the\nerror without completing the plan immediately so later lower-index\nfailures can replace it. Non-function failures such as OOM are not\nreplaced by later function errors. EntryPlan stops assigning more work\nand ThreadCountHolder completes when active workers drain.\n\n* Source/JavaScriptCore/wasm/WasmPlan.h:\n* Source/JavaScriptCore/wasm/WasmPlan.cpp:\n* Source/JavaScriptCore/wasm/WasmEntryPlan.h:\n* Source/JavaScriptCore/wasm/WasmEntryPlan.cpp:\n* Source/JavaScriptCore/wasm/WasmIPIntPlan.cpp:\n* JSTests/wasm/stress/consistent-compile-error-function-index.js: Added.\n\nCanonical link: https://commits.webkit.org/319430@main", "email": "chi187@gmail.com", "hash": "b7afce9416a9ef663661eb59613768529ea65101", "subject": "[JSC][Wasm] Prefer lowest function index for concurrent CompileError" }, "319431@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "319431@main", "clUrl": "https://commits.webkit.org/319431@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=261640\n\nReviewed by Sosuke Suzuki.\n\nTypeKind mixed value types with type-section forms (func, struct, array,\nrec, sub, subfinal). Those are not value types, so every TypeKind switch\nneeded dummy cases for them. Move them to DefinedTypeKind and dispatch\nthe type section on that enum.\n\n* Source/JavaScriptCore/wasm/wasm.json:\n* Source/JavaScriptCore/wasm/generateWasm.py:\n* Source/JavaScriptCore/wasm/generateWasmOpsHeader.py:\n* Source/JavaScriptCore/wasm/WasmSectionParser.cpp:\n* Source/JavaScriptCore/wasm/WasmTypeDefinition.h:\n* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:\n* Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp:\n* Source/JavaScriptCore/wasm/WasmBBQJIT64.h:\n* Source/JavaScriptCore/wasm/WasmOperations.cpp:\n* Source/JavaScriptCore/wasm/js/WasmToJS.cpp:\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyStruct.cpp:\n* JSTests/wasm/wasm.json:\n* JSTests/wasm/WASM.js:\n* LayoutTests/resources/wasm-builder.js:\n* LayoutTests/http/tests/security/contentSecurityPolicy/resources/wasm-builder.js:\n* LayoutTests/storage/indexeddb/resources/wasm-exceptions.js:\n* LayoutTests/workers/wasm-references/test.js:\n* LayoutTests/workers/wasm-resources/long-compile-worker.js:\n\nCanonical link: https://commits.webkit.org/319431@main", "email": "chi187@gmail.com", "hash": "76b474b3225c59cd3c31f39d5eed60a63a084a3d", "subject": "[JSC][Wasm] Split type definitions out of TypeKind" }, "319432@main": { "author": "Diego Pino Garcia", "avatar": "https://www.gravatar.com/avatar/e8cce88637f1a6e79155e8371e24b2e8?d=identicon\u0026s=64", "cl": "319432@main", "clUrl": "https://commits.webkit.org/319432@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=213874\n\nReviewed by Patrick Griffis.\n\nGLIB ports have a custom implementation for increment/decrement actions,\nwhich directly sets a value on the underlying backing object.\n\nOn the other hand, macOS and iOS ports use the increment/decrement methods\nprovided by 'AccessibilityNodeObject'. These operations are more complex than\nsimply updating the value of the backing object (for instance, in the case of\na slider, a keyboard event is emitted instead).\n\nThe test hangs on GLIB ports because their current implementation never emits\nthis keyboard event.\n\nSince increment/decrement live in 'AccessibilityNodeObject', this patch modifies\nthe GLIB implementation to reuse the same general implementation used by the\nmacOS and iOS ports, which fixes the timeout in the targetting tests.\n\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.h:\n* Source/WebCore/accessibility/atspi/AccessibilityObjectValueAtspi.cpp:\n(WebCore::AccessibilityObjectAtspi::increment):\n(WebCore::AccessibilityObjectAtspi::decrement):\n* Tools/WebKitTestRunner/InjectedBundle/atspi/AccessibilityUIElementAtspi.cpp:\n(WTR::AccessibilityUIElementAtspi::increment):\n(WTR::AccessibilityUIElementAtspi::decrement):\n\nCanonical link: https://commits.webkit.org/319432@main", "email": "dpino@igalia.com", "hash": "8ea696080a81725a5ec108c4982bca863824a40f", "subject": "[GLIB] accessibility/keyevents-posted-for-increment-actions.html times out" }, "319433@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "319433@main", "clUrl": "https://commits.webkit.org/319433@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322078\nrdar://185270122\n\nReviewed by Yijia Huang.\n\nLike 313752@main, if rope is substring, we can access to the underlying\nstring data cheaply. This patch extends StringSwitch to substring 8-bit\nropes (previously only non-rope 8-bit string is supported).\n\nTest: JSTests/stress/switch-string-substring-rope.js\n\n* JSTests/stress/switch-string-substring-rope.js: Added.\n(shouldBe):\n(expectedFor):\n(substringOfSubstring):\n(check):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n(JSC::DFG::SpeculativeJIT::emitSwitchStringOnString):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n\nCanonical link: https://commits.webkit.org/319433@main", "email": "ysuzuki@apple.com", "hash": "9516ed8a4ffc897ddca5eebfbf7b7218a729c406", "subject": "[JSC] Apply StringSwitch for substrings" }, "319434@main": { "author": "Anne van Kesteren", "avatar": "https://www.gravatar.com/avatar/09bb44ac3625a121017cd98d0a7dc52c?d=identicon\u0026s=64", "cl": "319434@main", "clUrl": "https://commits.webkit.org/319434@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321929\n\nReviewed by Aditya Keerthi.\n\nupdateIsSwitchVisuallyOnFromAbsoluteLocation took the track width and the thumb length\nfrom absoluteBoundingBoxRect, which is wrong twice over.\n\nWidth and height are the wrong way around for a vertical switch, so the thumb moved once\nthe pointer passed roughly 29% of the track rather than the middle of it.\n\nAnd the rect is in absolute coordinates while switchPointerTrackingLogicalLeftPosition\nreturns a local one, so a transformed switch compared a local position against\ntransform-inflated lengths. Under transform: scale(5) the change position sits five times\npast the end of the track, so the thumb never moves and every drag ends up as an ordinary\nclick.\n\nTests: fast/forms/switch/pointer-tracking-transform.html\n fast/forms/switch/pointer-tracking-vertical-lr.html\n\nCanonical link: https://commits.webkit.org/319434@main", "email": "annevk@annevk.nl", "hash": "cce7cffe955e012a6d428cda6dbab5098b841bad", "subject": "\u003cinput type=checkbox switch\u003e: pointer tracking uses the wrong axis and coordinate space" }, "319435@main": { "author": "Sihui Liu", "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64", "cl": "319435@main", "clUrl": "https://commits.webkit.org/319435@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321824\nrdar://184964977\n\nReviewed by Ryosuke Niwa.\n\nEvery top-level visit records FirstPartyVisit, so IsolatedSiteStore could grow without bound. Cap it at 5000 entries,\nwhich take roughly 600 KB in UIProcess and cover on the order of a year of first-party browsing. The number is a\njudgment rather than a measurement, and may be adjusted once there is more data.\n\nEviction priority is decided by signal first and then by last updated time:\n1. VisitOnly - FirstPartyVisit and nothing else\n2. Gestured - the user also did something deliberate there\n3. CredentialEvidence - anything outside firstPartySignals, evicted last\n\nlastUpdated is rounded down to a day, so entries recorded on the same day cannot be ordered by it. Breaking that tie\nby insertion order would make eviction depend on an implementation artifact rather than a meaningful signal - e.g. a\nbulk import would always evict whichever half of the batch happened to be processed first, every time it ran. Ties\nare broken at random instead, the same as WebProcessCache's and NetworkCache's eviction.\n\nSince the steady state evicts a single entry per navigation, eviction targets are picked with nth_element rather than a\nfull sort. Candidates hold pointers to the keys in the table to avoid copying every domain, which is only safe because\nnothing mutates m_sites between building the candidates and reading them back.\n\nEviction runs on the write path, and again after the load merges the rows from the database. The tracking prevention\nimport defers it until its batch finishes, so the imported set is capped in one pass rather than evicting entries as\neach domain is added.\n\nSplit isolatedSiteRecordForDisplayName into isolatedSiteRecords so the new tests can count records directly, and hold\nthe returned array in a local rather than enumerating the temporary: Objective-C fast enumeration destroys temporaries\nin the collection expression before the loop body runs, which would leave the enumeration walking a released array.\n\nTests: IsolatedSiteStore.EvictsOneOfTwoTiedSitesWithinTier\n IsolatedSiteStore.EvictsVisitOnlySiteBeforeGesturedSite\n IsolatedSiteStore.EvictionIsPersisted\n IsolatedSiteStore.EvictsLoadedSitesOverTheCap\n\n* Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStore.mm:\n(-[WKWebsiteDataStore _setMaximumIsolatedSiteCountForTesting:]):\n* Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h:\n* Source/WebKit/UIProcess/WebsiteData/IsolatedSiteStore.cpp:\n(WebKit::IsolatedSiteStore::IsolatedSiteStore):\n(WebKit::IsolatedSiteStore::didLoadSites):\n(WebKit::IsolatedSiteStore::importUserInteractions):\n(WebKit::IsolatedSiteStore::recordSignals):\n(WebKit::IsolatedSiteStore::evictionTier):\n(WebKit::IsolatedSiteStore::evictSitesIfNeeded):\n(WebKit::IsolatedSiteStore::setMaximumSiteCountForTesting):\n* Source/WebKit/UIProcess/WebsiteData/IsolatedSiteStore.h:\n* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp:\n(WebKit::WebsiteDataStore::setMaximumIsolatedSiteCountForTesting):\n* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebsiteDatastore.mm:\n(TestWebKitAPI::(IsolatedSiteStore, EvictsOneOfTwoTiedSitesWithinTier)):\n(TestWebKitAPI::(IsolatedSiteStore, EvictsVisitOnlySiteBeforeGesturedSite)):\n(TestWebKitAPI::(IsolatedSiteStore, EvictionIsPersisted)):\n(TestWebKitAPI::(IsolatedSiteStore, EvictsLoadedSitesOverTheCap)):\n\nCanonical link: https://commits.webkit.org/319435@main", "email": "sihui_liu@apple.com", "hash": "9c27c4ccf517794644bc3e08facc1e95a14f4e75", "subject": "[Site Isolation] Evict isolated sites once the store reaches its size cap" }, "319436@main": { "author": "Adrian Taylor", "avatar": "https://www.gravatar.com/avatar/d2acb8ad2e2670ff74ae0d65fb27014c?d=identicon\u0026s=64", "cl": "319436@main", "clUrl": "https://commits.webkit.org/319436@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321678\nrdar://184825762\n\nReviewed by Ian Grunert.\n\nA variety of WebKit headers contained #import yet were included as\ncross-platform within the modulemaps that were imported by Swift. This caused\ndifficulties under Windows where #import means something different.\n\n* Source/WTF/wtf/MachSendRightAnnotated.h:\n* Source/WebKit/Modules/Internal/WebKitInternalCxx.h:\n* Source/WebKit/Modules/Internal/module.modulemap:\n\nCanonical link: https://commits.webkit.org/319436@main", "email": "adrian_taylor@apple.com", "hash": "390e2c91dca558e7f3ae701d21f400d6905bf27a", "subject": "Fix '#import' in cross-platform headers" }, "319437@main": { "author": "Carlos Garcia Campos", "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64", "cl": "319437@main", "clUrl": "https://commits.webkit.org/319437@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321930\n\nReviewed by Nikolas Zimmermann.\n\nThis way we avoid creating a gl context for skia in the scrolling\nthread. A new buffer type CoordinatedPlatformLayerBufferSkiaDeferredImage\nreceives the recorded display list that is replayed on the compositor\nthread when painting the buffer for the first time.\n\n* Source/WebCore/page/scrolling/coordinated/ScrollerCoordinated.cpp:\n(WebCore::ScrollerCoordinated::updateValues):\n* Source/WebCore/platform/TextureMapper.cmake:\n* Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp:\n(WebCore::GraphicsContextSkia::beginRecording):\n(WebCore::GraphicsContextSkia::endRecording):\n* Source/WebCore/platform/graphics/skia/GraphicsContextSkia.h:\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.cpp:\n(WebCore::CoordinatedPlatformLayer::CoordinatedPlatformLayer):\n(WebCore::CoordinatedPlatformLayer::threadSafeGrContext const): Deleted.\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.h:\n(WebCore::CoordinatedPlatformLayer::threadSafeGrContext const):\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBuffer.h:\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferSkiaDeferredImage.cpp: Added.\n(WebCore::CoordinatedPlatformLayerBufferSkiaDeferredImage::create):\n(WebCore::CoordinatedPlatformLayerBufferSkiaDeferredImage::CoordinatedPlatformLayerBufferSkiaDeferredImage):\n(WebCore::m_displayList):\n(WebCore::CoordinatedPlatformLayerBufferSkiaDeferredImage::skiaImage):\n(WebCore::CoordinatedPlatformLayerBufferSkiaDeferredImage::paintToTextureMapper):\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferSkiaDeferredImage.h: Added.\n\nCanonical link: https://commits.webkit.org/319437@main", "email": "cgarcia@igalia.com", "hash": "fb7b8624edc02b0d33e121fff1c41026d75b555a", "subject": "[GTK][WPE] Skia compositor: use deferred display list to paint scrollbars" }, "319438@main": { "author": "Ryosuke Niwa", "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64", "cl": "319438@main", "clUrl": "https://commits.webkit.org/319438@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322089\n\nReviewed by Chris Dumez.\n\nFix the warning in DatagramSink.cpp by marking WebTransportDatagramDuplexStream::maxDatagramSize\nNODELETE since it just returns a constant number.\n\nNo new tests since there should be no behavioral changes.\n\n* Source/WebCore/Modules/webtransport/WebTransportDatagramDuplexStream.h:\n* Source/WebCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations:\n\nCanonical link: https://commits.webkit.org/319438@main", "email": "rniwa@webkit.org", "hash": "ec033bb5faaef26ed36faf7c51bb60935779fb1c", "subject": "Safer C++: Address a warning in DatagramSink.cpp" }, "319439@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "319439@main", "clUrl": "https://commits.webkit.org/319439@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=193823\n\nReviewed by Yusuke Suzuki.\n\ngenerateUnlinkedCodeBlockForFunctions only generates the CodeForCall variant of every function.\nFor a class constructor that variant is just the \"Cannot call a class constructor\" throw, emitted\nbefore the body, so the cache holds neither the construct code nor the functions nested in the\nconstructor body. Every `new C()` from a bytecode-cached program misses the cache and reparses\nthe constructor from source; the implicit default constructor is reparsed from the builtin source too.\n\nGenerate CodeForConstruct instead when the executable is a class constructor. Calling a class\nconstructor throws, so nothing is lost. The async-function early return becomes unreachable and is\nremoved. Ordinary functions still get CodeForCall only, since whether they are constructed is not\nknown at cache time.\n\nConstructing 182 three.js classes from a cached program: 253 -\u003e 4 parses, 14.5 ms -\u003e 10.3 ms.\nbabylon.js ES6 startup: 133 -\u003e 9 parses, 30.7 ms -\u003e 27.8 ms. Cache size grows by the previously\nmissing constructor bodies (three.js +10.8%, a 50 MB application bundle +0.5%).