{
  "commits": {
    "314451@main": {
      "author": "Jer Noble",
      "avatar": "https://www.gravatar.com/avatar/6d2cde9be23b98223ca964cb3b7813a0?d=identicon\u0026s=64",
      "cl": "314451@main",
      "clUrl": "https://commits.webkit.org/314451@main",
      "description": "rdar://176473804\nhttps://bugs.webkit.org/show_bug.cgi?id=318500\n\nReviewed by Jean-Yves Avenard\n\nWhen PlatformRawAudioData::copyTo() is told to copy zero samples, just bail out early. This\navoids a calculation where the number of samples has 1 subtracted from it, causing a math\nunderflow.\n\nCherry-pick https://commits.webkit.org/314451@main for test to pass.\n\nTest: fast/webcodecs/audio-data-copy-to-zero-frames-crash.html\n\n* LayoutTests/fast/webcodecs/audio-data-copy-to-zero-frames-crash-expected.txt: Added.\n* LayoutTests/fast/webcodecs/audio-data-copy-to-zero-frames-crash.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/audio-data-copyTo.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/audio-data-copyTo.any.js:\n(test):\n* LayoutTests/imported/w3c/web-platform-tests/webcodecs/audio-data-copyTo.any.worker-expected.txt:\n* Source/WebCore/Modules/webcodecs/WebCodecsAudioDataAlgorithms.cpp:\n(WebCore::computeCopyElementCount):\n* Source/WebCore/platform/audio/cocoa/PlatformRawAudioDataCocoa.cpp:\n(WebCore::PlatformRawAudioData::copyTo):\n\nOriginally-landed-as: 305413.1119@safari-7624.5-branch (6b8717a224a0). rdar://185368929\nCanonical link: https://commits.webkit.org/319651@main",
      "email": "jer.noble@apple.com",
      "hash": "4fa207d1c8d4a14afbda9ffa02b9070effd52d9b",
      "subject": "[WebCore] Memory underflow in PlatformRawAudioData::copyTo()"
    },
    "319652@main": {
      "author": "Sam Sneddon",
      "avatar": "https://www.gravatar.com/avatar/99f6b56d9db9d32920dfcc56deae86fc?d=identicon\u0026s=64",
      "cl": "319652@main",
      "clUrl": "https://commits.webkit.org/319652@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=309834\nrdar://172412849\n\nReviewed by Elliott Williams.\n\nThe test runners did not correctly handle Python's @unittest.expectedFailure\ndecorator. Expected failures were reported as \"passed\", and unexpected\nsuccesses (where a test marked as expected-to-fail actually passes) were\nconflated with regular failures without being clearly identified.\n\nTrack expected failures and unexpected successes as distinct outcomes\nthroughout the pipeline, instead of conflating them with passes and\nfailures.\n\n* Tools/Scripts/libraries/webkitcorepy/webkitcorepy/testing/test_runner.py:\n(TestRunner.run): Report expected failures as \"expected failure\" instead of\n\"passed\", and treat unexpected successes as failures.\n* Tools/Scripts/libraries/webkitcorepy/webkitcorepy/tests/testing/__init__.py: Added.\n* Tools/Scripts/libraries/webkitcorepy/webkitcorepy/tests/testing/test_runner_unittest.py: Added.\n(_Test_TestRunner):\n(_Test_TestRunner._test_pass):\n(_Test_TestRunner._test_fail):\n(_Test_TestRunner._test_error):\n(_Test_TestRunner._test_skip):\n(_Test_TestRunner._test_expected_failure):\n(_Test_TestRunner._test_unexpected_success):\n(_Test_TestRunner.id):\n(StubTestRunner):\n(StubTestRunner.__init__):\n(StubTestRunner.tests):\n(StubTestRunner.run_test):\n(TestRunnerTest):\n(TestRunnerTest._normalize):\n(TestRunnerTest._run):\n(TestRunnerTest.test_passed):\n(TestRunnerTest.test_failed):\n(TestRunnerTest.test_errored):\n(TestRunnerTest.test_skipped):\n(TestRunnerTest.test_unexpected_success_causes_failure):\n(TestRunnerTest.test_expected_failure_returns_success):\n* Tools/Scripts/webkitpy/test/main.py:\n(Tester._run_tests): Include expected/actual values for expected failures\nand unexpected successes in uploaded test results.\n* Tools/Scripts/webkitpy/test/printer.py:\n(Printer.print_finished_test): Accept expected_failures and\nunexpected_successes, so unexpected successes are shown as failures and\nexpected failures get their own summary suffix.\n* Tools/Scripts/webkitpy/test/printer_unittest.py: Added.\n(PrinterTest):\n(PrinterTest.setUp):\n(PrinterTest._make_printer):\n(PrinterTest._drive):\n(PrinterTest.test_passed):\n(PrinterTest.test_failed):\n(PrinterTest.test_errored):\n(PrinterTest.test_unexpected_success):\n(PrinterTest.test_expected_failure):\n(PrinterTest.test_failed_with_expected_failures_list):\n* Tools/Scripts/webkitpy/test/runner.py:\n(Runner.__init__): Track expected failures and unexpected successes.\n(Runner.handle): Ditto.\n(_Worker.handle): Compute expected_failures and unexpected_successes\nseparately instead of folding unexpected successes into failures.\n* Tools/Scripts/webkitpy/test/runner_unittest.py:\n(FakeModuleSuite.run): Support 'x' (expected failure) and 'u' (unexpected\nsuccess) fake results.\n(RunnerTest.test_run_expected_failures):\n\nCanonical link: https://commits.webkit.org/319652@main",
      "email": "gsnedders@apple.com",
      "hash": "b3f6dc92c6a45dbd5f4fcec996c551e319ffe678",
      "subject": "[webkitpy] [webkitcorepy] Expected failures / unexpected successes not properly handled"
    },
    "319653@main": {
      "author": "Sam Sneddon",
      "avatar": "https://www.gravatar.com/avatar/99f6b56d9db9d32920dfcc56deae86fc?d=identicon\u0026s=64",
      "cl": "319653@main",
      "clUrl": "https://commits.webkit.org/319653@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322341\nrdar://185604141\n\nUnreviewed test fix.\n\n* Tools/Scripts/webkitpy/test/runner_unittest.py:\n(FakeModuleSuite.run): Add the newly reachable values.\n\nCanonical link: https://commits.webkit.org/319653@main",
      "email": "gsnedders@apple.com",
      "hash": "ee946304054a01105a85ac54b45aff01e8041143",
      "subject": "REGRESSION(319652@main): webkitpy.test.runner_unittest.RunnerTest.test_run_expected_failures"
    },
    "319654@main": {
      "author": "Tyler Wilcock",
      "avatar": "https://www.gravatar.com/avatar/9545082e6bed96158a9f52dac6e4b869?d=identicon\u0026s=64",
