{ "commits": { "319668@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "319668@main", "clUrl": "https://commits.webkit.org/319668@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322292\n\u003crdar://problem/185534759\u003e\n\nReviewed by Antti Koivisto.\n\nThese call sites checked whether a document had a render tree when what they meant was whether it can ever render, which is what separates a\ndocument in a page from one made by DOMParser or held by a template. The spec calls that fully active, and its \"Updating the image data\"\nalgorithm names it directly. A non-rendered placeholder is fully active yet never gets a render tree, so Document::canEverRender() asks\nboth.\n\nhttps://html.spec.whatwg.org/multipage/images.html#updating-the-image-data\n\nTest: imported/w3c/web-platform-tests/css/cssom/stylesheets-in-non-rendered-document.html\n\n* Source/WebCore/dom/Document.h:\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::canEverRender const):\n* Source/WebCore/dom/Node.cpp:\n(WebCore::Node::computeEditabilityWithStyle const):\n* Source/WebCore/loader/FrameLoader.cpp:\n(WebCore::FrameLoader::clear):\n* Source/WebCore/loader/HistoryController.cpp:\n(WebCore::HistoryController::saveDocumentState):\n* Source/WebCore/loader/ImageLoader.cpp:\n(WebCore::ImageLoader::updateFromElement):\n(WebCore::ImageLoader::dispatchPendingBeforeLoadEvent):\n(WebCore::ImageLoader::dispatchPendingLoadEvent):\n(WebCore::ImageLoader::dispatchPendingErrorEvent):\n* Source/WebCore/style/StyleScope.cpp:\n(WebCore::Style::Scope::updateActiveStyleSheets):\n(WebCore::Style::Scope::styleSheetsForStyleSheetList):\n* LayoutTests/imported/w3c/web-platform-tests/css/cssom/stylesheets-in-non-rendered-document.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/cssom/stylesheets-in-non-rendered-document-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/319668@main", "email": "zalan@apple.com", "hash": "5178278df2e968475df523946dd4caf468069d57", "subject": "[cleanup] Ask whether a document is fully active rather than whether it has a render tree" }, "319669@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "319669@main", "clUrl": "https://commits.webkit.org/319669@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319112\nrdar://176792844\n\nReviewed by Mark Lam.\n\nDFG Uint32Array GetByVal may have Int32 result with speculation. But the\ncurrent code is always using boxed-double for boxed result. We should\nuse boxed-int32 when this speculation is set. The same thing is already\ndone in FTL.\n\nTest: JSTests/stress/uint32-array-result-int32-dfg.js\n\n* JSTests/stress/uint32-array-result-int32-dfg.js: Added.\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n(JSC::DFG::SpeculativeJIT::setIntTypedArrayLoadResult):\n\nOriginally-landed-as: 305413.1114@safari-7624.5-branch (2bc65ac3560e). rdar://185368553\nCanonical link: https://commits.webkit.org/319669@main", "email": "ysuzuki@apple.com", "hash": "8283d4f1273add66f659b203baaae8e56c4fc3f2", "subject": "[JSC] DFG Uint32Array load should consider about Int32 speculation path" }, "319670@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "319670@main", "clUrl": "https://commits.webkit.org/319670@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322288\nrdar://185524314\n\nReviewed by Gerald Squelart.\n\ncanDrawText() rejects text draws whose paint is a zero-size gradient, but which\ngradient matters depends on whether the caller is filling or stroking. The check\nwas written as two unconditional RefPtr assignments with the fill/stroke test\nfolded into each if-condition, so every fillText() and strokeText() call queried\nboth GraphicsContext::strokeGradient() and GraphicsContext::fillGradient() and\npaid a ref/deref pair for each - both accessors return a raw Gradient*, so the\nRefPtr construction is a real refcount round trip - when by construction one of\nthe two results is discarded unused.\n\nSelect the gradient with the fill flag first and take a single reference. No\nbehavior change: filling still consults only the fill gradient and stroking only\nthe stroke gradient.\n\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:\n(WebCore::CanvasRenderingContext2DBase::canDrawText):\n\nCanonical link: https://commits.webkit.org/319670@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "69387ce22018858ece19528bd2b8255e5ae0db32", "subject": "canDrawText() refs both the fill and stroke gradient when only one is used" }, "319671@main": { "author": "Richard Robinson", "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64", "cl": "319671@main", "clUrl": "https://commits.webkit.org/319671@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322360\nrdar://185646930\n\nReviewed by Abrar Rahman Protyasha.\n\nJust a small refactoring to make things a bit simpler.\n\nThis will also help for future Swift-Cxx interop changes now that the completion handler is 1-arity.\n\n* Source/WebKit/Scripts/webkit/messages.py:\n(headers_for_type):\n* Source/WebKit/Shared/Cocoa/GestureTypes.h:\n* Source/WebKit/Shared/Cocoa/GestureTypes.serialization.in:\n* Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm:\n(WebKit::WebPageProxy::selectWithGesture):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.swift:\n* Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm:\n(-[WKContentView changeSelectionWithGestureAt:withGesture:withState:withFlags:]):\n* Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm:\n(WebKit::WebPage::selectWithGesture):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.messages.in:\n\nCanonical link: https://commits.webkit.org/319671@main", "email": "richard_robinson2@apple.com", "hash": "481130961bd0575670ae8fb824890f0da610fa9a", "subject": "Refactor `WebPage{Proxy}::selectWithGesture` to have its result as a struct instead of separate values" }, "319672@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "319672@main", "clUrl": "https://commits.webkit.org/319672@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322261\n\nReviewed by Per Arne Vollan.\n\nNetworkConnectionToWebProcess::checkInWebProcess() runs once per WebContent\nprocess launch and logged the whole Launch Services info dictionary at default\nlevel each time. The dictionary is a copy of the com.apple.WebKit.WebContent.xpc\nInfo.plist plus a few fixed keys, so it is identical for every process; in the\nfield it serializes to 1162 bytes per launch.\n\nWhen WebContent processes launch at a high rate that is enough for\nlibsystem_trace to quarantine the NetworkProcess (\"QUARANTINED DUE TO HIGH\nLOGGING VOLUME\"), after which it stops logging altogether -- precisely when the\nlog is needed.\n\nLog the dictionary once per NetworkProcess instead. Also report the two check-in\nfailure paths as errors, consistent with the existing failure paths in the same\nfunction.\n\n* Source/WebKit/NetworkProcess/mac/NetworkConnectionToWebProcessMac.mm:\n(WebKit::NetworkConnectionToWebProcess::checkInWebProcess):\n\nCanonical link: https://commits.webkit.org/319672@main", "email": "cdumez@apple.com", "hash": "6e03d62f11e65f04577b3acd403b8d3e21b1c4e4", "subject": "Stop logging the Launch Services check-in info dictionary on every WebContent process launch" }, "319673@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "319673@main", "clUrl": "https://commits.webkit.org/319673@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322249\nrdar://185482522\n\nReviewed by Zak Ridouh.\n\nMake --cmake option given to run-safari works.\nCouple of issues with the cmake webkit build that prevented Safari to start:\n- compatibility version returned was 0.0.0 instead of the required 1.0.0\n- Some swift overlays were missing from the cmake files, so some symbols loaded by Safari were missing.\n\nThe macOS Swift module staging target is named WebKit_StageSwiftModuleMac, as the\niOS family section of PlatformCocoa.cmake already defines WebKit_StageSwiftModule.\n\nManually tested with run-safari --release --cmake\n\n* Source/JavaScriptCore/PlatformCocoa.cmake:\n* Source/WebCore/PlatformCocoa.cmake:\n* Source/WebGPU/WebGPU/CMakeLists.txt:\n* Source/WebKit/PlatformCocoa.cmake:\n* Source/WebKitLegacy/PlatformCocoa.cmake:\n* Source/cmake/OptionsCocoa.cmake:\n* Tools/Scripts/webkitdirs.pm:\n(determineArchitecture):\n(argumentsForConfiguration):\n(xcodeConfigurationProductDir): Where Xcode builds for the current configuration; also used by determineConfigurationProductDir so the two can't drift.\n(determineConfigurationProductDir):\n(safariPath):\n(printHelpAndExitForRunAndDebugWebKitAppIfNeeded):\n(prependMacWebKitDyldPaths):\n(setupMacWebKitEnvironment):\n(dyldFrameworkPathsForMacWebKitApp):\n(runMacWebKitApp):\n(execMacWebKitAppForDebugging): Use the same framework path list as runMacWebKitApp, so debug-safari --cmake finds Safari's own frameworks too.\n\nCanonical link: https://commits.webkit.org/319673@main", "email": "jya@apple.com", "hash": "bc9f76805019f00c439c5b5cc4fa197b5fc4cc1a", "subject": "[cmake] Provide ability to run Safari with webkit built by cmake" }, "319674@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "319674@main", "clUrl": "https://commits.webkit.org/319674@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320870\nrdar://184484940\n\nReviewed by Darin Adler.\n\nadjustGrainParameters() placed the initial playhead at the *end* of the grain\nwhen the playback rate was negative, at offset + duration - 1, rather than at\noffset. With no explicit duration, m_grainDuration defaults to the remainder of\nthe buffer, so the playhead always landed on the last frame of the buffer and\nthe caller's offset had no effect at all: start(0, 2 / sampleRate) on an\n8-frame buffer at rate -1 played 8,7,6,5,4,3,2,1 instead of 3,2,1.\n\nThe spec places the playhead at offset regardless of the sign of the rate, then\nclamps it only in the direction playback is heading:\n\n if (loop \u0026\u0026 computedPlaybackRate \u003e= 0 \u0026\u0026 offset \u003e= actualLoopEnd)\n offset = actualLoopEnd;\n if (computedPlaybackRate \u003c 0 \u0026\u0026 loop \u0026\u0026 offset \u003c actualLoopStart)\n offset = actualLoopStart;\n\nhttps://webaudio.github.io/web-audio-api/#playback-AudioBufferSourceNode\n\nBlink already implements exactly this, and this patch brings us in line with it.\nEvery change below matches the structure of Blink's\nAudioBufferSourceHandler::RenderFromBuffer(), which splits the playhead setup\ninto an explicit \"directional playhead setup\" with a forward branch and a\nreverse branch.\n\nrenderFromBuffer() applied only the forward half of the spec's clamping,\nwrapping to loopStart whenever the playhead was at or past virtualMaxFrame. For\na negative rate that is the wrong direction: an offset past loopEnd should\ndescend into the loop from above, not jump to the loop start. The forward wrap\nis now forward-only and the reverse path gets the clamp the spec asks for, the\nsame split Blink makes between its \"Forward Loop Clamping\" and \"Reverse Loop\nClamping\" cases. Because skipping the forward wrap also removes its implicit\nend-of-buffer guard, a reverse playhead starting at or past the end of the\nbuffer now returns false so process() zeroes the output bus instead of leaving\nit partially written.\n\nTwo smaller bugs in the reverse path fell out of the above. The sub-quantum\nstartFrameOffset adjustment advanced the playhead forward for both signs of the\nrate, moving a reverse playhead away from where it was about to read; it now\nsubtracts for a negative rate, as Blink's \"Reverse Start Time Adjustment\" does.\nThe pitchRate == -1 fast path clamped the read index down to loopEnd, which\ndefeats the point of not clamping the offset, and now only bounds it by the\nbuffer length.\n\nThe offset is converted with a new timeToFractionalSampleFrame() helper rather\nthan AudioUtilities::timeToSampleFrame(). The latter rounds to whole frames,\nwhich would quantize away a genuine sub-sample offset; the helper keeps the\nsub-sample position but still snaps values that differ from a whole frame only\nby floating-point round-off, preserving the existing property that playback of a\nwhole-frame offset at |rate| == 1 is a straight copy of the PCM data rather than\nan interpolation. Blink splits these two cases apart instead, rounding only when\nthe rate is exactly 1 and the detune is 0 and multiplying raw otherwise; the\nhelper gets the same result for both without branching on the rate.\n\nThis fixes 3 of the 6 failing subtests in the WPT test: an offset inside the\nloop, an offset past loopEnd, and sub-sample interpolation backwards. The\nremaining 3 are unrelated to the offset handling and stay in the rebaselined\nexpectation. Two are out-of-bounds offsets, which Blink handles with a reverse\nout-of-bounds catch-up loop that renders silence until the playhead descends\ninto the buffer. The third is a negative loopStart, where we implement the\nalgorithm's guard and so fall back to looping the entire buffer, while the test\nasserts the attribute definition's clamp to [0, loopEnd). The spec contradicted\nitself here; the Audio WG resolved in\nhttps://github.com/WebAudio/web-audio-api/issues/2689 to make the algorithm\nclamp the loop points before validating them, which is what Blink already does\nin UpdateEffectiveLoopPoints(). Both are larger changes than the offset fix and\nare left for follow-up.\n\nThe prose describing offset in the spec still states the negative-rate condition\nbackwards, saying an offset *greater* than loopStart is clamped. That is a\ntranscription error, not a second normative rule; the Audio WG resolved to\ncorrect the prose to match the algorithm in\nhttps://github.com/WebAudio/web-audio-api/issues/2690. This patch follows the\nalgorithm, as Blink does.\n\n* LayoutTests/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audiobuffersourcenode-interface/audiobuffersource-playbackrate-negative-expected.txt:\nRebaselined: 3 subtests now pass.