{
  "commits": {
    "319626@main": {
      "author": "Jetzel Espinal",
      "avatar": "https://www.gravatar.com/avatar/2edd78d5d9f2f2e2e695465277634921?d=identicon\u0026s=64",
      "cl": "319626@main",
      "clUrl": "https://commits.webkit.org/319626@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322305\nrdar://185542943\n\nUnreviewed test gardening.\n\n* LayoutTests/platform/ios/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319626@main",
      "email": "jespinal23@apple.com",
      "hash": "0e32e921ed82d2d1d48775a2a897a85e26c69e52",
      "subject": "[GARDENING][iOS]NEW TEST(319203@main): fast/visual-viewport/ios/interactive-widget/resizes-content-orientation-rotations.html (layout-tests) is a constant text failure."
    },
    "319627@main": {
      "author": "Per Arne Vollan",
      "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64",
      "cl": "319627@main",
      "clUrl": "https://commits.webkit.org/319627@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322053\nrdar://174169483\n\nReviewed by Sihui Liu.\n\nOpening a HTML file from the Notes app is failing when the Develop menu is enabled in Safari.\nThis is because the storage class of the HTML file on disk is different then the path Safari\ncreated a sandbox extension for, which is the root of the file system in developer mode.\n\nFix this by checking if the file path has a separate storage class, and if so, don't create\nan extension for the root of the file system, but instead create an extension for the parent\ndirectory of the file. By doing so, the system will not deny the WebContent process to create\na sandbox extension for the Networking process.\n\nThis bug depends on the System Integrity Protection mode, which makes it non-trivial to\ncreate a test case.\n\n* Source/WTF/wtf/FileSystem.h:\n* Source/WTF/wtf/cocoa/FileSystemCocoa.mm:\n(WTF::FileSystemImpl::homeDirectory):\n* Source/WebKit/Shared/AuxiliaryProcess.h:\n* Source/WebKit/Shared/mac/AuxiliaryProcessMac.mm:\n(WebKit::populateSandboxInitializationParameters):\n(WebKit::AuxiliaryProcess::openDirectoryCacheInvalidated):\n(WebKit::AuxiliaryProcess::getHomeDirectory): Deleted.\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::pathHasSeparateStorageClass):\n(WebKit::WebPageProxy::maybeInitializeSandboxExtensionHandle):\n\nCanonical link: https://commits.webkit.org/319627@main",
      "email": "pvollan@apple.com",
      "hash": "7d86b2c8a054e15691ae22c2b6f9ca287858770d",
      "subject": "Error opening local HTML files from Notes"
    },
    "319628@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319628@main",
      "clUrl": "https://commits.webkit.org/319628@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322245\nrdar://185479319\n\nReviewed by Ryosuke Niwa.\n\nHTMLSummaryElement and HTMLButtonElement implement space activation across three\nevents: keydown calls setActive(true), keypress marks the event handled to suppress\nscrolling, and keyup dispatches a simulated click if the element is still active.\n\nNeither checks whether the key press was actually directed at the element. When an\nediting host is nested inside the \u003csummary\u003e/\u003cbutton\u003e, the editor handles the keypress\nat the target and marks it handled, so callDefaultEventHandlersInBubblingOrder() stops\nbefore reaching the ancestor -- but keydown and keyup are not consumed, so they bubble\ninto these handlers, which set the active state and then dispatch a click. The result\nis that typing a space into the editable element both inserts the space and toggles the\n\u003cdetails\u003e / activates the \u003cbutton\u003e.\n\nGate the keyboard handling on the element itself being focused. Focus is the right\ndiscriminator rather than the event target: \u003csummary contenteditable\u003e is both focused\nand editable and must still toggle (the summary's own handler runs before the editor's,\nso no text is inserted), while a focused editable descendant must not activate the\nancestor. Using the focused element also avoids depending on event target retargeting,\nwhich keeps the auto-generated \u003csummary\u003e inside \u003cdetails\u003e's user-agent shadow tree\nworking.\n\n* LayoutTests/imported/w3c/web-platform-tests/editing/other/typing-space-in-editable-button.tentative-expected.txt: Progression\n* LayoutTests/imported/w3c/web-platform-tests/editing/other/typing-space-in-editable-summary.tentative-expected.txt: Ditto\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/editing/other/typing-space-in-editable-button.tentative-expected.txt: Renamed from LayoutTests/platform/gtk/imported/w3c/web-platform-tests/editing/other/typing-space-in-editable-button.tentative-expected.txt.\n* LayoutTests/platform/wpe/imported/w3c/web-platform-tests/editing/other/typing-space-in-editable-button.tentative-expected.txt: Removed.\n* Source/WebCore/html/HTMLButtonElement.cpp:\n(WebCore::HTMLButtonElement::defaultEventHandler):\n* Source/WebCore/html/HTMLSummaryElement.cpp:\n(WebCore::HTMLSummaryElement::defaultEventHandler):\n\nCanonical link: https://commits.webkit.org/319628@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "7432aeeb7c556549276f6d1c2d764f8ab6d4790f",
      "subject": "Typing a space in editable content inside \u003csummary\u003e or \u003cbutton\u003e also activates it"
    },
    "319629@main": {
      "author": "Aleksei Marchenko",
      "avatar": "https://www.gravatar.com/avatar/9a469093291c12531caccfcaa6ab73b1?d=identicon\u0026s=64",
      "cl": "319629@main",
      "clUrl": "https://commits.webkit.org/319629@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322166\nrdar://182292326\n\nReviewed by Mike Wyrzykowski.\n\nCSS transform/translate/rotate/scale on a \u003cmodel\u003e nested in a spatial: portal\nnow drive that child's entity, composed as (CSS) x (asset's original scale),\nCSS outermost. The container still owns auto-fit, stage mode and\nportal-transform, and a child's transform stays out of the auto containing\nvolume. Translations convert from CSS px to meters with pointsPerMeter,\nand are deliberately not divided out of the container's scale: a child\nsits inside the back spatial context, so portal-transform fits its position\nalong with its size.\n\nCSS wins for a nested child: entityTransform throws InvalidStateError while a\nCSS transform applies, and CSS overrides one set through the attribute.\nstagemode no longer blocks entityTransform in a portal -- it drives the\ncontainer, this drives the child. Non-uniform and shearing transforms are\nrefused, keeping the last accepted one.\n\nSuch a child has no renderer, so RenderTreeUpdater keeps its resolved style,\nElement::renderOrDisplayContentsStyle() returns it, and\nKeyframeEffect::ticksContinuouslyWhileActive() keeps ticking without one;\notherwise transitions only snap.\n\nTests: spatial-css/spatial-portal-model-entity-transform.html\n       spatial-css/spatial-portal-model-transform-transition.html\n       spatial-css/spatial-portal-model-transform-unsupported.html\n       spatial-css/spatial-portal-model-transform.html\n\n* LayoutTests/spatial-css/resources/spatial-portal-utils.js:\n* LayoutTests/spatial-css/spatial-portal-model-entity-transform-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-model-entity-transform.html: Added.