      "cl": "319654@main",
      "clUrl": "https://commits.webkit.org/319654@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322276\nrdar://185514214\n\nReviewed by Dominic Mazzoni.\n\nThis commit encompasses two main changes:\n\n  1. Of accessibility/mac/, there were ~40 tests that also passed on iOS\n     without change. These have been moved to the accessibility/ folder\n     and marked as [ Pass ] in LayoutTests/platform/ios/TestExpectations.\n\n  2. Of tests already in accessibility/, many just pass without\n     modification, but weren't explicitly enabled in LayoutTests/platform/ios/TestExpectations.\n     This commit enables them, increasing our overall test coverage.\n\n* LayoutTests/accessibility-isolated-tree/TestExpectations: Update paths.\n* LayoutTests/accessibility/aria-details-expected.txt: Renamed from LayoutTests/accessibility/mac/aria-details-expected.txt.\n* LayoutTests/accessibility/aria-details.html: Renamed from LayoutTests/accessibility/mac/aria-details.html.\n* LayoutTests/accessibility/aria-image-emits-object-replacement-expected.txt: Renamed from LayoutTests/accessibility/mac/aria-image-emits-object-replacement-expected.txt.\n* LayoutTests/accessibility/aria-image-emits-object-replacement.html: Renamed from LayoutTests/accessibility/mac/aria-image-emits-object-replacement.html.\n* LayoutTests/accessibility/bezier-path-curves-expected.txt: Renamed from LayoutTests/accessibility/mac/bezier-path-curves-expected.txt.\n* LayoutTests/accessibility/bezier-path-curves.html: Renamed from LayoutTests/accessibility/mac/bezier-path-curves.html.\n* LayoutTests/accessibility/clipped-text-under-element-expected.txt: Renamed from LayoutTests/accessibility/mac/clipped-text-under-element-expected.txt.\n* LayoutTests/accessibility/clipped-text-under-element.html: Renamed from LayoutTests/accessibility/mac/clipped-text-under-element.html.\n* LayoutTests/accessibility/combobox/combobox-value-expected.txt: Renamed from LayoutTests/accessibility/combobox/mac/combobox-value-expected.txt.\n* LayoutTests/accessibility/combobox/combobox-value.html: Renamed from LayoutTests/accessibility/combobox/mac/combobox-value.html.\n* LayoutTests/accessibility/crash-in-element-for-text-marker-expected.txt: Renamed from LayoutTests/accessibility/mac/crash-in-element-for-text-marker-expected.txt.\n* LayoutTests/accessibility/crash-in-element-for-text-marker.html: Renamed from LayoutTests/accessibility/mac/crash-in-element-for-text-marker.html.\n* LayoutTests/accessibility/css-speech-speak-expected.txt: Renamed from LayoutTests/accessibility/mac/css-speech-speak-expected.txt.\n* LayoutTests/accessibility/css-speech-speak.html: Renamed from LayoutTests/accessibility/mac/css-speech-speak.html.\n* LayoutTests/accessibility/dynamic-modal-expected.txt: Renamed from LayoutTests/accessibility/mac/dynamic-modal-expected.txt.\n* LayoutTests/accessibility/dynamic-modal.html: Renamed from LayoutTests/accessibility/mac/dynamic-modal.html.\n* LayoutTests/accessibility/focus-crash-expected.txt: Renamed from LayoutTests/accessibility/mac/focus-crash-expected.txt.\n* LayoutTests/accessibility/focus-crash.html: Renamed from LayoutTests/accessibility/mac/focus-crash.html.\n* LayoutTests/accessibility/grid-add-remove-rows-expected.txt: Renamed from LayoutTests/accessibility/mac/grid-add-remove-rows-expected.txt.\n* LayoutTests/accessibility/grid-add-remove-rows.html: Renamed from LayoutTests/accessibility/mac/grid-add-remove-rows.html.\n* LayoutTests/accessibility/heading-clickpoint-expected.txt: Renamed from LayoutTests/accessibility/mac/heading-clickpoint-expected.txt.\n* LayoutTests/accessibility/heading-clickpoint.html: Renamed from LayoutTests/accessibility/mac/heading-clickpoint.html.\n* LayoutTests/accessibility/index-for-zero-offset-text-marker-expected.txt: Renamed from LayoutTests/accessibility/mac/index-for-zero-offset-text-marker-expected.txt.\n* LayoutTests/accessibility/index-for-zero-offset-text-marker.html: Renamed from LayoutTests/accessibility/mac/index-for-zero-offset-text-marker.html.\n* LayoutTests/accessibility/input-type-change-crash-2-expected.txt: Renamed from LayoutTests/accessibility/mac/input-type-change-crash-2-expected.txt.\n* LayoutTests/accessibility/input-type-change-crash-2.html: Renamed from LayoutTests/accessibility/mac/input-type-change-crash-2.html.\n* LayoutTests/accessibility/large-text-area-expected.txt: Renamed from LayoutTests/accessibility/mac/large-text-area-expected.txt.\n* LayoutTests/accessibility/large-text-area.html: Renamed from LayoutTests/accessibility/mac/large-text-area.html.\n* LayoutTests/accessibility/line-requests-starting-after-first-line-expected.txt: Renamed from LayoutTests/accessibility/mac/line-requests-starting-after-first-line-expected.txt.\n* LayoutTests/accessibility/line-requests-starting-after-first-line.html: Renamed from LayoutTests/accessibility/mac/line-requests-starting-after-first-line.html.\n* LayoutTests/accessibility/list-items-ignored-expected.txt: Renamed from LayoutTests/accessibility/mac/list-items-ignored-expected.txt.\n* LayoutTests/accessibility/list-items-ignored.html: Renamed from LayoutTests/accessibility/mac/list-items-ignored.html.\n* LayoutTests/accessibility/listmarker-suffix-expected.txt: Renamed from LayoutTests/accessibility/mac/listmarker-suffix-expected.txt.\n* LayoutTests/accessibility/listmarker-suffix.html: Renamed from LayoutTests/accessibility/mac/listmarker-suffix.html.\n* LayoutTests/accessibility/mixed-checkbox-expected.txt: Renamed from LayoutTests/accessibility/mac/mixed-checkbox-expected.txt.\n* LayoutTests/accessibility/mixed-checkbox.html: Renamed from LayoutTests/accessibility/mac/mixed-checkbox.html.\n* LayoutTests/accessibility/native-vs-nonnative-checkboxes-expected.txt: Renamed from LayoutTests/accessibility/mac/native-vs-nonnative-checkboxes-expected.txt.