{
  "commits": {
    "319729@main": {
      "author": "Tim Nguyen",
      "avatar": "https://www.gravatar.com/avatar/208c05ac2decdf818a4a08ada568328e?d=identicon\u0026s=64",
      "cl": "319729@main",
      "clUrl": "https://commits.webkit.org/319729@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322304\nrdar://129315085\n\nReviewed by Abrar Rahman Protyasha and Megan Gardner.\n\nA bunch of methods were in WebPageProxy related to the caps lock indicator were not site isolation friendly.\n\nMake them query information from the correct frame. For firstRectForCharacterRangeAsync, also perform some coordinate conversion.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::hasMarkedText):\n(WebKit::WebPageProxy::isMarkedTextRequiredForComposition):\n(WebKit::WebPageProxy::getMarkedRangeAsync):\n(WebKit::WebPageProxy::getSelectedRangeAsync):\n(WebKit::WebPageProxy::firstRectForCharacterRangeAsync):\n(WebKit::WebPageProxy::sendWithAsyncReplyToFocusedOrMainFrameProcess):\n(WebKit::WebPageProxy::characterIndexForPointAsync):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::TEST(SiteIsolation, FirstRectForCharacterRangeInCrossOriginIframe)):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n\nCanonical link: https://commits.webkit.org/319729@main",
      "email": "ntim@apple.com",
      "hash": "c42ab29ab466360a5f827aaaec0ee3bfdec391b2",
      "subject": "[Site Isolation] Caps lock indicator does not work properly in cross-origin iframe"
    },
    "319730@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319730@main",
      "clUrl": "https://commits.webkit.org/319730@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322325\nrdar://185567540\n\nReviewed by Ryosuke Niwa.\n\nElement::focus() returns early for an element that is not programmatically\nfocusable. That is wrong for the document element, because the focusing steps\nfirst substitute the focusable area:\n\n    If new focus target is not a focusable area, then set new focus target to the\n    result of getting the focusable area for new focus target, given focus trigger\n    if it was passed.\n\nand getting the focusable area has a clause for it:\n\n    If focus target is the document element of its Document\n\n    If focus target is the document element of its Document\n        Return the Document's viewport.\n\nhttps://html.spec.whatwg.org/multipage/interaction.html#get-the-focusable-area\n\nThe result is non-null, so the focusing steps proceed and focus moves to the\nviewport. The spec makes this explicit in the note on blur(): \"if you want to\nfocus the viewport, call the focus() method on the Document's document element.\"\nWe instead left the previously focused element focused.\n\nThe \"element with one or more scrollable regions\" clause of getting the focusable\narea is still not implemented; only the document element case is handled here.\n\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-closedby-corner-cases-expected.txt: Progression\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-closedby-corner-cases-expected.txt: Removed.\n* Source/WebCore/dom/Element.cpp:\n(WebCore::Element::focus):\n\nCanonical link: https://commits.webkit.org/319730@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "569bafdafba6da329c22c4ef9437b1a95832b1b1",
      "subject": "documentElement.focus() should move focus to the viewport instead of doing nothing"
    },
    "319731@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "319731@main",
      "clUrl": "https://commits.webkit.org/319731@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322439\nrdar://185720499\n\nReviewed by Yijia Huang.\n\nWe are cleaning up Wasm Type registry whenever destroying Wasm Modules.\nBut this is happening too much. We should batch them by destroying many\nWasm Modules. We put a global flag (becuase Wasm Type registry is\nglobal), and doing clean up when it is set in GC end epilogue / VM\nshutdown timing.\n\n* Source/JavaScriptCore/heap/Heap.cpp:\n(JSC::Heap::lastChanceToFinalize):\n(JSC::Heap::clearConcurrentRetainedDataIfPossible):\n* Source/JavaScriptCore/wasm/WasmTypeDefinition.cpp:\n(JSC::Wasm::TypeInformation::requestCleanup):\n(JSC::Wasm::TypeInformation::cleanupIfRequested):\n* Source/JavaScriptCore/wasm/WasmTypeDefinition.h:\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.cpp:\n(JSC::JSWebAssemblyModule::destroy):\n\nCanonical link: https://commits.webkit.org/319731@main",
      "email": "ysuzuki@apple.com",
      "hash": "f479ae9f534c9e093b97fad9c186f4c2d8513f45",
      "subject": "[JSC] Do not clean up Wasm Type registry repeatedly"
    },
    "319732@main": {
      "author": "Sihui Liu",
      "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64",
      "cl": "319732@main",
      "clUrl": "https://commits.webkit.org/319732@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322285\nrdar://185522165\n\nReviewed by Per Arne Vollan.\n\nWhen cross-site subframe navigation that swaps process happens, it is noted that event handlers of pageswap, pagehide\nor unload event don't run or don't run to completion. This is observable especially when the even handler post message.\nThis is because WebFrameProxy::commitProvisionalFrame() sends LoadDidCommitInAnotherProcess to the outgoing process and\nthen immediately calls setProcess(), destroying the frame's old FrameProcess while that message is still in flight. That\ndisconnects the process's RemotePageProxy, so anything a handler sends arrives in the UI process with no receiver, and\nit shuts the process down outright when this was its last frame.\n\nTo fix this, give LoadDidCommitInAnotherProcess message an async reply and let UI process release the reference of the\nold FrameProcess after receiving reply. On the receiver web process site, dispatching pageswap and, through\nFrameTree::replaceChild() -\u003e detachFromParent() -\u003e  closeURL(), pagehide and unload, all happen before the reply is\nsent. Since a web process can hang itself from inside one of those handlers (e.g. not sending the reply), the reference\nin UI process side also expires after a second.\n\nThis fix helps remove a FIXME in API test SiteIsolation.Events, and ensures the test has the same behavior in both full\nSI and shared process mode.\n\n* Source/WebKit/UIProcess/WebFrameProxy.cpp:\n(WebKit::FrameProcessRefWithExpiration::create):\n(WebKit::FrameProcessRefWithExpiration::FrameProcessRefWithExpiration):\n(WebKit::WebFrameProxy::commitProvisionalFrame):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::commitProvisionalPage):\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::loadDidCommitInAnotherProcess):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.messages.in:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, Events)):\n\nCanonical link: https://commits.webkit.org/319732@main",
      "email": "sihui_liu@apple.com",
      "hash": "9bff36df8c41a76485e23c663255b827edd84e16",
      "subject": "[Site Isolation] Frame process is terminated before pageswap and unload event handlers run"
    },
    "319733@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "319733@main",
      "clUrl": "https://commits.webkit.org/319733@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322434\n\nReviewed by Geoffrey Garen.\n\nUpdate clang/Swift toolchain used on safer C++ macOS bot to\nswift-DEVELOPMENT-SNAPSHOT-2026-08-21-a.\n\n* Tools/CISupport/safer-cpp-swift-version:\n\nCanonical link: https://commits.webkit.org/319733@main",
      "email": "rniwa@webkit.org",
      "hash": "d611fcfa40f1f8b87c54700d6ac6e55518a9d040",
      "subject": "Update Swift toolchain on macOS to 2026-08-21-a"
    },
    "319734@main": {
      "author": "Ari Young",
      "avatar": "https://www.gravatar.com/avatar/0cd464869823d95556c74fd9f9419f92?d=identicon\u0026s=64",
      "cl": "319734@main",
      "clUrl": "https://commits.webkit.org/319734@main",
      "description": "rdar://183166336\nhttps://bugs.webkit.org/show_bug.cgi?id=322309\n\nReviewed by Brian Weinstein.\n\nAdd implementations for `close(...)` and `getLayout(...)` sidePanel API methods. `getLayout()`\nreports which side the panel is on through a new `WebExtensionSidebarSide` enum and an optional\ncontroller-delegate method. `close()` now backs both the argument-less `sidebarAction.close()` and\nthe identifier-scoped `sidePanel.close()` over one `SidebarClose` message, so the tab resolution and\noption parsing shared with `open()` moved into helpers. This patch also adds tests for these new\nmethod, and factor shared code out of new/existing tests.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPISidebar.mm\n\n* Source/WebKit/Scripts/webkit/messages.py:\n(types_that_cannot_be_forward_declared):\n    WebExtensionSidebarSide must be listed here to prevent the generator from forward-declaring it,\n    since it's an enum.\n(headers_for_type):\n    Map WebExtensionSidebarSide to its header, since it's in WebExtensionSidebarParameters.h rather\n    than a file with the same name as the type.\n* Source/WebKit/Shared/Extensions/WebExtensionSidebarParameters.h:\n* Source/WebKit/Shared/Extensions/WebExtensionSidebarParameters.serialization.in:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebExtensionControllerDelegatePrivate.h:\n* Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPISidebarCocoa.mm:\n(WebKit::getTabFromIdentifiers):\n(WebKit::WebExtensionContext::sidebarOpen):\n(WebKit::WebExtensionContext::sidebarClose):\n(WebKit::WebExtensionContext::sidebarGetLayout):\n(WebKit::WebExtensionContext::sidebarToggle):\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.h:\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.messages.in:\n* Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPISidePanelCocoa.mm:\n(WebKit::parseRequiredTabOrWindowIdentifiers):\n(WebKit::WebExtensionAPISidePanel::open):\n(WebKit::WebExtensionAPISidePanel::close):\n(WebKit::WebExtensionAPISidePanel::getLayout):\n* Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPISidebarActionCocoa.mm:\n(WebKit::WebExtensionAPISidebarAction::close):\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPISidePanel.h:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPISidePanel.idl:\n* Tools/TestWebKitAPI/Helpers/cocoa/TestWebExtensionsDelegate.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/TestWebExtensionsDelegate.mm:\n(-[TestWebExtensionsDelegate _webExtensionController:sidebarSideForExtensionContext:]):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPISidebar.mm:\n(TestWebKitAPI::SidebarCallCounts::create):\n(TestWebKitAPI::installSidebarCallCounters):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidebarActionOpenFailsWithoutUserGesture)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidebarActionCloseFailsWithoutUserGesture)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidebarActionToggleFailsWithoutUserGesture)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidebarActionToggleSucceedsWithUserGesture)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidePanelAPIAvailableWhenManifestRequests)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidePanelAPIDisallowsMissingArguments)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidePanelOpenForTabFailsWithoutUserGesture)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidePanelOpenForWindowFailsWithoutUserGesture)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidePanelCloseRequiresTabOrWindow)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidePanelCloseForTabClosesTabPanel)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidePanelCloseForWindowClosesGlobalPanel)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidePanelCloseForTabRejectsWhenOnlyGlobalOpen)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidePanelCloseIsNoOpWhenAlreadyClosed)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPISidebar, SidePanelGetLayoutReturnsSide)):\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionContextCocoa.mm:\n(WebKit::WebExtensionContext::getTabFromIdentifiers const):\n\nCanonical link: https://commits.webkit.org/319734@main",
      "email": "ari_young@apple.com",
      "hash": "97d426ec6562e61f2cac3aef1869f863ff18a0b3",
      "subject": "sidePanel API is missing features from newer Chrome versions"
    },
    "319735@main": {
      "author": "Roberto Rodriguez",
      "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64",
      "cl": "319735@main",
      "clUrl": "https://commits.webkit.org/319735@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=319507\nrdar://177955302\n\nReviewed by Dan Glastonbury.\n\nWhen drawing indexed geometry with a base vertex, the GPU reads each vertex at\n(index + baseVertex), but validation only checks the index against the size of the\nbound vertex buffers and ignores baseVertex. A small, in-range index buffer combined\nwith a large baseVertex therefore passes validation while the GPU reads past the end\nof the buffer, an out-of-bounds read in the GPU process. This is only reachable when\nthe WebGL draft extensions setting is enabled, which is off by default.\n\nFix by passing baseVertex into the shared draw-elements validation and checking the\neffective range (index + baseVertex), rejecting a draw whose largest effective index\nis past the buffer or whose smallest effective index is negative. Every base-vertex\nentry point now forwards its baseVertex and the others pass 0, so ordinary draws are\nunchanged.\n\nTest: fast/canvas/webgl/draw-elements-base-vertex-out-of-bounds.html\n\n* LayoutTests/fast/canvas/webgl/draw-elements-base-vertex-out-of-bounds-expected.txt: Added.\n* LayoutTests/fast/canvas/webgl/draw-elements-base-vertex-out-of-bounds.html: Added.\n* LayoutTests/platform/ios/TestExpectations:\n* Source/ThirdParty/ANGLE/src/libANGLE/ErrorStrings.h:\n* Source/ThirdParty/ANGLE/src/libANGLE/validationES.cpp:\n(gl::ValidateDrawElementsInstancedBase):\n(gl::ValidateDrawElementsInstancedANGLE):\n(gl::ValidateDrawElementsInstancedEXT):\n* Source/ThirdParty/ANGLE/src/libANGLE/validationES.h:\n(gl::ValidateDrawElementsCommon):\n* Source/ThirdParty/ANGLE/src/libANGLE/validationES2.h:\n(gl::ValidateDrawElements):\n* Source/ThirdParty/ANGLE/src/libANGLE/validationES3.cpp:\n(gl::ValidateDrawRangeElements):\n(gl::ValidateDrawElementsInstanced):\n(gl::ValidateMultiDrawElementsInstancedANGLE):\n(gl::ValidateDrawElementsInstancedBaseVertexBaseInstanceANGLE):\n(gl::ValidateMultiDrawElementsInstancedBaseVertexBaseInstanceANGLE):\n* Source/ThirdParty/ANGLE/src/libANGLE/validationES32.cpp:\n(gl::ValidateDrawElementsBaseVertex):\n(gl::ValidateDrawElementsInstancedBaseVertex):\n(gl::ValidateDrawRangeElementsBaseVertex):\n* Source/ThirdParty/ANGLE/src/libANGLE/validationESEXT.cpp:\n(gl::ValidateDrawElementsBaseVertexEXT):\n(gl::ValidateDrawElementsInstancedBaseVertexEXT):\n(gl::ValidateDrawRangeElementsBaseVertexEXT):\n(gl::ValidateDrawElementsInstancedBaseInstanceEXT):\n(gl::ValidateDrawElementsInstancedBaseVertexBaseInstanceEXT):\n(gl::ValidateDrawElementsBaseVertexOES):\n(gl::ValidateDrawElementsInstancedBaseVertexOES):\n(gl::ValidateDrawRangeElementsBaseVertexOES):\n* Source/ThirdParty/ANGLE/src/tests/gl_tests/DrawElementsTest.cpp:\n\nOriginally-landed-as: 305413.1122@safari-7624.5-branch (e21200a08a7a). rdar://185366919\nCanonical link: https://commits.webkit.org/319735@main",
      "email": "roberto_rodriguez2@apple.com",
      "hash": "bb5740819e68ae4a2d5c60613861f559f05e7b4b",
      "subject": "[ANGLE] drawElements*BaseVertex* does not check baseVertex against the vertex buffer size"
    },
    "319736@main": {
      "author": "Issac Roy",
      "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64",
      "cl": "319736@main",
      "clUrl": "https://commits.webkit.org/319736@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321199\nrdar://184257084\n\nReviewed by Sam Sneddon.\n\nBranch.ensure_issue already resolves a bare bug ID, but the prompt only\noffered \"issue URL or title of new issue\", so nobody knew. It also offered\n\"(or issue URL)\" when no tracker is configured, where a URL does not resolve\neither.\n\nAdvertise a bug ID only when one can actually be resolved, which excludes\nredacted changes and trackers that hide titles:\n\n    Enter issue URL, bug ID, or title of new issue:\n    Enter issue URL or title of new issue:\n    Enter name of new branch:\n\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/branch.py:\n(Branch.ensure_issue):\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/test/branch_unittest.py:\n(TestBranch.test_prompt_git):\n(TestBranch.test_prompt_number):\n(TestBranch.test_prompt_url):\n(TestBranch.test_automatic_radar_cc):\n(TestBranch.test_manual_radar_cc):\n(TestBranch.test_manual_radar_cc_integer):\n(TestBranch.test_manual_radar_cc_http):\n(TestBranch.test_radar_cc_disabled):\n(TestBranch.test_radar_cc_disabled_override):\n(TestBranch.test_no_cc_radar):\n(TestBranch.test_redacted):\n(TestBranch.test_create_bug):\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/test/pull_request_unittest.py:\n\nCanonical link: https://commits.webkit.org/319736@main",
      "email": "issacroy05@gmail.com",
      "hash": "a95eeddb2c1315627474b16b2b0576851d74b9fd",
      "subject": "[webkitscmpy] Issue prompt doesn't mention that a bug ID is accepted"
    },
    "319737@main": {
      "author": "Ben Nham",
      "avatar": "https://www.gravatar.com/avatar/dc0914eabf69047ee3397794c2d17bf7?d=identicon\u0026s=64",
      "cl": "319737@main",
      "clUrl": "https://commits.webkit.org/319737@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322449\nrdar://185731738\n\nReviewed by Tim Horton.\n\nFix the capitalization of the MiniBrowser bundle id for the cmake build.\n\nAdditionally, we should make the isMiniBrowser checks pass for SwiftBrowser as well.\n\n* Tools/MiniBrowser/mac/CMakeLists.txt:\n* Source/WTF/wtf/cocoa/RuntimeApplicationChecksCocoa.mm:\n(WTF::MacApplication::isMiniBrowser):\n(WTF::IOSApplication::isMiniBrowser):\n\nCanonical link: https://commits.webkit.org/319737@main",
      "email": "nham@apple.com",
      "hash": "fa83add6341fdf1286b95724cb93df29cbe6b5b7",
      "subject": "Fix CMake MiniBrowser bundle id"
    },
    "319738@main": {
      "author": "Issac Roy",
      "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64",
      "cl": "319738@main",
      "clUrl": "https://commits.webkit.org/319738@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=286603\nrdar://144089048\n\nReviewed by Sam Sneddon.\n\nTwo loops in the timeline were quadratic in the number of commits, which\ndominates page load when many configurations are displayed.\n\ncommitsForResults() merged each candidate commit into a sorted array by\nscanning from index 0, restarting that scan for every result. Collect commits\nin a Map keyed by uuid and sort once at the end instead.\n\nscaleForCommits() grew its result with unshift(), which moves every existing\nelement. The scale has the same length and indices as commits, so preallocate\nit and fill in place.\n\n* Tools/Scripts/libraries/resultsdbpy/resultsdbpy/view/static/js/timeline.js:\n(commitsForResults):\n(scaleForCommits):\n\nCanonical link: https://commits.webkit.org/319738@main",
      "email": "issacroy05@gmail.com",
      "hash": "f486b35a0a3a1560336597ee9d8bcb120550b4e5",
      "subject": "[Results DB] Really slow with large numbers of configurations"
    },
    "319739@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319739@main",
      "clUrl": "https://commits.webkit.org/319739@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322376\nrdar://185660088\n\nReviewed by Gerald Squelart.\n\npostProcessPixelBufferResults() took Ref\u003cPixelBuffer\u003e\u0026\u0026 but never moved or\nstored it: it forwarded to CanvasNoiseInjection::postProcessPixelBufferResults(),\nwhich takes PixelBuffer\u0026. std::forward on the non-deduced Ref\u003cPixelBuffer\u003e was\njust a cast to rvalue reference. The sole caller passes a PixelBuffer\u0026, so\nevery WebGL getImageData() materialized a temporary Ref for the duration of\nthe call, paying a ref()/deref() pair for nothing.\n\nTake PixelBuffer\u0026 instead. No behavior change.\n\n* Source/WebCore/html/CanvasBase.cpp:\n(WebCore::CanvasBase::postProcessPixelBufferResults const):\n* Source/WebCore/html/CanvasBase.h:\n\nCanonical link: https://commits.webkit.org/319739@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "cc9c3b0efd451fe6af9db9ff55dc20ad660cabe3",
      "subject": "CanvasBase::postProcessPixelBufferResults() takes an rvalue Ref\u003cPixelBuffer\u003e it never moves"
    },
    "319740@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "319740@main",
      "clUrl": "https://commits.webkit.org/319740@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=322273\u003e\n\u003crdar://185442781\u003e\n\nUnreviewed testing fix.\n\nSeveral xcconfig files assign `GCC_PREPROCESSOR_DEFINITIONS` or\n`SWIFT_ACTIVE_COMPILATION_CONDITIONS` without `$(inherited)`.  Both\nsettings may also be set by `CommonBase.xcconfig`, so a target that\nreassigns either one without `$(inherited)` silently discards the\nvalue `CommonBase.xcconfig` contributes -- with no diagnostic, because\na missing definition produces no warning.\n\nAdd `$(inherited)` at every site that overrides one of these two\nsettings.\n\nAdd more checks to check-webkit-style to catch this sooner.\n`BaseXcconfigChecker` only read `CommonBase.xcconfig` itself, so it did\nnot know about the settings `CommonBase.xcconfig` picks up from the\nfiles it includes, and could not flag a clobbered\n`SWIFT_ACTIVE_COMPILATION_CONDITIONS` at all.  Read those files too,\ntaking only the settings they append to, since their other settings\nare implementation details projects may legitimately override.  Require\na standalone `$(inherited)` token, since a nested\n`$(...:default=$(inherited))` is a fallback rather than an append.\nFlag a hard-coded `$(WK_COMMON_\u003cname\u003e)` for a setting that has no such\nvariable, since `$(inherited)` is the only form that preserves the\ninherited value there.  Add\n`basexcconfig/duplicate-commonbase-definitions` to flag a line that\nlists both `$(inherited)` and `$(WK_COMMON_\u003cname\u003e)`, which repeats the\nvalue `$(inherited)` already provides.\n\nSplice `\\` line continuations into one logical line before parsing, so\na continuation line that contains `=` (such as a preprocessor macro\nvalue) is not misread as a separate assignment and does not produce a\nfalse positive.\n\nHave the checker tests supply the `CommonBase.xcconfig` variables\ndirectly rather than reading them from disk, so they are self-contained\nand do not depend on which settings the on-disk `CommonBase.xcconfig`\nhappens to define.\n\nTests: Add 6 tests to webkitpy/style/checkers/basexcconfig_unittest.py.\n\n* Source/JavaScriptCore/Configurations/JavaScriptCore.xcconfig:\n* Source/JavaScriptCore/Configurations/TestExecutable.xcconfig:\n* Source/ThirdParty/ANGLE/Configurations/BaseTarget.xcconfig:\n* Source/ThirdParty/libwebrtc/Configurations/yasm.xcconfig:\n* Source/WTF/Configurations/WTF.xcconfig:\n* Source/bmalloc/Configurations/bmalloc.xcconfig:\n* Tools/DumpRenderTree/mac/Configurations/Base.xcconfig:\n* Tools/ImageDiff/cg/Configurations/Base.xcconfig:\n* Tools/WebKitTestRunner/Configurations/Base.xcconfig:\n- Add missing `$(inherited)`.\n\n* Tools/Scripts/webkitpy/style/checkers/basexcconfig.py:\n(BaseXcconfigChecker.appends_to_inherited_value): Add.\n(BaseXcconfigChecker.logical_lines): Add.\n(BaseXcconfigChecker.assignments): Add.\n(BaseXcconfigChecker.read_xcconfig_variables): Add.\n(BaseXcconfigChecker.included_xcconfig_paths): Add.\n(BaseXcconfigChecker.read_common_base_xcconfig_variables):\n(BaseXcconfigChecker.check):\n* Tools/Scripts/webkitpy/style/checkers/basexcconfig_unittest.py:\n(BaseXcconfigCheckerTest.make_checker): Add.\n(BaseXcconfigCheckerTest.assert_no_error):\n(BaseXcconfigCheckerTest.assert_error):\n(BaseXcconfigCheckerTest.test_gcc_preprocessor_definitions): Add.\n(BaseXcconfigCheckerTest.test_swift_active_compilation_conditions): Add.\n(BaseXcconfigCheckerTest.test_nested_inherited_is_not_an_append): Add.\n(BaseXcconfigCheckerTest.test_duplicate_commonbase_definitions): Add.\n(BaseXcconfigCheckerTest.test_line_continuation_is_not_a_separate_assignment): Add.\n(BaseXcconfigCheckerTest.test_read_xcconfig_variables_joins_line_continuations): Add.\n\nOriginally-landed-as: 316606.432@safari-7625-branch (995bfdbc3a08). rdar://185712704\nCanonical link: https://commits.webkit.org/319740@main",