\n\nTest: Source/JavaScriptCore/API/tests/testapi.mm\n\n* Source/JavaScriptCore/API/tests/testapi.mm:\n(testBytecodeCachedClassConstructorsDontReparse):\n(testObjectiveCAPI):\n* Source/JavaScriptCore/runtime/CodeCache.cpp:\n(JSC::generateUnlinkedCodeBlockForFunctions):\n\nCanonical link: https://commits.webkit.org/319439@main", "email": "sosuke@bun.sh", "hash": "c823243598c5b0ada8561918280e9a1d0649000d", "subject": "[JSC] Bytecode cache should generate `CodeForConstruct` for class constructors" }, "319440@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "319440@main", "clUrl": "https://commits.webkit.org/319440@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322069\n\nReviewed by Yusuke Suzuki.\n\nMap.prototype.forEach and Set.prototype.forEach are JS builtins that walk the\nstorage with @mapIterationNext, @mapIterationEntry, @mapIterationEntryKey and\n@mapIterationEntryValue. The corresponding DFG nodes were lowered to C++ calls\nin both DFG and FTL, so every element paid four operation calls whose bodies\nare two or three butterfly loads. The for-of siblings (MapIteratorNext,\nMapIteratorKey, MapIteratorValue) already walk the same table inline.\n\nLower the four nodes the same way. MapIterationNext checks for the sentinel,\nfalls back to the operation only when the table is obsolete, and otherwise\nscans the data table for the next non-deleted key and stores its entry index\ninto the IterationEntry slot. MapIterationEntry is a single load of that\nslot, and MapIterationEntryKey/Value compute the data index from it through\nloadMapEntryData, which MapIteratorKey/Value now share as well; the for-of\nlowering is unchanged.\n\nThe Entry/EntryKey/EntryValue operations are no longer reachable from JIT code\nand are removed. The remaining IterationNext operations are only called for\nobsolete tables, so they no longer handle the sentinel.\n\n Baseline Patched\n\nmap-for-each 2.2298+-0.0516 ^ 1.7644+-0.0487 ^ definitely 1.2638x faster\nmap-for-each-key-value 80.3508+-1.3258 ^ 48.7157+-1.0237 ^ definitely 1.6494x faster\nset-for-each-value 68.4946+-1.5632 ^ 46.6082+-1.1317 ^ definitely 1.4696x faster\nset-for-each 2.0780+-0.0679 ^ 1.6924+-0.0448 ^ definitely 1.2278x faster\n\nTests: JSTests/microbenchmarks/map-for-each-deleted-entries.js\n JSTests/microbenchmarks/map-for-each-key-value.js\n JSTests/microbenchmarks/set-for-each-value.js\n JSTests/stress/map-for-each-mutation-during-iteration.js\n JSTests/stress/set-for-each-mutation-during-iteration.js\n\n* JSTests/microbenchmarks/map-for-each-deleted-entries.js: Added.\n(sumEntries):\n* JSTests/microbenchmarks/map-for-each-key-value.js: Added.\n(sumEntries):\n* JSTests/microbenchmarks/set-for-each-value.js: Added.\n(sumValues.set forEach):\n* JSTests/stress/map-for-each-mutation-during-iteration.js: Added.\n(shouldBe):\n(makeMap):\n(keys):\n(deleteAhead):\n(deleteAllAhead):\n(addDuring):\n(clearDuring):\n(clearAndReadd):\n* JSTests/stress/set-for-each-mutation-during-iteration.js: Added.\n(shouldBe):\n(set values.set forEach):\n(deleteAhead.set forEach):\n(deleteAllAhead.set forEach):\n(addDuring.set forEach):\n(clearDuring.set forEach):\n(clearAndReadd.set forEach):\n* Source/JavaScriptCore/dfg/DFGOperations.cpp:\n(JSC::DFG::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):\n* Source/JavaScriptCore/dfg/DFGOperations.h:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n(JSC::DFG::SpeculativeJIT::loadMapEntryData):\n(JSC::DFG::SpeculativeJIT::compileMapIteratorKey):\n(JSC::DFG::SpeculativeJIT::compileMapIteratorValue):\n(JSC::DFG::SpeculativeJIT::compileMapIterationNext):\n(JSC::DFG::SpeculativeJIT::compileMapIterationEntry):\n(JSC::DFG::SpeculativeJIT::compileMapIterationEntryData):\n(JSC::DFG::SpeculativeJIT::compileMapIterationEntryKey):\n(JSC::DFG::SpeculativeJIT::compileMapIterationEntryValue):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n\nCanonical link: https://commits.webkit.org/319440@main", "email": "sosuke@bun.sh", "hash": "ce878e190fef3abba29f10243a8454fde765f573", "subject": "[JSC] Inline `Map#forEach` / `Set#forEach` iteration in DFG and FTL" }, "319441@main": { "author": "Diego Pino Garcia", "avatar": "https://www.gravatar.com/avatar/e8cce88637f1a6e79155e8371e24b2e8?d=identicon\u0026s=64", "cl": "319441@main", "clUrl": "https://commits.webkit.org/319441@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322007\n\nReviewed by Carlos Garcia Campos.\n\nSimilar to 319432@main.\n\nATSPI lacks an implementation of operation\n'dismiss' which causes GLIB tests relying on this operation to time out.\n\nThe 'dismiss' operation can be implemented via\n'performDismissAction', reaching the same entry point that macOS/iOS\nports eventually reach through their native a11y APIS ('AXDismissAction'\nand 'accessibilityPerformEscape', respectively).\n\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.h:\n* Source/WebCore/accessibility/atspi/AccessibilityObjectValueAtspi.cpp:\n(WebCore::AccessibilityObjectAtspi::dismiss):\n* Tools/WebKitTestRunner/InjectedBundle/atspi/AccessibilityUIElementAtspi.cpp:\n(WTR::AccessibilityUIElementAtspi::dismiss):\n* Tools/WebKitTestRunner/InjectedBundle/atspi/AccessibilityUIElementAtspi.h:\n\nCanonical link: https://commits.webkit.org/319441@main", "email": "dpino@igalia.com", "hash": "511f726506ff83b7b6ad99cb42989dda307659c1", "subject": "[GLIB][a11y] WTR: Add missing implementation of dismiss" }, "319442@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "319442@main", "clUrl": "https://commits.webkit.org/319442@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320882\nrdar://183902668\n\nReviewed by Antoine Quint.\n\nStep 3 of [1] sets \"unlimited current time\" from the timeline time when the animation's\nstart time is resolved, and only otherwise falls back to the animation's current time.\nWe additionally required the timeline time to be resolved before taking the first\nbranch, so a resolved start time paired with an unresolved timeline time silently took\nthe fallback.\n\nThat is wrong for an animation holding at its effect end: its hold time equals the\ntimeline duration, so \"effective timeline progress\" is exactly 1 and we report a\nboundary even though the timeline has no current time. Being at a boundary suppresses\nthe after phase, so a \"none\" fill mode animation stays active and keeps applying its\n100% keyframe instead of reverting to its unanimated style. Per [1] an unresolved\ntimeline time instead propagates to \"effective timeline progress\", which is then\nneither 0 nor 1, so the procedure returns false. Return false on that branch, leaving\nthe start-time-unresolved branch to use the animation's current time as [1] specifies.\n\nThis is why animation-inactive-outside-range-test.html is flaky. Its \"After cover\nphase\" indicator is the only one of the four whose local time is held exactly on its\nactive-after boundary, so it is the only one whose phase hinges on this predicate\nrather than on a strict inequality; one frame with an unresolved view timeline current\ntime paints it green instead of grey.\n\n[1] https://drafts.csswg.org/web-animations-2/#at-progress-timeline-boundary\n\nTest: imported/w3c/web-platform-tests/scroll-animations/css/view-timeline-unresolved-current-time-at-effect-end.html\n\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/view-timeline-unresolved-current-time-at-effect-end-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/view-timeline-unresolved-current-time-at-effect-end.html: Added.\n* Source/WebCore/animation/AnimationEffectTiming.cpp:\n(WebCore::AnimationEffectTiming::getBasicTiming const):\n\nCanonical link: https://commits.webkit.org/319442@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "928daa1cfd842184684d3f14365f82c93352695f", "subject": "[scroll-animations] An unresolved progress-based timeline current time is treated as a progress timeline boundary" }, "319443@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "319443@main", "clUrl": "https://commits.webkit.org/319443@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322009\nrdar://185204758\n\nReviewed by Antoine Quint.\n\ncomputedOffset() maps a keyframe's timeline range offset into the progress space of the\nanimation's attachment range by dividing by that range's length. It skipped the division\nonly when the attachment range isDefault(), which tests start.isNormal() \u0026\u0026 end.isNormal()\nand so does not catch a range that is non-default but degenerate. With a range such as\n\"contain 50% contain 50%\" both edges resolve to the same timeline offset, the length is\nzero, and the division yielded +/-Infinity (or NaN when the numerator happened to be zero\nas well).\n\nThe guard in updateComputedKeyframeOffsetsIfNeeded() does not help here: it bails out when\nthe timeline's currentTime is unresolved, but in this case the timeline range is perfectly\nordinary and only the attachment range is degenerate.\n\nA zero-length attachment range gives the animation no interval to progress over, so there\nis no offset to map onto. Return quiet_NaN() instead, which is how this code already\nrepresents an unresolved computed offset -- see the named-range-without-a-timeline case\nabove it, and hasKeyframeWithUnresolvedComputedOffset(), which disables acceleration.\nComputed offsets legitimately fall outside [0,1], so clamping would be wrong.\n\nThis matches Chrome, which already reports an unresolved computed offset here. Firefox\nreports +/-Infinity, as WebKit did before this change.\n\nWhile here, make BlendingKeyframes::updatedComputedOffsets() sort with an explicit\ncomparator. It sorted on BlendingKeyframe::offset() using std::less, which is not a strict\nweak ordering over NaN: every NaN compares equivalent to every other offset, while those\noffsets are not equivalent to each other. That is undefined behavior and trips hardened\nlibc++ comparator checks. It is reachable independently of the above, via range-offset\nkeyframes on an element with no scroll timeline at all. Order unresolved offsets last.\n\nTest: imported/w3c/web-platform-tests/scroll-animations/css/timeline-offset-keyframes-zero-length-attachment-range.html\n\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/timeline-offset-keyframes-zero-length-attachment-range-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/timeline-offset-keyframes-zero-length-attachment-range.html: Added.\n* Source/WebCore/animation/BlendingKeyframes.cpp:\n(WebCore::BlendingKeyframes::updatedComputedOffsets):\n* Source/WebCore/animation/KeyframeEffect.cpp:\n(WebCore::computedOffset):\n\nCanonical link: https://commits.webkit.org/319443@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "e9521780a83da546fd1cea021caf29306de8af8d", "subject": "A zero-length animation attachment range produces infinite computed keyframe offsets" }, "319444@main": { "author": "Jessica Lee", "avatar": "https://www.gravatar.com/avatar/fc717c99321d09f31fb9187418a8ffc5?d=identicon\u0026s=64", "cl": "319444@main", "clUrl": "https://commits.webkit.org/319444@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321961\nrdar://185147134\n\nReviewed by Chris Dumez.\n\nRemove each audio node from m_deferredBreakConnectionList before releasing its reference, since doing so may destroy\nit re-entrantly. (Patch was generated with AI assistance.)\n\nNo new tests needed.\n\n* Source/WebCore/Modules/webaudio/BaseAudioContext.cpp:\n(WebCore::BaseAudioContext::handleDeferredDecrementConnectionCounts):\n(WebCore::BaseAudioContext::handleDeferredDerefs):\n\nCanonical link: https://commits.webkit.org/319444@main", "email": "jlee53@apple.com", "hash": "2c2b96df94cb454c6e58536b16fead32d4dd1de3", "subject": "[ macOS Debug ] imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audionode-interface/audionode-channel-rules.html is a flaky crash" }, "319445@main": { "author": "Nikolas Zimmermann", "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64", "cl": "319445@main", "clUrl": "https://commits.webkit.org/319445@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322064\n\nReviewed by Rob Buis.\n\nSVG text is not painted at its specified font size. The font is scaled up to\nthe resolution the text is finally rendered at, and the context is scaled back\ndown by the same factor, so glyphs are rasterized at their on-screen size. The\nfactor comes from calculateScreenFontSizeScalingFactor(), and 'vector-effect:\nnon-scaling-stroke' on \u003ctext\u003e divides the stroke thickness by it too.\n\nIt is derived from computeAccumulatedTransform(TrackSVGScreenCTMMatrix), which\nfollows getScreenCTM() semantics and is zoom independent on purpose: getCTM()\nand getScreenCTM() need to report the same matrix at every zoom level. The zoom\nwas multiplied back in from style().usedZoom(), but only for SVG embedded in an\nHTML document. In a standalone SVG document the factor kept its unzoomed value,\nso at page zoom the text was rasterized for the wrong resolution and a\nnon-scaling stroke came out too thick by the zoom factor.\n\nThe accumulated matrix is the same in both cases, so drop the condition and\nalways apply the zoom. The text metrics of the zoomed documents below now match\nthe legacy SVG engine, which reaches the same factor by accumulating\nlocalToParentTransform() through LegacyRenderSVGRoot, whose\nlocalToBorderBoxTransform() carries the zoom.\n\nCovered by existing tests.\n\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/TestExpectations:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/page/zoom-coords-viewattr-01-b-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/page/zoom-coords-viewattr-01-b-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/page/zoom-mask-with-percentages-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/page/zoom-svg-through-object-with-absolute-size-2-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/page/zoom-svg-through-object-with-absolute-size-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/page/zoom-svg-through-object-with-percentage-size-expected.txt:\n* Source/WebCore/rendering/svg/SVGTransformComputation.h:\n(WebCore::SVGTransformComputation::calculateScreenFontSizeScalingFactor const):\n\nCanonical link: https://commits.webkit.org/319445@main", "email": "nzimmermann@igalia.com", "hash": "ab10ecb9a37d4ce68b3b23b783099af08387fccf", "subject": "[LBSE] SVG text is scaled for the wrong resolution in a zoomed SVG document" }, "319446@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "319446@main", "clUrl": "https://commits.webkit.org/319446@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321827\nrdar://184966612\n\nReviewed by Chris Dumez.\n\nLocation::ancestorOrigins() built its cached list by calling\nprotect(m_ancestorOrigins)-\u003eappend(...) inside the ancestor walk, taking a\nfresh RefPtr copy of the member on every iteration just to reach\nDOMStringList::append(). Append through a Ref local instead.\n\nThis is a readability cleanup rather than a measurable win: the list is built\nonce per Location and then cached, ancestor chains are short, and\nDOMStringList is non-atomically ref-counted, so the churn removed is a few\nincrements on a cold path. The copyRef() that publishes the member even adds\none ref/deref back in the common no-ancestor case.\n\nThe member is still assigned before the loop is entered, so the list is\npublished in the same order as before and a re-entrant read during the walk\nobserves the same partially-built list it does today.\n\nNo behavior change, so no new test.