\n* LayoutTests/spatial-css/spatial-portal-model-transform-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-model-transform-transition-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-model-transform-transition.html: Added.\n* LayoutTests/spatial-css/spatial-portal-model-transform-unsupported-expected.txt: Added.\n* LayoutTests/spatial-css/spatial-portal-model-transform-unsupported.html: Added.\n* LayoutTests/spatial-css/spatial-portal-model-transform.html: Added.\n* LayoutTests/spatial-css/spatial-portal-nested-model-stagemode-expected.txt:\n* LayoutTests/spatial-css/spatial-portal-nested-model-stagemode.html:\n* LayoutTests/spatial-css/spatial-portal-transform-auto-expected.txt:\n* LayoutTests/spatial-css/spatial-portal-transform-auto.html:\n* LayoutTests/spatial-css/spatial-portal-transform-none-expected.txt:\n* LayoutTests/spatial-css/spatial-portal-transform-none.html:\n* Source/WebCore/Modules/model-element/HTMLModelElement.cpp:\n(WebCore::HTMLModelElement::effectiveModelPlayer const):\n(WebCore::HTMLModelElement::updateEntityTransformFromCSS):\n(WebCore::HTMLModelElement::didUpdateEntityTransformInsidePortal):\n(WebCore::HTMLModelElement::setEntityTransform):\n(WebCore::HTMLModelElement::setPlaybackRate):\n(WebCore::HTMLModelElement::duration const):\n(WebCore::HTMLModelElement::paused const):\n(WebCore::HTMLModelElement::setPaused):\n(WebCore::HTMLModelElement::updateAutoplay):\n(WebCore::HTMLModelElement::updateLoop):\n(WebCore::HTMLModelElement::currentTime const):\n(WebCore::HTMLModelElement::setCurrentTime):\n(WebCore::HTMLModelElement::modelPlayerForAnimation const): Deleted.\n* Source/WebCore/Modules/model-element/HTMLModelElement.h:\n* Source/WebCore/Modules/model-element/SpatialPortalController.cpp:\n(WebCore::SpatialPortalController::loadChildModelIfReady):\n(WebCore::SpatialPortalController::childTransformDidChange):\n* Source/WebCore/Modules/model-element/SpatialPortalController.h:\n* Source/WebCore/animation/KeyframeEffect.cpp:\n(WebCore::KeyframeEffect::ticksContinuouslyWhileActive const):\n* Source/WebCore/dom/Element.cpp:\n(WebCore::Element::storeDisplayContentsOrNoneStyle):\n(WebCore::Element::renderOrDisplayContentsStyle const):\n* Source/WebCore/rendering/updating/RenderTreeUpdater.cpp:\n(WebCore::RenderTreeUpdater::updateElementRenderer):\n* Source/WebCore/style/StyleTransformResolver.cpp:\n(WebCore::Style::TransformResolver::hasTransformRelatedProperty):\n* Source/WebCore/style/StyleTransformResolver.h:\n* Source/WebKit/ModelProcess/cocoa/ModelProcessModelPlayerProxy.h:\n* Source/WebKit/ModelProcess/cocoa/ModelProcessModelPlayerProxy.mm:\n(WebKit::ModelProcessModelPlayerProxy::childEntityTransformSRT const):\n(WebKit::ModelProcessModelPlayerProxy::updateTransform):\n(WebKit::ModelProcessModelPlayerProxy::didFinishLoading):\n(WebKit::ModelProcessModelPlayerProxy::setEntityTransform):\n(WebKit::ModelProcessModelPlayerProxy::setPortalTransform):\n* Source/WebKit/WebProcess/Model/ModelProcessModelPlayer.cpp:\n(WebKit::ModelProcessModelPlayer::setPortalTransform):\n\nCanonical link: https://commits.webkit.org/319629@main",
      "email": "aleksei@apple.com",
      "hash": "4490cd9a89cc244a137d6b0cea780e61b76dbe12",
      "subject": "Support per-child entity transforms for \u003cmodel\u003e inside a spatial portal"
    },
    "319630@main": {
      "author": "Ben Nham",
      "avatar": "https://www.gravatar.com/avatar/dc0914eabf69047ee3397794c2d17bf7?d=identicon\u0026s=64",
      "cl": "319630@main",
      "clUrl": "https://commits.webkit.org/319630@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322231\nrdar://185461584\n\nReviewed by Ryosuke Niwa.\n\nA newly created page can run with the wrong hidden page throttling timer state:\n\n- If the page is created in a new WebProcess, then the initial state is incorrect, because we don't\n  pass the hidden page throttling state as part of process creation.\n\n- If the page is created in an existing WebProcess, then the initial state is incorrect, because we\n  don't store the last used hidden page throttling state anywhere and apply it to the newly created\n  page.\n\nFix this by adding hiddenPageDOMTimerThrottlingIncreaseLimit as a process creation parameter and\nalso store it globally on the WebProcess side.\n\nThis happens more when Site Isolation is enabled, since creating a new iframe while hidden will\ncreate a new process with potentially stale throttling flags.\n\n* LayoutTests/http/tests/site-isolation/hidden-page-dom-timer-throttling-limit-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/hidden-page-dom-timer-throttling-limit.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/dom-timer-throttling-state-frame.html: Added.\n* Source/WebCore/page/Page.h:\n(WebCore::Page::domTimerAlignmentIntervalIncreaseLimit const):\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::domTimerAlignmentInterval const):\n(WebCore::Internals::domTimerAlignmentIntervalIncreaseLimit const):\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\n* Source/WebKit/Shared/WebProcessCreationParameters.h:\n* Source/WebKit/Shared/WebProcessCreationParameters.serialization.in:\n* Source/WebKit/UIProcess/WebProcessPool.cpp:\n(WebKit::WebProcessPool::initializeNewWebProcess):\n(WebKit::WebProcessPool::updateHiddenPageThrottlingAutoIncreaseLimit):\n* Source/WebKit/UIProcess/WebProcessPool.h:\n* Source/WebKit/WebProcess/WebProcess.cpp:\n(WebKit::WebProcess::initializeWebProcess):\n(WebKit::WebProcess::createWebPage):\n(WebKit::WebProcess::setHiddenPageDOMTimerThrottlingIncreaseLimit):\n* Source/WebKit/WebProcess/WebProcess.h:\n\nCanonical link: https://commits.webkit.org/319630@main",
      "email": "nham@apple.com",
      "hash": "7b56a059223f8116c20cfd668ae8935e84d800de",
      "subject": "Make hidden page throttling heuristics apply to newly created pages"
    },
    "319631@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "319631@main",
      "clUrl": "https://commits.webkit.org/319631@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322307\nrdar://185544976\n\nReviewed by Tim Nguyen.\n\nThe values of GridLanesLayout::Phase repeated the name of the enum\nitself (LayoutPhase, MinContentPhase, MaxContentPhase). Drop the\nredundant suffix so the values read as Phase::Layout, Phase::MinContent\nand Phase::MaxContent. No change in behavior.\n\n* Source/WebCore/rendering/GridLanesLayout.cpp:\n(WebCore::GridLanesLayout::calculateGridLanesIntrinsicLogicalWidth):\n(WebCore::GridLanesLayout::insertIntoGridAndLayoutItem):\n* Source/WebCore/rendering/GridLanesLayout.h:\n* Source/WebCore/rendering/RenderGrid.cpp:\n(WebCore::RenderGrid::layoutGridLanes):\n(WebCore::RenderGrid::computeIntrinsicLogicalWidths):\n\nCanonical link: https://commits.webkit.org/319631@main",
      "email": "sammy.gill@apple.com",
      "hash": "85db209cf65d735fab78a76c5321a57fef7af0dd",
      "subject": "[Grid Lanes] Remove redundant \"Phase\" suffix from GridLanesLayout::Phase enum values."