      "email": "ddkilzer@apple.com",
      "hash": "f16770926abc5eef3280e3715c7a7831ecf3fba7",
      "subject": "Add missing inherited build settings that CommonBase.xcconfig sets"
    },
    "319741@main": {
      "author": "Dana Estra",
      "avatar": "https://www.gravatar.com/avatar/bb57a3e383fc407cd4b341aeef87d877?d=identicon\u0026s=64",
      "cl": "319741@main",
      "clUrl": "https://commits.webkit.org/319741@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322331\nrdar://181244652\n\nReviewed by Jer Noble.\n\nMidjourney's custom fullscreen video mode keeps the webkit presentation\nmode as inline and uses the  default inline media controls. Midjourney exits this mode\nwhen the user clicks outside the video rendering area. However, depending on the size\nof the safari video, the media control bar can end up below the video area. To prevent\nthis from causing the video to exit, we should stop propagation of click events. We already\nstop the propagation of click events for the fullscreen media controls. This patch does the\nsame for the inline controls.\n\nNo new tests.\n\n* Source/WebCore/Modules/modern-media-controls/controls/macos-inline-media-controls.js:\n\nCanonical link: https://commits.webkit.org/319741@main",
      "email": "destra@apple.com",
      "hash": "90d57b61d613e54706f17ee0a21650b2c8f4428f",
      "subject": "midjourney.com: scrubbing the video exits the video presentation"
    },
    "319742@main": {
      "author": "Ian Grunert",
      "avatar": "https://www.gravatar.com/avatar/6a676cf1bcb9ff83c6cd867a0e3a0fa4?d=identicon\u0026s=64",
      "cl": "319742@main",
      "clUrl": "https://commits.webkit.org/319742@main",
      "description": "Unreviewed test gardening.\n\nUpdate Windows expectations from the last 20 completed Win-Tests-EWS runs\n(builds 98613-98655, testing changes between 319581@main and 319601@main).\nEach EWS build tests a different pull request, so tests failing across many\nbuilds are tree issues rather than patch issues.\n\nFifteen tests produced an unexpected result in all 20 runs: six image\nfailures, seven text failures and two timeouts. Mark them accordingly, and\nskip the two timeouts as the file already does for the neighbouring\noffscreen-worker-unsafe-isPointInStroke-call.html. All six image failures\nare reftests, so they cannot be rebaselined - five of them show corner-shape\nnot being applied through the composited path on Windows.\n\nhttp/wpt/user-activation/bless-edge-cases.sub.html crashed in 17 of the 20\nruns and http/wpt/web-locks/lock-name-length-restriction.https.html crashed\nin two; skip both. Skipping bless-edge-cases.sub.html lets the run reach\nbless-nested.sub.html, which then crashes the GPU process, so skip it too.\n\nAlso skip fast/webcodecs/audio-data-copy-to-zero-frames-crash.html, added\nrecently alongside audio-data-copy-to-crash.html. It fails with \"Can't find\nvariable: AudioData\" because WEB_CODECS is disabled on Windows, so it goes\nin that section next to its sibling rather than with the gardening above.\n\n* LayoutTests/platform/win/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319742@main",
      "email": "ian.grunert@gmail.com",
      "hash": "b3a499630be0446522dac3ddb225fd7567ee779b",
      "subject": "[Win] Unreviewed test gardening"
    },
    "319743@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "319743@main",
      "clUrl": "https://commits.webkit.org/319743@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322244\n\nReviewed by Daniel Liu.\n\nA group quantified with anything other than {1} or ? inside a lookbehind, e.g. (?\u003c=(?:ab)+),\nsent the whole pattern to the interpreter.\n\nThe counted and ParenContext group opcodes only save, compare and restore the index, so they\nwork in either direction. Two checks did depend on it: the lazy group's \"try one more iteration\"\ntest must see the index move down when matching backward, and the optional copy the parser\nsplits a backward X{n,m} into must not clear the captures it shares with the mandatory part\nwhen it backtracks out of zero iterations. Forward code generation is unchanged.\n\n                                                 Baseline                  Patched\n\nregexp-lookbehind-quantified-group         2598.3586+-382.2034   ^    200.9308+-11.4910       ^ definitely 12.9316x faster\nregexp-lookbehind-fixed-count-group        3523.6885+-262.9262   ^    218.0944+-3.0137        ^ definitely 16.1567x faster\n\nTests: JSTests/microbenchmarks/regexp-lookbehind-fixed-count-group.js\n       JSTests/microbenchmarks/regexp-lookbehind-quantified-group.js\n       JSTests/stress/regexp-lookbehind-jit-quantified-groups-unicode.js\n       JSTests/stress/regexp-lookbehind-jit-quantified-groups.js\n\n* JSTests/microbenchmarks/regexp-lookbehind-fixed-count-group.js: Added.\n(let.re):\n* JSTests/microbenchmarks/regexp-lookbehind-quantified-group.js: Added.\n* JSTests/stress/regexp-lookbehind-jit-quantified-groups-unicode.js: Added.\n(shouldBe):\n(stringify):\n(stringifyIndices):\n(shouldBe.stringify):\n(a.z):\n(shouldBe.stringify.y):\n(c.u.exec):\n(shouldBe.string_appeared_here.replace):\n(shouldBe.stringifyIndices):\n(shouldBe.stringifyIndices.y):\n* JSTests/stress/regexp-lookbehind-jit-quantified-groups.js: Added.\n(shouldBe):\n(stringify):\n(stringifyIndices):\n(shouldBe.stringify):\n(shouldBe.stringify.y):\n(shouldBe.stringify.y.yb):\n(shouldBe.stringify.x):\n(b.exec):\n(shouldBe.string_appeared_here.replace):\n(shouldBe.stringifyIndices):\n(shouldBe.stringifyIndices.y):\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n* Source/JavaScriptCore/yarr/YarrPattern.cpp:\n(JSC::Yarr::YarrPatternConstructor::quantifyAtom):\n\nCanonical link: https://commits.webkit.org/319743@main",
      "email": "sosuke@bun.sh",
      "hash": "d21310b806f3d23c9a6c0ea4478221c5eb6eafd7",
      "subject": "[YARR] Compile lookbehinds containing quantified groups in the JIT"
    },
    "319744@main": {
      "author": "Issac Roy",
      "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64",
      "cl": "319744@main",
      "clUrl": "https://commits.webkit.org/319744@main",
      "description": "rdar://183782709\nhttps://bugs.webkit.org/show_bug.cgi?id=320775\n\nReviewed by Sam Sneddon.\n\nresults.webkit.org identifies a configuration by platform, version and\narchitecture, and rejects an upload that cannot supply all three. EWS knows\nneither reliably: architecture comes from the builder configuration, which\nnames what a build queue produces rather than what a tester ran on, so the\nmacOS-Sequoia testers inherit both x86_64 and arm64 and describe a machine\nthat does not exist. GTK and WPE have no OS version worth recording at all,\nsince what identifies a glib result is the port release.\n\nRead the architecture from the machine itself, via uname -m in\nPrintConfiguration, mapping aarch64 to the arm64 spelling results.webkit.org\nstores. Read the port release from SET_PROJECT_VERSION in the checkout's\nOptions{GTK,WPE}.cmake, as its own step: the version comes from the source\ntree, so a failure to resolve a commit identifier says nothing about whether\nit can be read, and neither failure should hide the other. Both are best\neffort, since nothing else in the build depends on either and a queue that\ncannot describe itself simply does not report.\n\n* Tools/CISupport/ews-build/factories.py:\n(Factory.__init__):\n(StyleFactory.__init__):\n(SaferCPPStaticAnalyzerFactory.__init__):\n(CommitQueueFactory.__init__):\n(MergeQueueFactoryBase.__init__):\n* Tools/CISupport/ews-build/factories_unittest.py:\n(TestExpectedBuildSteps):\n* Tools/CISupport/ews-build/steps.py:\n(ShowWebKitVersion):\n(ShowWebKitVersion.__init__):\n(ShowWebKitVersion.doStepIf):\n(ShowWebKitVersion.hideStepIf):\n(ShowWebKitVersion.run):\n(ShowWebKitVersion.getResultSummary):\n(PrintConfiguration):\n(PrintConfiguration.parseAndValidate):\n* Tools/CISupport/ews-build/steps_unittest.py:\n\nCanonical link: https://commits.webkit.org/319744@main",
      "email": "issacroy05@gmail.com",
      "hash": "f8a5ceefaa5c731bcc2ac9d986be53d34dc9e594",
      "subject": "EWS does not record the architecture or WebKit version needed to upload results to results.webkit.org"
    },
    "319745@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "319745@main",
      "clUrl": "https://commits.webkit.org/319745@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322374\n\nReviewed by Yusuke Suzuki.\n\nObject rest destructuring (`const { ...rest } = object`) creates an empty object and\ncalls @copyDataProperties, which replays the source's shape one property at a time\nvia putOwnDataPropertyBatching even when nothing is excluded. This is the situation\n319645@main fixed for Object.assign's batching path.\n\nTry objectCloneFast before enumerating properties when the excluded set is empty.\nThe preconditions of the fast enumeration block already satisfy what objectCloneFast\nrequires, and a non-empty target fails its first check.\n\n                                             Baseline                  Patched\n\nobject-rest-clone                         0.8409+-0.0355     ^      0.5708+-0.0369        ^ definitely 1.4733x faster\n\nTests: JSTests/microbenchmarks/object-rest-clone.js\n       JSTests/stress/object-rest-clone.js\n\n* JSTests/microbenchmarks/object-rest-clone.js: Added.\n* JSTests/stress/object-rest-clone.js: Added.\n(shouldBe):\n(shouldBeArray):\n(makeState):\n(restOnly):\n(restParameter):\n* Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n\nCanonical link: https://commits.webkit.org/319745@main",
      "email": "sosuke@bun.sh",
      "hash": "c9740e5b2bb94d45875c64d3ee4da528f534aeea",
      "subject": "[JSC] Use `objectCloneFast` for object rest destructuring in `@copyDataProperties`"
    },
    "319746@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "319746@main",
      "clUrl": "https://commits.webkit.org/319746@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322453\nrdar://184202868\n\nReviewed by Wenson Hsieh, Aditya Keerthi, and Richard Robinson.\n\nHTMLAttachmentElement opts into editing behavior that the platform\ninteractions do not really understand -- i.e. the shouldSelectOnMouseDown\ncontract. We should allow this contract to override any decision-making\nthat reads the input source when it comes to the event handler allowing\nclicks to modify selections.\n\nTest: AppKitGesturesTests.Basic.singleClickOverAttachmentSelectsTheWholeAttachment\n\n* Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm:\n(WebKit::WebPage::shouldAllowSingleClickToChangeSelection):\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift:\n\nCanonical link: https://commits.webkit.org/319746@main",
      "email": "a_protyasha@apple.com",
      "hash": "1e989cd5f836f38c3616ca35654e26c4aaee6723",
      "subject": "[AppKit Gestures] Clicking over \u003cattachment\u003e does not select the element in Mail compose"
    },
    "319747@main": {
      "author": "Megan Gardner",
      "avatar": "https://www.gravatar.com/avatar/b466a5bcbfabf4d82a8ecc595db5a531?d=identicon\u0026s=64",
      "cl": "319747@main",
      "clUrl": "https://commits.webkit.org/319747@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322227\nrdar://177949036\n\nReviewed by Ryosuke Niwa and Abrar Rahman Protyasha.\n\nIn Mail, type a line, hit Return, type some more, then select all and change the font or size:\nthe font and size selectors go blank.\n\nEditor::fontForSelection decides hasMultipleFonts by comparing the primary font of every node in\nthe selection, and that includes any \u003cbr\u003e. A \u003cbr\u003e that isn't inside a styled wrapper inherits its\nfont from an ancestor, so this comes back as \"multiple\" even though every bit of text is Helvetica:\n\n    \u003cfont face=Helvetica\u003eFirst\u003c/font\u003e\u003cbr\u003e\u003cfont face=Helvetica\u003eSecond\u003c/font\u003e\n\nOn macOS that lands in -[NSFontManager setSelectedFont:isMultiple:], which blanks out the panel's fields.\n\nSo stop letting a line break's font decide this; it contributes no text and shouldn't outvote the text\nthat's actually selected. It's kept as a fallback rather than skipped outright, because a selection\ncontaining only a line break still has to report something — otherwise NSFontAttributeName drops out of\nthe dictionary and clients get empty attributes instead of a merely wrong font.\n\nThis overturns the expectation added in 308562@main, which fixed the neighboring unstyled-wrapper case and\nrecorded the line-break case as reporting multiple fonts. That commit's stated rule was to count only\n\"elements with immediate text node children\", which a \u003cbr\u003e isn't, so the carve-out reads as preserving\nold behavior rather than asking for it, and neither the bug nor the PR says otherwise. It is a real\ntrade: a bare \u003cbr\u003e on a blank line does affect that line's height, so a selection containing one is no\nlonger reported as mixed. For a formatting UI, showing the selected text's font is the more useful answer.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/mac/FontManagerTests.mm\n\n* Source/WebCore/editing/Editor.cpp:\n(WebCore::Editor::fontForSelection):\n* Tools/Scripts/webkitpy/api_tests/allowlist.txt:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/mac/FontManagerTests.mm:\n(TestWebKitAPI::TEST(FontManagerTests, SelectionSpanningBRDoesNotReportMultipleFonts)):\n(TestWebKitAPI::TEST(FontManagerTests, SelectionContainingOnlyBRStillReportsAFont)):\n(TestWebKitAPI::TEST(FontManagerTests, SelectionSpanningBRDoesReportMultipleFonts)): Deleted.\n\nCanonical link: https://commits.webkit.org/319747@main",
      "email": "megan_gardner@apple.com",
      "hash": "7a12760719f1be2057e8d1d6732f9e99a14bd89e",
      "subject": "[Mail]: Formatting does not apply properly to line breaks, causing the selectors to appear blank."
    },
    "319748@main": {
      "author": "Jer Noble",
      "avatar": "https://www.gravatar.com/avatar/6d2cde9be23b98223ca964cb3b7813a0?d=identicon\u0026s=64",
      "cl": "319748@main",
      "clUrl": "https://commits.webkit.org/319748@main",
      "description": "rdar://147337918\nhttps://bugs.webkit.org/show_bug.cgi?id=322217\n\nReviewed by Eric Carlson.\n\nChess.com uses the Element Fullscreen API, without a fallback when that API is not available. Add Chess.com\nto the sites which redirect element.requestFullscreen() to the nearest appropriate video element.\n\nTo do so, add a new IDL qualifier: EnabledBySettingOrQuirk, which enables the API when either setting\nor quirk is true.\n\n* Source/WebCore/bindings/scripts/CodeGeneratorJS.pm:\n(NeedsRuntimeCheck):\n(GenerateRuntimeEnableConditionalString):\n* Source/WebCore/bindings/scripts/IDLAttributes.json:\n* Source/WebCore/bindings/scripts/preprocess-idls.pl:\n(GenerateConstructorAttributes):\n* Source/WebCore/dom/Element+Fullscreen.idl:\n* Source/WebCore/page/Quirks.cpp:\n* LayoutTests/fast/quirks/active-quirks-by-domain-expected.txt:\n* LayoutTests/fast/quirks/active-quirks-by-domain.html:\n* LayoutTests/platform/glib/fast/quirks/active-quirks-by-domain-expected.txt:\n* LayoutTests/platform/ios/fast/quirks/active-quirks-by-domain-expected.txt:\n* LayoutTests/platform/mac-sequoia/fast/quirks/active-quirks-by-domain-expected.txt:\n* LayoutTests/platform/mac-tahoe/fast/quirks/active-quirks-by-domain-expected.txt:\n* Source/WebCore/dom/Document+Fullscreen.idl:\n\nCanonical link: https://commits.webkit.org/319748@main",
      "email": "jer.noble@apple.com",
      "hash": "be959768ec9d9e06978395fdda566f23597d1ef7",
      "subject": "[iPhone] Chess.com: video lessons cannot be put into fullscreen"
    },
    "319749@main": {
      "author": "Dawn Morningstar",
      "avatar": "https://www.gravatar.com/avatar/9b791f3f02553608941e76bb5eecd471?d=identicon\u0026s=64",
      "cl": "319749@main",
      "clUrl": "https://commits.webkit.org/319749@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322352\nrdar://185622585\n\nReviewed by Jonathan Bedard.\n\nLowing the per-simulator memory estimate will allow\nmore simulators to run per machine. Name the CPU\nestimate while we are here.\n\n* Tools/Scripts/webkitpy/xcode/simulated_device.py:\n(SimulatedDeviceManager):\n(SimulatedDeviceManager.max_supported_simulators):\n\nCanonical link: https://commits.webkit.org/319749@main",
      "email": "morningstar@apple.com",
      "hash": "09cd676b90b7a89e96b78ecfa4c4ce634c7264cc",
      "subject": "[webkitpy] Lower the per-simulator memory estimate"
    },
    "319750@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "319750@main",
      "clUrl": "https://commits.webkit.org/319750@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322462\n\nUnreviewed. Update macOS safer C++ expectations after clang/swift toolchain update.\n\n* Source/JavaScriptCore/SaferCPPExpectations/ForwardDeclCheckerExpectations:\n* Source/JavaScriptCore/SaferCPPExpectations/MemoryUnsafeCastCheckerExpectations:\n* Source/JavaScriptCore/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/JavaScriptCore/SaferCPPExpectations/UncheckedCallArgsCheckerExpectations:\n* Source/JavaScriptCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations:\n* Source/JavaScriptCore/SaferCPPExpectations/UncountedLambdaCapturesCheckerExpectations:\n* Source/JavaScriptCore/SaferCPPExpectations/UncountedLocalVarsCheckerExpectations:\n* Source/JavaScriptCore/SaferCPPExpectations/UnretainedCallArgsCheckerExpectations:\n* Source/JavaScriptCore/SaferCPPExpectations/UnretainedLocalVarsCheckerExpectations:\n* Source/WTF/SaferCPPExpectations/MemoryUnsafeCastCheckerExpectations: Added.\n* Source/WTF/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/WTF/SaferCPPExpectations/UncheckedLambdaCapturesCheckerExpectations: Added.\n* Source/WTF/SaferCPPExpectations/UncountedCallArgsCheckerExpectations:\n* Source/WTF/SaferCPPExpectations/UncountedLocalVarsCheckerExpectations:\n* Source/WTF/SaferCPPExpectations/UnretainedCallArgsCheckerExpectations: Added.\n* Source/WebCore/PAL/SaferCPPExpectations/MemoryUnsafeCastCheckerExpectations: Added.\n* Source/WebCore/PAL/SaferCPPExpectations/UnretainedCallArgsCheckerExpectations: Added.\n* Source/WebCore/PAL/SaferCPPExpectations/UnretainedLocalVarsCheckerExpectations: Added.\n* Source/WebCore/SaferCPPExpectations/MemoryUnsafeCastCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/UncheckedCallArgsCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/UncheckedLambdaCapturesCheckerExpectations: Added.\n* Source/WebCore/SaferCPPExpectations/UncheckedLocalVarsCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/UncountedLambdaCapturesCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/UncountedLocalVarsCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/UnretainedCallArgsCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/UnretainedLocalVarsCheckerExpectations:\n* Source/WebGPU/SaferCPPExpectations/UncountedCallArgsCheckerExpectations: Added.\n* Source/WebGPU/SaferCPPExpectations/UncountedLocalVarsCheckerExpectations: Added.\n* Source/WebGPU/SaferCPPExpectations/UnretainedLocalVarsCheckerExpectations:\n* Source/WebKit/SaferCPPExpectations/MemoryUnsafeCastCheckerExpectations: Added.\n* Source/WebKit/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/WebKit/SaferCPPExpectations/UncheckedCallArgsCheckerExpectations:\n* Source/WebKit/SaferCPPExpectations/UncheckedLambdaCapturesCheckerExpectations: Added.\n* Source/WebKit/SaferCPPExpectations/UncheckedLocalVarsCheckerExpectations:\n* Source/WebKit/SaferCPPExpectations/UncountedCallArgsCheckerExpectations:\n* Source/WebKit/SaferCPPExpectations/UncountedLambdaCapturesCheckerExpectations: Added.\n* Source/WebKit/SaferCPPExpectations/UncountedLocalVarsCheckerExpectations:\n* Source/WebKit/SaferCPPExpectations/UnretainedCallArgsCheckerExpectations:\n* Source/WebKit/SaferCPPExpectations/UnretainedLocalVarsCheckerExpectations:\n* Source/WebKitLegacy/SaferCPPExpectations/MemoryUnsafeCastCheckerExpectations:\n* Source/WebKitLegacy/SaferCPPExpectations/UncheckedCallArgsCheckerExpectations:\n* Source/WebKitLegacy/SaferCPPExpectations/UncheckedLambdaCapturesCheckerExpectations: Added.\n* Source/WebKitLegacy/SaferCPPExpectations/UncheckedLocalVarsCheckerExpectations:\n* Source/WebKitLegacy/SaferCPPExpectations/UncountedCallArgsCheckerExpectations:\n* Source/WebKitLegacy/SaferCPPExpectations/UncountedLambdaCapturesCheckerExpectations:\n* Source/WebKitLegacy/SaferCPPExpectations/UncountedLocalVarsCheckerExpectations:\n* Source/WebKitLegacy/SaferCPPExpectations/UnretainedCallArgsCheckerExpectations:\n* Source/WebKitLegacy/SaferCPPExpectations/UnretainedLocalVarsCheckerExpectations:\n\nCanonical link: https://commits.webkit.org/319750@main",
      "email": "rniwa@webkit.org",
      "hash": "ea3dd8bd9889653af60e23e0559de3fadb6f79a0",
      "subject": "Update macOS safer C++ expectations (2026-08-24)"
    },
    "319751@main": {
      "author": "Dawn Morningstar",
      "avatar": "https://www.gravatar.com/avatar/9b791f3f02553608941e76bb5eecd471?d=identicon\u0026s=64",
      "cl": "319751@main",
      "clUrl": "https://commits.webkit.org/319751@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322455\nrdar://185739531\n\nReviewed by Jonathan Bedard.\n\nReducing the number of daemons that are running on\nsimulators greatly reduces their overhead.\n\n* Tools/Scripts/webkitpy/xcode/simulated_device.py:\n(SimulatedDevice.__init__):\n* Tools/Scripts/webkitpy/xcode/simulated_device_unittest.py:\n(LaunchdConfigurationDefaultTest.test_unneeded_daemons_are_disabled_by_default):\n(LaunchdConfigurationDefaultTest):\n(LaunchdConfigurationDefaultTest.test_daemons_testing_needs_are_not_disabled):\n(LaunchdConfigurationDefaultTest.test_chronod_is_disabled_by_default): Deleted.\n* Tools/Scripts/webkitpy/xcode/simulator_daemons.py: Added.\n(disabled_launchd_jobs):\n\nCanonical link: https://commits.webkit.org/319751@main",
      "email": "morningstar@apple.com",
      "hash": "e67102d7ea99731a5093d5fad817d1811073f54b",
      "subject": "reduce the number of daemons running on simulators"
    },
    "319752@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "319752@main",
      "clUrl": "https://commits.webkit.org/319752@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322366\nrdar://183441081\n\nReviewed by Per Arne Vollan.\n\nBump the priority of the IPC receive queue in AuxiliaryProcesses, to\nmatch the priority of the main thread. This is important to avoid\npriority inversion bugs when the main thread is doing a sendSync() and\nthe main thread is thus waiting on IPC.\n\nThis tested as performance neutral on the benchmarks we track.\n\n* Source/WebKit/GPUProcess/GPUProcess.h:\n* Source/WebKit/ModelProcess/ModelProcess.h:\n* Source/WebKit/Platform/IPC/Connection.cpp:\n(IPC::Connection::createClientConnection):\n* Source/WebKit/Platform/IPC/Connection.h:\n* Source/WebKit/Shared/AuxiliaryProcess.cpp:\n(WebKit::AuxiliaryProcess::initialize):\n* Source/WebKit/Shared/AuxiliaryProcess.h:\n(WebKit::AuxiliaryProcess::connectionReceiveQueueQOS const):\n* Source/WebKit/WebProcess/WebProcess.h:\n\nCanonical link: https://commits.webkit.org/319752@main",
      "email": "cdumez@apple.com",
      "hash": "75a56647b267d300489fa57013b2ac73d4ee0851",
      "subject": "Bump the priority of the IPC receive queue in AuxiliaryProcesses"
    },
    "319753@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "319753@main",
      "clUrl": "https://commits.webkit.org/319753@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322382\n\nReviewed by Tim Nguyen.\n\nResync domparsing WPT tests from upstream@83b63594532f89d8949a.\n\n* LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-scripting-support-disabled-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-scripting-support-disabled.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/domparsing/WEB_FEATURES.yml: Added.\n* LayoutTests/imported/w3c/web-platform-tests/domparsing/XMLSerializer-serializeToString-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/domparsing/XMLSerializer-serializeToString.html:\n* LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-08-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-08.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/domparsing/resources/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/domparsing/w3c-import.log:\n\nCanonical link: https://commits.webkit.org/319753@main",