\n* LayoutTests/accessibility/native-vs-nonnative-checkboxes.html: Renamed from LayoutTests/accessibility/mac/native-vs-nonnative-checkboxes.html.\n* LayoutTests/accessibility/nested-modal-expected.txt: Renamed from LayoutTests/accessibility/mac/nested-modal-expected.txt.\n* LayoutTests/accessibility/nested-modal.html: Renamed from LayoutTests/accessibility/mac/nested-modal.html.\n* LayoutTests/accessibility/offset-from-root-outside-text-run-expected.txt: Renamed from LayoutTests/accessibility/mac/offset-from-root-outside-text-run-expected.txt.\n* LayoutTests/accessibility/offset-from-root-outside-text-run.html: Renamed from LayoutTests/accessibility/mac/offset-from-root-outside-text-run.html.\n* LayoutTests/accessibility/prefers-non-blinking-cursor-expected.txt: Renamed from LayoutTests/accessibility/mac/prefers-non-blinking-cursor-expected.txt.\n* LayoutTests/accessibility/prefers-non-blinking-cursor.html: Renamed from LayoutTests/accessibility/mac/prefers-non-blinking-cursor.html.\n* LayoutTests/accessibility/progress-element-min-max-expected.txt: Renamed from LayoutTests/accessibility/mac/progress-element-min-max-expected.txt.\n* LayoutTests/accessibility/progress-element-min-max.html: Renamed from LayoutTests/accessibility/mac/progress-element-min-max.html.\n* LayoutTests/accessibility/radio-button-checkbox-size-expected.txt: Renamed from LayoutTests/accessibility/mac/radio-button-checkbox-size-expected.txt.\n* LayoutTests/accessibility/radio-button-checkbox-size.html: Renamed from LayoutTests/accessibility/mac/radio-button-checkbox-size.html.\n* LayoutTests/accessibility/range-from-webarea-expected.txt: Renamed from LayoutTests/accessibility/mac/range-from-webarea-expected.txt.\n* LayoutTests/accessibility/range-from-webarea.html: Renamed from LayoutTests/accessibility/mac/range-from-webarea.html.\n* LayoutTests/accessibility/replace-text-with-empty-range-expected.txt: Renamed from LayoutTests/accessibility/mac/replace-text-with-empty-range-expected.txt.\n* LayoutTests/accessibility/replace-text-with-empty-range.html: Renamed from LayoutTests/accessibility/mac/replace-text-with-empty-range.html.\n* LayoutTests/accessibility/replace-text-with-range-expected.txt: Renamed from LayoutTests/accessibility/mac/replace-text-with-range-expected.txt.\n* LayoutTests/accessibility/replace-text-with-range-on-webarea-element-expected.txt: Renamed from LayoutTests/accessibility/mac/replace-text-with-range-on-webarea-element-expected.txt.\n* LayoutTests/accessibility/replace-text-with-range-on-webarea-element.html: Renamed from LayoutTests/accessibility/mac/replace-text-with-range-on-webarea-element.html.\n* LayoutTests/accessibility/replace-text-with-range.html: Renamed from LayoutTests/accessibility/mac/replace-text-with-range.html.\n* LayoutTests/accessibility/search-predicate-visited-links-expected.txt: Renamed from LayoutTests/accessibility/mac/search-predicate-visited-links-expected.txt.\n* LayoutTests/accessibility/search-predicate-visited-links.html: Renamed from LayoutTests/accessibility/mac/search-predicate-visited-links.html.\n* LayoutTests/accessibility/shadow-dom/reference-target/aria-controls-expected.txt: Renamed from LayoutTests/accessibility/shadow-dom/reference-target/mac/aria-controls-expected.txt.\n* LayoutTests/accessibility/shadow-dom/reference-target/aria-controls.html: Renamed from LayoutTests/accessibility/shadow-dom/reference-target/mac/aria-controls.html.\n* LayoutTests/accessibility/shadow-dom/reference-target/aria-describedby-expected.txt: Renamed from LayoutTests/accessibility/shadow-dom/reference-target/mac/aria-describedby-expected.txt.\n* LayoutTests/accessibility/shadow-dom/reference-target/aria-describedby.html: Renamed from LayoutTests/accessibility/shadow-dom/reference-target/mac/aria-describedby.html.\n* LayoutTests/accessibility/stitched-text-marker-range-for-ui-element-expected.txt: Renamed from LayoutTests/accessibility/mac/stitched-text-marker-range-for-ui-element-expected.txt.\n* LayoutTests/accessibility/stitched-text-marker-range-for-ui-element.html: Renamed from LayoutTests/accessibility/mac/stitched-text-marker-range-for-ui-element.html.\n* LayoutTests/accessibility/string-range-contains-listmarker-expected.txt: Renamed from LayoutTests/accessibility/mac/string-range-contains-listmarker-expected.txt.\n* LayoutTests/accessibility/string-range-contains-listmarker.html: Renamed from LayoutTests/accessibility/mac/string-range-contains-listmarker.html.\n* LayoutTests/accessibility/submit-button-default-value-expected.txt: Renamed from LayoutTests/accessibility/mac/submit-button-default-value-expected.txt.\n* LayoutTests/accessibility/submit-button-default-value.html: Renamed from LayoutTests/accessibility/mac/submit-button-default-value.html.\n* LayoutTests/accessibility/svg-duplicated-expected.txt: Renamed from LayoutTests/accessibility/mac/svg-duplicated-expected.txt.\n* LayoutTests/accessibility/svg-duplicated.html: Renamed from LayoutTests/accessibility/mac/svg-duplicated.html.\n* LayoutTests/accessibility/text-marker-emitted-newlines-expected.txt: Renamed from LayoutTests/accessibility/mac/text-marker-emitted-newlines-expected.txt.\n* LayoutTests/accessibility/text-marker-emitted-newlines.html: Renamed from LayoutTests/accessibility/mac/text-marker-emitted-newlines.html.\n* LayoutTests/accessibility/text-marker-length-expected.txt: Renamed from LayoutTests/accessibility/mac/text-marker-length-expected.txt.\n* LayoutTests/accessibility/text-marker-length.html: Renamed from LayoutTests/accessibility/mac/text-marker-length.html.\n* LayoutTests/accessibility/text-marker-string-excludes-generated-content-expected.txt: Renamed from LayoutTests/accessibility/mac/text-marker-string-excludes-generated-content-expected.txt.\n* LayoutTests/accessibility/text-marker-string-excludes-generated-content.html: Renamed from LayoutTests/accessibility/mac/text-marker-string-excludes-generated-content.html.\n* LayoutTests/accessibility/text-markers-for-input-with-placeholder-expected.txt: Renamed from LayoutTests/accessibility/mac/text-markers-for-input-with-placeholder-expected.txt.\n* LayoutTests/accessibility/text-markers-for-input-with-placeholder.html: Renamed from LayoutTests/accessibility/mac/text-markers-for-input-with-placeholder.html.\n* LayoutTests/accessibility/updating-attribute-in-table-row-crash-expected.txt: Renamed from LayoutTests/accessibility/mac/updating-attribute-in-table-row-crash-expected.txt.\n* LayoutTests/accessibility/updating-attribute-in-table-row-crash.html: Renamed from LayoutTests/accessibility/mac/updating-attribute-in-table-row-crash.html.\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n* LayoutTests/platform/mac/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319654@main",