    },
    "319632@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "319632@main",
      "clUrl": "https://commits.webkit.org/319632@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321473\n\u003crdar://problem/185157814\u003e\n\nReviewed by Antti Koivisto.\n\nMarker content is inline content: what it measures, where it sits on the line and how bidi orders it are inline layout's answers to give.\nEvery kind of marker goes through it except a disc, circle or square, which the marker measures and paints itself from the font metrics,\ninto a box it sizes for that purpose alone. So marker drawing exists twice, and the two have to be kept in step.\n\nIt is also what stands in the way of making an inside marker an inline box, which is where this is going:\nan inline box has no box of its own to paint into, so anything the marker draws for itself has nowhere to go.\n\nA list-style-image that fails to load now rebuilds the marker rather than relaying it out. It falls\nback to its list-style-type, and that text needs renderers the marker was not built with. Nothing\nabout the element's style changed, and a pseudo-element list item is only revisited through its host\n(RenderTreeUpdater::updateAfterDescendants), so imageChanged() invalidates the host's renderers\ninstead of the element's style.\n\n* Source/WebCore/layout/formattingContexts/inline/text/TextUtil.cpp:\n(WebCore::Layout::TextUtil::width):\n* Source/WebCore/layout/integration/LayoutIntegrationBoxTreeUpdater.cpp:\n(WebCore::LayoutIntegration::markerTextSynthesizesGlyph):\n(WebCore::LayoutIntegration::BoxTreeUpdater::createLayoutBox):\n(WebCore::LayoutIntegration::updateContentCharacteristic):\n(WebCore::LayoutIntegration::BoxTreeUpdater::updateContent):\n* Source/WebCore/layout/layouttree/LayoutInlineTextBox.h:\n(WebCore::Layout::InlineTextBox::hasSynthesizedGlyph const):\n* Source/WebCore/rendering/RenderListMarker.cpp:\n(WebCore::RenderListMarker::textNeedsBidiResolution const):\n(WebCore::RenderListMarker::needsContentContainer const):\n(WebCore::RenderListMarker::paint):\n(WebCore::RenderListMarker::layoutContentContainer):\n(WebCore::RenderListMarker::imageChanged):\n(WebCore::RenderListMarker::updateContent):\n(WebCore::RenderListMarker::updateContentContainerText):\n(WebCore::RenderListMarker::computeIntrinsicLogicalWidthContributions):\n(WebCore::RenderListMarker::updateInlineMargins):\n(WebCore::RenderListMarker::relativeMarkerRect):\n(WebCore::RenderListMarker::synthesizesGlyph const):\n(WebCore::RenderListMarker::drawsBulletShape const): Deleted.\n* Source/WebCore/rendering/RenderListMarker.h:\n* Source/WebCore/rendering/RenderTreeAsText.cpp:\n(WebCore::write):\n* Source/WebCore/rendering/TextBoxPainter.cpp:\n(WebCore::TextBoxPainter::paint):\n(WebCore::TextBoxPainter::hasSynthesizedGlyph const):\n(WebCore::TextBoxPainter::paintSynthesizedGlyph):\n* Source/WebCore/rendering/TextBoxPainter.h:\n\nCanonical link: https://commits.webkit.org/319632@main",
      "email": "zalan@apple.com",
      "hash": "9518e96ced9f5f2ba70d9e9b651ced426ebc2d8e",
      "subject": "[list-marker] Lay bullet markers out as marker text so they take part in inline layout"
    },
    "319633@main": {
      "author": "Jetzel Espinal",
      "avatar": "https://www.gravatar.com/avatar/2edd78d5d9f2f2e2e695465277634921?d=identicon\u0026s=64",
      "cl": "319633@main",
      "clUrl": "https://commits.webkit.org/319633@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322313\nrdar://185553044\n\nUnreviewed test gardening.\n\n* LayoutTests/platform/mac/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319633@main",
      "email": "jespinal23@apple.com",
      "hash": "14cf46bf0d988503bf621915307967dd21005b02",
      "subject": "[GARDENING][macOS]REGRESSION(319200@main): accessibility/isolated-tree/aria-owns-id-change.html (layout-tests) is a constant Timeout."
    },
    "319634@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "319634@main",
      "clUrl": "https://commits.webkit.org/319634@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322303\nrdar://185541345\n\nReviewed by Dan Hecht.\n\nWe found that WasmWorklist's PriorityQueue's ordering is opposite and\nnot correct. The reason is that PriorityQueue and std::priority_queue's\ncomparator is opposite and when changing std::priority_queue to\nPriorityQueue, we didn't change the comparator. But this is error-prone.\nThis patch fixes that issue and also change PriorityQueue's comparator\nto align it to std::priority_queue's one. So by default, taking\nstd::less, and populating the greatest value first. Doing the same in\nPriorityQueue.\n\nTest: Tools/TestWebKitAPI/Tests/WTF/PriorityQueue.cpp\n\n* Source/JavaScriptCore/b3/air/AirAllocateRegistersByGreedy.cpp:\n(JSC::B3::Air::Greedy::TmpPriority::operator\u003c):\n(JSC::B3::Air::Greedy::TmpPriority::isHigherPriority): Deleted.\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::InliningCandidateIsLowerPriority::operator() const):\n(JSC::DFG::InliningPlan::build):\n(JSC::DFG::isHigherPriorityInliningCandidate): Deleted.\n* Source/JavaScriptCore/wasm/WasmInliningDecision.cpp:\n(JSC::Wasm::InliningNodeIsLowerPriority::operator() const):\n(JSC::Wasm::InliningDecision::expand):\n(JSC::Wasm::isHigherPriority): Deleted.\n* Source/JavaScriptCore/wasm/WasmWorklist.cpp:\n(JSC::Wasm::Worklist::completePlanSynchronously):\n* Source/JavaScriptCore/wasm/WasmWorklist.h:\n(JSC::Wasm::Worklist::QueueElementIsLowerPriority::operator() const):\n(JSC::Wasm::Worklist::isHigherPriority): Deleted.\n* Source/WTF/wtf/MathExtras.h:\n(isLessThan): Deleted.\n(isLessThanEqual): Deleted.\n(isGreaterThan): Deleted.\n(isGreaterThanEqual): Deleted.\n* Source/WTF/wtf/PriorityQueue.h:\n* Source/WebCore/loader/ResourceMonitorThrottler.h:\n* Source/WebCore/page/ImageAnalysisQueue.h:\n(WebCore::ImageAnalysisQueue::firstIsHigherPriority): Deleted.\n* Source/WebKit/NetworkProcess/cache/NetworkCacheStorage.cpp:\n(WebKit::NetworkCache::Storage::ReadOperationIsLowerPriority::operator() const):\n(WebKit::NetworkCache::Storage::isHigherPriority): Deleted.\n* Source/WebKit/NetworkProcess/cache/NetworkCacheStorage.h:\n* Tools/TestWebKitAPI/Tests/WTF/PriorityQueue.cpp:\n(enqueue):\n(dequeue):\n(TEST(WTF_PriorityQueue, Basic)):\n(TEST(WTF_PriorityQueue, ReversedComparator)):\n(MoveOnlyIsLessThan::operator() const):\n(MoveOnlyIsGreaterThan::operator() const):\n(TEST(WTF_PriorityQueue, MoveOnly)):\n(TEST(WTF_PriorityQueue, DecreaseKey)):\n(TEST(WTF_PriorityQueue, IncreaseKey)):\n(TEST(WTF_PriorityQueue, IncreaseKeyWithAReversedComparator)):\n(TEST(WTF_PriorityQueue, Iteration)):\n(TEST(WTF_PriorityQueue, EqualElementsAreAValidHeap)):\n(ReversibleComparator::operator() const):\n(TEST(WTF_PriorityQueue, IsValidHeapDetectsAGreaterChild)):\n(PrioritizedTaskIsLowerPriority::operator() const):\n(TEST(WTF_PriorityQueue, IncreaseKeyMovesTowardsTheFront)):\n(TEST(WTF_PriorityQueue, RandomActions)):\n(isHigherPriority): Deleted.\n(TEST(WTF_PriorityQueue, CustomPriorityFunction)): Deleted.\n\nCanonical link: https://commits.webkit.org/319634@main",
      "email": "ysuzuki@apple.com",
      "hash": "cffd5ed032c478c1dee5311a89b91e64909e8b90",
      "subject": "[WTF] Align PriorityQueue to std::priority_queue and fix WasmWorklist"
    },
    "319635@main": {
      "author": "Dan Glastonbury",
      "avatar": "https://www.gravatar.com/avatar/fb7cb28bf9f1bc9fc0c3bbf65566efdc?d=identicon\u0026s=64",
      "cl": "319635@main",
