{ "commits": { "318030@main": { "author": "Adrian Taylor", "avatar": "https://www.gravatar.com/avatar/d2acb8ad2e2670ff74ae0d65fb27014c?d=identicon\u0026s=64", "cl": "318030@main", "clUrl": "https://commits.webkit.org/318030@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322581\nrdar://185877377\n\nReviewed by Anne van Kesteren.\n\nPartial revert of https://commits.webkit.org/318030@main, to enable WebKit's\ndefault Swift-related behavior on the Windows platform. In practice, this will\nmean that the Windows port now enables some Swift WebKit features if a Swift\ntoolchain is found to be available, just as occurs on other platforms.\n\nCanonical link: https://commits.webkit.org/319868@main", "email": "adrian_taylor@apple.com", "hash": "f8876bda43783aff2a215265ba02af6919727252", "subject": "Allow Swift on Windows" }, "319832@main": { "author": "Cole Carley", "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64", "cl": "319832@main", "clUrl": "https://commits.webkit.org/319832@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322315\nrdar://185554722\n\nReviewed by Brent Fulgham.\n\nI have moved the element fullscreen quirk and the simulated mouse events quirks to follow\nthe new paradigm. Adding these quirks to the table explicitly names the quirks, which will\nhelp us later when we want to turn quirks on and off individually.\n\nI needed to extend the QuirkMatch API to do this correctly. I have added the following\nfunctions to the API:\nQuirkMatch::anySite()\nQuirkMatch::hostIsOneOf()\nQuirkMatch::onlyIfEmbedded()\nQuirkMatch::exceptWhen()\n\nTests: Tools/TestWebKitAPI/Tests/WebCore/QuirkMatch.cpp\n Tools/TestWebKitAPI/Tests/WebCore/Quirks.cpp\n\n* Source/WebCore/page/QuirkMatch.h:\n(WebCore::QuirkMatchContext::QuirkMatchContext):\n(WebCore::QuirkMatchContext::isTopDocument const):\n(WebCore::QuirkMatch::anySite):\n(WebCore::QuirkMatch::onlyIf):\n(WebCore::QuirkMatch::documentDomainIsOneOf):\n(WebCore::QuirkMatch::hostIsOneOf):\n(WebCore::QuirkMatch::onlyIfEmbedded):\n(WebCore::QuirkMatch::exceptWhen):\n(WebCore::QuirkMatch::matches const):\n(WebCore::QuirkMatch::Refinements::isEmpty const):\n(WebCore::QuirkMatch::setPathConstraint):\n(WebCore::QuirkMatch::matchesSite const):\n(WebCore::QuirkMatch::matchesRefinements const):\n(WebCore::QuirkMatch::anyOf):\n(WebCore::QuirkMatch::matchesPathConstraint const):\n(WebCore::Quirk::apply const):\n(WebCore::QuirkMatch::matchesDocumentDomain const): Deleted.\n* Source/WebCore/page/Quirks.cpp:\n* Source/WebCore/page/Quirks.h:\n(WebCore::Quirks::quirkIsEnabledAfterProbing const):\n* Source/WebCore/page/QuirksData.h:\n(WebCore::QuirksData::merge):\n(): Deleted.\n* Tools/TestWebKitAPI/Tests/WebCore/QuirkMatch.cpp:\n(TestWebKitAPI::matchesEmbeddedURL):\n(TestWebKitAPI::TEST(QuirkMatchTest, AnySiteWithOnlyIfEmbeddedMatchesEmbedsAnywhereButNeverTheTopDocument)):\n(TestWebKitAPI::TEST(QuirkMatchTest, AnySiteMatchesEverySiteWithoutFurtherRefinement)):\n(TestWebKitAPI::TEST(QuirkMatchTest, ExceptWhenCarvesOutPagesOfAMatchedSite)):\n(TestWebKitAPI::TEST(QuirkMatchTest, ExceptWhenCarvesOutHostsOfAMatchedSite)):\n(TestWebKitAPI::TEST(QuirkMatchTest, ExceptWhenTakesEveryRefinementIncludingEmbeddedDocuments)):\n(TestWebKitAPI::TEST(QuirkMatchTest, ExceptWhenAndTheMatchKeepSeparateRefinements)):\n(TestWebKitAPI::TEST(QuirkMatchTest, ExceptWhenWithNothingChainedIsANoOp)):\n* Tools/TestWebKitAPI/Tests/WebCore/Quirks.cpp:\n(TestWebKitAPI::resolveQuirksForTopURL):\n(TestWebKitAPI::TEST_F(QuirksTest, SiteSpecificQuirksResolveWithoutADocument)):\n\nCanonical link: https://commits.webkit.org/319832@main", "email": "ccarley2@apple.com", "hash": "11b32a9eb61ff839e2fbfb3c58fc54df3b3813c3", "subject": "[Quirks] Move element fullscreen and simulated mouse events quirks into the table" }, "319833@main": { "author": "Marta Darbinyan", "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64", "cl": "319833@main", "clUrl": "https://commits.webkit.org/319833@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322515\nrdar://185818355\n\nUnreviewed test gardening\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319833@main", "email": "darbinyan@apple.com", "hash": "b4980ee3b887765cc3f360c50ad02fb95437bf66", "subject": "[Gardening]: Remove gardening of imported/w3c/web-platform-tests/wasm/serialization/memory tests" }, "319834@main": { "author": "Anand Srinivasan", "avatar": "https://www.gravatar.com/avatar/84643a20c269974c2df6681742daf0a4?d=identicon\u0026s=64", "cl": "319834@main", "clUrl": "https://commits.webkit.org/319834@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322044\nrdar://185152703\n\nReviewed by Yijia Huang.\n\nOptimize chinese/dangi month code resolution in CalendarICUBridge.cpp by\ncaching results and no longer single stepping forward day by day.\n\n TipOfTree Changes\ntemporal-plain-month-day-lunisolar-month-code\n 14785.2729+-102.0720 ^ 223.6251+-4.9208 ^ definitely 66.1163x faster\n\u003cgeometric\u003e 14785.2729+-102.0720 ^ 223.6251+-4.9208 ^ definitely 66.1163x faster\n\nTests: JSTests/microbenchmarks/temporal-plain-month-day-lunisolar-month-code.js\n JSTests/stress/temporal-lunisolar-memo-aliasing.js\n\n* Source/JavaScriptCore/runtime/temporal/core/CalendarICUBridge.cpp:\n(JSC::TemporalCore::advanceToNextLunisolarMonth):\n(JSC::TemporalCore::actualLunisolarMonthLength):\n(JSC::TemporalCore::nonISOCalendarDateToISO):\n(JSC::TemporalCore::WTF_GUARDED_BY_LOCK):\n(JSC::TemporalCore::addUTCCalendarDays):\n(JSC::TemporalCore::nonISODateUntil):\n* JSTests/microbenchmarks/temporal-plain-month-day-lunisolar-month-code.js: Added.\n* JSTests/stress/temporal-lunisolar-memo-aliasing.js: Added.\n(shouldBe):\n(walkSlot):\n\nCanonical link: https://commits.webkit.org/319834@main", "email": "anand_srinivasan@apple.com", "hash": "2ca559226b1bdd624bc8c4224662a5794227c048", "subject": "Speed up lunisolar calendar month walk in JS Temporal" }, "319835@main": { "author": "Ian Gower", "avatar": "https://www.gravatar.com/avatar/cc2e677bc728b92e5463660d8b8d9ed8?d=identicon\u0026s=64", "cl": "319835@main", "clUrl": "https://commits.webkit.org/319835@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321626\nrdar://184756177\n\nReviewed by Zak Ridouh.\n\nOnly the FetchRequest-copying overload read init.targetAddressSpace, so\nfetch(url, { targetAddressSpace }) and new Request(url, { targetAddressSpace })\nleft the default of Public. The value gates the mixed-content exemption and the\naddress-space mismatch check for Local Network Access,\nhttps://wicg.github.io/local-network-access/\n\n* LayoutTests/fetch/request-target-address-space-from-init-expected.txt: Added.\n* LayoutTests/fetch/request-target-address-space-from-init.html: Added.\n* Source/WebCore/Modules/fetch/FetchRequest.cpp:\n(WebCore::FetchRequest::initializeWith):\n\nCanonical link: https://commits.webkit.org/319835@main", "email": "i_gower@apple.com", "hash": "e5961e3ed7e9a15be44a0a2c21c06b2a25d51859", "subject": "fetch() ignores targetAddressSpace when constructed from a URL string" }, "319836@main": { "author": "Yulun Wu", "avatar": "https://www.gravatar.com/avatar/9e34d6632f4d926cdf6fe8dce07f9cb7?d=identicon\u0026s=64", "cl": "319836@main", "clUrl": "https://commits.webkit.org/319836@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321662\n\u003crdar://184789473\u003e\n\nReviewed by Sammy Gill.\n\nIntrinsic size contributions are based on the outer size of the box, but GFC's intrinsic\ncontribution functions returned the grid item's border box size.\n\nhttps://www.w3.org/TR/css-sizing-3/#outer-size\n\nThis PR refactors margin calculations into GridLayoutUtils and updates the intrinsic\ncontribution functions to include the margin.\n\nNo behavior change. Grid coverage rejects any grid item whose margin box is not entirely\nzero, so every contribution grows by zero on trunk today.\n\n* Source/WebCore/layout/formattingContexts/grid/GridFormattingContext.h:\n(WebCore::Layout::GridFormattingContext::zoomFactor const): Deleted.\n* Source/WebCore/layout/formattingContexts/grid/GridLayout.cpp:\n(WebCore::Layout::GridLayout::layout):\n(WebCore::Layout::GridLayout::computeInlineMargins):\n(WebCore::Layout::GridLayout::computeBlockMargins):\n(WebCore::Layout::GridLayout::layoutGridItems const):\n(WebCore::Layout::computeMarginsForAxis): Deleted.\n* Source/WebCore/layout/formattingContexts/grid/GridLayout.h:\n* Source/WebCore/layout/formattingContexts/grid/GridLayoutUtils.cpp:\n(WebCore::Layout::GridLayoutUtils::usedMarginsForAxis):\n(WebCore::Layout::GridLayoutUtils::inlineAxisMinContentContribution):\n(WebCore::Layout::GridLayoutUtils::inlineAxisMaxContentContribution):\n(WebCore::Layout::GridLayoutUtils::blockAxisMinContentContribution):\n(WebCore::Layout::GridLayoutUtils::blockAxisMaxContentContribution):\n* Source/WebCore/layout/formattingContexts/grid/GridLayoutUtils.h:\n\nCanonical link: https://commits.webkit.org/319836@main", "email": "yulun_wu@apple.com", "hash": "de707c4cdc730b05690ae75247fca553837752c3", "subject": "[GFC] Include grid item margins in intrinsic size contributions" }, "319837@main": { "author": "Yulun Wu", "avatar": "https://www.gravatar.com/avatar/9e34d6632f4d926cdf6fe8dce07f9cb7?d=identicon\u0026s=64", "cl": "319837@main", "clUrl": "https://commits.webkit.org/319837@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321799\n\u003crdar://184933769\u003e\n\nReviewed by Sammy Gill.\n\nThis PR implements Step 2.4 of https://drafts.csswg.org/css-grid-1/#extra-space\n\ntracksToGrowBeyondGrowthLimits() collects the tracks the item spans that should be unfrozen\nand grown beyond its limits. shouldTrackGrowBeyondGrowthLimits() checks whether the track's\nmax sizing function is of the type that should be unfrozen in a given phase, asserting that\nthe correct ExtraSpaceDistributionTarget is passed in and matching spec.\n\nGridItemSizeContributionType has been renamed to AffectedTrackSizingFunction to better\nreflect the usage of the enum.\n\n* Source/WebCore/layout/formattingContexts/grid/TrackSizingAlgorithm.cpp:\n(WebCore::Layout::shouldTrackGrowBeyondGrowthLimits):\n(WebCore::Layout::tracksToGrowBeyondGrowthLimits):\n(WebCore::Layout::distributeExtraSpace):\n(WebCore::Layout::resolveIntrinsicTrackSizesWithSpanningItems):\n(WebCore::Layout::hasAffectedTrackSizingFunction):\n(WebCore::Layout::affectedTracks):\n(WebCore::Layout::shouldTrackAccommodateContributionType): Deleted.\n\nCanonical link: https://commits.webkit.org/319837@main", "email": "yulun_wu@apple.com", "hash": "a19aae0c7f91d4181f4b75e6278a54233df0f7b8", "subject": "[GFC] Implement step 2.4 of Distributing Extra Space" }, "319838@main": { "author": "Remy Demarest", "avatar": "https://www.gravatar.com/avatar/bf8b232d35a5e00cd0263c9501558c0e?d=identicon\u0026s=64", "cl": "319838@main", "clUrl": "https://commits.webkit.org/319838@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322459\n\nReviewed by Alex Christensen.\n\nCurrently, SOAuthorizationSession presents its authorization view controller\nby creating and managing its own NSWindow on macOS. This means the client\n(e.g. Safari) has no way to present the authorization UI within its own\nwindow/view hierarchy, such as a sheet on an existing browser window.\n\nAllow the client to opt in to presenting the authorization view controller\nitself by supplying a view controller via the UI client\n(WKUIDelegatePrivate._presentingViewControllerForWebView:). When a\nclient-provided view controller is available, present the authorization\nview controller as a sheet on it instead of creating a new NSWindow, and\ndismiss it the same way when the session ends.\n\nAdd a unit test verifying that the SOAuthorization view controller is presented\nas a child of the client-supplied view controller instead of a WebKit provided\nwindow.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SOAuthorizationTests.mm\n\n* Source/WebKit/UIProcess/Cocoa/SOAuthorization/SOAuthorizationSession.h:\n* Source/WebKit/UIProcess/Cocoa/SOAuthorization/SOAuthorizationSession.mm:\n(WebKit::SOAuthorizationSession::presentViewController):\n(WebKit::SOAuthorizationSession::dismissViewController):\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SOAuthorizationTests.mm:\n(-[TestSOAuthorizationDelegate _presentingViewControllerForWebView:]):\n(TestWebKitAPI::TEST(SOAuthorizationRedirect, InterceptionSucceedWithUIViaPresentingViewController)):\n\nCanonical link: https://commits.webkit.org/319838@main", "email": "rdemarest@apple.com", "hash": "ba29ff41e0a023bd1c7d3e64d4c35cc20046efbf", "subject": "SOAuthorizationSession should allow the client to present the authorization view controller via its own view controller on macOS" }, "319839@main": { "author": "Kai Tamkun", "avatar": "https://www.gravatar.com/avatar/dff073cba21885df4d9f73ed3cc493c2?d=identicon\u0026s=64", "cl": "319839@main", "clUrl": "https://commits.webkit.org/319839@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=316918\nrdar://177938898\n\nReviewed by Yusuke Suzuki and Dan Hecht.\n\nThis patch makes OMGIRGenerator mark the procedure as using SIMD when the parser\ndetects SIMD instructions.\n\nTest: JSTests/wasm/stress/inline-wasm-simd-into-non-simd.js\n\n* JSTests/wasm/stress/inline-wasm-simd-into-non-simd.js: Added.\n(try.call.B.local.0):\n(const.inst.new.WebAssembly.Instance.new.WebAssembly.Module):\n* Source/JavaScriptCore/b3/B3Procedure.cpp:\n(JSC::B3::Procedure::Procedure):\n* Source/JavaScriptCore/b3/B3Procedure.h:\n(JSC::B3::Procedure::setUsesSIMD):\n(JSC::B3::Procedure::setUsessSIMD): Deleted.\n* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:\n(JSC::Wasm::OMGIRGenerator::notifyFunctionUsesSIMD):\n\nOriginally-landed-as: 305413.976@safari-7624.5-branch (cdf687829ac6). rdar://185368152\nCanonical link: https://commits.webkit.org/319839@main", "email": "k_tamkun@apple.com", "hash": "9a17cd1100ad6cd41afa7aa1f0a2fa5a2e797a10", "subject": "[JSC] Procedure::usesSIMD() not set when OMG inlines a SIMD callee into a non-SIMD root" }, "319840@main": { "author": "Sammy Gill", "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64", "cl": "319840@main", "clUrl": "https://commits.webkit.org/319840@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322532\nrdar://problem/185827725\n\nReviewed by Tim Nguyen.\n\nGridLanesLayout had an initializeGridLanes() that reset every member at the start\nof each placement run, because the object used to live on RenderGrid and was reused\nacross layouts. Now that it is a stack local the only thing still forcing a reset\nwas computeIntrinsicLogicalWidths(), which performed two placement runs on a single\nobject. Give each run its own GridLanesLayout and the setup can move into the\nconstructor, where it is harder to end up with a half initialized object.\n\nEvery mutable member was already reset per run, so a new object per run is\nequivalent to resetting one. m_gridContentSize, m_itemOffsets and\nm_autoFlowNextCursor now rely on default construction, and the rest is set in the\nmember initializer list.\n\n* Source/WebCore/rendering/GridLanesLayout.cpp:\n(WebCore::GridLanesLayout::GridLanesLayout):\nTake the grid axis track count and the stacking axis direction, and do what\ninitializeGridLanes() used to do. resizeAndResetRunningPositions() had no other\ncaller so it is folded in here.\n\n(WebCore::GridLanesLayout::performGridLanesPlacement):\nDrop the two parameters that moved to the constructor. The explicit\nm_autoFlowNextCursor reset goes with them, since a freshly constructed object\nalready starts at 0.\n\n* Source/WebCore/rendering/RenderGrid.cpp:\n(WebCore::RenderGrid::layoutGridLanes):\nThe stacking axis direction is now needed before the object is constructed.\nisGridLanes() is defined as \"one of the two axes is the stacking axis\", so there is\nalways one here and it can be picked with a ternary. That removes the need for the\nlambda, which only existed to share a body between the rows and columns cases.\n\n(WebCore::RenderGrid::computeIntrinsicLogicalWidths const):\nConstruct a GridLanesLayout per phase. Both are given the track count computed\nbefore either run placed anything, which is what the single reused object was\ngiven.\n\nCanonical link: https://commits.webkit.org/319840@main", "email": "sammy.gill@apple.com", "hash": "4087ab818e4949f1d63a8c4c54fd08369b48f420", "subject": "[Grid Lanes] Initialize GridLanesLayout in its constructor" }, "319841@main": { "author": "Michael Catanzaro", "avatar": "https://www.gravatar.com/avatar/213b4484d2078dbdd03dcd3256564c2c?d=identicon\u0026s=64", "cl": "319841@main", "clUrl": "https://commits.webkit.org/319841@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321951\n\nReviewed by Patrick Griffis.\n\nThe auxiliary process always has the same view of /app and /usr as the\nUI process, so trying to expose them to the sandbox is pointless at\nbest. In the past, it has uncovered bugs in Flatpak. See:\nhttps://github.com/flatpak/flatpak/issues/6584\n\n* Source/WebKit/UIProcess/Launcher/glib/FlatpakLauncher.cpp:\n(WebKit::canPossiblyExposePath):\n(WebKit::flatpakSpawn):\n\nCanonical link: https://commits.webkit.org/319841@main", "email": "mcatanzaro@gnome.org", "hash": "60477f5f174c70623c6b3feeb2c5d30d5b2bee85", "subject": "[WPE][GTK] FlatpakLauncher should not attempt to expose paths under /app or /usr" }, "319842@main": { "author": "Jer Noble", "avatar": "https://www.gravatar.com/avatar/6d2cde9be23b98223ca964cb3b7813a0?d=identicon\u0026s=64", "cl": "319842@main", "clUrl": "https://commits.webkit.org/319842@main", "description": "rdar://185505597\nhttps://bugs.webkit.org/show_bug.cgi?id=322533\n\nReviewed by Eric Carlson and Andy Estes.\n\nIn 319759@main, RemoteAudioVideoRendererProxyManager was modified to explicitly\npause and flush all renderers when the manager was destroyed, and to explicitly\npause and flush individual renderers in shutdown(). However, this was not\nsufficient to completely eliminate the behavior in question. Logging showed\nthat both a) the WebContent process was being destroyed before a pause() IPC\ncould be sent b) the GPUConnectionToWebContent process destructor wasn't being\ncalled This means the pause behavior added to\nRemoteAudioVideoRendererProxyManager's destructor wasn't being called either.\n\nRather than relying on the RefCounted GPUConnectionToWebContent object being\nfully destroyed before tearing down all our audio and video renderers, adopt\nthe same mechanism used for other objects owned by the connection:\nGPUConnectionToWebProcess::didClose(). Logging shows this method is called\nwhile reproducing the bug, even when the GPUConnectionToWebProcess itself is\nnot subsequently destroyed.\n\n* Source/WebKit/GPUProcess/media/RemoteAudioVideoRendererProxyManager.cpp:\n(WebKit::RemoteAudioVideoRendererProxyManager::connectionToWebProcessClosed):\n* Source/WebKit/GPUProcess/media/RemoteAudioVideoRendererProxyManager.h:\n* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.cpp\n(WebKit::GPUConnectionToWebProcess::didClose):\n\nCanonical link: https://commits.webkit.org/319842@main", "email": "jer.noble@apple.com", "hash": "1018e6f4e438e1c5b723b1eb529ef89236bf4fe6", "subject": "[macOS] YouTube.com audio continues to play after tab is closed" }, "319843@main": { "author": "Keith Miller", "avatar": "https://www.gravatar.com/avatar/bddc1595b29098429a6ce7c8bf4aced2?d=identicon\u0026s=64", "cl": "319843@main", "clUrl": "https://commits.webkit.org/319843@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322495\nrdar://185800489\n\nReviewed by Yijia Huang.\n\nMoving/Copying doesn't seem useful and introduces a footgun to escape\nthe ScopedLambda past the lifetime of the passed lambda, e.g. via a move\nto the heap.\n\nNo new tests, no behavior change.\n\n* Source/WebCore/platform/graphics/cg/ImageUtilitiesCG.cpp:\n(WebCore::encode):\n Use a reference of the ScopedLambda rather than a copy.\n\nCanonical link: https://commits.webkit.org/319843@main", "email": "keith_miller@apple.com", "hash": "54b9fc03d8cb650626fcab77a275117cf99cc11f", "subject": "Make ScopedLambda non-moveable" }, "319844@main": { "author": "Anne van Kesteren", "avatar": "https://www.gravatar.com/avatar/09bb44ac3625a121017cd98d0a7dc52c?d=identicon\u0026s=64", "cl": "319844@main", "clUrl": "https://commits.webkit.org/319844@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322403\n\nReviewed by Ryosuke Niwa.\n\nUnfortunately the changes in 319453@main were insufficient due to custom elements.\nThe constructor cannot append the parent to the element, since creating an element\nrejects a constructed element that has children, but it can move the parent into a\nshadow root, or into the contents of a template element inside one. Check for that\nwith containsIncludingHostElements() and drop the element on the floor, as the\nadoption agency already does.\n\nMake containsIncludingHostElements() consult the cached shadow-including root to\nskip over a tree that cannot contain possibleAncestor, so the ancestor walk is\navoided entirely when the two nodes are in different trees. That is the common\ncase both for parser insertion and for appending a newly created node from\nscript.\n\nThe cycle check in executeInsertAlreadyParsedChildTask() is now redundant with\nthe one in insert(). Its parentNode() check is not: script run by\nparserRemoveChild() can give the node a parent again without creating a cycle.\n\nSpec changes: https://github.com/whatwg/html/pull/12830\n\nTests: imported/w3c/web-platform-tests/html/syntax/parsing/custom-element-reparenting-shadow-cycle.html\n imported/w3c/web-platform-tests/html/syntax/parsing/custom-element-reparenting-template-cycle.html\n imported/w3c/web-platform-tests/html/syntax/parsing/custom-element-reparenting.html\n\nTests upstream: https://github.com/web-platform-tests/wpt/pull/62174\n\nCanonical link: https://commits.webkit.org/319844@main", "email": "annevk@annevk.nl", "hash": "3dff3fac8c47236b7cab34e2f9239ef83f7f2df9", "subject": "HTML parser should not insert an element into its own subtree" }, "319845@main": { "author": "Sammy Gill", "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64", "cl": "319845@main", "clUrl": "https://commits.webkit.org/319845@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322534\nrdar://problem/185829927\n\nReviewed by Tim Nguyen.\n\nGridLayout::layout() ran the grid sizing algorithm inline, alongside grid item\nplacement, grid item layout, and alignment. Move this logic into its own class\nso that it is a bit more modular.\n\nGridSizer takes the grid formatting context and the layout state, and each entry\npoint takes the placed grid items plus the track sizing functions for both axes.\nBuilding those track sizing functions stays in GridLayout, since grid item sizing\nstill needs them once the tracks have been sized, so there is nothing to be\ngained from moving their construction and handing it back out again.\n\nThe fast path where the caller only needs the column sizes resolved by step 1 is\nsizeColumnsOnlyFastPath(), which delegates to sizeColumnTracks(), the counterpart\nto sizeRowTracks().\n\nNo change in behavior.\n\nCanonical link: https://commits.webkit.org/319845@main", "email": "sammy.gill@apple.com", "hash": "8d29616f91ef6b902037c77ff921ee89a2083940", "subject": "[GFC][Cleanup] Move the grid sizing algorithm into a GridSizer class" }, "319846@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "319846@main", "clUrl": "https://commits.webkit.org/319846@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322559\n\nReviewed by Yusuke Suzuki.\n\nop_instanceof is missing from the LINK list, so its two GetByIdModeMetadata stay\nzero-filled (mode = ProtoLoad, hitCountForLLIntCaching = 0) and the LLInt never\ncaches the Symbol.hasInstance load. instanceof microbenchmarks with\nJSC_useJIT=false get 1.4x-2.3x faster; JIT-enabled runs are neutral.\n\n* Source/JavaScriptCore/bytecode/CodeBlock.cpp:\n(JSC::CodeBlock::finishCreation):\n\nCanonical link: https://commits.webkit.org/319846@main", "email": "sosuke@bun.sh", "hash": "bc2c8875fc15984df835f8b328cad607447f7398", "subject": "[JSC] LINK `op_instanceof` metadata in `CodeBlock::finishCreation`" }, "319847@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "319847@main", "clUrl": "https://commits.webkit.org/319847@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322488\nrdar://185145277\n\nReviewed by Jer Noble.