      "email": "tyler_w@apple.com",
      "hash": "6a2b412d19043efdff526685ff7b5cb8c083a36f",
      "subject": "AX: Hundreds of accessibility layout tests pass on iOS, but are not enabled, and thus do not run by default"
    },
    "319655@main": {
      "author": "lilly",
      "avatar": "https://www.gravatar.com/avatar/d0533d52eeb271270df480f37629a407?d=identicon\u0026s=64",
      "cl": "319655@main",
      "clUrl": "https://commits.webkit.org/319655@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322210\nrdar://185447602\n\nReviewed by Simon Fraser.\n\nThread the reference box's corner curvatures through MotionPathData so the\n\u003ccoord-box\u003e path can be built from the corner-shape contour, falling back\nto the rounded rect when every corner is round.\n\n* Source/WebCore/platform/animation/values/paths/AcceleratedEffectBoxPath.cpp:\n(WebCore::tryPath):\n* Source/WebCore/platform/graphics/CornerShapeUtilities.cpp:\n(WebCore::borderContourPath):\n* Source/WebCore/platform/graphics/CornerShapeUtilities.h:\n* Source/WebCore/rendering/BorderShape.cpp:\n(WebCore::BorderShape::pathForShapedRect):\n* Source/WebCore/rendering/BorderShape.h:\n* Source/WebCore/rendering/MotionPath.cpp:\n(WebCore::MotionPath::motionPathDataForRenderer):\n* Source/WebCore/rendering/MotionPath.h:\n* Source/WebCore/rendering/PathOperation.cpp:\n(WebCore::BoxPathOperation::getPath const):\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-offset-path-coord-box-001-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-offset-path-coord-box-001-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-offset-path-coord-box-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-offset-path-coord-box-002-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-offset-path-coord-box-002-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-offset-path-coord-box-002.html: Added.\n\nCanonical link: https://commits.webkit.org/319655@main",
      "email": "173393835+cupidsity@users.noreply.github.com",
      "hash": "5278e92549a1635a7387a4cd9566b2d2af211e11",
      "subject": "corner-shape: offset-path does not respect corner-shape"
    },
    "319656@main": {
      "author": "Dawn Morningstar",
      "avatar": "https://www.gravatar.com/avatar/9b791f3f02553608941e76bb5eecd471?d=identicon\u0026s=64",
      "cl": "319656@main",
      "clUrl": "https://commits.webkit.org/319656@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322243\nrdar://185473232\n\nReviewed by David Kilzer.\n\nlaunchd_sim reads its config when it starts, so if a port wants something in\nplace for the boot itself it has to be written before we boot the device.\nThis allows for a port to supply something for the boot.\n\n* Tools/Scripts/webkitpy/xcode/simulated_device.py:\n(SimulatedDeviceManager):\n(SimulatedDeviceManager._configure_launchd_before_booting):\n(SimulatedDeviceManager._boot_device):\n* Tools/Scripts/webkitpy/xcode/simulated_device_unittest.py:\n(FakeDevice):\n(FakeAdditions):\n(FakeAdditions.__init__):\n(FakeAdditions.launchd_configuration):\n(setUp):\n(tearDown):\n(_run_with):\n(_path):\n(test_configuration_is_written_before_boot):\n(test_every_named_file_is_written):\n(test_nothing_written_without_apple_additions):\n(test_nothing_written_when_no_configuration_is_given):\n(test_existing_keys_are_kept):\n(test_unreadable_file_is_replaced_rather_than_raising):\n(test_failure_to_write_is_not_fatal):\n(test_failure_to_write_is_not_fatal.refuse):\n\nCanonical link: https://commits.webkit.org/319656@main",
      "email": "morningstar@apple.com",
      "hash": "e7ffac0f4edddadd2999733b109277919ae9bab9",
      "subject": "[webkitpy] Support pre-boot launchd configuration for simulated devices"
    },
    "319657@main": {
      "author": "Zak Ridouh",
      "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64",
      "cl": "319657@main",
      "clUrl": "https://commits.webkit.org/319657@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=319704\u003e\n\u003crdar://177161065\u003e\n\nReviewed by Alan Baradlay.\n\nField MTE reports show a use-after-free destroying InlineDisplay::Content during\nLineLayout::layout()'s clearInlineContent(): a display box's CheckedPtr\u003cLayout::Box\u003e\nstill references a Layout::Box that was already freed.\n\nPartial inline layout keeps the previous display content alive so the newly-built\nlines can be spliced into it, relying on InlineDamage::m_detachedLayoutBoxes to keep\nremoved layout boxes alive across the merge. When handlePartialDisplayContentUpdate\ncannot compute a valid damaged range, it returned early through ASSERT_NOT_REACHED()\nand left the previous display content untouched. The caller then destroys the\nInlineDamage (m_lineDamage = { }), freeing the detached layout boxes while the display\nboxes still reference them; the next clearInlineContent() touches freed memory.\n\nDrop the previous display content on that fallback path (after collecting its ink\noverflow for repaint) so we never carry stale CheckedPtr\u003cLayout::Box\u003e references past\nthe point their target is released. This hardens an ASSERT_NOT_REACHED() branch and\ndoes not change behavior on the fast path.\n\n* Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.cpp:\n(WebCore::LayoutIntegration::InlineContentBuilder::handlePartialDisplayContentUpdate const):\n* LayoutTests/fast/block/inside-inlines/block-in-inline-partial-relayout-crash.html: Added.\n* LayoutTests/fast/block/inside-inlines/block-in-inline-partial-relayout-crash-expected.txt: Added.\n\nOriginally-landed-as: 305413.1123@safari-7624.5-branch (039ba968916b). rdar://185369077\nCanonical link: https://commits.webkit.org/319657@main",