\n\n* LayoutTests/webaudio/audiobuffersource-negative-playbackrate.html:\n* LayoutTests/webaudio/audiobuffersource-negative-playbackrate-interpolated.html:\n* LayoutTests/webaudio/audiobuffersource-negative-playbackrate-loop.html:\n* LayoutTests/webaudio/audiobuffersource-negative-playbackrate-interpolated-loop.html:\nThese called start(0) or start(0, loopStart) with a negative rate and depended\non the playhead jumping to the end of the buffer or loop. Under the spec that\nstarts playback at frame 0 or at loopStart, which immediately runs off the front\nand renders silence. Each now passes the explicit offset it relied on\nimplicitly, so they keep testing what they were written to test rather than\nbeing rebaselined to the new output.\n\n* Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp:\n(WebCore::timeToFractionalSampleFrame):\n(WebCore::AudioBufferSourceNode::renderFromBuffer):\n(WebCore::AudioBufferSourceNode::adjustGrainParameters):\n\nCanonical link: https://commits.webkit.org/319674@main", "email": "cdumez@apple.com", "hash": "52e6da77b135861b49039098e00873cf895b9c18", "subject": "AudioBufferSourceNode ignores the start() offset for a negative playbackRate" }, "319675@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "319675@main", "clUrl": "https://commits.webkit.org/319675@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322172\nrdar://185404307\n\nReviewed by Gerald Squelart.\n\nbeginLayer() reset the layer rendering state by calling the public setters with\nconstant strings. That was both wrong and expensive.\n\nWrong: setShadowColor(\"black\") parses to opaque black, but the initial value of\nshadowColor -- and the value beginLayer() is specified to reset to -- is\ntransparent black. Any shadowBlur or shadowOffset set inside the layer therefore\npainted a shadow that should not exist, and ctx.shadowColor read back \"#000000\"\ninstead of \"rgba(0, 0, 0, 0)\". Separately, setFilterString() gives up when the\ncanvas has no computed style, so a non-rendered canvas kept its filter inside the\nlayer and applied it twice.\n\nExpensive: setGlobalCompositeOperation() and setShadowColor() parse before\nchecking whether the value changed, so every beginLayer() ran a composite\noperator parse and a full CSS color parse. setFilterString() goes through\nsetFilterStringWithoutUpdatingStyle(), which calls Document::updateStyleIfNeeded()\n-- a synchronous style recalc in the middle of beginLayer().\n\nSet the state fields directly instead, and push only what the layer's\nGraphicsContext needs: the transparency-layer switcher draws into the destination\ncontext, so alpha, composite operator and shadow still have to be applied there.\n\n* LayoutTests/imported/w3c/web-platform-tests/html/canvas/element/layers/2d.layer.layer-rendering-state-reset-in-layer-expected.txt: Progression\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:\n(WebCore::CanvasRenderingContext2DBase::beginLayer):\n\nCanonical link: https://commits.webkit.org/319675@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "5fb77d6068fb458d3b75048ea19c074eb8970cf2", "subject": "2D canvas beginLayer() resets shadowColor to opaque black and re-parses constant strings" }, "319676@main": { "author": "Andy Estes", "avatar": "https://www.gravatar.com/avatar/643f10f01b26fd94d03482a2013b2ea0?d=identicon\u0026s=64", "cl": "319676@main", "clUrl": "https://commits.webkit.org/319676@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322293\nrdar://185535803\n\nReviewed by Jean-Yves Avenard.\n\n-seekToPosition:tolerance: on AVPlaybackUserInterfaceControllable is documented to expect\nkCMTimeZero for a precise seek and kCMTimePositiveInfinity for a fast seek. However, WebKit was\nalways passing kCMTimeZero. Fixed this by using the SeekTarget passed to\nMediaPlayerPrivateWirelessPlayback::seekToTarget to compute the appropriate argument.\n\nTest: media/wireless-playback-media-player/seek-tolerance.html\n\n* LayoutTests/media/wireless-playback-media-player/seek-tolerance-expected.txt: Added.\n* LayoutTests/media/wireless-playback-media-player/seek-tolerance.html: Added.\n* Source/WebCore/platform/audio/ios/MediaDeviceRoute.h:\n* Source/WebCore/platform/audio/ios/MediaDeviceRoute.mm:\n(WebCore::convert):\n(WebCore::MediaDeviceRoute::seekToPosition):\n(WebCore::MediaDeviceRoute::setPlaybackPosition): Deleted.\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.cpp:\n(WebCore::seekTolerance):\n(WebCore::MediaPlayerPrivateWirelessPlayback::seekToTarget):\n* Source/WebCore/testing/MockMediaDeviceRoute.h:\n* Source/WebCore/testing/MockMediaDeviceRoute.idl:\n* Source/WebCore/testing/MockMediaDeviceRoute.mm:\n(WebCore::MockMediaDeviceRoute::lastSeekTolerance const):\n* Source/WebCore/testing/cocoa/WebMockMediaDeviceRoute.h:\n* Source/WebCore/testing/cocoa/WebMockMediaDeviceRoute.mm:\n(-[WebMockMediaDeviceRoute init]):\n(-[WebMockMediaDeviceRoute lastSeekTolerance]):\n(-[WebMockMediaDeviceRoute seekToPosition:tolerance:]):\n\nCanonical link: https://commits.webkit.org/319676@main", "email": "aestes@apple.com", "hash": "d08f00e761db2577ddcc30db998dc5f46424e4a2", "subject": "[iOS] MediaPlayerPrivateWirelessPlayback does not correctly issue fast seeks" }, "319677@main": { "author": "Andy Estes", "avatar": "https://www.gravatar.com/avatar/643f10f01b26fd94d03482a2013b2ea0?d=identicon\u0026s=64", "cl": "319677@main", "clUrl": "https://commits.webkit.org/319677@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322323\nrdar://185565496\n\nReviewed by Jean-Yves Avenard.\n\nWhen the active route changes to local, MediaSessionHelper pauses playback. When\nMediaPlayerPrivateWirelessPlayback::pause() is called, the playing property on the route is set to\nfalse. Later, MediaDeviceRoute receives a KVO notification of this change and notifies the MediaPlayer\nand its client via rateChanged() and playbackStateChanged(). However, since a route change is\noccurring, the route may have been cleared from MediaPlayerPrivateWirelessPlayback prior to the KVO\nnotification being received. As a result, the HTMLMediaElement thinks the media should still be\nplaying despite MediaSessionHelper attempting to pause it.\n\n319455@main did not introduce this bug, but it changed the timing of how route changes are\npropagated to the media player such that it exposed this underlying issue.\n\nResolved this by dispatching rateChanged() and playbackStateChanged() when\nMediaPlayerPrivateWirelessPlayback loses its route, and changing\nMediaPlayerPrivateWirelessPlayback::paused() to return true when there is no route.\n\nNo new tests. Covered by existing tests.\n\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.cpp:\n(WebCore::MediaPlayerPrivateWirelessPlayback::setWirelessPlaybackTarget):\n(WebCore::MediaPlayerPrivateWirelessPlayback::setShouldPlayToPlaybackTarget):\n(WebCore::MediaPlayerPrivateWirelessPlayback::notifyRateAndPlaybackStateChanged):\n(WebCore::MediaPlayerPrivateWirelessPlayback::hasRoute const):\n(WebCore::MediaPlayerPrivateWirelessPlayback::paused const):\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.h:\n\nCanonical link: https://commits.webkit.org/319677@main", "email": "aestes@apple.com", "hash": "16c6a9971daca74d3b6bdddba6daf8d2c4c57d8c", "subject": "REGRESSION (319455@main): media/wireless-playback-media-player/route-deactivate-pauses-playback.html fails" }, "319678@main": { "author": "Mark Lam", "avatar": "https://www.gravatar.com/avatar/87a4219a10aeda88757492c63da746de?d=identicon\u0026s=64", "cl": "319678@main", "clUrl": "https://commits.webkit.org/319678@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317632\nrdar://172794625\n\nReviewed by Dan Hecht.\n\nIf the number of opcodes (with metadata of substantive size) is large, the 32-bit unsigned\ncomputed buffer offsets in UnlinkedMetadataTable::finalize() can overflow. This patch\napplies the use of CheckedArithmetic to detect and handle any potential overflows. In the\nevent of a detected overflow, we'll propagate the failure to allocate the bytecode metadata\nup to the BytecodeGenerator, and treat its as an OOM error during parsing.\n\nTest: JSTests/stress/unlinked-metadata-table-finalize-overflow.js\n\n* JSTests/stress/unlinked-metadata-table-finalize-overflow.js: Added.\n(try.f):\n(catch):\n* Source/JavaScriptCore/bytecode/UnlinkedCodeBlockGenerator.cpp:\n(JSC::UnlinkedCodeBlockGenerator::finalize):\n* Source/JavaScriptCore/bytecode/UnlinkedCodeBlockGenerator.h:\n* Source/JavaScriptCore/bytecode/UnlinkedMetadataTable.cpp:\n(JSC::UnlinkedMetadataTable::finalize):\n* Source/JavaScriptCore/bytecode/UnlinkedMetadataTable.h:\n* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:\n(JSC::BytecodeGenerator::generate):\n\nOriginally-landed-as: 305413.1022@safari-7624.5-branch (9343a9521f58). rdar://185367993\nCanonical link: https://commits.webkit.org/319678@main", "email": "mark.lam@apple.com", "hash": "97df94ead028cddcfc21e48ec6f2f72d25ec1662", "subject": "Handle overflows in UnlinkedMetadataTable::finalize()." }, "319679@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "319679@main", "clUrl": "https://commits.webkit.org/319679@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322363\nrdar://185651379\n\nReviewed by Chris Dumez.\n\nCanvasBase::cssCanvasClients() and InspectorCanvas::cssCanvasClientNodes() were\nthe last HashSet\u003cElement*\u003e in WebCore; every other Element set in the tree is a\nHashSet\u003cRef\u003cElement\u003e\u003e or a WeakHashSet\u003cElement\u003e. Nothing misbehaves today —\nthe set is built and drained inside a single synchronous inspector call, with no\nscript or layout in between — but the uncounted container has no reason to exist\nhere: the producer already holds a RefPtr to each element, and both consumers\nimmediately re-ref every entry.\n\nReturn HashSet\u003cRef\u003cElement\u003e\u003e instead and let the callers iterate Refs directly.\n\n* Source/WebCore/html/CanvasBase.cpp:\n(WebCore::CanvasBase::cssCanvasClients const):\n(WebCore:: const): Deleted.\n* Source/WebCore/html/CanvasBase.h:\n* Source/WebCore/inspector/InspectorCanvas.cpp:\n(WebCore::InspectorCanvas::cssCanvasClientNodes const):\n* Source/WebCore/inspector/InspectorCanvas.h:\n* Source/WebCore/inspector/agents/page/PageCanvasAgent.cpp:\n(WebCore::PageCanvasAgent::requestCSSCanvasClientNodes):\n\nCanonical link: https://commits.webkit.org/319679@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "6743d4ebb647587a2b5b6ae8df4041490b87eb54", "subject": "cssCanvasClients() returns a set of raw Element pointers" }, "319680@main": { "author": "Dan Glastonbury", "avatar": "https://www.gravatar.com/avatar/fb7cb28bf9f1bc9fc0c3bbf65566efdc?d=identicon\u0026s=64", "cl": "319680@main", "clUrl": "https://commits.webkit.org/319680@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322260\nrdar://185491104\n\nReviewed by Kimmo Kinnunen.\n\nStreamClientConnection::send() called emitSendSignpost() unconditionally on every\nmessage, and both it and signpostsEnabled() were defined out-of-line in the .cpp\nwhile send\u003cT\u003e() is a header template. Without LTO, which local Release builds\ndisable, the compiler could not inline the enabled check, so every send paid a\ncall just to read a static bool. ENABLE_CORE_IPC_SIGNPOSTS is unconditionally 1\non Cocoa, so release builds paid it too.\n\nMove the fast path inline and guard the emitSendSignpost() call on it, leaving\nonly the one-time preference read out-of-line in signpostsEnabledSlow().\n\n* Source/WebKit/Platform/IPC/StreamClientConnection.cpp:\n(IPC::StreamClientConnection::forceEnableSignposts):\n(IPC::StreamClientConnection::signpostsEnabledSlow):\n* Source/WebKit/Platform/IPC/StreamClientConnection.h:\n(IPC::StreamClientConnection::signpostsEnabled):\n(IPC::StreamClientConnection::send):\n\nCanonical link: https://commits.webkit.org/319680@main", "email": "djg@apple.com", "hash": "60eee3f8f2c5bd21389fedb90964c8e78942800e", "subject": "Avoid an out-of-line call per stream IPC send to check whether signposts are enabled" }, "319681@main": { "author": "Richard Robinson", "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64", "cl": "319681@main", "clUrl": "https://commits.webkit.org/319681@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322297\nrdar://185536453\n\nReviewed by Ryan Reno, Alex Christensen, Abrar Rahman Protyasha, and Cole Carley.\n\nSwitch to using the normal `std::expected` type instead of our own implementation based on an\noutdated version.\n\nSince `std::expected` is stricter than ours was, several fixes are needed:\n\n1. It has no non-template constructor taking `const T\u0026`, only `template\u003cclass U = T\u003e expected(U\u0026\u0026)`.\n`U` cannot be deduced through a braced-init-list, so it falls back to `U = T` and the parameter\nbecomes `T\u0026\u0026`, which will not bind to an lvalue. Consequently `return { { someLvalue } }` no longer\ncompiles, and the extra braces are dropped. This only affected the cases where the inner element was\nan lvalue of type `T`.\n\n2. Its assignment operators require `is_nothrow_move_constructible_v\u003cT\u003e || is_nothrow_move_constructible_v\u003cE\u003e`,\nwhere ours were unconditional. Neither `Exception` nor `String` qualified, because `RefPtr`'s move\nconstructor was never marked `noexcept`, and that propagated up through `String`'s defaulted move\nconstructor. The result was that copy and move assignment were silently deleted for nearly every\n`ExceptionOr\u003cT\u003e` and `Expected\u003cT, String\u003e` use.\n\nFix by marking the `Ref` and `RefPtr` move constructors `noexcept`. Since it makes `String` and\ntherefore `Exception` nothrow-move-constructible, it satisfies the requirement for every `Expected`\nusing them as the error type, whatever the value type is.