\n\n* Source/WebCore/page/Location.cpp:\n(WebCore::Location::ancestorOrigins const):\n\nCanonical link: https://commits.webkit.org/319446@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "becdb864c9ddd9e05c4ecfd9c2b304e0856dc015", "subject": "Location::ancestorOrigins() should build its cached list through a local Ref" }, "319447@main": { "author": "David Kilzer", "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64", "cl": "319447@main", "clUrl": "https://commits.webkit.org/319447@main", "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=317082\u003e\n\u003crdar://179209792\u003e\n\nReviewed by Zak Ridouh.\n\nGuard against a missing entry before dereferencing the result of\n`HashMap::find()` in `decrementUseCount()`. The function relies on\n`ASSERT(iterator != ...end())`, which compiles to nothing in release\nbuilds, then reads `iterator-\u003evalue` unconditionally. When the\nidentifier is absent, `find()` returns `end()`, and reading\n`end()-\u003evalue` accesses memory one entry past the table's backing\nbuffer.\n\nThe absent-entry case became reachable in 259876@main, which replaced\nthe page-group-keyed owning map of providers with a single weakly-held\nprovider (`existingStorageNameSpaceProvider()`). The provider is now\ndestroyed when the last page in a Web Content process goes away and\nrecreated empty for the next page, so a `WebPage` torn down after that\npoint decrements against a provider that never held its identifier.\n\nReturn early when the iterator is `end()`, matching the existing guard\nin the sibling accessor `sessionStorageNamespace()`. The\n`ASSERT(sessionStorageNamespaces.useCount)` is retained so debug builds\nstill flag a use-count imbalance.\n\nNo new tests since this path is reached only during web page teardown\nwhen the session storage namespace entry has already been removed, and\nis not directly testable through public API.\n\n* Source/WebKit/WebProcess/WebStorage/WebStorageNamespaceProvider.cpp:\n(WebKit::WebStorageNamespaceProvider::decrementUseCount):\n\nOriginally-landed-as: 305413.965@safari-7624.4-branch (6254fe9499a7). rdar://184744974\nCanonical link: https://commits.webkit.org/319447@main", "email": "ddkilzer@apple.com", "hash": "313a4e84e9cc3044d9d5587e807074d0d6240dc1", "subject": "REGRESSION (259876@main): Check for end iterator in WebStorageNamespaceProvider::decrementUseCount()" }, "319448@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "319448@main", "clUrl": "https://commits.webkit.org/319448@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322079\nrdar://185270753\n\nReviewed by Antoine Quint.\n\nAnimatable.getAnimations() returns its list \"sorted using the composite order\ndescribed for the associated animations of effects in § 5.4.2 The effect\nstack\" [1][2].\n\nFor two CSS Animations that comparison resolves entirely on step 2 of § 5.4.2,\nthe class-specific composite order. Since an owning element is an (element,\npseudo-element) pair, two animations on different pseudo-elements of a single\nelement take the \"if the owning element of A and B differs\" branch of\ncss-animations-2 § 2.2 [3], which orders pseudo-elements as:\n\n element, ::marker, ::before, any other pseudo-elements not mentioned\n specifically in this list, sorted in ascending order by the Unicode\n codepoints that make up each selector, ::after, element children\n\nThe SortingIndex enum in\ncompareStyleOriginatedAnimationOwningElementPositionsInDocumentTreeOrder()\ndeviated from that order in three ways, because each newly-supported\npseudo-element was appended to the enum instead of being inserted in codepoint\norder:\n\n - PickerIcon sorted after After, so an animation on ::picker-icon was\n composited and returned after one on ::after.\n - WebKitScrollbar sorted after FirstLetter, FirstLine, GrammarError and\n Highlight, but \"-\" (U+002D) sorts before \"f\", \"g\" and \"h\".\n - Checkmark sorted after TargetText, but \"c\" sorts before \"f\".\n\nReorder the enum to match the order specified in [3], and spell out in the\ncomment above it that the enumerators are listed in sort order, so that a future\npseudo-element is inserted at its codepoint position rather than appended.\n\nThe ::view-transition pseudo-elements are left after After: their relative order\nis additionally constrained by css-view-transitions [4] and is already\nspecial-cased above by nameOrPart.\n\nThis is observable both through getAnimations() [1] and through the dispatch\norder of animation and transition events, since\ncompareAnimationEventsByCompositeOrder() sorts with the same comparison. Chrome\nalready returns ::picker-icon before ::after; Firefox creates no animations for\nany of the affected pseudo-elements. ::checkmark's position is corrected by the\nsame rule but is not yet observable, as no engine creates an animation for it.\n\nThe new test is a WebKit test rather than a web-platform-test because the\nordering ::-webkit-scrollbar takes part in cannot be tested cross-engine: it is\nnot a standardized pseudo-element, and Firefox has no equivalent. It reports the\nsubtests for the pseudo-elements WebKit creates no animation for — ::checkmark,\n::selection, ::highlight(), ::grammar-error, ::spelling-error and ::target-text —\nas unsupported rather than asserting on them, so that an unsupported\npseudo-element cannot mask a misordering.\n\n[1] https://drafts.csswg.org/web-animations-1/#dom-animatable-getanimations\n[2] https://drafts.csswg.org/web-animations-1/#the-effect-stack\n[3] https://drafts.csswg.org/css-animations-2/#animation-composite-order\n[4] https://drafts.csswg.org/css-view-transitions-1/\n\nTest: webanimations/pseudo-element-composite-order.html\n\n* LayoutTests/webanimations/pseudo-element-composite-order-expected.txt: Added.\n* LayoutTests/webanimations/pseudo-element-composite-order.html: Added.\n* Source/WebCore/animation/WebAnimationUtilities.cpp:\n(WebCore::compareStyleOriginatedAnimationOwningElementPositionsInDocumentTreeOrder):\n\nCanonical link: https://commits.webkit.org/319448@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "02f6ec0873f7cb4cccf05facfddda6f6b0753f13", "subject": "[web-animations] Animations targeting ::picker-icon and ::-webkit-scrollbar have the wrong composite order" }, "319449@main": { "author": "Diego Pino Garcia", "avatar": "https://www.gravatar.com/avatar/e8cce88637f1a6e79155e8371e24b2e8?d=identicon\u0026s=64", "cl": "319449@main", "clUrl": "https://commits.webkit.org/319449@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322094\n\nReviewed by Carlos Garcia Campos.\n\nChangeset 258327@main refactored properties 'FocusableAncestor',\n'EditableAncestor' and 'HighestEditableAncestor' to resolve them on demand.\nA working implementation for macOS/iOS port was added but an equivalent\nimplementation for GLIB ports was missing.\n\nThe core implementation for this functionality is shared across ports, living\nin 'AXCoreObject.h'. The patch implements the required WKTR interface methods\non GLIB ('focusableAncestor', 'editableAncestor', etc), which end up\ncalling the 'AXCoreObject' methods via 'AccessibilityObjectAtspi'.\n\nAlso, the condition in 'accessibilityPlatformIncludesObject' that\nignores children of text controls has been relaxed for content-editable\ncontrols, since they can contain valid non-text descendants (such as\na button). Otherwise, 'editableAncestor' would return an ignored object.\n\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.cpp:\n(WebCore::AccessibilityObjectAtspi::focusableAncestor const):\n(WebCore::AccessibilityObjectAtspi::editableAncestor const):\n(WebCore::AccessibilityObjectAtspi::highestEditableAncestor const):\n(WebCore::AccessibilityObject::accessibilityPlatformIncludesObject const):\n(WebCore::AccessibilityObjectAtspi::states const):\n* Source/WebCore/accessibility/atspi/AccessibilityObjectAtspi.h:\n* Tools/WebKitTestRunner/InjectedBundle/atspi/AccessibilityUIElementAtspi.cpp:\n(WTR::AccessibilityUIElementAtspi::focusableAncestor):\n(WTR::AccessibilityUIElementAtspi::editableAncestor):\n(WTR::AccessibilityUIElementAtspi::highestEditableAncestor):\n* Tools/WebKitTestRunner/InjectedBundle/atspi/AccessibilityUIElementAtspi.h:\n\nCanonical link: https://commits.webkit.org/319449@main", "email": "dpino@igalia.com", "hash": "a4cbb7e2164123007c62e1d2c9cd39d194f57233", "subject": "[GLIB][a11y] WTR: Add missing implementation of focusableAncestor" }, "319450@main": { "author": "Claudio Saavedra", "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64", "cl": "319450@main", "clUrl": "https://commits.webkit.org/319450@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319580\n\nReviewed by Nikolas Zimmermann and Carlos Garcia Campos.\n\nThe GTK EventSenderProxy touch methods were empty stubs, so\neventSender.addTouchPoint(), touchStart() and friends dispatched nothing\nand the fast/events/touch tests timed out. Unlike mouse, key and wheel\nevents, WebKitWebViewBase had no touch synthesis entry point, and the\nexisting touch path is built around GdkEvent, which cannot be constructed\nby application code under GTK4. Add webkitWebViewBaseSynthesizeTouchEvent(),\nwhich builds the WebPlatformTouchPoint list and dispatches a\nNativeWebTouchEvent directly, the same way the mouse path already bypasses\nGdkEvent; the GTK EventSenderProxy keeps the touch point state and maps it\nonto that entry point.\n\nUpdate the touch event test expectations for the tests that now pass, were\nunskipped, or changed to a deterministic failure, and add a GTK baseline\nfor basic-single-touch-events.html (touch point radius is unsupported, as\non WPE, but the touch modifiers are applied).\n\nCovered by fast/events/touch tests.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/gtk/TestExpectations:\n* LayoutTests/platform/gtk/fast/events/touch/basic-single-touch-events-expected.txt: Added.\n* LayoutTests/platform/wpe/TestExpectations:\n* Source/WebKit/Shared/NativeWebTouchEvent.h:\n* Source/WebKit/Shared/gtk/NativeWebTouchEventGtk.cpp:\n(WebKit::NativeWebTouchEvent::NativeWebTouchEvent):\n(WebKit::m_nativeEvent):\n* Source/WebKit/UIProcess/API/gtk/WebKitWebViewBase.cpp:\n(toWebPlatformTouchPointState):\n(webkitWebViewBaseSynthesizeTouchEvent):\n* Source/WebKit/UIProcess/API/gtk/WebKitWebViewBaseInternal.h:\n* Tools/WebKitTestRunner/EventSenderProxy.h:\n* Tools/WebKitTestRunner/gtk/EventSenderProxyGtk.cpp:\n(WTR::toSyntheticTouchPointState):\n(WTR::EventSenderProxy::addTouchPoint):\n(WTR::EventSenderProxy::updateTouchPoint):\n(WTR::sendTouchEvent):\n(WTR::markAllTouchPointsStationary):\n(WTR::EventSenderProxy::touchStart):\n(WTR::EventSenderProxy::touchMove):\n(WTR::EventSenderProxy::touchEnd):\n(WTR::EventSenderProxy::touchCancel):\n(WTR::EventSenderProxy::clearTouchPoints):\n(WTR::EventSenderProxy::releaseTouchPoint):\n(WTR::EventSenderProxy::cancelTouchPoint):\n(WTR::EventSenderProxy::setTouchModifier):\n\nCanonical link: https://commits.webkit.org/319450@main", "email": "csaavedra@igalia.com", "hash": "c4264e1b1836110efffc4cabc2ed5d7f0de9fc79", "subject": "[GTK] Implement touch event synthesis in WebKitTestRunner" }, "319451@main": { "author": "Karl Dubost", "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64", "cl": "319451@main", "clUrl": "https://commits.webkit.org/319451@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322081\nrdar://185276156\n\nReviewed by Dan Glastonbury.\n\nThis is adding a number of WPT tests for path data and SVG points error\nprocessing to avoid regression in the future. It doesn't cover yet\neverything. Some discussions are happening on\nhttps://github.com/w3c/svgwg/issues/764\nhttps://github.com/w3c/svgwg/issues/763\nfor the trailing part of the error.\n\nThis will be exported to WPT.\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/path/error-handling/path-data-error-geometry-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/path/error-handling/path-data-error-geometry.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGPointList-error-handling-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGPointList-error-handling.html: Added.\n\nCanonical link: https://commits.webkit.org/319451@main", "email": "karlcow@apple.com", "hash": "834b97ac1beff72b439f74acfd85da5ca9240200", "subject": "Extend WPT coverage for SVG paths and points" }, "319452@main": { "author": "Carlos Alberto Lopez Perez", "avatar": "https://www.gravatar.com/avatar/05326c1dbe06f486e884975e73f25179?d=identicon\u0026s=64", "cl": "319452@main", "clUrl": "https://commits.webkit.org/319452@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321142\n\nReviewed by Carlos Garcia Campos.\n\nUntil now the GTK and WPE ports were built with whatever compiler CMake\npicked up by default, which on Linux means GCC. This makes build-webkit\nand build-jsc use Clang instead for the GTK and WPE ports, and also for\nJSCOnly when building on Linux.\n\nThis follows a recent change were we made Clang the default compiler on\nthe CI. So this aligns the default developer build with the CI for the\nLinux ports. See 318539@main\n\nThe compiler is selected by exporting CC and CXX rather than by passing\n-DCMAKE_C_COMPILER to CMake. The reason is that shouldRemoveCMakeCache()\nalready keeps track of CC and CXX, so a change on the compiler removes\nthe CMake cache and reconfigures the build directory. Note that this\nmeans that the first build after this change will reconfigure and\nrebuild any existing GTK, WPE or JSCOnly build directory.\n\nBoth the clang and the clang++ binaries have to be available in the\nPATH. If any of them is missing then a warning is printed and the build\ncontinues using the default system compiler, so this doesn't break\nsystems where Clang is not installed.\n\nClang is also the new default for the cross-builds done with the\ntoolchains generated by cross-toolchain-helper (the ones selected with\nthe --cross-target flag). Those toolchains ship both compilers, and the\nenvironment setup script generated by cross-toolchain-helper already\nchecks the value of CC and CXX to decide which one of the two to use, so\nin that case CC and CXX are set simply as a hint for that script and the\nbinaries from the host PATH are not checked (the compiler used is the\ncross-compiled one from the toolchain). When the toolchain has no Clang\nsupport the setup script keeps using GCC as before.\n\nAnyone can still choose a different compiler: setting CC and CXX in the\nenvironment or passing the compiler via --cmakeargs takes precedence over\nthe default.\n\n* Tools/Scripts/build-webkit:\n* Tools/Scripts/cross-toolchain-helper:\n(YoctoCrossBuilder.cross_dev_shell):\n* Tools/Scripts/webkitdirs.pm:\n(determineDefaultCompiler):\n(buildCMakeProjectOrExit):\n* Tools/Scripts/webkitperl/BuildSubproject.pm:\n* Tools/Scripts/webkitperl/webkitdirs_unittest/determineDefaultCompilerCMakeArgs.pl: Added.\n* Tools/Scripts/webkitperl/webkitdirs_unittest/determineDefaultCompilerClang.pl: Added.\n* Tools/Scripts/webkitperl/webkitdirs_unittest/determineDefaultCompilerCrossTarget.pl: Added.\n* Tools/Scripts/webkitperl/webkitdirs_unittest/determineDefaultCompilerNoClang.pl: Added.\n* Tools/glib/dependencies/apt:\n* Tools/glib/dependencies/dnf:\n* Tools/glib/dependencies/pacman:\n* Tools/yocto/README.md:\n\nCanonical link: https://commits.webkit.org/319452@main", "email": "clopez@igalia.com", "hash": "70e8323a4fdd886403a1f5964cf393a677bc3796", "subject": "[GTK][WPE] Use Clang by default when building with build-webkit" }, "319453@main": { "author": "Anne van Kesteren", "avatar": "https://www.gravatar.com/avatar/09bb44ac3625a121017cd98d0a7dc52c?d=identicon\u0026s=64", "cl": "319453@main", "clUrl": "https://commits.webkit.org/319453@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319780\nrdar://183256491\n\nReviewed by Ryosuke Niwa.