      "email": "zakr@apple.com",
      "hash": "884e3169771bfde0f93c3bc3ed12c55144d5cd04",
      "subject": "[IFC] Do not leave stale display content when partial merge fails in InlineContentBuilder"
    },
    "319658@main": {
      "author": "Jean-Yves Avenard",
      "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64",
      "cl": "319658@main",
      "clUrl": "https://commits.webkit.org/319658@main",
      "description": "rdar://177930032\n\nReviewed by Youenn Fablet.\n\nMake AudioParam use thread-safe refcounted.\n\nTest: webaudio/AudioParam/audioparam-cross-thread-ref-deref-crash.html\n\n* LayoutTests/webaudio/AudioParam/audioparam-cross-thread-ref-deref-crash-expected.txt: Added.\n* LayoutTests/webaudio/AudioParam/audioparam-cross-thread-ref-deref-crash.html: Added.\n* Source/WebCore/Modules/webaudio/AudioParam.h:\n\nOriginally-landed-as: 305413.1077@safari-7624.5-branch (62fcbfe61a49). rdar://185368484\nCanonical link: https://commits.webkit.org/319658@main",
      "email": "jya@apple.com",
      "hash": "3e5b31e006359db053de870eaacfede629f49c64",
      "subject": "use-after-free of AudioParam via cross-thread non-atomic ref/deref in AudioNodeOutput::disconnectAllParams()"
    },
    "319659@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "319659@main",
      "clUrl": "https://commits.webkit.org/319659@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322348\nrdar://185619817\n\nReviewed by Zak Ridouh.\n\nThe CMake build requires `JSC::SymbolTableEntry::inflate` to be `JS_EXPORT_PRIVATE` since it uses\n`-fpch-codegen` which hoists inline function bodies out of the PCH into the PCH's own object file\nas strong external definitions.\n\n* Source/JavaScriptCore/runtime/SymbolTable.h:\n\nCanonical link: https://commits.webkit.org/319659@main",
      "email": "richard_robinson2@apple.com",
      "hash": "0f924849f534426b33d9b81e64365ab85597626d",
      "subject": "[CMake] Fix the CMake build after 319646@main"
    },
    "319660@main": {
      "author": "Carlos Garcia Campos",
      "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64",
      "cl": "319660@main",
      "clUrl": "https://commits.webkit.org/319660@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322349\n\nReviewed by Nikolas Zimmermann.\n\nThe SkSurface created by an accelerated ImageBuffer is expected to be\nreleased in the same thread it was created so that GL resources are\nfreed by the right GrContext. For accelerated ImageBuffer we take an\nimage snapshot and save all ImageBuffer parameters required to create\na new one in the destination thread to copy the image snapshot into.\n\n* Source/WebCore/platform/graphics/skia/SkiaSerializedImageBuffer.cpp:\n(WebCore::SkiaSerializedImageBuffer::SkiaSerializedImageBuffer):\n(WebCore::SkiaSerializedImageBuffer::sinkIntoImageBuffer):\n(WebCore::SkiaSerializedImageBuffer::memoryCost const):\n* Source/WebCore/platform/graphics/skia/SkiaSerializedImageBuffer.h:\n\nCanonical link: https://commits.webkit.org/319660@main",
      "email": "cgarcia@igalia.com",
      "hash": "1feb6ac19b06a18bee095b204f70551cb22eff3b",
      "subject": "[Skia] Do not transfer accelerated ImageBuffer to a different thread"
    },
    "319661@main": {
      "author": "lilly",
      "avatar": "https://www.gravatar.com/avatar/d0533d52eeb271270df480f37629a407?d=identicon\u0026s=64",
      "cl": "319661@main",
      "clUrl": "https://commits.webkit.org/319661@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322282\nrdar://185519894\n\nReviewed by Simon Fraser.\n\nAdopts https://github.com/web-platform-tests/wpt/pull/61696\n\nPasses existing tests\n\n* Source/WebCore/platform/graphics/BezierUtilities.cpp:\n(WebCore::resampleByArcLength): Deleted.\n(WebCore::hermiteInterpolate): Deleted.\n(WebCore::addCatmullRomBeziers): Deleted.\n* Source/WebCore/platform/graphics/BezierUtilities.h:\n* Source/WebCore/platform/graphics/CornerShapeUtilities.cpp:\n(WebCore::borderContourPath):\n* Source/WebCore/platform/graphics/CornerShapeUtilities.h:\n* Source/WebCore/platform/graphics/GeometryUtilities.cpp:\n(WebCore::findLineIntersection):\n(WebCore::crossProduct): Deleted.\n* Source/WebCore/platform/graphics/GeometryUtilities.h:\n* Source/WebCore/rendering/BorderShape.cpp:\n(WebCore::addAlignedToCurveOffsetContour):\n* Source/WebCore/platform/graphics/FloatPoint.h:\n(WebCore::FloatPoint::cross const):\n* Source/WebCore/platform/graphics/FloatSize.h:\n(WebCore::FloatSize::cross const):\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-bevel-round-scoop-square-outset-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-bevel-round-scoop-square-outset-ref.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-box-shadow-spread-elliptical.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-notch-squircle-outset-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-notch-squircle-outset-ref.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-outline-offset-elliptical.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-concave-outset-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-concave-outset-ref.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-concave.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-convex-outset-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-convex-outset-ref.html:\n* LayoutTests/fast/scrolling/corner-shape-nested-clips-overflow-scroll.html:\n* LayoutTests/fast/scrolling/corner-shape-overflow-scroll-uneven-radii.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-scoop.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-superellipse-scoop.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/render-corner-shape.html:\n\nCanonical link: https://commits.webkit.org/319661@main",