\n\n3. `value()` requires `is_copy_constructible_v\u003cE\u003e`, since it throws `bad_expected_access\u003cE\u003e` when\nthere is no value, which breaks move-only reject types in `NativePromise`. Use `operator*` instead,\nwhich doesn't have this requirement and whose only requirement is already guaranteed by the enclosing\n`if (result)`.\n\n4. Fix `BidiBrowsingContextAgent::getTree` to forward its result instead of unwrapping and\nrewrapping it, which was discarding the error case.\n\nTest: Tools/TestWebKitAPI/Tests/WTF/NativePromise.cpp\n\n* Source/WTF/wtf/Expected.h:\n(): Deleted.\n(std::experimental::fundamentals_v3::bad_expected_access\u003cvoid\u003e::bad_expected_access): Deleted.\n(std::experimental::fundamentals_v3::bad_expected_access::bad_expected_access): Deleted.\n(std::experimental::fundamentals_v3::bad_expected_access::error): Deleted.\n(std::experimental::fundamentals_v3::bad_expected_access::error const): Deleted.\n(std::experimental::fundamentals_v3::__expected_detail::__expected_terminate): Deleted.\n(std::experimental::fundamentals_v3::__expected_detail::base::base): Deleted.\n(std::experimental::fundamentals_v3::__expected_detail::voidbase::voidbase): Deleted.\n(std::experimental::fundamentals_v3::expected::expected): Deleted.\n(std::experimental::fundamentals_v3::expected::operator=): Deleted.\n(std::experimental::fundamentals_v3::expected::swap): Deleted.\n(std::experimental::fundamentals_v3::expected::operator bool const): Deleted.\n(std::experimental::fundamentals_v3::expected::has_value const): Deleted.\n(std::experimental::fundamentals_v3::expected::value_or const): Deleted.\n(std::experimental::fundamentals_v3::expected::value_or): Deleted.\n(std::experimental::fundamentals_v3::operator==): Deleted.\n(std::experimental::fundamentals_v3::swap): Deleted.\n* Source/WTF/wtf/Forward.h:\n* Source/WTF/wtf/NativePromise.h:\n* Source/WTF/wtf/Ref.h:\n* Source/WTF/wtf/RefPtr.h:\n* Source/WTF/wtf/TypeTraits.h:\n* Source/WebGPU/WGSL/ConstantFunctions.h:\n(WGSL::CONSTANT_FUNCTION):\n* Source/WebKit/UIProcess/Automation/BidiBrowsingContextAgent.cpp:\n(WebKit::BidiBrowsingContextAgent::getTree):\n* Tools/TestWebKitAPI/Tests/WTF/NativePromise.cpp:\n(TestWebKitAPI::TEST(NativePromise, MoveOnlyType)):\n\nCanonical link: https://commits.webkit.org/319681@main", "email": "richard_robinson2@apple.com", "hash": "0c7e7ad97b9c50e549387914d31ecc2908ae0171", "subject": "[WTF] Use std::expected instead of our own std::experimental::expected implementation" }, "319682@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "319682@main", "clUrl": "https://commits.webkit.org/319682@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322367\nrdar://185653414\n\nReviewed by Gerald Squelart.\n\npostProcessPixelBufferResults() only sets wasPixelBufferModified after the\n`if (!alphaChannel) continue;` guard, so it returns false when every pixel in the\ndirty rect is transparent. postProcessDirtyCanvasBuffer() gated both the\nputPixelBuffer() write-back and the `m_postProcessDirtyRect = { }` reset on that\nreturn value, so the dirty rect survived the readback. Nothing else clears it:\nCanvasBase::didDraw() only calls clearDirtyRect() for a whole-canvas draw with\nShouldApplyPostProcessingToDirtyRect::No.\n\nThe stale rect makes every subsequent getImageData()/toDataURL()/toBlob() redo an\nunpremultiplied RGBA8 getPixelBuffer() over it and throw the result away, and\nleaves havePendingCanvasNoiseInjection() permanently true, forcing\ndrawImage(thatCanvas, ...) down the post-processing didDraw() path.\n\nSkipping the write-back when nothing changed is still correct, so decouple the\ntwo: reset the dirty rect once the pixel buffer has been processed, and only write\nback when a pixel actually changed. The early returns for a missing image buffer\nor a failed readback still preserve the rect.\n\nOnly reachable with a non-zero noise salt; salt 0 is the testing path and returns\ntrue before the loop, which is why canvas-noise-injection.html misses this.\n\nTest: fast/canvas/canvas-noise-injection-transparent-dirty-rect.html\n\n* LayoutTests/fast/canvas/canvas-noise-injection-transparent-dirty-rect-expected.txt: Added.\n* LayoutTests/fast/canvas/canvas-noise-injection-transparent-dirty-rect.html: Added.\n* Source/WebCore/html/CanvasNoiseInjection.cpp:\n(WebCore::CanvasNoiseInjection::postProcessDirtyCanvasBuffer):\n\nCanonical link: https://commits.webkit.org/319682@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "f2faeb01517c97a8ee551309aa97c3c9a4d7d271", "subject": "CanvasNoiseInjection dirty rect is never cleared when the dirty region is fully transparent" }, "319683@main": { "author": "Lily Spiniolas", "avatar": "https://www.gravatar.com/avatar/b65cfeb51301399bd50e338bb2d7613e?d=identicon\u0026s=64", "cl": "319683@main", "clUrl": "https://commits.webkit.org/319683@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322353\nrdar://185625389\n\nReviewed by Wenson Hsieh and Abrar Rahman Protyasha.\n\nUpdate `RenderThemeCocoa::controlSupportsTints` to return true for\nspin buttons, thus causing them to be repainted when the window active\nstate changes.\n\nTests: fast/forms/form-control-refresh/spinbutton-window-inactive-state-dark-mode.html\n fast/forms/form-control-refresh/spinbutton-window-inactive-state-light-mode.html\n\n* LayoutTests/fast/forms/form-control-refresh/spinbutton-window-inactive-state-dark-mode-expected-mismatch.html: Added.\n* LayoutTests/fast/forms/form-control-refresh/spinbutton-window-inactive-state-dark-mode.html: Added.\n* LayoutTests/fast/forms/form-control-refresh/spinbutton-window-inactive-state-light-mode-expected-mismatch.html: Added.\n* LayoutTests/fast/forms/form-control-refresh/spinbutton-window-inactive-state-light-mode.html: Added.\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/visionos/TestExpectations:\n* Source/WebCore/rendering/cocoa/RenderThemeCocoa.mm:\n(WebCore::RenderThemeCocoa::controlSupportsTints const):\n\nCanonical link: https://commits.webkit.org/319683@main", "email": "lily_spiniolas@apple.com", "hash": "729c8c6ccb67f59c290dab45953c2b53eb603b34", "subject": "Spin buttons for input type=\"number\" do not repaint when window active state changes" }, "319684@main": { "author": "Youenn Fablet", "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64", "cl": "319684@main", "clUrl": "https://commits.webkit.org/319684@main", "description": "rdar://185207783\nhttps://bugs.webkit.org/show_bug.cgi?id=322017\n\nReviewed by Jean-Yves Avenard.\n\n* Source/ThirdParty/libwebrtc/Source/third_party/libyuv: Resynced.\n\nCanonical link: https://commits.webkit.org/319684@main", "email": "youenn@apple.com", "hash": "e84a219c82ccc42cbd8d829807976ea7b1c7e502", "subject": "Resync libyuv up to M152" }, "319685@main": { "author": "Youenn Fablet", "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64", "cl": "319685@main", "clUrl": "https://commits.webkit.org/319685@main", "description": "rdar://185207703\nhttps://bugs.webkit.org/show_bug.cgi?id=322015\n\nReviewed by Jean-Yves Avenard.\n\n* Source/ThirdParty/libwebrtc/Source/third_party/boringssl: Resynced.\n\nCanonical link: https://commits.webkit.org/319685@main", "email": "youenn@apple.com", "hash": "0703907b1d4a2b3e546023865c5c3174637a3dca", "subject": "Resync boringssl to M152" }, "319686@main": { "author": "Elliott Williams", "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64", "cl": "319686@main", "clUrl": "https://commits.webkit.org/319686@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322385\nrdar://185667195\n\nReviewed by Richard Robinson.\n\nRewrite the swiftinterface metadata at the top of the module to match\niOS 27 and fix a build error:\n\n cannot conform to protocol 'UIViewRepresentable' (compiled with Swift 5.10) because it has requirements that could not be loaded in Swift 6.4\n\n* Source/WebKit/Platform/spi/Cocoa/SwiftUI_SPI.swiftinterface:\n\nCanonical link: https://commits.webkit.org/319686@main", "email": "emw@apple.com", "hash": "7da1609eab539eb3a0b1b7416d5a9c96fe9e27ef", "subject": "[Build] Fix SwiftUI \"cannot conform to protocol\" error" }, "319687@main": { "author": "Dan Glastonbury", "avatar": "https://www.gravatar.com/avatar/fb7cb28bf9f1bc9fc0c3bbf65566efdc?d=identicon\u0026s=64", "cl": "319687@main", "clUrl": "https://commits.webkit.org/319687@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322258\nrdar://185490497\n\nReviewed by Mike Wyrzykowski.\n\nconcatenate() started from an identity AffineTransform and multiplied every item\ninto it, so the first iteration always performed a full 2x3 multiply against\nidentity. Seed the accumulator from the first item instead and multiply in the\nremaining ones, which removes one AffineTransform::multiply() per call regardless\nof list length.\n\n* Source/WebCore/svg/SVGTransformList.cpp:\n(WebCore::SVGTransformList::concatenate const):\n\nCanonical link: https://commits.webkit.org/319687@main", "email": "djg@apple.com", "hash": "8d5de0127f134360c3326ee52ceb6b6aa30d887d", "subject": "Avoid a redundant matrix multiply in SVGTransformList::concatenate()" }, "319688@main": { "author": "Nikolas Zimmermann", "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64", "cl": "319688@main", "clUrl": "https://commits.webkit.org/319688@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322340\n\nReviewed by Rob Buis.\n\nThe reference coordinate system for a non-scaling stroke is the one of the\noutermost \u003csvg\u003e. It holds all SVG internal transforms and nothing above them.\nPage zoom is not part of it either, because zoom scales the whole rendering,\nthe stroke included. We are currently using getScreenCTM() which includes\nall transformations up to RenderView, which is incorrect.\n\nFix: Introduce computeTransformToSVGRoot() to accumulates up to and including\nthe anonymous RenderSVGViewportContainer, which caries the outermost 'viewBox'\ntransform and stop there. This is the correct coordinate system for\nnon-scaling-stroke.\n\nFixes three non-scaling-stroke tests in LBSE.\n\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/TestExpectations:\n* Source/WebCore/rendering/svg/RenderSVGShape.cpp:\n(WebCore::RenderSVGShape::nonScalingStrokeTransform const):\n* Source/WebCore/rendering/svg/SVGTransformComputation.h:\n(WebCore::SVGTransformComputation::computeAccumulatedTransform const):\n(WebCore::SVGTransformComputation::computeTransformToSVGRoot const):\n\nCanonical link: https://commits.webkit.org/319688@main", "email": "nzimmermann@igalia.com", "hash": "9e4acd3a3813fa7bbeb453f8d7349a65fb310ba7", "subject": "[LBSE] non-scaling-stroke uses the wrong reference coordinate system" }, "319689@main": { "author": "Karl Dubost", "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64", "cl": "319689@main", "clUrl": "https://commits.webkit.org/319689@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322178\nrdar://185410830\n\nReviewed by Nikolas Zimmermann.\n\nAdds coverage for svgView() on an img element, preserveAspectRatio(), transform(),\nattribute order, the order attributes are applied in, a percent-encoded separator,\nand a trailing time segment.\n\nsvgview-and-xywh.html and its reference loaded sprite4.svg, which does not exist.\nThe support file is support/squares.svg. Both sides showed a missing image and\nmatched, so it passed without testing anything. Fixed, and now fails: WebKit and\nBlink honour the svgView() prefix where the test expects the whole fragment to be\nignored. Marked ImageOnlyFailure.\n\nsvgview-spaces.html and svgview-spaces-around-semicolon.html assert that spaces are\nallowed in a fragment specification, which SVG 2 says and no engine does. Marked\nImageOnlyFailure.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-and-xywh-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-and-xywh-ref.html:\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-and-xywh.html:\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-attribute-order-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-attribute-order.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-escaped-semicolon-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-escaped-semicolon.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-img-element-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-img-element-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-img-element.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-preserveaspectratio-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-preserveaspectratio-meet-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-preserveaspectratio-meet-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-preserveaspectratio-meet.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-preserveaspectratio.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-spaces-around-semicolon-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-spaces-around-semicolon.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-spaces-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-spaces.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-teal-100x50-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-terracotta-100x100-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-timesegment-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-timesegment.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-transform-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-transform.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-viewbox-then-transform-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/svgview-viewbox-then-transform.html: Added.\n\nCanonical link: https://commits.webkit.org/319689@main", "email": "karlcow@apple.com", "hash": "4bf9d2cf94e5a07bdcb977203ddc27f3752ecaf7", "subject": "Extend WPT coverage for svgview() fragment identifiers" }, "319690@main": { "author": "Antti Koivisto", "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64", "cl": "319690@main", "clUrl": "https://commits.webkit.org/319690@main", "description": "rdar://177909775\n\nReviewed by Alan Baradlay.