\n\nWhen a player seeked to a MediaSource video's duration in repetition, the `ended` event would have been fired\nagain even if it had been fired before and currentTime didn't change.\nThat's because while HTMLMediaElement::seekTask has a shortcut to detect a seek to the same currentTime\nand just fire the `seeked` event, when a MediaSource is in use this shortcut is bypassed\nand so we start a fullseek.\nWhen timechanged is called again by the MediaPlayer, we compare the currentTime with the duration\nand if equal we fired the `ended` event.\n\nAdditionally, with ManagedMediaSource, following 312694@main , we call MediaSource::monitorSourceBuffers()\nagain, which at the start of a seek cause the ManagedMedaSource.streaming attribute to become true\nand at the end to be false, and so startstreaming/endstreaming would have too been fired.\nAny calls to monitorSourceBuffers() at end-of-stream would have produced that pair of events to be fired\n(312694@main only made it obvious)\n\nWe now add an early exit in ManagedMedaSource::monitorSourceBuffers() if the MediaSource is ended and\ncurrentTime \u003e= duration, we call setStreaming(false) and return. Nothing will call setStreaming(true)\nagain.\n\nTo prevent the redundant, and incorrect ended event, we only clear m_sentEndEvent if the MediaSource\nisn't ended and we aren't seeking to duration()\n\nFly-by: we limit the system notifications about streaming activity to once per 10s only.\n - First call ever (m_notifiedMediaStreamingActivity unset) posts immediately — no startup delay.\n - A call matching the currently published state clears any pending change and returns; nothing is posted.\n - A change within 10s of the last post is stored in m_pendingMediaStreamingActivity and a single dispatchAfter is armed for the remainder of the window.\n Further toggles overwrite the pending value without arming more work.\n - When the window closes, the flush re-enters notifyMediaStreamingActivity with the pending value, which then either posts it or drops it if it equals what's already published.\n\nTest added: media/media-source/media-managedmse-no-streaming-toggle-at-end.html\n\n* LayoutTests/media/media-source/media-managedmse-no-streaming-toggle-at-end-expected.txt: Added.\n* LayoutTests/media/media-source/media-managedmse-no-streaming-toggle-at-end.html: Added.\n* Source/WebCore/Modules/mediasource/ManagedMediaSource.cpp:\n(WebCore::ManagedMediaSource::monitorSourceBuffers):\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::seekTask):\n* Source/WebKit/NetworkProcess/NetworkProcess.cpp:\n(WebKit::NetworkProcess::notifyMediaStreamingActivity):\n* Source/WebKit/NetworkProcess/NetworkProcess.h:\n\nCanonical link: https://commits.webkit.org/319847@main", "email": "jya@apple.com", "hash": "cab391584f801d18cde18093204d9b980964ca80", "subject": "[MSE] Seeking to the end of a HTMLMediaElement backed by a MediaSource will unnecessarily fire an ended event" }, "319848@main": { "author": "Rob Buis", "avatar": "https://www.gravatar.com/avatar/74fb5af173895d2a7814b0aed1238a39?d=identicon\u0026s=64", "cl": "319848@main", "clUrl": "https://commits.webkit.org/319848@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=305869\nrdar://problem/168534323\n\nReviewed by Alan Baradlay.\n\nLine-clamp affects block containers, which includes inline blocks [1].\n\nFor legacy line clamp we keep the existing behaviour.\n\n[1] https://drafts.csswg.org/css-overflow-4/#line-clamp\n\n* LayoutTests/TestExpectations:\n* Source/WebCore/rendering/LineClampUpdater.h:\n(WebCore::LineClampUpdater::LineClampUpdater):\n\nCanonical link: https://commits.webkit.org/319848@main", "email": "rbuis@igalia.com", "hash": "f186fcf4e2e1b0a56de87a8edc97628b45b19558", "subject": "[preview-only] REGRESSION(304956@main): wpt /css/css-overflow/line-clamp/line-clamp-015.html" }, "319849@main": { "author": "Roy Reapor", "avatar": "https://www.gravatar.com/avatar/bcb83d9f4fea3f6823d1b8f01e888053?d=identicon\u0026s=64", "cl": "319849@main", "clUrl": "https://commits.webkit.org/319849@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322551\nrdar://185842381\n\nReviewed by David Kilzer.\n\nInclude `Tools/TestWebKitAPI` in Apple builds.\n\n* .submitproject-append:\n\nCanonical link: https://commits.webkit.org/319849@main", "email": "rreapor@apple.com", "hash": "5d41d959bf3f8d4d33c9dc47474480713ad1ccb3", "subject": "`.submitproject-append` should include `Tools/TestWebKitAPI`" }, "319850@main": { "author": "Nikolas Zimmermann", "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64", "cl": "319850@main", "clUrl": "https://commits.webkit.org/319850@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321882\n\nReviewed by Rob Buis.\n\nRenderSVGResourcePattern::collectPatternAttributesIfNeeded() followed the\nxlink:href chain without remembering where it had been, so two patterns pointing\nat each other, or one pointing at itself, hang the WebContent process on the\nfirst paint.\n\nGradients never had that problem, their walk and its cycle detection live in\nSVGLinearGradientElement::collectGradientAttributes(). Switch patterns to the\nsame kind of logic: move the walk into SVGPatternElement::collectPatternAttributes(),\nwhich now returns whether the pattern can be rendered. The legacy renderer keeps its\nSVGResourcesCache walk and only follows the rename.\n\nTwo further differences turned out to be accidental and now follow the gradient\nrule: patterns kept the attributes collected so far when the chain reached an\nelement without a renderer aand they resolved each href in the tree scope of the\nelement holding it, not the one the walk started from which is incorrect.\n\nFinally, unify both code paths as much as possible, so gradient/pattern attribute\ncollection has the very same shape - less confusing this way.\n\nUpdate expectations, and add new fast/shadow-dom tests to cover the tree scope\nchange.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/fast/shadow-dom/svg-multiple-references-in-multiple-shadows-pattern-expected.html: Added.\n* LayoutTests/fast/shadow-dom/svg-multiple-references-in-multiple-shadows-pattern.html: Added.\n* LayoutTests/fast/shadow-dom/svg-pattern-dynamic-update-href-in-shadow-tree-expected.html: Added.\n* LayoutTests/fast/shadow-dom/svg-pattern-dynamic-update-href-in-shadow-tree.html: Added.\n* LayoutTests/fast/shadow-dom/svg-pattern-href-in-shadow-tree-expected.html: Added.\n* LayoutTests/fast/shadow-dom/svg-pattern-href-in-shadow-tree.html: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/TestExpectations:\n* LayoutTests/svg/custom/pattern-href-cycle-detection-expected.svg: Added.\n* LayoutTests/svg/custom/pattern-href-cycle-detection.svg: Added.\n* Source/WebCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations:\n* Source/WebCore/rendering/svg/RenderSVGResourcePattern.cpp:\n(WebCore::RenderSVGResourcePattern::collectPatternAttributesIfNeeded):\n* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResourcePattern.cpp:\n(WebCore::LegacyRenderSVGResourcePattern::collectPatternAttributes const):\n* Source/WebCore/svg/SVGLinearGradientElement.cpp:\n(WebCore::setGradientAttributes):\n(WebCore::SVGLinearGradientElement::collectGradientAttributes):\n* Source/WebCore/svg/SVGPatternElement.cpp:\n(WebCore::SVGPatternElement::collectPatternAttributes):\n(WebCore::SVGPatternElement::collectOwnPatternAttributes const):\n(WebCore::SVGPatternElement::collectPatternAttributes const): Deleted.\n* Source/WebCore/svg/SVGPatternElement.h:\n* Source/WebCore/svg/SVGRadialGradientElement.cpp:\n(WebCore::setGradientAttributes):\n(WebCore::SVGRadialGradientElement::collectGradientAttributes):\n\nCanonical link: https://commits.webkit.org/319850@main", "email": "nzimmermann@igalia.com", "hash": "19a32ddd271368e7c6c774883950f1ac119b64f0", "subject": "[LBSE] Collecting pattern attributes walks an xlink:href cycle forever" }, "319851@main": { "author": "Sammy Gill", "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64", "cl": "319851@main", "clUrl": "https://commits.webkit.org/319851@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322508\nrdar://problem/185811508\n\nReviewed by Alan Baradlay.\n\nGridLanesLayout should not need to know about the legacy render tree grid\nimplementation. As a step in that direction, stop having it consult the grid\ncontainer's style to resolve fit-tolerance. RenderGrid now resolves the style\nvalue into a used value up front and passes it in, so the placement code only\never deals with an already resolved length, or the infinite keyword.\n\nThis removes the reads on the grid container that existed solely to compute the\ntolerance: style().fitTolerance(), style().computedFontSize(),\nstyle().usedZoomForLength(), contentBoxLogicalWidth() and\ncontentBoxLogicalHeight().\n\nResolving once per placement run instead of once per auto placed item is not a\nbehavior change. Nothing in the placement loop mutates the container's content\nbox, and the container's logical height is not set until after placement has\nfinished.\n\n* Source/WebCore/rendering/GridLanesLayout.h:\nAdd ResolvedFitTolerance, which is either the used length or the infinite\nkeyword. It is only needed while items are being placed, so it is threaded\nthrough placement rather than stored as a member.\n\n* Source/WebCore/rendering/GridLanesLayout.cpp:\nDrop the StyleFitTolerance.h and StylePrimitiveNumericTypes+Evaluation.h includes,\nwhich were only needed by the resolution that moved out.\n(WebCore::GridLanesLayout::performGridLanesPlacement):\n(WebCore::GridLanesLayout::placeGridLanesItems):\n(WebCore::GridLanesLayout::gridAreaForIndefiniteGridAxisItem):\nTake the resolved tolerance as a parameter and pass it down to\ngridAreaForIndefiniteGridAxisItem(), which is the only thing that uses it.\n\n* Source/WebCore/rendering/RenderGrid.cpp:\n(WebCore::resolveFitTolerance):\nThe moved resolution, which is why StyleFitTolerance.h is now included here. A\npercentage resolves against the stacking axis content box size, since the\ntolerance is a distance measured along the stacking axis. The local is named for\nthat axis so it is harder to misread which one applies.\n(WebCore::RenderGrid::layoutGridLanes):\n(WebCore::RenderGrid::computeIntrinsicLogicalWidths const):\nResolve the tolerance and hand it to performGridLanesPlacement(). The intrinsic\nwidth path runs placement twice, so it resolves once and reuses the value.\n\nCanonical link: https://commits.webkit.org/319851@main", "email": "sammy.gill@apple.com", "hash": "ee671ed1c8f5bc9023ec5681cbb94007e8b278ab", "subject": "[Grid Lanes] Resolve fit-tolerance outside of GridLanesLayout" }, "319852@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "319852@main", "clUrl": "https://commits.webkit.org/319852@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322536\nrdar://185830225\n\nReviewed by Keith Miller.\n\nThis patch uses JSString's perCellBit for `isDefinitelyAtom` flag. This\nindicates that this JSString is *definitely* having AtomStringImpl\nwithout querying to the actual AtomStringImpl content. This flag can be\nfalse-negative: it can be not-set even if JSString is actually holding\nAtomStringImpl because one StringImpl can be held by multiple different\nJSString* and one may upgrade it to AtomStringImpl in-place. But this\nflag is totally fine as the invariant is \"when it is saying true, then\nJSString is holding AtomStringImpl*. Otherwise, unknown, it may have\nAtomStringImpl or not\".\n\nBy using this flag, we replace our speculationFromCell code to use this\nflag instead of looking into AtomStringImpl* actually. This resolves\nmemory ordering issue around ValueProfile in a conservative way. It may\nsay wrong result, but since it is speculation, anyway, it is fine.\n\nTest: JSTests/stress/jsstring-definitely-atom-bit.js\n\n* JSTests/stress/jsstring-definitely-atom-bit.js: Added.\n(shouldBe):\n(set makeString):\n(makeRope):\n(exercise):\n* Source/JavaScriptCore/bytecode/SpeculatedType.cpp:\n(JSC::speculationFromCellImpl):\n(JSC::speculationFromCell):\n(JSC::speculationFromValueImpl):\n(JSC::speculationFromValue):\n(JSC::speculationFromValueForProfiling):\n* Source/JavaScriptCore/bytecode/SpeculatedType.h:\n* Source/JavaScriptCore/bytecode/ValueProfile.h:\n(JSC::ValueProfileBase::dump):\n(JSC::ValueProfileBase::computeUpdatedPrediction):\n(JSC::ValueProfileBase::computeUpdatedPredictionForExtraValue):\n(JSC::ValueProfileBase::classInfo const): Deleted.\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n(JSC::DFG::SpeculativeJIT::speculateStringIdentAndLoadStorage):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n* Source/JavaScriptCore/jit/AssemblyHelpers.cpp:\n(JSC::AssemblyHelpers::loadCacheableIdentifierImpl):\n* Source/JavaScriptCore/jit/AssemblyHelpers.h:\n(JSC::AssemblyHelpers::branchIfNotAtomStringImpl):\n* Source/JavaScriptCore/jit/JITOpcodes.cpp:\n(JSC::JIT::compileOpStrictEq):\n* Source/JavaScriptCore/runtime/JSString.h:\n(JSC::JSString::typeInfoBlobForAtomness):\n(JSC::JSString::JSString):\n(JSC::JSString::isDefinitelyAtom const):\n(JSC::JSString::markAsAtom const):\n(JSC::JSString::existingAtomOrNull const):\n(JSC::JSString::swapToAtomString const):\n(JSC::JSString::toIdentifier const):\n(JSC:: const):\n* Source/JavaScriptCore/runtime/JSStringInlines.h:\n(JSC::JSRopeString::convertToNonRope const):\n(JSC::jsAtomString):\n* Source/JavaScriptCore/tools/JSDollarVM.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n(JSC::JSDollarVM::finishCreation):\n\nCanonical link: https://commits.webkit.org/319852@main", "email": "ysuzuki@apple.com", "hash": "24f0a336557e9618836f7025396888bc42f25ff1", "subject": "[JSC] Add JSString::isDefinitelyAtom" }, "319853@main": { "author": "Vivienne Watermeier", "avatar": "https://www.gravatar.com/avatar/b679444a541a24a040e18682e425b2ee?d=identicon\u0026s=64", "cl": "319853@main", "clUrl": "https://commits.webkit.org/319853@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322499\n\nReviewed by Philippe Normand.\n\nCurrently we use watermarks proportional to the total size of the resource,\nwhich can result in excessively large or small watermarks, and requires a\nspecial case for small files (arguably one would be needed for large files too).\n\nSetting fixed values for watermarks will be simpler and more consistent.\n\n* Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:\n(restartLoaderIfNeeded):\n(stopLoaderIfNeeded):\n\nCanonical link: https://commits.webkit.org/319853@main", "email": "vwatermeier@igalia.com", "hash": "71c8aeac877f4b2890b694003de958a508a0fa18", "subject": "[GStreamer] Use fixed watermarks for WebKitWebSource's internal queue" }, "319854@main": { "author": "Ian Grunert", "avatar": "https://www.gravatar.com/avatar/6a676cf1bcb9ff83c6cd867a0e3a0fa4?d=identicon\u0026s=64", "cl": "319854@main", "clUrl": "https://commits.webkit.org/319854@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322271\n\nReviewed by Ian Grunert and Elliott Williams.\n\nThe Windows Swift build failed in the clang importer for several stacked\nreasons:\n\n1. The Swift SDK's vcruntime.modulemap wraps the MSVC STL in a clang\n module whose yvals_core.h lives in an explicit submodule, so the\n __cpp_lib_* feature-test macros never become visible to headers that\n reach \u003cversion\u003e through a module import. WTF/simdutf then mix\n pre-C++20 and C++23 preprocessor paths. Seed the macros through the\n platform-swift-args.resp response file (generate-platform-args\n --stl-feature-macros); they must not go on the command line, which\n already sits near the 32767-char CreateProcess limit that ninja hits\n before swiftc-wrapper can expand its own response file.\n\n2. The same modulemap names only two of the STL's __msvc_*.hpp internal\n headers, leaving e.g. std::views::transform (__msvc_ranges_to.hpp)\n invisible at use sites. Generate an amended modulemap listing all of\n them and mount it over the MSVC include dir with a VFS overlay.\n\nAlternatives considered:\n\n1. Generate the amened modulemap directly in cmake rather than python.\n This was more concise but was unusually complex cmake code.\n\n2. Do not _generate_ an amended modulemap; instead ship a static one.\n However, the SDK-provided VC modulemap is currently 796 lines which\n would be troublesome to maintain if we forked. A live amendment\n to insert the extra files seems less bad. (Licensing might also\n have made this awkward.)\n\n3. Instead of execute_process, use a add_custom_command such that the\n python script runs in parallel with other build steps instead of\n at each configure time. Architecturally nicer, but the extra\n dependency edges, plus the need to respect CONFIGURE_DEPENDS\n would have made this even more verbose (and it's only one of\n hundreds of existing python invocations during cmake configure.)\n\n4. List the headers which need to be added, instead of globbing.\n Everyone knows globbing is fragile and bad. However, the list\n of headers may also be fragile, and hopefully the use of\n CONFIGURE_DEPENDS reduces the globbing risk by prompting\n regeneration if the VC runtime header file set changes.\n\nThe reference for the limitations of the shipping modulemap is\nrdar://185507163.\n\nCo-Authored-By: Adrian Taylor \u003cadrian_taylor@apple.com\u003e\nCanonical link: https://commits.webkit.org/319854@main", "email": "ian.grunert@gmail.com", "hash": "4e646d190c3faf19195be9e2532318526865044b", "subject": "Fix the Swift clang importer on Windows: MSVC STL module visibility and more" }, "319855@main": { "author": "Philippe Normand", "avatar": "https://www.gravatar.com/avatar/eef27203750af3510263cc29af21a16e?d=identicon\u0026s=64", "cl": "319855@main", "clUrl": "https://commits.webkit.org/319855@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322494\n\nReviewed by Adrian Perez de Castro.\n\nOtherwise our ports are assumed to support HLS and Legacy EME, which is not the case. And in our\ncase DRM is unlikely supported for that media transport anyway. By using a Chrome UA playback is\nhandled with MSE/EME.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/glib/UserAgentQuirks.cpp\n\n* Source/WebCore/platform/glib/UserAgentQuirks.cpp:\n(WebCore::urlRequiresChromeBrowser):\n* Tools/TestWebKitAPI/Tests/WebCore/glib/UserAgentQuirks.cpp:\n(TestWebKitAPI::TEST(UserAgentTest, Quirks)):\n\nCanonical link: https://commits.webkit.org/319855@main", "email": "philn@igalia.com", "hash": "d115ce184f961a75c7101e4114c7cf0378e21ba5", "subject": "[WPE][GTK] Use a Chrome UA for PrimeVideo" }, "319856@main": { "author": "Carlos Garcia Campos", "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64", "cl": "319856@main", "clUrl": "https://commits.webkit.org/319856@main", "description": "Canonical link: https://commits.webkit.org/319856@main", "email": "cgarcia@igalia.com", "hash": "874824c2000d30d7b790724ca0df09aff11f62b8", "subject": "Unreviewed. [GTK] Bump version numbers" }, "319857@main": { "author": "Claudio Saavedra", "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64", "cl": "319857@main", "clUrl": "https://commits.webkit.org/319857@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322569\n\nReviewed by Carlos Garcia Campos.\n\nThe serializer is registered for WTF::MemoryPressureHandlerConfiguration, which\nthe generator records without the WTF:: prefix, but the two GLib-guarded members\nreach it through the MemoryPressureHandler::Configuration alias, so\nipc/serialized-type-info.html found no metadata under the name actually in use.\n\nSpell both members MemoryPressureHandlerConfiguration, the name the metadata\ncarries, and export it from the header the way Seconds and the other names used\nunqualified in serialization.in files already are.\n\n* Source/WTF/wtf/MemoryPressureHandler.h:\n* Source/WebKit/NetworkProcess/NetworkProcessCreationParameters.serialization.in:\n* Source/WebKit/Shared/WebProcessCreationParameters.serialization.in:\n\nCanonical link: https://commits.webkit.org/319857@main", "email": "csaavedra@igalia.com", "hash": "3e6559f2f3a9017a4937fc2441c04bc18c22fb9e", "subject": "[GLIB] MemoryPressureHandlerConfiguration has no IPC metadata under the name in use" }, "319858@main": { "author": "Adrian Perez de Castro", "avatar": "https://www.gravatar.com/avatar/30ffea8cf404586741a8f5f7110c0914?d=identicon\u0026s=64", "cl": "319858@main", "clUrl": "https://commits.webkit.org/319858@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322572\n\nReviewed by Carlos Garcia Campos.\n\nUse the current Unix epoch as timestamp when adding a new item in\nIconDatabase::addIcon(). Another option that was considered was changing\nthe database schema to include \"default (unixepoch())\" in the timestamp\ncolumn; but it was discarded to avoid changing the schema version.\n\nPrior to the fix, using zero as timestamp when adding a new page icon in\nIconDatabase::addIcon() made it always look as if it were immediately\nexpired:\n\n- IconDatabase::iconIDForIconURL() would flag icons as expired,\n resulting in them being re-downloaded.\n\n- IconDatabase::pruneTimerFired() would remove icons from the database\n if their timestamp has not been touched, making icons prone to be\n removed before they have a chance to be used if the timer kicks in\n before their first use.\n\nUnfortunately writing a proper test for this would be tricky it would\nneed access to the IconDatabase internals, and testing would be slow\nbecause it would need a 10s pause for every test case.\n\n* Source/WebKit/UIProcess/API/glib/IconDatabase.cpp:\n(WebKit::IconDatabase::addIcon):\n\nCanonical link: https://commits.webkit.org/319858@main", "email": "aperez@igalia.com", "hash": "9d3acc999bfd920472d36b6025588fcd50cd71bb", "subject": "[GTK][WPE] IconDatabase should use current timestamp when inserting new icons" }, "319859@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "319859@main", "clUrl": "https://commits.webkit.org/319859@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322558\nrdar://185734791\n\nReviewed by Youenn Fablet.\n\n319455@main turned clientWillBeginPlayback() from a completion-handler API\ninto one returning GenericPromise, and serialized admissions on m_currentPlaybackAdmission\nso they always completed in request order.\n\nStarting a video asks the media session manager for permission to play. Once granted, the session claims the Playing state.\nThat claim is what pauses videos in other windows and tells the UI process which video is playing.\n\nIn one case the claim was refused. The check guarding it compared the session's state at the end of the request against its state at the start, and read a change to Paused as a pause()\narriving in the meantime.\nThat was right for every starting state but one: a session already Playing never made a request, a session already Paused had not changed state, and a session\nthat started out Autoplaying or Idle and ended up Paused really had been paused.\n\nA session that started out as Interrupted was the exception.\nGranting its request ended the interruption, and ending an interruption put the session back to the state it held when the\ninterruption began (Paused), for a video another window had just paused.\nSo the check fired on a change the request had made itself. The session claimed nothing, the UI process was never\ntold, the video in the other window kept playing, and both played at once.\n\nendInterruption() now restores Playing whenever a play request is in flight,\nwhatever the session was doing when the interruption began. beginInterruption() already did this for a request\nalready in flight; this covers one that started later.\n\nNeither the stale restored state nor the check itself is new (319455@main only moved the check into commitPlaybackAdmission()).\nWhat made it visible was gating enforceConcurrentPlaybackRestriction() and the\nnotification to the UI process on the check's result.\nBefore, both ran either way, so a session that failed to claim Playing still paused the others.