\n\nThe parser inserts nodes with low-level operations that skip pre-insertion validity\nchecks, so script that moves a node on the stack of open elements during parsing\ncould make us build a tree the DOM does not allow.\n\nUse Document::canAcceptChild() when inserting into a Document, which drops Text\nnode children, a second element child, and a second or misordered DocumentType\nchild on the floor. This is reachable by foster parenting into a table that script\nhas made another Document's document element, and by document.open() leaving\nchildren in the Document before the DOCTYPE token or the \"html\" start tag.\n\nThe adoption agency algorithm checked for cycles with Node::contains(), which only\nconsiders the node's own tree, so it missed a parent script had moved into a shadow\nroot (crashing) or into a template element's content (silently creating an invalid\ntree).\n\nMove the nextChild check out of executeInsertAlreadyParsedChildTask() and into\ninsert(), where nextChild is used. Script can run before a queued insertion takes\nplace: in the case from bug 169222, parserRemoveChild() destroys an iframe\nelement's frame and its unload handler removes nextChild from the parent, which is\ncovered by fast/parser/scriptexec-during-parserInsertBefore.html. Nothing about\nthat is specific to the adoption agency, though no input is known to reach the\ncheck through a plain insertion.\n\nBecause the template element branch runs first and clears nextChild, a stale\nnextChild no longer prevents an insertion into a template element's contents. That\nis what appropriate place for inserting a node calls for, as it redirects into the\ncontents after the last child, discarding the reference node.\n\nSpec changes: https://github.com/whatwg/html/pull/12708\n https://github.com/whatwg/html/pull/12709\n\nTests: imported/w3c/web-platform-tests/html/syntax/parsing/foster-parenting-into-document-with-element-child.html\n imported/w3c/web-platform-tests/html/syntax/parsing/insert-into-nonempty-document.html\n imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_url.html?file=scripted_foster01\n imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_write.html?file=scripted_foster01\n imported/w3c/web-platform-tests/html/syntax/parsing/html5lib_write_single.html?file=scripted_foster01\n imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-document-target.html\n imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-shadow-cycle.html\n imported/w3c/web-platform-tests/html/syntax/parsing/adoption-agency-reparenting-template-cycle.html\n\nCanonical link: https://commits.webkit.org/319453@main", "email": "annevk@annevk.nl", "hash": "e8b1d6b3bee17692f749f06aa2729107a2e3148d", "subject": "HTML parser should not insert nodes the DOM would reject" }, "319454@main": { "author": "Claudio Saavedra", "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64", "cl": "319454@main", "clUrl": "https://commits.webkit.org/319454@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317928\n\nReviewed by Michael Catanzaro.\n\nLet's start moving away from handcrafted serializers for the GLib/GObject\nstructs and classes. This can serve as an example of how to do this in\ngeneral.\n\nGeneratedSerializers.h now includes \u003cwtf/glib/GRefPtr.h\u003e under USE(GLIB),\nand the forward-declaration logic skips GRefPtr: unlike RetainPtr it has a\nsecond (defaulted) template parameter, so the generated single-parameter\nforward declaration would conflict with the real one. This special-case is\ntemporary; it goes away once GRefPtr is handled as a proper smart-pointer\nfamily (keyed on the wrapped type rather than GRefPtr\u003cT\u003e), which will be\ndone in a separate PR.\n\n* Source/WebKit/PlatformGTK.cmake:\n* Source/WebKit/Scripts/generate-serializers.py:\n(generate_forward_declarations):\n(generate_header):\n* Source/WebKit/Shared/PrintInfo.serialization.in:\n* Source/WebKit/Shared/gtk/ArgumentCodersGtk.cpp: Removed.\n* Source/WebKit/Shared/gtk/ArgumentCodersGtk.serialization.in: Added.\n* Source/WebKit/Shared/gtk/CoreIPCGtkPrint.cpp: Copied from Source/WebKit/Shared/gtk/ArgumentCodersGtk.h.\n(WebKit::CoreIPCGtkPrintSettings::CoreIPCGtkPrintSettings):\n(WebKit::CoreIPCGtkPrintSettings::operator GRefPtr\u003cGtkPrintSettings\u003e const):\n(WebKit::CoreIPCGtkPageSetup::CoreIPCGtkPageSetup):\n(WebKit::CoreIPCGtkPageSetup::operator GRefPtr\u003cGtkPageSetup\u003e const):\n* Source/WebKit/Shared/gtk/CoreIPCGtkPrint.h: Renamed from Source/WebKit/Shared/gtk/ArgumentCodersGtk.h.\n(WebKit::CoreIPCGtkPrintSettings::CoreIPCGtkPrintSettings):\n(WebKit::CoreIPCGtkPrintSettings::settings const):\n(WebKit::CoreIPCGtkPageSetup::CoreIPCGtkPageSetup):\n(WebKit::CoreIPCGtkPageSetup::pageSetup const):\n* Source/WebKit/SourcesGTK.txt:\n* Source/WebKit/WebProcess/WebCoreSupport/gtk/WebDragClientGtk.cpp:\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n\nCanonical link: https://commits.webkit.org/319454@main", "email": "csaavedra@igalia.com", "hash": "e8eea7b9bf07ecbaf4b1d539cbb0c586bf41e605", "subject": "[GTK] Generate serializers for GTK printing-related classes" }, "319455@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "319455@main", "clUrl": "https://commits.webkit.org/319455@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321871\nrdar://185043324\n\nReviewed by Eric Carlson.\n\nPlatformMediaSession::clientWillBeginPlayback() took a completion handler that\nMediaSessionManagerInterface::sessionWillBeginPlayback() could call immediately,\ninline, when admission needed no further work (the audio session was already\nactive), or only later, once AudioSession activation settled asynchronously.\nNothing guaranteed that two admissions requested close together completed in the\norder they were requested: a video needing to activate the audio session stayed\npending while a second video, needing no activation, was admitted right away and\ncould evict the first video before the first video's own admission had even\nfinished. That inversion produced the flaky failure in bug 321819.\n\nclientWillBeginPlayback() and the whole call chain down to\nsessionWillBeginPlayback() now return a GenericPromise instead of taking a\ncompletion handler, and each manager chains every new admission onto the promise\nof whichever admission is currently outstanding: a request's own work does not\nstart until the previous one has fully settled, so completion always follows\nrequest order and the inversion above cannot happen.\nenforceConcurrentPlaybackRestriction()'s eviction predicate no longer treats a\nsession whose own admission is preparingToPlay() as already playing: that let a\nsession which was still only queued, not yet given its turn, get evicted before\nit ever started, which serialization makes both unnecessary and wrong.\n\nSerializing admission this way also settles each one at least a run-loop turn\nlater than the completion-handler path did when no AudioSession activation was\nneeded. That wider window exposed two existing races: updateShouldPlay() and\ncancelPendingEventsAndCallbacks() each rejected pending play promises\nunconditionally, never checking whether an in-flight admission already promised\nto settle them, producing an unhandled rejection in\nmedia/audio-playback-restriction-play-muted.html and\nimported/w3c/web-platform-tests/css/selectors/media/media-playback-state.html.\nA session paused while its own admission sat queued behind another one's could\nalso still have setCurrentSession() called on its behalf, since nothing\nrevalidated its intent to play first.\n\nBoth rejection sites now defer to the same m_playPromiseSettlementGuaranteed\nguard pauseInternal() already uses. PlatformMediaSessionInterface gains\ncommitPlaybackAdmission(), called by the manager right before\nenforceConcurrentPlaybackRestriction(), and sessionWillBeginPlayback() gains an\nearlier admissionStillValid() check (true by construction for\nRemoteMediaSessionProxy, whose admission was already decided by the WebContent\nprocess) so a paused, queued session never reaches setCurrentSession(). The\nper-subclass sessionWillBeginPlayback() overrides are replaced by\nsessionDidCompleteAdmission(), called only once commitPlaybackAdmission()\nsucceeds, keeping post-admission side effects inside the serialized region and\nlimited to a session that actually claimed Playing. updatePlayState() also\nstopped requesting a second, redundant admission when one was already in flight\nfor the same session. commitPlaybackAdmission() takes the state captured at\nadmission start as a parameter rather than reading it from a member: a second,\noverlapping admission for the same session would otherwise overwrite that member\nbefore the first admission's commit reads it.\n\nAudioContext hit a variant of the same ordering problem: suspendRendering()\ncalls clientWillPausePlayback(), which stays synchronous, while\nresumeRendering() calls the now-always-asynchronous clientWillBeginPlayback().\nCalling resume() then immediately suspend() could let suspend()'s promise settle\nfirst, in violation of the ordering\nimported/w3c/web-platform-tests/webaudio/the-audio-api/the-audiocontext-interface/suspend-after-construct.html\nchecks, which surfaced there as an unhandled rejection. resumeRendering() and\nsuspendRendering() now chain onto a new m_currentRenderingOperation the same way\nsessionWillBeginPlayback() chains onto m_currentPlaybackAdmission, so a later\ncall's promise cannot settle before an earlier one already has; both now assert\nthey run on the main thread, since that chain is main-thread-only and nothing\nenforced that before.\n\n* LayoutTests/media/video-playback-quality-webm-expected.txt:\n* LayoutTests/media/video-playback-quality-webm.html: Test was waiting on the playing event to check if playback quality has changed; this doesn't guarantee playback progressed.\n* LayoutTests/platform/ios/TestExpectations: This commit resolved imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audiocontext-interface/suspend-after-construct.html\n* LayoutTests/platform/mac/TestExpectations: This commit resolved imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audiocontext-interface/suspend-after-construct.html\n* Source/WebCore/Modules/mediasession/MediaSession.cpp:\n(WebCore::MediaSession::setPlaybackState): Register the session synchronously\nvia setActive(true), the same way HTMLMediaElement::playInternal() already\ndoes, so beginInterruption() can find it before its (now async) admission\nsettles.\n* Source/WebCore/Modules/webaudio/AudioContext.cpp:\n(WebCore::AudioContext::suspendRendering): Chain onto\nm_currentRenderingOperation and assert the main thread.\n(WebCore::AudioContext::resumeRendering): Ditto.\n(WebCore::AudioContext::willBeginPlayback):\n* Source/WebCore/Modules/webaudio/AudioContext.h:\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::cancelPendingEventsAndCallbacks): Ditto.\n(WebCore::HTMLMediaElement::playInternal): Consume the promise directly; the\nhand-built GenericPromise::Producer bridge is no longer needed now that\nclientWillBeginPlayback() returns one.\n(WebCore::HTMLMediaElement::updatePlayState): Skip re-requesting admission if\none is already in flight for the session.\n(WebCore::HTMLMediaElement::updateShouldPlay): Let pauseInternal()'s own\nguarded rejection handle the pending play promise.\n* Source/WebCore/html/MediaElementSession.cpp:\n(WebCore::MediaElementSession::clientWillBeginPlayback):\n* Source/WebCore/html/MediaElementSession.h:\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.cpp:\n(WebCore::MediaSessionManagerInterface::sessionWillBeginPlayback): Assert the\nmain thread. Chain the request onto m_currentPlaybackAdmission and return a\nGenericPromise. Resolve without starting the admission when\nadmissionStillValid() is false.\n(WebCore::MediaSessionManagerInterface::sessionDidCompleteAdmission):\n(WebCore::MediaSessionManagerInterface::startSessionAdmission): The former\nbody of sessionWillBeginPlayback(), returning a GenericPromise and taking the\ncaller's captured start state; call commitPlaybackAdmission() and only\nenforce the restriction and call sessionDidCompleteAdmission() when it\nreturns true.\n(WebCore::MediaSessionManagerInterface::enforceConcurrentPlaybackRestriction):\nDrop the preparingToPlay() case from the eviction predicate.\n(WebCore::MediaSessionManagerInterface::sessionWillEndPlayback): Use\nisPlayingOrPreparingToPlay().\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.h:\n* Source/WebCore/platform/audio/PlatformMediaSession.cpp:\n(WebCore::PlatformMediaSession::clientWillBeginPlayback): Capture the state\nat admission start in a local, passed to commitPlaybackAdmission() as a\nparameter rather than stored on the session.\n(WebCore::PlatformMediaSession::commitPlaybackAdmission): Added.\n* Source/WebCore/platform/audio/PlatformMediaSession.h:\n* Source/WebCore/platform/audio/PlatformMediaSessionInterface.h:\n(WebCore::PlatformMediaSessionInterface::admissionStillValid const):\n(WebCore::PlatformMediaSessionInterface::isPlayingOrPreparingToPlay const):\n* Source/WebCore/platform/audio/cocoa/MediaSessionManagerCocoa.h:\n* Source/WebCore/platform/audio/cocoa/MediaSessionManagerCocoa.mm:\n(WebCore::MediaSessionManagerCocoa::sessionDidCompleteAdmission): Replaces the\nsessionWillBeginPlayback() override.\n(WebCore::MediaSessionManagerCocoa::sessionWillBeginPlayback): Deleted.\n* Source/WebCore/platform/audio/glib/MediaSessionManagerGLib.cpp:\n(WebCore::MediaSessionManagerGLib::sessionDidCompleteAdmission): Ditto.\n(WebCore::MediaSessionManagerGLib::sessionWillBeginPlayback): Deleted.\n* Source/WebCore/platform/audio/glib/MediaSessionManagerGLib.h:\n* Source/WebCore/platform/audio/ios/MediaSessionManagerIOS.h:\n* Source/WebCore/platform/audio/ios/MediaSessionManagerIOS.mm:\n(WebCore::MediaSessionManageriOS::sessionDidCompleteAdmission): Ditto, keeping\nthe AirPlay playback target assignment.\n(WebCore::MediaSessionManageriOS::sessionWillBeginPlayback): Deleted.\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.cpp:\n(WebKit::RemoteMediaSessionManagerProxy::mediaSessionWillBeginPlayback):\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionProxy.cpp:\n(WebKit::RemoteMediaSessionProxy::commitPlaybackAdmission): Added.\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionProxy.h:\n* Source/WebKit/WebProcess/Media/RemoteMediaSessionManager.cpp:\n(WebKit::RemoteMediaSessionManager::sessionDidCompleteAdmission): Replaces the\nsessionWillBeginPlayback() override; the session-state snapshot is now taken\nafter commitPlaybackAdmission() has run.\n(WebKit::RemoteMediaSessionManager::sessionWillBeginPlayback): Deleted.\n* Source/WebKit/WebProcess/Media/RemoteMediaSessionManager.h:\n\nCanonical link: https://commits.webkit.org/319455@main", "email": "jya@apple.com", "hash": "b989a866564b70d8e8507f2d773c8f8df6d342f4", "subject": "PlatformMediaSession::clientWillBeginPlayback() should return a GenericPromise" }, "319456@main": { "author": "Lauro Moura", "avatar": "https://www.gravatar.com/avatar/6157f52d61e04c2c63fe7ff668ba69b3?d=identicon\u0026s=64", "cl": "319456@main", "clUrl": "https://commits.webkit.org/319456@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322100\n\nUnreviewed test gardening.