\n\ndispatchPendingLoadEvent() and dispatchPendingErrorEvent() dispatch author script and then\ntouch `this` again via updatedHasPendingEvent(). The only thing keeping the element alive\nacross the dispatch is a full-expression-scoped Ref plus the m_protectedElement member, and\nthe 0s m_derefElementTimer can clear that member. A load handler can re-arm the timer by\nremoving the \u003cimg\u003e from its \u003cpicture\u003e (selectImageSource(RelevantMutation::Yes) calls\nupdatedHasPendingEvent()), then spin a nested run loop via showModalDialog(). The timer\nfires and drops m_protectedElement while the dispatch is still on the stack. When the\ndispatch returns the temporary Ref destructs as the last reference, ~HTMLImageElement frees\nthe loader via its unique_ptr\u003cHTMLImageLoader\u003e, and the trailing updatedHasPendingEvent()\nruns on freed `this`.\n\nHold a stack Ref to the element across the dispatch and the trailing updatedHasPendingEvent()\nin both functions. The loader is owned by the element, so keeping the element alive keeps\nthis ImageLoader alive.\n\nTest: fast/images/image-load-event-in-modal-dialog-crash.html\n\n* LayoutTests/fast/images/image-load-event-in-modal-dialog-crash-expected.txt: Added.\n* LayoutTests/fast/images/image-load-event-in-modal-dialog-crash.html: Added.\n* LayoutTests/fast/images/resources/self-closing-modal-dialog.html: Added.\n* Source/WebCore/loader/ImageLoader.cpp:\n(WebCore::ImageLoader::dispatchPendingLoadEvent):\n(WebCore::ImageLoader::dispatchPendingErrorEvent):\n\nOriginally-landed-as: 305413.1064@safari-7624.5-branch (fe774071a22a). rdar://185367866\nCanonical link: https://commits.webkit.org/319690@main", "email": "antti@apple.com", "hash": "d40f4efab0e0cee61e29c8540abff5285bf5275d", "subject": "[WebCore] Use-after-free in ImageLoader::dispatchPendingLoadEvent / dispatchPendingErrorEvent" }, "319691@main": { "author": "David Kilzer", "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64", "cl": "319691@main", "clUrl": "https://commits.webkit.org/319691@main", "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=322380\u003e\n\u003crdar://185663612\u003e\n\nUnreviewed build fix.\n\nAdd `WEBCORE_EXPORT` to `ISOOriginalFormatBox::parse()`. 319410@main\nchanged the ISO box `parse()` methods to take `const ByteView\u0026` and, in\nthat same change, dropped the class-level `WEBCORE_EXPORT` from\n`ISOOriginalFormatBox`, re-adding it only to the constructor and\ndestructor. The `parse()` override was left un-exported, so code\noutside WebCore that links against the framework and calls it fails\nwith an undefined symbol. The sibling ISO box classes stay reachable\nthrough their own class-level or per-member `WEBCORE_EXPORT`, so\n`ISOOriginalFormatBox` was the only one affected.\n\nNo new tests since this change is not directly testable.\n\n* Source/WebCore/platform/graphics/iso/ISOOriginalFormatBox.h:\n(WebCore::ISOOriginalFormatBox::parse):\n\nCanonical link: https://commits.webkit.org/319691@main", "email": "ddkilzer@apple.com", "hash": "588e0f8ae8a0b21c73c10ad185fd125624b06d4c", "subject": "REGRESSION (319410@main): WebCore::ISOOriginalFormatBox::parse() is no longer exported from WebCore" }, "319692@main": { "author": "David Kilzer", "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64", "cl": "319692@main", "clUrl": "https://commits.webkit.org/319692@main", "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=322329\u003e\n\u003crdar://179508210\u003e\n\nReviewed by Chris Dumez.\n\n`WebLockRegistryProxy` validates the incoming `ClientOrigin` with\n`WebProcessProxy::hasCommittedClientOrigin()`. For a WebProcess that\nonly hosts remote workers there is no committed load, so that predicate\nfell back to comparing both halves of the `ClientOrigin` against\n`WebProcessProxy::m_site`.\n\nThat comparison is wrong. `m_site` of a remote worker process is the\n*top* site, because `SWServer` and `WebSharedWorkerServer` ask for a\ncontext connection with `SWServerWorker::topSite()` /\n`WebSharedWorker::topSite()`, i.e. with the storage partition rather\nthan with the worker's own origin. A service worker or a shared worker\nregistered by a third-party frame has a client origin on a different\nsite than its partition, so `Site { clientOrigin.clientOrigin }` never\nmatched `m_site`, the `MESSAGE_CHECK` fired an `EXC_GUARD` fault and the\nworker process was killed. Web Locks were therefore unreachable from any\nthird-party worker, which is legitimate content: the lock registry\nitself is keyed by the full `ClientOrigin` and partitions such a worker\ncorrectly.\n\nUse new `WebProcessProxy::m_remoteWorkerSites` to track the storage\npartitions for which a process has been made a remote worker host, and\nvalidate the top origin of the incoming `ClientOrigin` against that set.\nThis is the tightest granularity the UI process actually possesses: it\nis never told the origins of the workers running in a context process,\nonly the partitions the process was established for. A forged\n`ClientOrigin` whose top origin is on another site is still rejected, so\n`LayoutTests/ipc/weblock-registry-origin.html` keeps failing the check.\n\nThe set only ever grows so that a message which was already in flight\nwhen `disableRemoteWorkers()` ran is still considered valid. A\nWorker-only process has an empty `m_committedClientOrigins` and would\notherwise fail the check during that teardown window.\n\nTests: http/tests/web-locks/web-lock-in-third-party-serviceworker.html\n http/tests/web-locks/web-lock-in-third-party-serviceworker-site-isolation.html\n http/tests/web-locks/web-lock-in-third-party-sharedworker.html\n http/tests/web-locks/web-lock-in-third-party-sharedworker-site-isolation.html\n\n* LayoutTests/http/tests/web-locks/resources/third-party-service-worker.js: Added.\n* LayoutTests/http/tests/web-locks/resources/third-party-serviceworker-frame.html: Added.\n* LayoutTests/http/tests/web-locks/resources/third-party-sharedworker-frame.html: Added.\n* LayoutTests/http/tests/web-locks/web-lock-in-third-party-serviceworker-expected.txt: Added.\n* LayoutTests/http/tests/web-locks/web-lock-in-third-party-serviceworker-site-isolation-expected.txt: Added.\n* LayoutTests/http/tests/web-locks/web-lock-in-third-party-serviceworker-site-isolation.html: Added.\n* LayoutTests/http/tests/web-locks/web-lock-in-third-party-serviceworker.html: Added.\n* LayoutTests/http/tests/web-locks/web-lock-in-third-party-sharedworker-expected.txt: Added.\n* LayoutTests/http/tests/web-locks/web-lock-in-third-party-sharedworker-site-isolation-expected.txt: Added.\n* LayoutTests/http/tests/web-locks/web-lock-in-third-party-sharedworker-site-isolation.html: Added.\n* LayoutTests/http/tests/web-locks/web-lock-in-third-party-sharedworker.html: Added.\n* Source/WebKit/UIProcess/WebProcessPool.cpp:\n(WebKit::WebProcessPool::establishRemoteWorkerContextConnectionToNetworkProcess):\n- Record the storage partition on a reused remote-worker host process.\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::createForRemoteWorkers):\n(WebKit::WebProcessProxy::hasCommittedClientOrigin const):\n(WebKit::WebProcessProxy::didBecomeRemoteWorkerHostForSite):\n* Source/WebKit/UIProcess/WebProcessProxy.h:\n- Move `m_isEligibleForWebProcessCache` so the new `m_remoteWorkerSites`\n member variable does not grow `WebProcessProxy` into a larger\n allocation bucket: it stays at 1424 bytes.\n\nCanonical link: https://commits.webkit.org/319692@main", "email": "ddkilzer@apple.com", "hash": "b58727688abaf30310e8962431b0ce109f083555", "subject": "MESSAGE_CHECK failure in WebLockRegistryProxy::requestLock for a worker registered by a third-party frame" }, "319693@main": { "author": "Aakash Jain", "avatar": "https://www.gravatar.com/avatar/e82e0cafeeac3a35b7e74206ebe4c536?d=identicon\u0026s=64", "cl": "319693@main", "clUrl": "https://commits.webkit.org/319693@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322264\n\u003crdar://problem/185499346\u003e\n\nReviewed by Ryan Haddad.\n\nPatches are deprecated, so no new attachment is tested by EWS and\nupdate-test-expectations-from-bugzilla only applies to attachments from before the\nswitch, whose results are far too old to rebaseline against. update-test-expectations\nkeeps working for a pull request, and EWS keeps serving the results it already recorded\nfor old attachments.\n\nAlso removes two files which nothing referenced any more: the deprecated-command stub\nand a ChangeLog analysis page.\n\n* Tools/Scripts/update-test-expectations-from-bugzilla: Removed.\n* Tools/Scripts/webkitpy/common/net/bugzilla/results_fetcher.py:\n* Tools/Scripts/webkitpy/common/net/bugzilla/results_fetcher_unittest.py:\n* Tools/Scripts/webkitpy/common/net/bugzilla/test_expectation_updater.py:\n* Tools/Scripts/webkitpy/common/net/bugzilla/test_expectation_updater_unittest.py:\n* Tools/Scripts/webkitpy/tool/commands/data/summary.html: Removed.\n* Tools/Scripts/webkitpy/tool/commands/deprecatedcommand.py: Removed.\n\nCanonical link: https://commits.webkit.org/319693@main", "email": "aakash_jain@apple.com", "hash": "da99882cd45a9e6af0c31d960c39e0a7f5d4f46b", "subject": "[webkit-patch] Remove Bugzilla patch workflow support from webkit-patch - Part 3" }, "319694@main": { "author": "Carlos Garcia Campos", "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64", "cl": "319694@main", "clUrl": "https://commits.webkit.org/319694@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322182\n\nReviewed by Nikolas Zimmermann.\n\nCoordinatedPlatformLayerBufferProxy is currently defined as the\nPlatformLayer for coordinated graphics. That works only because we only\nsupport media platform buffers in GraphicsLayer::setContentsToPlatformLayer().\nBut CoordinatedPlatformLayerBufferProxy is not really a platform layer,\nit's helper class created by the media player and shared with the\nGraphicsLayer to be able to send video frames to the compositor. This\npatch moves the ownership from the media player to the graphics layer.\nFor that GraphicsLayer::setContentsToMediaPlayer() has been added, with\na default implementation that just calls setContentsToPlatformLayer(),\nbut overriden by GraphicsLayerCoordinated to create a new\nCoordinatedPlatformLayerBufferProxy if needed and set it to the given\nmedia player. This allows to create the CoordinatedPlatformLayerBufferProxy\nwith a CoordinatedPlatformLayer. When the newly created proxy is set on\nthe media player, if there's already a video frame available, it's set\nin the proxy as initial buffer that is handled from the main thread\nduring layer flush. Creating the proxy from GraphicsLayerCoordinated\nwill also allow us to pass the thread safe gr context to the proxy to\ncreate video buffers using skia promised images too.\n\n* Source/WebCore/platform/graphics/GraphicsLayer.cpp:\n(WebCore::GraphicsLayer::setContentsToMediaPlayer):\n* Source/WebCore/platform/graphics/GraphicsLayer.h:\n* Source/WebCore/platform/graphics/MediaPlayer.cpp:\n(WebCore::MediaPlayer::setPlatformLayerBufferProxy):\n(WebCore::MediaPlayer::platformLayerBufferProxy const):\n* Source/WebCore/platform/graphics/MediaPlayer.h:\n* Source/WebCore/platform/graphics/MediaPlayerPrivate.h:\n(WebCore::MediaPlayerPrivateInterface::setPlatformLayerBufferProxy):\n(WebCore::MediaPlayerPrivateInterface::platformLayerBufferProxy const):\n* Source/WebCore/platform/graphics/PlatformLayer.h:\n* Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:\n(WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):\n(WebCore::MediaPlayerPrivateGStreamer::setPlatformLayerBufferProxy):\n(WebCore::MediaPlayerPrivateGStreamer::platformLayerBufferProxy const):\n(WebCore::MediaPlayerPrivateGStreamer::pushTextureToCompositor):\n(WebCore::MediaPlayerPrivateGStreamer::flushCurrentBuffer):\n(WebCore::MediaPlayerPrivateGStreamer::pushNextHolePunchBuffer):\n(WebCore::MediaPlayerPrivateGStreamer::platformLayer const): Deleted.\n* Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:\n* Source/WebCore/platform/graphics/holepunch/MediaPlayerPrivateHolePunch.cpp:\n(WebCore::MediaPlayerPrivateHolePunch::MediaPlayerPrivateHolePunch):\n(WebCore::MediaPlayerPrivateHolePunch::setPlatformLayerBufferProxy):\n(WebCore::MediaPlayerPrivateHolePunch::platformLayerBufferProxy const):\n(WebCore::MediaPlayerPrivateHolePunch::pushNextHolePunchBuffer):\n(WebCore::MediaPlayerPrivateHolePunch::platformLayer const): Deleted.\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferProxy.cpp:\n(WebCore::CoordinatedPlatformLayerBufferProxy::create):\n(WebCore::CoordinatedPlatformLayerBufferProxy::CoordinatedPlatformLayerBufferProxy):\n(WebCore::CoordinatedPlatformLayerBufferProxy::invalidate):\n(WebCore::CoordinatedPlatformLayerBufferProxy::setInitialDisplayBuffer):\n(WebCore::CoordinatedPlatformLayerBufferProxy::consumePendingBufferIfNeeded):\n(WebCore::CoordinatedPlatformLayerBufferProxy::setDisplayBuffer):\n(WebCore::CoordinatedPlatformLayerBufferProxy::dropCurrentBufferWhilePreservingTexture):\n(WebCore::CoordinatedPlatformLayerBufferProxy::setTargetLayer): Deleted.\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferProxy.h:\n* Source/WebCore/platform/graphics/texmap/coordinated/GraphicsLayerCoordinated.cpp:\n(WebCore::GraphicsLayerCoordinated::~GraphicsLayerCoordinated):\n(WebCore::GraphicsLayerCoordinated::setContentsToMediaPlayer):\n(WebCore::GraphicsLayerCoordinated::setContentsDisplayDelegate):\n(WebCore::GraphicsLayerCoordinated::setContentsToPlatformLayer): Deleted.