\n\nTest: media/video-interruption-play-restores-playing-state.html\n\n* LayoutTests/media/video-interruption-play-restores-playing-state-expected.txt: Added.\n* LayoutTests/media/video-interruption-play-restores-playing-state.html: Added.\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.cpp:\n(WebCore::MediaSessionManagerInterface::startSessionAdmission):\n* Source/WebCore/platform/audio/PlatformMediaSession.cpp:\n(WebCore::PlatformMediaSession::endInterruption):\n\nCanonical link: https://commits.webkit.org/319859@main", "email": "jya@apple.com", "hash": "da06d39f11c38563a494e6a66e34a1964612a7aa", "subject": "(319455@main) Multiple YouTube videos can play simultaneously across separate Safari windows" }, "319860@main": { "author": "Kimmo Kinnunen", "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64", "cl": "319860@main", "clUrl": "https://commits.webkit.org/319860@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322263\nrdar://185498825\n\nReviewed by Dan Glastonbury.\n\nOffscreenCanvas, HTMLCanvasElement hold copied image of the backing\nstore. In the future, CanvasRenderingContexts will hold a copy of\nthe image of the backing store. The copy should be dropped once\nwe know the drawing buffer will change. This prevents the cached\ncopy from forcing copy-on-write on contexts such as 2D that support\nthis.\n\nRename CanvasBase::didDraw to CanvasBase::willUpdateContents and\ncall willUpdateContents before doing the update.\n\n* Source/WebCore/html/CanvasBase.cpp:\n(WebCore::CanvasBase::willUpdateContents):\n(WebCore::CanvasBase::didDraw): Deleted.\n* Source/WebCore/html/CanvasBase.h:\n(WebCore::CanvasBase::willUpdateContents):\n(WebCore::CanvasBase::didDraw): Deleted.\n* Source/WebCore/html/CustomPaintCanvas.h:\n* Source/WebCore/html/HTMLCanvasElement.cpp:\n(WebCore::HTMLCanvasElement::willUpdateContents):\n(WebCore::HTMLCanvasElement::didDraw): Deleted.\n* Source/WebCore/html/HTMLCanvasElement.h:\n* Source/WebCore/html/OffscreenCanvas.cpp:\n(WebCore::OffscreenCanvas::willUpdateContents):\n(WebCore::OffscreenCanvas::didDraw): Deleted.\n* Source/WebCore/html/OffscreenCanvas.h:\n* Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp:\n(WebCore::CanvasRenderingContext2D::drawFocusIfNeededInternal):\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:\n(WebCore::CanvasRenderingContext2DBase::endLayer):\n(WebCore::CanvasRenderingContext2DBase::fillInternal):\n(WebCore::CanvasRenderingContext2DBase::strokeInternal):\n(WebCore::CanvasRenderingContext2DBase::clearRect):\n(WebCore::CanvasRenderingContext2DBase::fillRect):\n(WebCore::CanvasRenderingContext2DBase::strokeRect):\n(WebCore::CanvasRenderingContext2DBase::drawImage):\n(WebCore::CanvasRenderingContext2DBase::willUpdateEntireContents):\n(WebCore::CanvasRenderingContext2DBase::willUpdateContents):\n(WebCore::CanvasRenderingContext2DBase::putImageData):\n(WebCore::CanvasRenderingContext2DBase::drawTextUnchecked):\n(WebCore::CanvasRenderingContext2DBase::didDrawEntireCanvas): Deleted.\n(WebCore::CanvasRenderingContext2DBase::didDraw): Deleted.\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.h:\n(WebCore::CanvasRenderingContext2DBase::defaultWillUpdateContentsOptions):\n(WebCore::CanvasRenderingContext2DBase::defaultWillUpdateContentsOptionsWithoutPostProcessing):\n(WebCore::CanvasRenderingContext2DBase::defaultDidDrawOptions): Deleted.\n(WebCore::CanvasRenderingContext2DBase::defaultDidDrawOptionsWithoutPostProcessing): Deleted.\n* Source/WebCore/html/canvas/GPUBasedCanvasRenderingContext.cpp:\n(WebCore::GPUBasedCanvasRenderingContext::willUpdateCanvasContents):\n(WebCore::GPUBasedCanvasRenderingContext::markCanvasChanged): Deleted.\n* Source/WebCore/html/canvas/GPUBasedCanvasRenderingContext.h:\n* Source/WebCore/html/canvas/GPUCanvasContextCocoa.h:\n* Source/WebCore/html/canvas/GPUCanvasContextCocoa.mm:\n(WebCore::GPUCanvasContextCocoa::getCurrentTexture):\n(WebCore::GPUCanvasContextCocoa::willUpdateDisplayBufferContents):\n(WebCore::GPUCanvasContextCocoa::markContextChangedAndNotifyCanvasObservers): Deleted.\n* Source/WebCore/html/canvas/ImageBitmapRenderingContext.cpp:\n(WebCore::ImageBitmapRenderingContext::transferFromImageBitmap):\n(WebCore::ImageBitmapRenderingContext::transferToImageBuffer):\n* Source/WebCore/html/canvas/PlaceholderRenderingContext.cpp:\n(WebCore::PlaceholderRenderingContext::setPlaceholderBuffer):\n* Source/WebCore/html/canvas/WebGL2RenderingContext.cpp:\n(WebCore::WebGL2RenderingContext::blitFramebuffer):\n(WebCore::WebGL2RenderingContext::drawRangeElements):\n(WebCore::WebGL2RenderingContext::clearBufferfv):\n* Source/WebCore/html/canvas/WebGLDrawInstancedBaseVertexBaseInstance.cpp:\n(WebCore::WebGLDrawInstancedBaseVertexBaseInstance::drawArraysInstancedBaseInstanceWEBGL):\n(WebCore::WebGLDrawInstancedBaseVertexBaseInstance::drawElementsInstancedBaseVertexBaseInstanceWEBGL):\n* Source/WebCore/html/canvas/WebGLMultiDraw.cpp:\n(WebCore::WebGLMultiDraw::multiDrawArraysWEBGL):\n(WebCore::WebGLMultiDraw::multiDrawArraysInstancedWEBGL):\n(WebCore::WebGLMultiDraw::multiDrawElementsWEBGL):\n(WebCore::WebGLMultiDraw::multiDrawElementsInstancedWEBGL):\n* Source/WebCore/html/canvas/WebGLMultiDrawInstancedBaseVertexBaseInstance.cpp:\n(WebCore::WebGLMultiDrawInstancedBaseVertexBaseInstance::multiDrawArraysInstancedBaseInstanceWEBGL):\n(WebCore::WebGLMultiDrawInstancedBaseVertexBaseInstance::multiDrawElementsInstancedBaseVertexBaseInstanceWEBGL):\n* Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp:\n(WebCore::WebGLRenderingContextBase::willUpdateDrawingBufferContents):\n(WebCore::WebGLRenderingContextBase::clear):\n(WebCore::WebGLRenderingContextBase::drawArrays):\n(WebCore::WebGLRenderingContextBase::drawElements):\n(WebCore::WebGLRenderingContextBase::drawArraysInstanced):\n(WebCore::WebGLRenderingContextBase::drawElementsInstanced):\n(WebCore::WebGLRenderingContextBase::markContextChangedAndNotifyCanvasObserver): Deleted.\n* Source/WebCore/html/canvas/WebGLRenderingContextBase.h:\n\nCanonical link: https://commits.webkit.org/319860@main", "email": "kkinnunen@apple.com", "hash": "4d58ca82d511855cd877e82d432872e7068fa0a3", "subject": "CanvasBase and CanvasRenderingContexts should discard copies before draws" }, "319861@main": { "author": "Angelos Oikonomopoulos", "avatar": "https://www.gravatar.com/avatar/ee46106043323b10e0bb3c899f9590e5?d=identicon\u0026s=64", "cl": "319861@main", "clUrl": "https://commits.webkit.org/319861@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319092\n\nReviewed by Carlos Alberto Lopez Perez.\n\nWe scale JSC_timeout by the number of cores, which might allow a hanging\ntest to run past the buildbot timeout, causing the whole run to\nfail with\n\n command timed out: 1200 seconds without output\n\nCap the timeout by default on all jscore-tests runs.\n\nCanonical link: https://commits.webkit.org/319861@main", "email": "angelos@igalia.com", "hash": "d06355e48e7ff945ca98ed05b353206b63540d31", "subject": "[CISupport] Cap max timeout in jscore-tests" }, "319862@main": { "author": "Sam Weinig", "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64", "cl": "319862@main", "clUrl": "https://commits.webkit.org/319862@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322518\n\nReviewed by Darin Adler.\n\nSimplify the logic for viewport-percentage unit resolution, removing a\nbit of duplicate logic.\n\n* Source/WebCore/style/values/primitives/StyleLengthResolution.cpp:\n(WebCore::Style::resolveViewportLogicalAxis):\n(WebCore::Style::resolveViewportAxis):\n(WebCore::Style::resolveViewportType):\n(WebCore::Style::resolveViewportUnit):\n(WebCore::Style::resolveLengthImpl):\n(WebCore::Style::resolveViewportPercentagePhysicalAxis): Deleted.\n(WebCore::Style::resolveViewportPercentageLogicalAxis): Deleted.\n(WebCore::Style::resolveViewportPercentageUnit): Deleted.\n\nCanonical link: https://commits.webkit.org/319862@main", "email": "sam@webkit.org", "hash": "ae6f786db13d0bc15dfe1726dd5c0ada20843e5c", "subject": "[Cleanup] Streamline the viewport-percentage unit resolution functions" }, "319863@main": { "author": "Youenn Fablet", "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64", "cl": "319863@main", "clUrl": "https://commits.webkit.org/319863@main", "description": "rdar://177096608\n\nReviewed by Jean-Yves Avenard.\n\nRemoteVideoDecoderCallbacks::addDuration is called from the JS thread that invoked VideoDecoder.decode.\nRemoteVideoDecoderCallbacks::notifyDecodingResult is called from the LibWebRTCCodecs work queue.\nBoth mutate m_timestampToDuration so we need to add a lock to ensure synchronization.\nWe also make m_isClosed atomic on both the decoder and encoder callback objects as it is written in a thread and read in another.\n\nPatch mostly written by Simon Lewis.\n\n* LayoutTests/http/wpt/webcodecs/videoDecoder-concurrent-decode-output-no-crash-expected.txt: Added.\n* LayoutTests/http/wpt/webcodecs/videoDecoder-concurrent-decode-output-no-crash.html: Added.\n* Source/WebKit/WebProcess/GPU/media/RemoteVideoCodecFactory.cpp:\n(WebKit::RemoteVideoDecoderCallbacks::addDuration):\n(WebKit::RemoteVideoDecoderCallbacks::takeDuration):\n(WebKit::RemoteVideoDecoderCallbacks::notifyDecodingResult):\n\nOriginally-landed-as: 305413.1093@safari-7624.5-branch (50232798d951). rdar://185369402\nCanonical link: https://commits.webkit.org/319863@main", "email": "youenn@apple.com", "hash": "9ba6cb68fcfbb1948bc4b6a1d3f88c4d9073e032", "subject": "Race on RemoteVideoDecoderCallbacks::m_timestampToDuration leads to use-after-free" }, "319864@main": { "author": "Youenn Fablet", "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64", "cl": "319864@main", "clUrl": "https://commits.webkit.org/319864@main", "description": "rdar://176890926\n\nReviewed by Chris Dumez.\n\nWe cannot easily validate that a sandbox extension is valid or related to a specific file.\nWe thus stop validating the sandbox extension and only rely on the allowed file path check.\nThis ensures that a web process can only create blobs from a file that the UIProcess deemed appropriate (via direct UIProcess/NetworkProcess IPC).\n\nTwo code paths need to be updated to not break existing functionality:\n1. Image transcoding for files dropped on \u003cinput type=file\u003e was previoulsy done in WebProcess.\n We move this to UIProcess via ChromeClient::transcodeChosenFiles, with a default implementation\n that preserves the previous in-WebProcess behavior by dispatching to the shared transcoding queue.\n WebChromeClient is implementing out-of-process transcoding by asking WebPageProxy via IPC to do the work.\n WebPageProxy does this and makes sure to notify network process that the transcoded files can be accessed.\n2. WebPageProxy::didChooseFilesForOpenPanelWithImageTranscoding needs to make sure to allow access of these files\n from the network process. Once this is done, it notifies the WebProcess of the result as before.\n\nWe do a small refactoring by factoring the queue dispatch + main-thread hop into transcodeImagesInBackgroundQueue.\nCall sites like the default ChromeClient implementation and WebPageProxy::transcodeChosenFiles no longer manage cross-thread copies.\n\nManually tested.\n\n* Source/WebCore/html/FileInputType.cpp:\n(WebCore::FileInputType::receiveDroppedFilesWithImageTranscoding):\n* Source/WebCore/page/Chrome.cpp:\n(WebCore::Chrome::transcodeChosenFiles):\n* Source/WebCore/page/Chrome.h:\n* Source/WebCore/page/ChromeClient.cpp:\n(WebCore::ChromeClient::transcodeChosenFiles):\n* Source/WebCore/page/ChromeClient.h:\n* Source/WebCore/platform/graphics/ImageUtilities.h:\n* Source/WebCore/platform/graphics/cg/ImageUtilitiesCG.cpp:\n(WebCore::transcodeImages):\n(WebCore::transcodeImagesInBackgroundQueue):\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:\n(WebKit::NetworkConnectionToWebProcess::registerInternalFileBlobURL):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::didChooseFilesForOpenPanelWithImageTranscoding):\n(WebKit::WebPageProxy::transcodeChosenFiles):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.messages.in:\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:\n(WebKit::WebChromeClient::transcodeChosenFiles):\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h:\n\nOriginally-landed-as: 305413.1003@safari-7624.5-branch (1c3f0755c46a). rdar://185369553\nCanonical link: https://commits.webkit.org/319864@main", "email": "youenn@apple.com", "hash": "0748de3348707dfdfb3bb4c2c295979833a654ab", "subject": "Incomplete replacementPath validation in NetworkConnectionToWebProcess::registerInternalFileBlobURL" }, "319865@main": { "author": "Youenn Fablet", "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64", "cl": "319865@main", "clUrl": "https://commits.webkit.org/319865@main", "description": "rdar://177953125\n\nReviewed by Chris Dumez.\n\nWe add a lock and the related lock assertions to prevent unlocked access to the map.\nGiven the potential locking that may happen for form data size computation, we make sure to compute the response real size outside of the lock.\n\nTest: http/wpt/cache-storage/cache-put-opaque-response-race.html\n\n* LayoutTests/http/wpt/cache-storage/cache-put-opaque-response-race-expected.txt: Added.\n* LayoutTests/http/wpt/cache-storage/cache-put-opaque-response-race.html: Added.\n* Source/WebCore/Modules/cache/CacheStorageConnection.cpp:\n(WebCore::CacheStorageConnection::computeRecordBodySize):\n* Source/WebCore/Modules/cache/CacheStorageConnection.h:\n\nOriginally-landed-as: 305413.1001@safari-7624.5-branch (4c69ed8ad988). rdar://185368026\nCanonical link: https://commits.webkit.org/319865@main", "email": "youenn@apple.com", "hash": "63ee8a1a7d39228e31d3f00a78fa8eef52909609", "subject": "Unsynchronized cross-thread access to m_opaqueResponseToSizeWithPaddingMap in CacheStorageConnection::computeRecordBodySize" }, "319866@main": { "author": "Carlos Garcia Campos", "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64", "cl": "319866@main", "clUrl": "https://commits.webkit.org/319866@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322587\n\nReviewed by Nikolas Zimmermann.\n\nWe create a new SkImage every time the tile texture is created, but\nSkImage is supposed to be immutable, in particular the\nSkImages::BorrowTextureFrom documentations says: \"The backend texture\nmust stay valid and unchanged until textureReleaseProc is called\". So,\neven if the texture id is the same, every time the contents are updated\nwe should reset the cached image to be regenerated. We should also use a\ntextureReleaseProc to ensure the texture is valid.\n\n* Source/WebCore/platform/graphics/skia/SkiaBackingStore.cpp:\n(WebCore::SkiaBackingStore::Tile::ensureTexture):\n(WebCore::SkiaBackingStore::Tile::image const):\n\nCanonical link: https://commits.webkit.org/319866@main", "email": "cgarcia@igalia.com", "hash": "68a8f633acf15a1f3324965dc57d5f00ba63dcfe", "subject": "[GTK][WPE] Skia compositor: tile cached SkImage should be re-created for every update" }, "319867@main": { "author": "Justin Michaud", "avatar": "https://www.gravatar.com/avatar/36e0433ee725a08f7e1122a6bc584b57?d=identicon\u0026s=64", "cl": "319867@main", "clUrl": "https://commits.webkit.org/319867@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322290\n\nReviewed by Claudio Saavedra.\n\nThis was bugging me while I was looking at it, little drive-by cleanup.\n\nCanonical link: https://commits.webkit.org/319867@main", "email": "jmichaud@igalia.com", "hash": "9fa946d9a72f9ebd5703e0a301849482f6c8463b", "subject": "Clean up jsObjectCall style" }, "319869@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "319869@main", "clUrl": "https://commits.webkit.org/319869@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322387\nrdar://185671311\n\nReviewed by Youenn Fablet.\n\nCache.addAll() rejects with InvalidStateError when two of its requests match\neach other. It checked this by walking every already-staged record as each\nfetch completed, which is O(n^2): 500 URLs means ~125000 comparisons. Each\ncomparison was also far more expensive than it looks, because\nFetchRequest::resourceRequest() is not an accessor -- it copies the whole\nResourceRequest, sets the header fields, and calls bodyAsFormData() when a body\nis present -- and it was invoked inside the loop.\n\nGive FetchTasksHandler a map from URL to the positions of the records staged\nunder it and let it answer the query via hasMatchingRecord(). The key is the\nfragment-stripped URL, which is exactly the equality queryCacheMatch() applies\nhere: options is default-constructed, so ignoreSearch is false and matchURLs()\nreduces to equalIgnoringFragmentIdentifier(). queryCacheMatch() still runs\nagainst every record in the bucket, so Vary continues to distinguish records\nsharing a URL. resourceRequest() is now called once per completed fetch.\nPositions rather than pointers, because m_records reallocates as it grows.\n\nThis mirrors CacheStorageCache in the network process, which already keys its\nrecords map with computeKeyURL(). That map also strips the query, because it\nserves ignoreSearch lookups; addAll() does not, so keying on the query here is\ncorrect and more selective.\n\nAdded a WPT subtest covering two entries that differ only by fragment, which\nmust be rejected as duplicates. This is the case the new URL key depends on,\nand nothing covered it before.\n\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/cache-add.https.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/cache-add.https.any.js:\n(cache_test.async cache):\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/cache-add.https.any.serviceworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/cache-add.https.any.sharedworker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/service-workers/cache-storage/cache-add.https.any.worker-expected.txt:\n* Source/WebCore/Modules/cache/DOMCache.cpp:\n(WebCore::FetchTasksHandler::hasMatchingRecord const):\n(WebCore::FetchTasksHandler::addRecord):\n(WebCore::DOMCache::addAll):\n(WebCore::FetchTasksHandler::records const): Deleted.\n\nCanonical link: https://commits.webkit.org/319869@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "d59388dcdfbd0c749ace56cf3b21969f03ecda6b", "subject": "Avoid quadratic duplicate detection in Cache.addAll()" }, "319870@main": { "author": "Nikolas Zimmermann", "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64", "cl": "319870@main", "clUrl": "https://commits.webkit.org/319870@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322486\n\nReviewed by Carlos Garcia Campos.\n\nRebaseline the glib fetch/service-worker results affected by upstream libsoup\nchanges: 3.7.1 rejects multiple Content-Length headers instead of combining\ntheir values, and tightened chunked encoding parsing. Both are intentional\nhardening upstream. The broken-chunked-encoding baseline is removed rather\nthan updated, since glib now matches the cross-platform expectation.\n\n* .wkdev-sdk-version: Bump to v11, bringing GStreamer 1.28.5 (plus a missing pipewire module), sparkle-cdm 2026.2, libsoup 3.7.2.\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/fetch/api/basic/header-value-combining.any-expected.txt: Added.\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/fetch/api/basic/header-value-combining.any.serviceworker-expected.txt: Added.\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/fetch/api/basic/header-value-combining.any.sharedworker-expected.txt: Added.\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/fetch/api/basic/header-value-combining.any.worker-expected.txt: Added.\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/fetch/content-length/api-and-duplicate-headers.any-expected.txt:\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/fetch/content-length/api-and-duplicate-headers.any.worker-expected.txt:\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/service-workers/service-worker/navigation-preload/broken-chunked-encoding.https-expected.txt: Removed.\n* LayoutTests/platform/gtk/TestExpectations: Mark media/event-attributes.html as crashing with GStreamer 1.28.5.\n\nCanonical link: https://commits.webkit.org/319870@main", "email": "nzimmermann@igalia.com", "hash": "1a124a04a6f54a16ffd37ce41770e1371a560502", "subject": "[GTK][WPE] Bump SDK version v9 -\u003e v11" }, "319871@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "319871@main", "clUrl": "https://commits.webkit.org/319871@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322469\nrdar://185755876\n\nReviewed by Chris Dumez.\n\nannotationHighlightKey() returned an ASCIILiteral, so each use implicitly\nconstructed an AtomString, and AtomString(ASCIILiteral) calls\nAtomStringImpl::add() under AtomStringTableLocker. Two of those ran on every\ncall: contains() then get() on the hit path, contains() then setFromMapLike() on\nthe miss path. Return a MainThreadNeverDestroyed\u003cconst AtomString\u003e instead so the\natom is created once, and fold the contains()/get() pair into a single m_map.get()\nso the key is hashed once rather than twice.\n\nUsing the RefPtr that get() already returns also drops a protect() call on the\nraw map value.\n\nNo change in behavior.\n\n* Source/WebCore/Modules/highlight/HighlightRegistry.cpp:\n(WebCore::annotationHighlightKey):\n(WebCore::HighlightRegistry::addAnnotationHighlightWithRange):\n\nCanonical link: https://commits.webkit.org/319871@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "4d2212f4f8ca37f93afa738fe4c52e2765a444b9", "subject": "HighlightRegistry::addAnnotationHighlightWithRange() does redundant atom table and hash lookups" }, "319872@main": { "author": "Claudio Saavedra", "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64", "cl": "319872@main", "clUrl": "https://commits.webkit.org/319872@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322567\n\nReviewed by Carlos Garcia Campos.\n\n319727@main gave ScopedLambda a converting constructor from any invocable,\nconstrained on Invocable\u003cFunctor, Signature\u003e but not against ScopedLambda\nitself. That makes Invocable\u003cScopedLambda\u003cSig\u003e, Sig\u003e circular: it asks whether\na std::function\u003cSig\u003e is assignable from the functor, libstdc++ answers through\nis_nothrow_constructible\u003cScopedLambda, ScopedLambda\u003e, and resolving that checks\nthis constructor's own constraint again. clang 18 through 20 reject the cycle,\nboth where a ScopedLambda is copied (Air) and where the concept is applied to\none directly (Options::initialize). clang 21 and GCC accept it, so EWS did not\ncatch it.\n\nConstrain the constructor against ScopedLambda, as std::optional and\nCompactVariant do; the conjunction short-circuits, so Invocable is never\nevaluated for ScopedLambda.\n\nTwo callees still took a ScopedLambda by value, which selected the converting\nconstructor rather than a copy. With it excluded, and the copy constructor\ndeleted by 319843@main, they have no viable constructor left. Take them by\nconst reference, like every other ScopedLambda parameter in the tree.\n\n* Source/JavaScriptCore/b3/air/AirCustom.h:\n(JSC::B3::Air::PatchCustom::forEachArg):\n* Source/JavaScriptCore/heap/MarkingConstraintSolver.cpp:\n(JSC::MarkingConstraintSolver::execute):\n(JSC::MarkingConstraintSolver::runExecutionThread):\n* Source/JavaScriptCore/heap/MarkingConstraintSolver.h:\n* Source/WTF/wtf/ScopedLambda.h:\n(WTF::ScopedLambda\u003cResultType):\n\nCanonical link: https://commits.webkit.org/319872@main", "email": "csaavedra@igalia.com", "hash": "44d3c5c94dc71fda8748e63c60a5270f2d5e80df", "subject": "REGRESSION(319727@main): Broke the build with clang 20 due to a self-referential ScopedLambda constraint" }, "319873@main": { "author": "Sihui Liu", "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64", "cl": "319873@main", "clUrl": "https://commits.webkit.org/319873@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322386\nrdar://184669941\n\nReviewed by Chris Dumez.\n\nA page that queues many read-write transactions operating on the same object store and is then suspended crashed the\nnetwork process. The cause is that handleTransactions() ended every scheduling pass by calling\nabortInProgressTransactionsBlockedOnSuspendedClients(), and that pass ended by calling handleTransactions() again. When\nthe scopes all overlap, takeNextRunnableTransaction() starts exactly one transaction before deferring the rest, so each\ncycle handled a single queued transaction and cost one frame pair; the reported crash recursed over 3000 levels.