      "email": "cdumez@apple.com",
      "hash": "2bf5b6e2d9f34ba4114af97d0f6cabcc7caa4aeb",
      "subject": "Resync domparsing WPT tests from upstream"
    },
    "319754@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "319754@main",
      "clUrl": "https://commits.webkit.org/319754@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322266\n\nReviewed by Per Arne Vollan.\n\nEach auxiliary process costs its host application two RunningBoard assertions: a\nthrottler assertion, and \"Jetsam Boost\" (ProcessAssertionType::BoostedJetsam),\ntaken on macOS as soon as we connect to the process.\n\nThe two have very different lifetimes. AuxiliaryProcessProxy::shutDownProcess()\ndrops the throttler assertion via ProcessThrottler::didDisconnectFromProcess(),\nso it is scoped to the connection. m_boostedJetsamAssertion was not cleared\nthere, so it was only released by ~ProcessAssertion when the last reference to\nthe proxy went away -- which can be arbitrarily later, since pages, the process\ncache, suspended pages and pending completion handlers all keep the proxy alive\npast the child's death.\n\nClear m_boostedJetsamAssertion from the same scope exit in shutDownProcess()\nthat already tears down the throttler assertion, so it runs on every exit path\nincluding the State::Terminated early return.\n\n* Source/WebKit/UIProcess/AuxiliaryProcessProxy.cpp:\n(WebKit::AuxiliaryProcessProxy::shutDownProcess):\n\nCanonical link: https://commits.webkit.org/319754@main",
      "email": "cdumez@apple.com",
      "hash": "24ad492ba4204cf716e3834de4ecde0853f61ac3",
      "subject": "Release the jetsam boost assertion when disconnecting from an auxiliary process"
    },
    "319755@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "319755@main",
      "clUrl": "https://commits.webkit.org/319755@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322372\n\nReviewed by Jean-Yves Avenard and Darin Adler.\n\nrenderFromBuffer() rejected out-of-range loop points and fell back to looping the\nentire buffer, which is what the spec's playback algorithm says. But the\nloopStart/loopEnd attribute definitions say those values are clamped into the\nbuffer instead, and the two readings give different output. The Audio WG resolved\nthe contradiction in favour of clamping in\nhttps://github.com/WebAudio/web-audio-api/issues/2689: clamp both endpoints\nfirst, then fall back to the entire buffer only if what is left is not a range of\npositive length. The spec PR has not landed yet, so index.bs still shows the old\nguard. Blink already does this in\nAudioBufferSourceHandler::UpdateEffectiveLoopPoints(), and we now match it for a\nnegative loopStart, a loopStart past the buffer duration, loopStart \u003e= loopEnd, a\nnegative loopEnd, a loopEnd past the duration, and the loopStart == loopEnd == 0\ndefault.\n\nTwo configurations change. A negative loopStart looped the whole buffer and now\nloops [0, loopEnd), the case the WPT test already asserted. A loopStart past the\nbuffer duration used to *pass* the old guard, since 0 \u003c= loopStart \u003c loopEnd\nholds, leaving virtualMinFrame above virtualMaxFrame and a negative\nvirtualDeltaFrames; the playback-rate check then bailed out and rendered silence.\nClamping makes that range empty rather than inverted, so it falls back to the\nwhole buffer.\n\nThe forward wrap recomputed its target from the raw m_loopStart rather than the\neffective loop points, so it wrapped to loopStart even when playback had fallen\nback to the whole buffer. It now uses virtualMinFrame.\n\nOne difference from Blink remains, unchanged by this patch: Blink resolves a\nloopEnd of exactly 0 to the buffer duration and loops [loopStart, duration),\nwhile the resolution maps any loopEnd \u003c= 0 to 0 and falls back to the entire\nbuffer.\n\n* LayoutTests/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audiobuffersourcenode-interface/audiobuffersource-playbackrate-negative-expected.txt:\nRebaselined: \"loops backwards using clamped loopStart when loopStart \u003c 0\" passes.\nThe two remaining failures are out-of-bounds start offsets, unrelated.\n\n* LayoutTests/webaudio/AudioBufferSource/audiobuffersource-loop-comprehensive.html:\n* LayoutTests/webaudio/AudioBufferSource/audiobuffersource-loop-comprehensive-expected.txt:\nCase 14 expected loopStart = -8 with loopEnd = 3 to loop the whole buffer,\ncontradicting the WPT test. Updated to the clamped loop [0, 3), matching\nChromium's updated copy of this test.\n\n* Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp:\n(WebCore::AudioBufferSourceNode::renderFromBuffer):\n\nCanonical link: https://commits.webkit.org/319755@main",
      "email": "cdumez@apple.com",
      "hash": "c2c8b0cb3b0def5b71c991462d7b3714c46a8d62",
      "subject": "AudioBufferSourceNode does not clamp out-of-range loopStart/loopEnd"
    },
    "319756@main": {
      "author": "Roberto Rodriguez",
      "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64",
      "cl": "319756@main",
      "clUrl": "https://commits.webkit.org/319756@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315712\nrdar://176813583\n\nReviewed by Kimmo Kinnunen.\n\nes3_format_type_combinations.json incorrectly pairs GL_DEPTH_COMPONENT32_OES with GL_UNSIGNED_INT_24_8,\nallowing TexImage2D with internalformat=GL_DEPTH_COMPONENT32_OES, format=GL_DEPTH_COMPONENT, and\ntype=GL_UNSIGNED_INT_24_8 to pass ES3 format validation. GL_UNSIGNED_INT_24_8 is only valid with\nGL_DEPTH_STENCIL (per OpenGL ES 3.0.6, Table 3.6). Metal backend's load-function table has no converter\nfor this combination and falls through to UnreachableLoadFunction which in release-mode is a no-op,\ncausing an uninitialized malloc'd buffer to be uploaded into the GPU process depth texture.\n\nChange the JSON entry from GL_UNSIGNED_INT_24_8 to GL_UNSIGNED_INT and regenerate format_map_autogen.cpp.\nThe invalid combination is now rejected with GL_INVALID_OPERATION before any buffer allocation occurs.\n\n* Source/ThirdParty/ANGLE/src/libANGLE/es3_format_type_combinations.json:\n* Source/ThirdParty/ANGLE/src/libANGLE/format_map_autogen.cpp:\n(gl::ValidES3FormatCombination):\n* Source/ThirdParty/ANGLE/src/tests/gl_tests/DepthStencilFormatsTest.cpp:\n\nOriginally-landed-as: 305413.982@safari-7624.5-branch (8b1c27595893). rdar://185368194\nCanonical link: https://commits.webkit.org/319756@main",
      "email": "roberto_rodriguez2@apple.com",
      "hash": "9eeb617afd1d6f309fbf0a9e2c64e318f9f7fa84",
      "subject": "[ANGLE] Fix GL_DEPTH_COMPONENT32_OES format validation to reject GL_UNSIGNED_INT_24_8"
    },
    "319757@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319757@main",
      "clUrl": "https://commits.webkit.org/319757@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322361\nrdar://185649955\n\nReviewed by Gerald Squelart.\n\ntransformAreaToDevice() applied the state CTM and the base transform as two\nseparate Path::transform() calls. Matrix multiplication is associative (and\nclose enough to associative in double), so the pair is equivalent to a single\ntransform by the composed matrix baseTransform() * state().transform. The\noperands read in the opposite order from the two calls because AffineTransform's\n`A * B` maps a point through B first and then A, so the transform that was\napplied second is the left operand.\n\nThe second pass is not free. The only caller reaches this via the FloatRect\noverload, and PathRect::canTransform is false, so the first transform()\nalready materializes a platform path; on CG each subsequent transform() is a\nCGPathCreateMutableCopyByTransformingPath, i.e. a fresh CGMutablePath\nallocation. Pre-multiplying drops one path allocation and one full walk per\ncomposited drawImage().\n\nNo change in behavior, covered by the existing full-canvas composite tests\n(fast/canvas/canvas-composite-*).\n\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:\n(WebCore::CanvasRenderingContext2DBase::transformAreaToDevice const):\n\nCanonical link: https://commits.webkit.org/319757@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "ba807ab430770f1a34bc50171301a7e175b1b1b5",
      "subject": "[canvas] transformAreaToDevice() walks the path twice"
    },
    "319758@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "319758@main",
      "clUrl": "https://commits.webkit.org/319758@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322390\n\nReviewed by Daniel Liu.\n\nA lookbehind containing a lookahead, fell back to the interpreter.\n\nTo match backward, the JIT compiles a lookbehind from a copy of its\ndisjunction tree with the terms reversed and inputPosition renumbered from\nthe assertion's position. A lookahead inside the lookbehind is still matched\nforward, so its terms must not be reversed, but their inputPosition values\ncome from the parser and continue the pattern-order numbering of the\nenclosing alternative, which does not match the reversed numbering the JIT\ngave that alternative. Compiling them as-is would read the wrong characters,\nso the JIT refused the pattern.\n\nThis patch gives such a lookahead the same treatment as a lookbehind: a copy\nof its disjunction, kept in match order, with inputPosition renumbered from\n0, compiled with a checked offset of 0. The ParentheticalAssertionBegin op\nalready moves the index to the assertion's position, so the forward code\nworks unchanged from there.\n\nreverseDisjunctionForBackward() becomes copyDisjunctionInMatchOrder(), which\nhandles both directions. m_reversedDisjunctions becomes\nm_copiedDisjunctions, and its type changes from\nVector\u003cstd::unique_ptr\u003cPatternDisjunction\u003e\u003e to Bag\u003cPatternDisjunction\u003e: the\ncopies are only created and kept alive until the generator is destroyed,\nnever looked up, so creating them in place lets the function return a plain\npointer instead of passing ownership around.\n\n                                                 Baseline                  Patched\n\nregexp-lookbehind-lookahead                1411.3836+-12.6421    ^    174.3478+-4.0373        ^ definitely 8.0952x faster\n\nTests: JSTests/microbenchmarks/regexp-lookbehind-lookahead.js\n       JSTests/stress/regexp-lookbehind-jit-lookahead-unicode.js\n       JSTests/stress/regexp-lookbehind-jit-lookahead.js\n\n* JSTests/microbenchmarks/regexp-lookbehind-lookahead.js: Added.\n* JSTests/stress/regexp-lookbehind-jit-lookahead-unicode.js: Added.\n(shouldBe):\n(stringify):\n(stringifyIndices):\n* JSTests/stress/regexp-lookbehind-jit-lookahead.js: Added.\n(shouldBe):\n(stringify):\n(stringifyIndices):\n(shouldBe.stringify):\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n\nCanonical link: https://commits.webkit.org/319758@main",
      "email": "sosuke@bun.sh",
      "hash": "44ebe94906dafa251c4d8a96f698e327b17b1614",
      "subject": "[YARR] Compile lookbehinds containing lookaheads in JIT"
    },
    "319759@main": {
      "author": "Jer Noble",
      "avatar": "https://www.gravatar.com/avatar/6d2cde9be23b98223ca964cb3b7813a0?d=identicon\u0026s=64",
      "cl": "319759@main",
      "clUrl": "https://commits.webkit.org/319759@main",
      "description": "rdar://185505597\nhttps://bugs.webkit.org/show_bug.cgi?id=322448\n\nReviewed by Jean-Yves Avenard and Abrar Rahman Protyasha.\n\nUser reports indicate YouTube.com audio playback is continuing under some circumstances, even after\nthe tab containing the YouTube.com page is closed. Subsequent analysis of users' logs reveals that\nthe AudioVideoRenderAVFObjC object continues playback until it runs out of enqueued buffers and\nstalls. The teardown path inside RemoteAudioVideoRendererProxyManager::shutdown() is being called,\nand in fact the RemoteAudioVideoRendererProxyManager itself is being destroyed. But if\nRemoteAudioVideoRendererProxyManager is not the lone holder of the AudioVideoRenderer RefPtr, its\nrefcount will not drop to zero and audio will continue until either buffers run dry or the last\nremaining RefPtr is destroyed.\n\nRather than rely on the refcount dropping to zero to end playback, explicitly pause() and flush\n() the renderer when shutting down a player, and do the same to all outstanding renderers when the\nManager itself is destroyed.\n\n* Source/WebKit/GPUProcess/media/RemoteAudioVideoRendererProxyManager.cpp:\n(WebKit::RemoteAudioVideoRendererProxyManager::~RemoteAudioVideoRendererProxyManager):\n(WebKit::RemoteAudioVideoRendererProxyManager::shutdown):\n\nCanonical link: https://commits.webkit.org/319759@main",
      "email": "jer.noble@apple.com",
      "hash": "5173c0afd8a33bfb469c886cc5839a1c54cd7cb7",
      "subject": "[macOS] YouTube.com audio continues to play after tab is closed"
    },
    "319760@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "319760@main",
      "clUrl": "https://commits.webkit.org/319760@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322413\nrdar://problem/185702304\n\nReviewed by Tim Nguyen.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/fa5393bb9f5f7d41cc16d1aeede1809ccd378ac0\n\nCanonical link: https://commits.webkit.org/319760@main",
      "email": "sammy.gill@apple.com",
      "hash": "f6dbdfadcb4a32fe6f3d9c3348358cdc7677db2b",
      "subject": "Reimport css-box WPTs."
    },
    "319761@main": {
      "author": "Wenson Hsieh",
      "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64",
      "cl": "319761@main",
      "clUrl": "https://commits.webkit.org/319761@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322436\nrdar://184783170\n\nReviewed by Abrar Rahman Protyasha and Megan Gardner.\n\nImprove both text-search-based targeting and summary strings for targeted elements with little-to-no\naccessible attributes or other context:\n\n1.  When targeting based on text, we currently require the search text to be present in the rendered\n    DOM of the targeted element. However, in the case where the agent is trying to target a button\n    or link that's a sibling of target text, this can cause confusing failures (from the perspective\n    of the agent), since the target element doesn't (literally) contain the search text.\n\n    Mitigate this by relaxing the constraints around text search, so that if we don't find search\n    text underneath the target container, we fall back to searching the nearest non-inline ancestor\n    of the target element for the search text.\n\n2.  Instead of surfacing an interaction description like:\n\n    \u003e Click on span with classes “sprite-fm-mono icon-arrow-right expand”\n\n    ...in the case where a targeted element has no text, we should pull text context from rendered\n    text siblings within the same block-level container, such that the interaction description can\n    look something more like:\n\n    \u003e Click on span with classes “sprite-fm-mono icon-arrow-right expand” before rendered text “Security”\n\nTest: TextExtractionTests.InteractionDescriptionAndSearchTextForLabellessIcons\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm\n* Source/WebCore/page/text-extraction/TextExtraction.cpp:\n(WebCore::TextExtraction::nearestNonInlineAncestor):\n(WebCore::TextExtraction::searchForInteractionTargetText):\n(WebCore::TextExtraction::resolveMouseTarget):\n(WebCore::TextExtraction::adjacentRenderedTextLabel):\n(WebCore::TextExtraction::adjacentRenderedTextLabelDescription):\n(WebCore::TextExtraction::hasNoRenderedTextOrLabeledChild):\n(WebCore::TextExtraction::textDescription):\n(WebCore::TextExtraction::precedingRenderedTextLabel): Deleted.\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:\n(TestWebKitAPI::TEST(TextExtractionTests, InteractionDescriptionAndSearchTextForLabellessIcons)):\n\nCanonical link: https://commits.webkit.org/319761@main",
      "email": "wenson_hsieh@apple.com",
      "hash": "602545c636e67d2e48f25962a51f872d6fe5d86b",
      "subject": "[Text Extraction] Add more text context before or after a targeted element that's missing meaningful text context"
    },
    "319762@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "319762@main",
      "clUrl": "https://commits.webkit.org/319762@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322378\n\nReviewed by Richard Robinson.\n\nThe TestWebKitAPILibrary target has no fileSystemSynchronizedGroups entry, so the\nsynchronized Tests folder contributes nothing to it by default and its\nmembershipExceptions list is an opt-in list of the files compiled directly.\nEverything else reaches the target through the UnifiedSourceN bundles generated\nfrom Sources.txt and SourcesCocoa.txt, which means a file marked @no-unify has to\nappear in membershipExceptions or it is not compiled at all.\n\n310630@main dropped WebKit/WKWebView/MediaLoading.mm and\nWebKit/WKWebView/WKAttachmentTests.mm from that list, so 41 WKAttachmentTests, 11\nWKAttachmentTestsMac and 5 MediaLoading tests have silently not been built or run\nin the Xcode build since. Add them back. Only the Xcode build was affected; the\nCMake ports read Sources*.txt directly and handle @no-unify themselves.\n\nAll 57 tests pass with the files restored.\n\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/319762@main",
      "email": "cdumez@apple.com",
      "hash": "66328c1f5db75fc96954b1e3e960f6cf0cb39e40",
      "subject": "WKAttachmentTests and MediaLoading API tests are not built in the Xcode build"
    },
    "319763@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "319763@main",
      "clUrl": "https://commits.webkit.org/319763@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322447\nrdar://problem/185731047\n\nReviewed by Alan Baradlay.\n\nGridLayout::layout() ran the grid item placement algorithm inline, alongside\ntrack sizing, grid item layout, and alignment. Give placement its own class so\nthat step 1 of the layout algorithm reads as a single call and GridLayout is\nleft with only the steps that size and position items.\n\nGridItemPlacer takes the implicit grid rather than building it, so constructing\nthe initial grid stays the responsibility of ImplicitGrid itself via a new\ncreateInitialGrid() factory. calculateInitialImplicitGridDimensions() moved\nthere as a file-static helper since it needs no member access, which keeps\nGridDimensions out of every header.\n\nPlacement only reads the unplaced items -- it writes into the ImplicitGrid --\nso placeItems() and GridLayout::layout() now take a const UnplacedGridItems\u0026.\nThat lets computeIntrinsicWidths() drop the per-scenario clone of the unplaced\nitems, which was a deep copy of three Vectors per intrinsic width scenario. Its\ncomment claimed the placement and sizing algorithm consumed them, but nothing\never mutated them: every ImplicitGrid entry point already took them by const\nreference, and the grid cells, grid areas and PlacedGridItems built downstream\nall store copies. The clone was not isolating anything, so dropping it leaves\nthe min-content and max-content scenarios as independent as they already were.\n\nNo change in behavior.\n\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/layout/formattingContexts/grid/GridFormattingContext.cpp:\n(WebCore::Layout::GridFormattingContext::computeIntrinsicWidths):\n* Source/WebCore/layout/formattingContexts/grid/GridItemPlacer.cpp: Added.\n(WebCore::Layout::GridItemPlacer::GridItemPlacer):\n(WebCore::Layout::GridItemPlacer::placeItems const):\n* Source/WebCore/layout/formattingContexts/grid/GridItemPlacer.h: Added.\n* Source/WebCore/layout/formattingContexts/grid/GridLayout.cpp:\n(WebCore::Layout::GridLayout::layout):\n(WebCore::Layout::GridLayout::calculateInitialImplicitGridDimensions): Deleted.\n(WebCore::Layout::GridLayout::constructInitialImplicitGrid): Deleted.\n(WebCore::Layout::GridLayout::placeGridItems): Deleted.\n* Source/WebCore/layout/formattingContexts/grid/GridLayout.h:\n* Source/WebCore/layout/formattingContexts/grid/ImplicitGrid.cpp:\n(WebCore::Layout::calculateInitialImplicitGridDimensions):\n(WebCore::Layout::ImplicitGrid::createInitialGrid):\n* Source/WebCore/layout/formattingContexts/grid/ImplicitGrid.h:\n\nCanonical link: https://commits.webkit.org/319763@main",
      "email": "sammy.gill@apple.com",
      "hash": "9ec22b7a341738632efa8b6ad6564da7d43ccb17",
      "subject": "[GFC][Cleanup] Move item placement logic into a dedicated class"
    },
    "319764@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "319764@main",
      "clUrl": "https://commits.webkit.org/319764@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322451\nrdar://185735562\n\nReviewed by Yijia Huang.\n\nHeap::runTaskInParallel() publishes a bonus task, runs it on the collector\nvisitor (collector thread), then clears it. And both setting and\nclearing a bonus task (for parallel visitors) notify\nm_markingConditionVariable. While publishing a bonus task requires\nbroadcasting notification, clearing does not need it since it just\nreduces a possible task. Also, we do not need to notify\nm_markingConditionVariable when clearing a bonus task in drainFromShared\ntoo. We add m_bonusVisitorTaskConditionVariable to signal it to the\ncollector thread.\n\n* Source/JavaScriptCore/heap/Heap.cpp:\n(JSC::Heap::clearConcurrentRetainedDataIfPossible):\n* Source/JavaScriptCore/heap/Heap.h:\n* Source/JavaScriptCore/heap/SlotVisitor.cpp:\n(JSC::SlotVisitor::drainFromShared):\n\nCanonical link: https://commits.webkit.org/319764@main",
      "email": "ysuzuki@apple.com",
      "hash": "2eedeabcb721282641ccc06a25be24cca67ad8df",
      "subject": "[JSC] Stop broadcasting to every parallel marker when a bonus visitor task ends"
    },
    "319765@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319765@main",
      "clUrl": "https://commits.webkit.org/319765@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322383\nrdar://185665260\n\nReviewed by Chris Dumez.\n\nTwo spots on the Cache API lookup path copied a URL only to throw the copy\naway.\n\nDOMCacheEngine::matchURLs() copied both the request URL and the cached record\nURL into locals before comparing them, but the copies only exist so that\nsetQuery({ }) can strip the query strings when CacheQueryOptions::ignoreSearch\nis set. When ignoreSearch is false -- the common case -- both copies are\ndiscarded unmodified. Take that path first and compare in place.\n\nCacheStorageCache::computeKeyURL() built a whole URL just to call\nremoveQueryAndFragmentIdentifier() on it and read back the string. Truncate\nthe URL's string directly instead, which is what\nremoveQueryAndFragmentIdentifier() does internally, and which also skips the\nsubstring allocation entirely for URLs that have no query or fragment.\n\nTogether these run once per bucket lookup plus once per record examined, for\nevery match(), matchAll(), keys(), delete() and put(), as well as addAll()'s\nduplicate-request check.\n\nNo change in behavior.\n\n* Source/WebCore/Modules/cache/DOMCacheEngine.cpp:\n(WebCore::DOMCacheEngine::matchURLs):\n* Source/WebKit/NetworkProcess/storage/CacheStorageCache.cpp:\n(WebKit::CacheStorageCache::computeKeyURL):\n\nCanonical link: https://commits.webkit.org/319765@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "b4f60d6c8f3d1ba9b7c3096264c09de05e747f3d",
      "subject": "Avoid redundant URL copies on Cache API query paths"
    },
    "319766@main": {
      "author": "Taher Ali",
      "avatar": "https://www.gravatar.com/avatar/e104800647d8c98b8c9dbe736b5e1751?d=identicon\u0026s=64",
      "cl": "319766@main",
      "clUrl": "https://commits.webkit.org/319766@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322460\nrdar://185746232\n\nReviewed by Simon Fraser.\n\nCall sites temporarily clear an image's observer and restore it manually.\nBecause restoration re-reads a mutable image variable, reassignment or\nan early exit can leave the CachedImage without its observer permanently.\n\nIntroduce a small RAII guard that binds the image so restoration is tied to the\noriginally bound image and guaranteed on every exit path.\n\nNo behavior change.\n\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:\n(WebCore::CanvasRenderingContext2DBase::drawImage):\n* Source/WebCore/platform/graphics/BitmapImage.cpp:\n(WebCore::BitmapImage::drawLuminanceMaskPattern):\n* Source/WebCore/platform/graphics/Image.cpp:\n(WebCore::ImageObserverDisableScope::ImageObserverDisableScope):\n(WebCore::ImageObserverDisableScope::~ImageObserverDisableScope):\n* Source/WebCore/platform/graphics/Image.h:\n* Source/WebCore/svg/graphics/SVGImage.cpp:\n(WebCore::SVGImage::drawForContainer):\n(WebCore::SVGImage::nativeImage):\n\nCanonical link: https://commits.webkit.org/319766@main",