\n* Source/WebCore/platform/graphics/texmap/coordinated/GraphicsLayerCoordinated.h:\n* Source/WebCore/rendering/RenderLayerBacking.cpp:\n(WebCore::RenderLayerBacking::updateConfiguration):\n* Source/WebCore/platform/graphics/MediaPlayerPrivate.cpp:\n(WebCore::MediaPlayerPrivateInterface::setPlatformLayerBufferProxy):\n(WebCore::MediaPlayerPrivateInterface::platformLayerBufferProxy const):\n* Source/WebCore/platform/graphics/holepunch/MediaPlayerPrivateHolePunch.h:\n* Source/WebKit/WebProcess/GPU/media/gstreamer/VideoLayerRemoteGStreamer.cpp:\n\nCanonical link: https://commits.webkit.org/319694@main", "email": "cgarcia@igalia.com", "hash": "e1e984506198419c3141b726ab5b9338103e270e", "subject": "[CoordinatedGraphics] Move ownership of CoordinatedPlatformLayerBufferProxy from media player to graphics layer" }, "319695@main": { "author": "Claudio Saavedra", "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64", "cl": "319695@main", "clUrl": "https://commits.webkit.org/319695@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317724\n\nReviewed by Yusuke Suzuki and Michael Catanzaro.\n\n312858@main (relanded in 315305@main) uses C++23 std::format in WTF,\nwhich libstdc++ first provides in GCC 13.1. Raise the minimum required\nGCC version in WebKitCommon.cmake from 12.2.0 to 13.1.0 to match.\n\nWith that minimum, version guards that no supported compiler can satisfy\nare now dead and are removed:\n\n- WebKitCompilerFlags.cmake disabled -Wno-uninitialized and\n -Wno-mismatched-new-delete only for GCC \u003c 12.0.0 (already unreachable\n under the previous 12.2.0 minimum).\n- JIT.h worked around a GCC \u003c 12.3.0 ICE on using-enum in templates.\n\n* Source/JavaScriptCore/jit/JIT.h:\n* Source/cmake/WebKitCommon.cmake:\n* Source/cmake/WebKitCompilerFlags.cmake:\n\nCanonical link: https://commits.webkit.org/319695@main", "email": "csaavedra@igalia.com", "hash": "1fec4985d1794c782ff12e2aefc088b76023ba16", "subject": "Require GCC 13.1.0 and remove dead checks for older GCC versions" }, "319696@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "319696@main", "clUrl": "https://commits.webkit.org/319696@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322332\n\u003crdar://problem/185591842\u003e\n\nReviewed by Antti Koivisto.\n\nRenderTreeBuilder::Block::attach decides childrenInline from the first child but skips that when the child is\nfloating or out-of-flow, so a leading float or out-of-flow box leaves the parent non-empty and the first in-flow\nchild never reaches the branch that would turn the flag off. A container whose in-flow children are all block\nlevel then runs an inline formatting context, which leaves adjoining margins between those boxes uncollapsed,\nmoves out-of-flow static positions and changes what align-content aligns. Ask whether an in-flow child has\narrived rather than whether the box is empty, skipping floats, out-of-flow boxes and an excluded marker.\n\n* Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp:\n(WebCore::RenderTreeBuilder::Block::attach):\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/margin-collapse-after-float-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/margin-collapse-after-float-001-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/margin-collapse-after-float-001-expected.html: Added.\n\nCanonical link: https://commits.webkit.org/319696@main", "email": "zalan@apple.com", "hash": "2f6829bc0e9b663bb2c26bcb544560787a27b137", "subject": "[anon-block-removal] Adjoining margins do not collapse when the container's first child is a float or an out-of-flow box" }, "319697@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "319697@main", "clUrl": "https://commits.webkit.org/319697@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322338\n\u003crdar://problem/185598333\u003e\n\nReviewed by Antti Koivisto.\n\nA block level box on a line is handed to block layout at the line's top, and block layout applies the pending\nmargin from the container's own position, so LineBuilder::handleBlockContent takes that margin back off the line\ntop first - but only when the margin was no longer at the before side of the block, while the line was advanced by\nit whenever the margin could not collapse out through the root's before edge. With a border or padding on the\nroot the two disagree: the line top already holds the margin and block layout adds it again, so\n\u003cspan\u003e\u003cdiv style=\"margin-top:100px\"\u003e\u003c/div\u003e\u003c/span\u003e\u003cdiv\u003e puts the second block 200px down instead of 100px. Make\nthe rollback test the condition the advance already uses.\n\n* Source/WebCore/layout/formattingContexts/inline/InlineLineBuilder.cpp:\n(WebCore::Layout::LineBuilder::handleBlockContent):\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/margin-collapse-through-block-in-inline-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/margin-collapse-through-block-in-inline-001-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/CSS2/normal-flow/margin-collapse-through-block-in-inline-001-expected.html: Added.\n\nCanonical link: https://commits.webkit.org/319697@main", "email": "zalan@apple.com", "hash": "dd58efd5acc56ff28293307f49cee0caba5be914", "subject": "[block-in-inline] Margin does not collapse after a self collapsing block level box on a line" }, "319698@main": { "author": "Mike Gorse", "avatar": "https://www.gravatar.com/avatar/9953e4848ac7a1e3808f50f333429369?d=identicon\u0026s=64", "cl": "319698@main", "clUrl": "https://commits.webkit.org/319698@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322113\n\nReviewed by Yusuke Suzuki.\n\nOnly compile the WasmAddressType B3::type constructor where B3::type is\ndefined.\n\n* Source/JavaScriptCore/wasm/WasmAddressType.cpp:\n* Source/JavaScriptCore/wasm/WasmAddressType.h:\n\nCanonical link: https://commits.webkit.org/319698@main", "email": "mgorse@suse.com", "hash": "f69625842f3157301031121ad3d8fcf48f52080d", "subject": "Build failure with jit disabled" }, "319699@main": { "author": "Anne van Kesteren", "avatar": "https://www.gravatar.com/avatar/09bb44ac3625a121017cd98d0a7dc52c?d=identicon\u0026s=64", "cl": "319699@main", "clUrl": "https://commits.webkit.org/319699@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322330\n\nReviewed by Chris Dumez.\n\nThe HTML specification's \"exposed\" concept, which no engine implemented\nconsistently, is being removed: https://github.com/whatwg/html/issues/12787\n\nWebKit applied isExposed() when resolving a name but not when enumerating\nsupported property names, so Object.getOwnPropertyNames(document) could\nreport a name that resolved to undefined. Stop consulting it, matching\nGecko. Two behavior changes: an object or embed element nested in an\nobject element with the same name or id now matches alongside its\nancestor, so lookup returns an HTMLCollection rather than the innermost\nelement; and an object element with object or embed descendants is now\nreachable by its name and id.\n\nTests imported from https://github.com/web-platform-tests/wpt/pull/62149\n\nTests: imported/w3c/web-platform-tests/html/dom/documents/dom-tree-accessors/nameditem-empty-name-dynamic-crash.html\n imported/w3c/web-platform-tests/html/dom/documents/dom-tree-accessors/nameditem-img-name-added-cached-list.html\n imported/w3c/web-platform-tests/html/dom/documents/dom-tree-accessors/nameditem-img-name-added.html\n imported/w3c/web-platform-tests/html/dom/documents/dom-tree-accessors/nameditem-img-name-dynamic.html\n imported/w3c/web-platform-tests/html/dom/documents/dom-tree-accessors/nameditem-img-name-removed.html\n imported/w3c/web-platform-tests/html/dom/documents/dom-tree-accessors/nameditem-no-shadowing.tentative.html\n imported/w3c/web-platform-tests/html/dom/documents/dom-tree-accessors/nameditem-tree-order.html\n\nCanonical link: https://commits.webkit.org/319699@main", "email": "annevk@annevk.nl", "hash": "63519535440f8da30cfffdabab46c68dda9f45a9", "subject": "Document named properties should not filter object and embed elements by exposedness" }, "319700@main": { "author": "Dan Hecht", "avatar": "https://www.gravatar.com/avatar/080f47d912b1b34d0be8293f825d132d?d=identicon\u0026s=64", "cl": "319700@main", "clUrl": "https://commits.webkit.org/319700@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317603\nrdar://178735697\n\nReviewed by Marcus Plutowski.\n\nThe addRootSuccessor lambda in WTF::BackwardsGraph used a single\nGraphNodeWorklist both to decide synthetic-root membership and to drive\nthe predecessor-coverage flood. Depending on the order that back-edges\nwere processed, this would cause some back-edge sources to not be\nincluded as backwards root successors.\n\nB3::BackwardsDominators, built on the resulting incomplete reverse CFG, can\nthen report that a block post-dominates the loop pre-header even though a\npotentially-infinite loop between them means the block may never execute.\nB3HoistLoopInvariantValues uses post-dominators to conclude a control-dependent\nvalue always runs once the loop is entered, and hoists it into the pre-header,\nso the value can execute on paths where it should not.\n\nDecouple the two roles: addRootSuccessor now records every distinct back-edge\nsource and terminal in m_rootSuccessorSet unconditionally, and uses the\nworklist only to bound the predecessor flood.\n\nTests: JSTests/wasm/gc/backwards-graph-multi-backedge-licm.js\n Source/JavaScriptCore/b3/testb3_1.cpp\n Source/JavaScriptCore/b3/testb3_7.cpp\n\n* JSTests/wasm/gc/backwards-graph-multi-backedge-licm.js: Added.\n(catch):\n* Source/JavaScriptCore/b3/B3Procedure.h:\n* Source/JavaScriptCore/b3/testb3.h:\n* Source/JavaScriptCore/b3/testb3_1.cpp:\n(run):\n* Source/JavaScriptCore/b3/testb3_7.cpp:\n(testBackwardsDominatorsWithMultipleBackEdges):\n* Source/WTF/wtf/BackwardsGraph.h:\n(WTF::BackwardsGraph::BackwardsGraph):\n\nOriginally-landed-as: 305413.1019@safari-7624.5-branch (dec21f1baf1f). rdar://185366847\nCanonical link: https://commits.webkit.org/319700@main", "email": "dan.hecht@apple.com", "hash": "7d867192b7ab40a0c797e68d86a5842884729bea", "subject": "[JSC] Fix BackwardsGraph for loops with multiple back-edge sources" }, "319701@main": { "author": "Claudio Saavedra", "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64", "cl": "319701@main", "clUrl": "https://commits.webkit.org/319701@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=284040\n\nReviewed by Fujii Hironori.\n\n* Source/WebCore/platform/graphics/texmap/BitmapTexture.cpp:\n(WebCore::BitmapTexture::updateContents):\n\nCanonical link: https://commits.webkit.org/319701@main", "email": "csaavedra@igalia.com", "hash": "50d4810ab53006528fc295310f055f47ed57dd53", "subject": "[TextureMapper] Drop WTF_ALLOW_UNSAFE_BUFFER_USAGE from BitmapTexture" }, "319702@main": { "author": "Claudio Saavedra", "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64", "cl": "319702@main", "clUrl": "https://commits.webkit.org/319702@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=283899\n\nReviewed by Adrian Perez de Castro.\n\nThe old reads were unaligned loads, undefined regardless of the\nannotation; copying the bytes out is well-defined and lowers to the same\ninstruction. The table directory keeps a cast because its cursor is\nprovably four-byte aligned: it starts at 12 and advances by 16.\n\n* Source/WebCore/platform/graphics/WOFFFileFormat.cpp:\n(WebCore::readUInt32):\n(WebCore::readUInt16):\n(WebCore::convertWOFFToSfnt):\n\nCanonical link: https://commits.webkit.org/319702@main", "email": "csaavedra@igalia.com", "hash": "64d37a3906cab6ce0e50d4d10c81327f2ba2aef9", "subject": "Drop WTF_ALLOW_UNSAFE_BUFFER_USAGE from WOFFFileFormat" }, "319704@main": { "author": "Marta Darbinyan", "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64", "cl": "319704@main", "clUrl": "https://commits.webkit.org/319704@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321046\nrdar://176804299\n\nReviewed by Aakash Jain.\n\nrun-api-tests currently runs to completion, which lets API test EWS\nsteps run for hours when a change breaks many tests. Add\n--exit-after-n-failures N so callers can bound the run. Enabling it on\nEWS is a separate follow-up to Tools/CISupport/ews-build/steps.py.\n\nManager.run() catches EarlyExitException from report_result once the\nfailure count reaches the cap, then falls through to the normal\nsummary/JSON path so the \"Ran N tests of M ...\" line still reaches\nstdout - filter-test-logs and buildbot's parseOutputLine observer both\ndepend on it.\n\n* Tools/Scripts/run-api-tests:\n(parse_args):\nAdd --exit-after-n-failures N option.\n\n* Tools/Scripts/webkitpy/api_tests/runner.py:\n(EarlyExitException):\n(report_result):\n(Runner.__init__):\nTrack a failure counter on the Runner. When report_result records a\nFAILED/CRASHED/TIMEOUT status and the count reaches the cap, raise\nEarlyExitException.\n\n* Tools/Scripts/webkitpy/api_tests/manager.py:\n(Manager.run):\nWire the option onto the Runner. Catch EarlyExitException and fall\nthrough to the normal summary/JSON path.\n\n* Tools/Scripts/webkitpy/api_tests/runner_unittest.py:\n(ReportResultEarlyExitTest):\nCover report_result's early-exit behavior.\n\nCanonical link: https://commits.webkit.org/319704@main", "email": "darbinyan@apple.com", "hash": "2a77f5e5eb97e190d708ca2ae6fc4cb3b7a27679", "subject": "Add --exit-after-n-failures option to run-api-tests" }, "319705@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "319705@main", "clUrl": "https://commits.webkit.org/319705@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322223\nrdar://185455432\n\nReviewed by Ben Nham.\n\nNo need to copy certificates from a frame to itself.\n\n* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:\n(WebKit::ProvisionalPageProxy::ProvisionalPageProxy):\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/319705@main", "email": "achristensen@apple.com", "hash": "81215415fa56d910bd87d807c5b20f5ffd4e2c4b", "subject": "[DEBUG]REGRESSION(318495@main): 3x TestWebKitAPI.SiteIsolation.BrowsingContext*/CrossOriginPopup* (api-tests) is a constant crash." }, "319706@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "319706@main", "clUrl": "https://commits.webkit.org/319706@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322350\nrdar://185620492\n\nReviewed by Sosuke Suzuki.