      "clUrl": "https://commits.webkit.org/319635@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322250\nrdar://185485580\n\nReviewed by Simon Fraser.\n\nPathOrShapeGradientApplier bracketed each gradient apply in its own\ncontext-\u003esave()/restore() pair, costing two IPC messages per gradient-filled shape\npaint when rendering in the GPU process. The pair has been vestigial since\n32921@main moved the CTM mutations it was originally added for into the gradient's\nown space transform.\n\nRemove it. All callers already bracket the apply/postApply sequence in an outer\nGraphicsContextStateSaver, and LegacyRenderSVGResourceSolidColor has never restored\nthis state either, so gradient paint now behaves like solid-color paint.\n\nWorth ~2.5% on MotionMark 1.3 Suits.\n\n* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResourceGradient.cpp:\n(WebCore::PathOrShapeGradientApplier::applyResource):\n(WebCore::PathOrShapeGradientApplier::postApplyResource):\n\nCanonical link: https://commits.webkit.org/319635@main",
      "email": "djg@apple.com",
      "hash": "c22c85fd52be074f029f80ab95d154c45802a991",
      "subject": "Remove redundant paint state save/restore around SVG gradient fill/stroke"
    },
    "319636@main": {
      "author": "Dan Glastonbury",
      "avatar": "https://www.gravatar.com/avatar/fb7cb28bf9f1bc9fc0c3bbf65566efdc?d=identicon\u0026s=64",
      "cl": "319636@main",
      "clUrl": "https://commits.webkit.org/319636@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322259\nrdar://185490398\n\nReviewed by Kimmo Kinnunen.\n\nTimeout's constructor eagerly computes ApproximateTime::now() + delta, but\nStreamClientConnection::send() only consults the deadline if tryAcquire() has to\nblock, which is rare since the ring buffer normally has room. The cost was paid\non every message, and showed up in MotionMark 1.3 Suits profiles where IPC\naccounted for ~22% of samples.\n\nAdd StreamClientConnectionBuffer::acquireNoWait() for the non-blocking case and\ntry it first when the destination ID is unchanged, falling back to the existing\nTimeout-based path otherwise. Skipping trySendDestinationIDIfNeeded() on that\nfast path is equivalent to the early return it would have taken, since\nm_currentDestinationID is only assigned after the SetStreamDestinationID message\nhas been released. Timeout keeps its by-value semantics, so the shared budget\nacross trySendDestinationIDIfNeeded() + tryAcquire() is unaffected.\n\n* Source/WebKit/Platform/IPC/StreamClientConnection.h:\n(IPC::StreamClientConnection::send):\n* Source/WebKit/Platform/IPC/StreamClientConnectionBuffer.h:\n(IPC::StreamClientConnectionBuffer::acquireNoWait):\n\nCanonical link: https://commits.webkit.org/319636@main",
      "email": "djg@apple.com",
      "hash": "4f1ddc1d813f89f2a529c841dcdbb5b038d8d63a",
      "subject": "Avoid constructing a Timeout on the common stream IPC send path"
    },
    "319637@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "319637@main",
      "clUrl": "https://commits.webkit.org/319637@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=255434\nrdar://108030923\n\nReviewed by Alan Baradlay.\n\nNow that margin-trim only applies to block containers, RenderBlockFlow is the\nonly renderer that can trim one of its children's margins. The\nmachinery for it does not need to sit on RenderBox anymore, where every other\nlayout system can see it.\n\nTo help cleanup the code a bit and make the responsibility clear we can\nmove most of the code that lives in RenderBox into RenderBlockFlow.\n\n* Source/WebCore/rendering/RenderBox.cpp:\n(WebCore::RenderBox::computeLogicalWidth const):\n(WebCore::RenderBox::computeOrTrimInlineMargin const): Deleted.\nInstead of having a \"compute or trim,\" function let's just replace it\nwith the code inline since it's really only used in one place.\n\nCanonical link: https://commits.webkit.org/319637@main",
      "email": "sammy.gill@apple.com",
      "hash": "00055d9dab65a99dbe3407afad48d425d13e0a24",
      "subject": "[margin-trim][cleanup] Move margin trimming machinery out of RenderBox"
    },
    "319638@main": {
      "author": "Per Arne Vollan",
      "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64",
      "cl": "319638@main",
      "clUrl": "https://commits.webkit.org/319638@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322240\nrdar://181259623\n\nReviewed by Sihui Liu.\n\nThis can happen when a LocalFrame is trying to access its RemoteFrame parent, as the RemoteFrame\nis being destroyed -- for example in response to the message WebPage::frameWasRemovedInAnotherProcess.\n\nFix this by by calling detachFromParent on all the children in FrameTree::~FrameTree().\n\nNo new tests, since reproducing this issue depends on having an extension installed in Safari.\n\n* Source/WebCore/page/FrameTree.cpp:\n(WebCore::FrameTree::~FrameTree):\n\nCanonical link: https://commits.webkit.org/319638@main",
      "email": "pvollan@apple.com",
      "hash": "112604f6a167ea78c004e392cd123edde551f2b5",
      "subject": "[Site Isolation] Crash under WebFrame::fromCoreFrame"
    },
    "319639@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "319639@main",
      "clUrl": "https://commits.webkit.org/319639@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322300\n\nReviewed by Sihui Liu.\n\nAlways enable UseUIProcessForBackForwardItemLoading in the test.\n\n* LayoutTests/fast/events/suspend-timers.html:\n\nCanonical link: https://commits.webkit.org/319639@main",
      "email": "rniwa@webkit.org",
      "hash": "adf3372359dc8d160a16ee4bf0f9cb5e6b3b7d6f",
      "subject": "[Site Isolation] fast/events/suspend-timers.html fails"
    },
    "319640@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319640@main",
      "clUrl": "https://commits.webkit.org/319640@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322310\nrdar://185549474\n\nReviewed by Tim Nguyen.\n\nThe close the dialog steps gate the focus restore [1]:\n\n    If subject's node document's focused area of the document's DOM anchor is a\n    shadow-including inclusive descendant of subject, or wasModal is true, then\n    run the focusing steps for element; the viewport should not be scrolled by\n    doing this step.\n\nWe ran that unconditionally, so closing a non-modal dialog yanked focus back\neven when the author had moved it elsewhere. The stray focus change is\nobservable: it fires focusin, letting a listener re-enter the dialog's own state\nmachine. Capture wasModal after removing the open attribute, matching the spec's\nstep order, and gate on it.\n\nThe check uses the composed tree, not the shadow-including tree: a node slotted\ninto a dialog inside a shadow root is not a shadow-including descendant, yet\nfocus restore is expected for it. See whatwg/html#8904 [2], cited by\ndialog-focus-previous-outside.html for that case.\n\nThis removes the FIXME from 319173@main and fixes the bug by handling focus\nproperly.\n\n[1] https://html.spec.whatwg.org/multipage/interactive-elements.html#close-the-dialog\n[2] https://github.com/whatwg/html/issues/8904\n\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-closedby-corner-cases-expected.txt: Progression\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-focus-previous-outside-expected.txt: Ditto\n* Source/WebCore/html/HTMLDialogElement.cpp:\n(WebCore::HTMLDialogElement::close):\n\nCanonical link: https://commits.webkit.org/319640@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "baf4a9a7ec0b8436f3dec8cb8c4b418f0795a308",
      "subject": "dialog close() restores focus unconditionally instead of only when focus is inside the dialog or it was modal"
    },
    "319641@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "319641@main",