\n\n* WebDriverTests/TestExpectations.json:\n\nCanonical link: https://commits.webkit.org/319456@main", "email": "lmoura@igalia.com", "hash": "32b2458357b3abec6f510df7d367e7d288dd2f99", "subject": "REGRESSION(319347@main) [WebDriver][WPE] test_move_to_fractional_position and test_touch_pointer_in_shadow_tree are failing" }, "319457@main": { "author": "Mike Wyrzykowski", "avatar": "https://www.gravatar.com/avatar/4b1bc9e238714f95e22d5d2454c07066?d=identicon\u0026s=64", "cl": "319457@main", "clUrl": "https://commits.webkit.org/319457@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321944\nrdar://184980365\n\nReviewed by Tadeu Zagallo.\n\nEvery .swiftinterface WebGPU ships verifies cleanly today, so the flag is not needed and is only suppressing future signal.\n\n* Source/WebGPU/Configurations/WebGPU.xcconfig:\n\nCanonical link: https://commits.webkit.org/319457@main", "email": "mwyrzykowski@apple.com", "hash": "6e16dfdcbbe773b612dd81f98e78f58ec89428d8", "subject": "Remove -no-verify-emitted-module-interface" }, "319458@main": { "author": "Tim Nguyen", "avatar": "https://www.gravatar.com/avatar/208c05ac2decdf818a4a08ada568328e?d=identicon\u0026s=64", "cl": "319458@main", "clUrl": "https://commits.webkit.org/319458@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322082\nrdar://185278019\n\nReviewed by Aditya Keerthi and Zak Ridouh.\n\n* Source/WebCore/html/HTMLDialogElement.cpp:\n(WebCore::HTMLDialogElement::show):\n(WebCore::HTMLDialogElement::showModal):\n\nCanonical link: https://commits.webkit.org/319458@main", "email": "ntim@apple.com", "hash": "1abaef0188b3b0cacac517aef0fcd6badf857835", "subject": "Clean up comments in HTMLDialogElement" }, "319459@main": { "author": "Diego Pino Garcia", "avatar": "https://www.gravatar.com/avatar/e8cce88637f1a6e79155e8371e24b2e8?d=identicon\u0026s=64", "cl": "319459@main", "clUrl": "https://commits.webkit.org/319459@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=212805\n\nReviewed by Tyler Wilcock.\n\nThe test needs a separate codepath for GLIB ports and a specific\nbaseline. There are several reasons for that:\n\n1) ATSPI returns 'AXRole: AXSection' for an SVGText element, while the\n general baseline expected 'AXRole: AXGroup'.\n2) ATSPI exposes a text-node directly on the object, instead of doing\n it in a separate object. That makes 'childrenCount' equal to 0 on\n GLIB ports while the general baseline expects 1 child.\n\n* LayoutTests/accessibility/svg-text.html:\n* LayoutTests/platform/glib/accessibility/svg-text-expected.txt: Added.\n* LayoutTests/platform/glib/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319459@main", "email": "dpino@igalia.com", "hash": "c5eba5138685519363fd6acc999cd79e0de5cf62", "subject": "[GLIB][a11y] accessibility/svg-text.html is failing since added in r262500" }, "319460@main": { "author": "Claudio Saavedra", "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64", "cl": "319460@main", "clUrl": "https://commits.webkit.org/319460@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317939\n\nReviewed by Michael Catanzaro.\n\nThis adds GRefPtrWrapper to generate-serializers.py, which can be used to\ngenerate a serializer for a type that is wrapped by GRefPtr. The\ncoding for such a type passes first for generated code that takes care\nof unwrapping/wrapping a GRefPtr.\n\nUse this to generate the serialization for GVariant, which now uses\nGRefPtrWrapper=GVariant and a CoreIPC wrapper.\n\nAlso add unit-test coverage for the new generator, which apparently\nalso had outdated generated files; regenerate to update those as well.\nThese generated files can be used during review to check the consistency\nof the GRefPtrWrapper-generated code.\n\nCovered by existing API tests (for WebProcessUserExtensions user\nmessages, for example, which test GVariant IPC).\n\n* Source/WebKit/PlatformGTK.cmake:\n* Source/WebKit/PlatformWPE.cmake:\n* Source/WebKit/Scripts/generate-serializers.py:\n(SerializedType.__init__):\n(SerializedType.namespace_and_name):\n(SerializedType.should_skip_forward_declare):\n(generate_header):\n(generate_one_impl):\n* Source/WebKit/Scripts/webkit/opaque_ipc_types.tracking.in:\n* Source/WebKit/Scripts/webkit/tests/GeneratedSerializers.cpp:\n(IPC::ArgumentCoder\u003cGRefPtr\u003cGFooBar\u003e\u003e::encode):\n(IPC::ArgumentCoder\u003cGRefPtr\u003cGFooBar\u003e\u003e::decode):\n* Source/WebKit/Scripts/webkit/tests/GeneratedSerializers.h:\n* Source/WebKit/Scripts/webkit/tests/SerializedTypeInfo.cpp:\n(WebKit::allSerializedTypes):\n* Source/WebKit/Scripts/webkit/tests/TestSerializedType.serialization.in:\n* Source/WebKit/Shared/glib/ArgumentCodersGLib.cpp:\n(IPC::ArgumentCoder\u003cGRefPtr\u003cGVariant\u003e\u003e::encode): Deleted.\n(IPC::ArgumentCoder\u003cGRefPtr\u003cGVariant\u003e\u003e::decode): Deleted.\n* Source/WebKit/Shared/glib/ArgumentCodersGLib.h:\n* Source/WebKit/Shared/glib/CoreIPCGVariant.cpp: Copied from Source/WebKit/Shared/glib/ArgumentCodersGLib.h.\n(WebKit::CoreIPCGVariant::CoreIPCGVariant):\n(WebKit::CoreIPCGVariant::data const):\n(WebKit::CoreIPCGVariant::operator GRefPtr\u003cGVariant\u003e const):\n* Source/WebKit/Shared/glib/CoreIPCGVariant.h: Copied from Source/WebKit/Shared/glib/ArgumentCodersGLib.h.\n(WebKit::CoreIPCGVariant::typeString const):\n* Source/WebKit/Shared/glib/CoreIPCGVariant.serialization.in: Added.\n* Source/WebKit/SourcesGTK.txt:\n* Source/WebKit/SourcesWPE.txt:\n\nCanonical link: https://commits.webkit.org/319460@main", "email": "csaavedra@igalia.com", "hash": "ef90833ee0ee96d9983960f95bac5691316dd254", "subject": "[GLIB] Add GRefPtrWrapper support to generate-serializers and generate GVariant IPC serialization" }, "319461@main": { "author": "Basuke Suzuki", "avatar": "https://www.gravatar.com/avatar/5192a1151c7575317affb7a4633f8d63?d=identicon\u0026s=64", "cl": "319461@main", "clUrl": "https://commits.webkit.org/319461@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321950\nrdar://185129202\n\nReviewed by Chris Dumez.\n\nBuild the WebKit side of a remote disable switch for shipped security fixes. A list fetched from\na server names flags, and every flag named is turned off at runtime, so a fix that turns out to\ncause a stability or web-compatibility regression can be disabled without waiting for a software\nupdate. This change is the mechanism only: there is no transport yet and nothing consumes a\nflag.\n\nSecurityFlags.yaml is a deliberately strict schema of two fields, humanReadableDescription and\ncondition; the type is always bool and the default is always the secure value. The key is the\nradar number of the fix, and that same string is the YAML key, the wire identifier and the C++\nmember name, so there is no name transformation anywhere and renaming a key is a protocol\nchange. Radar numbers are what keep a key unique over time, since one list is served to every OS\nversion we still support. humanReadableDescription is required because the key says nothing\nabout what the flag guards. GenerateSecurityFlags.rb stays separate from GeneratePreferences.rb\nbecause an explicit field whitelist is what stops this schema from drifting into\nUnifiedWebPreferences.yaml's.\n\nThe list is the whole truth rather than a set of edits: setDisabledFlagsNamed builds a fresh\nall-enforced value and turns off only the names it carries, so a name dropping out moves that\nflag back to enforced and an empty list resets everything, which is what makes a disablement\nthat itself causes trouble undoable. Every flag defaults to its secure value, so the window\nbefore a list arrives and any failure to fetch one both fail safe. An unknown name is ignored\nrather than treated as an error, because entries stay in the list for years and an older WebKit\nroutinely sees names for flags it does not have.\n\nSecurityFlagsController owns the one authoritative value for the UIProcess, as a singleton\nrather than state on a process proxy because the value is device-global while the proxies are\nper-pool. Reading a flag through it is safe from any thread, and setting them asserts the main run\nloop because that is what propagateToChildProcesses() needs. It reaches the Networking, GPU and\nModel processes in their creation parameters at\nlaunch and over a new SecurityFlagsDidChange message while they are running. Unlike its\nSharedPreferencesForWebProcessDidChange neighbour that message carries no ProcessIdentifier and\ntakes no reply, which serve per-connection scoping and a version barrier and do not apply here;\nthe stale direction is fail safe because a child that has not received an update keeps\nenforcing.\n\nSecurityFlags stores a WTF::BitSet of the *disabled* flags, so the secure default falls out of\nzero initialisation and the representation matches what the list expresses. concurrentGet gives\nan atomic per-flag read, a single relaxed word load, so a check can run on whatever thread it\nlands on, which matters because the GPU process dispatches stream receivers off the main thread;\nflags are independent of each other, so a stale read only delays a change. One std::atomic\ninstead would have capped the type at 128 flags on 64-bit Apple platforms, past which it\nsilently takes a lock on every security check.\n\nThe BitSet stays private and off the wire: serialization goes through a getter and a CreateUsing\nfactory converting to and from plain 64-bit words, so the wire form does not depend on which\nword type BitSet picked and no new general-purpose ArgumentCoder is needed. The factory rejects\na word with a bit belonging to no flag rather than dropping it quietly, since the sender is the\nUIProcess and that can only mean a bug. Copy assignment is deleted because assigning the words\nwholesale is not safe against a reader on another thread. The description is marked\n[WebKitPlatform] so the coder lands in libWebKitPlatform.a, without which the round-trip tests\nfail to link TestIPC -- the same reason EditingRange and ShareableResourceHandle are marked that\nway.\n\nThe generator validates the raw YAML node tree rather than the parsed hash, because YAML\nsilently collapses a repeated key and keeps only the last one, so by the time load_file has\nreturned a duplicated flag is invisible and someone else's description has been discarded. One\npass covers ordering, duplication within a file, and a key defined in two flag files, which\nwould otherwise only surface as a C++ redefinition. Ordering is by radar number rather than by\nstring, because a string sort puts radar1000000000 before radar99999999 and the file has to be\nkept sorted by hand. A leading zero is rejected because radar0184485266 and radar184485266 would\nbe two wire identifiers for one radar.\n\nDisabling a flag is reachable only from testing SPI, and that SPI is compiled out unless\nENGINEERING_BUILD is set. That is keyed on the build configuration rather than on the SDK, so it\nis off for Production -- the configuration a customer build uses -- and the entry point does not\nexist there at all. A client embedding WebKit must not be able to weaken a shipped security fix.\nIt is on for Debug and Release, which is also what the open-source bots build, so the API tests\ndriving the SPI compile and run there rather than being skipped as an internal-SDK-only build\nwould leave them.\n\nThe flags are never sent to the WebContent process, which we assume is compromised, so a check\nthere would be worthless. There is no per-flag process scoping to express that; the struct\nsimply has no path to WebContent. That is also why the member is added to the three\n*ProcessCreationParameters separately rather than to the shared\nAuxiliaryProcessCreationParameters, which looks like the obvious single place but is embedded in\nWebProcessCreationParameters too.\n\nThe one entry is radar184485266, the radar for this feature. It guards no fix and exists to\nvalidate the mechanism end to end before anything in production depends on it.\n\nTests: ArgumentCoderSecurityFlags.SecureDefaultRoundTrips\n ArgumentCoderSecurityFlags.DisabledFlagRoundTrips\n ArgumentCoderSecurityFlags.BitBelongingToNoFlagIsRejectedNotCrashed\n SecurityFlagsTest.SecureByDefault\n SecurityFlagsTest.DidChangeReachesRunningProcess\n SecurityFlagsTest.CreationParametersReachNewProcess\n SecurityFlagsTest.UnknownFlagNameIsIgnored\n\n* Source/WTF/Scripts/GenerateSecurityFlags.rb: Added.\n* Source/WTF/Scripts/Preferences/SecurityFlags.yaml: Added.\n* Source/WTF/WTF.xcodeproj/project.pbxproj:\n* Source/WTF/wtf/CMakeLists.txt:\n* Source/WebKit/CMakeLists.txt:\n* Source/WebKit/DerivedSources-input.xcfilelist:\n* Source/WebKit/DerivedSources-output.xcfilelist:\n* Source/WebKit/DerivedSources.make:\n* Source/WebKit/Scripts/IPCTestingHeaders-input.xcfilelist:\n* Source/WebKit/Scripts/IPCTestingHeaders-output.xcfilelist:\n* Source/WebKit/Scripts/SecurityFlagsTemplates/SecurityFlags.cpp.erb: Added.\n* Source/WebKit/Scripts/SecurityFlagsTemplates/SecurityFlags.h.erb: Added.\n* Source/WebKit/Scripts/SecurityFlagsTemplates/SecurityFlags.serialization.in.erb: Added.\n* Source/WebKit/Sources.txt:\n* Source/WebKit/SourcesCMakeCocoa.txt:\n* Source/WebKit/UIProcess/SecurityFlagsController.h: Added.\n* Source/WebKit/UIProcess/SecurityFlagsController.cpp: Added.\n(WebKit::SecurityFlagsController::singleton):\n(WebKit::SecurityFlagsController::setDisabledFlagsNamed):\n(WebKit::SecurityFlagsController::propagateToChildProcesses):\n* Source/WebKit/GPUProcess/GPUProcess.h:\n(WebKit::GPUProcess::securityFlags):\n* Source/WebKit/GPUProcess/GPUProcess.cpp:\n(WebKit::GPUProcess::securityFlagsDidChange):\n(WebKit::GPUProcess::initializeGPUProcess):\n* Source/WebKit/GPUProcess/GPUProcess.messages.in:\n* Source/WebKit/GPUProcess/GPUProcessCreationParameters.h:\n* Source/WebKit/GPUProcess/GPUProcessCreationParameters.serialization.in:\n* Source/WebKit/NetworkProcess/NetworkProcess.h:\n(WebKit::NetworkProcess::securityFlags):\n* Source/WebKit/NetworkProcess/NetworkProcess.cpp:\n(WebKit::NetworkProcess::initializeNetworkProcess):\n(WebKit::NetworkProcess::securityFlagsDidChange):\n(WebKit::NetworkProcess::isSecurityFlagEnabledForTesting):\n* Source/WebKit/NetworkProcess/NetworkProcess.messages.in:\n* Source/WebKit/NetworkProcess/NetworkProcessCreationParameters.h:\n* Source/WebKit/NetworkProcess/NetworkProcessCreationParameters.serialization.in:\n* Source/WebKit/ModelProcess/ModelProcess.h:\n(WebKit::ModelProcess::securityFlags):\n* Source/WebKit/ModelProcess/ModelProcess.cpp:\n(WebKit::ModelProcess::securityFlagsDidChange):\n(WebKit::ModelProcess::initializeModelProcess):\n* Source/WebKit/ModelProcess/ModelProcess.messages.in:\n* Source/WebKit/ModelProcess/ModelProcessCreationParameters.h:\n* Source/WebKit/ModelProcess/ModelProcessCreationParameters.serialization.in:\n* Source/WebKit/UIProcess/GPU/GPUProcessProxy.h:\n* Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp:\n(WebKit::GPUProcessProxy::GPUProcessProxy):\n(WebKit::GPUProcessProxy::securityFlagsDidChange):\n* Source/WebKit/UIProcess/Network/NetworkProcessProxy.h:\n* Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp:\n(WebKit::NetworkProcessProxy::sendCreationParametersToNewProcess):\n(WebKit::NetworkProcessProxy::securityFlagsDidChange):\n(WebKit::NetworkProcessProxy::isSecurityFlagEnabledForTesting):\n* Source/WebKit/UIProcess/Model/ModelProcessProxy.h:\n* Source/WebKit/UIProcess/Model/ModelProcessProxy.cpp:\n(WebKit::ModelProcessProxy::ModelProcessProxy):\n(WebKit::ModelProcessProxy::securityFlagsDidChange):\n* Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStore.mm:\n(+[WKWebsiteDataStore _setDisabledSecurityFlagsForTesting:]):\n(-[WKWebsiteDataStore _isSecurityFlagEnabledInNetworkProcessForTesting:completionHandler:]):\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/IPC/ArgumentCoderTests.cpp:\n(TestWebKitAPI::TEST(ArgumentCoderSecurityFlags, SecureDefaultRoundTrips)):\n(TestWebKitAPI::TEST(ArgumentCoderSecurityFlags, DisabledFlagRoundTrips)):\n(TestWebKitAPI::TEST(ArgumentCoderSecurityFlags, BitBelongingToNoFlagIsRejectedNotCrashed)):\n* Tools/TestWebKitAPI/SourcesCocoa.txt:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SecurityFlags.mm: Added.