\n\nPerform several optimizations to reduce compile time in Air Greedy RegAlloc.\n\n1. Caching ClobberSite for each point. Some of Air Inst, like Call is\n clobbering all caller-save registers. Thus this query can be executed\n frequently with the same point. Let's just cache it in the Vector so\n that we can quickly answer to the question here.\n2. Use forEachTmpFast if possible as it is dramatically faster than forEachArg.\n We also fixes AirPrintSpecial was not reporting the args correctly.\n3. In emitSpillCodeAndEnqueueNewTmps, before doing complicated spill\n analysis and emission code, we do quick rejection via forEachTmpFast\n check.\n\n* Source/JavaScriptCore/b3/air/AirAllocateRegistersByGreedy.cpp:\n(JSC::B3::Air::Greedy::GreedyAllocator::buildLiveRanges):\n(JSC::B3::Air::Greedy::GreedyAllocator::trySplitAroundClobbers):\n(JSC::B3::Air::Greedy::GreedyAllocator::validateFastTmpEnumeration):\n(JSC::B3::Air::Greedy::GreedyAllocator::ensureUseDefLists):\n(JSC::B3::Air::Greedy::GreedyAllocator::emitSpillCodeAndEnqueueNewTmps):\n* Source/JavaScriptCore/b3/air/AirPrintSpecial.cpp:\n(JSC::B3::Air::PrintSpecial::forEachArg):\n(JSC::B3::Air::PrintSpecial::generate):\n* Source/JavaScriptCore/b3/air/AirPrintSpecial.h:\n\nCanonical link: https://commits.webkit.org/319706@main", "email": "ysuzuki@apple.com", "hash": "96b1030b8df45a6799b4e4bc1f354287c20e56c8", "subject": "[JSC] Make Air Greedy RegAlloc faster" }, "319707@main": { "author": "Fady Farag", "avatar": "https://www.gravatar.com/avatar/0ac5127c69f90d0c57054173ae4c3108?d=identicon\u0026s=64", "cl": "319707@main", "clUrl": "https://commits.webkit.org/319707@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322339\nrdar://185601516\n\nReviewed by Darin Adler.\n\nThis drops the pre-C++20 overload-resolution SFINAE\ndetection idiom in favor of modern C++ language features.\n\nNo new tests since there should be no behavioral changes.\n\n* Source/WTF/wtf/CheckedPtr.h:\n* Source/WTF/wtf/CheckedRef.h:\n* Source/WTF/wtf/CrossThreadTask.h:\n* Source/WTF/wtf/Ref.h:\n* Source/WTF/wtf/RefCountable.h:\n(WTF::RefCountable::create):\n(WTF::RefCountable::RefCountable):\n* Source/WTF/wtf/RunLoop.h:\n* Source/WTF/wtf/StdLibExtras.h:\n(WTF::makeUnique):\n(WTF::makeUniqueWithoutFastMallocCheck):\n* Source/WTF/wtf/TypeTraits.h:\n(WTF::requires):\n* Source/WTF/wtf/UniqueRef.h:\n(WTF::makeUniqueRef):\n* Source/WTF/wtf/WeakHashSet.h:\n* Source/WTF/wtf/WeakPtr.h:\n(WTF::WeakPtr::ptrAllowingHashTableEmptyValue const):\n(WTF::WeakPtr::get const):\n(WTF::WeakPtr::operator-\u003e const):\n(WTF::WeakPtr::operator* const):\n* Source/WTF/wtf/WeakRef.h:\n(WTF::WeakRef::ptrAllowingHashTableEmptyValue const):\n(WTF::WeakRef::ptr const):\n(WTF::WeakRef::get const):\n* Source/WebCore/platform/Timer.h:\n\nCanonical link: https://commits.webkit.org/319707@main", "email": "com.webkit.iidmsa@gmail.com", "hash": "140ec9c4a1ace8b9717b5f13d6e03c91c07b8b1c", "subject": "Use C++20 Concepts in `wtf/TypeTraits.h`" }, "319708@main": { "author": "Wenson Hsieh", "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64", "cl": "319708@main", "clUrl": "https://commits.webkit.org/319708@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322408\nrdar://185697376\n\nReviewed by Abrar Rahman Protyasha.\n\nSlightly increase the throttled \"framerate\" when driving display refreshes manually, when\n`backgroundTextExtractionEnabled` is set.\n\n* Source/WebKit/UIProcess/API/Cocoa/WKWebView+TextExtraction.mm:\n\nCanonical link: https://commits.webkit.org/319708@main", "email": "wenson_hsieh@apple.com", "hash": "81c701e40c59564d8041f722cccfcddc75d3215b", "subject": "[Text Extraction] iOS: Automatically Fix Passwords may time out when filling old/new/confirm new passwords when device is locked" }, "319709@main": { "author": "Ryosuke Niwa", "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64", "cl": "319709@main", "clUrl": "https://commits.webkit.org/319709@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322419\n\nUnreviewed. Updated safer C++ expectations.\n\n* Source/WebCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations:\n\nCanonical link: https://commits.webkit.org/319709@main", "email": "rniwa@webkit.org", "hash": "596e7f865c09474207a965fddac608d8cb0569e2", "subject": "Update safer C++ expectations (2026-08-24)" }, "319710@main": { "author": "Ryan Haddad", "avatar": "https://www.gravatar.com/avatar/b7d8cd2dec546cac2524e4b58181f9d5?d=identicon\u0026s=64", "cl": "319710@main", "clUrl": "https://commits.webkit.org/319710@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321829\nrdar://185229829\n\nReviewed by Ryosuke Niwa.\n\nThe iOS Safer C++ queue reported Modules/webtransport/DatagramSink.cpp as a new failing file on\nPR 71664, which does not touch it. The build was based on 319210@main and the expectations update\nadding that file landed at 319223@main, so it did look new and check_results_db asked the results\ndatabase whether the failure was pre-existing. The response was empty:\n\n Response from results-db: {'does_result_match': False, 'raw_data': [], 'logs': ''}\n\nAn empty raw_data means the request succeeded but held no result for that test. does_result_match\nthen fell through to the caller's default of 'PASS', compared it against 'FAIL', and declared the\nfile not pre-existing. Because a dict rather than None came back, check_results_db treated that as\na successful verdict and skipped the tip-of-tree fallback, which would have rebuilt without\nthe change and shown the failure was not caused by it.\n\nRemoving the `default` parameter collapses both \"cannot answer\" cases in does_result_match into a\nsingle None return, so the fallback in check_results_db always runs.\n\nfilter_results_using_results_db combined its two categories with `or`. Since check_results_db\nreturns an empty set for a category with nothing to check, an unresolved failures result was masked\nby a non-None empty passes result, so it has to require both categories to resolve.\n\n* Tools/CISupport/ews-build/results_db.py:\n(ResultsDatabase.does_result_match): Remove the `default` parameter, which had no other production\ncaller, and return None for both a failed request and a response with no result for the test.\n* Tools/CISupport/ews-build/steps.py:\n(FindUnexpectedStaticAnalyzerResults.filter_results_using_results_db): Require both checks to resolve.\n(FindUnexpectedStaticAnalyzerResults.check_results_db): Stop passing default='PASS'. Log the test,\nidentifier and configuration that produced no answer, and note in stdio that a build without the\nchange is being run.\n* Tools/CISupport/ews-build/steps_unittest.py:\n(TestFindUnexpectedStaticAnalyzerResults.configureResultsDatabase): Stub only has_commit and\nget_results so the real filtering runs, and restore the two methods other tests in this class\nreplace on the class rather than with self.patch. Three tests cover escalation on a missing result,\nescalation when only the passes category is empty, and filtering of a genuine pre-existing failure.\n(TestResultsDatabaseFailureHandling.test_does_result_match_returns_none_when_there_is_no_result_for_the_test):\nReplaces test_does_result_match_uses_default_on_empty_success, which asserted the behavior fixed here.\n\nCanonical link: https://commits.webkit.org/319710@main", "email": "ryanhaddad@apple.com", "hash": "f135b2556e900c616941bec46e8fcaa7f6f13ed1", "subject": "[ews] Safer C++ queues blame unchanged files when results-db has no result for a test" }, "319711@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "319711@main", "clUrl": "https://commits.webkit.org/319711@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322351\nrdar://185622139\n\nReviewed by Sosuke Suzuki.\n\nApply several optimizations.\n\n1. State tends to be empty frequently. So let's skip various analysis\n when state is empty.\n2. Do quick check before copying Inst.\n3. Do not scan an operand's Tmps for defs when it cannot report one.\n\n* Source/JavaScriptCore/b3/air/AirFixObviousSpills.cpp:\n\nCanonical link: https://commits.webkit.org/319711@main", "email": "ysuzuki@apple.com", "hash": "ecc99e50298faee67ef9230e09e691441e1bd81d", "subject": "[JSC] Make FixObviousSpills faster" }, "319712@main": { "author": "Jeffrey Xu", "avatar": "https://www.gravatar.com/avatar/102604c66589181d1a1247ea63f49964?d=identicon\u0026s=64", "cl": "319712@main", "clUrl": "https://commits.webkit.org/319712@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322125\nhttps://bugs.webkit.org/show_bug.cgi?id=322126\nrdar://185354635\nrdar://185354719\n\nReviewed by Alex Christensen.\n\nThe new HTTP/2 and HTTP/3 API tests were timing out on iOS.\nI initially adjusted the HAVE_NETWORK_FRAMEWORK_HTTP_MESSAGING condition, but that wasn't enough.\nAdjusting the tests to replace _test_waitForAlert with directly awaiting responses in JS fixed the timeouts, as _test_waitForAlert seems to be unreliable on iOS.\nRe-enabled all the disabled tests.\n\n* Source/WTF/wtf/PlatformHave.h:\n* TestExpectations/apitests:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/HTTP2Server.mm:\n(TestWebKitAPI::TEST(HTTP2Server, POSTBody)):\n(TestWebKitAPI::TEST(HTTP2Server, NonDefaultStatusCodeAndResponseHeader)):\n(TestWebKitAPI::TEST(HTTP2Server, MultipleRequestsOverOneConnection)):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/HTTP3Server.mm:\n(TestWebKitAPI::TEST(HTTP3Server, POSTBody)):\n(TestWebKitAPI::TEST(HTTP3Server, NonDefaultStatusCodeAndResponseHeader)):\n(TestWebKitAPI::TEST(HTTP3Server, MultipleRequestsOverOneConnection)):\n\nCanonical link: https://commits.webkit.org/319712@main", "email": "jeffrey_xu2@apple.com", "hash": "c9d8bf6fee91c5fba48ded997ccd7be5a2d93dc7", "subject": "Fix HTTP/2 and HTTP/3 API tests timing out on iOS." }, "319713@main": { "author": "Ryosuke Niwa", "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64", "cl": "319713@main", "clUrl": "https://commits.webkit.org/319713@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322422\n\nUnreviewed. Remove the failing test expectations for two tests that are now passing.\n\n* LayoutTests/platform/ios-site-isolation/TestExpectations:\n* LayoutTests/platform/mac-site-isolation/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319713@main", "email": "rniwa@webkit.org", "hash": "5aa34b26ef75b8252559a6de9af07ba87eea2927", "subject": "[Site Isolation] Remove failing expectations for fast/events/suspend-timers.html and fast/files/file-reader-back-forward-cache.html" }, "319714@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "319714@main", "clUrl": "https://commits.webkit.org/319714@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322141\nrdar://185364481\n\nReviewed by Basuke Suzuki.\n\nIt was made a non-singleton as part of an experiment several years ago that never came to anything.\nMake it a singleton like WebProcess and GPUProcess.\nThis will allow us to remove the Ref\u003cNetworkProcess\u003e members on many objects.\n\n* Source/WebKit/NetworkProcess/EntryPoint/Cocoa/XPCService/NetworkServiceEntryPoint.mm:\n(WebKit::initializeAuxiliaryProcess\u003cNetworkProcess\u003e): Deleted.\n* Source/WebKit/NetworkProcess/NetworkProcess.cpp:\n(WebKit::NetworkProcess::singleton):\n(WebKit::NetworkProcess::NetworkProcess):\n(WebKit::NetworkProcess::create): Deleted.\n* Source/WebKit/NetworkProcess/NetworkProcess.h:\n* Source/WebKit/NetworkProcess/curl/NetworkProcessMainCurl.cpp:\n* Source/WebKit/NetworkProcess/soup/NetworkProcessMainSoup.cpp:\n* Source/WebKit/Shared/AuxiliaryProcessMain.h:\n(WebKit::AuxiliaryProcessMainBase::initializeAuxiliaryProcess):\n(WebKit::AuxiliaryProcessMainBaseNoSingleton::process): Deleted.\n(): Deleted.\n\nCanonical link: https://commits.webkit.org/319714@main", "email": "achristensen@apple.com", "hash": "fc6a7726a210ddc669a001d258ccd0f5f466a2bd", "subject": "Make NetworkProcess a singleton again" }, "319715@main": { "author": "Jonathan Bedard", "avatar": "https://www.gravatar.com/avatar/24548a6c84377efe7594acc92601e839?d=identicon\u0026s=64", "cl": "319715@main", "clUrl": "https://commits.webkit.org/319715@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322417\nrdar://185662712\n\nUnreviewed build fix.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebPageTests.swift:\n(WebPageTests.qualifiedServerTrust):\n\nCanonical link: https://commits.webkit.org/319715@main", "email": "jbedard@apple.com", "hash": "4f728bd6f38ac96a0ddc62d334aba9623faa74a2", "subject": "REGRESSION(319551@main): Broke iOS 26.6" }, "319716@main": { "author": "Eric Carlson", "avatar": "https://www.gravatar.com/avatar/e227ff07cc6d645fc1c69fd56c2c8cb8?d=identicon\u0026s=64", "cl": "319716@main", "clUrl": "https://commits.webkit.org/319716@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322355\nrdar://183466855\n\nReviewed by Jer Noble.\n\nMediaSessionManagerCocoa::audioOutputDeviceChanged() dereferenced m_audioHardwareListener\nunconditionally, guarded only by an ASSERT. That listener is created in addSession() and cleared\nin removeSession() once the last session is gone.\n\nUnder site isolation the UI-process RemoteMediaSessionManagerProxy keeps its audio-hardware\nlistener proxy alive for the lifetime of the process, so an audio-output-device change relayed\nfrom the GPU process after the last session was removed still reached audioOutputDeviceChanged()\n- now with a null m_audioHardwareListener - and crashed the UI process in release builds.\n\nA device change arriving while no media session exists is a valid condition, not a\nprogramming error, so return early when there is no listener and drop the ASSERT.