\nBatching the aborts in 318222@main did not help, because there is never more than one transaction to abort per pass.\n\nThis patch breaks the cycle at both ends. handleTransactions() no longer calls the abort pass, and\ntakeNextRunnableTransaction() no longer picks transactions of suspended clients: such a client cannot send requests, so\nstarting its transaction only holds the scope without making progress, and since the SQLite backing stores serialize\nwrites it blocks every other client's writes as well.\n\nThe abort pass now runs only from the three points where the blocked set can change, each followed by\nhandleTransactions() to start whatever became runnable:\n- Suspending a client marks it suspended and aborts its in-progress transactions that block an active client.\n- Resuming a client marks it active and aborts the in-progress transactions of still-suspended clients that now block\nit.\n- Queuing a transaction aborts the in-progress transactions of suspended clients that block it.\n\nAll three are IPC entry points, so the abort pass is unreachable from the scheduler and the recursion is structurally\nimpossible; a debug-only re-entrancy assertion replaces the recursion-depth counter from 318222@main. A suspended\nclient's queued transactions are now kept rather than started and rolled back, so their writes are no longer lost.\n\nAlso renamed setClientProcessSuspended() to setClientSuspended(), since a client connection in this layer is already\nidentified by a ProcessIdentifier.\n\nAdded 3 IndexedDB API tests to expand coverage:\n- ManyQueuedTransactionsOfSuspendedProcessAreDeferredNotAborted covers the reported crash and checks that only the\nin-progress transaction is aborted, that the 99 queued ones complete after resume, and that the network process\nsurvived.\n- TransactionOfSuspendedProcessIsNotAbortedByItsOwnQueuedTransaction checks that a suspended client's in-progress\ntransaction is left alone when the only thing waiting on it is that client's own queued transaction.\n- TransactionOfSuspendedProcessIsAbortedWhenAnotherSuspendedProcessResumes checks that with two suspended clients,\nresuming one aborts the other's in-progress transaction and starts the resumed client's.\n\n* Source/WebCore/Modules/indexeddb/server/IDBConnectionToClient.cpp:\n(WebCore::IDBServer::IDBConnectionToClient::setClientSuspended):\n(WebCore::IDBServer::IDBConnectionToClient::setClientProcessSuspended): Deleted.\n* Source/WebCore/Modules/indexeddb/server/IDBConnectionToClient.h:\n(WebCore::IDBServer::IDBConnectionToClient::isClientSuspended const):\n(WebCore::IDBServer::IDBConnectionToClient::isClientProcessSuspended const): Deleted.\n* Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.cpp:\n(WebCore::IDBServer::UniqueIDBDatabase::enqueueTransaction):\n(WebCore::IDBServer::UniqueIDBDatabase::handleTransactions):\n(WebCore::IDBServer::isTransactionOfSuspendedClient):\n(WebCore::IDBServer::UniqueIDBDatabase::takeNextRunnableTransaction):\n(WebCore::IDBServer::UniqueIDBDatabase::transactionBlocksPendingTransactions):\n(WebCore::IDBServer::UniqueIDBDatabase::handleTransactionsAfterAbortingSuspendedClientTransactions):\n(WebCore::IDBServer::UniqueIDBDatabase::abortInProgressTransactionsOfSuspendedClientsIfNeeded):\n(WebCore::IDBServer::UniqueIDBDatabase::abortInProgressTransactionsBlockedOnSuspendedClients): Deleted.\n* Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.h:\n* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp:\n(WebKit::NetworkStorageManager::setWebProcessSuspended):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/IndexedDBSuspendImminently.mm:\n(ManyQueuedTransactionsOfSuspendedProcessAreDeferredNotAborted)):\n(TransactionOfSuspendedProcessIsNotAbortedByItsOwnQueuedTransaction)):\n(TransactionOfSuspendedProcessIsAbortedWhenAnotherSuspendedProcessResumes)):\n\nCanonical link: https://commits.webkit.org/319873@main", "email": "sihui_liu@apple.com", "hash": "03efc9761a39b4849f8c849c455b4f6806c250f9", "subject": "REGRESSION(315609@main): Stack overflow in NetworkProcess aborting the queued transactions of a suspended process" }, "319874@main": { "author": "Kimmo Kinnunen", "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64", "cl": "319874@main", "clUrl": "https://commits.webkit.org/319874@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322168\nrdar://185398807\n\nReviewed by Matt Woodrow.\n\nDisplayList::Recorder would maintain the full GraphicsContext state\nin its save state stack. This used for two reasons:\n1. When GraphicsContext state changes, the recorder does not immediately\n record the state change items. The record happens only when\n an item is recorded that does actual work (draw, save, restore).\n2. Upon restore, the level was popped from the stack and the new\n top of the stack state entry would describe the state the remote was\n in.\n\nFullfill the 1. with maintaining one \"state currently committed to\nrecording\" flag. So any GraphicsContext state changes on top of that\nneeds to be sent when encountering item for actual work.\n\nThe 2. is unneeded, as after restore(), the recorded and local\nGraphicsContext state must match.\n\nRelated to 2.:\nRecord only \"changes done in current state stack entry\", in order to\nspeed up the state assign after restore(). Look at the changes\nto know which properties were modified, so then copy those properties\nback instead of the whole state object.\n\n* Source/WebCore/platform/graphics/GraphicsContextState.cpp:\n(WebCore::GraphicsContextState::copyPropertiesFrom):\n(WebCore::GraphicsContextState::propertiesEqual const):\n(WebCore::GraphicsContextState::copyLastChangesFrom): Deleted.\n* Source/WebCore/platform/graphics/GraphicsContextState.h:\n* Source/WebCore/platform/graphics/displaylists/DisplayListRecorder.cpp:\n(WebCore::DisplayList::Recorder::Recorder):\n(WebCore::DisplayList::Recorder::updateStateForSave):\n(WebCore::DisplayList::Recorder::updateStateForRestore):\n(WebCore::DisplayList::Recorder::computeStateChanges):\n(WebCore::DisplayList::Recorder::commitStateChanges):\n(WebCore::DisplayList::Recorder::updateStateForBeginTransparencyLayer):\n(WebCore::DisplayList::Recorder::pushStateForTransparencyLayer):\n(WebCore::DisplayList::Recorder::updateStateForEndTransparencyLayer):\n* Source/WebCore/platform/graphics/displaylists/DisplayListRecorder.h:\n(WebCore::DisplayList::Recorder::ContextState::cloneForTransparencyLayer const): Deleted.\n* Source/WebCore/platform/graphics/displaylists/DisplayListRecorderImpl.cpp:\n(WebCore::DisplayList::RecorderImpl::appendStateChangeItemIfNecessary):\n* Source/WebKit/WebProcess/GPU/graphics/RemoteGraphicsContextProxy.cpp:\n(WebKit::RemoteGraphicsContextProxy::appendStateChangeItemIfNecessary):\n(WebKit::RemoteGraphicsContextProxy::inlineStrokeStateIfBatchable):\n\nCanonical link: https://commits.webkit.org/319874@main", "email": "kkinnunen@apple.com", "hash": "65713772d8209dc7799659f689e84a216859c8dc", "subject": "DisplayList::Recorder has a copy of remote GraphicsContext state per level" }, "319875@main": { "author": "Philippe Normand", "avatar": "https://www.gravatar.com/avatar/eef27203750af3510263cc29af21a16e?d=identicon\u0026s=64", "cl": "319875@main", "clUrl": "https://commits.webkit.org/319875@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320836\n\nReviewed by Adrian Perez de Castro.\n\nMake the USE_SPIEL and USE_FLITE CMake options truly mutually exclusive.\n\n* Source/cmake/OptionsGTK.cmake:\n* Source/cmake/OptionsWPE.cmake:\n\nCanonical link: https://commits.webkit.org/319875@main", "email": "philn@igalia.com", "hash": "5bb22860bf931d1f35ed2b9df7f02a10f8468c4f", "subject": "[GTK][WPE?] Branch webkitglib/2.54 does not build with USE_SPIEL=ON" }, "319876@main": { "author": "Youenn Fablet", "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64", "cl": "319876@main", "clUrl": "https://commits.webkit.org/319876@main", "description": "rdar://177147013\n\nReviewed by Eric Carlson.\n\nThere is no use of updating csrcs, especially since this functionality is off by default.\nWe remove updating csrcs from RTCEncodedVideoFrame constructor for now.\nWe also remove dependencies and spatial index as they are not used either.\n\n* Source/WebCore/Modules/mediastream/libwebrtc/LibWebRTCRtpTransformableFrame.cpp:\n(WebCore::LibWebRTCRtpTransformableFrame::setOptions):\n\nOriginally-landed-as: 305413.999@safari-7624.5-branch (747321afe7db). rdar://185368602\nCanonical link: https://commits.webkit.org/319876@main", "email": "youenn@apple.com", "hash": "76f03b22155beaba28f6be01aa50775ad61c3564", "subject": "missing bounds check in RtpPacket::SetCsrcs for RTCEncodedVideoFrameMetadata.contributingSources" }, "319877@main": { "author": "Youenn Fablet", "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64", "cl": "319877@main", "clUrl": "https://commits.webkit.org/319877@main", "description": "rdar://177214855\n\nReviewed by Eric Carlson.\n\nObu::size and Packet::packet_size are signed 32-bit while OBU payload lengths are size_t.\nParseObus adds obu.payload.size() into obu.size, which wraps negative for an OBU \u003e= 2 GiB.\nPacketizeInternal then accepts the negative size as fitting into a single packet and computes a small packet_size,\nbut NextPacket allocates the RTP buffer from that truncated value and memcpy() the untruncated size_t payload, writing past the CopyOnWriteBuffer.\n\nThis is reachable via a RTCRtpScriptTransform creating a big AV1 data buffer.\n\nThe fix is to reject the frame in ParseObus when an OBU payload would overflow Obu::size, matching the existing handling for other malformed inputs.\n\nPatch written with Simon Lewis.\n\nTest: webrtc/script-transform-av1-large-obu-crash.html\n\n* LayoutTests/webrtc/script-transform-av1-large-obu-crash-expected.txt: Added.\n* LayoutTests/webrtc/script-transform-av1-large-obu-crash-worker.js: Added.\n(onrtctransform.event.pump):\n* LayoutTests/webrtc/script-transform-av1-large-obu-crash.html: Added.\n* Source/ThirdParty/libwebrtc/Source/webrtc/modules/rtp_rtcp/source/rtp_packetizer_av1.cc:\n\nOriginally-landed-as: 305413.1000@safari-7624.5-branch (ffec8ee666a1). rdar://185368538\nCanonical link: https://commits.webkit.org/319877@main", "email": "youenn@apple.com", "hash": "d7c8ef5a571492a339b90378a27432e4010f10c8", "subject": "int truncation of OBU size in RtpPacketizerAv1::ParseObus" }, "319878@main": { "author": "Youenn Fablet", "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64", "cl": "319878@main", "clUrl": "https://commits.webkit.org/319878@main", "description": "rdar://176978345\n\nReviewed by Jean-Yves Avenard.\n\ncopyVideoFrameBuffer used i420Frame-\u003ewidth() / i010Frame-\u003ewidth() as both the destination row pitch and the UV plane size.\nlibyuv's I420ToNV12 / I010ToP010 round chroma dimensions up: they emit ((width + 1) / 2) * 2 bytes per UV row and (height + 1) / 2 UV rows.\nFor odd width, libyuv writes one byte (I420) or two bytes (I010) past each UV row, with the final row's overrun landing past the end of the SharedMemory mapping.\nFor odd height, an entire UV row's worth of data (~width or 2*width bytes) lands past the mapping.\n\nRound chroma dimensions up to match libyuv.\nSharedVideoFrameInfo::fromVideoFrameBuffer now sizes the UV plane via computeStrideUV\u003cbyteType\u003e(frame) (sizeof(byteType) * (width rounded up to even)) and computeHeightUV(frame) ((height + 1) / 2).\ncopyVideoFrameBuffer applies the same rounding to the strideUV it hands to libyuv, so writer row pitch matches the receiver's m_bytesPerRowPlaneB and rows no longer overlap.\n\nCovered by added API tests.\n\n* Source/ThirdParty/libwebrtc/Configurations/libwebrtc.exp:\n* Source/ThirdParty/libwebrtc/Configurations/libwebrtc.xcconfig:\n* Source/ThirdParty/libwebrtc/Source/webrtc/webkit_sdk/WebKit/WebKitUtilities.mm:\n(webrtc::copyVideoFrameBuffer):\n* Source/WebCore/platform/cocoa/SharedVideoFrameInfo.mm:\n(WebCore::computeStrideY):\n(WebCore::computeStrideUV):\n(WebCore::computeWidthUV):\n(WebCore::computeHeightUV):\n(WebCore::SharedVideoFrameInfo::fromVideoFrameBuffer):\n* Tools/TestWebKitAPI/Configurations/Base.xcconfig:\n* Tools/TestWebKitAPI/Configurations/TestWebKitAPIBase.xcconfig:\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/SharedVideoFrame.mm:\n(TestWebKitAPI::TEST(SharedVideoFrame, PlaneAlphaSize)):\n(TestWebKitAPI::testSharedVideoFrameInfoRoundTrip):\n(TestWebKitAPI::TEST(SharedVideoFrame, OddWidthI420)):\n(TestWebKitAPI::TEST(SharedVideoFrame, OddHeightI420)):\n(TestWebKitAPI::TEST(SharedVideoFrame, OddWidthAndHeightI420)):\n(TestWebKitAPI::TEST(SharedVideoFrame, OddWidthI010)):\n(TestWebKitAPI::TEST(SharedVideoFrame, OddHeightI010)):\n(TestWebKitAPI::TEST(SharedVideoFrame, OddWidthAndHeightI010)):\n(TestWebKitAPI::TEST(WebCore, SharedVideoFramePlaneAlphaSize)): Deleted.\n\nOriginally-landed-as: 305413.997@safari-7624.5-branch (881cd542f818). rdar://185368288\nCanonical link: https://commits.webkit.org/319878@main", "email": "youenn@apple.com", "hash": "dfe0d84a7b23319d997143cd24b33f9f1a0d51d9", "subject": "[WebRTC] Out-of-bounds write in copyVideoFrameBuffer for odd-width I420/I010 frames" }, "319879@main": { "author": "Abrar Rahman Protyasha", "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64", "cl": "319879@main", "clUrl": "https://commits.webkit.org/319879@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322554\nrdar://185838964\n\nReviewed by Richard Robinson.\n\nThere are multiple conflicting configurations in which we would like\nmouse tracking to be active, and it is not feasible to alter certain\ngesture recognizer properties between .began and .ended. To work around\nthis, we teach WKAppKitGestureController to hold a set of recognizers\ninstead.\n\nThe bulk of the new state (and associated coordination) is to ensure a\ngesture handoff is correct if gesture recognition criteria changes such\nthat the currently active tracking recognizer gives way to a different\ntracking recognizer. As a drive-by, we also fix an existing issue where\nmouseUp events were not dispatched on every terminal state.\n\nThe delegate rules that referred to the single recognizer are now\ngeneralized over the set, and simultaneity is granted (like before)\nagainst the pan, magnification, rotation and double-click recognizers,\nand between the tracking recognizers themselves.\n\nCanonical link: https://commits.webkit.org/319879@main", "email": "a_protyasha@apple.com", "hash": "533420b4dcae5d17e8e5323e8444f7e1ba94232e", "subject": "[AppKit Gestures] Support mouse tracking with multiple gesture recognizers" }, "319880@main": { "author": "Patrick Griffis", "avatar": "https://www.gravatar.com/avatar/2233c3a857004b126158572af9fe36f7?d=identicon\u0026s=64", "cl": "319880@main", "clUrl": "https://commits.webkit.org/319880@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321724\n\nReviewed by Michael Catanzaro and Carlos Garcia Campos.\n\nAdds WebKitUpgradeToHTTPSPolicy and the upgrade-to-https-policy property,\nmapping onto HTTPSByDefaultMode, so embedders can opt navigations into\nupgrading HTTP to HTTPS. The enum values match the Cocoa port's\nWKWebpagePreferencesUpgradeToHTTPSPolicy.\n\nUpgradeWithUserMediatedFallback is not exposed which would allow a user\nto choose to allow fallbacks. That can come in a later addition with\na new signal if desired.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestWebKitPolicyClient.cpp\n\n* Source/WebCore/loader/DocumentLoader.cpp:\n(WebCore::DocumentLoader::loadMainResource):\n* Source/WebCore/platform/network/ResourceErrorBase.h:\n* Source/WebCore/platform/network/cocoa/ResourceErrorCocoa.mm:\n(WebCore::ResourceError::errorRecoveryMethod const):\n* Source/WebCore/platform/network/soup/ResourceError.h:\n(WebCore::ResourceError::errorRecoveryMethod const): Deleted.\n* Source/WebCore/platform/network/soup/ResourceErrorSoup.cpp:\n(WebCore::ResourceError::timeoutError):\n(WebCore::ResourceError::errorRecoveryMethod const):\n* Source/WebKit/Shared/API/APIError.cpp:\n(API::Error::webKitNetworkErrorDomain):\n* Source/WebKit/Shared/API/APIError.h:\n* Source/WebKit/UIProcess/API/glib/WebKitError.h.in:\n* Source/WebKit/UIProcess/API/glib/WebKitPrivate.cpp:\n(toWebKitError):\n(toWebCoreError):\n* Source/WebKit/UIProcess/API/glib/WebKitWebsitePolicies.cpp:\n(webkitWebsitePoliciesGetProperty):\n(webkitWebsitePoliciesSetUpgradeToHTTPSPolicy):\n(webkitWebsitePoliciesSetProperty):\n(webkit_website_policies_class_init):\n(webkit_website_policies_get_upgrade_to_https_policy):\n* Source/WebKit/UIProcess/API/glib/WebKitWebsitePolicies.h.in:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestWebKitPolicyClient.cpp:\n(setProxySettings):\n(testUpgradeToHTTPSPolicy):\n(policySchemeRequestCallback):\n(testUpgradeToHTTPSPolicySecureSchemes):\n(testHTTPSByDefaultSetting):\n(beforeAll):\n\nCanonical link: https://commits.webkit.org/319880@main", "email": "pgriffis@igalia.com", "hash": "b2678ccf7efb04a68ae229eff8edfc8c98ed402e", "subject": "[GLib] Add API for the HTTPS upgrade policy" }, "319881@main": { "author": "Youenn Fablet", "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64", "cl": "319881@main", "clUrl": "https://commits.webkit.org/319881@main", "description": "rdar://184648367\nhttps://bugs.webkit.org/show_bug.cgi?id=321534\n\nReviewed by Philippe Normand.\n\nm_drawingState needs to be protected by the lock before being used, we add a thread safety assertion for this.\nIn case generatePhoto is called after a generateFrame, the drawing state may not be empty.\nWe therefore invalidate it before taking the photo..\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/mac/TestExpectations:\n* Source/WebCore/platform/mock/MockRealtimeVideoSource.cpp:\n(WebCore::MockRealtimeVideoSource::generatePhoto):\n* Source/WebCore/platform/mock/MockRealtimeVideoSource.h:\n\nCanonical link: https://commits.webkit.org/319881@main", "email": "youenn@apple.com", "hash": "ca6fa1bdc5b24bf39eac9f01002230d556f2e8f3", "subject": "New Test(316184@main): [macOS Debug] fast/mediastream/applyConstraints-with-takePhoto.html is a flaky CRASH" }, "319882@main": { "author": "Ryosuke Niwa", "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64", "cl": "319882@main", "clUrl": "https://commits.webkit.org/319882@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322503\n\nReviewed by Alex Christensen.\n\nWhen a process commits a new top document, Page::setMainFrameURLAndOrigin()\nbroadcasts that document's complete DocumentSyncData so the other processes\nhosting frames of the page can answer questions about the top document --\nPage::mainFrameOrigin(), Page::mainFrameURL() and the rest -- without being able\nto see it.\n\nFor a main frame navigation that swaps processes, that broadcast can reach the UI\nprocess before commitProvisionalPage() has pointed legacyMainFrameProcess() at the\ncommitting process. WebPageProxy::broadcastAllDocumentSyncData() then rejects it as\ncoming from a process that does not host the top document. Nothing re-sends it, so\nthe update is lost for good and every other process hosting a frame of that page\ngoes on reporting the previous top document's state.\n\nProvisionalPageProxy::didReceiveMessage() already forwards both sync data\nbroadcasts to the WebPageProxy, so these messages are meant to be handled while a\nload is provisional; only the guard failed to account for it. Rather than dropping\na broadcast from the current provisional page, hold it on the ProvisionalPageProxy\n-- next to the existing m_deferredRemoteTransitionSite, which defers commit-time\nwork the same way -- and apply it in commitProvisionalPage() once\nswapToProvisionalPage() has switched legacyMainFrameProcess(). The guard itself is\nunchanged, so an unrelated subframe process still cannot touch top document state,\nand data belonging to a provisional load that never commits is discarded with the\nProvisionalPageProxy.\n\nSingle-property broadcasts are folded in only when that process has already sent a\nfull payload. Applying one over a default constructed DocumentSyncData would\npresent every other field as though the new document had reset it, which is worse\nthan dropping it.\n\nA process that had no page for this browsing context group before the navigation\npicks the state up from its remote page creation parameters instead, and the\nprocess that hosted the previous main frame gets it from\nLoadDidCommitInAnotherProcess(), which is why this needs a window navigated across\norigins more than once to show up.\n\nBlob URLs made this visible. They are partitioned by the top document's origin:\nBlobURLRegistry::registerURL() and WebLoaderStrategy::scheduleLoad() both key off\nDocument::topOrigin(), which for a subframe resolves to Page::mainFrameOrigin(),\nand BlobRegistryImpl::blobDataFromURL() rejects a lookup whose top origin does not\nmatch the one recorded at registration. With a stale top origin a subframe is both\ndenied a blob URL belonging to its own partition and able to reach one partitioned\nunder the previous top origin, which is what the partitioning exists to prevent.\n\nCovered by http/tests/local/blob/navigate-blob.html under site isolation, whose\nlast step reads a blob from the partition it was created in after the window has\nbeen navigated localhost:8443 -\u003e localhost:8000 -\u003e 127.0.0.1:8000.\n\n* LayoutTests/platform/ios-site-isolation/TestExpectations:\n* LayoutTests/platform/mac-site-isolation/TestExpectations:\n* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:\n(WebKit::ProvisionalPageProxy::setDeferredTopDocumentSyncData):\n(WebKit::ProvisionalPageProxy::updateDeferredTopDocumentSyncData):\n(WebKit::ProvisionalPageProxy::takeDeferredTopDocumentSyncData):\n* Source/WebKit/UIProcess/ProvisionalPageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::commitProvisionalPage):\n(WebKit::WebPageProxy::broadcastDocumentSyncData):\n(WebKit::WebPageProxy::broadcastAllDocumentSyncData):\n(WebKit::WebPageProxy::applyDeferredTopDocumentSyncDataFromCommittedProcess):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n\nCanonical link: https://commits.webkit.org/319882@main", "email": "rniwa@webkit.org", "hash": "713192fabebfdd2955aa596c262c33bfbf3d50be", "subject": "[Site Isolation] http/tests/local/blob/navigate-blob.html fails" }, "319883@main": { "author": "Cole Carley", "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64", "cl": "319883@main", "clUrl": "https://commits.webkit.org/319883@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322538\nrdar://185834375\n\nReviewed by Brent Fulgham.\n\nThis patch addresses some of the rough edges around the QuirkMatch API.\n\nI renamed some things:\nQuirkCondition -\u003e QuirkEnvironment\nhost() -\u003e topHost()\nregistrableDomain() -\u003e topRegistrableDomain()\ndomainWithPublicSuffix() -\u003e topDomainWithPublicSuffix()\ndocumentDomain() -\u003e documentRegistrableDomain()\n\nI introduced QuirkPatternList to combine the single and multiple pattern cases.\nNow, you can pass one or multiple patterns to domain(), documentDomainIs(),\nand hostIs(), which allowed me to remove domains(), documentDomainIsOneOf(), and\nhostIsOneOf().\n\nI removed the quirkBehaviors() function in favor of a new QuirkBehaviors class\nthat wraps a QuirkBitSet. It has a constructor that takes an initializer list,\nwhich cleans up the quirk table significantly.\n\nI also introduced a new QuirkMatch::when() to go along with the\nQuirkMatch::exceptWhen(). These now take any structure defined in the\nQuirkRefinement namespace. The refinements are stored in a RefinementSet which\nis either in QuirkMatch::m_refinements or QuirkMatch::m_exception.\n\nThis cleans up the QuirkMatch interface to look like this:\n QuirkMatch::anyTopLevelDomain(\"apple\"_s).when(pathStartsWith(\"/store\"_s))\n QuirkMatch::domain(\"wix.com\"_s).exceptWhen(pathStartsWith(\"/website/templates/\"_s))\n\nTests: Tools/TestWebKitAPI/Tests/WebCore/QuirkMatch.cpp\n Tools/TestWebKitAPI/Tests/WebCore/Quirks.cpp\n\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/page/QuirkMatch.cpp: Added.