\n(TestWebKitAPI::flagStateInNetworkProcess):\n(TestWebKitAPI::launchNetworkProcess):\n(TestWebKitAPI::TEST_F(SecurityFlagsTest, SecureByDefault)):\n(TestWebKitAPI::TEST_F(SecurityFlagsTest, DidChangeReachesRunningProcess)):\n(TestWebKitAPI::TEST_F(SecurityFlagsTest, CreationParametersReachNewProcess)):\n(TestWebKitAPI::TEST_F(SecurityFlagsTest, UnknownFlagNameIsIgnored)):\n\nCanonical link: https://commits.webkit.org/319461@main", "email": "basuke@apple.com", "hash": "722d0b38a97ce1a15ca4d7d1cb051215d11f96da", "subject": "[SecurityFlags] Introduce SecurityFlags and propagate them to the privileged child processes" }, "319462@main": { "author": "Tadeu Zagallo", "avatar": "https://www.gravatar.com/avatar/d517fd5480efde083cc7b6af36c73ced?d=identicon\u0026s=64", "cl": "319462@main", "clUrl": "https://commits.webkit.org/319462@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322101\nrdar://183337191\n\nReviewed by Yusuke Suzuki.\n\nemitSwitchChar()'s StringUse case called op1.use() before speculateString(), so\nthe operand's death event preceded the BadType exit in the variable event stream.\nReconstruction then handed out a dead-value recovery for every bytecode local\nwhose MovHint pointed at that node (here the scrutinee temporary, whose\nSetLocal the DFG had eliminated) and baseline re-executed op_switch_char on it.\n\nSpeculate before releasing the operand, as emitSwitchString() already does.\n\nTest: JSTests/stress/switch-char-scrutinee-live-at-osr-exit.js\n\n* JSTests/stress/switch-char-scrutinee-live-at-osr-exit.js: Added.\n(opt.switch.case.string_appeared_here):\n(opt):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n(JSC::DFG::SpeculativeJIT::emitSwitchChar):\n\nCanonical link: https://commits.webkit.org/319462@main", "email": "tzagallo@apple.com", "hash": "3ddc7045b7c5a9ccb6ef09124c7b8efb93527208", "subject": "[JSC] DFG SwitchChar releases its operand before speculating that it is a string" }, "319463@main": { "author": "Joanne Pan", "avatar": "https://www.gravatar.com/avatar/5cbbf578426a0c98cb5c977ca2dd88fc?d=identicon\u0026s=64", "cl": "319463@main", "clUrl": "https://commits.webkit.org/319463@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319919\nrdar://182846761\n\nReviewed by Antti Koivisto and Tim Nguyen.\n\nBoth functions number their own random draws from zero, so an auto random() and an\nauto random-item() in one value each claimed index 0. With the same property and\nelement they built the same RandomCachingKey and resolved to one base value, so\n`width: calc(random(auto, 0px, 400px) + random-item(auto, 0px, 1000px))` rolled\none die instead of two. 319153@main made this reachable by giving random-item()'s\n`auto` the element scoping it was missing.\n\nRecord which function a derived property scope came from, so the two get separate\nbuckets. Only derived scopes carry it, leaving an author's \u003cdashed-ident\u003e and a\nbare element-scoped key shared across both functions as before.\n\nWhether the spec wants one index sequence across both functions or one per\nfunction is open as csswg-drafts#14330. This keys on the function rather than\nmerging the sequences, which fixes the collision under either answer, and does not\ndepend on counting across the substitution and parse phases. \u003crandom-ua-ident\u003e\nserialization will need to account for the function once it is implemented\n(bug 321552).\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-item-computed-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-item-computed.html:\n* Source/WebCore/css/calc/CSSCalcRandomSharing.h:\n* Source/WebCore/css/calc/CSSCalcTree+Parser.cpp:\n(WebCore::CSSCalc::consumeRandom):\n* Source/WebCore/style/StyleSubstitutionResolver.cpp:\n(WebCore::Style::SubstitutionResolver::randomItemBaseValue):\n\nCanonical link: https://commits.webkit.org/319463@main", "email": "jpan0917@gmail.com", "hash": "b70772b13dd06af968f0de8aef4e81404bede915", "subject": "[css-values-5 random-item()] auto random() and random-item() in the same property value get the same random value" }, "319464@main": { "author": "Justin Michaud", "avatar": "https://www.gravatar.com/avatar/36e0433ee725a08f7e1122a6bc584b57?d=identicon\u0026s=64", "cl": "319464@main", "clUrl": "https://commits.webkit.org/319464@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321653\n\nReviewed by Carlos Alberto Lopez Perez.\n\nWe have some wasm OOM crashes on the bots because they have\nvery high core counts but not enough memory.\n\nEx: https://build.webkit.org/#/builders/2018/builds/44\n\nLet's pick a more reasonable number of default wasm threads.\n\nCanonical link: https://commits.webkit.org/319464@main", "email": "jmichaud@igalia.com", "hash": "1c2c282d06f0a0c454ca7715044d179c9bfd5139", "subject": "Set a more reasonable default number of wasm threads" }, "319465@main": { "author": "Anthony Tarbinian", "avatar": "https://www.gravatar.com/avatar/ef46154a1a21c6a5ef593e952ebc62f4?d=identicon\u0026s=64", "cl": "319465@main", "clUrl": "https://commits.webkit.org/319465@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321531\nrdar://168602323\n\nReviewed by Charlie Wolfe.\n\nWith site isolation enabled, it's possible for a web process to have a handle on\na Page with a stale topOrigin. Then, when the web process communicates to the\nNetworkProcess, the innocent web process is wrongfully terminated.\n\nThis resulted in ads on bbc.com to go blank after clicking on a few ads on the\npage.\n\nHere's the scenario that triggers the bug:\n\n1. Page A is bbc.com (WP1) with a google.com iframe (WP2)\n2. Some user click creates a new Page B in a different process (i.e. ad.com)\n3. Event though there's no google.com iframe on Page B, it still has a copy of\n Page B's state due to BrowsingContextGroup::addPage.\n4. Page B's main frame navigates to ford.com (WP3). ford.com happens to have a\n google.com iframe.\n5. ford.com (WP3) sends BroadcastAllDocumentSyncData to the UIProcess to inform\n it about the navigation.\n5. Normally, WebPageProxy::broadcastAllDocumentSyncData will broadcast Page B's\n new top origin information to other web process. However it has an early\n return which skips this broadcast if the web process that sent\n BroadcastAllDocumentSyncData doesn't match legacyMainFrameProcess. In this\n scenario, the legacyMainFrameProcess still points to an old web process and\n didn't get updated yet to the ford.com WP3.\n6. WebKit sees that ford.com has a google.com iframe and places it in WP2 (which\n was already hosting the google.com iframe on Page A).\n6. Since WP2 never received the updated top origin, it has a stale view of Page\n B and gets terminated for having the wrong top origin when talking to the\n NetworkProcess.\n\nThis patch fixes this bug by keeping WP2's topOrigin for Page B in sync with the\nactual main frame of page B.\n\nThe bug is that the right topOrigin doesn't get broadcasted if the sender is a\nprovisional page due to an early return in\nWebPageProxy::broadcastAllDocumentSyncData.\n\nInstead of dropping the broadcast, this patch updates top origin by updating\nthe DocumentSyncData of the web process's copy of WebPage\n(during WebPage;:reinitializeWebPage).\n\nThis DocumentSyncData comes from the CreateWebPage IPC which is sent by\nthe UIProcess with the page's updated top origin.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::reinitializeWebPage):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, TopOriginInRemoteProcessesAfterMainFrameProcessSwap)):\n\nCanonical link: https://commits.webkit.org/319465@main", "email": "a_tarbinian@apple.com", "hash": "86ad754c5241dc05eefb5ce157aa0967e3dfa785", "subject": "[Site Isolation] ad iframes auto-refresh after returning from ad clicks." }, "319466@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "319466@main", "clUrl": "https://commits.webkit.org/319466@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322056\nrdar://185246834\n\nReviewed by Zak Ridouh.\n\nOtherwise I get a lot of linker failures like this:\n\nUndefined symbols for architecture arm64e:\n \"JSC::Identifier::fromUid(JSC::VM\u0026, WTF::UniquedStringImpl*)\", referenced from:\n .../WebKitBuild/cmake-mac/DebugO3/Source/WebCore/CMakeFiles/WebCoreStyle.dir/WebCoreStyle_pch_obj.cpp.o\n \"void* JSC::allocateCell\u003cJSC::JSFinalObject\u003e(JSC::VM\u0026, unsigned long)\", referenced from:\n .../WebKitBuild/cmake-mac/DebugO3/Source/WebCore/CMakeFiles/WebCoreStyle.dir/WebCoreStyle_pch_obj.cpp.o\n \"void* JSC::allocateCell\u003cJSC::CustomGetterSetter\u003e(JSC::VM\u0026, unsigned long)\", referenced from:\n .../WebKitBuild/cmake-mac/DebugO3/Source/WebCore/CMakeFiles/WebCoreStyle.dir/WebCoreStyle_pch_obj.cpp.o\n ...\n\n* CMakePresets.json:\n* Source/cmake/WebKitCompilerFlags.cmake:\n* Source/cmake/WebKitMacros.cmake:\n\nCanonical link: https://commits.webkit.org/319466@main", "email": "achristensen@apple.com", "hash": "69acaeddc2f92e1bb4a45ff299b8d38c95f71e63", "subject": "Fix mac-dev-debug-o3 cmake build" }, "319467@main": { "author": "Marta Darbinyan", "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64", "cl": "319467@main", "clUrl": "https://commits.webkit.org/319467@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321961\nrdar://185147134\n\nUnreviewed test Gardening\n\nRemoving the test expectation after the fix.\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319467@main", "email": "darbinyan@apple.com", "hash": "04158642a9d36dacad650c864a8e1177cd33d9d0", "subject": "[Gardening]: [ macOS Debug ] imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audionode-interface/audionode-channel-rules.html is a flaky crash" }, "319468@main": { "author": "Nikolas Zimmermann", "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64", "cl": "319468@main", "clUrl": "https://commits.webkit.org/319468@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322055\n\nReviewed by Said Abou-Hallawa.\n\nSVGLengthContext::computeViewportSize() resolves a descendant's viewport\nsize from the nearest \u003csvg\u003e by recomputing currentViewBoxRect() on every\ncall. During a transform animation this runs once per shape per frame,\neven though the viewport is invariant across the flush and identical for\nall shapes under the same \u003csvg\u003e.\n\nCache the derived size - mirroring the existing logic used already for\nm_cachedViewportSizeExcludingZoom.\n\nCovered by existing tests.\n\n* Source/WebCore/rendering/svg/RenderSVGRoot.cpp:\n(WebCore::RenderSVGRoot::layout):\n* Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp:\n(WebCore::RenderSVGViewportContainer::updateLayoutSizeIfNeeded):\n* Source/WebCore/svg/SVGLengthContext.cpp:\n(WebCore::SVGLengthContext::computeViewportSize const):\n* Source/WebCore/svg/SVGSVGElement.cpp:\n(WebCore::SVGSVGElement::viewportSizeForLengthResolution const):\n* Source/WebCore/svg/SVGSVGElement.h:\n\nCanonical link: https://commits.webkit.org/319468@main", "email": "nzimmermann@igalia.com", "hash": "48f0a2d2fe553bb66088d7158e509f6c01b44321", "subject": "[LBSE] Cache the SVG viewport size used for length resolution" }, "319469@main": { "author": "Patrick Griffis", "avatar": "https://www.gravatar.com/avatar/2233c3a857004b126158572af9fe36f7?d=identicon\u0026s=64", "cl": "319469@main", "clUrl": "https://commits.webkit.org/319469@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321520\n\nReviewed by Claudio Saavedra.\n\nThey outright block any UA they don't like.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/UserAgentQuirks.cpp\n\n* Source/WebCore/platform/glib/UserAgentQuirks.cpp:\n(WebCore::urlRequiresFirefoxBrowser):\n* Tools/TestWebKitAPI/Tests/WebCore/UserAgentQuirks.cpp:\n(TestWebKitAPI::TEST(UserAgentTest, Quirks)):\n\nCanonical link: https://commits.webkit.org/319469@main", "email": "pgriffis@igalia.com", "hash": "fe4fb973bb6d32f38dd816b7d11db803bd35162d", "subject": "[GLib] Use Firefox Quirk for claude.ai" }, "319470@main": { "author": "Morne Veldsman", "avatar": "https://www.gravatar.com/avatar/7fd5d2d947856098f50cc45905c33063?d=identicon\u0026s=64", "cl": "319470@main", "clUrl": "https://commits.webkit.org/319470@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=214512\nrdar://65750362\n\nUnreviewed test gardening.\n\nThis has been marked as failing on all of mac since r264558, but it only fails on x86_64.\nThe addPath cases put rendered canvas data in their failure messages, and the baseline\nholds arm64's bytes, so Intel never matches. EWS agrees — mac-wk2 and the arm64 Tahoe\nDebug bot pass, mac-intel-wk2 fails. It also passed 8/8 under WebKitTestRunner and 3/3\nunder DumpRenderTree on my arm64 machine.\n\nScoping the line instead of adding an Intel baseline, since baselines only fall back by OS\nand port. Leaving the bug open — iOS still reports [ Pass Failure ] and GLib has its own\nfailure under webkit.org/b/273480.\n\nimported/w3c/web-platform-tests/css/geometry/DOMMatrix2DInit-validate-fixup.html\n\n* LayoutTests/platform/mac/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319470@main", "email": "morne@apple.com", "hash": "485c1d7d3b9af6ec7718e469d41a03a5b558052c", "subject": "[Geometry Interfaces] DOMMatrix2DInit-validate-fixup.html is only failing on x86_64 mac" }, "319471@main": { "author": "Adrian Taylor", "avatar": "https://www.gravatar.com/avatar/d2acb8ad2e2670ff74ae0d65fb27014c?d=identicon\u0026s=64", "cl": "319471@main", "clUrl": "https://commits.webkit.org/319471@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322104\nrdar://185321693\n\nReviewed by Zak Ridouh.\n\nAdd platform gates so that this does not discombobulate the Windows Swift C++\nimporter.\n\nCanonical link: https://commits.webkit.org/319471@main", "email": "adrian_taylor@apple.com", "hash": "905a2256713b2d5786379bce89176ec04bf44685", "subject": "Gate UniStdExtras" }, "319472@main": { "author": "Przemyslaw Gorszkowski", "avatar": "https://www.gravatar.com/avatar/e543ed682c6f99c866b01ca9bcbab360?d=identicon\u0026s=64", "cl": "319472@main", "clUrl": "https://commits.webkit.org/319472@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319665\n\nReviewed by Alicia Boya Garcia and Nikolas Zimmermann.\n\nThis bundles three related fixes uncovered while restoring pages containing\na media element (e.g.: \"video\") from the back/forward cache:\n\n1. HTMLMediaElement::suspend() destroyed the media player on entering the\n cache (via stopWithoutDestroyingMediaPlayer() -\u003e userCancelledLoad()),\n so a restored page reported video.error.code == MEDIA_ERR_ABORTED.\n userCancelledLoad() now takes a destroyMediaPlayer flag, false for the\n BackForwardCache suspension path, so it early-returns instead of tearing\n the player down.