      "email": "173393835+cupidsity@users.noreply.github.com",
      "hash": "53e6dc79c7d38591f39d70fecb9938d4fa0678a1",
      "subject": "corner-shape: algorithm for outset curves needs to be updated to match new algorithm"
    },
    "319662@main": {
      "author": "Antti Koivisto",
      "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64",
      "cl": "319662@main",
      "clUrl": "https://commits.webkit.org/319662@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321846\nrdar://184994906\n\nReviewed by Alan Baradlay.\n\nActive selections fail to visually update if ::selection style changes. The repaint code compares\nthe highlight pseudo-element styles cached in the parent ComputedStyle, and ::selection was still\nresolving without caching, so there was never a previous style to compare against.\n\n* LayoutTests/fast/repaint/highlight-pseudo-rule-change-expected.txt:\n* LayoutTests/fast/repaint/highlight-pseudo-rule-change.html:\n\nThe ::selection case passes now.\n\n* Source/WebCore/rendering/RenderElement.cpp:\n(WebCore::RenderElement::selectionPseudoStyle const):\n\nUse textSegmentPseudoStyle(), which already does this with lazyPseudoElementStyle(). It was an\nexact copy of what selectionPseudoStyle() was doing, minus the caching.\n\n* Source/WebCore/rendering/RenderElement.h:\n* Source/WebCore/rendering/RenderText.h:\n(WebCore::RenderText::selectionPseudoStyle const):\n\n* Source/WebCore/rendering/StyledMarkedText.cpp:\n(WebCore::resolveStyleForMarkedText):\n* Source/WebCore/rendering/TextBoxPainter.cpp:\n(WebCore::TextBoxPainter::paintForegroundAndDecorations):\n* Source/WebCore/rendering/TextPaintStyle.cpp:\n(WebCore::computeTextSelectionPaintStyle):\n\nThe returned style is now owned by the parent ComputedStyle rather than the caller, so the locals\nneed to be CheckedPtr.\n\nCanonical link: https://commits.webkit.org/319662@main",
      "email": "antti@apple.com",
      "hash": "5dd82e774cf8a2ead554aa962a73e855606b1d4c",
      "subject": "::selection fails to repaint on style change"
    },
    "319663@main": {
      "author": "Nikolas Zimmermann",
      "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64",
      "cl": "319663@main",
      "clUrl": "https://commits.webkit.org/319663@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322357\n\nReviewed by Patrick Griffis.\n\nCreating the renderer for \u003csvg:filter\u003e fires an assertion:\n\nASSERTION FAILED: SVGElement::isResourceContainerTagName(element.tagQName())\nSource/WebCore/rendering/svg/RenderSVGResourceContainer.cpp(47)\n...\n\nA tag can be written with a namespace prefix, as in \u003csvg:filter\u003e. Two\nQualifiedNames are only equal when their prefixes match as well, so\n\u003csvg:filter\u003e is not equal to SVGNames::filterTag. isResourceContainerTagName()\nlooked up the whole tag in a HashSet\u003cQualifiedName\u003e and thus missed every\nprefixed resource container. Element::hasTagName() gets this right by calling\nQualifiedName::matches(), which compares the local name and the namespace and\nignores the prefix.\n\nFix debug assertions in svg/dynamic-updates - covered by existing tests.\n\n* Source/WebCore/svg/SVGElement.cpp:\n(WebCore::SVGElement::isResourceContainerTagName):\n\nCanonical link: https://commits.webkit.org/319663@main",
      "email": "nzimmermann@igalia.com",
      "hash": "df06a95a287e3dd4e525ea60934a433e2ccba9fa",
      "subject": "[LBSE] Assertion failure for SVG resource containers with a namespace prefix"
    },
    "319664@main": {
      "author": "Dan Hecht",
      "avatar": "https://www.gravatar.com/avatar/080f47d912b1b34d0be8293f825d132d?d=identicon\u0026s=64",
      "cl": "319664@main",
      "clUrl": "https://commits.webkit.org/319664@main",
      "description": "rdar://178657225\nhttps://bugs.webkit.org/show_bug.cgi?id=316791\n\nReviewed by Yijia Huang.\n\nSimilar to throw/rethrow patchpoints, a Wasm OMG call patchpoint inside\na Try block carries an exception-restoration stackmap keyed by its CallSiteIndex,\nso it should not be cloned. If B3 Select specialization (or B3DuplicateTails)\nduplicates them, that leaves two call sites sharing one stackmap even with\npotentially differing live-value layouts.\n\nExtend 266643@main to also mark call patchpoints cloningForbidden when\nm_tryCatchDepth != 0, and make specializeSelect() bail when a\ncloning-forbidden value is in the range it would clone.\n\nTest: JSTests/wasm/stress/omg-reduce-strength-select-exception-stackmap.js\n\nOriginally-landed-as: 305413.972@safari-7624.5-branch (db24355101bd). rdar://185368817\nCanonical link: https://commits.webkit.org/319664@main",
      "email": "dan.hecht@apple.com",
      "hash": "9f07374e9eb2398ebf629352f5fc0a509ae631b8",
      "subject": "[JSC] Do not clone patchpoints for Wasm calls within a try block"
    },
    "319665@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "319665@main",