\n(WebCore::QuirkMatchContext::topRegistrableDomain const):\n(WebCore::QuirkMatchContext::topDomainWithoutPublicSuffix const):\n(WebCore::QuirkMatchContext::documentRegistrableDomain const):\n(WebCore::QuirkMatch::RefinementSet::matchesPathPattern const):\n(WebCore::QuirkMatch::RefinementSet::matches const):\n(WebCore::QuirkMatch::matchesSite const):\n(WebCore::QuirkMatch::matches const):\n(WebCore::Quirk::apply const):\n* Source/WebCore/page/QuirkMatch.h:\n(WebCore::QuirkMatchContext::QuirkMatchContext):\n(WebCore::QuirkPatternList::QuirkPatternList):\n(WebCore::QuirkPatternList::isEmpty const):\n(WebCore::QuirkPatternList::contains const):\n(WebCore::QuirkPatternList::containsMatching const):\n(WebCore::QuirkRefinement::pathContains):\n(WebCore::QuirkRefinement::pathStartsWith):\n(WebCore::QuirkRefinement::pathOrFragmentContains):\n(WebCore::QuirkRefinement::documentDomainIs):\n(WebCore::QuirkRefinement::hostIs):\n(WebCore::QuirkRefinement::embedded):\n(WebCore::QuirkRefinement::smallScreen):\n(WebCore::QuirkRefinement::tubularApp):\n(WebCore::QuirkRefinement::lensApp):\n(WebCore::QuirkMatch::domain):\n(WebCore::QuirkMatch::host):\n(WebCore::QuirkMatch::hostOrSubdomainOf):\n(WebCore::QuirkMatch::anyTopLevelDomain):\n(WebCore::QuirkMatch::anySite):\n(WebCore::QuirkMatch::when):\n(WebCore::QuirkMatch::exceptWhen):\n(WebCore::QuirkMatch::setPathPattern):\n(WebCore::QuirkMatch::applyRefinement):\n(WebCore::QuirkMatch::QuirkMatch):\n(WebCore::QuirkBehaviors::QuirkBehaviors):\n(WebCore::QuirkMatch::domains): Deleted.\n(WebCore::QuirkMatch::hostEndingWith): Deleted.\n(WebCore::QuirkMatch::pathContains): Deleted.\n(WebCore::QuirkMatch::pathStartsWith): Deleted.\n(WebCore::QuirkMatch::pathOrFragmentContains): Deleted.\n(WebCore::QuirkMatch::onlyIf): Deleted.\n(WebCore::QuirkMatch::documentDomainIs): Deleted.\n(WebCore::QuirkMatch::documentDomainIsOneOf): Deleted.\n(WebCore::QuirkMatch::hostIsOneOf): Deleted.\n(WebCore::QuirkMatch::onlyIfEmbedded): Deleted.\n(WebCore::QuirkMatch::matches const): Deleted.\n(WebCore::QuirkMatch::PatternList::PatternList): Deleted.\n(WebCore::QuirkMatch::PatternList::isEmpty const): Deleted.\n(WebCore::QuirkMatch::Refinements::isEmpty const): Deleted.\n(WebCore::QuirkMatch::setPathConstraint): Deleted.\n(WebCore::QuirkMatch::anyPattern const): Deleted.\n(WebCore::QuirkMatch::matchesSite const): Deleted.\n(WebCore::QuirkMatch::matchesRefinements const): Deleted.\n(WebCore::QuirkMatch::anyOf): Deleted.\n(WebCore::QuirkMatch::matchesPathConstraint const): Deleted.\n(WebCore::quirkBehaviors): Deleted.\n(WebCore::Quirk::apply const): Deleted.\n* Source/WebCore/page/Quirks.cpp:\n* Tools/TestWebKitAPI/Tests/WebCore/QuirkMatch.cpp:\n(TestWebKitAPI::matchesURL):\n(TestWebKitAPI::TEST(QuirkMatchTest, DomainsMatchesAnyPatternInTheList)):\n(TestWebKitAPI::TEST(QuirkMatchTest, HostOrSubdomainOfCoversShardedHosts)):\n(TestWebKitAPI::TEST(QuirkMatchTest, PathContainsMatchesAnywhereInThePath)):\n(TestWebKitAPI::TEST(QuirkMatchTest, PathStartsWithIsAnchored)):\n(TestWebKitAPI::TEST(QuirkMatchTest, PathOrFragmentContainsSearchesBoth)):\n(TestWebKitAPI::TEST(QuirkMatchTest, EnvironmentIsANDedWithTheSiteMatch)):\n(TestWebKitAPI::TEST(QuirkMatchTest, DocumentDomainIsMatchesEmbeddedDocuments)):\n(TestWebKitAPI::TEST(QuirkMatchTest, DocumentDomainIsAcceptsASinglePattern)):\n(TestWebKitAPI::TEST(QuirkMatchTest, AnySiteWithOnlyIfEmbeddedMatchesEmbedsAnywhereButNeverTheTopDocument)):\n(TestWebKitAPI::TEST(QuirkMatchTest, ExceptWhenCarvesOutPagesOfAMatchedSite)):\n(TestWebKitAPI::TEST(QuirkMatchTest, ExceptWhenCarvesOutHostsOfAMatchedSite)):\n(TestWebKitAPI::TEST(QuirkMatchTest, ExceptWhenCarvesOutASingleHost)):\n(TestWebKitAPI::TEST(QuirkMatchTest, HostIsNarrowsAMatchToOneHost)):\n(TestWebKitAPI::TEST(QuirkMatchTest, ExceptWhenTakesEveryRefinementIncludingEmbeddedDocuments)):\n(TestWebKitAPI::TEST(QuirkMatchTest, ExceptWhenAndTheMatchKeepSeparateRefinements)):\n(TestWebKitAPI::TEST(QuirkMatchTest, ExceptWhenRequiresEveryRefinementToExclude)):\n(TestWebKitAPI::TEST(QuirkMatchTest, RefinementsOfDifferentKindsAreAllANDed)):\n(TestWebKitAPI::TEST(QuirkMatchTest, EnvironmentStacksWithAPathRefinement)):\n(TestWebKitAPI::TEST(QuirkMatchTest, ContextDerivesValuesFromTheRightURL)):\n(TestWebKitAPI::TEST(QuirkMatchTest, ContextCachesDerivedValues)):\n(TestWebKitAPI::TEST(QuirkMatchTest, URLsWithoutAHostMatchNothing)):\n(TestWebKitAPI::TEST(QuirkMatchTest, HostEndingWithIgnoresLabelBoundaries)): Deleted.\n(TestWebKitAPI::TEST(QuirkMatchTest, OnlyTheLastPathConstraintIsKept)): Deleted.\n(TestWebKitAPI::TEST(QuirkMatchTest, ConditionIsANDedWithTheSiteMatch)): Deleted.\n(TestWebKitAPI::TEST(QuirkMatchTest, DocumentDomainIsOneOfMatchesEmbeddedDocuments)): Deleted.\n(TestWebKitAPI::TEST(QuirkMatchTest, DocumentDomainIsMatchesASingleEmbeddedDomain)): Deleted.\n(TestWebKitAPI::TEST(QuirkMatchTest, ExceptWhenWithNothingChainedIsANoOp)): Deleted.\n(TestWebKitAPI::TEST(QuirkMatchTest, ConditionStacksWithAPathRefinement)): Deleted.\n* Tools/TestWebKitAPI/Tests/WebCore/Quirks.cpp:\n(TestWebKitAPI::resolveQuirksForTopURL):\n\nCanonical link: https://commits.webkit.org/319883@main", "email": "ccarley2@apple.com", "hash": "aa73fff0f62234af069fdab28c58d154f275fe0a", "subject": "[Quirks] Clean up the QuirksMatch API" }, "319884@main": { "author": "Ben Nham", "avatar": "https://www.gravatar.com/avatar/dc0914eabf69047ee3397794c2d17bf7?d=identicon\u0026s=64", "cl": "319884@main", "clUrl": "https://commits.webkit.org/319884@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322535\nrdar://185830113\n\nReviewed by Megan Gardner, Alex Christensen, and Kiet Ho.\n\nWe currently send frame layout info on each rendering update from the WebProcess to the UIProcess\nwhen Site Isolation is enabled. This is unnecessary if there is only one process involved in\nrendering the page.\n\nTo make this cheaper, we cache whether the page has a remote frame. The cache is invalidated on\nevery FrameTree mutation, which should be relatively rare.\n\nTests: http/tests/site-isolation/only-broadcast-frame-geometry-if-remote-frame-exists.html\n\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::doAfterUpdateRendering):\n(WebCore::Page::setMainFrame):\n(WebCore::Page::frameTreeContainsRemoteFrame const):\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::updateIntersectionObservers):\n* Source/WebCore/page/FrameTree.cpp:\n(WebCore::FrameTree::didMutateTree):\n(WebCore::FrameTree::detachFromParent):\n(WebCore::FrameTree::appendChild):\n(WebCore::FrameTree::removeChild):\n(WebCore::FrameTree::replaceChild):\n* Source/WebCore/page/FrameTree.h:\n(WebCore::FrameTree::detachFromParent): Deleted.\n* Source/WebCore/page/Page.h:\n(WebCore::Page::didMutateFrameTree):\n* LayoutTests/http/tests/site-isolation/only-broadcast-frame-geometry-if-remote-frame-exists-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/only-broadcast-frame-geometry-if-remote-frame-exists.html: Added.\n\nCanonical link: https://commits.webkit.org/319884@main", "email": "nham@apple.com", "hash": "a8c31653e18a1227f2140465ef04dc6d2cd1edcc", "subject": "[Site Isolation] Avoid sending per-frame layout info if there are no remote frame processes" }, "319885@main": { "author": "Devin Rousso", "avatar": "https://www.gravatar.com/avatar/c9e757d973342c773f107a94b70cb9cd?d=identicon\u0026s=64", "cl": "319885@main", "clUrl": "https://commits.webkit.org/319885@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=131061\n\nReviewed by BJ Burg.\n\nThese migrations were added between 2019 and 2022, so any active Web Inspector developer has already opened a frontend that consumed them.\n\n* Source/WebInspectorUI/UserInterface/Base/Setting.js:\nUse the current defaults instead of migrating `group-by-dom-node` and `show-invalid-characters`.\n\n* Source/WebInspectorUI/UserInterface/Controllers/DOMDebuggerManager.js:\n(WI.DOMDebuggerManager):\n* Source/WebInspectorUI/UserInterface/Controllers/DebuggerManager.js:\n(WI.DebuggerManager):\nRemove migrations from legacy `localStorage` breakpoint data to the current `WI.ObjectStore` and structured breakpoint settings.\n\n* Source/WebInspectorUI/UserInterface/Views/GeneralStyleDetailsSidebarPanel.js:\n(WI.GeneralStyleDetailsSidebarPanel):\nUse the current default instead of migrating `class-list-container-toggled`.\n\nCanonical link: https://commits.webkit.org/319885@main", "email": "hi@devinrousso.com", "hash": "6c3d7d16c13d6f850c6a6bc1cdda27f0183ba64e", "subject": "Web Inspector: remove obsolete setting migrations" }, "319886@main": { "author": "Claudio Saavedra", "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64", "cl": "319886@main", "clUrl": "https://commits.webkit.org/319886@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322570\n\nReviewed by Alex Christensen.\n\nexpectedTypesNeedingDescriptions() was written when Cocoa was the only port\nrunning this test, so five of its entries get pushed where the types do not\nexist: CTFontDescriptorOptions and MachSendRight were unconditional, and\nNSObject\u003cNSSecureCoding\u003e, NSURLRequest and DDScannerResult are gated on\nHAVE(WK_SECURE_CODING_*), which is false off Cocoa. Gate all five on\nisMac || isIOSFamily, which covers the whole family including visionOS.\n\nWebCore::ContextMenuAction is the other way round. It was gated on isMac, but it\nis an unscoped enum reached from the cross-platform\nShared/WebContextMenuItemData.serialization.in, which is guarded by\nENABLE(CONTEXT_MENUS): on by default and off only on PLATFORM(IOS_FAMILY). Key it\non !isIOSFamily so it is expected wherever the type is serialized.\n\nFinally, WebCore::SystemImage has three subclasses and all of them are Cocoa-only,\nso off Cocoa its subclasses member is generated as Variant\u003c\u003e. splitTypeFromList()\nreturned the empty string for that, which the test reported as a type without a\ndescription. Return no types for an empty template argument list.\n\nThe expected set is unchanged on macOS, iOS and visionOS for every combination of\nthe two secure-coding predicates.\n\n* LayoutTests/ipc/serialized-type-info.html:\n\nCanonical link: https://commits.webkit.org/319886@main", "email": "csaavedra@igalia.com", "hash": "a6dae4543addea4b067213bcc54e60e62bdf665d", "subject": "ipc/serialized-type-info.html reports the wrong types off Cocoa" }, "319887@main": { "author": "Roberto Rodriguez", "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64", "cl": "319887@main", "clUrl": "https://commits.webkit.org/319887@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322228\nrdar://185460525\n\nReviewed by Kimmo Kinnunen\n\nContains upstream commits:\nef84704aca05 Vulkan: Refactor EGL image robust init paths\n0bdeec3fc0d3 Translator: Fix block vs struct name collision\n99ee9910c68b Translator: Don't use kUserDefinedNamePrefix directly\n922804e75179 Translator: Always declare named structs globally\n9cf92a040212 Vulkan: Refactor EGL image glGetTexImage paths\nf1cc6b2e2f5c IR: Make sure generated names are below 1024 chars\n1ca561b41b1c GL: workaround: pack large row lengths separately.\n4d3e5c7cb8d8 Tests: Fix Snorm3DTextureNonZeroOffset ASAN crash\nbaeac58b753d Translator: Fix type size cache for interface blocks\nabaf4b8ebeb1 Reorder member declaration in CommandQueue.\n7ba5affdb076 Translator: Make the type size cache be just that\n835b8bba9540 Remove GL_WEBGL_video_texture\n5147f32e43fe Vulkan: Skip xfb RecordAndDrawWithScissorTest\nab15aec81e49 Translator: avoid collisions in hashed names.\nc51b136c1feb GL: Refactor glEnable/glDisable usage into a helper.\nef303c05a54f Fix null descriptor crash for unbound storage images\n882dd090e404 GL: Refactor StateManagerGL into ContextStateGL [last/N]\n8b207281b671 Ignore most indexing in attribute and output bindings\na2cabe1f33db Manual roll Chromium from 356ded2aa088 to 404b845f953d (2450 revisions)\ne32be29b57ae GL: Remove testing on Mac\nb1b3bc376c59 WGPU: Implement glGenerateMipmap for 2D textures.\n86c20202bff2 Fix chromium roll script\ndc3864636271 Roll vulkan-deps from ef0d2fd00095 to e6f8ad39a426 (18 revisions)\n8b3018dd6823 Roll VK-GL-CTS from 68a4b00fbd81 to 71d11e5e5362 (10 revisions)\nc1a25085dd9e Vulkan: Skip xfb tests on S22/S24 Exynos devices\n311c502e88d9 GL: workaround: split PBO uploads to 2D textures' level 0.\n64db1c8add8e WGPU: Resurrect ANGLE_explicit_context.\nbaa6e7f54417 GL: Refactor StateManagerGL into ContextStateGL [2/N]\nca42923e461d Vulkan: Refactor EGL image glClearTex*ImageEXT paths\n5723e9d0ef45 GL: Track native GL state in ContextStateGL [1/N]\n3f7fbaeefc4c Add flag to toggle backward compatible contexts\n6b98fe1de125 Reland \"Add Wayland window surface support to the wgpu renderer\"\n0f0454f90b7b Vulkan: Fix depth- or stencil-only MSRTT rendering\n7a574a43ee94 Disable GL_WEBGL_video_texture and remove tests\n71959fdc46b4 Manual roll Chromium from 01c202833772 to 356ded2aa088 (213 revisions)\n764842b29945 Roll vulkan-deps from 4bcc3df3290a to ef0d2fd00095 (20 revisions)\n69e200e7178a Add unsafe buffer macro for trace event\n3a674cbcaefe IR: Fix name collision between global and local structs\nfc174c46a137 Revert \"Replace mFunctions-\u003eclear in clearRenderbuffer\"\n7ccab2ccb8ef Vulkan: Refactor EGL image glCopyImageSubDataEXT paths\n9785f60b3fe5 Fix RGB565 test failure due to format combination\nb2c5c7e8c582 Manual roll vulkan-deps from b21bf6e50934 to 4bcc3df3290a (8 revisions)\n8cf253b87f6f Revert \"Add Wayland window surface support to the wgpu renderer\"\n91e4d9de86f4 Fix the bug where copy_to_aosp_paths gets deleted\n10759433f070 Switch Android NDK syncing approach\ne25e8d8565f7 Capture/Replay: Fix GLES1 matrix setup\n1a6734b227ba Add Wayland window surface support to the wgpu renderer\n0ec59299eab9 Always sync the texture after robust init sync\nb2d2601e1499 [metal] Add trace events for BufferPool memory tracking\ndc4634c5d32a Vulkan: Refactor EGL image glCopy*Texture paths\n630cd843c4d3 HLSL: Fix name collision between globals and locals\nefe382b830f8 dEQP: Derive the display's native platform type from OSWindow\n4c9846573448 Add restrictions for ES2 TexSubImage for format\nfdb5d1f7570e DirectX9 Backend Removal: Remove shader model 3 code paths\n6a371d0e0df1 SPIR-V: RelaxedPrecision adjustments\n65ef3557354d Vulkan: Exclude CUBE_COMPATIBLE from MSRTSS query\n3255c6f4b131 Add tests for ES3 TexSubImage format-types\ndb450ffd19a9 Vulkan: Fix heap use-after-free in transform feedback emulation\nf8d85b15a059 Fix misaligned offset when merging client vertex attribs\n887a21ec97e4 Adjust ProgramUniform*EXT validation\nf728a633987c Fix ETCTextureTest.ETC2RGB8_CubeMapValidation\n9028f1bcd357 Refactor PatchParameteri validation\nabe56b10d574 Roll vulkan-deps from 08c031d6c089 to b21bf6e50934 (8 revisions)\n4e19b906e577 Roll SwiftShader from eb0bee078ef2 to a7c547b55474 (1 revision)\n920dd82d0293 Roll VK-GL-CTS from cd01da613a2e to 68a4b00fbd81 (4 revisions)\n88ffd0e1afa5 Roll Chromium from 215b9995626a to 01c202833772 (1487 revisions)\n5574b3f85e71 Use packed enums for framebuffer parameters\nd3728521450c OpenCL: Fixes to DescriptorSetReuse feature\n04e32f4479e2 DirectX9 Backend Removal: Remove shader translator code\nab4ff38a1096 D3D11: Remove attributeZeroRequiresZeroDivisor limitation\n50945218152c Vulkan: fix VkQueue creation with GLOBAL_PRIORITY_REALTIME_EXT\n93b1b76ce5ad PLS: Use internal API for setting default dimensions\nd1bfbd3e842f Refactor PolygonMode validation\n4e0fcf14911c Validate sub-image update type against allocated texture format\n97976ff82a55 Remove redundant functions from Context\n5f48075d7e2f Roll SwiftShader from 7868bf37d5b2 to eb0bee078ef2 (1 revision)\nff68f46b370c Fix VRAM leak in D3D11 cube map redefinition\n0147c06e5b1f Roll vulkan-deps from 8e7420f63043 to 08c031d6c089 (12 revisions)\n\nCanonical link: https://commits.webkit.org/319887@main", "email": "roberto_rodriguez2@apple.com", "hash": "296586e1c910cd26302bfe858c3617728baf497d", "subject": "Update ANGLE to 2026-07-13 (ef84704aca0595b7e3c5b165efc4de81bfaa83d5)" }, "319888@main": { "author": "Abrar Rahman Protyasha", "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64", "cl": "319888@main", "clUrl": "https://commits.webkit.org/319888@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322602\nrdar://185721724\n\nReviewed by Tim Horton.\n\nOur gesture recognizer driven magnification can drive two independent\nsubsystems at once: the pan GR synthesizes wheel events that produce\nscrolling, while the magnification GR drives a transient zoom. When\ndriven through NSResponder magnification, these are not supposed to\noverlap. Three separate problems (and how we solve them) fall out of that:\n\n1. Transient zoom compensates for growing the main frame clip layer by\n shifting the scrolled contents layer back, and prescribes a new\n position derived from the layer's current one. If there is a\n simultaneous scroll, then the scrolling tree rewrites that position\n every frame, too, and these mechanisms start fighting each other.\n We can instead let the scrolling tree continue being the only writer\n of that data if we derive an additive compensation rather than an\n absolute position in RLTDrawingAreaProxyMac::applyTransientZoomToLayer.\n This is a no-op for configurations where the scrolling tree does not\n actually touch the scrolled content layer position during a\n magnification gesture.\n\n2. scaledMagnificationOrigin() is derived from the magnification gesture's\n origin, so we can end up double accounting when the origin changes\n (due to a scroll). This made sense in the past since we did not have\n a configuration that allowed scrolls during a transient zoom, but now\n it only makes sense for NSResponder magnification. As such, we limit\n this behavior change behind the gesture input source.\n\n3. -sendWheelEventForGesture: computed the scrollability along each axis\n and handed that over to the directional scroll lock tracker. However,\n certain gestures can bypass this scrollability check (those that\n \"prefer unlocked scrolls\"). This produced unwanted sideways jitter -\u003e\n rubberband stretch rather than a scroll. We should instead let the\n directional scroll tracker do its internal updating with the provided\n scrollability values, and then enforce a hard clamp separately. I\n left a FIXME to try to incorporate this witihn the tracker itself,\n but this shape minimizes the risk (since we also use this for\n momentum calulcations).\n\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeDrawingAreaProxyMac.mm:\n(WebKit::additiveTransientPositionAnimation):\n(WebKit::RemoteLayerTreeDrawingAreaProxyMac::applyTransientZoomToLayer):\n* Source/WebKit/UIProcess/ViewGestureController.cpp:\n(WebKit::ViewGestureController::didEndGesture):\n(WebKit::ViewGestureController::scaledMagnificationOrigin):\n* Source/WebKit/UIProcess/ViewGestureController.h:\n* Source/WebKit/UIProcess/mac/AppKitGestures/WKAppKitGestureController.mm:\n(-[WKAppKitGestureController sendWheelEventForGesture:]):\n(-[WKAppKitGestureController magnificationGestureRecognized:]):\n* Source/WebKit/UIProcess/mac/ViewGestureControllerMac.mm:\n(WebKit::ViewGestureController::handleMagnificationGesture):\n* Source/WebKit/UIProcess/mac/WebViewImpl.h:\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::magnifyWithEvent):\n(WebKit::WebViewImpl::gestureEventWasNotHandledByWebCoreFromViewOnly):\n(WebKit::WebViewImpl::magnificationGestureEventWasNotHandledByWebCoreFromViewOnly):\n(WebKit::WebViewImpl::applyNativeMagnification):\n\nCanonical link: https://commits.webkit.org/319888@main", "email": "a_protyasha@apple.com", "hash": "153ae030bbdec163692f4b2826096674c01ed360", "subject": "[AppKit Gestures] Magnification can snap the scroll position unexpectedly" }, "319889@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "319889@main", "clUrl": "https://commits.webkit.org/319889@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322475\nrdar://185763143\n\nReviewed by Yijia Huang.\n\nWhen reaching to termination, there is no work. Then waking up helper\nthreads do not offer anything since it is waiting until (1) there is a\nwork, (2) bonus visitor task exists, or (3) m_parallelMarkersShouldExit.\nThis patch removes these unnecessary wakeup.\n\n* Source/JavaScriptCore/heap/SlotVisitor.cpp:\n(JSC::SlotVisitor::drainFromShared):\n(JSC::SlotVisitor::drainInParallelPassively):\n(JSC::SlotVisitor::waitForTermination):\n* Source/JavaScriptCore/heap/SlotVisitor.h:\n\nCanonical link: https://commits.webkit.org/319889@main", "email": "ysuzuki@apple.com", "hash": "f733e45e7f50ad876bd768dfe35ea536ab7045c3", "subject": "[JSC] Do not broadcast termination from the thread that is about to stop draining" }, "319890@main": { "author": "Cole Carley", "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64", "cl": "319890@main", "clUrl": "https://commits.webkit.org/319890@main", "description": "rdar://185837295\n\nReviewed by Brent Fulgham.\n\nQuirks::isDomain and Quirks::isEmbedDomain have no place in the Quirks\nimplementation after the introduction of QuirkMatch. I removed them and\nconverted their callers to named site specific quirks. This introduced\ntwo new quirks: NeedsLimitedMatroskaSupportQuirk and\nNeedsSupportsProgressMonitoringQuirk. I also needed to add Reddit to\nQuirkSites to remove one of the callers.\n\n* Source/WebCore/page/Quirks.cpp:\n* Source/WebCore/page/Quirks.h:\n* Source/WebCore/page/QuirksData.h:\n\nCanonical link: https://commits.webkit.org/319890@main", "email": "ccarley2@apple.com", "hash": "46357e1e9c0005ef59cf21f008a40a59bfca156b", "subject": "[Quirks] Remove isDomain and isEmbedDomain" }, "319891@main": { "author": "Kimmo Kinnunen", "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64", "cl": "319891@main", "clUrl": "https://commits.webkit.org/319891@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317286\nrdar://178005812\n\nReviewed by Dan Glastonbury.\n\nFinite loop classification relies on the property that ++i or --i eventually lands\nto a value that makes the condition evaluate to false. This is not true for cases\n uint i: i \u003e= 0u, i \u003c= 4294967295u\n int i: i \u003c -2147483646, i \u003e= 2147483647\n\nClassify these as infinite by checking the constant for \u003c=, \u003e=.\n\n* Source/ThirdParty/ANGLE/src/compiler/translator/tree_ops/msl/EnsureLoopForwardProgress.cpp:\n* Source/ThirdParty/ANGLE/src/tests/gl_tests/GLSLOutputTest.cpp:\n\nOriginally-landed-as: 305413.1008@safari-7624.5-branch (af3089d4dc75). rdar://185367969\nCanonical link: https://commits.webkit.org/319891@main", "email": "kkinnunen@apple.com", "hash": "fd1caf2e06751dcc918767f82a7ba876ec4dfb80", "subject": "ANGLE: Metal: EnsureLoopForwardProgress infinite loops with unsigned tautology compare classified as finite" }, "319892@main": { "author": "Claudio Saavedra", "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64", "cl": "319892@main", "clUrl": "https://commits.webkit.org/319892@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=315569\n\nReviewed by Patrick Griffis.\n\nXRDeviceIdentifier is an ObjectIdentifier, so it belongs in the list that feeds\nIPC.objectIdentifiers. Only ports that enable WEBXR compile XRDeviceInfo, which\nis why ipc/serialized-type-info.html reports it as lacking IPC metadata on GLib\nand visionOS but not on macOS.\n\n* Source/WebKit/Scripts/webkit/messages.py:\n(serialized_identifiers):\n* Source/WebKit/Scripts/webkit/tests/MessageArgumentDescriptions.cpp:\n\nCanonical link: https://commits.webkit.org/319892@main", "email": "csaavedra@igalia.com", "hash": "432bc10c950699e0b10f36c3390cff021047a2e6", "subject": "[GLIB] Add XRDeviceIdentifier to serialized_identifiers()" }, "319893@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "319893@main", "clUrl": "https://commits.webkit.org/319893@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321907\nrdar://185080341\n\nReviewed by Sam Weinig.\n\nSVGAngleValue::setValueAsString() hand-rolled its parsing on top of\nSVGParserUtilities: parseNumber() followed by a parseAngleType() helper that\nswitched on the buffer's remaining length and compared characters directly.