\n\n* Source/WebCore/platform/audio/cocoa/MediaSessionManagerCocoa.mm:\n(WebCore::MediaSessionManagerCocoa::audioOutputDeviceChanged):\n* Tools/TestWebKitAPI/Tests/WebCore/PlatformMediaSessionManagerTests.cpp:\n(TestWebKitAPI::TestFiringAudioHardwareListener::create):\n(TestWebKitAPI::TestFiringAudioHardwareListener::fireOutputDeviceChanged):\n(TestWebKitAPI::TestMediaSessionManagerCocoa::create):\n(TestWebKitAPI::TEST): Added a regression test that fires a device change after the last\nsession is removed.\n\nCanonical link: https://commits.webkit.org/319716@main", "email": "eric.carlson@apple.com", "hash": "dc6ce247faeea6c6466018559b5177314ac1d667", "subject": "[Site Isolation] UI-process crash in MediaSessionManagerCocoa::audioOutputDeviceChanged() after the last media session is removed" }, "319717@main": { "author": "Ryosuke Niwa", "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64", "cl": "319717@main", "clUrl": "https://commits.webkit.org/319717@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322428\n\nReviewed by Richard Robinson.\n\nUpdate the checker entries per UncountedLambdaCapturesChecker / UncheckedLambdaCapturesChecker split\nto be consistent with other checkers.\n\n* Tools/Scripts/webkitpy/safer_cpp/checkers.py:\n(Checker.__init__):\n(Checker.find_checker_by_description):\n\nCanonical link: https://commits.webkit.org/319717@main", "email": "rniwa@webkit.org", "hash": "27920d32adee955a420bd46d822e2cddfc595d09", "subject": "Prepare safer C++ tooling for 2026-08-21 Swift toolchain" }, "319718@main": { "author": "Dan Hecht", "avatar": "https://www.gravatar.com/avatar/080f47d912b1b34d0be8293f825d132d?d=identicon\u0026s=64", "cl": "319718@main", "clUrl": "https://commits.webkit.org/319718@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=316347\nrdar://177687354\n\nReviewed by Marcus Plutowski.\n\nIn B3ReduceStrength, specializeSelect() specializes a Select that has a constant\narm and is reached, within selectSpecializationBound, from a Check: it splits the\nblock at the Check, clones the values between the Select and the Check into the\nthen/else arms, and deleteValue()s the Void ones in that range.\n\nPureCSE records pure Values in a per-iteration map (m_pureCSE) and assumes they\nstay present. Checks, though Void, are also recorded (to enable removing redundant\nBranches), so an intermediate Check in that range is recorded too; specializeSelect\nthen deleteValue()s it without updating the map.\n\nKeep the map consistent: remove the value from m_pureCSE before specializeSelect\ndeletes it.\n\nTests: Source/JavaScriptCore/b3/testb3_1.cpp\n Source/JavaScriptCore/b3/testb3_6.cpp\n\n* Source/JavaScriptCore/b3/B3PureCSE.cpp:\n(JSC::B3::PureCSE::clear):\n(JSC::B3::PureCSE::remove):\n* Source/JavaScriptCore/b3/B3PureCSE.h:\n* Source/JavaScriptCore/b3/B3ReduceStrength.cpp:\n* Source/JavaScriptCore/b3/testb3.h:\n* Source/JavaScriptCore/b3/testb3_1.cpp:\n(run):\n* Source/JavaScriptCore/b3/testb3_6.cpp:\n(testCheckSelectAndDeadCheckCSE):\n\nOriginally-landed-as: 305413.977@safari-7624.5-branch (353f0e1145bf). rdar://185369088\nCanonical link: https://commits.webkit.org/319718@main", "email": "dan.hecht@apple.com", "hash": "1d5c10e2f9c8f31378c8b14fb71a48423793ce07", "subject": "[JSC] Fix B3 ReduceStrength Select specialization when a Check appears between the Select and triggering Check" }, "319719@main": { "author": "Shu-yu Guo", "avatar": "https://www.gravatar.com/avatar/3884544eb9e557e2ec917d32c6e12720?d=identicon\u0026s=64", "cl": "319719@main", "clUrl": "https://commits.webkit.org/319719@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=316803\nrdar://178423757\n\nReviewed by Yusuke Suzuki.\n\nA GetScope could be constant folded to Identity. When this happens, the\nabstract interpreter isn't re-executed on the Identity node. If a previous run\nof the AI left the abstract value corresponding to the pre-replacement GetScope\nnode as bottom, this stale bottom value can cause downstream consumers to\nassume the Identity is unreachable when it is.\n\nThis PR re-executes AI after folding to Identity.\n\nTest: JSTests/stress/dfg-getscope-fold-stale-cfa-state.js\n\n* JSTests/stress/dfg-getscope-fold-stale-cfa-state.js: Added.\n(try.Trans):\n(try.inline):\n(foo):\n(C):\n(opt):\n(i.catch):\n* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:\n(JSC::DFG::ConstantFoldingPhase::foldConstants):\n\nOriginally-landed-as: 305413.1012@safari-7624.5-branch (3efb180e50d2). rdar://185369111\nCanonical link: https://commits.webkit.org/319719@main", "email": "syg@apple.com", "hash": "cb05a6083ae0246da0eeee815a7ba5daf3b20c25", "subject": "[JSC] Refresh AI state when folding GetScope to Identity" }, "319720@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "319720@main", "clUrl": "https://commits.webkit.org/319720@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322359\nrdar://185644921\n\nReviewed by Keith Miller.\n\nUse exchangeOr / exchangeAnd for BitSet concurrentTestAndSet / concurrentTestAndClear\nas it is more efficient than using weak CAS loop as ARM64 LSE\nenvironment lowers it to ldset etc.\n\n* Source/WTF/wtf/BitSet.h:\n(WTF::WordType\u003e::concurrentTestAndSet):\n(WTF::WordType\u003e::concurrentTestAndClear):\n\nCanonical link: https://commits.webkit.org/319720@main", "email": "ysuzuki@apple.com", "hash": "f69aff0fba598c2ceb51e11c90907565b6b1245d", "subject": "[WTF] Use exchangeOr / exchangeAnd in BitSet concurrentTestAndSet / concurrentTestAndClear" }, "319721@main": { "author": "Richard Robinson", "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64", "cl": "319721@main", "clUrl": "https://commits.webkit.org/319721@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322430\nrdar://185712624\n\nReviewed by Abrar Rahman Protyasha.\n\nThis feature is on by default in Swift 6.4. However, some CI configurations like Safer CPP use\na version of Swift that does not yet have the change that makes it on by default, so enable the\nfeature explicitly.\n\n* Configurations/CommonBase.xcconfig:\n\nCanonical link: https://commits.webkit.org/319721@main", "email": "richard_robinson2@apple.com", "hash": "3bb23409d5d058544e129be7218224e24be738ad", "subject": "[Swift in WebKit] Enable the SuppressedAssociatedTypes Swift compiler flags" }, "319722@main": { "author": "Aakash Jain", "avatar": "https://www.gravatar.com/avatar/e82e0cafeeac3a35b7e74206ebe4c536?d=identicon\u0026s=64", "cl": "319722@main", "clUrl": "https://commits.webkit.org/319722@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322402\nrdar://185690788\n\nReviewed by Carlos Alberto Lopez Perez.\n\nRemove the WPT import bot special case, which keyed off the Bugzilla-only\npatch_author build property. Its only producer was removed in 319303@main,\nso the branch can no longer be reached.\n\n* Tools/CISupport/ews-build/steps.py:\n(GetTestExpectationsBaseline.run):\n(GetUpdatedTestExpectations.run):\n(RunWebKitTests.setLayoutTestCommand):\n* Tools/CISupport/ews-build/steps_unittest.py:\n(TestRunWebKitTests.test_success_wpt_import_bot): Deleted.\n\nCanonical link: https://commits.webkit.org/319722@main", "email": "aakash_jain@apple.com", "hash": "ff0937cb73c708dc1727feae377b5f917572b635", "subject": "[ews-build] Remove Bugzilla patch workflow support from ews-build.webkit.org - Part 3" }, "319723@main": { "author": "Tim Nguyen", "avatar": "https://www.gravatar.com/avatar/208c05ac2decdf818a4a08ada568328e?d=identicon\u0026s=64", "cl": "319723@main", "clUrl": "https://commits.webkit.org/319723@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322326\nrdar://183755347\n\nReviewed by Abrar Rahman Protyasha.\n\nEventHandler::handleMousePressEvent only set up mouse-event capture\n(m_capturingMouseEventsElement) when a mousedown hit a LocalFrame\nsubframe, never when it hit a RemoteFrame (an out-of-process iframe\nunder site isolation). Without capture, every subsequent mousemove\nduring the drag was freshly hit-tested in the main frame's process,\nso once the pointer left the iframe's on-screen bounds, events\nstopped being forwarded to the iframe's process entirely. This broke\nselection-drag autoscroll and made text selection stop extending as\nsoon as the drag moved outside a cross-origin iframe.\n\nFix this by capturing to the RemoteFrame's owner element the same way\nalready done for LocalFrame subframes, so drag events keep routing to\nthe correct process for the duration of the gesture.\n\nTests: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n http/tests/site-isolation/mouse-events/autoscroll-on-cross-origin-iframe.html\n\n* LayoutTests/http/tests/site-isolation/mouse-events/autoscroll-on-cross-origin-iframe-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/mouse-events/autoscroll-on-cross-origin-iframe.html: Added.\n* LayoutTests/http/tests/site-isolation/resources/tall-selectable-text-frame.html: Added.\n* Source/WebCore/page/EventHandler.cpp:\n(WebCore::EventHandler::handleMousePressEvent):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::TEST(SiteIsolation, MouseCaptureOutsideSubframeDuringDrag)):\n\nCanonical link: https://commits.webkit.org/319723@main", "email": "ntim@apple.com", "hash": "eb401eda2a846a5e0d205de597d779328b737326", "subject": "[Site Isolation][macOS] Cannot autoscroll on cross-origin \u003ciframe\u003e content" }, "319724@main": { "author": "Per Arne Vollan", "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64", "cl": "319724@main", "clUrl": "https://commits.webkit.org/319724@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322181\nrdar://185415299\n\nReviewed by Sihui Liu.\n\nMake sure that RemotePageProxies are updated with a potentially new drawing area in\nWebPageProxy::setBrowsingContextGroup.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n\n* Source/WebKit/UIProcess/RemotePageProxy.cpp:\n(WebKit::RemotePageProxy::setDrawingArea):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::setBrowsingContextGroup):\n(WebKit::WebPageProxy::swapToProvisionalPage):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, RestoredPageWithIframeIsRenderedAfterCrossSiteBFCacheRoundTrip)):\n\nCanonical link: https://commits.webkit.org/319724@main", "email": "pvollan@apple.com", "hash": "c0ab4fa033de398ee4f2da782eb91bf65999a3e8", "subject": "[Site Isolation] Cross origin iframe is not rendering after back navigation" }, "319725@main": { "author": "Taher Ali", "avatar": "https://www.gravatar.com/avatar/e104800647d8c98b8c9dbe736b5e1751?d=identicon\u0026s=64", "cl": "319725@main", "clUrl": "https://commits.webkit.org/319725@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322423\nrdar://185708428\n\nReviewed by Simon Fraser.\n\nNeither method scrolls. They set and reset the root \u003csvg\u003e element's\ncurrent view for an SVG fragment identifier.\n\nFollow-ups will move this out of LocalFrameView so SVGImage::drawForContainer()\ncan set the view directly instead of going through the frame view's\nscroll, :target, and focus machinery.\n\nNo behavior change.\n\n* Source/WebCore/page/LocalFrameView.cpp:\n(WebCore::LocalFrameView::scrollToAnchorFragment):\n(WebCore::LocalFrameView::resetScrollAnchor):\n* Source/WebCore/svg/SVGSVGElement.cpp:\n(WebCore::SVGSVGElement::setViewForFragment):\n(WebCore::SVGSVGElement::resetViewToDefault):\n(WebCore::SVGSVGElement::scrollToFragment): Deleted.\n(WebCore::SVGSVGElement::resetScrollAnchor): Deleted.\n* Source/WebCore/svg/SVGSVGElement.h:\n\nCanonical link: https://commits.webkit.org/319725@main", "email": "taher_ali@apple.com", "hash": "ab5be65e2f8e91ad834066a145f3e939e85c6d26", "subject": "Rename SVGSVGElement::scrollToFragment/resetScrollAnchor" }, "319726@main": { "author": "Yijia Huang", "avatar": "https://www.gravatar.com/avatar/5bc95a5f0a5fdfc107bbdec6979dae89?d=identicon\u0026s=64", "cl": "319726@main", "clUrl": "https://commits.webkit.org/319726@main", "description": "rdar://179027979\nhttps://bugs.webkit.org/show_bug.cgi?id=317611\n\nReviewed by Keith Miller.\n\nDFGIntegerRangeOptimizationPhase (IRO) flips checked arithmetic to\nArith::Unchecked using range proofs derived from other checked ops in\nthe graph, but doesn't record that dependency. DFG DCE can then remove\nthose upstream checks (when their values are otherwise unread), making\nIRO's earlier mutations unsound at runtime.\n\n* rangeFor() now returns a RangeBound { value, proof } per axis,\nwhere proof points to the relationship that produced the tight\nbound (one per axis; ties resolved by first encountered).\n\n* pinRangeBounds(...) is a variadic helper that sets NodeMustGenerate\non the producers behind each given bound's proof. Every site that\nflips a checked op to Arith::Unchecked calls it with only the\nbounds the proof actually consulted.\n\nTest: JSTests/stress/arith-abs-checked-input-range.js\n\nOriginally-landed-as: 305413.1092@safari-7624.5-branch (f778c76c61d1). rdar://185367869\nCanonical link: https://commits.webkit.org/319726@main", "email": "yijia_huang@apple.com", "hash": "03a07e420089127130f5e8560d8b1888ccc4d6f4", "subject": "[JSC] Pin upstream checks that DFG IRO range proofs rely on" }, "319727@main": { "author": "Keith Miller", "avatar": "https://www.gravatar.com/avatar/bddc1595b29098429a6ce7c8bf4aced2?d=identicon\u0026s=64", "cl": "319727@main", "clUrl": "https://commits.webkit.org/319727@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322406\nrdar://185695582\n\nReviewed by Yusuke Suzuki.\n\nScopedLambda required every caller to name the function signature at the\ncall site by wrapping the lambda in a scopedLambda\u003cSig\u003e() call. This is\nbecause ScopedLambda could only be constructed from a raw\n(void*, Args...) thunk. Give ScopedLambda a converting constructor from\nany invocable, so a callee declared as taking a const ScopedLambda\u003cSig\u003e\u0026\ncan simply be passed a lambda. The parameter is marked LIFETIME_BOUND so\nthat clang diagnoses the cases where that does not hold: binding a\ntemporary lambda to a named ScopedLambda, returning one, or initializing\na member from one are all caught by -Wdangling, -Wreturn-stack-address,\nand -Wdangling-field respectively.