      "clUrl": "https://commits.webkit.org/319641@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322301\nrdar://185540297\n\nReviewed by Abrar Rahman Protyasha.\n\nThe `FileSystemHandleGlobalIdentifier` type is the only type across the entire codebase that\nused a UUID-based ObjectIdentifier. Switch to just a normal UUID to be consistent with everything else.\n\nThis also unblocks being able to remove the UUID version of ObjectIdentifier, a mistake introduced\nby a less pragmatic version of myself several years ago.\n\n* Source/WebCore/Modules/filesystem/FileSystemHandle.cpp:\n(WebCore::FileSystemHandle::markAsUnresolved):\n* Source/WebCore/Modules/filesystem/FileSystemHandleGlobalIdentifier.h:\n* Source/WebCore/Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:\n(WebCore::IDBServer::SQLiteIDBBackingStore::addFileSystemHandleRecordsForObjectStoreRecord):\n* Source/WebCore/bindings/js/SerializedScriptValue.cpp:\n(WebCore::CloneSerializer::dumpDerivedTerminal):\n* Source/WebKit/NetworkProcess/storage/FileSystemStorageManager.cpp:\n(WebKit::FileSystemStorageManager::createHandle):\n* Source/WebKit/Scripts/webkit/messages.py:\n(atomic_object_identifier):\n(serialized_identifiers):\n(types_that_cannot_be_forward_declared):\n(headers_for_type):\n* Source/WebKit/Scripts/webkit/tests/MessageArgumentDescriptions.cpp:\n(IPC::serializedIdentifiers):\n* Source/WebKit/Shared/WTFArgumentCoders.serialization.in:\n\nCanonical link: https://commits.webkit.org/319641@main",
      "email": "richard_robinson2@apple.com",
      "hash": "22fbd8510ca81ff8d8cc2e03f50a5dbb186dbb9d",
      "subject": "Use a normal UUID for the `FileSystemHandleGlobalIdentifier` type"
    },
    "319642@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "319642@main",
      "clUrl": "https://commits.webkit.org/319642@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322311\nrdar://185549590\n\nReviewed by Dan Hecht.\n\nAvoiding calling forEachArg twice and collecting hasEarlyDef /\nhasLateUseOrDef at once via paddingSummary.\n\n* Source/JavaScriptCore/b3/air/AirInst.cpp:\n(JSC::B3::Air::Inst::paddingSummary):\n(JSC::B3::Air::Inst::needsPadding): Deleted.\n* Source/JavaScriptCore/b3/air/AirInst.h:\n* Source/JavaScriptCore/b3/air/AirPadInterference.cpp:\n(JSC::B3::Air::padInterference):\n\nCanonical link: https://commits.webkit.org/319642@main",
      "email": "ysuzuki@apple.com",
      "hash": "2cba6521075d9a3a968a4a00f5e352f6e578c61f",
      "subject": "[JSC] Make Air::padInference faster by avoiding visiting args twice"
    },
    "319643@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "319643@main",
      "clUrl": "https://commits.webkit.org/319643@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322314\n\nReviewed by Sihui Liu.\n\nIgnore the console logs since they're not the primary point of this test.\n\n* LayoutTests/fast/files/file-reader-back-forward-cache.html:\n\nCanonical link: https://commits.webkit.org/319643@main",
      "email": "rniwa@webkit.org",
      "hash": "cd9803c538a58c8ffc75f03b7ce121e408c5f6f1",
      "subject": "[Site Isolation] fast/files/file-reader-back-forward-cache.html fails"
    },
    "319644@main": {
      "author": "tannal",
      "avatar": "https://www.gravatar.com/avatar/440e4046bc26811d72aa4a34e08385f5?d=identicon\u0026s=64",
      "cl": "319644@main",
      "clUrl": "https://commits.webkit.org/319644@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321996\n\nRebase WPT tests in the mathml/ directory.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/4eeb06f9241da36ca3543dcbd25ce67727262238\n\nReviewed by Frédéric Wang Nélar.\n\n* LayoutTests/imported/w3c/resources/resource-files.json:\n* LayoutTests/imported/w3c/web-platform-tests/mathml/relations/html5-tree/a-rel-getter-setter-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/mathml/relations/html5-tree/a-rel-getter-setter.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/mathml/relations/html5-tree/a-rel-policy-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/mathml/relations/html5-tree/a-rel-policy.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/mathml/relations/html5-tree/href-target-base-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/mathml/relations/html5-tree/href-target-base.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/mathml/relations/html5-tree/support/a-rel-target.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/mathml/relations/html5-tree/support/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/mathml/relations/html5-tree/w3c-import.log:\n* LayoutTests/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319644@main",
      "email": "mtan@igalia.com",
      "hash": "089848d399ffbc765f2f8d914f8b0b55cca87be7",
      "subject": "Resync `mathml` from WPT Upstream"
    },
    "319645@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "319645@main",
      "clUrl": "https://commits.webkit.org/319645@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322161\n\nReviewed by Yusuke Suzuki.\n\nObject.assign({}, state, patch) with 2 or 3 sources goes through the batching path in\nobjectConstructorAssign, which enumerates every source and replays the first source's\nshape one property at a time via putOwnDataPropertyBatching. objectCloneFast is only\nreachable from objectAssignFast, which is used for a single source or 5+ arguments.\n\nTry objectCloneFast for the first source at the start of the batching path and start\nthe per-source loop from the second source when it succeeds. The batching path's\nexisting preconditions already satisfy what objectCloneFast requires.\n\n                                               Baseline                  Patched\n\nobject-assign-clone-multiple-sources        0.9998+-0.0420     ^      0.7104+-0.0486        ^ definitely 1.4073x faster\nobject-assign-multiple-sources              9.5170+-0.2249     ^      6.2294+-0.2320        ^ definitely 1.5278x faster\n\nTests: JSTests/microbenchmarks/object-assign-clone-multiple-sources.js\n       JSTests/stress/object-assign-clone-multiple-sources.js\n\n* JSTests/microbenchmarks/object-assign-clone-multiple-sources.js: Added.\n* JSTests/stress/object-assign-clone-multiple-sources.js: Added.\n(shouldBe):\n(shouldBeArray):\n(makeState):\n* Source/JavaScriptCore/runtime/ObjectConstructor.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n\nCanonical link: https://commits.webkit.org/319645@main",
      "email": "sosuke@bun.sh",
      "hash": "96ca975b2a61a52093cccecd9249e2b410085eea",
      "subject": "[JSC] Use `objectCloneFast` for the first source in `Object.assign`'s batching path"
    },
    "319646@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "319646@main",
      "clUrl": "https://commits.webkit.org/319646@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321587\n\nReviewed by Yusuke Suzuki.\n\nEvery closure variable that its own function stores to (which includes the initializing store of\n`var` / `let` / `function` / `class` bindings and captured parameters) and every global variable\ngets SymbolTableEntry::prepareToWatch() when its CodeBlock is linked or the global is declared.\nThat allocated a 16-byte FatEntry plus a WatchpointSet (a 32-byte libpas cell) per variable.\nThe WatchpointSet is only needed once DFG constant-folds a load of the variable and adds a\nWatchpoint to it; until then LLInt, Baseline and DFG only read and step its\nClearWatchpoint / IsWatched / IsInvalidated state.\n\nThis patch makes FatEntry hold an InlineWatchpointSet, which keeps that state in one word and\ninflates to a WatchpointSet only when a Watchpoint is added. The op_get_from_scope /\nop_put_to_scope metadata, ResolveOp, DFG NotifyWrite and ScopedArgumentsTable now point at the\nInlineWatchpointSet, and LLInt / Baseline / DFG / FTL check its word inline before falling back to\nthe WatchpointSet state. Since an InlineWatchpointSet cannot be shared, copies of a\nSymbolTableEntry are now always thin; the few places that took the watchpoint set from a copy use\nSymbolTable::find() instead, and JSGlobalObject::defineOwnProperty sets the read-only bit in place\nrather than replacing the entry.