\nReplace it with the shared CSS property-parser machinery, the way SVGLengthValue\nwas modernized in 298731@main: tokenize with CSSTokenizer under a\nSVGAttributeMode parser context, then consume via\nMetaConsumer\u003cCSS::NumberRaw\u003c\u003e, CSS::AngleRaw\u003c\u003e\u003e.\n\nMetaConsumer avoids allocating a throwaway CSSPrimitiveValue, and the Raw types\nhave no FunctionToken consumer, so calc() is rejected structurally rather than\nconsumed and then discarded (FIXME to support it, matching SVGLengthValue and\nevery other engine). CSS::NumberRaw\u003c\u003e must come first: the unroller tries types\nin order, and CSS::AngleRaw\u003c\u003e would otherwise take a unitless value as degrees\ninstead of leaving it SVG_ANGLETYPE_UNSPECIFIED.\n\nWhitespace is handled on the token range, not the string: consumeWhitespace()\nfor the leading run, and each consumer already ends with\nconsumeIncludingWhitespace() so the trailing run is gone before atEnd() is\nchecked. The tokenizer's whitespace set is exactly isASCIIWhitespace()'s, so\nthis accepts what a StringView::trim() would have without the copy.\n\nAn FLT_MAX check remains because unresolved CSS numeric types always store a\ndouble regardless of their ResolvedValueType (see CSSPrimitiveNumericRaw.h) and\nCSS::All neither rejects nor clamps; it keeps the old rejection of values like\n\"1e39deg\" that the float member cannot represent. Past DBL_MAX the tokenizer\nyields an infinity that the consumers reject on their own.\n\nSince the \u003cangle\u003e in SVG attributes is a CSS \u003cangle\u003e, its unit is now matched\nASCII case-insensitively, so \"5Rad\" and \"5graD\" parse instead of throwing, in\nline with SVG length attributes. Sharing the tokenizer likewise means comments\nand identifier escapes are accepted, as they already are for lengths.\n\nPrecision improves as a side effect: the old parser accumulated in float and\nmultiplied by a float-narrowed power of ten, so \"5e-2deg\" landed on 0.049999997.\nIt now computes 0.05 as a double and narrows once.\n\nSVGAngle.html asserted that \"5graD\" and \"5Rad\" throw; those are replaced by a\nblock covering all four units in mixed case, where \"5TurN\" reports\nSVG_ANGLETYPE_UNKNOWN because SVGAngle.idl exposes no TURN constant and\nunitType() clamps above GRAD per specification, while valueAsString still\nround-trips \"5turn\". Added coverage for the float and double boundaries in both\ndirections, and a calc() block written against the behavior we want, so the\nFIXME is tracked by the baseline rather than only by a comment.\n\n* LayoutTests/svg/dom/SVGAngle-expected.txt: Rebaselined.\n* LayoutTests/svg/dom/SVGAngle.html: Add test cases for case-insensitive units,\ncalc(), and the float/double range boundaries.\n* Source/WebCore/svg/SVGAngleValue.cpp:\n(WebCore::cssAngleUnitToSVGAngleType):\n(WebCore::SVGAngleValue::setValueAsString):\n(WebCore::parseAngleType): Deleted.\n\nCanonical link: https://commits.webkit.org/319893@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "0ca045f5e7c02f2ed6935cb5131f40643cc5ee3f", "subject": "Adopt CSS parser machinery for parsing SVGAngleValue" }, "319894@main": { "author": "Charlie Wolfe", "avatar": "https://www.gravatar.com/avatar/857b3b5ff3394c31fa2689310a93dbab?d=identicon\u0026s=64", "cl": "319894@main", "clUrl": "https://commits.webkit.org/319894@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322542\nrdar://185838347\n\nReviewed by Per Arne Vollan.\n\nAdd @_spi(Private) invalidate(reason:) to NetworkingProcess, WebContentProcess, and RenderingProcess,\nplus -invalidateWithReason: ObjC shims on the __BE*Process classes. When a reason is supplied, the\nextension process is terminated with reportType .crashLog and an OS_REASON_WEBKIT exception domain\nso abnormal terminations are attributable in stability reports; the plain invalidate() path is\nunchanged and still leaves no crash log.\n\n* Source/WebKit/Platform/spi/Cocoa/ExtensionKitSPI.h:\n* Source/WebKit/UIProcess/AuxiliaryProcessProxy.cpp:\n(WebKit::AuxiliaryProcessProxy::terminate):\n* Source/WebKit/UIProcess/Launcher/ProcessLauncher.h:\n* Source/WebKit/UIProcess/Launcher/cocoa/ExtensionProcess.h:\n* Source/WebKit/UIProcess/Launcher/cocoa/ExtensionProcess.mm:\n(WebKit::ExtensionProcess::invalidate const):\n* Source/WebKit/UIProcess/Launcher/cocoa/ProcessLauncherCocoa.mm:\n(WebKit::ProcessLauncher::terminateProcess):\n* Source/WebKit/UIProcess/Launcher/glib/ProcessLauncherGLib.cpp:\n(WebKit::ProcessLauncher::terminateProcess):\n* Source/WebKit/UIProcess/Launcher/playstation/ProcessLauncherPlayStation.cpp:\n(WebKit::ProcessLauncher::terminateProcess):\n* Source/WebKit/UIProcess/Launcher/win/ProcessLauncherWin.cpp:\n(WebKit::ProcessLauncher::terminateProcess):\n\nCanonical link: https://commits.webkit.org/319894@main", "email": "charliew@apple.com", "hash": "9790ba0df4c6634c76ca43a013a3474644063508", "subject": "Generate a crash log when terminating auxiliary processes due to an IPC validation failure" }, "319895@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "319895@main", "clUrl": "https://commits.webkit.org/319895@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322597\n\u003crdar://problem/185895981\u003e\n\nReviewed by Sam Weinig and Antti Koivisto.\n\nRenderBlockFlow::layoutSimpleBlockContentInInline lays a block level box on a line out again where it already\nis. It read the position back with RenderBox::logicalTop(), which is on the box's own block axis, and handed it\nto layoutBlockChildFromInlineLayout, which writes it on the container's. Orthogonal writing modes make those\ntwo different axes, so the box landed at its inline offset along the container's block axis: 55px into a\ncontainer whose only line before it takes 20px, sitting on that line rather than after it.\n\nRead and write the position through the container's own accessors, which is what put the box there in the first\nplace.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-writing-modes/orthogonal-block-in-inline-block-axis-position-001-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-writing-modes/orthogonal-block-in-inline-block-axis-position-001.html: Added.\n* Source/WebCore/rendering/RenderBlockFlow.cpp:\n(WebCore::RenderBlockFlow::layoutSimpleBlockContentInInline):\n\nCanonical link: https://commits.webkit.org/319895@main", "email": "zalan@apple.com", "hash": "4102848ed39add0d8fef73db2f3f781773a8ab93", "subject": "[block-in-inline] An orthogonal block level box in an inline box is misplaced" }, "319896@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "319896@main", "clUrl": "https://commits.webkit.org/319896@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318209\nrdar://181010844\n\nReviewed by Kimmo Kinnunen.\n\nIn lowerAndUpperBound(component1, component2, component3) the second\nbranch (component1 \u003e component3) had a duplicated condition. Line 223\nused the \"component2 above both neighbors\" test\n(component1 \u003c component2 \u0026\u0026 component2 \u003e component3) but returned the\nmiddle-case interval { component3, component1 }, and a later branch\nrepeated that identical condition with the correct above-both return\nvalue { component1, component2 }, leaving it permanently dead.\n\nAs a result, when component2 was above both neighbors it received the\nmiddle-case bounds, and the genuine middle case\n(component3 \u003c= component2 \u003c= component1) fell through every condition to\nthe degenerate { component2, component2 } default, collapsing the noise\ninterval to zero width for those pixels.\n\nGive the first branch the middle-case condition\n(component1 \u003e= component2 \u0026\u0026 component2 \u003e= component3) so all three\norderings mirror the component1 \u003c= component3 branch:\n\n - middle -\u003e { component3, component1 }\n - below both -\u003e { component2, component3 }\n - above both -\u003e { component1, component2 }\n\n* Source/WebCore/html/CanvasNoiseInjection.cpp:\n(WebCore::lowerAndUpperBound):\n\nCanonical link: https://commits.webkit.org/319896@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "5f231156f34b99b4d1fae961ba492960414b04b4", "subject": "CanvasNoiseInjection lowerAndUpperBound mishandles neighbor ordering when component1 \u003e component3" }, "319897@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "319897@main", "clUrl": "https://commits.webkit.org/319897@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322595\n\u003crdar://problem/185890940\u003e\n\nReviewed by Antti Koivisto.\n\nThe line asks the render tree what a block level box on it costs along the line's inline axis, and got the\nbox's own inline size back. When the box's writing mode is orthogonal to the line's, that is the wrong axis.\nRead the box's intrinsic block size for that case, which is what block layout reads for an orthogonal block\nchild in the block level branch of RenderBlockFlow::computeInlinePreferredLogicalWidths.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-writing-modes/orthogonal-block-in-inline-inline-size-001-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-writing-modes/orthogonal-block-in-inline-inline-size-001.html: Added.\n* Source/WebCore/layout/integration/LayoutIntegrationFormattingContextLayout.cpp:\n(WebCore::LayoutIntegration::formattingContextRootLogicalWidthForType):\n\nCanonical link: https://commits.webkit.org/319897@main", "email": "zalan@apple.com", "hash": "613b3c7720c2e6c88b661def85af22d987313b74", "subject": "[block-in-inline] An orthogonal block level box in an inline box makes its container as wide as the box instead of as its content" }, "319898@main": { "author": "Brian Weinstein", "avatar": "https://www.gravatar.com/avatar/2892a9aaa68f537ee65c6f95ef0768a6?d=identicon\u0026s=64", "cl": "319898@main", "clUrl": "https://commits.webkit.org/319898@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322306\nrdar://185462954\n\nReviewed by Youenn Fablet.\n\nThis PR allows custom extension schemes to be found as clients of the service worker if they are\nfrom the same scheme/host.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIOffscreen.mm\n\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::updateServiceWorkerClientData): Don't return early if the scheme is in the list\nof schemes allowed to be service worker clients.\n* Source/WebCore/loader/DocumentLoader.cpp:\n(WebCore::DocumentLoader::matchRegistration): Ditto.\n(WebCore::DocumentLoader::commitData): Ditto.\n(WebCore::DocumentLoader::startLoadingMainResource): Main resources served by a URL scheme handler never create\na NetworkResourceLoader, so the fetch-interception path that normally assigns a controlling service worker\nregistration cannot run for them. Make sure that we register these.\n* Source/WebCore/platform/LegacySchemeRegistry.cpp:\n(WebCore::WTF_REQUIRES_LOCK):\n(WebCore::LegacySchemeRegistry::registerURLSchemeAsAllowingServiceWorkerClients):\n(WebCore::LegacySchemeRegistry::shouldTreatURLSchemeAsAllowingServiceWorkerClients):\n(WebCore::schemesAllowingServiceWorkerClients):\n* Source/WebCore/platform/LegacySchemeRegistry.h:\n* Source/WebCore/workers/service/server/SWServerWorker.cpp:\n(WebCore::SWServerWorker::origin const): Use the non-strict variant to match how clients are keyed.\nSecurityOriginData::fromURL() consults LegacySchemeRegistry::schemeIsHandledBySchemeHandler(), which is only\npopulated in a web content process, so it would yield an opaque origin here for any non-special scheme served\nby a URL scheme handler. This matches the code in validateClientOrigin.\ncould stall due to the completion handler not being called. This could have been a standalone PR, but the bug\nwas only brought forward from the rest of this change.\n* Source/WebKit/UIProcess/Extensions/WebExtensionMatchPattern.cpp:\n(WebKit::WebExtensionMatchPattern::registerCustomURLScheme): Add the custom scheme to the schemes for service\nworker registration.\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIOffscreen.mm:\n(TestWebKitAPI::TEST_F(WKWebExtensionAPIOffscreen, OffscreenDocumentVisibleToClientsMatchAll)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPIOffscreen, OffscreenDocumentRemovedFromClientsMatchAllAfterClose)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPIOffscreen, ClientsMatchAllUsedAsHasDocumentGuard)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPIOffscreen, DocumentContentLoads)):\n(TestWebKitAPI::TEST_F(WKWebExtensionAPIOffscreen, TabAndOffscreenDocumentVisibleToClientsMatchAll)):\n* Source/WebCore/workers/service/server/SWServer.cpp:\n(WebCore::SWServer::matchAll):\n\nCanonical link: https://commits.webkit.org/319898@main", "email": "bweinstein@apple.com", "hash": "86ddc7a7a759e3741432f7dac824120cb7de5e58", "subject": "Extension background service worker can't find other extension pages using clients.matchAll" }, "319899@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "319899@main", "clUrl": "https://commits.webkit.org/319899@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322539\n\u003crdar://problem/185835450\u003e\n\nReviewed by Antti Koivisto.\n\nA block level box gets a line of its own, and that line box is as wide as the container's content box.\nInk overflow already leaves that rect out and lets the box contribute its own, since the box is what the line\nholds. Let's apply it to scrollable overflow too.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-relative-positioned-block-in-inline-002-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-relative-positioned-block-in-inline-002.html: Added.\n* Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.cpp:\n(WebCore::LayoutIntegration::InlineContentBuilder::adjustDisplayLines const):\n* LayoutTests/fast/repaint/transform-absolute-in-positioned-container-expected.txt:\n* LayoutTests/platform/glib/fast/encoding/utf-16-big-endian-expected.txt:\n* LayoutTests/platform/glib/fast/encoding/utf-16-little-endian-expected.txt:\n* LayoutTests/platform/glib/fast/repaint/transform-absolute-in-positioned-container-expected.txt:\n* LayoutTests/platform/mac/fast/encoding/utf-16-big-endian-expected.txt:\n* LayoutTests/platform/mac/fast/encoding/utf-16-little-endian-expected.txt:\n\nCanonical link: https://commits.webkit.org/319899@main", "email": "zalan@apple.com", "hash": "00f2675ea704e8fe868d2d6b9de581bdca82d709", "subject": "[block-in-inline] A relatively positioned block level box on a line reports scrollable overflow as wide as the line" }, "319900@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "319900@main", "clUrl": "https://commits.webkit.org/319900@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322601\nrdar://185904357\n\nReviewed by Taher Ali.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/3ba06522cce6462b7042de96a4dd0bcb67d02616\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/resources/resource-files.json:\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/svg/as-image/sprite-sheet-fractional-size-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/as-image/sprite-sheet-fractional-size-helper.svg: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/as-image/sprite-sheet-fractional-size-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/as-image/sprite-sheet-fractional-size.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/as-image/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/svg/embedded/svg-zero-size-crash.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/embedded/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/svg/extensibility/foreignObject/foreign-object-scale-scroll.html:\n* LayoutTests/imported/w3c/web-platform-tests/svg/geometry/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/svg/idlharness.window.js:\n(idlArray.const.element.of.SVG_ELEMENT_TAGS.catch):\n(idlArray.const.element.of.elements.catch): Deleted.\n* LayoutTests/imported/w3c/web-platform-tests/svg/linking/reftests/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/svg/painting/inline-svg-resize-viewport-dependent-mask.html:\n* LayoutTests/imported/w3c/web-platform-tests/svg/painting/reftests/non-scaling-stroke-009-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/painting/reftests/non-scaling-stroke-009.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/painting/reftests/non-scaling-stroke-010-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/painting/reftests/non-scaling-stroke-010.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/painting/reftests/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/svg/path/error-handling/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/svg/resources/svg-tags.js: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/resources/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/svg/struct/reftests/reference/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/svg/struct/reftests/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/svg/struct/scripted/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/svg/styling/svg-element-attributeStyleMap-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/styling/svg-element-attributeStyleMap.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/styling/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/crashtests/abspos-pseudo.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/text/crashtests/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/w3c-import.log:\n\nCanonical link: https://commits.webkit.org/319900@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "aaa9ed323ecce4a39a817c79cdb0609ae60bc71c", "subject": "Resync `svg` from WPT Upstream" }, "319901@main": { "author": "Richard Robinson", "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64", "cl": "319901@main", "clUrl": "https://commits.webkit.org/319901@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322377\nrdar://185660724\n\nReviewed by Adrian Taylor.\n\nCreate an abstraction to allow `WTF::CompletionHandler` types to be properly constructed in Swift.\nThis is done by designing a pair of Swift protocols which `WTF::CompletionHandler` specializations\nmay conform to: `CxxCompletionHandler` for specializations taking a single argument, and\n`CxxVoidCompletionHandler` for those taking none. Both refine `CxxCompletionHandlerBase`, which\nprovides the initializers.\n\nPreviously, Swift created these by relying on `WTF::CompletionHandler`'s Objective-C block\nconstructor, which was only exposed under `#ifdef __swift__`. That is now deleted unconditionally,\nbecause implicitly bridging a Swift closure to a block gave no control over the closure's lifetime\nand forced every callsite to spell out a `WTF::ThreadLikeAssertion` by hand. It was also not cross-platform.\nInstead, a Swift closure is now reduced to the C ABI it fundamentally is (a function pointer, an opaque\ncontext, and a destructor for that context) and `WTF::CompletionHandler` gains a constructor accepting\nexactly that. The context is owned by a `std::unique_ptr\u003cvoid, SwiftClosureDestroy\u003e` captured by the\nresulting handler, so it is destroyed together with the handler.\n\nOn the Swift side, the closure is stored in a class box passed across as a retained opaque pointer.\nThe box is deliberately split into a generic `SwiftClosureBox\u003cArgument\u003e` and a non-generic\n`ErasedSwiftClosureBox` base, since a C function pointer cannot be formed from a closure that\ncaptures generic parameters.\n\nNote that because WTF does not yet support Swift, `WTFCompletionHandler+Extras.swift` must have a\ncopy in TestWTFLibrary for now.\n\nThe `callAsFunction` protocol requirement is witnessed by the imported C++ `operator()`. This is what\nmakes the compiler check that the `Argument` associated type matches the parameter type C++ actually\npasses, so a mismatched conformance fails to compile rather than silently reinterpreting memory.\n\nThis abstraction currently does not support completion handlers whose parameters are noncopyable\ntypes; this will be done in a subsequent change.\n\nIt also only supports completion handlers whose parameter list is of arity-0 or arity-1, and whose\nreturn type is void; supporting arbitrary arity-n parameter lists is not currently prioritized due\nto its infrequent use. Both restrictions are enforced at compile time by `static_assert`.\n\nTests: Tools/TestWebKitAPI/Tests/WTF/cocoa/SwiftCxxInteropTests.swift\n Tools/TestWebKitAPI/Tests/WebKit/WebPage/JSHandleTests.swift\n Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebPageTests.swift\n\n* Source/WTF/wtf/CompletionHandler.h:\n(WTF::CompletionHandler\u003cOut):\n(WTF::adopt):\n(WTF::CompletionHandlerWithFinalizer\u003cOut):\n(WTF::Detail::CallableWrapper\u003cCompletionHandler\u003cOut):\n\nAdd the `SwiftClosureInvoke` and `SwiftClosureDestroy` aliases describing the C ABI a Swift closure\nreduces to, along with the constructor accepting them. Add an `Argument` alias for the Swift\nprotocols to key off of, and `VoidCompletionHandler` / `BoolCompletionHandler` aliases for the two\nspecializations common enough to conform out of the box.\n\nAnnotate the pointers in this header for nullability, which is required now that the Swift closure\ntypedefs introduce nullability into it.\n\n* Source/WTF/wtf/OptionSet.h:\n\nUse a different spelling for the friendship to ConstexprOptionSet to workaround a compiler bug (rdar://185869726).\n\n* Source/WTF/wtf/module.modulemap:\n* Source/WebKit/CMakeLists.txt:\n* Source/WebKit/Shared/WTFCompletionHandler+Extras.swift: Added.\n(CxxCompletionHandlerBase.init(_:)):\n(ErasedSwiftClosureBox.call(with:)):\n(SwiftClosureBox.init(_:)):\n(SwiftClosureBox.call(with:)):\n(CxxCompletionHandler.callAsFunction(_:)):\n(CxxVoidCompletionHandler.callAsFunction):\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n\n* Source/WebKit/UIProcess/WebPageProxy.swift:\n(WebKit.WebPageProxy.selectWithGesture(at:type:state:isInteractingWithFocusedElement:)): Deleted.\n(WebKit.WebPageProxy.selectPosition(at:isInteractingWithFocusedElement:)): Deleted.\n(WebKit.WebPageProxy.selectText(at:by:isInteractingWithFocusedElement:)): Deleted.\n(WebKit.WebPageProxy.updateSelection(withExtentPoint:by:isInteractingWithFocusedElement:source:)): Deleted.\n(WebKit.selectPosition(at:isInteractingWithFocusedElement:)): Deleted.\n* Source/WebKit/UIProcess/mac/WKTextSelectionController.swift:\n(WKTextSelectionController.reextendSelectionForAutoscrollIfNeeded):\n(WKTextSelectionController.moveInsertionCursor(to:placeAtWordBoundary:)):\n(WKTextSelectionController.beginRangeSelection(at:with:)):\n(WKTextSelectionController.continueRangeSelection(at:)):\n\nSimplify the existing call-sites. These hand-written `async` wrappers existed only to hide the\nboilerplate the block constructor demanded; with the continuation initializer, the callers can now\nwrap the C++ functions directly and the wrappers earn their keep no longer.\n\n* Tools/TestWebKitAPI/Configurations/TestWTFLibrary.xcconfig:\n* Tools/TestWebKitAPI/Helpers/WTFCompletionHandler+Extras.swift: Added.\n(CxxCompletionHandlerBase.init(_:)):\n(ErasedSwiftClosureBox.call(with:)):\n(SwiftClosureBox.init(_:)):\n(SwiftClosureBox.call(with:)):\n(CxxCompletionHandler.callAsFunction(_:)):\n(CxxVoidCompletionHandler.callAsFunction):\n* Tools/TestWebKitAPI/TestBundle/TestWebKitAPIBundle-Bridging-Header.h:\n* Tools/TestWebKitAPI/TestWTFLibrary/TestWTFLibrary.swift: Added.\n* Tools/TestWebKitAPI/TestWTFLibrary/module.modulemap: Added.\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Helpers/cocoa/HTTPServer.swift:\n(HTTPServer.run(_:)):\n* Tools/TestWebKitAPI/TestWTFLibrary/SwiftCxxInteropTestbed.h: Renamed from Tools/TestWebKitAPI/Tests/WTF/cocoa/SwiftCxxInteropTestbed.h.\n* Tools/TestWebKitAPI/TestWTFLibrary/SwiftCxxInteropTestbed.cpp: Renamed from Tools/TestWebKitAPI/Tests/WTF/cocoa/SwiftCxxInteropTestbed.cpp.