      "email": "taher_ali@apple.com",
      "hash": "a3d2b19de1762775a0db3494b2171356a53aa304",
      "subject": "Image observer save/restore should be scope-bound"
    },
    "319767@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "319767@main",
      "clUrl": "https://commits.webkit.org/319767@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322365\nrdar://184886311\n\nReviewed by David Kilzer.\n\nDrop the hardening added to DOMWrapperWorld in 315505@main now the cause\nof the crash has been identified.\n\n* Source/WebCore/bindings/js/DOMWrapperWorld.cpp:\n(WebCore::DOMWrapperWorld::DOMWrapperWorld):\n(WebCore::DOMWrapperWorld::~DOMWrapperWorld):\n(WebCore::DOMWrapperWorld::clearWrappers):\n(WebCore::initializeWrapperMapGuardingOnce): Deleted.\n(): Deleted.\n(WebCore::WTF_REQUIRES_LOCK): Deleted.\n(WebCore::WrapperMapTableMalloc::allocate): Deleted.\n(WebCore::WrapperMapTableMalloc::malloc): Deleted.\n(WebCore::WrapperMapTableMalloc::zeroedMalloc): Deleted.\n(WebCore::WrapperMapTableMalloc::free): Deleted.\n(WebCore::DOMWrapperWorld::setWrappersTableWritable): Deleted.\n(WebCore::WrapperMutationScope::enter): Deleted.\n(WebCore::WrapperMutationScope::leave): Deleted.\n* Source/WebCore/bindings/js/DOMWrapperWorld.h:\n(WebCore::DOMWrapperWorld::noteTableBacking): Deleted.\n(WebCore::DOMWrapperWorld::forgetTableBacking): Deleted.\n(WebCore::WrapperMutationScope::WrapperMutationScope): Deleted.\n(WebCore::WrapperMutationScope::~WrapperMutationScope): Deleted.\n(WebCore::WrapperMutationScope::currentlyMutatedWorld): Deleted.\n* Source/WebCore/bindings/js/JSDOMWrapperCache.h:\n(WebCore::cacheWrapper):\n(WebCore::uncacheWrapper):\n\nCanonical link: https://commits.webkit.org/319767@main",
      "email": "cdumez@apple.com",
      "hash": "2f352b53432a3a71f20aa6934b286d82b45574d3",
      "subject": "Drop the hardening added to DOMWrapperWorld in 315505@main"
    },
    "319768@main": {
      "author": "Issac Roy",
      "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64",
      "cl": "319768@main",
      "clUrl": "https://commits.webkit.org/319768@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321562\nrdar://184673539\n\nReviewed by Sam Sneddon.\n\n`write_branch_variables` wrote every value with `git config --add`, which\nappends rather than replaces, so each run left another copy of\n`branch.\u003cname\u003e.bug` and `branch.\u003cname\u003e.title` behind.\n\n- Write a key's first value with `--replace-all` and the rest with `--add`,\n  making the write idempotent and collapsing duplicates that earlier\n  runs left behind\n- Pass bug URLs as a list rather than joining them with a newline:\n  `git config -l` would unescape the newline but the value was truncated\n  at the first URL and the remainder became a bogus key in `Git.config()`\n- Modeled `--add` as appending in `mocks.local.Git`, taught it the `--list`\n  spelling of `-l`, and made both report every value of a repeated key\n  rather than flattening them through a dict, without which no test can\n  observe the duplication\n- `RE_ELEMENT` was mis-parsing config values that contain '='\n\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/__init__.py:\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/mocks/local/git.py:\n(Git):\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/branch.py:\n(Branch.main):\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/command.py:\n(Command.write_branch_variables):\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/program/pull_request.py:\n(PullRequest.pull_request_branch_point):\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/test/branch_unittest.py:\n* Tools/Scripts/libraries/webkitscmpy/webkitscmpy/test/command_unittest.py:\n(TestFilteredCommandRevision.test_revision_in_body_not_transformed):\n(TestWriteBranchVariables):\n(TestWriteBranchVariables.setUp):\n(TestWriteBranchVariables.values_for):\n(TestWriteBranchVariables.test_single_value_is_not_duplicated):\n(TestWriteBranchVariables.test_value_is_replaced):\n(TestWriteBranchVariables.test_multiple_values_are_kept):\n\nCanonical link: https://commits.webkit.org/319768@main",
      "email": "issacroy05@gmail.com",
      "hash": "f824f17ebf1dd60a79614693ec98f1ee7ca2c55c",
      "subject": "[git-webkit] Uploading a pull request repeatedly duplicates the branch's bug and title in .git/config"
    },
    "319769@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319769@main",
      "clUrl": "https://commits.webkit.org/319769@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322461\nrdar://185747815\n\nReviewed by Chris Dumez.\n\n* Source/WebCore/Modules/web-locks/WebLockManager.cpp:\n(WebCore::WebLockManager::request):\n\nCanonical link: https://commits.webkit.org/319769@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "38f9cc622f5911dcaffd6769459669441fabcbf2",
      "subject": "Remove stale UNUSED_PARAM(name) in WebLockManager::request()"
    },
    "319770@main": {
      "author": "Sean Patterson",
      "avatar": "https://www.gravatar.com/avatar/b19318d92b64ac7809b78670c03b0f1e?d=identicon\u0026s=64",
      "cl": "319770@main",
      "clUrl": "https://commits.webkit.org/319770@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322454\n\nReviewed by Tim Nguyen.\n\nThe imported copies of these tests predate w3c/csswg-drafts#5180, which moved the\nline-relative values top, center and bottom off alignment-baseline onto\nbaseline-shift. They still assert those three are valid, so WebKit -- which\nalready rejects them, correctly -- reports three FAILs per file that describe the\ngrammar as it no longer is. Upstream has since flipped those three over to\nalignment-baseline-invalid.html, and added hanging, which WebKit accepts, to the\nvalid and computed tests.\n\nRefresh alignment-baseline-{valid,computed,invalid}.html and the css-typed-om\nalignment-baseline.html from upstream, and rebaseline. This changes which\nassertions run, not what WebKit does: nine stale FAILs go away and five new\nPASSes appear, and no subtest goes from PASS to FAIL.\n\nThe rest of css/css-inline is deliberately left alone. Upstream's vertical-align\ntests there now assert css-inline-3's shorthand grammar, which WebKit does not\nimplement, so importing them belongs in its own change.\n\ntext-top and text-bottom still FAIL. Those are genuinely unimplemented, and are\nfixed in bug 321612.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/alignment-baseline-computed-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/alignment-baseline-computed.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/alignment-baseline-invalid-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/alignment-baseline-invalid.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/alignment-baseline-valid-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/alignment-baseline-valid.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-typed-om/the-stylepropertymap/properties/alignment-baseline-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-typed-om/the-stylepropertymap/properties/alignment-baseline.html:\n\nCanonical link: https://commits.webkit.org/319770@main",
      "email": "sean_patterson@apple.com",
      "hash": "bfb94d150b4243ef0586cdcc575bbad1e874263c",
      "subject": "Refresh the imported css-inline alignment-baseline parsing tests from upstream"
    },
    "319771@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319771@main",
      "clUrl": "https://commits.webkit.org/319771@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322467\nrdar://185752888\n\nReviewed by Chris Dumez.\n\nGeolocation interleaves its one-byte members with pointer-sized ones, leaving\n11 bytes of interior padding: 6 after m_hasBeenRequested/m_allowGeolocation,\nand 5 after the three bools that follow m_authorizationToken.\n\nGroup AllowGeolocation and the four bools at the end of the class, and move\nthe pointer-sized members up with the rest. sizeof(Geolocation) goes from 328\nto 320. Verified with -fdump-record-layouts; the saving holds on every 64-bit\nABI including MSVC, and 32-bit targets are unaffected.\n\nNo behaviour change.\n\n* Source/WebCore/Modules/geolocation/Geolocation.h:\n\nCanonical link: https://commits.webkit.org/319771@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "6ceceeb3ecb092dec058629ef0ce923e521b5869",
      "subject": "Field ordering in Geolocation wastes 8 bytes of padding per instance"
    },
    "319772@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "319772@main",
      "clUrl": "https://commits.webkit.org/319772@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322414\nrdar://problem/185702236\n\nReviewed by Tim Nguyen.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/8ef1302ab5f298741a5b95630a61166b2bb1719a\n\nCanonical link: https://commits.webkit.org/319772@main",
      "email": "sammy.gill@apple.com",
      "hash": "4b62d53ec6c16753020dbe69e59bf761ed0948e3",
      "subject": "Reimport css-flexbox WPTs."
    },
    "319773@main": {
      "author": "Nikolas Zimmermann",
      "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64",
      "cl": "319773@main",
      "clUrl": "https://commits.webkit.org/319773@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316052\n\nReviewed by Carlos Garcia Campos.\n\nOpacity applies to the whole group it composites, but SkiaCompositingLayer\nonly damaged the layer itself, so a descendant layer painting outside the\nlayer bounds kept its stale pixels.\n\nMasks used to have the same issue, and we solved it by introduced\na m_maskChanged flag and mask-specific damage collector. Generalize both into\none m_groupPropertyChanged flag, set through groupPropertyChanged() by every\nproperty that decides how the group is composited: opacity, filter, mask\nblend mode and replica. collectGroupDamage() now damages the layer\nplus the overlap region of its subtree, which fixes the problem.\n\nAdded new GTK/WPE specific damage tests, where coverage was missing.\n\n* LayoutTests/platform/glib/damage/animations-opacity-with-descendant-layer-expected.txt: Added.\n* LayoutTests/platform/glib/damage/animations-opacity-with-descendant-layer.html: Added.\n* LayoutTests/platform/glib/damage/layer-blend-mode-change-expected.txt: Added.\n* LayoutTests/platform/glib/damage/layer-blend-mode-change.html: Added.\n* LayoutTests/platform/glib/damage/layer-opacity-change-with-descendant-layer-expected.txt: Added.\n* LayoutTests/platform/glib/damage/layer-opacity-change-with-descendant-layer.html: Added.\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.cpp:\n(WebCore::SkiaCompositingLayer::setOpacity):\n(WebCore::SkiaCompositingLayer::setBlendMode):\n(WebCore::SkiaCompositingLayer::setMask):\n(WebCore::SkiaCompositingLayer::setReplica):\n(WebCore::SkiaCompositingLayer::setFilters):\n(WebCore::SkiaCompositingLayer::opacityForAnimationsState const):\n(WebCore::SkiaCompositingLayer::opacity const):\n(WebCore::SkiaCompositingLayer::syncAnimations):\n(WebCore::SkiaCompositingLayer::addGroupDamage):\n(WebCore::SkiaCompositingLayer::collectGroupDamage):\n(WebCore::SkiaCompositingLayer::paintWithMaskAndBackdrop):\n(WebCore::SkiaCompositingLayer::paintWithFilterAndMask):\n(WebCore::SkiaCompositingLayer::recursiveCleanUpAfterPaint):\n(WebCore::SkiaCompositingLayer::collectMaskDamage): Deleted.\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.h:\n\nCanonical link: https://commits.webkit.org/319773@main",
      "email": "nzimmermann@igalia.com",
      "hash": "b62ea5f7bcc9d2e2aef56bdc63faf2c2f85189b8",
      "subject": "[GTK][WPE][Damage] opacity animation doesn't damage descendant layers"
    },
    "319774@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "319774@main",
      "clUrl": "https://commits.webkit.org/319774@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322416\n\nReviewed by Anne van Kesteren.\n\nReplaced a raw pointer with CheckedPtr.\n\nNo new tests since there should be no behavioral changes.\n\n* Source/WebCore/dom/Node.h:\n\nCanonical link: https://commits.webkit.org/319774@main",
      "email": "rniwa@webkit.org",
      "hash": "b98b1c50745f921ffbe586a7945a66ce4b59a3b8",
      "subject": "Use CheckedPtr for Node::m_previousSibling"
    },
    "319775@main": {
      "author": "Claudio Saavedra",
      "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64",
      "cl": "319775@main",
      "clUrl": "https://commits.webkit.org/319775@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322425\n\nReviewed by Carlos Garcia Campos.\n\nThe GLib arm of the guard also required COMPILER(GCC), because clang is slow to\nbuild with IPC testing enabled. The ports build with clang by default though, and\nevery GCC-based GLib CI job is build-only, so no bot that runs layout tests has\nthe API compiled in: window.IPC is undefined and the ipc/ tests return early and\nreport PASS without testing anything.\n\nThe slowness is one file. SerializedTypeInfo.cpp gets one initializer entry per\nserialized type, making allSerializedTypes() a single 29000-line function that\nclang takes 52 minutes to compile at -O3 and 34 seconds at -O0. Only the GLib\nports ever optimize it, because Cocoa enables IPC testing on debug builds while\nthe GTK and WPE bots enable assertions on release builds. Build that file without\noptimizations, and the COMPILER(GCC) term can go.\n\nSkip the two tests that then fail.\n\n* Source/WTF/wtf/PlatformEnable.h:\n* Source/WebKit/CMakeLists.txt:\n* LayoutTests/platform/glib/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319775@main",
      "email": "csaavedra@igalia.com",
      "hash": "81c94dae4ce537d5891e2a248cb405c9fe8f3358",
      "subject": "[GLIB] Enable the IPC testing API for clang builds of the GTK and WPE ports"
    },
    "319776@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "319776@main",
      "clUrl": "https://commits.webkit.org/319776@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322477\n\nUnreviewed. Update safer C++ expectations.\n\n* Source/WebKitLegacy/SaferCPPExpectations/UncountedLambdaCapturesCheckerExpectations:\n\nCanonical link: https://commits.webkit.org/319776@main",
      "email": "rniwa@webkit.org",
      "hash": "2faf1df3d1dce492c2c239880f42e0fcd68fa79a",
      "subject": "Update safer C++ expectations (2026-08-25)"
    },
    "319777@main": {
      "author": "Andrew Gaul",
      "avatar": "https://www.gravatar.com/avatar/c4735ff5ae1f882942f2b3befcedbdba?d=identicon\u0026s=64",
      "cl": "319777@main",
      "clUrl": "https://commits.webkit.org/319777@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322370\n\nReviewed by Yusuke Suzuki.\n\nMacroAssemblerARM64::branch32/branch64 route a zero immediate through\ncommuteCompareToZeroIntoTest(), which rewrites a relational condition into\nthe equivalent test condition so the branch becomes a single cbz/cbnz\ninstead of a cmp plus b.cond. The switch covered Equal, NotEqual, LessThan\nand GreaterThanOrEqual but not the unsigned pair, although unsigned x \u003e 0\nis exactly x != 0 and unsigned x \u003c= 0 is exactly x == 0.\n\nThat gap costs an instruction in every unfenced write barrier. blackThreshold\nis 0, so AssemblyHelpers::barrierBranchWithoutFence() asks for\nbranch8(Above, cellState, TrustedImm32(blackThreshold)) and gets\n\n    ldurb w17, [x1, #7]\n    cmp   w17, #0\n    b.hi  skipBarrier\n\nwhere cbnz w17 does the same work. Scanning everything the JITs emit while\nrunning JetStream 3 (54.7M instructions) reports 65764 sites, 99.4% of them\nthis barrier: 27158 in DFG OSR exit stubs, where osrWriteBarrier() emits the\nsequence once per exit, 26303 in DFG code, 7580 in FTL OSR exits and 4723 in\nwasm BBQ. The whole class is gone from a re-scan after this change, removing\nroughly 263 KB of dead compares from that run.\n\nMacroAssemblerX86_64 carries the same switch and the same gap, so extend it\nthere too. test reg, reg clears CF, so Above (CF == 0 \u0026\u0026 ZF == 0) is exactly\nNonZero and BelowOrEqual (CF == 1 || ZF == 1) is exactly Zero, and the\nresulting test is also shorter to encode than the cmp against an immediate.\n\nThe fenced barrierBranch(vm, ...) form compares against\nvm.heap.barrierThreshold, a runtime value that the collector raises to a\ntautological threshold, and correctly keeps its compare.\n\nFound with armlint.\n\n* Source/JavaScriptCore/assembler/MacroAssemblerARM64.h:\n(JSC::MacroAssemblerARM64::commuteCompareToZeroIntoTest):\n* Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h:\n(JSC::MacroAssemblerX86_64::commuteCompareToZeroIntoTest):\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\nCanonical link: https://commits.webkit.org/319777@main",
      "email": "andrew@gaul.org",
      "hash": "1330d5747e024bad42fc5d0d95234bd5db399781",
      "subject": "[JSC] Fold unsigned compares against zero into cbz/cbnz and test"
    },
    "319778@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "319778@main",
      "clUrl": "https://commits.webkit.org/319778@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322333\n\nReviewed by Yusuke Suzuki.\n\nThe parser guards its own recursion and accepts destructuring patterns\nnested ~20k levels deep, but ArrayPatternNode::bindValue recurses into\nnested patterns with no stack check. Each level costs about 1KB of\nnative stack for the iterator temporaries and try/finally machinery, so\na pattern several thousand levels deep overflows the stack before the\nparser's limit is reached:\n\n    let [[[ /* 12000 levels */ z ]]] = [];  // SIGSEGV\n\nObjectPatternNode::bindValue has the same unbounded recursion.\n\nAdd the isSafeToRecurse() check that emitNode() already performs to the\ntop of both bindValue implementations. On failure, bytecode generation\nreports ParserError::OutOfMemory and the caller sees a catchable\nRangeError, matching other engines.\n\nTest: JSTests/stress/destructuring-pattern-deep-recursion.js\n\n* JSTests/stress/destructuring-pattern-deep-recursion.js: Added.\n(shouldThrowRangeError):\n* Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:\n(JSC::ArrayPatternNode::bindValue const):\n(JSC::ObjectPatternNode::bindValue const):\n\nCanonical link: https://commits.webkit.org/319778@main",
      "email": "sosuke@bun.sh",
      "hash": "752ab9007271ac2a897a91b2ffb65d1e5f709c9c",
      "subject": "[JSC] Deeply nested destructuring pattern crashes bytecode generation"
    },
    "319779@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "319779@main",
      "clUrl": "https://commits.webkit.org/319779@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322373\n\nReviewed by Jean-Yves Avenard.\n\nstart() silently clamps offset to [0, duration], so a negative playbackRate can\nleave the playhead exactly at the end of the buffer. renderFromBuffer() decided\nonce per render quantum whether the playhead was usable and returned false when\nit was not, making process() zero the whole bus. But only the first frame is\noutside the buffer: the playhead immediately descends back into it. A 4-frame\nbuffer started at offset == duration with rate -1 therefore rendered four silent\nframes instead of one silent frame followed by 4, 3, 2.\n\nThis aligns us with the spec, which makes that decision per frame rather than\nper quantum:\n```\n    if (bufferTime \u003e= 0 \u0026\u0026 bufferTime \u003c buffer.duration)\n        output.push(playbackSignal(bufferTime));\n    else\n        output.push(0); // past end of buffer, so output silent frame\n```\nUnlike bugs 320870 and 322372, no spec ambiguity is involved: the existing text\nalready specifies this, and we simply did not implement it.\n\nIt also aligns us with Blink, whose \"Reverse Out-Of-Bounds Playhead Catch-up\"\nloop in AudioBufferSourceHandler::RenderFromBuffer() is equivalent, added for the\nsame reason.\n\nForward playback is unaffected. With a positive rate the playhead only moves\nfurther past the end of the buffer, so bailing out and rendering silence was\nalready the correct result and still is.\n\n* LayoutTests/imported/w3c/web-platform-tests/webaudio/the-audio-api/the-audiobuffersourcenode-interface/audiobuffersource-playbackrate-negative-expected.txt:\nRebaselined: \"handles offset exactly at duration with negative rate\" and\n\"handles out-of-bounds start offset correctly\" now pass. The one remaining\nfailure is a negative loopStart, addressed separately in bug 322372.\n\n* Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp:\n(WebCore::AudioBufferSourceNode::renderFromBuffer):\n\nCanonical link: https://commits.webkit.org/319779@main",
      "email": "cdumez@apple.com",
      "hash": "268a25f376b16d07e316f099693025f2b61615cc",
      "subject": "AudioBufferSourceNode renders only silence for an out-of-bounds start() offset with a negative playbackRate"
    },
    "319780@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "319780@main",
      "clUrl": "https://commits.webkit.org/319780@main",
      "description": "rdar://185212996\nhttps://bugs.webkit.org/show_bug.cgi?id=322021\n\nReviewed by Jean-Yves Avenard.\n\n* Source/ThirdParty/libwebrtc/Source/third_party/libvpx: Resynced.\n\nCanonical link: https://commits.webkit.org/319780@main",
      "email": "youenn@apple.com",
      "hash": "87c3be939c9ab80e069eef4280907f70778540f5",
      "subject": "Resync libvpx up to M152"
    },
    "319781@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "319781@main",
      "clUrl": "https://commits.webkit.org/319781@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322022\nrdar://problem/185213886\n\nReviewed by Jean-Yves Avenard.\n\n* Source/ThirdParty/libwebrtc/Source/third_party/libaom: Resynced.\n\nCanonical link: https://commits.webkit.org/319781@main",
      "email": "youenn@apple.com",
      "hash": "11d5c088f987ecafc12b3211d4da7141ee8b7f91",
      "subject": "Resync libaom up to M152"
    },
    "319782@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "319782@main",
      "clUrl": "https://commits.webkit.org/319782@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322388\n\nReviewed by Yusuke Suzuki.\n\nThe WebIDL web-platform-test \"If the implementation has a stack property on\nnormal errors, it also does on DOMExceptions\" was still failing after\n318930@main. That test compares typeof new Error().stack against\ntypeof (new DOMException()).stack; we returned \"string\" for the former and\n\"undefined\" for the latter. Firefox passes this test; Chrome fails it.\n\n318930@main gave DOMException's JS wrapper the [[ErrorData]] internal slot by\nmaking it a genuine JSC::ErrorInstance subclass, but deliberately opted out of\nstack capture (StackTraceCapturePolicy::DoNotCapture) to keep the property set\nbyte-for-byte unchanged. Now that a DOMException really is an ErrorInstance,\nthere is no reason for it to be the one error in the engine without a stack, so\nlet it capture one like any other.\n\nErrorInstance's DoNotCapture policy had exactly one caller, so the enum is\nreplaced by a single named entry point, finishCreationForEmbedderError(), which\ncaptures a stack trace but still adds no own \"message\" / \"cause\" properties.\nJSDOMErrorWrapper calls it. \"stack\" (and WebKit's non-standard \"line\", \"column\"\nand \"sourceURL\") then materialize lazily through the existing\nmaterializeErrorInfoIfNeeded() path, so they are DontEnum and honour\nError.stackTraceLimit exactly as they do for a plain Error, and DOMException's\nname/message continue to come from the WebIDL getters on the prototype rather\nthan from own properties. This also covers DOMException's subclasses\n(WebTransportError, GPUPipelineError, RTCError, OverconstrainedError).\n\nGiving DOMException a stack also stops WPT's\nstructured-cloning-error-stack-optional.sub.window.html from skipping its\nDOMException cases, at which point it asserts that a clone reports the same\nstack as the original. That failed, because dumpDOMException() serialized only\nthe name and message, so a clone reported the stack of whichever frame did the\ndeserializing. The four \"web API-created DOMException\" subtests were already\nfailing this way, since createDOMException() has always given engine-thrown\nDOMExceptions a stack.\n\nSo serialize the line/column/sourceURL/stack alongside the name and message.\nThat needs wire format version 16, and the extra fields are read back behind a\nversion check so version 15 and earlier data still deserializes.\nErrorInstance::setErrorInfoForEmbedderError() replaces the stack trace captured\nwhen the wrapper was created with the deserialized information, still leaving\nthe properties to materialize lazily, so a cloned DOMException and a cloned\nError behave the same way. All 20 subtests of that test pass now, up from 12.\n\ncreateDOMException()'s addErrorInfo() call is now partly redundant, since\ncreating the wrapper on the preceding line already captures a stack trace, but\nit is kept: it is what gives a \"stack\" of \"\" to exceptions created with no JS\nframes on the stack, such as an asynchronous rejection. Dropping it made\nWebGPU's mapping.spec.js fail its typeof ex.stack === 'string' assertion for\nmapAsync rejections.\n\nTwo consequences worth noting. Surfacing a DOM exception to JS now pays for a\nstack trace capture, the same cost `new Error()` already pays. And, as with every\nserialization version bump, data written by this build cannot be read by older\nversions of WebKit.\n\n* LayoutTests/fast/storage/serialized-script-value.html: Bump the pinned wire\nformat version.\n* LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any.worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/infrastructure/safe-passing-of-structured-data/structured-cloning-error-stack-optional.sub.window-expected.txt:\n* LayoutTests/js/dom/dom-exception-stack.html: Added.\n* LayoutTests/js/dom/dom-exception-stack-expected.txt: Added.\n* Source/JavaScriptCore/runtime/ErrorInstance.cpp:\n(JSC::ErrorInstance::finishCreationForEmbedderError):\n(JSC::ErrorInstance::setErrorInfoForEmbedderError):\n* Source/JavaScriptCore/runtime/ErrorInstance.h:\n* Source/JavaScriptCore/runtime/StructuredCloneTags.h:\n* Source/WebCore/bindings/js/JSDOMWrapper.h:\n(WebCore::JSDOMErrorWrapper::finishCreation):\n* Source/WebCore/bindings/js/SerializedScriptValue.cpp:\n(WebCore::CloneSerializer::dumpDOMException):\n(WebCore::CloneDeserializer::readDOMException):\n\nCanonical link: https://commits.webkit.org/319782@main",