\n\nIn a server application made of about 250 CommonJS modules, main allocated 1,466 WatchpointSets\nright after loading the application, while this patch allocates none. Even after the code has\nbeen JIT-compiled by DFG/FTL, only 376 of the 1,752 watchpoint sets got inflated; the rest stayed\ninline watchpoint sets.\n\n* Source/JavaScriptCore/b3/B3AbstractHeapRepository.h:\n* Source/JavaScriptCore/bytecode/BytecodeList.rb:\n* Source/JavaScriptCore/bytecode/VariableWriteFireDetail.cpp:\n(JSC::VariableWriteFireDetail::touch):\n* Source/JavaScriptCore/bytecode/VariableWriteFireDetail.h:\n* Source/JavaScriptCore/bytecode/Watchpoint.h:\n(JSC::InlineWatchpointSet::inflatedSetConcurrently const):\n(JSC::InlineWatchpointSet::offsetOfData):\n(JSC::InlineWatchpointSet::thinFlag):\n(JSC::InlineWatchpointSet::encodedThinState):\n(JSC::InlineWatchpointSet::encodeState):\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::ByteCodeParser::parseBlock):\n* Source/JavaScriptCore/dfg/DFGGraph.cpp:\n(JSC::DFG::Graph::tryGetConstantClosureVar):\n* Source/JavaScriptCore/dfg/DFGNode.h:\n(JSC::DFG::Node::watchpointSet):\n* Source/JavaScriptCore/dfg/DFGOperations.cpp:\n(JSC::DFG::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):\n* Source/JavaScriptCore/dfg/DFGOperations.h:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n(JSC::DFG::SpeculativeJIT::compileNotifyWrite):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileNotifyWrite):\n* Source/JavaScriptCore/jit/AssemblyHelpers.h:\n(JSC::AssemblyHelpers::branchIfInlineWatchpointSetIsStillValid):\n* Source/JavaScriptCore/jit/JIT.cpp:\n(JSC::JIT::emitNotifyWriteWatchpoint):\n* Source/JavaScriptCore/jit/JIT.h:\n* Source/JavaScriptCore/jit/JITOperations.cpp:\n(JSC::JSC_DEFINE_JIT_OPERATION):\n* Source/JavaScriptCore/llint/LowLevelInterpreter.asm:\n* Source/JavaScriptCore/llint/LowLevelInterpreter64.asm:\n* Source/JavaScriptCore/lol/LOLJITOperations.cpp:\n(JSC::LOL::JSC_DEFINE_JIT_OPERATION):\n* Source/JavaScriptCore/runtime/CommonSlowPathsInlines.h:\n(JSC::CommonSlowPaths::cacheGlobalLexicalVar):\n(JSC::CommonSlowPaths::tryCachePutToScopeGlobal):\n(JSC::CommonSlowPaths::tryCacheGetFromScopeGlobal):\n* Source/JavaScriptCore/runtime/GetPutInfo.h:\n(JSC::ResolveOp::ResolveOp):\n* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:\n(JSC::JSGlobalObject::defineOwnProperty):\n(JSC::JSGlobalObject::addStaticGlobals):\n* Source/JavaScriptCore/runtime/JSSymbolTableObject.h:\n(JSC::symbolTablePutTouchWatchpointSet):\n(JSC::symbolTablePutInvalidateWatchpointSet):\n(JSC::symbolTablePut):\n* Source/JavaScriptCore/runtime/ProgramExecutable.cpp:\n(JSC::ProgramExecutable::initializeGlobalProperties):\n* Source/JavaScriptCore/runtime/ScopedArgumentsTable.cpp:\n(JSC::ScopedArgumentsTable::trySetWatchpointSet):\n* Source/JavaScriptCore/runtime/ScopedArgumentsTable.h:\n* Source/JavaScriptCore/runtime/SymbolTable.cpp:\n(JSC::SymbolTableEntry::inflateSlow):\n(JSC::SymbolTable::hasScopedWatchpointSet):\n(JSC::SymbolTableEntry::copySlow): Deleted.\n(JSC::SymbolTableEntry::prepareToWatch): Deleted.\n* Source/JavaScriptCore/runtime/SymbolTable.h:\n(JSC::SymbolTableEntry::varOffsetFromBits):\n(JSC::SymbolTableEntry::scopeOffsetFromBits):\n(JSC::SymbolTableEntry::SymbolTableEntry):\n(JSC::SymbolTableEntry::operator=):\n(JSC::SymbolTableEntry::isWatchable const):\n(JSC::SymbolTableEntry::prepareToWatch):\n(JSC::SymbolTableEntry::watchpointSet):\n(JSC::SymbolTableEntry::pack):\n(JSC::SymbolTableEntry::disableWatching): Deleted.\n* Source/JavaScriptCore/runtime/SymbolTableInlines.h:\n(JSC::SymbolTableEntry::SymbolTableEntry):\n(JSC::SymbolTableEntry::operator=):\n(JSC::SymbolTable::prepareToWatchScopedArgument):\n(JSC::SymbolTableEntry::inflate): Deleted.\n\nCanonical link: https://commits.webkit.org/319646@main",
      "email": "sosuke@bun.sh",
      "hash": "cea233cedec0d634e84b0eb2d3e495e62c9a6959",
      "subject": "[JSC] `SymbolTableEntry` should not allocate a `WatchpointSet` until somebody watches the variable"
    },
    "319647@main": {
      "author": "Fady Farag",
      "avatar": "https://www.gravatar.com/avatar/0ac5127c69f90d0c57054173ae4c3108?d=identicon\u0026s=64",
      "cl": "319647@main",
      "clUrl": "https://commits.webkit.org/319647@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321998\nrdar://185499780\n\nUnreviewed.\n\n* LayoutTests/platform/ios/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319647@main",
      "email": "com.webkit.iidmsa@gmail.com",
      "hash": "889d15f0a77e0701ab5db32607647476a5d0498b",
      "subject": "[Gardening] Remove outdated test expectation after 319592@main"
    },
    "319648@main": {
      "author": "Per Arne Vollan",
      "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64",
      "cl": "319648@main",
      "clUrl": "https://commits.webkit.org/319648@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=311807\nrdar://171541375\n\nReviewed by Chris Dumez.\n\nThis was already fixed for iOS in rdar://159116963. This patch enables the feature on macOS\nwith an additional link check.\n\nNo new tests, since both WebKitTestRunner and TestWebKitAPI are not blocking network access.\n\n* Source/WTF/wtf/PlatformEnableCocoa.h:\n* Source/WTF/wtf/cocoa/RuntimeApplicationChecksCocoa.h:\n* Source/WTF/wtf/cocoa/RuntimeApplicationChecksCocoa.mm:\n(WTF::computeSDKAlignedBehaviors):\n* Source/WTF/wtf/spi/darwin/dyldSPI.h:\n* Source/WebKit/NetworkProcess/cocoa/NetworkProcessCocoa.mm:\n(WebKit::blockNetworkAccessIfNeeded):\n(WebKit::NetworkProcess::platformInitializeNetworkProcessCocoa):\n* Source/WebKit/NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:\n* Source/WebKit/Scripts/process-entitlements.sh:\n\nOriginally-landed-as: 305413.701@safari-7624-branch (8f582cbc1a83). rdar://184743905\nCanonical link: https://commits.webkit.org/319648@main",
      "email": "pvollan@apple.com",
      "hash": "cb7daacd43302439e72f19b9577d2b10c629d242",
      "subject": "[macOS] The Networking process sandbox should inherit network access from the UI process"
    },
    "319649@main": {
      "author": "Kai Tamkun",
      "avatar": "https://www.gravatar.com/avatar/dff073cba21885df4d9f73ed3cc493c2?d=identicon\u0026s=64",
      "cl": "319649@main",
      "clUrl": "https://commits.webkit.org/319649@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315213\nrdar://176984293\n\nReviewed by Yijia Huang.\n\nThis patch prevents overflow checks for increment/decrement in DFG from being mistakenly DCE'd.\n\nTest: JSTests/stress/inc-dec-int32-overflow-dce.js\n\n* JSTests/stress/inc-dec-int32-overflow-dce.js: Added.\n(shouldBe):\n(inc):\n(dec):\n* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:\n(JSC::DFG::FixupPhase::fixupNode):\n\nOriginally-landed-as: 305413.1015@safari-7624.5-branch (7951c397a1ba). rdar://185368748\nCanonical link: https://commits.webkit.org/319649@main",
      "email": "k_tamkun@apple.com",
      "hash": "7711916200dda7e418b321e34493f66a7af2a0b0",
      "subject": "[JSC] NodeMustGenerate incorrectly cleared on CheckOverflow ArithAdd/ArithSub in DFGFixupPhase Inc/Dec handler"
    },
    "319650@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "319650@main",