\n(SwiftCxxInteropTestbed::callIntBoolFunction):\n(SwiftCxxInteropTestbed::callIntCompletionHandler):\n(SwiftCxxInteropTestbed::callVoidCompletionHandler):\n(SwiftCxxInteropTestbed::storedIntCompletionHandler):\n(SwiftCxxInteropTestbed::storeIntCompletionHandler):\n(SwiftCxxInteropTestbed::invokeStoredIntCompletionHandler):\n(SwiftCxxInteropTestbed::resetStoredIntCompletionHandler):\n* Tools/TestWebKitAPI/Tests/WTF/cocoa/SwiftCxxInteropTests.swift:\n(Recorder.values):\n(SwiftCxxInteropTests.completionHandlerReceivesItsArgument):\n(SwiftCxxInteropTests.wtfCompletionHandlerCanBeInvokedFromSwift):\n(SwiftCxxInteropTests.completionHandlerPreservesCapturedState):\n(SwiftCxxInteropTests.voidCompletionHandlerCanBeInvokedFromSwift):\n(SwiftCxxInteropTests.voidCompletionHandlerWorksWithAContinuation):\n(SwiftCxxInteropTests.separateHandlersDoNotShareAContext):\n(SwiftCxxInteropTests.contextIsReleasedAfterTheHandlerIsCalled):\n(SwiftCxxInteropTests.contextSurvivesUntilTheHandlerIsInvokedLater):\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/JSHandleTests.swift:\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/WebPageTests.swift:\n\nAdd tests\n* Source/WTF/wtf/OptionSet.h:\n\nCanonical link: https://commits.webkit.org/319901@main", "email": "richard_robinson2@apple.com", "hash": "cbf0ef68ade64b72082fcc6de3b06f70db1fa46f", "subject": "[Swift in WebKit] Introduce a bridging mechanism to create `WTF::CompletionHandler`s in Swift" }, "319902@main": { "author": "Issac Roy", "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64", "cl": "319902@main", "clUrl": "https://commits.webkit.org/319902@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322607\nrdar://185912043\n\nReviewed by Aakash Jain.\n\nGTK/WPE need to fall back to `webkit_version` when there is no\n`os_version`.\n\n`SiteIsolationResultsDBMixin` suppresses reporting because the site-isolation\nqueue used to blame a change after a single test run, so there was no\nconfirmed outcome worth recording. 319404@main gave the queue the same retry\nladder as every other layout-test queue so we should add it to the system.\n\nLayout-test steps derive the results-database flavor from\n`layout_test_driver`, but only `RunWebKit1Tests` and\n`RunWebKitTestsInStressMode` ever set that attribute, and the stress step\nruns only when the change modified layout tests. Replace the derivation\nwith a `results_db_flavor` class attribute, since the subclass is the\nlabel. `None` means \"leave the label the first run set\", which the reruns\nneed.\n\n* Tools/CISupport/ews-build/steps.py:\n(ResultsDBReportMixin.results_db_query_configuration):\n(ResultsDBReportMixin.results_db_configuration):\n(RunWebKitTests):\n(RunWebKitTests.run):\n(RunWebKitTestsInStressMode):\n(ReRunWebKitTests):\n(RunWebKitTestsWithoutChange):\n(SiteIsolationResultsDBMixin):\n(RunWebKit1Tests):\n(SiteIsolationResultsDBMixin.results_db_query_configuration): Deleted.\n* Tools/CISupport/ews-build/steps_unittest.py:\n(test_the_run_labels_the_build_wk2):\n(test_the_rerun_leaves_the_label_the_first_run_set):\n(TestRunWebKitTestsInStressMode):\n(TestRunWebKitTestsInStressMode.test_stress_mode_does_not_label_the_build):\n(TestRunWebKitTestsEWSSiteIsolation):\n(TestRunWebKitTestsEWSSiteIsolation.test_the_run_labels_the_build_site_isolation):\n(TestReRunWebKitTestsEWSSiteIsolation):\n(TestReRunWebKitTestsEWSSiteIsolation.test_the_rerun_keeps_the_site_isolation_label):\n(TestRunWebKit1Tests):\n(TestRunWebKit1Tests.test_the_run_labels_the_build_wk1):\n(TestFilterLayoutTestFailuresUsingResultsDB.test_site_isolation_queries_keep_their_platform):\n(TestReportToResultsDB.test_a_glib_port_reports_the_webkit_version_it_builds):\n(TestRunWebKitTestsEWSSiteIsolation.test_results_db_query_configuration_uses_site_isolation_flavor): Deleted.\n(TestReRunWebKitTestsEWSSiteIsolation.test_results_db_query_configuration_uses_site_isolation_flavor): Deleted.\n(TestFilterLayoutTestFailuresUsingResultsDB.test_site_isolation_queries_across_platforms): Deleted.\n\nCanonical link: https://commits.webkit.org/319902@main", "email": "issacroy05@gmail.com", "hash": "f391e2248bba0cd065ec18899cbc0f64725a955f", "subject": "[EWS] Flaky Detection Fixes" }, "319903@main": { "author": "Roberto Rodriguez", "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64", "cl": "319903@main", "clUrl": "https://commits.webkit.org/319903@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322322\nrdar://185565011\n\nReviewed by Kimmo Kinnunen.\n\ngetAttribLocation and getUniformLocation must return without generating an error when passed\na name with a reserved prefix (gl_, webgl_ or _webgl_), but only when the WebGL program is\nlinked. With an unlinked program those calls must generate INVALID_OPERATION regardless of the\nname. WebKit checks for a reserved prefix before checking whether the program is linked, which\nfails several WebGL conformance layout tests.\n\nFix by moving the reserved prefix check below the link status check in both operations.\n\n* LayoutTests/TestExpectations:\n* Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp:\n(WebCore::WebGLRenderingContextBase::getAttribLocation):\n(WebCore::WebGLRenderingContextBase::getUniformLocation):\n\nCanonical link: https://commits.webkit.org/319903@main", "email": "roberto_rodriguez2@apple.com", "hash": "c728111e1637eac7c3e953f59964b6d4fc39216c", "subject": "[WebGL] Querying an unlinked WebGL program with a reserved name prefix incorrectly reports no error" }, "319904@main": { "author": "Mark Lam", "avatar": "https://www.gravatar.com/avatar/87a4219a10aeda88757492c63da746de?d=identicon\u0026s=64", "cl": "319904@main", "clUrl": "https://commits.webkit.org/319904@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321334\nrdar://184365506\n\nReviewed by Elliott Williams and Dan Hecht.\n\nMya (pronounced like Maya) is a new command line tool for examining the JSC and\nWebKit memory use in a running process. It attaches to a target by PID and captures\nsnapshots of its memory (read-only Mach corpses of the process), and then enables\nqueries on these snapshots via a REPL.\n\nHere is an example user work flow:\n\n # mya --help // Prints help text and exit.\n\n # mya --pid 12345 // Attach to the process, and take a snapshot.\n Attached to 12345\n Captured Snapshot #1 of 12345\n\n \u003e\u003e\u003e snapshot list // Lists all existing snapshots.\n #1: pid 12345 ... // Only one so far.\n\n \u003e\u003e\u003e snapshot // Take another snapshot, and switch to it.\n Captured Snapshot #2 of 12345 // Capture and switch to snapshot 2.\n\n \u003e\u003e\u003e status // Shows current pid and snapshot being examined.\n Using snapshot 2 of pid 12345 // The snapshot command above switched us.\n\n \u003e\u003e\u003e snapshot --pid 23456\n Attached to 23456 // Attach and switch to this second process.\n Captured Snapshot #3 of 23456 // Capture and switch to snapshot 3.\n\n \u003e\u003e\u003e snapshot list // Lists all existing snapshots.\n #1: pid 12345 ...\n #2: pid 12345 ...\n #3: pid 23456 ...\n\n \u003e\u003e\u003e status // Shows current pid and snapshot being examined.\n Using snapshot 2 of pid 23456 // Note: the snapshot command above switched us.\n\n \u003e\u003e\u003e detach // Detach from the current process.\n Detached from 23456\n\n \u003e\u003e\u003e snapshot // Fails. No attached process.\n Unable to capture snapshot. Not attached to any process. Use `attach` command or specify `--pid` argument for the snapshot command.\n\n \u003e\u003e snapshot info 1 // Show info on snapshot 1.\n ...\n\n \u003e\u003e\u003e snapshot delete 2 // Delete snapshot 2.\n ...\n\n \u003e\u003e\u003e snapshot diff 1 3 // Diff between snapshots 1 and 3. Not yet implemented.\n ...\n\n \u003e\u003e snapshot 1 // Select snapshot 1 for analysis.\n\n \u003e\u003e\u003e thread list // Prints info on all thread in the current snapshot.\n Threads in snapshot #1 (pid 12345):\n INDEX TID STATE USER(ms) SYS(ms) SP STACK SIZE PAGES RESIDENT DIRTY NAME\n 1 0x12278c6 halted 23645.003 2937.065 0x16b7361e0 0x16af3c000-0x16b738000 7.98 MB 511 7 7 -\n 2 0x12278c7 halted 56.147 23.816 0x167386aa0 0x167304000-0x16738c000 544 KB 34 1 1 WebCore: ServiceWorker\n 3 0x12278c8 halted 0.211 0.472 0x105986b30 0x105904000-0x10598c000 544 KB 34 1 1 -\n\n \u003e\u003e\u003e p/x \u0026g_config // Prints the address of the g_config record.\n \u0026g_config = 0x1f48e0000\n\nThe corpse management and analysis machinery lives in libJavaScriptCoreTools, a new\nstatic library built alongside the JavaScriptCore framework. Clients that need to do\nthis type of snapshot analysis can link against it. By design, the corpse management\nand analysis code is not linked and packaged with the JavaScriptCore framework by\ndefault because they are not needed there.\n\nlibJavaScriptCoreTools provides abstractions like Address, Process, Snapshot, Thread,\nRegion, Symbol, etc. for inspecting and analyzing such WebKit and JSC corpses. Corpse\nAddresses are numbered based on the target process' address space mapping, not the\nclient tool like mya. Currently, libJavaScriptCoreTools copies over memory from the\ncorpse for inspection as an initial bootstrap implementation. In subsequent patches,\nwe will introduce a Memory Manager that will make reading corpse memory more efficient.\n\nSymbol lookup resolves a name to an address by walking the dyld exports trie of\neach image loaded in the corpse. That needs no cooperation from the target and no\ndebug information, but it only finds exported symbols.\n\nEverything read out of a corpse is untrusted input: a corrupted target could otherwise\nsteer mya into unbounded work or bad reads. The parsing paths therefore bound the work\nthey will do and reject implausible sizes, counts, and offsets rather than trusting what\nthe target claims.\n\nmya and libJavaScriptCoreTools are only for Apple platforms, since they are built on\nMach task APIs, which are only available on Apple platforms.\n\nAlso, it is not a goal to support analysis of Rosetta processes. Some subset of\nfunctionality may still work, but only on a WYSIWYG basis.\n\nTests: Source/JavaScriptCore/corpse/tests/\n\ntestLibJSCTools is a new test tool for libJavaScriptCoreTools, built with the other\nJSC test tools and run by:\n\n run-javascriptcore-tests --testlibjsctools\n\nA task may take a corpse of itself with no entitlement and no privilege, and the\ntests are built on that: they snapshot the running test process and check what the\ncorpse reports against what that process already knows about itself. A symbol\nresolved out of the corpse, for instance, has to land on the address this process\nuses for it. The suites are:\n\n ByteParser ULEB128 and C string decoding, including the truncated and out of\n range encodings that untrusted data can hold.\n ExportsTrie terminal and edge decoding for every export kind and flag, the\n malformed tries that a corrupt corpse can present, and that a\n cyclic trie still terminates. Also fuzzed from a fixed seed on\n every run, under a watchdog, because the decoder's contract is to\n bound its work on any input at all.\n Address null, ordering, arithmetic, and the ptrauth and top-byte stripping\n that a pointer out of a corpse needs.\n Process attach, detach, re-attach, a pid that has exited, and a target\n running under Rosetta translation.\n Snapshot validity, identifier assignment, and that repeatedly snapshotting\n leaves no Mach port behind.\n Region a mapping of known size and residency, an unmapped hole, and an\n address inside the shared cache submap.\n Thread thread names and their truncation, and that a thread's stack\n pointer lies inside the stack region reported for it.\n Symbol g_config, malloc and environ resolved out of a corpse of this\n process, each compared against the address it has locally, plus\n the names that are deliberately not found: a symbol hidden from\n the linker, and a name given with its underscore already attached.\n\nFor the build, libJavaScriptCoreTools, mya, and testLibJSCTools are deliberately put in\njsc's dependency closure in the JavaScriptCore_executables XBS project. This is so that\nthey can piggy-back off of jsc shell's build phase i.e. only trigger a build after\nJavaScriptCore.framework is done building, and trigger an install like the jsc shell is\n(albeit to their respective install destinations, which may defer).\n\n* Source/JavaScriptCore/CMakeLists.txt:\n* Source/JavaScriptCore/Configurations/Mya.xcconfig: Added.\n* Source/JavaScriptCore/Configurations/TestLibJSCTools.xcconfig: Added.\n* Source/JavaScriptCore/Configurations/libJavaScriptCoreTools.xcconfig: Added.\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/Scripts/process-entitlements.sh:\n* Source/JavaScriptCore/corpse/CMakeLists.txt: Added.\n* Source/JavaScriptCore/corpse/CorpseAddress.h: Added.\n* Source/JavaScriptCore/corpse/CorpseByteParser.cpp: Added.\n* Source/JavaScriptCore/corpse/CorpseByteParser.h: Added.\n* Source/JavaScriptCore/corpse/CorpseClient.cpp: Added.\n* Source/JavaScriptCore/corpse/CorpseClient.h: Added.\n* Source/JavaScriptCore/corpse/CorpseError.cpp: Added.\n* Source/JavaScriptCore/corpse/CorpseError.h: Added.\n* Source/JavaScriptCore/corpse/CorpseExportsTrie.cpp: Added.\n* Source/JavaScriptCore/corpse/CorpseExportsTrie.h: Added.\n* Source/JavaScriptCore/corpse/CorpseProcess.cpp: Added.\n* Source/JavaScriptCore/corpse/CorpseProcess.h: Added.\n* Source/JavaScriptCore/corpse/CorpseRegion.cpp: Added.\n* Source/JavaScriptCore/corpse/CorpseRegion.h: Added.\n* Source/JavaScriptCore/corpse/CorpseSnapshot.cpp: Added.\n* Source/JavaScriptCore/corpse/CorpseSnapshot.h: Added.\n* Source/JavaScriptCore/corpse/CorpseSymbol.cpp: Added.\n* Source/JavaScriptCore/corpse/CorpseSymbol.h: Added.\n* Source/JavaScriptCore/corpse/CorpseThread.cpp: Added.\n* Source/JavaScriptCore/corpse/CorpseThread.h: Added.\n* Source/JavaScriptCore/corpse/testLibJSCTools.cpp: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseAddressTest.cpp: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseAddressTest.h: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseByteParserTest.cpp: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseByteParserTest.h: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseExportsTrieTest.cpp: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseExportsTrieTest.h: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseProcessTest.cpp: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseProcessTest.h: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseRegionTest.cpp: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseRegionTest.h: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseSnapshotTest.cpp: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseSnapshotTest.h: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseSymbolTest.cpp: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseSymbolTest.h: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseThreadTest.cpp: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseThreadTest.h: Added.\n* Source/JavaScriptCore/corpse/tests/LibJSCToolsTestUtilities.cpp: Added.\n* Source/JavaScriptCore/corpse/tests/LibJSCToolsTestUtilities.h: Added.\n* Source/JavaScriptCore/mya/mya.cpp: Added.\n* Source/JavaScriptCore/shell/CMakeLists.txt:\n* Source/JavaScriptCore/shell/PlatformCocoa.cmake:\n* Tools/CISupport/ews-build/steps.py:\n* Tools/Scripts/run-javascriptcore-tests:\n* Tools/Scripts/webkitperl/BuildSubproject.pm:\n* Tools/Scripts/webkitpy/common/config/ports.py:\n* Tools/Scripts/webkitpy/common/config/ports_unittest.py:\n\nCanonical link: https://commits.webkit.org/319904@main", "email": "mark.lam@apple.com", "hash": "e5c29fb322200872ae3cce866c62c7f6529103fc", "subject": "Introducing Mya, a MemorY Analyzer, and libJavaScriptCoreTools." }, "319905@main": { "author": "Pascoe", "avatar": "https://www.gravatar.com/avatar/7a6e50b09dba6a185f45250268683d71?d=identicon\u0026s=64", "cl": "319905@main", "clUrl": "https://commits.webkit.org/319905@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322560\nrdar://174931466\n\nReviewed by Megan Gardner, Abrar Rahman Protyasha, and Wenson Hsieh.\n\nCcidConnection opens an exclusive TKSmartCard session to probe for the FIDO applet and held it until the\nend of the ceremony even when the card wasn't a security key, locking out every other CryptoTokenKit\nclient. End the session once the card answers neither the applet selection nor the U2F_VERSION fallback.\n\n* Source/WebKit/UIProcess/WebAuthentication/Cocoa/CcidConnection.mm:\n(WebKit::CcidConnection::trySelectFidoApplet):\n\nCanonical link: https://commits.webkit.org/319905@main", "email": "pascoe@apple.com", "hash": "aa0d4270f211f3648cd5c44aa41af1c071dcc31c", "subject": "[WebAuthn] Smart card is inaccessible to other clients during ceremony" }, "319906@main": { "author": "Sammy Gill", "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64", "cl": "319906@main", "clUrl": "https://commits.webkit.org/319906@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322609\nrdar://problem/185913304\n\nReviewed by Vitor Roriz.\n\nperformGridLanesPlacement() began by calling RenderGrid::populateGridPositionsForDirection()\nfor both axes, handing the half-built GridLanesLayout back to RenderGrid before a single item\nhad been placed. Neither call was doing anything useful, and for the stacking axis the value\nthey wrote was wrong.\n\nNothing reads them during placement. GridLanesLayout only asks RenderGrid for the grid, the\nstyle, the content box sizes and gridAreaBreadthForGridItem(), none of which touch positions.\nThe positions get populated once placement and sizing are done which is how grid layout on\nRenderGrid behaves.\n\nFor the stacking axis the early call was actively wrong rather than merely redundant.\npopulateGridPositionsForDirection() sets positions[lastLine] to gridContentSize() +\npositions[0] when the direction is the stacking axis, but placement had not run yet, so\ngridContentSize() was still 0 and the last line collapsed onto the first.\n\nRenderGrid also no longer calls back into a GridLanesLayout whose content size is still being\ncomputed, which is a step toward returning the placement result rather than reading it back off\nthe object.\n\nCanonical link: https://commits.webkit.org/319906@main", "email": "sammy.gill@apple.com", "hash": "66a86d6045492a307bf8c94e1136ad26c2e65917", "subject": "[Grid Lanes] GridLanesLayout attempts to populate positions before layout" }, "319907@main": { "author": "Sammy Gill", "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64", "cl": "319907@main", "clUrl": "https://commits.webkit.org/319907@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322611\nrdar://problem/185914211\n\nReviewed by Brent Fulgham.\n\nm_stackingAxisSpan was not derived from the grid or from anything passed to the\nconstructor. It was initialized to GridSpan::stackingAxisTranslatedDefiniteGridSpan(),\nwhich always returns GridSpan(0, 1, TranslatedDefinite), so it was a constant being\nstored per object rather than state belonging to a placement run.\n\nThere is not need to store this as a member since it only had a single\nreader.\n\nCanonical link: https://commits.webkit.org/319907@main", "email": "sammy.gill@apple.com", "hash": "98d64b7362c212ee5f886ea3d065b68e98aa26bc", "subject": "[Grid Lanes][Cleanup] Remove GridLanesLayout::m_stackingAxisSpan" }, "319908@main": { "author": "Andrew Gaul", "avatar": "https://www.gravatar.com/avatar/c4735ff5ae1f882942f2b3befcedbdba?d=identicon\u0026s=64", "cl": "319908@main", "clUrl": "https://commits.webkit.org/319908@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322504\n\nReviewed by Keith Miller.\n\nThe immediate forms of add32/add64/sub32/sub64 wrote a register-to-register\ncopy the expensive way when the immediate was zero: add xD, xS, #0 or\nsub wD, wS, #0 on arm64, and leaq 0(%src), %dest or a dead addq $0, %reg on\nx86_64, where the TrustedImm64 pair also burned a movabsq and the scratch\nregister. A mov is eliminated at rename where add-with-zero and lea are not,\nand the 64-bit forms drop the instruction entirely when source and destination\ncoincide. The 32-bit forms go through zeroExtend32ToWord() instead, since they\nmust still zero the destination's upper half.\n\nNone of these entry points promise flags -- arm64 already uses the\nnon-flag-setting add and sub, and flag-consuming callers use\nbranchAdd64/branchSub64 -- so dropping x86_64's flag write is invisible.\n\nx86_64 needed more entry points than arm64: only the add32/sub32 three-operand\nforms had the check, and its two-operand forms emit their own instruction\nrather than forwarding to the three-operand ones. Its 32-bit two-operand forms\nare left alone, where the substitution would be movl %eax, %eax: a byte shorter\nthan addl $0, %eax but the same single uop.\n\nThe dominant source is JIT::emit_op_new_array(), which passes the address of\nthe literal's first element with\n\n addPtr(TrustedImm32(valuesStart.offset() * sizeof(Register)),\n callFrameRegister, argumentGPR2);\n\nand that offset is zero for an empty [] literal.\n\nScanning everything the JITs emit while running JetStream 3, armlint reports\n4563 sites on arm64, 3081 of them exactly add x2, x29, #0 (3335 Baseline, 1068\nDFG) and the remaining 699 sub wD, wS, #0. The same scan on x86_64 -- 111654\ncode blobs and 240 MB captured through LinkBuffer's perf JITDump -- has x86lint\nreporting 3989 sites:\n\n 3091 lea rD, [rS] zero displacement, 3090 Baseline and 1 DFG\n 680 add/sub rD, 0 64-bit, 676 DFG, 3 Baseline, 1 WasmBBQ\n 216 add/sub eD, 0 32-bit, deliberately unchanged\n 2 lea rD, [rS+rI] two-register, unrelated to this change\n\nAll 3091 zero-displacement LEAs are exactly leaq 0(%rbp), %rdx, which is\ncallFrameRegister into argumentGPR2. After this change an empty array literal\ncompiles to mov x2, fp or movq %rbp, %rdx; no zero-immediate add or sub is left\non arm64, and on x86_64 both targeted rows are empty, 3771 sites in total. The\n32-bit row's drift to 219 is JIT nondeterminism between runs.\n\ntestmasm covered none of these entry points on x86_64: the six sub tests sat in\nthe #if CPU(ARM64) block and there were no add tests at all. Move them to\n#if CPU(X86_64) || CPU(ARM64) and add testAdd32Imm, testAdd32ArgImm,\ntestAdd64Imm32, testAdd64ArgImm32, testAdd64Imm64 and testAdd64ArgImm64, one\nper immediate form. int32Operands() and int64Operands() both start at 0, so all\nof them exercise the zero-immediate path. testmasm goes from 382 to 394 tests\non x86_64, all passing.\n\nFound with armlint and x86lint.\n\n* Source/JavaScriptCore/assembler/MacroAssemblerARM64.h:\n(JSC::MacroAssemblerARM64::add32):\n(JSC::MacroAssemblerARM64::add64):\n(JSC::MacroAssemblerARM64::sub32):\n(JSC::MacroAssemblerARM64::sub64):\n* Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h:\n(JSC::MacroAssemblerX86_64::add64):\n(JSC::MacroAssemblerX86_64::sub64):\n* Source/JavaScriptCore/assembler/testmasm.cpp:\n(JSC::testAdd32Imm):\n(JSC::testAdd32ArgImm):\n(JSC::testAdd64Imm32):\n(JSC::testAdd64ArgImm32):\n(JSC::testAdd64Imm64):\n(JSC::testAdd64ArgImm64):\n(JSC::run):\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\nCanonical link: https://commits.webkit.org/319908@main", "email": "andrew@gaul.org", "hash": "80fc868e7373b04d6c0456a974af2c8ea89ace5f", "subject": "[JSC] add/sub of a zero immediate should be a mov" }, "319909@main": { "author": "Nikolas Zimmermann", "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64", "cl": "319909@main", "clUrl": "https://commits.webkit.org/319909@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322653\n\nUnreviewed gardening.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/gtk/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319909@main", "email": "nzimmermann@igalia.com", "hash": "33cb9c1dd2e8ae6dd98c7beb5d9fe761bee74fc1", "subject": "[GTK][WPE] Gardening of tests - 2026-08-26" }, "319910@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "319910@main", "clUrl": "https://commits.webkit.org/319910@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321146\n\u003crdar://181639379\u003e\n\nReviewed by Antti Koivisto.