\n\n2. A \u003cvideo\u003e that was playing before being cached did not resume playing\n after restore. HTMLMediaElement::resume() schedules an updatePlayState()\n task while the media session is still interrupted. mayResumePlayback()\n now also retries updatePlayState() when the element isn't paused.\n\n3. A \u003cvideo\u003e that was paused before being cached showed a blank/white\n frame instead of its last decoded frame after restore. Restoring a page\n rebuilds the render tree, so CoordinatedPlatformLayerBufferProxy gets\n attached to a brand new CoordinatedPlatformLayer with no buffer of its\n own, and a paused GStreamer pipeline has no new sample to push. The\n proxy now invokes a layer-attached callback whenever a new non-null\n layer is attached, which MediaPlayerPrivateGStreamer uses to re-deliver\n its current sample so the new layer isn't left blank.\n\nAlso fixes a related macOS-only assert crash (ASSERTION FAILED:\nm_mediaSessions.contains(identifier) in MediaUsageManagerCocoa::\nupdateMediaUsage): the UI process unconditionally clears its usage-tracking\nmap on every navigation commit, including a back/forward cache restore, but\nMediaElementSession kept believing it had already added its session across\nthe whole suspend/resume cycle. mediaUsageManagerSessionWillBeSuspended()\nresets that flag on suspend so the next update re-adds the session first.\n\nA LayoutTest for the playing-before-caching scenario (fix #2):\nit plays a video, waits for the playing event, navigates away and\nback via history.back(), and asserts the video is still not paused and\ncurrentTime has advanced after restore.\n\nAdded a LayoutTest based on media/restore-from-page-cache.html for a video\nthat was paused before entering the cache, as a real pixel/screenshot\ncomparison to catch the blank-frame regression from fix #3.\n\nTests: media/restore-from-page-cache-paused.html\n media/restore-from-page-cache-playing.html\n* LayoutTests/media/restore-from-page-cache-paused-expected.png: Added.\n* LayoutTests/media/restore-from-page-cache-paused-expected.txt: Added.\n* LayoutTests/media/restore-from-page-cache-paused.html: Added.\n* LayoutTests/media/restore-from-page-cache-playing-expected.txt: Added.\n* LayoutTests/media/restore-from-page-cache-playing.html: Added.\n* LayoutTests/platform/ios/TestExpectations:\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::userCancelledLoad):\n(WebCore::HTMLMediaElement::stopWithoutDestroyingMediaPlayer):\n(WebCore::HTMLMediaElement::suspend):\n(WebCore::HTMLMediaElement::mayResumePlayback):\n* Source/WebCore/html/HTMLMediaElement.h:\n* Source/WebCore/html/MediaElementSession.cpp:\n(WebCore::MediaElementSession::mediaUsageManagerSessionWillBeSuspended):\n* Source/WebCore/html/MediaElementSession.h:\n* Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:\n(WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):\n(WebCore::MediaPlayerPrivateGStreamer::pushTextureToCompositor):\n(WebCore::MediaPlayerPrivateGStreamer::triggerRepaint):\n* Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferProxy.cpp:\n(WebCore::CoordinatedPlatformLayerBufferProxy::CoordinatedPlatformLayerBufferProxy):\n(WebCore::CoordinatedPlatformLayerBufferProxy::create):\n(WebCore::CoordinatedPlatformLayerBufferProxy::setTargetLayer):\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferProxy.h:\n\nCanonical link: https://commits.webkit.org/319472@main", "email": "pgorszkowski@igalia.com", "hash": "f60e5f1e1bd13f7bf56ecb74ce85f1638ee60d7e", "subject": "MEDIA_ERR_ABORTED after restore page with media from bfcache" }, "319473@main": { "author": "Patrick Griffis", "avatar": "https://www.gravatar.com/avatar/2233c3a857004b126158572af9fe36f7?d=identicon\u0026s=64", "cl": "319473@main", "clUrl": "https://commits.webkit.org/319473@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322060\n\nReviewed by Adrian Perez de Castro.\n\nPreviously it ignored dark mode entirely. Also made minor tweak\nto it's border to be rounded like everything else is.\n\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/css/css-transforms/transform-input-017-expected.png: Added.\n* Source/WebCore/platform/graphics/adwaita/Adwaita.h:\n* Source/WebCore/platform/graphics/adwaita/ToggleButtonAdwaita.cpp:\n(WebCore::ToggleButtonAdwaita::drawCheckbox):\n(WebCore::ToggleButtonAdwaita::drawRadio):\n\nCanonical link: https://commits.webkit.org/319473@main", "email": "pgriffis@igalia.com", "hash": "ca336a9d896b21710b6e22b42635b03e1fed86fc", "subject": "[Adwaita] Fix togglebutton not respecting dark mode" }, "319474@main": { "author": "Yoav Weiss", "avatar": "https://www.gravatar.com/avatar/228600d5a1cfae576e64ee92e46f6a1e?d=identicon\u0026s=64", "cl": "319474@main", "clUrl": "https://commits.webkit.org/319474@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319492\n\nReviewed by Keith Miller.\n\nThis implements the spec changes from https://github.com/whatwg/html/pull/10327 to avoid caching HTTP or network module import failures.\n\nNo new tests, but lots of progressions.\n\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/json-module/repeated-imports.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/json-module/repeated-imports.any.sharedworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/json-module/repeated-imports.any.worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/concurrent-failed-imports-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/concurrent-failed-imports.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/concurrent-failed-imports.any.sharedworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/concurrent-failed-imports.any.worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/repeated-imports.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/repeated-imports.any.sharedworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/repeated-imports.any.worker-expected.txt:\n* Source/JavaScriptCore/runtime/JSMicrotask.cpp:\n(JSC::moduleLoadTopRejected): Avoid registering failed module loads.\n(JSC::moduleLoadStoreError): Avoid registering failed module loads.\n(JSC::runInternalMicrotask): Avoid registering failed module loads.\n(JSC::moduleLoadTopSettled): Avoid registering failed module loads.\n* Source/JavaScriptCore/runtime/JSModuleLoader.cpp:\n(JSC::JSModuleLoader::loadModule): Remove failed modules.\n(JSC::JSModuleLoader::removeFailedFetchEntry):\n* Source/JavaScriptCore/runtime/JSModuleLoader.h:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/instantiation-error-8-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/319474@main", "email": "yoav.weiss@shopify.com", "hash": "f324cca020c0e50244783167f30a433f24758888", "subject": "Don't cache HTTP/network errors in the module map" }, "319475@main": { "author": "Luke Warlow", "avatar": "https://www.gravatar.com/avatar/262b456ff1e93842b93f9694d1e01a9e?d=identicon\u0026s=64", "cl": "319475@main", "clUrl": "https://commits.webkit.org/319475@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320556\n\nReviewed by Ryosuke Niwa and Darin Adler.\n\nImplements the missing moving steps for the option element.\n\nSpec: https://html.spec.whatwg.org/multipage/form-elements.html#the-option-element:html-element-moving-steps\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/select-option-optgroup-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/select-option-optgroup.html:\n* Source/WebCore/html/HTMLOptionElement.cpp:\n(WebCore::HTMLOptionElement::movingSteps):\n* Source/WebCore/html/HTMLOptionElement.h:\n\nCanonical link: https://commits.webkit.org/319475@main", "email": "lwarlow@igalia.com", "hash": "4247c3f6c8db79e938e16e742937ed93969b9a21", "subject": "Implement moving steps for HTMLOptionElement" }, "319476@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "319476@main", "clUrl": "https://commits.webkit.org/319476@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322111\n\u003crdar://problem/185330733\u003e\n\nReviewed by Antti Koivisto.\n\n \u003cstyle\u003e\n li { list-style-type: \"\\627\\644\\641\"; font-size: 16px }\n \u003c/style\u003e\n \u003cul\u003e\u003cli\u003etext\n \u003cscript\u003e\n document.body.offsetTop;\n document.querySelector(\"li\").style.fontSize = \"32px\";\n \u003c/script\u003e\n\nNow that markers create their own subtrees, style needs to get propagated too.\n\n* Source/WebCore/rendering/RenderListMarker.cpp:\n(WebCore::RenderListMarker::styleDidChange):\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/list-marker-font-size-mutation.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/list-marker-font-size-mutation-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/list-marker-font-size-mutation-expected.html: Added.\n\nCanonical link: https://commits.webkit.org/319476@main", "email": "zalan@apple.com", "hash": "13bd343994335cc3c8ca209e4c4291615bb4749e", "subject": "[list-marker] A dynamic font change does not reach the list marker's content renderers" }, "319477@main": { "author": "Richard Robinson", "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64", "cl": "319477@main", "clUrl": "https://commits.webkit.org/319477@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322121\nrdar://184743776\n\nReviewed by Aditya Keerthi and Abrar Rahman Protyasha.\n\nRevert 318934@main\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/319477@main", "email": "richard_robinson2@apple.com", "hash": "0c3354415414405cc5556f6dd44ce8b3b449c8e7", "subject": "REGRESSION(318934@main): PDF HUD does not have interactive glass behavior" }, "319478@main": { "author": "Cole Carley", "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64", "cl": "319478@main", "clUrl": "https://commits.webkit.org/319478@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321960\nrdar://185144394\n\nReviewed by Zak Ridouh.\n\nI am going to start making large changes to the quirking system. I want to be sure\nthat my changes do not affect what quirks are active for which websites.\n\nThis patch tests many quirked domains. The expected.txt file is a sorted list of\nactive quirks under each domain being tested. This way, I can make large changes\nwhile ensuring that each site continues being quirked in the same way.\n\nTest: fast/quirks/active-quirks-by-domain.html\n\n* Source/WebCore/page/Quirks.cpp:\n* Source/WebCore/page/Quirks.h:\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::activeQuirks const):\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\n* LayoutTests/fast/quirks/active-quirks-by-domain-expected.txt: Added.\n* LayoutTests/fast/quirks/active-quirks-by-domain.html: Added.\n* LayoutTests/platform/glib/fast/quirks/active-quirks-by-domain-expected.txt: Added.\n* LayoutTests/platform/ios/fast/quirks/active-quirks-by-domain-expected.txt: Added.\n* LayoutTests/fast/quirks/active-quirks-sdk-gated-expected.txt: Added.\n* LayoutTests/fast/quirks/active-quirks-sdk-gated.html: Added.\n* LayoutTests/fast/quirks/resources/quirk-test-domains.js: Added.\n(isSDKGatedQuirk):\n(reportActiveQuirks):\n* LayoutTests/platform/ios/fast/quirks/active-quirks-sdk-gated-expected.txt: Added.\n* LayoutTests/platform/mac-sequoia/fast/quirks/active-quirks-sdk-gated-expected.txt: Added.\n* LayoutTests/platform/mac-tahoe/fast/quirks/active-quirks-sdk-gated-expected.txt: Added.\n* LayoutTests/platform/mac/fast/quirks/active-quirks-sdk-gated-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/319478@main", "email": "ccarley2@apple.com", "hash": "c8003a12b86c0c7e1a2287b1aa339bb0dedc481a", "subject": "Add tests for the active quirks for relevant domains per platform" }, "319479@main": { "author": "Matt Woodrow", "avatar": "https://www.gravatar.com/avatar/cc2397f5735802900c7bd10e44601cc1?d=identicon\u0026s=64", "cl": "319479@main", "clUrl": "https://commits.webkit.org/319479@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322072\n\u003crdar://182787176\u003e\n\nReviewed by Kimmo Kinnunen.\n\nWebPageProxy::takeSnapshot can intentionally use an empty size for the snapshot\n(when _setUsesContentsRect is TRUE), for the WebProcess to resolve the actual\nsize. Sending this empty size to the GPUProcess fails to allocate a buffer, and\ncrashes.\n\nReturn the resolved size from the WebProcess, and use that to send to the\nGPUProcess instead.\n\nTests: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebViewSnapshot.mm\n\n* Source/WebKit/GPUProcess/GPUProcess.cpp:\n(WebKit::GPUProcess::sinkCompletedSnapshotToPDF):\n(WebKit::GPUProcess::sinkCompletedSnapshotToBitmap):\n* Source/WebKit/GPUProcess/graphics/RemoteSnapshot.cpp:\n(WebKit::RemoteSnapshot::drawToBitmap):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::takeSnapshot):\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::takeRemoteSnapshot):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.messages.in:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebViewSnapshot.mm:\n(TestWebKitAPI::TEST(WKWebView, RemoteSnapshotWithContentsRect)):\n\nCanonical link: https://commits.webkit.org/319479@main", "email": "mattwoodrow@apple.com", "hash": "1603d30438c2628ceb6b413201a1c26b6e5cc192", "subject": "Crash in RemoteSnapshot::applyFrame accessing null display list." }, "319480@main": { "author": "Basuke Suzuki", "avatar": "https://www.gravatar.com/avatar/5192a1151c7575317affb7a4633f8d63?d=identicon\u0026s=64", "cl": "319480@main", "clUrl": "https://commits.webkit.org/319480@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322110\nrdar://185330340\n\nReviewed by Eric Carlson.\n\nMediaToolboxSoftLink.h renamed the soft-linked function with a #define, and that macro stays in\neffect for the rest of the translation unit. When MediaToolbox's own FigVideoTargetPrivate.h is\nreached later in the same TU, the macro rewrites the identifier in its extern \"C\" declaration,\nso the function ends up declared with both C and C++ language linkage:\n\n FigVideoTargetPrivate.h:205:1: error: declaration of\n 'softLink_MediaToolbox_FigVideoTargetCreateWithVideoReceiverEndpointID' has a different\n language linkage\n\nNeither header reaches the other through a single include chain, so nothing catches this until\nunified sources put both in one TU. In Source/WebKit that pairing is WebProcessPoolCocoa.mm,\nwhich imports pal/cocoa/MediaToolboxSoftLink.h, with GroupActivitiesCoordinator.mm, which\narrives at the SDK header through AVFoundationSoftLink.h, AVFoundationSPI.h, AVPlayer_Private.h.\n\nThe tree builds today only because the current bundle layout happens to keep those two files\napart. Adding any file to Source/WebKit/SourcesCocoa.txt ahead of them shifts the packing along\nby one and the build fails somewhere unrelated to the change. Adding\nUIProcess/Cocoa/SecurityFlagsControllerCocoa.mm for bug 322074 is what surfaced this, and that\nfile had to be marked @no-unify to get around it. The next person to add a file under\nUIProcess/Cocoa would hit the same wall.\n\nDrop the #define and let the caller use the soft-link name. The function has exactly one caller,\nso nothing else has to change, and the identifier can no longer collide with the SDK's\ndeclaration.\n\nNo new tests. Verified by compiling a translation unit that imports\npal/cocoa/MediaToolboxSoftLink.h followed by pal/spi/cocoa/AVFoundationSPI.h, which fails with\nthe error above before this change and compiles cleanly after it.