      "clUrl": "https://commits.webkit.org/319665@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322298\n\u003crdar://problem/185536955\u003e\n\nReviewed by Antti Koivisto.\n\nalign-content distributes a block container's extra space by moving its content. shiftForAlignContent moves\nevery child box and FloatingObjects::shiftFloatsBy then moves the float renderers again, so a float that is a\nchild of the container travels twice as far as the content it sits with.\n\nA float taken from a child's float list moves twice as well: the child moves with the rest of the content and\nshiftFloatsBy then moves the float's renderer, which belongs to that child. Only the FloatingObject's frame\nrect needs the shift there, since that rect is in this container's coordinate space.\n\n* Source/WebCore/rendering/FloatingObjects.cpp:\n(WebCore::FloatingObjects::shiftFloatsBy):\n* Source/WebCore/rendering/RenderBlockFlow.cpp:\n(WebCore::RenderBlockFlow::shiftForAlignContent):\n* LayoutTests/imported/w3c/web-platform-tests/css/css-align/blocks/align-content-block-float-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-align/blocks/align-content-block-float-001-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-align/blocks/align-content-block-004-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-align/blocks/align-content-block-005-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-align/blocks/align-content-block-006-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-align/blocks/align-content-block-007-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-align/blocks/align-content-block-008-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-align/blocks/align-content-block-009-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-align/blocks/align-content-block-010-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-align/blocks/align-content-block-011-expected.txt:\n* Source/WebCore/rendering/FloatingObjects.h:\n\nCanonical link: https://commits.webkit.org/319665@main",
      "email": "zalan@apple.com",
      "hash": "8c4fd56347648a238656e54d696b308dca674fe8",
      "subject": "[block] align-content moves a float child twice"
    },
    "319666@main": {
      "author": "Phinehas Fuachie",
      "avatar": "https://www.gravatar.com/avatar/900d85de8c325e38975f39115c36bb75?d=identicon\u0026s=64",
      "cl": "319666@main",
      "clUrl": "https://commits.webkit.org/319666@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315989\nrdar://175673159\n\nReviewed by Chris Dumez.\n\nHTMLMediaElement::clearMediaPlayer() resets m_player on the main thread without holding\nm_audioSourceNode-\u003eprocessLock(), but the audio render thread reads m_player via\naudioSourceProvider() inside MediaElementAudioSourceNode::process() while holding that lock.\nBecause audioSourceProvider() returns a raw AudioSourceProvider* and drops its local\nRefPtr\u003cMediaPlayer\u003e on return, and MediaPlayer is DestructionThread::Main, the main thread can\nsynchronously run ~MediaPlayer (destroying the RemoteAudioSourceProvider) while the render thread\nis still inside provideInput() with the now-dangling pointer.\n\nThis is reachable from HTMLMediaElement::stop() (ActiveDOMObject stop on iframe detach) and\nuserCancelledLoad().\n\nMatch the contract already enforced by createMediaPlayer() and\nmediaPlayerWill/DidInitializeMediaEngine() by holding the audio node's processLock around\nplayer-\u003einvalidate() / m_player = nullptr in clearMediaPlayer(). process() acquires the same lock\nwith tryLock(), so this cannot deadlock — the render thread will simply zero its output for one\nquantum while the main thread tears down.\n\nTest: webaudio/mediaelementsource-clear-detached-frame.html\n\n* LayoutTests/webaudio/mediaelementsource-clear-detached-frame-expected.txt: Added.\n* LayoutTests/webaudio/mediaelementsource-clear-detached-frame.html: Added.\n* LayoutTests/webaudio/resources/mediaelementsource-clear-detached-frame-iframe.html: Added.\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::clearMediaPlayer): Deleted.\n\nOriginally-landed-as: 305413.1065@safari-7624.5-branch (e186258f7967). rdar://185367736\nCanonical link: https://commits.webkit.org/319666@main",
      "email": "pfuachie2@apple.com",
      "hash": "55d9d9007f54ee61fa38accb59cd88a8d4075847",
      "subject": "Use-after-free in MediaElementAudioSourceNode::provideInput when iframe is detached"
    },
    "319667@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "319667@main",
      "clUrl": "https://commits.webkit.org/319667@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=315533\u003e\n\u003crdar://177889453\u003e\n\nReviewed by Simon Fraser.\n\n`RemoteLayerTreeEventDispatcher::scheduleDelayedRenderingUpdateDetectionTimer()`\nlazily creates `m_delayedRenderingUpdateDetectionTimer` on the\nscrolling thread, against the scrolling thread's run loop.  When\nthe owning page is closed,\n`RemoteScrollingCoordinatorProxyMac::~RemoteScrollingCoordinatorProxyMac()`\nruns on the main thread, calls\n`RemoteLayerTreeEventDispatcher::invalidate()`, and then drops the\nlast reference, destroying the dispatcher (and the timer) on the\nmain thread.\n\n`CFRunLoopTimerInvalidate()` called from `~TimerBase()` on the main\nthread does not synchronize with a CFRunLoopTimer callback that the\nscrolling thread's run loop has already begun dispatching, so the\ncallback can read the freed `TimerBase` via its raw context\npointer.  ASan reports this as a heap-use-after-free in\n`RunLoop::TimerBase::start()::$_0::__invoke` on the scrolling\nthread.\n\nFix by destroying `m_delayedRenderingUpdateDetectionTimer` on the\nscrolling thread from `invalidate()`, holding a strong reference to\nthe dispatcher across the dispatch so it outlives the timer.\nBecause the dispatch and the timer callback both run serially on\nthe scrolling thread's run loop, the timer is either destroyed\nbefore the callback fires, or after the callback has returned.\nThis mirrors the equivalent fix in\n`ThreadedScrollingTree::invalidate()` (225114@main).\n\nThe dispatch is performed after `m_scrollingTree` has been cleared\nso any in-flight or subsequently queued `didRefreshDisplay()`\nreturns early and cannot recreate the timer.\n\nAlso reorder the ASSERTs in `~RemoteLayerTreeEventDispatcher` to\nmatch the declaration order of the asserted members.\n\nTest: fast/scrolling/mac/event-dispatcher-timer-close-crash.html\n\n* LayoutTests/fast/scrolling/mac/event-dispatcher-timer-close-crash-expected.txt: Add.\n* LayoutTests/fast/scrolling/mac/event-dispatcher-timer-close-crash.html: Add.\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.mm:\n(WebKit::RemoteLayerTreeEventDispatcher::~RemoteLayerTreeEventDispatcher):\n(WebKit::RemoteLayerTreeEventDispatcher::invalidate):\n\nOriginally-landed-as: 305413.1021@safari-7624.5-branch (fb7f8555bdf0). rdar://185368389\nCanonical link: https://commits.webkit.org/319667@main",