\n\nConvert every caller to pass its lambda directly, which additionally\ndrops a needless copy of the functor at the sites that were wrapping an\nalready-live reference. This left scopedLambda(), ScopedLambdaFunctor,\nscopedLambdaRef() and ScopedLambdaRefFunctor with no users, so I removed\nthem. The new constructor does what scopedLambdaRef() did and also\naccepts functors whose call operator is not const, which\nscopedLambdaRef() could not. The last user of the owning form was\nLazyFireDetail, which stored a non-const ScopedLambda\u0026 and so forced its\ncallers to keep one in a variable. I made it a template constrained on\nConstInvocable\u003cvoid(PrintStream\u0026)\u003e that owns its functor instead, which\nis both simpler at its two call sites and removes the borrowed reference\naltogether. opcode_generator.rb now emits forEachArgCustom(functor)\ndirectly. Export ConstInvocable from StdLibExtras.h alongside Invocable\nso it can be named unqualified, and drop the WTF:: qualification in\nDFGForAllKills.h accordingly.\n\nTest: Tools/TestWebKitAPI/Tests/WTF/ScopedLambda.cpp\nCanonical link: https://commits.webkit.org/319727@main", "email": "keith_miller@apple.com", "hash": "f057e7bc12bee1ce5870e2a290f3658bf186d477", "subject": "Clean up ScopedLambda API for modern C++" }, "319728@main": { "author": "Ryosuke Niwa", "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64", "cl": "319728@main", "clUrl": "https://commits.webkit.org/319728@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322431\n\nReviewed by Tim Nguyen.\n\nIncrease the fuzziness so that the test passes with site isolation enabled.\n\n* LayoutTests/fast/selectors/text-field-selection-stroke-color.html:\n\nCanonical link: https://commits.webkit.org/319728@main", "email": "rniwa@webkit.org", "hash": "05e712cb260eb0655c71a2e6c263f290257e0119", "subject": "[Site Isolation] fast/selectors/text-field-selection-stroke-color.html" } }, "date": "2026-08-24", "days": 1, "generatedAt": "2026-08-24T22:05:58Z", "markdown": "## Highlights\n- **Security** Fixed a use-after-free in ImageLoader event dispatch, closing a real memory safety hole in core loading paths. [commit 319690@main](https://commits.webkit.org/319690@main)\n- **Networking** Made NetworkProcess a singleton again, a significant process-model change with broad impact on isolation, lifecycle, and resource handling. [commit 319714@main](https://commits.webkit.org/319714@main)\n- **Site Isolation** Fixed cross-origin iframes disappearing after back navigation, restoring a high-visibility correctness path for embedded content. [commit 319724@main](https://commits.webkit.org/319724@main)\n- **Security** Resynced BoringSSL to M152, pulling in upstream crypto and protocol fixes. [commit 319685@main](https://commits.webkit.org/319685@main)\n- **Perf** Landed two JSC compiler speedups for register allocation and spill cleanup, shaving overhead in backend optimization passes. [commit 319706@main](https://commits.webkit.org/319706@main)\n- **Web Platform** Fixed document named properties exposedness filtering for object and embed, aligning behavior more closely with the platform model. [commit 319699@main](https://commits.webkit.org/319699@main)\n- **Rendering** Landed multiple margin-collapsing fixes in block-in-inline and anonymous block removal, improving layout correctness in tricky edge cases. [commit 319697@main](https://commits.webkit.org/319697@main)\n- **Media** Fixed AudioBufferSourceNode start offset handling for negative playbackRate, correcting a real Web Audio behavior bug. [commit 319674@main](https://commits.webkit.org/319674@main)\n- **Build** Raised the floor to GCC 13.1.0 and continued the safer C++ push, tightening toolchain assumptions across the tree. [commit 319695@main](https://commits.webkit.org/319695@main)\n\n## What landed by area\n\n### JavaScriptCore and WTF\n- **V8** Pinned upstream checks that DFG IRO range proofs rely on, reducing the chance of optimizer assumptions drifting out of sync. [commit 319726@main](https://commits.webkit.org/319726@main)\n- **V8** Refreshed AI state when folding GetScope to Identity in JSC, fixing optimizer bookkeeping. [commit 319719@main](https://commits.webkit.org/319719@main)\n- **V8** Fixed B3 ReduceStrength Select specialization when an intervening Check breaks the expected pattern. [commit 319718@main](https://commits.webkit.org/319718@main)\n- **Perf** Made FixObviousSpills faster in JSC, trimming backend compile cost. [commit 319711@main](https://commits.webkit.org/319711@main)\n- **Perf** Made Air Greedy RegAlloc faster, another backend throughput win for JSC compilation. [commit 319706@main](https://commits.webkit.org/319706@main)\n- **V8** Fixed BackwardsGraph handling for loops with multiple back-edge sources. [commit 319700@main](https://commits.webkit.org/319700@main)\n- **Build** Fixed build failures when JIT is disabled. [commit 319698@main](https://commits.webkit.org/319698@main)\n- **Refactor** Switched WTF to use standard std::expected instead of the old std::experimental::expected shim. [commit 319681@main](https://commits.webkit.org/319681@main)\n- **Security** Handled overflows in UnlinkedMetadataTable::finalize(), tightening parser and metadata robustness. [commit 319678@main](https://commits.webkit.org/319678@main)\n- **V8** Fixed DFG Uint32Array load speculation to account for the Int32 path. [commit 319669@main](https://commits.webkit.org/319669@main)\n- **Refactor** Cleaned up ScopedLambda for modern C++, simplifying a core utility API. [commit 319727@main](https://commits.webkit.org/319727@main)\n- **Refactor** Switched BitSet concurrentTestAndSet and concurrentTestAndClear to exchangeOr and exchangeAnd. [commit 319720@main](https://commits.webkit.org/319720@main)\n- **Build** Adopted C++20 Concepts in wtf/TypeTraits.h. [commit 319707@main](https://commits.webkit.org/319707@main)\n\n### Site Isolation, process model, and IPC\n- **UI** Fixed cross-origin iframe rendering after back navigation. [commit 319724@main](https://commits.webkit.org/319724@main)\n- **UI** Fixed macOS autoscroll inside cross-origin iframes. [commit 319723@main](https://commits.webkit.org/319723@main)\n- **Media** Fixed a UI-process crash in MediaSessionManagerCocoa when audio output changes after the last media session is removed. [commit 319716@main](https://commits.webkit.org/319716@main)\n- **Networking** Made NetworkProcess a singleton again. [commit 319714@main](https://commits.webkit.org/319714@main)\n- **Refactor** Removed failing Site Isolation expectations for suspend-timers and file-reader BFCache tests while the underlying issues are sorted out. [commit 319713@main](https://commits.webkit.org/319713@main)\n- **UI** Fixed a constant crash in CrossOriginPopup SiteIsolation API tests. [commit 319705@main](https://commits.webkit.org/319705@main)\n- **Security** Fixed a MESSAGE_CHECK failure in WebLockRegistryProxy::requestLock for a worker registered by a third-party frame. [commit 319692@main](https://commits.webkit.org/319692@main)\n- **Perf** Avoided an out-of-line call on every stream IPC send when checking signpost state. [commit 319680@main](https://commits.webkit.org/319680@main)\n- **Refactor** Changed WebPage and WebPageProxy selectWithGesture to return a result struct instead of separate values. [commit 319671@main](https://commits.webkit.org/319671@main)\n- **Refactor** Switched cleanup code to ask whether a document is fully active rather than whether it has a render tree. [commit 319668@main](https://commits.webkit.org/319668@main)\n\n### Rendering, layout, canvas, and SVG\n- **Rendering** Renamed SVGSVGElement::scrollToFragment and resetScrollAnchor for clearer SVG fragment navigation semantics. [commit 319725@main](https://commits.webkit.org/319725@main)\n- **Rendering** Fixed margin collapsing after a self-collapsing block-level box on a line. [commit 319697@main](https://commits.webkit.org/319697@main)\n- **Rendering** Fixed adjoining margin collapse when the container's first child is a float or out-of-flow box. [commit 319696@main](https://commits.webkit.org/319696@main)\n- **Rendering** Extended WPT coverage for svgview() fragment identifiers. [commit 319689@main](https://commits.webkit.org/319689@main)\n- **Rendering** Fixed non-scaling-stroke using the wrong reference coordinate system in LBSE. [commit 319688@main](https://commits.webkit.org/319688@main)\n- **Perf** Avoided a redundant matrix multiply in SVGTransformList::concatenate(). [commit 319687@main](https://commits.webkit.org/319687@main)\n- **UI** Fixed number input spin buttons failing to repaint when window active state changes. [commit 319683@main](https://commits.webkit.org/319683@main)\n- **Rendering** Fixed CanvasNoiseInjection leaving dirty rects uncleared when the dirty region is fully transparent. [commit 319682@main](https://commits.webkit.org/319682@main)\n- **Security** Reworked cssCanvasClients() away from a set of raw Element pointers. [commit 319679@main](https://commits.webkit.org/319679@main)\n- **Rendering** Fixed 2D canvas beginLayer() resetting shadowColor to opaque black and re-parsing constant strings. [commit 319675@main](https://commits.webkit.org/319675@main)\n- **Rendering** Fixed canDrawText() taking references on both fill and stroke gradients when only one is actually used. [commit 319670@main](https://commits.webkit.org/319670@main)\n- **Security** Removed unsafe buffer usage exemptions from BitmapTexture in TextureMapper. [commit 319701@main](https://commits.webkit.org/319701@main)\n\n### Media, audio, and graphics\n- **GPU** Moved ownership of CoordinatedPlatformLayerBufferProxy from the media player to the graphics layer in CoordinatedGraphics. [commit 319694@main](https://commits.webkit.org/319694@main)\n- **Security** Restored export of WebCore::ISOOriginalFormatBox::parse() after a regression, unbreaking callers that depend on it. [commit 319691@main](https://commits.webkit.org/319691@main)\n- **Media** Fixed a wireless playback route-deactivate regression that broke pause behavior tests. [commit 319677@main](https://commits.webkit.org/319677@main)\n- **Mobile** Fixed MediaPlayerPrivateWirelessPlayback fast seek behavior on iOS. [commit 319676@main](https://commits.webkit.org/319676@main)\n- **Media** Fixed AudioBufferSourceNode ignoring start() offset when playbackRate is negative. [commit 319674@main](https://commits.webkit.org/319674@main)\n- **Build** Resynced libyuv to M152. [commit 319684@main](https://commits.webkit.org/319684@main)\n\n### Networking, loading, and platform behavior\n- **Networking** Fixed HTTP/2 and HTTP/3 API tests timing out on iOS. [commit 319712@main](https://commits.webkit.org/319712@main)\n- **Security** Fixed a use-after-free in ImageLoader::dispatchPendingLoadEvent and dispatchPendingErrorEvent. [commit 319690@main](https://commits.webkit.org/319690@main)\n- **Privacy** Stopped logging the Launch Services check-in info dictionary on every WebContent process launch. [commit 319672@main](https://commits.webkit.org/319672@main)\n\n### Web Platform and DOM behavior\n- **Web Platform** Document named properties no longer filter object and embed elements by exposedness. [commit 319699@main](https://commits.webkit.org/319699@main)\n- **Web Platform** Fixed text-field-selection-stroke-color in Site Isolation test coverage. [commit 319728@main](https://commits.webkit.org/319728@main)\n\n### Build, tooling, Swift, and infrastructure\n- **Build** Enabled SuppressedAssociatedTypes Swift compiler flags for Swift in WebKit. [commit 319721@main](https://commits.webkit.org/319721@main)\n- **Build** Prepared safer C++ tooling for the 2026-08-21 Swift toolchain. [commit 319717@main](https://commits.webkit.org/319717@main)\n- **Build** Updated safer C++ expectations for 2026-08-24. [commit 319709@main](https://commits.webkit.org/319709@main)\n- **DevTools** Added --exit-after-n-failures to run-api-tests for faster failure loops in local and CI runs. [commit 319704@main](https://commits.webkit.org/319704@main)\n- **Security** Removed unsafe buffer usage exemptions from WOFFFileFormat. [commit 319702@main](https://commits.webkit.org/319702@main)\n- **Build** Required GCC 13.1.0 and removed dead compatibility checks for older GCC versions. [commit 319695@main](https://commits.webkit.org/319695@main)\n- **Build** Removed Bugzilla patch workflow support from webkit-patch. [commit 319693@main](https://commits.webkit.org/319693@main)\n- **Build** Fixed a SwiftUI \"cannot conform to protocol\" build error. [commit 319686@main](https://commits.webkit.org/319686@main)\n- **Build** Added support for running Safari with a CMake-built WebKit. [commit 319673@main](https://commits.webkit.org/319673@main)\n- **Build** Removed Bugzilla patch workflow support from ews-build.webkit.org. [commit 319722@main](https://commits.webkit.org/319722@main)\n- **Build** Safer C++ EWS queues now blame unchanged files when results-db has no result for a test. [commit 319710@main](https://commits.webkit.org/319710@main)\n\n### iOS and text extraction\n- **Mobile** Fixed an iOS Automatically Fix Passwords timeout when filling old, new, and confirmation fields on a locked device. [commit 319708@main](https://commits.webkit.org/319708@main)\n- **Mobile** Fixed a regression from 319551@main that broke iOS 26.6. [commit 319715@main](https://commits.webkit.org/319715@main)\n\n## Reverts \u0026 Reapplies\n\nNo reverts or reapplies landed in this window.", "repo": "webkit", "repoDisplay": "WebKit", "rollGroups": [ { "name": "Versioning.", "count": 1 } ], "since": "2026-08-24", "totals": { "commits": 61, "features": 60, "rolls": 1 }, "until": "2026-08-24" }