\n\n* Source/WebCore/PAL/pal/cocoa/MediaToolboxSoftLink.h:\n* Source/WebCore/platform/graphics/cocoa/VideoTargetFactory.mm:\n(WebCore::VideoTargetFactory::createTargetFromEndpoint):\n\nCanonical link: https://commits.webkit.org/319480@main", "email": "basuke@apple.com", "hash": "bcdddcb81ab8ec1fbfa7053c04696a681363d437", "subject": "[PAL] MediaToolboxSoftLink.h's FigVideoTargetCreateWithVideoReceiverEndpointID macro breaks unified builds" }, "319481@main": { "author": "Roberto Rodriguez", "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64", "cl": "319481@main", "clUrl": "https://commits.webkit.org/319481@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321949\nrdar://185125314\n\nReviewed by Matthew Finkel.\n\n319079@main normalizes an empty document URL to about:blank in NavigationRequester::from so\nabout:blank inherits its initiator's policy container rather than a cross-origin one. That also\nmakes NavigationAction::isEmpty() false for a history restore in a relaunched process, so its\ntriggering action is preserved and the navigation reports NavigationType::BackForward.\nhandleBackForwardNavigation then runs for a reload, whose navigation sets reloadItem() rather\nthan targetItem(), so the prior state reads as Disabled and Enhanced Security goes dormant. The\nresulting process swap discards the HTTP fallback state and the reload is upgraded back to https.\n\nFix by falling back to reloadItem() when there is no targetItem(). Both name the item being\nnavigated to and only one is ever set, so the item's stored Enhanced Security state is used\ninstead of defaulting to Disabled.\n\n* Source/WebKit/UIProcess/EnhancedSecurityTracking.cpp:\n(WebKit::EnhancedSecurityTracking::handleBackForwardNavigation):\n\nCanonical link: https://commits.webkit.org/319481@main", "email": "roberto_rodriguez2@apple.com", "hash": "39b67e68ebc2aed8f549fdf73622f8f6c4871647", "subject": "REGRESSION(319079@main): TestWebKitAPI.WKNavigation.PreferredHTTPSPolicyAutomaticHTTPFallbackAfterTerminateProcess (api-test) is a constant fail." } }, "date": "2026-08-19", "days": 1, "generatedAt": "2026-08-19T22:06:04Z", "markdown": "## Highlights\n- **Security** Introduced SecurityFlags and propagated them into privileged child processes, tightening process-level security plumbing for sensitive capabilities. [commit 319461@main](https://commits.webkit.org/319461@main)\n- **Web Platform** Enabled SVG external resources by default, expanding spec-aligned SVG behavior that sites can rely on without flags. [commit 319411@main](https://commits.webkit.org/319411@main)\n- **V8** Inlined `Map#forEach` and `Set#forEach` iteration in DFG and FTL, cutting callback overhead in common collection-heavy JavaScript. [commit 319440@main](https://commits.webkit.org/319440@main)\n- **V8** Deferred array materialization in JSON.parse, a meaningful parser fast path win for large JSON payloads. [commit 319420@main](https://commits.webkit.org/319420@main)\n- **Networking** Stopped caching HTTP and network failures in the module map, preventing bad fetch results from poisoning later module loads. [commit 319474@main](https://commits.webkit.org/319474@main)\n- **Privacy** Tightened text extraction redaction so replacementStrings only substitute at word boundaries, reducing false positives when scrubbing PII. [commit 319423@main](https://commits.webkit.org/319423@main)\n- **Rendering** Fixed a null display list crash in RemoteSnapshot::applyFrame, removing a nasty compositor-side failure mode. [commit 319479@main](https://commits.webkit.org/319479@main)\n- **Media** Fixed MEDIA_ERR_ABORTED after restoring a page with media from BFCache, improving resume reliability across back-forward navigations. [commit 319472@main](https://commits.webkit.org/319472@main)\n- **Web Platform** Added @supports named-feature() support from css-conditional-5, moving feature queries forward for modern CSS capability checks. [commit 319412@main](https://commits.webkit.org/319412@main)\n- **UI** Restored interactive glass behavior for the PDF HUD after a regression, fixing a visible macOS PDF interaction break. [commit 319477@main](https://commits.webkit.org/319477@main)\n\n## What landed by area\n\n### JavaScriptCore and Wasm\n- **V8** Bytecode cache now generates `CodeForConstruct` for class constructors, fixing constructor semantics when loading cached code. [commit 319439@main](https://commits.webkit.org/319439@main)\n- **V8** Applied StringSwitch for substrings, a targeted JSC string dispatch optimization. [commit 319433@main](https://commits.webkit.org/319433@main)\n- **V8** Set a more reasonable default number of wasm threads, dialing in parallel compilation behavior. [commit 319464@main](https://commits.webkit.org/319464@main)\n- **V8** Split Wasm type definitions out of TypeKind, cleaning up internal type representation for future work. [commit 319431@main](https://commits.webkit.org/319431@main)\n- **V8** Concurrent Wasm CompileError reporting now prefers the lowest function index, making failures more deterministic and useful. [commit 319430@main](https://commits.webkit.org/319430@main)\n- **V8** Fixed a bad assertion path so Wasm exception handling no longer expects NativeCallee on JS frames. [commit 319429@main](https://commits.webkit.org/319429@main)\n- **V8** Gated Module.imports/exports type fields behind useWasmJSTypes, keeping new JS type exposure behind the intended switch. [commit 319427@main](https://commits.webkit.org/319427@main)\n- **V8** JSON.parse int32 lexing no longer repeats int32 materialization work, shaving redundant parsing cost. [commit 319419@main](https://commits.webkit.org/319419@main)\n- **V8** Fixed DFG SwitchChar releasing its operand too early before speculating on string type, removing a compiler correctness bug. [commit 319462@main](https://commits.webkit.org/319462@main)\n\n### Rendering, SVG, CSS, and animations\n- **Rendering** Fixed dynamic font changes not reaching list marker content renderers, so list bullets now track font updates correctly. [commit 319476@main](https://commits.webkit.org/319476@main)\n- **Rendering** Cached the SVG viewport size used for length resolution in LBSE, reducing repeated work in SVG layout. [commit 319468@main](https://commits.webkit.org/319468@main)\n- **Rendering** Fixed SVG text scaling against the wrong resolution in zoomed SVG documents. [commit 319445@main](https://commits.webkit.org/319445@main)\n- **Rendering** Extended WPT coverage for SVG paths and points, strengthening conformance around path geometry APIs. [commit 319451@main](https://commits.webkit.org/319451@main)\n- **Web Platform** Fixed `random()` and `random-item()` so auto randoms in the same property value do not collapse to the same result. [commit 319463@main](https://commits.webkit.org/319463@main)\n- **Rendering** Fixed composite order for web animations targeting `::picker-icon` and `::-webkit-scrollbar`. [commit 319448@main](https://commits.webkit.org/319448@main)\n- **Rendering** Fixed infinite computed keyframe offsets when an animation attachment range has zero length. [commit 319443@main](https://commits.webkit.org/319443@main)\n- **Rendering** Fixed unresolved progress-based timeline current time being treated as a timeline boundary in scroll animations. [commit 319442@main](https://commits.webkit.org/319442@main)\n- **Rendering** Fixed a crash in `WebAnimation::bindingsRangeStart()` on scroll animation code paths. [commit 319422@main](https://commits.webkit.org/319422@main)\n- **Refactor** Removed unused overloads taking CSSToLengthConversionData, trimming dead CSS conversion surface. [commit 319426@main](https://commits.webkit.org/319426@main)\n- **UI** Added navigation-related layout tests for `interactive-widget`, expanding coverage for viewport and keyboard interaction behavior. [commit 319428@main](https://commits.webkit.org/319428@main)\n- **UI** Fixed `\u003cinput type=checkbox switch\u003e` pointer tracking to use the right axis and coordinate space. [commit 319434@main](https://commits.webkit.org/319434@main)\n\n### DOM, HTML, and general Web Platform\n- **Web Platform** Implemented moving steps for HTMLOptionElement, closing a standards gap in option element mutation behavior. [commit 319475@main](https://commits.webkit.org/319475@main)\n- **Web Platform** The HTML parser no longer inserts nodes the DOM would reject, aligning parser behavior with DOM validity rules. [commit 319453@main](https://commits.webkit.org/319453@main)\n- **Web Platform** Location::ancestorOrigins() now builds its cached list through a local Ref, fixing a lifetime hazard in origin ancestry caching. [commit 319446@main](https://commits.webkit.org/319446@main)\n- **Web Platform** Digital Credentials now queue global tasks for both reject and resolve paths per spec. [commit 319421@main](https://commits.webkit.org/319421@main)\n- **Refactor** Cleaned up comments in HTMLDialogElement with no behavior change. [commit 319458@main](https://commits.webkit.org/319458@main)\n- **Web Platform** Geometry Interfaces test coverage got a platform-specific fix for DOMMatrix2DInit validation on x86_64 mac. [commit 319470@main](https://commits.webkit.org/319470@main)\n\n### Networking, loading, storage, and process model\n- **Networking** Fixed a macOS assertion in DocumentLoader around `m_waitingForContentPolicy`, removing a loader regression. [commit 319418@main](https://commits.webkit.org/319418@main)\n- **Networking** SOUP now preserves an Authorization header set by the page instead of replacing it with cached credentials. [commit 319424@main](https://commits.webkit.org/319424@main)\n- **Networking** Appended CompressionDictionary to FetchOptionsDestination instead of inserting it, fixing enum ordering assumptions. [commit 319409@main](https://commits.webkit.org/319409@main)\n- **Networking** Removed unneeded WebTransportSession::SecurityProtocolMetadata, simplifying transport internals. [commit 319414@main](https://commits.webkit.org/319414@main)\n- **Security** Fixed WebStorageNamespaceProvider::decrementUseCount() to guard end iterators, eliminating a storage-side regression crash. [commit 319447@main](https://commits.webkit.org/319447@main)\n- **Security** Make process count limiter work better with Site Isolation, improving stability of stricter process allocation. [commit 319408@main](https://commits.webkit.org/319408@main)\n- **Security** Evict isolated sites once the store reaches its size cap, bounding site isolation state growth. [commit 319435@main](https://commits.webkit.org/319435@main)\n- **Security** Fixed stale ScrollingTree active nodes crashing the UI process during layer tree scrolling relation setup under site isolation. [commit 319425@main](https://commits.webkit.org/319425@main)\n- **Security** Fixed ad iframe auto-refresh after returning from ad clicks under site isolation. [commit 319465@main](https://commits.webkit.org/319465@main)\n\n### Media, graphics, and PDF\n- **Media** PlatformMediaSession::clientWillBeginPlayback() now returns a GenericPromise, modernizing async playback signaling. [commit 319455@main](https://commits.webkit.org/319455@main)\n- **Media** Fixed a regression where an audible video that could not autoplay could interrupt playback in another app. [commit 319413@main](https://commits.webkit.org/319413@main)\n- **Media** Added support for writing ISOBoxes as well as reading and parsing them, broadening container tooling. [commit 319410@main](https://commits.webkit.org/319410@main)\n- **GPU** GTK and WPE Skia compositor now uses a deferred display list to paint scrollbars. [commit 319437@main](https://commits.webkit.org/319437@main)\n- **UI** Fixed WKWebView._hitTest(at:inFrameCoordinates:) returning a JSHandle usable only in pageWorld, addressing API-world mismatch. [commit 319416@main](https://commits.webkit.org/319416@main)\n- **Build** Fixed a unified build break in MediaToolboxSoftLink.h caused by the FigVideoTargetCreateWithVideoReceiverEndpointID macro. [commit 319480@main](https://commits.webkit.org/319480@main)\n\n### GTK, WPE, and GLib platform work\n- **Build** GTK and WPE now use Clang by default when building with build-webkit. [commit 319452@main](https://commits.webkit.org/319452@main)\n- **Build** Fixed the mac-dev-debug-o3 cmake build. [commit 319466@main](https://commits.webkit.org/319466@main)\n- **Build** Gated UniStdExtras, tightening platform-specific exposure. [commit 319471@main](https://commits.webkit.org/319471@main)\n- **Build** Fixed cross-platform headers to avoid bad `#import` usage. [commit 319436@main](https://commits.webkit.org/319436@main)\n- **UI** Adwaita togglebuttons now respect dark mode. [commit 319473@main](https://commits.webkit.org/319473@main)\n- **Web Platform** GLib adopted the Firefox quirk for claude.ai, another targeted compatibility patch for a high-traffic site. [commit 319469@main](https://commits.webkit.org/319469@main)\n- **Refactor** Added GRefPtrWrapper support to generate-serializers and generated GVariant IPC serialization. [commit 319460@main](https://commits.webkit.org/319460@main)\n- **Refactor** Generated serializers for GTK printing-related classes. [commit 319454@main](https://commits.webkit.org/319454@main)\n- **UI** Implemented touch event synthesis in WebKitTestRunner for GTK. [commit 319450@main](https://commits.webkit.org/319450@main)\n- **A11y** WebKitTestRunner on GLib now implements focusableAncestor. [commit 319449@main](https://commits.webkit.org/319449@main)\n- **A11y** WebKitTestRunner on GLib now implements dismiss. [commit 319441@main](https://commits.webkit.org/319441@main)\n\n### Testing, regressions, and infrastructure\n- **Web Platform** Added tests for active quirks on relevant domains per platform, making compatibility behavior more explicit. [commit 319478@main](https://commits.webkit.org/319478@main)\n- **A11y** Fixed GLib failure coverage for `accessibility/svg-text.html`. [commit 319459@main](https://commits.webkit.org/319459@main)\n- **A11y** Fixed GLib timeout coverage for `accessibility/keyevents-posted-for-increment-actions.html`. [commit 319432@main](https://commits.webkit.org/319432@main)\n- **Mobile** Fixed WPE WebDriver regressions for fractional move targets and touch pointers in shadow trees. [commit 319456@main](https://commits.webkit.org/319456@main)\n- **DevTools** Fixed a flaky inspector network text failure in `resource-sizes-network.html` on Big Sur wk2 arm64. [commit 319417@main](https://commits.webkit.org/319417@main)\n- **Media** Marked the constant-fail WKNavigation PreferredHTTPSPolicy automatic HTTP fallback after process termination test as a regression case. [commit 319481@main](https://commits.webkit.org/319481@main)\n- **Media** Addressed flaky crash tracking for the macOS Debug webaudio `audionode-channel-rules.html` test. [commit 319467@main](https://commits.webkit.org/319467@main)\n- **Media** Continued flaky crash handling for the same macOS Debug webaudio test. [commit 319444@main](https://commits.webkit.org/319444@main)\n- **Media** Continued gardening on the same macOS Debug webaudio flaky crash. [commit 319415@main](https://commits.webkit.org/319415@main)\n- **Build** Removed `-no-verify-emitted-module-interface`, simplifying the Swift or module-interface build setup. [commit 319457@main](https://commits.webkit.org/319457@main)\n\n## Reverts \u0026 Reapplies\n\nNo explicit revert, reapply, or backed out commits landed in this window.", "repo": "webkit", "repoDisplay": "WebKit", "rollGroups": [], "since": "2026-08-19", "totals": { "commits": 74, "features": 74, "rolls": 0 }, "until": "2026-08-19" }