      "clUrl": "https://commits.webkit.org/319650@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322324\nrdar://185566036\n\nReviewed by Ben Nham.\n\nI introduced this version of ObjectIdentifier two years ago, when I was more naïve and less pragmatic.\nRemove this unnecessary and unused version by effectively reverting 279402@main.\n\nThis greatly re-simplifies the code and also makes crash log stack symbols and compilation errors a lot\neasier to read.\n\nTest: Source/JavaScriptCore/assembler/testmasm.cpp\n\n* Source/JavaScriptCore/assembler/testmasm.cpp:\n* Source/JavaScriptCore/wasm/debugger/WasmExecutionHandler.cpp:\n(JSC::Wasm::findVM):\n(JSC::Wasm::WTF_REQUIRES_LOCK):\n(JSC::Wasm::ExecutionHandler::callStackStringFor):\n* Source/JavaScriptCore/wasm/debugger/tests/ExecutionHandlerTest.cpp:\n(ExecutionHandlerTest::switchTarget):\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n* Source/WTF/wtf/CrossThreadCopier.h:\n* Source/WTF/wtf/Forward.h:\n* Source/WTF/wtf/ObjectIdentifier.cpp:\n(WTF::ObjectIdentifierMainThreadAccessTraits::generateIdentifierInternal):\n(WTF::printInternal):\n(WTF::ObjectIdentifierThreadSafeAccessTraits::generateIdentifierInternal):\n(WTF::ObjectIdentifierMainThreadAccessTraits\u003cuint64_t\u003e::generateIdentifierInternal): Deleted.\n(WTF::ObjectIdentifierThreadSafeAccessTraits\u003cuint64_t\u003e::generateIdentifierInternal): Deleted.\n(WTF::ObjectIdentifierMainThreadAccessTraits\u003cUUID\u003e::generateIdentifierInternal): Deleted.\n(WTF::ObjectIdentifierThreadSafeAccessTraits\u003cUUID\u003e::generateIdentifierInternal): Deleted.\n* Source/WTF/wtf/ObjectIdentifier.h:\n(WTF::ObjectIdentifierGenericBase::toUInt64 const):\n(WTF::ObjectIdentifierGenericBase::isValidIdentifier):\n(WTF::ObjectIdentifierGenericBase::ObjectIdentifierGenericBase):\n(WTF::ObjectIdentifierGenericBase::hashTableDeletedValue):\n(WTF::ObjectIdentifierGeneric::ObjectIdentifierGeneric):\n(WTF::ObjectIdentifierGeneric::isHashTableEmptyValue const):\n(WTF::add):\n(WTF::operator==):\n(WTF::operator\u003c=\u003e):\n(WTF::ObjectIdentifierGenericBase\u003cuint64_t\u003e::isHashTableDeletedValue const): Deleted.\n(WTF::ObjectIdentifierGenericBase\u003cuint64_t\u003e::toUInt64 const): Deleted.\n(WTF::ObjectIdentifierGenericBase\u003cuint64_t\u003e::toRawValue const): Deleted.\n(WTF::ObjectIdentifierGenericBase\u003cuint64_t\u003e::loggingString const): Deleted.\n(WTF::ObjectIdentifierGenericBase\u003cuint64_t\u003e::isValidIdentifier): Deleted.\n(WTF::ObjectIdentifierGenericBase\u003cuint64_t\u003e::ObjectIdentifierGenericBase): Deleted.\n(WTF::ObjectIdentifierGenericBase\u003cuint64_t\u003e::hashTableDeletedValue): Deleted.\n(WTF::ObjectIdentifierGenericBase\u003cUUID\u003e::isHashTableDeletedValue const): Deleted.\n(WTF::ObjectIdentifierGenericBase\u003cUUID\u003e::toRawValue const): Deleted.\n(WTF::ObjectIdentifierGenericBase\u003cUUID\u003e::loggingString const): Deleted.\n(WTF::ObjectIdentifierGenericBase\u003cUUID\u003e::isValidIdentifier): Deleted.\n(WTF::ObjectIdentifierGenericBase\u003cUUID\u003e::ObjectIdentifierGenericBase): Deleted.\n(WTF::ObjectIdentifierGenericBase\u003cUUID\u003e::hashTableDeletedValue): Deleted.\n(WTF::ObjectIdentifierGenericBaseStringTypeAdapter\u003cuint64_t\u003e::length const): Deleted.\n(WTF::ObjectIdentifierGenericBaseStringTypeAdapter\u003cuint64_t\u003e::is8Bit const): Deleted.\n(WTF::ObjectIdentifierGenericBaseStringTypeAdapter\u003cuint64_t\u003e::writeTo const): Deleted.\n(WTF::ObjectIdentifierGenericBaseStringTypeAdapter\u003cuint64_t\u003e::ObjectIdentifierGenericBaseStringTypeAdapter): Deleted.\n* Source/WTF/wtf/text/TextStream.cpp:\n(WTF::operator\u003c\u003c):\n* Source/WTF/wtf/text/TextStream.h:\n* Source/WebCore/Modules/indexeddb/IDBTransaction.cpp:\n(WebCore::IDBTransaction::renameIndex):\n(WebCore::IDBTransaction::deleteIndex):\n* Source/WebCore/Modules/indexeddb/server/MemoryIDBBackingStore.cpp:\n(WebCore::IDBServer::MemoryIDBBackingStore::createObjectStore):\n(WebCore::IDBServer::MemoryIDBBackingStore::addIndex):\n* Source/WebCore/Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:\n(WebCore::IDBServer::SQLiteIDBBackingStore::migrateIndexInfoTableForIDUpdate):\n(WebCore::IDBServer::SQLiteIDBBackingStore::migrateIndexRecordsTableForIDUpdate):\n(WebCore::IDBServer::SQLiteIDBBackingStore::extractExistingDatabaseInfo):\n(WebCore::IDBServer::SQLiteIDBBackingStore::createObjectStore):\n(WebCore::IDBServer::SQLiteIDBBackingStore::deleteObjectStore):\n(WebCore::IDBServer::SQLiteIDBBackingStore::renameObjectStore):\n(WebCore::IDBServer::SQLiteIDBBackingStore::clearObjectStore):\n(WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedGetExistingPrimaryKeyForIndexKey):\n(WebCore::IDBServer::SQLiteIDBBackingStore::overwriteRecord):\n(WebCore::IDBServer::SQLiteIDBBackingStore::checkIndexConstraintsForPut):\n(WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedPutIndexKey):\n(WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedPutIndexRecord):\n(WebCore::IDBServer::SQLiteIDBBackingStore::deleteIndex):\n(WebCore::IDBServer::SQLiteIDBBackingStore::renameIndex):\n(WebCore::IDBServer::SQLiteIDBBackingStore::keyExistsInObjectStore):\n(WebCore::IDBServer::SQLiteIDBBackingStore::deleteRecord):\n(WebCore::IDBServer::SQLiteIDBBackingStore::deleteRange):\n(WebCore::IDBServer::SQLiteIDBBackingStore::updateAllIndexesForAddRecord):\n(WebCore::IDBServer::SQLiteIDBBackingStore::addRecord):\n(WebCore::IDBServer::SQLiteIDBBackingStore::deleteFileSystemHandleRecordsForObjectStore):\n(WebCore::IDBServer::SQLiteIDBBackingStore::getRecord):\n(WebCore::IDBServer::SQLiteIDBBackingStore::getAllObjectStoreRecords):\n(WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedGetIndexRecordForOneKey):\n(WebCore::IDBServer::SQLiteIDBBackingStore::getCount):\n(WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedGetKeyGeneratorValue):\n(WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedSetKeyGeneratorValue):\n(WebCore::IDBServer::SQLiteIDBBackingStore::revertGeneratedKeyNumber):\n(WebCore::IDBServer::SQLiteIDBBackingStore::addIndex):\n* Source/WebCore/Modules/indexeddb/server/SQLiteIDBCursor.cpp:\n(WebCore::IDBServer::SQLiteIDBCursor::internalFetchNextRecord):\n(WebCore::IDBServer::SQLiteIDBCursor::boundIDValue const):\n* Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.cpp:\n(WebCore::IDBServer::UniqueIDBDatabase::createIndexAsyncAfterQuotaCheck):\n* Source/WebCore/Modules/indexeddb/shared/IDBCursorInfo.cpp:\n(WebCore::IDBCursorInfo::loggingString const):\n* Source/WebCore/dom/ViewTransition.cpp:\n(WebCore::effectiveViewTransitionName):\n* Source/WebCore/inspector/InspectorIdentifierRegistry.h:\n(Inspector::IdentifierRegistry::protocolFrameId):\n* Source/WebCore/loader/NavigationIdentifier.h:\n* Source/WebCore/page/FrameIdentifier.cpp:\n(WebCore::operator\u003c\u003c):\n* Source/WebCore/page/RemoteFrame.cpp:\n(WebCore::RemoteFrame::hostingProcessIdentifier const):\n* Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::identifierForTimeline const):\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:\n(WebKit::escapeIDForJSON):\n* Source/WebKit/Platform/IPC/Connection.h:\n(IPC::Connection::sendWithAsyncReply):\n(IPC::Connection::sendWithPromisedReply):\n(IPC::Connection::send):\n(IPC::Connection::sendSync):\n(IPC::Connection::waitForAndDispatchImmediately):\n* Source/WebKit/Platform/IPC/Decoder.cpp:\n* Source/WebKit/Platform/IPC/MessageSender.h:\n* Source/WebKit/Platform/IPC/MessageSenderInlines.h:\n(IPC::MessageSender::send):\n(IPC::MessageSender::sendSync):\n(IPC::MessageSender::sendWithAsyncReply):\n* Source/WebKit/Platform/IPC/StreamClientConnection.h:\n(IPC::StreamClientConnection::send):\n(IPC::StreamClientConnection::sendWithAsyncReply):\n(IPC::StreamClientConnection::sendWithAsyncReplyOnDispatcher):\n(IPC::StreamClientConnection::sendSync):\n(IPC::StreamClientConnection::waitForAndDispatchImmediately):\n* Source/WebKit/Platform/IPC/StreamServerConnection.h:\n(IPC::StreamServerConnection::send):\n* Source/WebKit/Shared/AuxiliaryProcess.h:\n(WebKit::AuxiliaryProcess::addMessageReceiver):\n(WebKit::AuxiliaryProcess::removeMessageReceiver):\n* Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTreeTransaction.mm:\n(WebKit::RemoteLayerTreeTransaction::LayerCreationProperties::hostingContextID const):\n* Source/WebKit/Shared/WTFArgumentCoders.serialization.in:\n* Source/WebKit/Shared/WebFoundTextRange.cpp:\n(WebKit::WebFoundTextRange::CueData::hash