      "email": "cdumez@apple.com",
      "hash": "045a0c6379ef4d428a45302fe0c95160d4cea9e8",
      "subject": "DOMException should have a stack property, like other errors"
    },
    "319783@main": {
      "author": "Diego Pino Garcia",
      "avatar": "https://www.gravatar.com/avatar/e8cce88637f1a6e79155e8371e24b2e8?d=identicon\u0026s=64",
      "cl": "319783@main",
      "clUrl": "https://commits.webkit.org/319783@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=273477\n\nReviewed by Carlos Garcia Campos.\n\nWebKit shapes vertical writing-mode text as an ordinary horizontal HarfBuzz\nbuffer (LTR/RTL direction) and relies on the font's OpenType 'vert'/'vrt2'\nGSUB features to substitute glyphs with their vertical forms. HarfBuzz only\nauto-enables 'vert'/'vrt2' for buffers shaped in a vertical direction (TTB/BTT),\nwhich WebKit never uses. Thus, 'ComplexTextControllerSkia' must request\nthese features explicitly (otherwise vertical glyph substitution won't happen).\n\nFix by explicitly requesting 'vert'/'vrt2' whenever the font is vertically\noriented. Also add 'findScriptForVerticalGlyphSubstitution()', almost\nidentical to Harfbuzz's implementation, which looks up in which script the font\nactually registers 'vert' and 'vrt2' and uses that script for shaping.\n\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebCore/platform/graphics/skia/ComplexTextControllerSkia.cpp:\n(WebCore::findScriptForVerticalGlyphSubstitution):\n(WebCore::ComplexTextController::collectComplexTextRunsForCharacters):\n\nCanonical link: https://commits.webkit.org/319783@main",
      "email": "dpino@igalia.com",
      "hash": "a562b34e5386c35648835584439534662ce6b4a2",
      "subject": "[Skia] Test fast/writing-mode/vertical-subst-font-vert-no-dflt.html is failing"
    },
    "319784@main": {
      "author": "Adrian Taylor",
      "avatar": "https://www.gravatar.com/avatar/d2acb8ad2e2670ff74ae0d65fb27014c?d=identicon\u0026s=64",
      "cl": "319784@main",
      "clUrl": "https://commits.webkit.org/319784@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322268\nrdar://185504660\n\nReviewed by Ian Grunert and Elliott Williams.\n\nWe can't import Foundation into WebKit Swift on Windows, due to a conflict\nbetween WTF's ICU and the Foundation ICU. While this is resolved, import only\nFoundationEssentials.\n\nCanonical link: https://commits.webkit.org/319784@main",
      "email": "adrian_taylor@apple.com",
      "hash": "682a3622e2f8aaf4cd6496182044c39b2b8ce7ff",
      "subject": "Avoid importing Foundation on Windows"
    },
    "319785@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "319785@main",
      "clUrl": "https://commits.webkit.org/319785@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322471\nrdar://185759621\n\nReviewed by Richard Robinson.\n\nCertain scroll gestures are configured to not require a trailing\nmomentum stage. In this patch, we begin respecting that.\n\n* Source/WebKit/UIProcess/mac/AppKitGestures/WKAppKitGestureController.mm:\n(-[WKAppKitGestureController sendWheelEventForGesture:]):\n\nCanonical link: https://commits.webkit.org/319785@main",
      "email": "a_protyasha@apple.com",
      "hash": "6937c075deee8f8ab8748f0f7f3bb8ef9c97dd4b",
      "subject": "[AppKit Gestures] Some scrolls should not produce momentum"
    },
    "319786@main": {
      "author": "Jon Butler",
      "avatar": "https://www.gravatar.com/avatar/8ea31467fdac4a6517da9705d256efe1?d=identicon\u0026s=64",
      "cl": "319786@main",
      "clUrl": "https://commits.webkit.org/319786@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321580\nrdar://180734422\n\nReviewed by Kimmo Kinnunen.\n\nFix a correctness issue in MSL symbol table key comparison. Previously, we\nmistakenly compared the variable's unique ID with itself, leading to incorrect\ntranslator state that crashes later in the pipeline, or emits invalid MSL.\n\nThis change corrects the comparison logic, but does not update the hash template\nspecialisation for VarField, which continues to use object addresses rather than\nunique IDs to avoid behavioural changes and to stay consistent with the more common\npattern in this part of the codebase.\n\n* Source/ThirdParty/ANGLE/ANGLE.xcodeproj/project.pbxproj:\n* Source/ThirdParty/ANGLE/src/compiler/translator/msl/SymbolEnv.h:\n(sh::VarField::operator== const):\n* Source/ThirdParty/ANGLE/src/tests/angle_unittests.gni:\n* Source/ThirdParty/ANGLE/src/tests/compiler_tests/MSLSymbolEnv_test.cpp: Added.\n(sh::TEST(MSLSymbolEnv, VarFieldEquality)):\n\nCanonical link: https://commits.webkit.org/319786@main",
      "email": "jonbutler@apple.com",
      "hash": "3f38d00a27f16fbabbc82dfe589651351e3fd599",
      "subject": "[ANGLE] Fix MSL symbol table key comparison logic"
    },
    "319787@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "319787@main",
      "clUrl": "https://commits.webkit.org/319787@main",
      "description": "rdar://185298317\nhttps://bugs.webkit.org/show_bug.cgi?id=322099\n\nReviewed by Jean-Yves Avenard.\n\nWe resync libwebrtc up to M152 and update WebCore binding code according api changes.\n\n* Source/ThirdParty/libwebrtc/CMakeLists.txt:\n* Source/ThirdParty/libwebrtc/Configurations/libwebrtc.exp:\n* Source/ThirdParty/libwebrtc/libwebrtc.xcodeproj/project.pbxproj:\n* Source/WebCore/Modules/mediastream/libwebrtc/LibWebRTCRtpTransformableFrame.cpp:\n(WebCore::timestampFromRtpTimestampInfo):\n(WebCore::LibWebRTCRtpTransformableFrame::timestamp const):\n(WebCore::LibWebRTCRtpTransformableFrame::audioMetadata const):\n(WebCore::LibWebRTCRtpTransformableFrame::videoMetadata const):\n(WebCore::LibWebRTCRtpTransformableFrame::setOptions):\n* Source/WebCore/Modules/mediastream/libwebrtc/LibWebRTCUtils.cpp:\n(WebCore::toRTCHeaderExtensionParameters):\n(WebCore::fromRTCHeaderExtensionParameters):\n* Source/ThirdParty/libwebrtc/Source/webrtc/p2p/base/packet_transport_internal.cc:\n* Source/ThirdParty/libwebrtc/Source/webrtc/p2p/base/packet_transport_internal.h:\n\nCanonical link: https://commits.webkit.org/319787@main",
      "email": "youenn@apple.com",
      "hash": "8000aee5e8a9ed3758c08791773a57824d0ae027",
      "subject": "Resync libwebrtc up to M152"
    },
    "319788@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "319788@main",
      "clUrl": "https://commits.webkit.org/319788@main",
      "description": "rdar://184253301\nhttps://bugs.webkit.org/show_bug.cgi?id=321191\n\nReviewed by Chris Dumez.\n\n318042@main started failing the load when the fetch event request body is disturbed,\nsince a body backed by a ReadableStream can no longer be provided\n\nWe need to support a service worker reading a clone of the request, even if the original request gets to the network.\nPendingStreamState cannot have multiple consumers and we keep it this way for simplicity.\n\nTo implement the correct functional behavior, in case a fetch event request that has a pending stream body, the request is cloned\nand the fetch event is not handled, we make the service worker do the fetch itself and we use this fetch for the fetch event.\nThis ensures that all request body data gets to the service worker and to the network, through the readable stream tee algorithm.\nThis also ensures that backward pressure is applied properly on the original readable stream.\n\n We now convert a pending stream FormData body into a ReadableStream before cloning it,\nso that FetchBody::clone tees it as it does for any other stream body.\nThe original request keeps one branch and the clone gets the other, and each can be consumed independently.\n\nFinally, when the fetch event is left unhandled, the request body is canceled, so the request is marked as disturbed to make it unusable afterwards, as per specification.\n\nCovered by existing tests.\n\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-event.https.h2-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-event.https.h2.html:\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/resources/fetch-event-test-worker.js:\n(handleCloneAndIgnore):\n(handleCloneAfterIgnore):\n(async self):\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-event.https.h2-expected.txt:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n* Source/WebCore/Modules/fetch/FetchBody.cpp:\n(WebCore::FetchBody::clone):\n* Source/WebCore/Modules/fetch/FetchBody.h:\n(WebCore::FetchBody::setAsReadableStream):\n(WebCore::FetchBody::isPendingStreamFormData const):\n* Source/WebCore/Modules/fetch/FetchBodyOwner.cpp:\n(WebCore::FetchBodyOwner::cloneBody):\n(WebCore::FetchBodyOwner::hasClonedReadableStream const):\n* Source/WebCore/Modules/fetch/FetchBodyOwner.h:\n* Source/WebCore/Modules/fetch/FetchBodySource.h:\n* Source/WebCore/Modules/fetch/FetchRequest.cpp:\n(WebCore::FetchRequest::clone):\n* Source/WebCore/Modules/fetch/FetchRequest.h:\n* Source/WebCore/Modules/fetch/FetchResponse.cpp:\n(WebCore::FetchResponse::clone):\n* Source/WebCore/Modules/streams/ReadableStream.h:\n(WebCore::ReadableStream::controller const):\n* Source/WebCore/workers/service/FetchEvent.cpp:\n(WebCore::FetchEvent::respondWith):\n(WebCore::FetchEvent::processRespondWithPromise):\n* Source/WebCore/workers/service/FetchEvent.h:\n* Source/WebCore/workers/service/context/ServiceWorkerFetch.cpp:\n(WebCore::ServiceWorkerFetch::dispatchFetchEvent):\n\nCanonical link: https://commits.webkit.org/319788@main",
      "email": "youenn@apple.com",
      "hash": "b5aef3f0e4fc73299ec9f998007de512019041d3",
      "subject": "REGRESSION(317964@main): [macOS iOS] ASSERTION FAILED: bytesSent \u003e= m_pendingStreamBytesSentByNetwork in imported/w3c/web-platform-tests/service-workers/service-worker/fetch-event.https.h2.html"
    },
    "319789@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "319789@main",
      "clUrl": "https://commits.webkit.org/319789@main",
      "description": "rdar://182485644\nhttps://bugs.webkit.org/show_bug.cgi?id=322000\n\nReviewed by Jean-Yves Avenard.\n\n* Source/ThirdParty/libwebrtc/libwebrtc.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/319789@main",
      "email": "youenn@apple.com",
      "hash": "cd7cc6fe671bd4b807b7a407dca11bfee569fe41",
      "subject": "Remove a few unneeded abseil files from Xcode build"
    },
    "319790@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "319790@main",
      "clUrl": "https://commits.webkit.org/319790@main",
      "description": "rdar://185689807\nhttps://bugs.webkit.org/show_bug.cgi?id=322401\n\nReviewed by Chris Dumez.\n\nReadableByteStreamFetchSourceEnabled is on by default.\nWe remove this flag and the related code.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebCore/Modules/fetch/FetchBodyOwner.cpp:\n(WebCore::FetchBodyOwner::createReadableStream):\n* Source/WebCore/Modules/fetch/FetchBodySource.cpp:\n(WebCore::FetchBodySource::create):\n(WebCore::FetchBodySource::FetchBodySource):\n(WebCore::FetchBodySource::setByteController):\n(WebCore::FetchBodySource::enqueue):\n(WebCore::FetchBodySource::close):\n(WebCore::FetchBodySource::error):\n(WebCore::FetchBodySource::isPulling const):\n(WebCore::FetchBodySource::resolvePullPromise):\n(WebCore::FetchBodySource::detach):\n(WebCore::FetchBodySource::createNonByteSource): Deleted.\n(WebCore::FetchBodySource::createByteSource): Deleted.\n(WebCore::FetchBodySource::isCancelling const): Deleted.\n(WebCore::FetchBodySource::NonByteSource::NonByteSource): Deleted.\n(WebCore::FetchBodySource::NonByteSource::setActive): Deleted.\n(WebCore::FetchBodySource::NonByteSource::setInactive): Deleted.\n(WebCore::FetchBodySource::NonByteSource::doStart): Deleted.\n(WebCore::FetchBodySource::NonByteSource::doPull): Deleted.\n(WebCore::FetchBodySource::NonByteSource::doCancel): Deleted.\n(WebCore::FetchBodySource::NonByteSource::close): Deleted.\n(WebCore::FetchBodySource::NonByteSource::error): Deleted.\n* Source/WebCore/Modules/fetch/FetchBodySource.h:\n\nCanonical link: https://commits.webkit.org/319790@main",
      "email": "youenn@apple.com",
      "hash": "cb138473ae6a19d20367d13b40228c30320461f5",
      "subject": "Remove ReadableByteStreamFetchSourceEnabled flag"
    },
    "319791@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "319791@main",
      "clUrl": "https://commits.webkit.org/319791@main",
      "description": "rdar://185207698\nhttps://bugs.webkit.org/show_bug.cgi?id=322014\n\nReviewed by Jean-Yves Avenard.\n\n* Source/ThirdParty/libwebrtc/Source/third_party/abseil-cpp: resynced.\n\nCanonical link: https://commits.webkit.org/319791@main",
      "email": "youenn@apple.com",
      "hash": "05da85224bd81f73edfbe99bd7fad5f2467bc633",
      "subject": "Resync abseil-cpp to M152"
    },
    "319792@main": {
      "author": "Fady Farag",
      "avatar": "https://www.gravatar.com/avatar/0ac5127c69f90d0c57054173ae4c3108?d=identicon\u0026s=64",
      "cl": "319792@main",
      "clUrl": "https://commits.webkit.org/319792@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322456\nrdar://185740189\n\nReviewed by Chris Dumez.\n\nThis makes SpinButtonOwner ref-countable since nothing enforces that\nthe owner stays alive across its virtual functions.\n\nNo new tests since there should be no behavioral changes.\n\n* Source/WebCore/html/shadow/SpinButtonElement.cpp:\n(WebCore::SpinButtonElement::defaultEventHandler):\n(WebCore::SpinButtonElement::doStepAction):\n(WebCore::SpinButtonElement::shouldRespondToMouseEvents const):\n* Source/WebCore/html/shadow/SpinButtonElement.h:\n\nCanonical link: https://commits.webkit.org/319792@main",
      "email": "com.webkit.iidmsa@gmail.com",
      "hash": "9972b95bf01bb57cb62406e1cbaa769721d560da",
      "subject": "Harden `SpinButtonElement` by making `SpinButtonOwner` ref-countable"
    },
    "319793@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "319793@main",
      "clUrl": "https://commits.webkit.org/319793@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322415\nrdar://problem/185702394\n\nReviewed by Tim Nguyen.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/8ef1302ab5f298741a5b95630a61166b2bb1719a\n\nCanonical link: https://commits.webkit.org/319793@main",
      "email": "sammy.gill@apple.com",
      "hash": "5c50fc915194b4b751b4b33ddf6e3cb98e682ef9",
      "subject": "Reimport css-grid WPTs."
    },
    "319794@main": {
      "author": "Antti Koivisto",
      "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64",
      "cl": "319794@main",
      "clUrl": "https://commits.webkit.org/319794@main",
      "description": "rdar://177596584\n\nReviewed by Alan Baradlay.\n\nFontFace is Exposed=(Window,Worker), so its descriptor getters serialize\nCSSPrimitiveValues off the main thread via customCSSText(), racing the main\nthread on the unsynchronized process-global serialization map and the\nm_hasCachedCSSText flag. A concurrent HashTable rehash can free the backing\nbuffer while another thread still holds a bucket pointer into it.\n\nOnly memoize on the main thread; other threads serialize directly without\ntouching the shared state. Move m_hasCachedCSSText out of the bit-field group so\nthe main thread can set it without racing reads of the adjacent bits of a shared\nstatic value.\n\nTest: fast/css/font-face-worker-serialization-thread-safety.html\n* LayoutTests/fast/css/font-face-worker-serialization-thread-safety-expected.txt: Added.\n* LayoutTests/fast/css/font-face-worker-serialization-thread-safety.html: Added.\n* Source/WebCore/css/CSSPrimitiveValue.cpp:\n(WebCore::CSSPrimitiveValue::~CSSPrimitiveValue):\n(WebCore::CSSPrimitiveValue::customCSSText const):\n* Source/WebCore/css/CSSValue.h:\n\nOriginally-landed-as: 305413.1032@safari-7624.5-branch (bc1c6b94e762). rdar://185366777\nCanonical link: https://commits.webkit.org/319794@main",
      "email": "antti@apple.com",
      "hash": "b2c29f67e8c72fe3c0150e69b2e430f64b115481",
      "subject": "[WebCore] Unsynchronized access to process-global serializedPrimitiveValues() HashMap in CSSPrimitiveValue::customCSSText from Worker thread"
    },
    "319795@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "319795@main",
      "clUrl": "https://commits.webkit.org/319795@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321948\nrdar://185125327\n\nReviewed by Alan Baradlay.\n\nThe CSSWG resolved to rename the flow-tolerance property to fit-tolerance\n(https://github.com/w3c/csswg-drafts/issues/10884), so rename it here, along\nwith the Style::FlowTolerance value type and the GridData member that stores it.\n\nflow-tolerance is kept as an alias so that content written against the old name\nkeeps working. This is a temporary measure and will likely be removed at\nsome point in the future. To help facilitate this process we show a\ndeprecation warning in the web inspector. When the old name is used the\nweb inspector will show a warning icon next to the declaration and a\nhover will inform the user that the property name is deprecated.\n\n* Source/WebInspectorUI/UserInterface/Views/SpreadsheetStyleProperty.js:\nRather than creating a generic deprecated alias mechanism I just extend\nthe logic here to consider the flow-tolerance/fit-tolerance case\ndirectly. I do not expect this type of behavior to become more of a\ncommon occurrence in the future and definitely would not want to\nencourage it!\n\n* Source/WebCore/css/CSSProperties.json:\nThe property definition was sitting in the middle of the inset-* block,\nwhich it has nothing to do with. Move it to the end of the grid family so\nit lives next to the other css-grid properties. This is a pure move; the\ndefinition itself is unchanged.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-lanes/animation/flow-tolerance-interpolation.html: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-lanes/animation/flow-tolerance-interpolation-expected.txt: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-lanes/animation/fit-tolerance-interpolation.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-lanes/animation/fit-tolerance-interpolation-expected.txt: Added.\nThe interpolation test has to use the canonical property name rather than\nthe alias. The Web Animations portion of the interpolation harness hands\nthe property to Element.animate() in IDL form, and\nIDLAttributeNameToAnimationPropertyName() rejects any name that does not\nround trip back to itself, so keyframes naming \"flowTolerance\" are\ndropped and the Web Animations subtests all observe the initial value\ninstead of an animated one. The CSS Transitions and CSS Animations\nportions set the property through style.setProperty(), where the alias\nresolves normally, which is why only part of the test was affected.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/css/css-cascade/all-prop-initial-xml-expected.txt:\nThis test enumerates the computed style property list, which is sorted by\nproperty name and does not include aliases, so the entry is renamed and\nalso moves out of the \"fl\" block into the \"fi\" block.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\nFollow the test rename.\n\nCanonical link: https://commits.webkit.org/319795@main",
      "email": "sammy.gill@apple.com",
      "hash": "117c2123daa060fcada4218713a7083116dd29bc",
      "subject": "[Grid Lanes] Rename flow-tolerance to fit-tolerance"
    },
    "319796@main": {
      "author": "Tyler Wilcock",
      "avatar": "https://www.gravatar.com/avatar/9545082e6bed96158a9f52dac6e4b869?d=identicon\u0026s=64",
      "cl": "319796@main",
      "clUrl": "https://commits.webkit.org/319796@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322343\nrdar://185613759\n\nReviewed by Dominic Mazzoni.\n\nTen AT-facing macOS accessibility APIs had either no layout test at all, or a single\ntest that was non-comprehensive. This commit adds fifteen tests filling these gaps.\n\ntable-visible-cells.html\n  - Reason added: AXVisibleCells is a real macOS accessibility API with no test.\n\ntable-visible-cells-tree-membership.html\n  - Reason added: same API, exercise it across a mutation.\n\ngrid-selected-cells-deselect.html\n  - Reason added: AXSelectedCells has one test, and it only ever grows the selection.\n\nin-description-list-term-roles.html\n  - Reason added: AXIsInDescriptionListTerm was only covered by tests under\n    accessibility/ios-simulator/, so the macOS attribute path was never exercised.\n\nin-description-list-term-reparent.html\n  - Reason added: same API exercised across a mutation.\n\nparagraph-text-marker-range-is-position-independent.html\n  - Reason added: AXParagraphTextMarkerRangeForTextMarker had only one test.\n    This one exercises the API from multiple positions within the paragraph.\n\nsentence-text-marker-range-across-inline-boundary.html\n  - Reason added: AXSentenceTextMarkerRangeForTextMarker had only one test.\n    Tests consistency of sentence and paragraph APIs.\n\ntext-marker-range-for-line-index-base.html\n  - Reason added: AXTextMarkerRangeForLine had only one test\n    Exercises the zero vs. one indexing expectation for the API.\n\nrelative-index-for-text-marker-container.html\n  - Reason added: AXRelativeIndexForTextMarker had only one test.\n\nstyle-text-marker-range-inline-boundary.html\n  - Reason added: AXStyleTextMarkerRangeForTextMarker has only one test, and it only\n    varies font-style across block-level siblings.\n\nstyle-text-marker-range-color-attributes.html\n  - Reason added: same API, tests the presence of color.\n\nmathml-multiscript-odd-postscripts.html\n  - Reason added: Adds coverage for multiscript pairs.\n\nmathml-multiscript-none-holds-slot.html\n  - Reason added: same API, tests edgecases for the none-slot.\n\nspinbutton-increment-decrement-buttons.html\n  - Reason added: AXDecrementButton had one test, and it only asserts the attribute\n    is advertised via isAttributeSupported, never that it resolves to anything.\n\nspinbutton-press-steps-value.html\n  - Reason added: nothing connected the exposed spin button parts to what they do.\n\n* LayoutTests/accessibility/mac/grid-selected-cells-deselect-expected.txt: Added.\n* LayoutTests/accessibility/mac/grid-selected-cells-deselect.html: Added.\n* LayoutTests/accessibility/mac/in-description-list-term-reparent-expected.txt: Added.\n* LayoutTests/accessibility/mac/in-description-list-term-reparent.html: Added.\n* LayoutTests/accessibility/mac/in-description-list-term-roles-expected.txt: Added.\n* LayoutTests/accessibility/mac/in-description-list-term-roles.html: Added.\n* LayoutTests/accessibility/mac/paragraph-text-marker-range-is-position-independent-expected.txt: Added.\n* LayoutTests/accessibility/mac/paragraph-text-marker-range-is-position-independent.html: Added.\n* LayoutTests/accessibility/mac/previous-line-start-text-marker-expected.txt: Added.\n* LayoutTests/accessibility/mac/previous-line-start-text-marker.html: Added.\n* LayoutTests/accessibility/mac/relative-index-for-text-marker-container-expected.txt: Added.\n* LayoutTests/accessibility/mac/relative-index-for-text-marker-container.html: Added.\n* LayoutTests/accessibility/mac/scroll-view-scrollbar-attributes-expected.txt: Added.\n* LayoutTests/accessibility/mac/scroll-view-scrollbar-attributes.html: Added.\n* LayoutTests/accessibility/mac/sentence-text-marker-range-across-inline-boundary-expected.txt: Added.\n* LayoutTests/accessibility/mac/sentence-text-marker-range-across-inline-boundary.html: Added.\n* LayoutTests/accessibility/mac/spinbutton-increment-decrement-buttons-expected.txt: Added.\n* LayoutTests/accessibility/mac/spinbutton-increment-decrement-buttons.html: Added.\n* LayoutTests/accessibility/mac/spinbutton-press-steps-value-expected.txt: Added.\n* LayoutTests/accessibility/mac/spinbutton-press-steps-value.html: Added.\n* LayoutTests/accessibility/mac/style-text-marker-range-color-attributes-expected.txt: Added.\n* LayoutTests/accessibility/mac/style-text-marker-range-color-attributes.html: Added.\n* LayoutTests/accessibility/mac/style-text-marker-range-inline-boundary-expected.txt: Added.\n* LayoutTests/accessibility/mac/style-text-marker-range-inline-boundary.html: Added.\n* LayoutTests/accessibility/mac/table-visible-cells-expected.txt: Added.\n* LayoutTests/accessibility/mac/table-visible-cells-tree-membership-expected.txt: Added.\n* LayoutTests/accessibility/mac/table-visible-cells-tree-membership.html: Added.\n* LayoutTests/accessibility/mac/table-visible-cells.html: Added.\n* LayoutTests/accessibility/mac/text-marker-range-for-line-index-base-expected.txt: Added.\n* LayoutTests/accessibility/mac/text-marker-range-for-line-index-base.html: Added.\n* LayoutTests/accessibility/mathml-multiscript-none-holds-slot-expected.txt: Added.\n* LayoutTests/accessibility/mathml-multiscript-none-holds-slot.html: Added.\n* LayoutTests/accessibility/mathml-multiscript-odd-postscripts-expected.txt: Added.\n* LayoutTests/accessibility/mathml-multiscript-odd-postscripts.html: Added.\n* LayoutTests/platform/ios/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319796@main",