      "email": "ddkilzer@apple.com",
      "hash": "2df698f59386b2ffccd45c7ef28422b69eba8c44",
      "subject": "Heap-use-after-free of RemoteLayerTreeEventDispatcher's RunLoop::Timer on the scrolling thread"
    }
  },
  "date": "2026-08-23",
  "days": 1,
  "generatedAt": "2026-08-23T22:05:24Z",
  "markdown": "## Highlights\n- **Security** Fixed a heap use-after-free in RemoteLayerTreeEventDispatcher's scrolling-thread timer, closing a crashable lifetime bug in remote layer tree event handling. [commit 319667@main](https://commits.webkit.org/319667@main)\n- **Security** Fixed a use-after-free when MediaElementAudioSourceNode keeps pulling audio after an iframe is detached, hardening Web Audio against document teardown races. [commit 319666@main](https://commits.webkit.org/319666@main)\n- **Security** Removed a cross-thread non-atomic ref/deref path that could free AudioParam during disconnectAllParams(), tightening Web Audio lifetime safety. [commit 319658@main](https://commits.webkit.org/319658@main)\n- **Security** Fixed a memory underflow in PlatformRawAudioData::copyTo(), closing a low-level audio buffer safety bug. [commit 314451@main](https://commits.webkit.org/314451@main)\n- **Rendering** Fixed ::selection failing to repaint after style changes, restoring correct visual updates for edited and dynamic content. [commit 319662@main](https://commits.webkit.org/319662@main)\n- **Web Platform** Updated corner-shape outset curve behavior to match the revised algorithm, improving spec alignment for advanced CSS corners. [commit 319661@main](https://commits.webkit.org/319661@main)\n- **Web Platform** Fixed offset-path to respect corner-shape, making motion layout and shaped corners agree in CSS rendering. [commit 319655@main](https://commits.webkit.org/319655@main)\n- **V8** Stopped cloning patchpoints for Wasm calls inside try blocks in JSC, reducing risk around exception-sensitive Wasm code generation. [commit 319664@main](https://commits.webkit.org/319664@main)\n- **A11y** Enabled a large backlog of iOS accessibility layout tests so they run by default, raising coverage where many passing tests were previously inert. [commit 319654@main](https://commits.webkit.org/319654@main)\n\n## What landed by area\n\n### Audio and Media\n- **Security** Fixed a use-after-free in MediaElementAudioSourceNode::provideInput triggered when an iframe is detached during audio processing. [commit 319666@main](https://commits.webkit.org/319666@main)\n- **Security** Fixed a cross-thread AudioParam lifetime bug in AudioNodeOutput::disconnectAllParams() caused by non-atomic ref and deref. [commit 319658@main](https://commits.webkit.org/319658@main)\n- **Security** Fixed a memory underflow in PlatformRawAudioData::copyTo(), hardening raw audio buffer copying. [commit 314451@main](https://commits.webkit.org/314451@main)\n\n### Rendering and Layout\n- **Rendering** Fixed a block layout bug where align-content could move a float child twice. [commit 319665@main](https://commits.webkit.org/319665@main)\n- **Rendering** Fixed stale display content surviving a failed partial merge in InlineContentBuilder under IFC. [commit 319657@main](https://commits.webkit.org/319657@main)\n- **Rendering** Fixed ::selection not repainting when styles change, so selection visuals now stay in sync with dynamic styling. [commit 319662@main](https://commits.webkit.org/319662@main)\n- **Rendering** Fixed an assertion failure in LBSE for SVG resource containers that use a namespace prefix. [commit 319663@main](https://commits.webkit.org/319663@main)\n\n### CSS and Web Platform\n- **Web Platform** Updated the corner-shape algorithm for outset curves to match the new spec behavior. [commit 319661@main](https://commits.webkit.org/319661@main)\n- **Web Platform** Fixed offset-path so it respects corner-shape instead of ignoring shaped corners during path layout. [commit 319655@main](https://commits.webkit.org/319655@main)\n\n### JavaScriptCore and Wasm\n- **V8** Adjusted JSC Wasm code generation to avoid cloning patchpoints for calls inside try blocks. [commit 319664@main](https://commits.webkit.org/319664@main)\n\n### Graphics, Layers, and Threading\n- **Security** Fixed a heap use-after-free involving RemoteLayerTreeEventDispatcher's RunLoop::Timer on the scrolling thread. [commit 319667@main](https://commits.webkit.org/319667@main)\n- **GPU** Prevented Skia accelerated ImageBuffer instances from being transferred across threads, avoiding unsafe ownership handoff. [commit 319660@main](https://commits.webkit.org/319660@main)\n\n### Accessibility\n- **A11y** Enabled hundreds of already-passing iOS accessibility layout tests so they run by default in coverage. [commit 319654@main](https://commits.webkit.org/319654@main)\n\n### Tooling, Testing, and Build\n- **Build** Fixed the CMake build after a recent regression. [commit 319659@main](https://commits.webkit.org/319659@main)\n- **Mobile** Added webkitpy support for pre-boot launchd configuration on simulated devices. [commit 319656@main](https://commits.webkit.org/319656@main)\n- **Build** Fixed a regression in webkitpy.test.runner_unittest.RunnerTest.test_run_expected_failures. [commit 319653@main](https://commits.webkit.org/319653@main)\n- **Build** Fixed expected-failure and unexpected-success handling in webkitpy and webkitcorepy test infrastructure. [commit 319652@main](https://commits.webkit.org/319652@main)",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [],
  "since": "2026-08-23",
  "totals": {
    "commits": 17,
    "features": 17,
    "rolls": 0
  },
  "until": "2026-08-23"
}