const):\n(WebKit::operator\u003c\u003c):\n* Source/WebKit/Shared/unix/AuxiliaryProcessMain.cpp:\n(WebKit::AuxiliaryProcessMainCommon::parseCommandLine):\n* Source/WebKit/UIProcess/Automation/BidiScriptAgent.h:\n* Source/WebKit/UIProcess/AuxiliaryProcessProxy.h:\n(WebKit::AuxiliaryProcessProxy::sendWithAsyncReply):\n(WebKit::AuxiliaryProcessProxy::send):\n(WebKit::AuxiliaryProcessProxy::sendSync):\n(WebKit::AuxiliaryProcessProxy::addMessageReceiver):\n(WebKit::AuxiliaryProcessProxy::removeMessageReceiver):\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.cpp:\n(WebKit::WebExtensionContext::isPrivilegedMessage const):\n* Source/WebKit/UIProcess/Extensions/WebExtensionController.h:\n(WebKit::WebExtensionController::sendToAllProcesses):\n* Source/WebKit/UIProcess/Model/PortalPresentationManagerProxy.mm:\n(WebKit::PortalPresentationManagerProxy::invalidateModel):\n(WebKit::PortalPresentationManagerProxy::ensurePortalPresentation):\n* Source/WebKit/UIProcess/RemoteLayerTree/RemoteAnimationTimeline.cpp:\n(WebKit::RemoteAnimationTimeline::toJSONForTesting const):\n* Source/WebKit/UIProcess/WebFrameProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebProcessPool.h:\n* Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm:\n(+[WKFoundTextRange foundTextRangeWithWebFoundTextRange:]):\n* Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp:\n(WebKit::RemoteRenderingBackendProxy::send):\n(WebKit::RemoteRenderingBackendProxy::sendSync):\n(WebKit::RemoteRenderingBackendProxy::sendWithAsyncReply):\n* Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.h:\n* Source/WebKit/WebProcess/WebPage/RemoteLayerTree/PlatformCALayerRemoteCustom.mm:\n(WebKit::PlatformCALayerRemoteCustom::PlatformCALayerRemoteCustom):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n\nCanonical link: https://commits.webkit.org/319650@main",
      "email": "richard_robinson2@apple.com",
      "hash": "314133b7a60e4c00c9160e685cf56cc11901c298",
      "subject": "[WTF] Remove UUID version of ObjectIdentifier"
    }
  },
  "date": "2026-08-22",
  "days": 1,
  "generatedAt": "2026-08-22T22:05:26Z",
  "markdown": "## Highlights\n- **Security** macOS networking sandboxing now correctly inherits network access from the UI process, fixing a process permission gap that could break real-world loads. [commit 319648@main](https://commits.webkit.org/319648@main)\n- **V8** JSC stops clearing NodeMustGenerate incorrectly for overflow-checked add and sub in DFG fixup, fixing a bad optimization hazard in Inc and Dec handling. [commit 319649@main](https://commits.webkit.org/319649@main)\n- **Perf** JSC speeds up Object.assign by using objectCloneFast for the first source in the batching path, cutting overhead on a common object-copy pattern. [commit 319645@main](https://commits.webkit.org/319645@main)\n- **Perf** Stream IPC avoids constructing a Timeout on the hot send path, trimming overhead from a common communication path. [commit 319636@main](https://commits.webkit.org/319636@main)\n- **Rendering** List bullet markers now lay out as marker text and participate in inline layout, a meaningful correctness fix for marker positioning and line construction. [commit 319632@main](https://commits.webkit.org/319632@main)\n- **A11y** dialog.close() now restores focus unconditionally, tightening focus behavior and making dialog teardown more predictable for keyboard and assistive tech users. [commit 319640@main](https://commits.webkit.org/319640@main)\n- **Mobile** Hidden page throttling heuristics now apply to newly created pages too, closing a lifecycle gap that could waste work in backgrounded content. [commit 319630@main](https://commits.webkit.org/319630@main)\n- **UI** Typing a space in editable content inside summary or button no longer misfires activation behavior, fixing an annoying editing and controls interaction bug. [commit 319628@main](https://commits.webkit.org/319628@main)\n- **Rendering** Spatial portals gain per-child entity transforms for model content, expanding scene composition for immersive and 3D content. [commit 319629@main](https://commits.webkit.org/319629@main)\n\n## What landed by area\n\n### JavaScriptCore\n- **Perf** JSC delays WatchpointSet allocation for SymbolTableEntry until something actually watches the variable, reducing bookkeeping overhead and memory churn. [commit 319646@main](https://commits.webkit.org/319646@main)\n- **Perf** Air::padInference gets faster by avoiding a second visit over arguments, shaving compiler work in the backend. [commit 319642@main](https://commits.webkit.org/319642@main)\n- **Refactor** WTF PriorityQueue is aligned with std::priority_queue semantics, with a WasmWorklist fix folded in to keep users correct after the cleanup. [commit 319634@main](https://commits.webkit.org/319634@main)\n\n### Rendering and layout\n- **Rendering** Margin trimming machinery moves out of RenderBox, continuing the cleanup around margin-trim and making the implementation less tangled. [commit 319637@main](https://commits.webkit.org/319637@main)\n- **Refactor** GridLanesLayout drops redundant \"Phase\" suffixes from enum values, a small naming cleanup in layout internals. [commit 319631@main](https://commits.webkit.org/319631@main)\n- **Perf** SVG gradient fill and stroke painting no longer do redundant paint state save and restore, removing unnecessary work in a rendering path. [commit 319635@main](https://commits.webkit.org/319635@main)\n\n### DOM, editing, and interaction\n- **UI** Opening local HTML files from Notes is fixed, smoothing a user-visible integration path on Apple platforms. [commit 319627@main](https://commits.webkit.org/319627@main)\n\n### Site isolation and page lifecycle\n- **Security** A Site Isolation crash under WebFrame::fromCoreFrame is fixed, addressing a bad failure mode in frame plumbing. [commit 319638@main](https://commits.webkit.org/319638@main)\n- **Mobile** A Site Isolation failure in file-reader-back-forward-cache coverage is fixed, another sign of active BFCache hardening under isolated frames. [commit 319643@main](https://commits.webkit.org/319643@main)\n- **Mobile** A Site Isolation failure in suspend-timers coverage is fixed, tightening lifecycle behavior across isolated documents. [commit 319639@main](https://commits.webkit.org/319639@main)\n\n### File system and identifiers\n- **Refactor** FileSystemHandleGlobalIdentifier now uses a normal UUID type, simplifying identifier handling. [commit 319641@main](https://commits.webkit.org/319641@main)\n- **Refactor** WTF removes the UUID-flavored ObjectIdentifier variant, continuing identifier type cleanup at the utility layer. [commit 319650@main](https://commits.webkit.org/319650@main)\n\n### Web platform and standards\n- **Web Platform** WebKit resynced MathML tests from upstream WPT, pulling in current conformance coverage. [commit 319644@main](https://commits.webkit.org/319644@main)\n\n### Test gardening\n- **Refactor** An outdated test expectation added before [bug 321998](https://bugs.webkit.org/show_bug.cgi?id=321998) is removed after the underlying behavior changed in 319592@main. [commit 319647@main](https://commits.webkit.org/319647@main)\n- **A11y** A constant timeout regression in isolated-tree aria-owns-id-change coverage on macOS gets test gardening attention. [commit 319633@main](https://commits.webkit.org/319633@main)\n- **Mobile** An iOS visual viewport rotation test gets updated after a constant text failure in interactive-widget coverage. [commit 319626@main](https://commits.webkit.org/319626@main)",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [],
  "since": "2026-08-22",
  "totals": {
    "commits": 25,
    "features": 25,
    "rolls": 0
  },
  "until": "2026-08-22"
}