      "email": "tyler_w@apple.com",
      "hash": "a4bb5774559f6cc7621f80c0e4eff8cf0fb9b60a",
      "subject": "AX: Add coverage for ten untested or under-tested macOS accessibility APIs"
    },
    "319797@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319797@main",
      "clUrl": "https://commits.webkit.org/319797@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322463\nrdar://185751998\n\nReviewed by Jean-Yves Avenard.\n\nHTMLVideoElement+PictureInPicture.idl declares both autoPictureInPicture and\ndisablePictureInPicture as [Reflect], so the generated bindings read and write\nthe content attribute directly on HTMLVideoElement:\n\n    impl.hasAttributeWithoutSynchronization(HTMLNames::autopictureinpictureAttr)\n    impl.setBooleanAttribute(HTMLNames::autopictureinpictureAttr, ...)\n\nNothing has called the four static accessors on the supplement since\n216923@main added [Reflect] without removing them, and m_autoPictureInPicture\n/ m_disablePictureInPicture have been state that nobody reads. Remove all six.\n\nAlso remove m_eventTaskGroup, which is never referenced anywhere - the class\nqueues its enterpictureinpicture and leavepictureinpicture tasks through\nActiveDOMObject::queueTaskKeepingObjectAlive() - along with the now-unneeded\nCancellableTask.h include.\n\nNo behavior change, so no new tests.\n\n* Source/WebCore/Modules/pictureinpicture/HTMLVideoElementPictureInPicture.cpp:\n(WebCore::HTMLVideoElementPictureInPicture::autoPictureInPicture): Deleted.\n(WebCore::HTMLVideoElementPictureInPicture::setAutoPictureInPicture): Deleted.\n(WebCore::HTMLVideoElementPictureInPicture::disablePictureInPicture): Deleted.\n(WebCore::HTMLVideoElementPictureInPicture::setDisablePictureInPicture): Deleted.\n* Source/WebCore/Modules/pictureinpicture/HTMLVideoElementPictureInPicture.h:\n\nCanonical link: https://commits.webkit.org/319797@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "396f000caabcc215d7cce0ffc5f5663352812a38",
      "subject": "Remove dead autoPictureInPicture/disablePictureInPicture accessors in HTMLVideoElementPictureInPicture"
    },
    "319798@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "319798@main",
      "clUrl": "https://commits.webkit.org/319798@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322445\n\nReviewed by Alexey Proskuryakov.\n\nAlways block the external URLs in subframes to make test results consistent with regards to site isolation.\n\n* LayoutTests/fast/loader/onload-policy-ignore-for-frame-async-delegates-expected.txt:\n* LayoutTests/fast/loader/onload-policy-ignore-for-frame-expected.txt:\n* LayoutTests/platform/wk2/http/tests/misc/will-send-request-returns-null-on-redirect-expected.txt:\n* Tools/WebKitTestRunner/TestController.cpp:\n\nCanonical link: https://commits.webkit.org/319798@main",
      "email": "rniwa@webkit.org",
      "hash": "61f9f23b682aa75addebeaf1646cbdb9352e0897",
      "subject": "Unconditionally block external URLs in subframes"
    },
    "319799@main": {
      "author": "Said Abou-Hallawa",
      "avatar": "https://www.gravatar.com/avatar/ae80a929a378a055822829ae63903296?d=identicon\u0026s=64",
      "cl": "319799@main",
      "clUrl": "https://commits.webkit.org/319799@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315295\nrdar://177298988\n\nReviewed by Jean-Yves Avenard.\n\nImageDecoderFactoryAVF is a new class which will replace the calls and uses of\ninstalledFactories() in ImageDecoder.cpp.\n\ninstalledFactories() returns  a process-wide Vector\u003cImageDecoderFactory\u003e with\nNO synchronization. A worker thread can reach to installedFactories() to call\ncreateImageDecoder(). The main thread can also reach to installedFactories() but\nto clearFactories() which deletes the heap-allocated of Vector\u003cImageDecoderFactory\u003e\nwhich can lead to UAF.\n\nThe fix is to move the code of installedFactories() to a new class called\nImageDecoderFactoryAVF. This class will contain a single DecoderInterface but\nguarded by a Lock. All accesses to the DecoderInterface have to preceded by\nacquiring the Lock through a Locker.\n\n* Source/WebCore/SourcesCocoa.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/platform/graphics/ImageDecoder.cpp:\n(WebCore::ImageDecoder::create):\n(WebCore::ImageDecoder::supportsMediaType):\n(WebCore::createInProcessImageDecoderAVFObjC): Deleted.\n(WebCore::platformRegisterFactories): Deleted.\n(WebCore::installedFactories): Deleted.\n(WebCore::ImageDecoder::installFactory): Deleted.\n(WebCore::ImageDecoder::resetFactories): Deleted.\n(WebCore::ImageDecoder::clearFactories): Deleted.\n(WebCore::createInProcessAsyncImageDecoderAVFObjC): Deleted.\n* Source/WebCore/platform/graphics/ImageDecoder.h:\n* Source/WebCore/platform/graphics/avfoundation/ImageDecoderFactoryAVF.cpp: Added.\n(WebCore::ImageDecoderFactoryAVF::singleton):\n(WebCore::ImageDecoderFactoryAVF::ImageDecoderFactoryAVF):\n(WebCore::ImageDecoderFactoryAVF::platformDecoderInterface):\n(WebCore::ImageDecoderFactoryAVF::set):\n(WebCore::ImageDecoderFactoryAVF::reset):\n(WebCore::ImageDecoderFactoryAVF::supportsMediaType const):\n(WebCore::ImageDecoderFactoryAVF::createImageDecoder const):\n* Source/WebCore/platform/graphics/avfoundation/ImageDecoderFactoryAVF.h: Added.\n* Source/WebKit/WebProcess/GPU/media/RemoteImageDecoderAVFManager.cpp:\n(WebKit::RemoteImageDecoderAVFManager::setUseGPUProcess):\n(WebKit::RemoteImageDecoderAVFManager::createAsyncImageDecoder): Deleted.\n\nOriginally-landed-as: 305413.1018@safari-7624.5-branch (187f143ff26f). rdar://185369465\n* Source/WebKit/WebProcess/GPU/media/RemoteImageDecoderAVFManager.h:\n\nCanonical link: https://commits.webkit.org/319799@main",
      "email": "said@apple.com",
      "hash": "b17b55f6a8fb1f801cf24aceb70a867e7db87af1",
      "subject": "Make ImageDecoderFactoryAVF thread safe"
    },
    "319801@main": {
      "author": "Per Arne Vollan",
      "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64",
      "cl": "319801@main",
      "clUrl": "https://commits.webkit.org/319801@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317320\nrdar://177766868\n\nReviewed by Chris Dumez.\n\nThe method processValueWithDefaultPolicy can end up deleting the ScriptExecutionContext passed as parameter.\nThis patch fixes this by adding protection of ScriptExecutionContext.\n\nTest: fast/html/trusted-types-set-attribute-iframe-removal-crash.html\n\n* LayoutTests/fast/html/trusted-types-set-attribute-iframe-removal-crash.html: Added.\n* LayoutTests/fast/html/trusted-types-set-attribute-iframe-removal-crash-expected.txt: Added.\n* Source/WebCore/dom/Attr.cpp:\n(WebCore::Attr::setValue):\n* Source/WebCore/dom/Element.cpp:\n(WebCore::Element::setAttribute):\n(WebCore::Element::setAttributeNode):\n(WebCore::Element::setAttributeNodeNS):\n(WebCore::Element::setAttributeNS):\n* Source/WebCore/dom/TrustedType.cpp:\n(WebCore::trustedTypeCompliantString):\n(WebCore::requireTrustedTypesForPreNavigationCheckPasses):\n\nOriginally-landed-as: 305413.1005@safari-7624.5-branch (a26cf8dc190a). rdar://185368259\nCanonical link: https://commits.webkit.org/319801@main",
      "email": "pvollan@apple.com",
      "hash": "5549b3663c5d3904eab780389cd14c58523d1dfa",
      "subject": "Use-after-free of ScriptExecutionContext in trustedTypeCompliantString"
    },
    "319802@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "319802@main",
      "clUrl": "https://commits.webkit.org/319802@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322452\n\u003crdar://problem/185736289\u003e\n\nReviewed by Antti Koivisto.\n\nGrid-lanes keep their anon boxes similar to flex and grid.\n\nCovered by imported/w3c/web-platform-tests/css/css-grid/grid-lanes/intrinsic-sizing/grid-lanes-contain-intrinsic-size-006.html and -008.html.\n\n* Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp:\n(WebCore::RenderTreeBuilder::Block::attach):\n\nCanonical link: https://commits.webkit.org/319802@main",
      "email": "zalan@apple.com",
      "hash": "b5fcdaaa6eb02279ef986373e64c17560e781a40",
      "subject": "[anon-block-removal] A grid-lanes container gets no anonymous item for its inline content"
    },
    "319803@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "319803@main",
      "clUrl": "https://commits.webkit.org/319803@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322356\nrdar://185638011\n\nReviewed by Antti Koivisto.\n\nAdd missing initialLogicalTopLeft initialization (couldn't find a repro test case).\n\n* Source/WebCore/layout/formattingContexts/inline/InlineFormattingContext.cpp:\n(WebCore::Layout::InlineFormattingContext::createDisplayContentForLineFromCachedContent):\n\nCanonical link: https://commits.webkit.org/319803@main",
      "email": "zalan@apple.com",
      "hash": "6fb54e2ec478d47519a41fc57fbcdd22b618cb86",
      "subject": "[inline] LineGeometry::initialLogicalTopLeft is left unset for a line built from cached maximum intrinsic width content"
    },
    "319804@main": {
      "author": "Ryan Haddad",
      "avatar": "https://www.gravatar.com/avatar/b7d8cd2dec546cac2524e4b58181f9d5?d=identicon\u0026s=64",
      "cl": "319804@main",
      "clUrl": "https://commits.webkit.org/319804@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322279\nrdar://problem/185518939\n\nReviewed by Aakash Jain.\n\nRunning tests/WebKitBot.test.mjs locally fails because src/WebKitBot.mjs imports https-proxy-agent,\nwhich is not declared in package.json. This means that`npm ci` alone resolves only the transitive\nv5, and `import { HttpsProxyAgent }` fails against it because v5 is CommonJS with no statically\ndetectable named export. The deployed bot is unaffected, since the image supplies v8 and Node\nresolves it natively.\n\nAlong with declaring the dependency, move the pure command parsing out of WebKitBot.mjs into\na new module with no imports at all, so the tests exercise it without loading the Slack clients\nor the proxy agent. Other than a drive-by fix to drop an unnecessary escape in the revision\nregexp (\\@ -\u003e @), this is a straight move.\n\n* Tools/WebKitBot/package.json: Declare https-proxy-agent so `npm ci` matches the deployed image.\n* Tools/WebKitBot/package-lock.json: Hoist https-proxy-agent v8, v5 stays nested under axios and jsdom.\n* Tools/WebKitBot/src/CommandParser.mjs: Added. Moved from WebKitBot.mjs.\n(parseBugId): Moved.\n(parsePRUrl): Moved.\n(extractRevision): Moved.\n(buildGitWebkitRevertCommand): Moved.\n(extractRevisionsAndReason): Moved.\n(extractCommandAndArgs): Moved.\n(extractTextIfMentioned): Moved.\n* Tools/WebKitBot/src/WebKitBot.mjs: Import the parsing helpers from CommandParser.mjs.\n* Tools/WebKitBot/tests/WebKitBot.test.mjs: Import from CommandParser.mjs.\n\nCanonical link: https://commits.webkit.org/319804@main",
      "email": "ryanhaddad@apple.com",
      "hash": "950d24e29c691c014281861b30b28ccddecc96cb",
      "subject": "[webkitbot] Test suite cannot run due to undeclared https-proxy-agent dependency"
    },
    "319805@main": {
      "author": "Adrian Perez de Castro",
      "avatar": "https://www.gravatar.com/avatar/30ffea8cf404586741a8f5f7110c0914?d=identicon\u0026s=64",
      "cl": "319805@main",
      "clUrl": "https://commits.webkit.org/319805@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322484\n\nReviewed by Patrick Griffis.\n\nWebKitImage is documented to use premultiplied alpha, but when wrapping the\npixel data with a SkImage the flag kUnpremul_SkAlphaType was used. The fix\nis to use the correct kPremul_SkAlphaType flag instead\n\nThe \"/webkit/WebKitImage/loadable-icon-interface-sync-load\" test case is\nmodified to add encoding of a WebKitImage with a translucent pixel as PNG\nand then reading it back using plain libpng calls to verify that the pixel\nwas stored un-premultiplied correctly in the PNG (as per the spec).\n\n* Source/WebKit/UIProcess/API/glib/WebKitImage.cpp:\n(webkitImageLoad):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestWebKitImage.cpp:\n(testWebKitImageLoadableIconLoadSync):\n\nCanonical link: https://commits.webkit.org/319805@main",
      "email": "aperez@igalia.com",
      "hash": "05b0362e7afb422264eec6fa23675d71d700855d",
      "subject": "[GTK][WPE] Using g_loadable_icon_load[_async] on a WebKitImage provides wrong translucent pixel values"
    },
    "319806@main": {
      "author": "Keith Miller",
      "avatar": "https://www.gravatar.com/avatar/bddc1595b29098429a6ce7c8bf4aced2?d=identicon\u0026s=64",
      "cl": "319806@main",
      "clUrl": "https://commits.webkit.org/319806@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322502\nrdar://185804679\n\nReviewed by Zak Ridouh and Geoffrey Garen.\n\n319787@main moved timestamp_extrapolator.h from\nmodules/video_coding/timing/ to video/timing/ but failed to update the\npath in the WebRTCPrefix.h header.\n\n* Source/ThirdParty/libwebrtc/WebRTCPrefix.h:\n\nCanonical link: https://commits.webkit.org/319806@main",
      "email": "keith_miller@apple.com",
      "hash": "0fdbfc2c77ce3e85884bef7b1a48fcfb7630c28f",
      "subject": "Fix WebRTCPrefix.h after 319787@main"
    },
    "319807@main": {
      "author": "Kai Tamkun",
      "avatar": "https://www.gravatar.com/avatar/dff073cba21885df4d9f73ed3cc493c2?d=identicon\u0026s=64",
      "cl": "319807@main",
      "clUrl": "https://commits.webkit.org/319807@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314836\nrdar://176792596\n\nReviewed by Yusuke Suzuki.\n\nThis patch modifies the Absence case for PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint\nto consult the non-reified static property table if the property isn't present in the property table.\nThis prevents the Abstract Interpreter from misfolding GetById.\n\nTest: JSTests/stress/absence-propertycondition-and-non-reified-static-property-tables.js\n\n* JSTests/stress/absence-propertycondition-and-non-reified-static-property-tables.js: Added.\n(assert):\n(assertThrows):\n(setup):\n(f):\n* Source/JavaScriptCore/bytecode/PropertyCondition.cpp:\n(JSC::PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint const):\n\nOriginally-landed-as: 305413.1014@safari-7624.5-branch (d0cd53048a11). rdar://185368891\nCanonical link: https://commits.webkit.org/319807@main",
      "email": "k_tamkun@apple.com",
      "hash": "33876268a1c683eff9a7b1a74e2a1fe6177ed664",
      "subject": "[JavaScriptCore] Absence PropertyCondition does not consult non-reified static property tables"
    },
    "319808@main": {
      "author": "Marta Darbinyan",
      "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64",
      "cl": "319808@main",
      "clUrl": "https://commits.webkit.org/319808@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318485\nrdar://181274857\n\nUnreviewed test Gardening\n\nAdding new test expectation and update existing one based on failing configs.\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/319808@main",
      "email": "darbinyan@apple.com",
      "hash": "47bd52d9c545d4ee7dac1bf50bbd1b57db52e6ae",
      "subject": "[Gardening]: [macOS Release] TestWebKitAPI.WebKit.MediaBufferingPolicy is a flaky failure"
    },
    "319809@main": {
      "author": "Ben Nham",
      "avatar": "https://www.gravatar.com/avatar/dc0914eabf69047ee3397794c2d17bf7?d=identicon\u0026s=64",
      "cl": "319809@main",
      "clUrl": "https://commits.webkit.org/319809@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322336\nrdar://185594943\n\nReviewed by Per Arne Vollan.\n\nOn Mac, cached and prewarmed processes run at the background rather than the idle jetsam priority\nlevel for a few reasons:\n\n- All processes run with a permanent jetsam boost assertion.\n- Prewarmed processes run with a background lifetime activity until the first page attaches to the\n  process (mostly due to the complexity around the setRunningBoardThrottlingEnabled pref).\n- Cached processes purposely hold a background activity for ~30s (see cachedProcessSuspensionDelay)\n  as a PLT optimization, which boosts the process to the background jetsam level for that period.\n\nIdeally, cached and prewarmed processes would always be at the idle jetsam level, because that\nallows the kernel jetsam to kill them to reclaim memory as necessary instead of needing to wait\nuntil the memory pressure handler fires in the UIProcess (which can take a while since the system\npurposely spaces out sending memory pressure notifications to avoid thundering herd issues).\n\n(Note that processes in the WebBackForwardCache are already at idle jetsam level, since we only\ninsert them in to that cache if they are holding no activities.)\n\nThe cleanest way I could figure out how to shoehorn this in to the existing ProcessThrottler\nmachinery was to add a new ProcessThrottler property that makes background activities use the idle\njetsam band. This maps to a new BackgroundIdleBand assertion type.\n\nOne confusing thing is that the BackgroundIdleBand assertion type maps to the existing \"Suspended\"\nassertion in LifecyclePolicy. Despite the name, this is an assertion type that allows the process,\nto run, but at the idle jetsam priority, which is what we want here.\n\nTesting that cached and prewarmed processes actually get to idle jetsam level reliably is pretty\ntricky because we may refuse to spawn those types of processes while under memory pressure, and the\nsystem might kill those processes before we can read their jetsam level. Also, reading the jetsam\nlevel of a process as an unprivileged user can basically only done via `top`. Instead, the API test\nhere just makes sure that `setJetsamBoost` itself works.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ProcessJetsamPriority.mm\n\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivateForTesting.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewTesting.mm:\n(-[WKWebView _processAssertionTypeForTesting]):\n(-[WKWebView _setJetsamBoostEnabledForTesting:]):\n* Source/WebKit/UIProcess/AuxiliaryProcessProxy.cpp:\n(WebKit::AuxiliaryProcessProxy::didFinishLaunching):\n(WebKit::AuxiliaryProcessProxy::setJetsamBoostEnabled):\n(WebKit::AuxiliaryProcessProxy::updateJetsamBoostAssertion):\n* Source/WebKit/UIProcess/AuxiliaryProcessProxy.h:\n* Source/WebKit/UIProcess/Cocoa/ProcessAssertionCocoa.mm:\n(WebKit::runningBoardNameForAssertionType):\n(WebKit::runningBoardDomainForAssertionType):\n(WebKit::ProcessAndUIAssertion::updateRunInBackgroundCount):\n* Source/WebKit/UIProcess/ProcessAssertion.cpp:\n(WebKit::processAssertionTypeDescription):\n* Source/WebKit/UIProcess/ProcessAssertion.h:\n* Source/WebKit/UIProcess/ProcessThrottler.cpp:\n(WebKit::ProcessThrottler::assertionName const):\n(WebKit::ProcessThrottler::assertionTypeForState):\n(WebKit::ProcessThrottler::setThrottleState):\n(WebKit::ProcessThrottler::acquireAssertion):\n(WebKit::ProcessThrottler::setShouldBackgroundActivitiesUseIdleJetsamBand):\n* Source/WebKit/UIProcess/ProcessThrottler.h:\n(WebKit::ProcessThrottler::assertionTypeForTesting const):\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::create):\n(WebKit::WebProcessProxy::setIsInProcessCache):\n(WebKit::WebProcessProxy::markIsNoLongerInPrewarmedPool):\n* Tools/TestWebKitAPI/SourcesCocoa.txt:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ProcessJetsamPriority.mm: Added.\n(waitForAssertionType):\n(TEST(ProcessJetsamPriority, DisablingJetsamBoostMovesBackgroundAssertionToIdleBand)):\n(TEST(ProcessJetsamPriority, DisablingJetsamBoostDoesNotAffectForegroundAssertion)):\n\nCanonical link: https://commits.webkit.org/319809@main",
      "email": "nham@apple.com",
      "hash": "23997cdd825d50528bcc77d7b532e44541d6bf45",
      "subject": "Make prewarmed and cached processes run in idle jetsam band"
    },
    "319810@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "319810@main",
      "clUrl": "https://commits.webkit.org/319810@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322316\nrdar://problem/185555283\n\nReviewed by Alan Baradlay.\n\nRenderGrid held onto a GridLanesLayout object as a member and generally\nwe want to avoid having items live on the renderer unless they are\nneeded for some reason after layout. There are a couple of grid lanes\nrelated information that is needed for the web inspector but there is no\nneed to hold onto the whole object so in the patch we change it to be a\nlocal stack variable that is alive during the duration of layout.\n\nThis is mostly a mechanical change where we create the GridLanesLayout\nobject on the stack and then thread it through different areas of the\ncode where it is needed. There are some bits of RenderGrid code that\nseem to need access to this object so we thread it through as an\noptional std::ref to appease both the Grid and Grid Lanes situations.\n\n* Source/WebCore/inspector/InspectorOverlay.cpp:\n(WebCore::InspectorOverlay::buildGridOverlay):\nThis is the only piece of information that is needed outside of layout.\nThe web inspector overlay needs to know the grid content size so we will\nkeep that one piece of information on the renderer and label it so it is\nclear what it is being used for.\n\n* Source/WebCore/rendering/GridLanesLayout.cpp:\n(WebCore::GridLanesLayout::performGridLanesPlacement):\npopulateGridPositionsForDirection needs access to a GridLanesLayout\nobject in this case so we wrap it in a optional std::ref so that it can\nuse it.\n\n* Source/WebCore/rendering/GridLanesLayout.h:\nNeed to initialize some of these members as well!\n\n(WebCore::GridLanesLayout::gridGap const): Deleted.\nUnused.\n\n* Source/WebCore/rendering/GridTrackSizingAlgorithm.cpp:\n(WebCore::GridTrackSizingAlgorithm::computeTrackBasedSize const):\nThis one is a little interesting because all callers of this function\ncould not actually trigger the if (isDirectionInStackingAxis()) logic.\nSo I remove that code and replace it with a debug assert instead.\n\nCanonical link: https://commits.webkit.org/319810@main",
      "email": "sammy.gill@apple.com",
      "hash": "efff72a3b9ffcf15c4af0b28648a7c209a5d8eb6",
      "subject": "[Grid Lanes] GridLanesLayout does not need to live on RenderGrid."
    },
    "319811@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "319811@main",
      "clUrl": "https://commits.webkit.org/319811@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322507\nrdar://185810866\n\nReviewed by Richard Robinson.\n\nBoth the rotation GR and the magnification GR independently feed the\nview gesture controller. If their locations are inconsistent, the\nresulting gesture event stream will seem to snap back and forth as the\nstream of inconsistent locations keep stomping over each other. This\npatch placates said inconsistency.\n\nCanonical link: https://commits.webkit.org/319811@main",
      "email": "a_protyasha@apple.com",
      "hash": "d669c9d8dcf76fdd7b1ca1ee34b1e97e74c43b68",
      "subject": "[AppKit Gestures] Rotation and magnification gesture location inconsistencies produce unwanted jank in resulting gesture event streams"
    },
    "319812@main": {
      "author": "Sergey Rubanov",
      "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64",
      "cl": "319812@main",
      "clUrl": "https://commits.webkit.org/319812@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322493\n\nReviewed by Keith Miller.\n\nThose two fields are adjacent on WasmCallableFunction. The trampoline\nnow loads them with loadPairPtr.\n\n* Source/JavaScriptCore/wasm/WasmBinding.cpp:\n\nCanonical link: https://commits.webkit.org/319812@main",
      "email": "chi187@gmail.com",
      "hash": "b5928f9be1258f7494277df09219007020329a00",
      "subject": "[JSC][Wasm] Use loadPair for targetInstance and entrypoint in wasmToWasm stubs"
    },
    "319813@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "319813@main",
      "clUrl": "https://commits.webkit.org/319813@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322483\nrdar://185776232\n\nReviewed by Tim Horton.\n\nIn this patch, we simply align the enablement criteria for both\nfeatures.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/319813@main",
      "email": "a_protyasha@apple.com",
      "hash": "34a2ffae86c5154b16af0975c901c21ae744d8e4",
      "subject": "[AppKit Gestures] Gesture event support should follow regular AppKit gestures enablement"
    },
    "319814@main": {
      "author": "Alex Christensen",
      "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64",
      "cl": "319814@main",
      "clUrl": "https://commits.webkit.org/319814@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322513\nrdar://185815685\n\nUnreviewed.\n\nThe symbol of SetAbslHardeningEnabled was missing when linking after 319791@main\nA header was missing after 319799@main\n\n* Source/ThirdParty/libwebrtc/CMakeLists.txt:\n* Source/WebCore/PlatformCocoa.cmake:\n\nCanonical link: https://commits.webkit.org/319814@main",
      "email": "achristensen@apple.com",
      "hash": "1de8c29dddf8ebdf5996c39043778ca3e5396c8d",
      "subject": "Fix Cocoa CMake build"
    },
    "319815@main": {
      "author": "Ryan Haddad",
      "avatar": "https://www.gravatar.com/avatar/b7d8cd2dec546cac2524e4b58181f9d5?d=identicon\u0026s=64",
      "cl": "319815@main",
      "clUrl": "https://commits.webkit.org/319815@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=253031\nrdar://105998389\n\nReviewed by Aakash Jain.\n\nA commit identifier such as 319186@main matches local@domain, so Slack treats it as an\nemail address and linkifies it, delivering the message text to @webkitbot as:\n\n    \u003c@UBOT\u003e revert \u003cmailto:319186@main|319186@main\u003e Causes MotionMark regression\n\nThe text extraction only unwrapped \u003chttps://url|label\u003e links, so the mailto wrapper\nsurvived preprocessing. This caused the whole argument list to fall through to the \"reason\",\nresulting in the \"Failed to parse revision and reason\" response.\n\nIn addition to unwrapping mailto links, accept identifiers pasted as commits.webkit.org links,\nsince that is the form webkitbot itself posts and people copy them back into the channel.\n\n* Tools/WebKitBot/src/CommandParser.mjs:\n(extractRevision): Strip a leading commits.webkit.org URL from each candidate.\n(extractTextIfMentioned): Strip Slack's auto-linked email addresses.\n* Tools/WebKitBot/src/WebKitBot.mjs:\n(WebKitBot.prototype.revertCommand): Log and echo the arguments that failed to parse, so\nissues like this show up in the pod logs in the future.\n* Tools/WebKitBot/tests/WebKitBot.test.mjs: Add coverage for linkified identifiers,\ncommits.webkit.org links, and for leaving user mentions in the reason intact.\n\nCanonical link: https://commits.webkit.org/319815@main",
      "email": "ryanhaddad@apple.com",
      "hash": "24562bd10d496a41b56a1d593737f1adcb2188f0",
      "subject": "[webkitbot] webkitbot fails to parse identifiers when they are linkified in Slack"
    },
    "319816@main": {
      "author": "Elika Etemad",
      "avatar": "https://www.gravatar.com/avatar/55e113d03e0552e6df90ecbc15acd9b8?d=identicon\u0026s=64",
      "cl": "319816@main",
      "clUrl": "https://commits.webkit.org/319816@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321699\nrdar://184843832\n\nReviewed by Tim Nguyen.\n\nThis ports over the following updates from the demo:\n- Switching padding-block to use lh units, so it scales with line-height.\n- Applying align-items: center to the select itself, so the button content\n  is also centered (not just the ::picker-icon).\n- Specificity clean-up by simplifying and reordering style rules.\n\nAlso switches ::picker-icon and ::checkmark rule to using the 'font' shorthand\nper https://github.com/w3c/csswg-drafts/issues/14250\n\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/select-base-appearance-computed-style-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-select-element/customizable-select/update.css:\n(select,):\n(select:hover,):\n(select:active,):\n(select:user-invalid):\n(select::picker-icon,):\n(select option,):\n(select option:hover,):\n(select option:active):\n(select option:disabled,):\n(select option::checkmark,):\n(select:enabled:hover:not(:user-invalid),): Deleted.\n(select:enabled:active,): Deleted.\n(select option:enabled:hover,): Deleted.\n(select option:enabled:active): Deleted.\n* LayoutTests/platform/ios/imported/w3c/web-platform-tests/html/rendering/widgets/the-select-element/select-as-listbox-default-styles.tentative-expected.txt:\n* Source/WebCore/css/html.css:\n(select:-internal-uses-menulist):\n(select:-internal-uses-menulist:hover):\n(select:-internal-uses-menulist:active):\n(select:-internal-uses-menulist:user-invalid):\n(select::picker-icon):\n(select:-internal-uses-menulist option):\n(select option:hover,):\n(select option:active):\n(select option:disabled):\n(select option::checkmark):\n(@media (prefers-contrast) select option:is(:hover, :focus-visible, :active)):\n(select:-internal-uses-menulist:enabled:hover:not(:user-invalid)): Deleted.\n(select:-internal-uses-menulist:enabled:active): Deleted.\n(select option:enabled:hover,): Deleted.\n(select option:enabled:active): Deleted.\n(@media (prefers-contrast) select option:enabled:is(:hover, :focus-visible, :active)): Deleted.\n* Source/WebCore/style/computed/StyleComputedStyle.cpp:\n\nCanonical link: https://commits.webkit.org/319816@main",
      "email": "fantasai.bugs@inkedblade.net",
      "hash": "3a999a1a45ed3cf451677c24ee47f18bd3ce7e65",
      "subject": "Sync alignment, padding, specificity, changes for appearance: base-select styling"
    },
    "319817@main": {
      "author": "Dan Hecht",
      "avatar": "https://www.gravatar.com/avatar/080f47d912b1b34d0be8293f825d132d?d=identicon\u0026s=64",
      "cl": "319817@main",
      "clUrl": "https://commits.webkit.org/319817@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317142\nrdar://178282225\n\nReviewed by Yusuke Suzuki.\n\nhandleHostCall performs the host call which may execute JS that\nfires a watchpoint invalidating the passed CallLinkInfo. So,\nit's not safe to modify *CallLinkInfo after the host call.\n\nSo, make the callers of virtualForWithFunction skip the\nlinkPolymorphicCall call in this case. This aligns the behavior\nof operationPolymorphicCall / llint_polymorphic_call with linkFor.\n\nHowever, to avoid the InternalFunction case potentially getting\nstuck in the polymorphic mode slow path, return the JSCell in this case.\nThis is a slight change in behavior: before this change,\nInternalFunction would have caused the CallLinkInfo to downgrade\nto virtual mode. With this change, it can remain in polymorphic\nmode. This also aligns with linkFor behavior.\n\nTest: JSTests/stress/operation-polymorphic-call-host-call-ic-reset.js\n\n* JSTests/stress/operation-polymorphic-call-host-call-ic-reset.js: Added.\n(g2):\n(g3):\n(getP):\n(evil.new.Proxy):\n(evil.new.Proxy.apply):\n* Source/JavaScriptCore/bytecode/RepatchInlines.h:\n(JSC::virtualForWithFunction):\n* Source/JavaScriptCore/jit/JITOperations.cpp:\n(JSC::JSC_DEFINE_JIT_OPERATION):\n* Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:\n(JSC::LLInt::llint_polymorphic_call):\n\nOriginally-landed-as: 305413.992@safari-7624.5-branch (09ca909b6a83). rdar://185366736\nCanonical link: https://commits.webkit.org/319817@main",
      "email": "dan.hecht@apple.com",
      "hash": "7920db18a51b134b3e7aef9d58cc32626bc0ffd6",
      "subject": "[JSC] Do not attempt to link a CallLinkInfo after handleHostCall"
    },
    "319818@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "319818@main",
      "clUrl": "https://commits.webkit.org/319818@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322458\nrdar://185741211\n\nReviewed by Antti Koivisto.\n\nRenderListItem::paintObject paints the marker after calling the base class, so the marker ends up over the list\nitem's content instead of behind it. Content that reaches back across the marker, a first line pulled out by a\nnegative margin, is drawn under the marker rather than covering it.\n\nTests: imported/w3c/web-platform-tests/css/css-lists/list-marker-paint-order-ref.html\n       imported/w3c/web-platform-tests/css/css-lists/list-marker-paint-order.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/list-marker-paint-order-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/list-marker-paint-order-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-lists/list-marker-paint-order.html: Added.\n* Source/WebCore/rendering/RenderListItem.cpp:\n(WebCore::RenderListItem::paintObject):\n\nCanonical link: https://commits.webkit.org/319818@main",
      "email": "zalan@apple.com",
      "hash": "791e1e02c6c1ee6f753599f9194d3cd66b911356",
      "subject": "List marker is painted on top of the list item's content instead of behind it"
    },
    "319819@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "319819@main",
      "clUrl": "https://commits.webkit.org/319819@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322521\nrdar://185820718\n\nUnreviewed build fix.\n\nWe used some NS[Magnification|Rotation]GestureRecognizer SPI in the\noffending commit without pulling their declarations in. This patch\naddresses that gap.\n\n* Source/WebKit/Platform/spi/mac/AppKitSPI.h:\n\nCanonical link: https://commits.webkit.org/319819@main",
      "email": "a_protyasha@apple.com",
      "hash": "1e517efb6b24ade431a880847b0fe2b652644482",
      "subject": "REGRESSION(319811@main): Broke internal macOS builds"
    },
    "319820@main": {
      "author": "Nathan Solomon",
      "avatar": "https://www.gravatar.com/avatar/511ed1e062e5bfec8adff762a004a148?d=identicon\u0026s=64",
      "cl": "319820@main",
      "clUrl": "https://commits.webkit.org/319820@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322063\nrdar://184939583\n\nReviewed by Alan Baradlay.\n\nOn relayout, we rebuild the InlineItemsList using the TextBreakingPositionCache. We\nalready utilize the glyphGeometryCache to retrieve the cached width of an inlineTextBox's\ncontent that we have seen before and it already has a high hit rate. However, we query\nthis cache essentially per word. The overhead of retrieving the cached width for workloads\nwith large amounts of text can be significant. To speed up the performance of retrieving\ncached widths, change the value of TextBreakingPositionCache to also hold a list, where\neach element is for each FontCascade of the keyed text content, and each of these elements\nholds a list of non-whitespace widths.\n\nWhen we populate the TextBreakingPositionCache for the first time or rebuild the\ninlineItemList using the TextBreakingPositionCache and don't already have an entry for the\ncached widths, populate the cache with all the non whitespace widths for a given inline\ntext box. Then, when we rebuild the InlineItems list during relayout and use the\nTextBreakingPositionCache, use the list of cached widths to avoid calling\nTextUtil::width() (and its per-word glyphGeometryCache lookup) for each InlineTextItem.\nThis improves locality of fetching and reading the cached widths compared to just using\nglyphGeometryCache. The glyphGeometryCache is still used as fallback if the cached widths\nlookup misses.\n\n* Source/WebCore/layout/formattingContexts/inline/InlineItemsBuilder.cpp:\n(WebCore::Layout::textBoxMayHaveGlyphOverflow):\n(WebCore::Layout::inlineTextBoxWidthsAreCacheable):\n(WebCore::Layout::fontCascadeIdentifier):\n(WebCore::Layout::InlineItemsBuilder::computeInlineTextItemWidthsAndTextSpacing):\n(WebCore::Layout::InlineItemsBuilder::buildInlineItemListForTextFromBreakingPositionsCache):\n(WebCore::Layout::InlineItemsBuilder::handleTextContent):\n(WebCore::Layout::collectWidthsFromBuiltItems):\n(WebCore::Layout::InlineItemsBuilder::populateBreakingPositionCache):\n* Source/WebCore/layout/formattingContexts/inline/InlineItemsBuilder.h:\n* Source/WebCore/layout/formattingContexts/inline/text/TextBreakingPositionCache.cpp:\n(WebCore::Layout::TextBreakingPositionCache::Entry::widths const):\n(WebCore::Layout::widthsBytes):\n(WebCore::Layout::TextBreakingPositionCache::addWidths):\n(WebCore::Layout::TextBreakingPositionCache::approximateEntrySizeBytes):\n(WebCore::Layout::TextBreakingPositionCache::evict):\n(WebCore::Layout::TextBreakingPositionCache::set):\n(WebCore::Layout::TextBreakingPositionCache::get const):\n(WebCore::Layout::TextBreakingPositionCache::clearWidthsIfGenerationChanged):\n(WebCore::Layout::TextBreakingPositionCache::widths):\n* Source/WebCore/layout/formattingContexts/inline/text/TextBreakingPositionCache.h:\n(WebCore::Layout::TextBreakingPositionCache::Entry::Entry):\n* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:\n(WebCore::LayoutIntegration::LineLayout::~LineLayout):\n* Source/WebCore/platform/graphics/FontCascadeCache.cpp:\n(WebCore::makeFontCascadeCacheKey):\n* Source/WebCore/platform/graphics/FontCascadeCache.h:\n* LayoutTests/fast/inline/inline-item-width-cache-stale-after-font-cache-invalidation-expected.txt: Added.\n* LayoutTests/fast/inline/inline-item-width-cache-stale-after-font-cache-invalidation.html: Added.\n* LayoutTests/platform/glib/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319820@main",
      "email": "nathan_solomon@apple.com",
      "hash": "b0212ef741e072bf886c5d5a065875245e072a18",
      "subject": "Cache InlineTextItem widths per inline text box content to speed up retrieving cached widths"
    },
    "319821@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "319821@main",
      "clUrl": "https://commits.webkit.org/319821@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322487\n\u003crdar://problem/185787568\u003e\n\nReviewed by Antti Koivisto.\n\nLine positions are adjusted for column and page breaks after inline layout has finished, while a block level\nbox on a line is laid out by block layout during inline layout, at the position the line had before that\nadjustment. Moving the lines afterwards moved the display boxes but left the block box's renderer where it\nwas, so it overlapped the line it is supposed to follow. A widow that made line layout restart hid this,\nwhich is why it took a case with no restart to see it.\n\nGive the renderer the offset its line took, and let it lay out again in case its own content breaks\ndifferently at the new position.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-multicol/block-in-inline-after-column-break-001-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-multicol/block-in-inline-after-column-break-001.html: Added.\n* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:\n(WebCore::LayoutIntegration::LineLayout::updateRenderTreePositions):\n(WebCore::LayoutIntegration::relayoutAfterPaginationOffset):\n\nCanonical link: https://commits.webkit.org/319821@main",
      "email": "zalan@apple.com",
      "hash": "c9d5b3f137ca209ef6ec4cd79dc1856377e5f4dd",
      "subject": "A block level box on a line is left behind when a column break moves the line"
    },
    "319822@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "319822@main",
      "clUrl": "https://commits.webkit.org/319822@main",
      "description": "rdar://183719203\nhttps://bugs.webkit.org/show_bug.cgi?id=320733\n\nReviewed by Eric Carlson.\n\nWe update setLocalDescription for the non parameter less setLocalDescription.\nTo validate that applied description comes from the previous generated offer/answer, we validate the fingerprints.\nWe do not go as far as validating the whole SDP since SDP munging is still a thing.\n\nWe also stop resetting last offer/answer in RTCPeerConnection::updateDescriptions as this is not as per spec.\nTo not change the parameterless setLocalDescription behavior, we introduce booleans to control how much we reuse the last offer/answer.\n\nCovered by rebased tests.\n\n* LayoutTests/imported/w3c/web-platform-tests/webrtc/RTCPeerConnection-setLocalDescription-answer-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webrtc/RTCPeerConnection-setLocalDescription-offer_interop-2026-expected.txt:\n* Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp:\n(WebCore::RTCPeerConnection::createOffer):\n(WebCore::RTCPeerConnection::createAnswer):\n(WebCore::typeForSetLocalDescription):\n(WebCore::isSdpFingerprintValid):\n(WebCore::RTCPeerConnection::setLocalDescription):\n(WebCore::RTCPeerConnection::updateDescriptions):\n* Source/WebCore/Modules/mediastream/RTCPeerConnection.h:\n\nCanonical link: https://commits.webkit.org/319822@main",
      "email": "youenn@apple.com",
      "hash": "037843ae12ffcf5071691e3a0ded328179b37a6e",
      "subject": "Validate fingerprints to previous generated offer/answer when apply a local description"
    },
    "319823@main": {
      "author": "Roberto Rodriguez",
      "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64",
      "cl": "319823@main",
      "clUrl": "https://commits.webkit.org/319823@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315543\nrdar://176813852\n\nReviewed by Kimmo Kinnunen.\n\nThe MSL translator uses UB-safe wrapper functions to perform integer arithmetic via unsigned\noperations, preventing Metal's LLVM backend from exploiting undefined behavior to fold away\nthe ANGLE_int_clamp array-bounds guard. Three operations are not routed through these wrappers:\nsigned unary negate, signed division by -1, and unsigned div/mod. The resulting UB lets LLVM's\noptimizer eliminate the bounds clamp, allowing a WebGL2 page to index arbitrarily into GPU\ndevice memory.\n\nThe fix routes all three operations through UB-safe wrappers: a new ANGLE_negateInt that negates\nvia unsigned subtraction, an extended ANGLE_div that guards divisor -1 in addition to 0, and\nrouting unsigned div/mod through the existing ANGLE_div/ANGLE_imod whose unsigned branches already\nmask zero divisors.\n\nThe new wrappers are tested in IntegerOverflowClampTest.cpp.\n\n* Source/ThirdParty/ANGLE/ANGLE.xcodeproj/project.pbxproj:\n* Source/ThirdParty/ANGLE/src/compiler/translator/msl/EmitMetal.cpp:\n(GetOperatorString):\n* Source/ThirdParty/ANGLE/src/compiler/translator/msl/ProgramPrelude.cpp:\n(PROGRAM_PRELUDE_DECLARE):\n* Source/ThirdParty/ANGLE/src/tests/angle_end2end_tests.gni:\n* Source/ThirdParty/ANGLE/src/tests/gl_tests/IntegerOverflowClampTest.cpp: Added.\n(angle::IntegerOverflowClampTest::IntegerOverflowClampTest):\n(angle::IntegerOverflowClampTest::runShader):\n\nOriginally-landed-as: 305413.991@safari-7624.5-branch (43afeddf1aab). rdar://185368065\nCanonical link: https://commits.webkit.org/319823@main",
      "email": "roberto_rodriguez2@apple.com",
      "hash": "f05fd6d8b3bee9719437f45a7cb1d1d7ee9c3151",
      "subject": "[ANGLE] MSL translator missing integer UB wrappers allow array bounds clamp elimination"
    },
    "319824@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "319824@main",
      "clUrl": "https://commits.webkit.org/319824@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322480\nrdar://185772918\n\nReviewed by Dan Hecht.\n\nIn MarkedBlock::Handle::stopAllocating, we need to set a bit for\nNewlyAllocated status in BitSet. This can be accelerated by using\nsetEachNthBit as cell size is fixed for each MarkedBlock. This patch\nuses it. Also optimizing setEachNthBit code not to do read-modify-write\nmultiple times for the same word.\n\n* Source/JavaScriptCore/heap/MarkedBlock.cpp:\n(JSC::MarkedBlock::Handle::stopAllocating):\n* Source/WTF/wtf/BitSet.h:\n(WTF::WordType\u003e::setEachNthBit):\n\nCanonical link: https://commits.webkit.org/319824@main",
      "email": "ysuzuki@apple.com",
      "hash": "f198e8af3b2af94d6582b4c64ff061f4c433dcb7",
      "subject": "[JSC] Optimize MarkedBlock::Handle::stopAllocating"
    },
    "319825@main": {
      "author": "Andrew Gaul",
      "avatar": "https://www.gravatar.com/avatar/c4735ff5ae1f882942f2b3befcedbdba?d=identicon\u0026s=64",
      "cl": "319825@main",
      "clUrl": "https://commits.webkit.org/319825@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322496\n\nReviewed by Yusuke Suzuki.\n\nThe inline megamorphic property cache lookup and the DFG HasOwnPropertyCache\nlookup both recompute UniquedStringImpl::hash() by loading the flags word and\nshifting out StringImpl::s_flagCount low bits, then adding the result into the\nrunning hash. Emitting that as a standalone urshift32() followed by add32()\nleaves an arm64 pair that the assembler can express as a single shifted-register\nadd:\n\n    lsr w5, w5, #8\n    add w6, w6, w5\n\nbecomes\n\n    add w6, w6, w5, lsr #8\n\nMacroAssembler::addUnsignedRightShift32() already exists on every 64-bit\nbackend, and AssemblyHelpers already uses it a few lines later for the secondary\nhash (key + (key \u003e\u003e structureIDHashShift3)), so this just closes the gap for the\nuid half. The x86_64 and RISCV64 implementations expand to the same two\ninstructions they emitted before, so nothing regresses there.\n\nProfiling JetStream 3 with armlint found 2454 of these unfolded pairs across the\ngenerated code: 1648 in DFG, 699 in FTL and 107 in inline caches. Every one of\nthem is a shift by StringImpl::s_flagCount, which is 8.\n\nFound with armlint.\n\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:\n(JSC::DFG::SpeculativeJIT::compileHasOwnProperty):\n* Source/JavaScriptCore/jit/AssemblyHelpers.cpp:\n(JSC::AssemblyHelpers::findMegamorphicCacheEntry):\n(JSC::AssemblyHelpers::storeMegamorphicProperty):\n(JSC::AssemblyHelpers::hasMegamorphicProperty):\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\nCanonical link: https://commits.webkit.org/319825@main",
      "email": "andrew@gaul.org",
      "hash": "2b0e50239ab5a1a9bc9ab066de1aa7616a67f630",
      "subject": "[JSC] Fold the string-impl hash shift into the megamorphic cache hash add"
    },
    "319826@main": {
      "author": "Aakash Jain",
      "avatar": "https://www.gravatar.com/avatar/e82e0cafeeac3a35b7e74206ebe4c536?d=identicon\u0026s=64",
      "cl": "319826@main",
      "clUrl": "https://commits.webkit.org/319826@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322398\n\u003crdar://problem/185686807\u003e\n\nReviewed by Ryan Haddad.\n\nThe extract-test-results step unzips the results archive on the buildmaster.\nUnder disk pressure the unzip can exceed buildbot's 5-minute no-output timeout\nand then survive SIGKILL, which surfaces as a build exception and an\nunnecessary retry, even though the results archive has already been uploaded to\nthe buildmaster and the tests have already run.\n\nTreat an extraction failure as a non-fatal step failure instead of a build\nexception, and include the archive size in the step summary so oversized\narchives are easy to spot.\n\n* Tools/CISupport/ews-build/steps.py:\n(ExtractTestResults.archiveSizeText):\n(ExtractTestResults.run):\n\nCanonical link: https://commits.webkit.org/319826@main",
      "email": "aakash_jain@apple.com",
      "hash": "09003477a258cf761878ac2cee0e1ac3247ae1fc",
      "subject": "[EWS] Don't mark the build as exception when extract-test-results is killed on the buildmaster"
    },
    "319827@main": {
      "author": "Karl Rackler",
      "avatar": "https://www.gravatar.com/avatar/809e306d02face15d5e29b561026f7c2?d=identicon\u0026s=64",
      "cl": "319827@main",
      "clUrl": "https://commits.webkit.org/319827@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322512\nrdar://182859944\n\nUnreviewed test rebaselines.\n\n318162@main rebaselined the version-generic platform/mac-wk1/ baselines to the coalesced\nform produced on macOS 27 after 317100@main. macOS 26 still emits the un-coalesced form,\nso those baselines stopped matching there and the 5 tests became constant TEXT failures\non macOS 26 WK1. Attribute values are identical in both forms; only run segmentation\ndiffers. macOS 27 and macOS 28 pass with the coalesced baselines, so the generic\ndirectory is correct for macOS 27 and newer and only macOS 26 needs a scoped override,\nmatching platform/mac-sequoia-wk1/, which holds the older WK1 output for these tests.\n\nAlso removes the dead macOS 27-scoped expectations block for these tests, which never\napplied: it is shadowed on WK1 by the per-test [ Pass ] entries in\nplatform/mac-wk1/TestExpectations, and on WK2 these tests are skipped by\nplatform/mac-wk2/TestExpectations (webkit.org/b/89401) since\ntextInputController.legacyAttributedString exists only in DumpRenderTree.\n\n* LayoutTests/platform/mac-tahoe-wk1/editing/mac/attributed-string/attributed-string-across-shadow-boundaries-1-expected.txt: Added.\n* LayoutTests/platform/mac-tahoe-wk1/editing/mac/attributed-string/attributed-string-across-shadow-boundaries-2-expected.txt: Added.\n* LayoutTests/platform/mac-tahoe-wk1/editing/mac/attributed-string/attributed-string-across-shadow-boundaries-3-expected.txt: Added.\n* LayoutTests/platform/mac-tahoe-wk1/editing/mac/attributed-string/attributed-string-across-shadow-boundaries-4-expected.txt: Added.\n* LayoutTests/platform/mac-tahoe-wk1/editing/mac/attributed-string/attributed-string-across-shadow-boundaries-5-expected.txt: Added.\n* LayoutTests/platform/mac/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319827@main",
      "email": "rackler@apple.com",
      "hash": "a1aec7bbddd244ff4f56044b84d693eb948bacc8",
      "subject": "REGRESSION(318162@main): [macOS 26] 5 editing/mac/attributed-string/attributed-string-across-shadow-boundaries tests are constant TEXT failures"
    },
    "319828@main": {
      "author": "Zak Ridouh",
      "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64",
      "cl": "319828@main",
      "clUrl": "https://commits.webkit.org/319828@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322514\nrdar://185816251\n\nReviewed by Alex Christensen.\n\nThe hook is rendered into .git/hooks, but it imports webkitscmpy from the\ncheckout, so a hook installed from main runs against whatever branch is checked\nout. Amending on a branch cut before 319270@main raised the following\nerror:\n\nAttributeError: 'CommitMessageParser' object has no attribute 'reconcile_tests'\n\nand aborted the commit.\n\nCall reconcile_tests only when the parser has it and keep the tests section as\nwritten otherwise, so amending still updates the file list. Every other parser\ncall here carries the same hazard, so move them under the existing ImportError\nguard and catch AttributeError as well. An out-of-date checkout now falls back\nto the commit message as written instead of failing the commit, the same way\npre-push tolerates a checkout too old for its imports.\n\n* Tools/Scripts/hooks/prepare-commit-msg:\n\nCanonical link: https://commits.webkit.org/319828@main",
      "email": "zakr@apple.com",
      "hash": "920f5177de716d41851e4b98f59989d9f9b5fad5",
      "subject": "[git webkit] prepare-commit-msg fails to amend when the checkout is older than the installed hook"
    },
    "319829@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "319829@main",
      "clUrl": "https://commits.webkit.org/319829@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322478\nrdar://184773360\n\nReviewed by Richard Robinson.\n\ngestureEventWasNotHandledByWebCore can only tell the client about\nunhandled gestures in the presence of a backing NSEvent. Gesture events\nconstructed under UseAppKitGestureForGestureEvents do not have one, and\nso we never end up informing the client of this signal.\n\nWe add an adjacent SPI -_magnificationGestureEventWasNotHandled...,\nshaped similarly to the existing -_gestureEventWasNotHandledByWebCore:\nmethod. In this SPI, we simply launder the necessary state clients would\nwant to know (magnification, window location, and phase) off from the\ngesture recognition path.\n\nTo aid our changes, we also refactor a few things; namely, add two phase\nconversion helpers to WebEventFactory, with phaseForEvent now delegating\nto one of them, and rename magnificationGestureWasNotHandledByWebCore...\nto applyNativeMagnification. This method now has two callers, and\n\"FromViewOnly\" described its caller rather than itself, so it was a\nmisnomer with the new SPI.\n\n* Source/WebKit/Shared/mac/WebEventFactory.h:\n* Source/WebKit/Shared/mac/WebEventFactory.mm:\n(WebKit::WebEventFactory::phaseForEvent):\n(WebKit::WebEventFactory::phaseForNativeEventPhase):\n(WebKit::WebEventFactory::toNativeEventPhase):\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivate.h:\n* Source/WebKit/UIProcess/API/mac/WKView.mm:\n(-[WKView _web_magnificationGestureEventWasNotHandledByWebCoreWithPhase:magnification:locationInWindow:]):\n* Source/WebKit/UIProcess/API/mac/WKWebViewMac.mm:\n(-[WKWebView _web_magnificationGestureEventWasNotHandledByWebCoreWithPhase:magnification:locationInWindow:]):\n(-[WKWebView _magnificationGestureEventWasNotHandledByWebCoreWithPhase:magnification:locationInWindow:]):\n* Source/WebKit/UIProcess/mac/WebViewImpl.h:\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::magnifyWithEvent):\n(WebKit::WebViewImpl::smartMagnifyWithEvent):\n(WebKit::WebViewImpl::setLastMouseDownEvent):\n(WebKit::WebViewImpl::magnificationGestureWasNotHandledByWebCoreFromViewOnly): Deleted.\n\nCanonical link: https://commits.webkit.org/319829@main",
      "email": "a_protyasha@apple.com",
      "hash": "c763056577cb27c4f34bb791c41d291c1fbf9da7",
      "subject": "[AppKit Gestures] Notify the client of unhandled magnification gestures"
    },
    "319830@main": {
      "author": "Gerald Squelart",
      "avatar": "https://www.gravatar.com/avatar/894904f08d85651bf2a76868a4d2f1b3?d=identicon\u0026s=64",
      "cl": "319830@main",
      "clUrl": "https://commits.webkit.org/319830@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322289\nrdar://185532644\n\nReviewed by Abrar Rahman Protyasha.\n\nXcode removed some files from xros in 317307@main, reverting just these\nlines.\n\nThis caused some tests to start failing, they were gardened-out in\nwebkit.org/b/322289 and webkit.org/b/322296, reverting these\nTestExpectations now.\n\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* LayoutTests/platform/visionos/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319830@main",
      "email": "g_squelart@apple.com",
      "hash": "0100ccae9b5ca9e75e355589a2731ee4768c23dd",
      "subject": "Fix pbxproj after 317307@main moved files out of xros"
    },
    "319831@main": {
      "author": "Issac Roy",
      "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64",
      "cl": "319831@main",
      "clUrl": "https://commits.webkit.org/319831@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322516\nrdar://185818758\n\nReviewed by Aakash Jain.\n\nMove the newline character from before `pre-exsting-flake` to after it.\n\n* Tools/CISupport/ews-build/steps.py:\n(RunWebKitTests.filter_failures_using_results_db):\n\nCanonical link: https://commits.webkit.org/319831@main",
      "email": "issacroy05@gmail.com",
      "hash": "aca22be814e23246ea548d231fdb1defb7ee535f",
      "subject": "[ews-build] Logging grouping of resultsDB results"
    }
  },
  "date": "2026-08-25",
  "days": 1,
  "generatedAt": "2026-08-25T22:06:30Z",
  "markdown": "## Highlights\n- **Security** WebKit now unconditionally blocks external URLs in subframes, tightening a risky navigation path and reducing cross-context abuse surface. [commit 319798@main](https://commits.webkit.org/319798@main)\n- **Security** A use-after-free in Trusted Types string handling was fixed, closing a real lifetime bug in script execution context plumbing. [commit 319801@main](https://commits.webkit.org/319801@main)\n- **Web Platform** DOMException now exposes a stack property like other errors, bringing web-visible error behavior closer to developer expectations. [commit 319782@main](https://commits.webkit.org/319782@main)\n- **Rendering** Inline text width caching was tightened to cache per inline text box content, cutting repeated measurement work on text-heavy layout paths. [commit 319820@main](https://commits.webkit.org/319820@main)\n- **Perf** Prewarmed and cached processes now run in the idle jetsam band, a notable process-management change for memory pressure behavior on Apple platforms. [commit 319809@main](https://commits.webkit.org/319809@main)\n- **Mobile** WebKit fixed audio continuing after a tab closes on macOS and fullscreen failures on Chess.com on iPhone, cleaning up two high-visibility media UX regressions. [commit 319759@main](https://commits.webkit.org/319759@main) [commit 319748@main](https://commits.webkit.org/319748@main)\n- **V8** JavaScriptCore landed a dense set of engine wins: faster object rest cloning, regex JIT coverage for more lookbehind shapes, and lower overhead in GC and Wasm plumbing. [commit 319745@main](https://commits.webkit.org/319745@main) [commit 319758@main](https://commits.webkit.org/319758@main) [commit 319824@main](https://commits.webkit.org/319824@main)\n- **Rendering** Grid and inline layout kept moving fast with multiple correctness fixes for column breaks, list markers, anonymous items, and intrinsic-width cached lines. [commit 319821@main](https://commits.webkit.org/319821@main) [commit 319818@main](https://commits.webkit.org/319818@main) [commit 319802@main](https://commits.webkit.org/319802@main) [commit 319803@main](https://commits.webkit.org/319803@main)\n- **Media** WebRTC and media stacks got a broad refresh with libwebrtc sync to M152, SDP fingerprint validation tightening, and audio buffer edge-case fixes. [commit 319787@main](https://commits.webkit.org/319787@main) [commit 319822@main](https://commits.webkit.org/319822@main) [commit 319779@main](https://commits.webkit.org/319779@main)\n\n## What landed by area\n\n### JavaScriptCore and Wasm\n- **V8** JSC folded the string-impl hash shift into megamorphic cache hashing to shave work from a hot property access path. [commit 319825@main](https://commits.webkit.org/319825@main)\n- **V8** MarkedBlock::Handle::stopAllocating was optimized to reduce GC allocator overhead. [commit 319824@main](https://commits.webkit.org/319824@main)\n- **V8** JSC now avoids linking CallLinkInfo after handleHostCall, fixing an invalid optimization path around host calls. [commit 319817@main](https://commits.webkit.org/319817@main)\n- **V8** Wasm-to-Wasm stubs now use loadPair for targetInstance and entrypoint, tightening generated code on that call path. [commit 319812@main](https://commits.webkit.org/319812@main)\n- **V8** Absence PropertyCondition now consults non-reified static property tables correctly. [commit 319807@main](https://commits.webkit.org/319807@main)\n- **V8** Deeply nested destructuring no longer crashes bytecode generation. [commit 319778@main](https://commits.webkit.org/319778@main)\n- **V8** Unsigned compares against zero are now folded into cbz/cbnz and test where possible. [commit 319777@main](https://commits.webkit.org/319777@main)\n- **V8** Parallel marking no longer broadcasts to every marker when a bonus visitor task ends. [commit 319764@main](https://commits.webkit.org/319764@main)\n- **V8** YARR JIT can now compile lookbehinds containing lookaheads. [commit 319758@main](https://commits.webkit.org/319758@main)\n- **V8** Object rest destructuring in @copyDataProperties now uses objectCloneFast. [commit 319745@main](https://commits.webkit.org/319745@main)\n- **V8** YARR JIT can now compile lookbehinds containing quantified groups. [commit 319743@main](https://commits.webkit.org/319743@main)\n- **V8** JSC stops repeatedly cleaning up the Wasm type registry. [commit 319731@main](https://commits.webkit.org/319731@main)\n\n### Rendering and CSS layout\n- **Rendering** A block-level box is no longer left behind when a column break moves its line. [commit 319821@main](https://commits.webkit.org/319821@main)\n- **Perf** InlineTextItem width caching is now keyed per inline text box content for faster reuse. [commit 319820@main](https://commits.webkit.org/319820@main)\n- **Rendering** List markers are painted behind list item content again instead of on top. [commit 319818@main](https://commits.webkit.org/319818@main)\n- **Refactor** Base-select appearance styling was resynced for alignment, padding, and specificity. [commit 319816@main](https://commits.webkit.org/319816@main)\n- **Refactor** GridLanesLayout no longer needs to live on RenderGrid, simplifying ownership. [commit 319810@main](https://commits.webkit.org/319810@main)\n- **Rendering** initialLogicalTopLeft is now set for cached maximum intrinsic width lines. [commit 319803@main](https://commits.webkit.org/319803@main)\n- **Rendering** Grid-lanes containers now generate an anonymous item for inline content when needed. [commit 319802@main](https://commits.webkit.org/319802@main)\n- **Refactor** Grid Lanes renamed flow-tolerance to fit-tolerance. [commit 319795@main](https://commits.webkit.org/319795@main)\n- **Web Platform** css-grid WPTs were reimported from upstream. [commit 319793@main](https://commits.webkit.org/319793@main)\n- **Security** A worker-thread race on process-global serializedPrimitiveValues() in CSSPrimitiveValue::customCSSText was fixed. [commit 319794@main](https://commits.webkit.org/319794@main)\n- **Web Platform** css-flexbox WPTs were reimported from upstream. [commit 319772@main](https://commits.webkit.org/319772@main)\n- **Web Platform** css-inline alignment-baseline parsing tests were refreshed from upstream. [commit 319770@main](https://commits.webkit.org/319770@main)\n- **Refactor** Grid item placement logic moved into a dedicated class. [commit 319763@main](https://commits.webkit.org/319763@main)\n- **Web Platform** css-box WPTs were reimported from upstream. [commit 319760@main](https://commits.webkit.org/319760@main)\n- **Perf** canvas transformAreaToDevice() no longer walks the path twice. [commit 319757@main](https://commits.webkit.org/319757@main)\n- **Rendering** Skia test coverage was adjusted for a vertical writing-mode regression. [commit 319783@main](https://commits.webkit.org/319783@main)\n\n### Media, WebRTC, and graphics\n- **Security** WebRTC now validates fingerprints against the previously generated offer or answer when applying a local description. [commit 319822@main](https://commits.webkit.org/319822@main)\n- **Media** ImageDecoderFactoryAVF was made thread safe. [commit 319799@main](https://commits.webkit.org/319799@main)\n- **Refactor** Dead autoPictureInPicture and disablePictureInPicture accessors were removed from HTMLVideoElementPictureInPicture. [commit 319797@main](https://commits.webkit.org/319797@main)\n- **Networking** The ReadableByteStreamFetchSourceEnabled flag was removed, suggesting the path is now just on or retired. [commit 319790@main](https://commits.webkit.org/319790@main)\n- **Media** A service worker fetch-event bytes accounting regression was fixed on macOS and iOS. [commit 319788@main](https://commits.webkit.org/319788@main)\n- **Media** libwebrtc was resynced to M152. [commit 319787@main](https://commits.webkit.org/319787@main)\n- **GPU** ANGLE fixed MSL symbol table key comparison logic. [commit 319786@main](https://commits.webkit.org/319786@main)\n- **Media** AudioBufferSourceNode no longer renders silence for an out-of-bounds start() offset with a negative playbackRate. [commit 319779@main](https://commits.webkit.org/319779@main)\n- **Media** libaom was resynced to M152. [commit 319781@main](https://commits.webkit.org/319781@main)\n- **Media** libvpx was resynced to M152. [commit 319780@main](https://commits.webkit.org/319780@main)\n- **GPU** ANGLE now rejects GL_UNSIGNED_INT_24_8 for GL_DEPTH_COMPONENT32_OES validation. [commit 319756@main](https://commits.webkit.org/319756@main)\n- **Media** AudioBufferSourceNode now clamps out-of-range loopStart and loopEnd. [commit 319755@main](https://commits.webkit.org/319755@main)\n- **Web Platform** domparsing WPTs were resynced from upstream. [commit 319753@main](https://commits.webkit.org/319753@main)\n- **Mobile** Chess.com video lessons can enter fullscreen on iPhone again. [commit 319748@main](https://commits.webkit.org/319748@main)\n- **Media** Scrubbing video on midjourney.com no longer exits video presentation. [commit 319741@main](https://commits.webkit.org/319741@main)\n- **GPU** ANGLE now checks baseVertex against vertex buffer size for drawElements*BaseVertex*. [commit 319735@main](https://commits.webkit.org/319735@main)\n- **GPU** ANGLE fixed missing integer UB wrappers in the MSL translator that allowed array bounds clamp elimination. [commit 319823@main](https://commits.webkit.org/319823@main)\n\n### Security, DOM, and page lifecycle\n- **Security** Trusted Types string handling no longer uses a freed ScriptExecutionContext. [commit 319801@main](https://commits.webkit.org/319801@main)\n- **Security** SpinButtonElement was hardened by making SpinButtonOwner ref-countable. [commit 319792@main](https://commits.webkit.org/319792@main)\n- **Security** Node::m_previousSibling now uses CheckedPtr. [commit 319774@main](https://commits.webkit.org/319774@main)\n- **Refactor** Hardening added to DOMWrapperWorld in an earlier commit was dropped. [commit 319767@main](https://commits.webkit.org/319767@main)\n- **Security** External URLs are now blocked in subframes across the board. [commit 319798@main](https://commits.webkit.org/319798@main)\n- **Web Platform** documentElement.focus() now moves focus to the viewport instead of doing nothing. [commit 319730@main](https://commits.webkit.org/319730@main)\n- **Security** Site Isolation now lets pageswap and unload handlers run before terminating a frame process. [commit 319732@main](https://commits.webkit.org/319732@main)\n- **UI** Caps lock indicator behavior in cross-origin iframes was fixed under Site Isolation. [commit 319729@main](https://commits.webkit.org/319729@main)\n\n### Platform UI, editing, and accessibility\n- **UI** AppKit clients are now notified about unhandled magnification gestures. [commit 319829@main](https://commits.webkit.org/319829@main)\n- **UI** macOS 26 editing regressions across shadow-boundary attributed-string tests were fixed. [commit 319827@main](https://commits.webkit.org/319827@main)\n- **UI** AppKit gesture event support now follows normal AppKit gesture enablement. [commit 319813@main](https://commits.webkit.org/319813@main)\n- **UI** Gesture location inconsistencies for rotation and magnification were fixed to remove stream jank. [commit 319811@main](https://commits.webkit.org/319811@main)\n- **UI** Some scrolls no longer incorrectly produce momentum under AppKit gestures. [commit 319785@main](https://commits.webkit.org/319785@main)\n- **A11y** macOS accessibility coverage expanded across ten previously untested or under-tested APIs. [commit 319796@main](https://commits.webkit.org/319796@main)\n- **UI** Text extraction now captures more useful surrounding context for targeted elements. [commit 319761@main](https://commits.webkit.org/319761@main)\n- **Mobile** YouTube audio no longer keeps playing after the tab is closed on macOS. [commit 319759@main](https://commits.webkit.org/319759@main)\n- **UI** Mail compose now correctly applies formatting around line breaks instead of showing blank selectors. [commit 319747@main](https://commits.webkit.org/319747@main)\n- **UI** Clicking over \u003cattachment\u003e now selects the element correctly in Mail compose. [commit 319746@main](https://commits.webkit.org/319746@main)\n- **UI** An internal macOS build regression caused by gesture work was fixed. [commit 319819@main](https://commits.webkit.org/319819@main)\n\n### Networking, processes, and system behavior\n- **Perf** Prewarmed and cached processes now run in the idle jetsam band. [commit 319809@main](https://commits.webkit.org/319809@main)\n- **Perf** Auxiliary processes now get a higher-priority IPC receive queue. [commit 319752@main](https://commits.webkit.org/319752@main)\n- **Perf** Jetsam boost assertions are now released when disconnecting from an auxiliary process. [commit 319754@main](https://commits.webkit.org/319754@main)\n- **Perf** Cache API query paths avoid redundant URL copies. [commit 319765@main](https://commits.webkit.org/319765@main)\n- **Perf** Geolocation field ordering was tightened to save 8 bytes of padding per instance. [commit 319771@main](https://commits.webkit.org/319771@main)\n- **Refactor** Image observer save and restore is now scope-bound. [commit 319766@main](https://commits.webkit.org/319766@main)\n- **Refactor** CanvasBase::postProcessPixelBufferResults() no longer takes an rvalue Ref it never moves. [commit 319739@main](https://commits.webkit.org/319739@main)\n- **Build** Simulators now run fewer daemons. [commit 319751@main](https://commits.webkit.org/319751@main)\n- **Perf** webkitpy lowered its per-simulator memory estimate. [commit 319749@main](https://commits.webkit.org/319749@main)\n\n### Build, tooling, and infrastructure\n- **Build** Xcode project fallout from moving files out of xros was fixed. [commit 319830@main](https://commits.webkit.org/319830@main)\n- **Build** git-webkit prepare-commit-msg now amends correctly even when the checkout is older than the installed hook. [commit 319828@main](https://commits.webkit.org/319828@main)\n- **Build** EWS no longer marks a build as an exception when extract-test-results is killed on the buildmaster. [commit 319826@main](https://commits.webkit.org/319826@main)\n- **Build** webkitbot can now parse identifiers that Slack has linkified. [commit 319815@main](https://commits.webkit.org/319815@main)\n- **Build** Cocoa CMake builds were repaired. [commit 319814@main](https://commits.webkit.org/319814@main)\n- **Build** webkitbot test runs were fixed by restoring the https-proxy-agent dependency. [commit 319804@main](https://commits.webkit.org/319804@main)\n- **Build** abseil-cpp was resynced to M152. [commit 319791@main](https://commits.webkit.org/319791@main)\n- **Build** Unneeded abseil files were removed from the Xcode build. [commit 319789@main](https://commits.webkit.org/319789@main)\n- **Build** Foundation imports are now avoided on Windows. [commit 319784@main](https://commits.webkit.org/319784@main)\n- **Build** IPC testing API was enabled for clang builds of GTK and WPE. [commit 319775@main](https://commits.webkit.org/319775@main)\n- **Build** git-webkit no longer duplicates bug and title metadata in .git/config on repeated PR uploads. [commit 319768@main](https://commits.webkit.org/319768@main)\n- **Build** WKAttachmentTests and MediaLoading API tests are now built in the Xcode build. [commit 319762@main](https://commits.webkit.org/319762@main)\n- **Build** EWS now records architecture and WebKit version for results.webkit.org uploads. [commit 319744@main](https://commits.webkit.org/319744@main)\n- **Build** CommonBase.xcconfig inherited settings missing from some builds were restored. [commit 319740@main](https://commits.webkit.org/319740@main)\n- **Perf** Results DB performance was improved for large configuration counts. [commit 319738@main](https://commits.webkit.org/319738@main)\n- **Build** CMake MiniBrowser bundle ID was fixed. [commit 319737@main](https://commits.webkit.org/319737@main)\n- **Build** webkitscmpy issue prompting now mentions that a bug ID is accepted. [commit 319736@main](https://commits.webkit.org/319736@main)\n- **Build** The Swift toolchain on macOS was updated to 2026-08-21-a. [commit 319733@main](https://commits.webkit.org/319733@main)\n- **Build** resultsDB logging now groups related results more cleanly. [commit 319831@main](https://commits.webkit.org/319831@main)\n\n### Web APIs, tests, and smaller platform fixes\n- **Web Platform** DOMException now has a stack property like other errors. [commit 319782@main](https://commits.webkit.org/319782@main)\n- **Web Platform** sidePanel API support was extended to cover newer Chrome behavior. [commit 319734@main](https://commits.webkit.org/319734@main)\n- **Refactor** WebLockManager::request() dropped a stale UNUSED_PARAM(name). [commit 319769@main](https://commits.webkit.org/319769@main)\n- **Build** Safer C++ expectations were updated. [commit 319776@main](https://commits.webkit.org/319776@main)\n- **Build** macOS safer C++ expectations were updated again for the previous day. [commit 319750@main](https://commits.webkit.org/319750@main)\n- **Build** A flaky MediaBufferingPolicy API test on macOS Release was gardened. [commit 319808@main](https://commits.webkit.org/319808@main)\n- **Build** Windows test gardening landed. [commit 319742@main](https://commits.webkit.org/319742@main)\n- **Build** WebRTCPrefix.h was fixed after the libwebrtc roll. [commit 319806@main](https://commits.webkit.org/319806@main)\n- **Rendering** GTK and WPE fixed translucent pixel handling when loading a WebKitImage through g_loadable_icon_load APIs. [commit 319805@main](https://commits.webkit.org/319805@main)\n- **Rendering** GTK and WPE fixed missing descendant damage during opacity animation. [commit 319773@main](https://commits.webkit.org/319773@main)\n\n## Reverts \u0026 Reapplies\n- **Refactor** No explicit Revert, Reapply, or Backed out commits landed in this slice.",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [
    {
      "name": "Unreviewed",
      "count": 1
    }
  ],
  "since": "2026-08-25",
  "totals": {
    "commits": 103,
    "features": 102,
    "rolls": 1
  },
  "until": "2026-08-25"
}