\n\n \u003cdiv style=\"display: none; width: 300px\"\u003e\n \u003ciframe srcdoc=\"\u003cdiv style='width: 250px; height: 169px'\u003e\u003c/div\u003e\"\u003e\u003c/iframe\u003e\n \u003c/div\u003e\n\nThe box inside should measure 0x0 while the ancestor is display:none. Instead it was 250x169. We build a render tree for the content of such a\nframe so script can ask for geometry, but nothing gives that content document's view a size, so it lays out against a 0x0 viewport and the\ngeometry answers describe nothing. Build no render tree at all under a frame whose owner element generates no box, and build it back when the\nowner does.\n\nTests: imported/w3c/web-platform-tests/css/css-animations/display-none-ancestor-does-not-cancel-subframe-animations.html\n imported/w3c/web-platform-tests/css/cssom/computed-style-in-subframe-reflects-owner-document.html\n imported/w3c/web-platform-tests/html/rendering/replaced-elements/embedded-content/iframe-display-animated-to-none-content-not-laid-out.html\n imported/w3c/web-platform-tests/html/rendering/replaced-elements/embedded-content/iframe-display-none-content-not-laid-out.html\n imported/w3c/web-platform-tests/html/rendering/replaced-elements/embedded-content/iframe-display-none-content-not-laid-out-while-parent-restyles.html\n imported/w3c/web-platform-tests/html/rendering/replaced-elements/embedded-content/iframe-display-none-preserves-content-scroll-offset.tentative.html\n imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/iframe-display-none-content-stays-editable.html\n imported/w3c/web-platform-tests/html/semantics/embedded-content/the-iframe-element/iframe-display-none-still-loads-images.html\n\n* Source/WebCore/dom/Document.h:\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::ownerElementGeneratesBox const):\n The question, answered from the owner element having a renderer rather than from its\n display value, since it also generates no box inside a display:none subtree and when a shadow root leaves it unslotted.\n An owner element in a document with no render tree has no renderer whatever its display is,\n so that case recurses, which is what keeps nested unrendered frames hidden.\n A missing renderer settles nothing until the owner element itself has been styled, since every subframe is created\n while the parser is still building the tree around its owner element. Without that an iframe's initial empty\n document never gets a tree, so it never resolves style and never reports what it should. Asked of the owner\n element rather than of its document, so an unrelated restyle elsewhere in the parent does not make a settled\n frame look undecided and build a tree only to take it down again.\n\n(WebCore::Document::updateRenderTreeForOwnerElementBox):\n Builds or tears down this document's render tree to match. Called from the owner\n document's style update rather than from the display change itself: an owner element\n losing its renderer may be having it replaced rather than\n removed, and nothing at the time of the change can tell those apart, so the tree is settled from state afterwards. That also makes it idempotent.\n\n(WebCore::Document::updateRenderTreesForDescendantFrames):\n Runs the above over every descendant frame once this document has resolved style.\n Collects the documents first, because tearing a tree down can detach a frame mid-walk.\n\n(WebCore::Document::createRenderTree):\n Withholds the tree for a frame whose owner generates no box. Needed here as well because a subframe's\n first document arrives through setDocument(), before any style update of the owner.\n\n(WebCore::Document::destroyRenderTree):\n Takes whether the document is going away. A frame becoming unrendered is still here, so its renderers\n come down with RendererUpdate rather than a Full teardown, keeping animations and hover state.\n\n(WebCore::Document::updateStyleIfNeeded):\n(WebCore::Document::enqueuePaintTimingEntryIfNeeded):\n A frame that stops being rendered keeps a view that is still visually non-empty from\n before, so ContentfulPaintChecker was reached with no RenderView.\n\n(WebCore::Document::hitTest):\n Checked for a render tree, flushed layout - which resolves owner documents and can take that tree away - then\n used it. Re-checks after the flush.\n\n* Source/WebCore/html/parser/HTMLResourcePreloader.cpp:\n(WebCore::HTMLResourcePreloader::preload): Asserted that a document with a frame has a render view, which a\n frame whose owner element generates no box no longer does. Nothing below it needs one: the media query\n evaluator checks view() and documentElement(), and takes renderView() as a pointer that may be null.\n* Source/WebCore/page/LocalFrame.cpp:\n(WebCore::LocalFrame::setPrinting):\n Printing a display:none frame still works, so the tree is reconciled when printing starts and stops.\n\n* Source/WebCore/rendering/updating/RenderTreeUpdater.cpp:\n (WebCore::RenderTreeUpdater::tearDownRenderersForDisplayNoneFrame): TeardownType is private, so the RendererUpdate teardown gets a named entry\n point like the others.\n\n* Source/WebCore/rendering/updating/RenderTreeUpdater.h:\n* Source/WebCore/style/StyleExtractor.cpp:\n (WebCore::Style::Extractor::updateStyleIfNeededForProperty): A child's tree is decided by the parent's style update, and this only flushed the\n child, so a resolved value read after the owner was shown came back as the computed value.\n\n* LayoutTests/fast/dynamic/display-none-iframe-async-layout-expected.html: Updated for the new behavior.\n\nCanonical link: https://commits.webkit.org/319910@main", "email": "zalan@apple.com", "hash": "364b06df0efb23bab2ae49198c6b6df89c043172", "subject": "marketwatch.com: \"Subscribe now\" drop-down does not render anything" }, "319911@main": { "author": "Andrew Gaul", "avatar": "https://www.gravatar.com/avatar/c4735ff5ae1f882942f2b3befcedbdba?d=identicon\u0026s=64", "cl": "319911@main", "clUrl": "https://commits.webkit.org/319911@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322566\n\nReviewed by Keith Miller.\n\nop_new_object and op_put_to_scope each read two adjacent pointer-sized\nfields out of the metadata table with two separate loadPtr calls, which on\narm64 is two ldrs against the same base at offsets eight apart:\n\n ldr x1, [x25, #0x1a8] ; ObjectAllocationProfile::m_allocator\n ldr x3, [x25, #0x1b0] ; ObjectAllocationProfile::m_structure\n\nbecomes\n\n ldp x1, x3, [x25, #0x1a8]\n\nBoth pairs are laid out adjacently by construction, so this is just a\nmissed use of loadPairPtr(), which every 64-bit backend implements and\nwhich degrades to the two loads it replaces when the offset is outside\nldp's imm7 range (-512..504) or on a backend without a paired load.\n\n* op_new_object loads ObjectAllocationProfile's m_allocator and m_structure.\n A new loadPairPtrFromMetadata() spells the paired form the way\n loadPtrFromMetadata() spells the single one.\n\n* op_put_to_scope loads OpPutToScope::Metadata's m_watchpointSet and\n m_operand. The ClosureVar case already loads them back to back. The\n GlobalVar case loaded m_operand, ran the TDZ check, then loaded\n m_watchpointSet; hoisting the watchpoint-set load above the TDZ check\n pairs them too. Nothing between the two points clobbers either register,\n and both were already live across emitNotifyWriteWatchpoint().\n\nBoth sites get a static_assert on the adjacency the paired load depends on,\nso a layout change is a build error rather than a silent pessimization.\n\nScanning everything the JITs emit while running JetStream 3 (54.7M\ninstructions) reports 6601 adjacent-load pairs that ldp could fold. 2953 of\nthem are these two opcodes -- 1502 op_new_object and 1451 op_put_to_scope --\nand all 2953 are within ldp's immediate range. The remaining 3648 are DFG\nand FTL tail calls, where CallFrameShuffler restores the caller's callee-save\nregisters from adjacent old-frame slots one ldr at a time; that needs a\nchange to the shuffler's load loop and is not addressed here.\n\nRe-dumping ARES-6 with this change: every ldp-encodable metadata pair is\ngone, and 53 ldps appear where 28 pairs were folded -- the extra 25 are\nGlobalLexicalVar sites whose two loads were previously separated by the TDZ\ncheck, so armlint's adjacency matcher never counted them.\n\nFound with armlint.\n\n* Source/JavaScriptCore/jit/JIT.h:\n* Source/JavaScriptCore/jit/JITInlines.h:\n(JSC::JIT::loadPairPtrFromMetadata):\n* Source/JavaScriptCore/jit/JITOpcodes.cpp:\n(JSC::JIT::emit_op_new_object):\n* Source/JavaScriptCore/jit/JITPropertyAccess.cpp:\n(JSC::JIT::emit_op_put_to_scope):\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\nCanonical link: https://commits.webkit.org/319911@main", "email": "andrew@gaul.org", "hash": "0a67a6646c829465c43ee79154632b039437957d", "subject": "[JSC] Baseline: load adjacent metadata pointer fields with a single ldp" } }, "date": "2026-08-26", "days": 1, "generatedAt": "2026-08-26T22:06:18Z", "markdown": "## Highlights\n- **Security** WebRTC got a concentrated hardening pass for frame copying, AV1 OBU parsing, CSRC metadata bounds checks, blob URL validation, and remote decoder lifetime races. [commit 319878@main](https://commits.webkit.org/319878@main) [commit 319877@main](https://commits.webkit.org/319877@main) [commit 319876@main](https://commits.webkit.org/319876@main) [commit 319864@main](https://commits.webkit.org/319864@main) [commit 319863@main](https://commits.webkit.org/319863@main)\n- **Security** Auxiliary processes now emit a crash log on IPC validation kills, which should make real-world exploitation and triage failures much easier to see. [commit 319894@main](https://commits.webkit.org/319894@main)\n- **Perf** JavaScriptCore tightened its low-level codegen with better Baseline loads, zero-immediate folding to mov, and faster Temporal lunisolar month walking. [commit 319911@main](https://commits.webkit.org/319911@main) [commit 319908@main](https://commits.webkit.org/319908@main) [commit 319834@main](https://commits.webkit.org/319834@main)\n- **Rendering** CSS Grid lane and grid formatting context work kept landing fast, with extra-space distribution, intrinsic sizing with margins, and a notable internal GridSizer refactor. [commit 319837@main](https://commits.webkit.org/319837@main) [commit 319836@main](https://commits.webkit.org/319836@main) [commit 319845@main](https://commits.webkit.org/319845@main)\n- **Web Platform** Fetch and Cache behavior moved closer to spec and scale, fixing targetAddressSpace on URL-string fetches and removing quadratic duplicate detection from Cache.addAll(). [commit 319835@main](https://commits.webkit.org/319835@main) [commit 319869@main](https://commits.webkit.org/319869@main)\n- **UI** WebKit fixed several user-visible Safari regressions across gestures and media playback, including scroll snapping during magnification and YouTube audio/video continuing after closure. [commit 319888@main](https://commits.webkit.org/319888@main) [commit 319859@main](https://commits.webkit.org/319859@main) [commit 319842@main](https://commits.webkit.org/319842@main)\n- **GPU** Graphics and shader plumbing saw a useful cluster of correctness work across ANGLE, WebGL, Canvas copy invalidation, and DisplayList state tracking. [commit 319891@main](https://commits.webkit.org/319891@main) [commit 319903@main](https://commits.webkit.org/319903@main) [commit 319860@main](https://commits.webkit.org/319860@main) [commit 319874@main](https://commits.webkit.org/319874@main)\n- **Build** Swift and cross-platform bringup improved again, with Swift completion-handler bridging in WebKit, Swift-on-Windows enablement, and importer fixes for MSVC STL modules. [commit 319901@main](https://commits.webkit.org/319901@main) [commit 318030@main](https://commits.webkit.org/318030@main) [commit 319854@main](https://commits.webkit.org/319854@main)\n- **Refactor** JavaScriptCore gained Mya, a new memory analyzer plus libJavaScriptCoreTools, which looks like infrastructure that will pay back in debugging and heap work. [commit 319904@main](https://commits.webkit.org/319904@main)\n\n## What landed by area\n\n### JavaScriptCore and runtime\n- **Perf** Baseline now loads adjacent metadata pointer fields with a single ldp to shave instruction count in hot paths. [commit 319911@main](https://commits.webkit.org/319911@main)\n- **Perf** add/sub with a zero immediate now canonicalizes to mov in JSC codegen. [commit 319908@main](https://commits.webkit.org/319908@main)\n- **Refactor** Mya and libJavaScriptCoreTools landed as new memory-analysis infrastructure for JavaScriptCore. [commit 319904@main](https://commits.webkit.org/319904@main)\n- **Security** JSC no longer broadcasts termination from the thread that is about to stop draining, tightening thread shutdown behavior. [commit 319889@main](https://commits.webkit.org/319889@main)\n- **Refactor** jsObjectCall style got cleaned up. [commit 319867@main](https://commits.webkit.org/319867@main)\n- **Perf** JSString gained isDefinitelyAtom, likely helping fast-path atom checks avoid extra work. [commit 319852@main](https://commits.webkit.org/319852@main)\n- **Web Platform** op_instanceof metadata is now linked in CodeBlock::finishCreation instead of later. [commit 319846@main](https://commits.webkit.org/319846@main)\n- **Build** ScopedLambda was made non-moveable after a clang 20 related fallout. [commit 319843@main](https://commits.webkit.org/319843@main)\n- **Perf** SIMD usage tracking now survives OMG inlining a SIMD callee into a non-SIMD root. [commit 319839@main](https://commits.webkit.org/319839@main)\n- **Perf** Temporal's lunisolar calendar month walk got faster. [commit 319834@main](https://commits.webkit.org/319834@main)\n\n### Layout, rendering, and CSS\n- **Refactor** GridLanesLayout dropped m_stackingAxisSpan as cleanup continues in the new lane code. [commit 319907@main](https://commits.webkit.org/319907@main)\n- **Rendering** GridLanesLayout no longer tries to populate positions before layout has happened. [commit 319906@main](https://commits.webkit.org/319906@main)\n- **Rendering** Relative-positioned block-in-inline overflow width reporting was fixed to stop inflating to the whole line. [commit 319899@main](https://commits.webkit.org/319899@main)\n- **Rendering** Orthogonal block-level boxes inside inline boxes no longer force the container to the wrong width. [commit 319897@main](https://commits.webkit.org/319897@main)\n- **Rendering** Another orthogonal block-in-inline fix corrects misplacement. [commit 319895@main](https://commits.webkit.org/319895@main)\n- **Refactor** Viewport-percentage unit resolution functions were streamlined. [commit 319862@main](https://commits.webkit.org/319862@main)\n- **Rendering** Grid lane fit-tolerance resolution moved out of GridLanesLayout. [commit 319851@main](https://commits.webkit.org/319851@main)\n- **Refactor** The grid sizing algorithm moved into a dedicated GridSizer class. [commit 319845@main](https://commits.webkit.org/319845@main)\n- **Rendering** GridLanesLayout now initializes in its constructor, reducing partial-state setup. [commit 319840@main](https://commits.webkit.org/319840@main)\n- **Rendering** Grid formatting context implemented step 2.4 of distributing extra space. [commit 319837@main](https://commits.webkit.org/319837@main)\n- **Rendering** Grid item margins are now included in intrinsic size contributions. [commit 319836@main](https://commits.webkit.org/319836@main)\n- **Rendering** The preview-only line-clamp regression test coverage was updated for a css-overflow case. [commit 319848@main](https://commits.webkit.org/319848@main)\n\n### Networking, storage, and process model\n- **Security** Site Isolation avoids sending per-frame layout info when there are no remote frame processes, reducing unnecessary cross-process data flow. [commit 319884@main](https://commits.webkit.org/319884@main)\n- **Security** Site Isolation fixed a failing blob navigation test in local HTTP coverage. [commit 319882@main](https://commits.webkit.org/319882@main)\n- **Networking** GLib added API for HTTPS upgrade policy control. [commit 319880@main](https://commits.webkit.org/319880@main)\n- **Security** A NetworkProcess regression causing stack overflow while aborting queued transactions from a suspended process was fixed. [commit 319873@main](https://commits.webkit.org/319873@main)\n- **Perf** Cache.addAll() now avoids quadratic duplicate detection. [commit 319869@main](https://commits.webkit.org/319869@main)\n- **Security** CacheStorageConnection::computeRecordBodySize no longer performs unsynchronized cross-thread access on its opaque response size map. [commit 319865@main](https://commits.webkit.org/319865@main)\n- **Security** registerInternalFileBlobURL now validates replacementPath more completely. [commit 319864@main](https://commits.webkit.org/319864@main)\n- **Web Platform** fetch() now respects targetAddressSpace even when constructed from a URL string. [commit 319835@main](https://commits.webkit.org/319835@main)\n- **Web Platform** Extension background service workers can again discover sibling extension pages through clients.matchAll(). [commit 319898@main](https://commits.webkit.org/319898@main)\n\n### Media, WebRTC, and capture\n- **Security** copyVideoFrameBuffer no longer writes out of bounds for odd-width I420 and I010 frames. [commit 319878@main](https://commits.webkit.org/319878@main)\n- **Security** AV1 RTP packetization now avoids integer truncation when parsing OBU sizes. [commit 319877@main](https://commits.webkit.org/319877@main)\n- **Security** RTCEncodedVideoFrameMetadata.contributingSources now gets the missing bounds check in RtpPacket::SetCsrcs. [commit 319876@main](https://commits.webkit.org/319876@main)\n- **Media** A flaky crash test was added for applyConstraints-with-takePhoto in mediastream on macOS debug. [commit 319881@main](https://commits.webkit.org/319881@main)\n- **Media** Seeking to the end of an MSE-backed media element no longer fires an unnecessary ended event. [commit 319847@main](https://commits.webkit.org/319847@main)\n- **UI** A Safari regression that let YouTube audio continue after tab close on macOS was fixed. [commit 319842@main](https://commits.webkit.org/319842@main)\n- **UI** A separate Safari regression that allowed multiple YouTube videos to play simultaneously across windows was fixed. [commit 319859@main](https://commits.webkit.org/319859@main)\n- **Media** GStreamer's WebKitWebSource internal queue now uses fixed watermarks. [commit 319853@main](https://commits.webkit.org/319853@main)\n- **Security** RemoteVideoDecoderCallbacks no longer races m_timestampToDuration into use-after-free territory. [commit 319863@main](https://commits.webkit.org/319863@main)\n\n### Graphics, Canvas, WebGL, and SVG\n- **Web Platform** WebGL now correctly reports an error when querying an unlinked program with a reserved name prefix. [commit 319903@main](https://commits.webkit.org/319903@main)\n- **GPU** ANGLE's Metal backend now classifies a certain unsigned tautology compare in EnsureLoopForwardProgress as finite instead of infinite. [commit 319891@main](https://commits.webkit.org/319891@main)\n- **GPU** ANGLE was rolled forward to the 2026-07-13 snapshot, bringing a wider batch of graphics fixes under WebKit. [commit 319887@main](https://commits.webkit.org/319887@main)\n- **GPU** DisplayList::Recorder now keeps a per-level copy of remote GraphicsContext state. [commit 319874@main](https://commits.webkit.org/319874@main)\n- **Perf** HighlightRegistry::addAnnotationHighlightWithRange() now avoids redundant atom table and hash lookups. [commit 319871@main](https://commits.webkit.org/319871@main)\n- **GPU** CanvasBase and CanvasRenderingContexts now discard copies before draws, tightening copy invalidation behavior. [commit 319860@main](https://commits.webkit.org/319860@main)\n- **Privacy** CanvasNoiseInjection fixed neighbor ordering in lowerAndUpperBound when component1 \u003e component3. [commit 319896@main](https://commits.webkit.org/319896@main)\n- **Web Platform** SVGAngleValue parsing now reuses CSS parser machinery. [commit 319893@main](https://commits.webkit.org/319893@main)\n- **Security** LBSE no longer walks xlink:href cycles forever while collecting pattern attributes. [commit 319850@main](https://commits.webkit.org/319850@main)\n- **Web Platform** SVG WPT expectations were resynced from upstream. [commit 319900@main](https://commits.webkit.org/319900@main)\n\n### Platform integration, UI, and auth\n- **UI** marketwatch.com's \"Subscribe now\" drop-down renders again. [commit 319910@main](https://commits.webkit.org/319910@main)\n- **Security** WebAuthn fixed smart-card accessibility during a ceremony so other clients are not blocked incorrectly. [commit 319905@main](https://commits.webkit.org/319905@main)\n- **UI** AppKit magnification no longer snaps scroll position unexpectedly. [commit 319888@main](https://commits.webkit.org/319888@main)\n- **UI** AppKit gesture handling now supports mouse tracking with multiple recognizers. [commit 319879@main](https://commits.webkit.org/319879@main)\n- **Mobile** SOAuthorizationSession on macOS now lets clients present the authorization view controller from their own controller. [commit 319838@main](https://commits.webkit.org/319838@main)\n- **Refactor** Quirks removed isDomain and isEmbedDomain. [commit 319890@main](https://commits.webkit.org/319890@main)\n- **Refactor** The QuirksMatch API got cleaned up. [commit 319883@main](https://commits.webkit.org/319883@main)\n- **Refactor** Element fullscreen and simulated mouse-event quirks moved into the quirks table. [commit 319832@main](https://commits.webkit.org/319832@main)\n\n### GTK, WPE, GLib, and cross-platform build\n- **Build** GTK and WPE test gardening landed for the day. [commit 319909@main](https://commits.webkit.org/319909@main)\n- **Build** EWS got a set of flaky detection fixes. [commit 319902@main](https://commits.webkit.org/319902@main)\n- **Build** Swift in WebKit gained a bridge for creating WTF::CompletionHandler values from Swift. [commit 319901@main](https://commits.webkit.org/319901@main)\n- **Build** GLib added XRDeviceIdentifier to serialized_identifiers(). [commit 319892@main](https://commits.webkit.org/319892@main)\n- **Build** ipc/serialized-type-info.html now reports the right types off Cocoa. [commit 319886@main](https://commits.webkit.org/319886@main)\n- **Build** webkitglib/2.54 now builds again with USE_SPIEL=ON. [commit 319875@main](https://commits.webkit.org/319875@main)\n- **Build** A clang 20 self-referential ScopedLambda constraint regression was fixed. [commit 319872@main](https://commits.webkit.org/319872@main)\n- **Build** GTK and WPE bumped SDK version from v9 to v11. [commit 319870@main](https://commits.webkit.org/319870@main)\n- **Build** Swift on Windows is now allowed. [commit 318030@main](https://commits.webkit.org/318030@main)\n- **GPU** WPE and GTK's Skia compositor now recreates tile-cached SkImage on every update. [commit 319866@main](https://commits.webkit.org/319866@main)\n- **Build** IconDatabase now uses the current timestamp when inserting new icons on GTK and WPE. [commit 319858@main](https://commits.webkit.org/319858@main)\n- **Build** GLib's MemoryPressureHandlerConfiguration now has IPC metadata under the correct name. [commit 319857@main](https://commits.webkit.org/319857@main)\n- **Build** GTK version numbers were bumped. [commit 319856@main](https://commits.webkit.org/319856@main)\n- **Mobile** WPE and GTK now use a Chrome UA for PrimeVideo compatibility. [commit 319855@main](https://commits.webkit.org/319855@main)\n- **Build** The Swift clang importer on Windows was fixed for MSVC STL module visibility and related issues. [commit 319854@main](https://commits.webkit.org/319854@main)\n- **Security** FlatpakLauncher no longer tries to expose paths under /app or /usr on WPE and GTK. [commit 319841@main](https://commits.webkit.org/319841@main)\n\n### Tooling, inspector, parser, and tests\n- **DevTools** Web Inspector removed obsolete setting migrations. [commit 319885@main](https://commits.webkit.org/319885@main)\n- **Build** jscore-tests now caps max timeout in CI support. [commit 319861@main](https://commits.webkit.org/319861@main)\n- **Build** .submitproject-append now includes Tools/TestWebKitAPI. [commit 319849@main](https://commits.webkit.org/319849@main)\n- **Security** The HTML parser now refuses to insert an element into its own subtree. [commit 319844@main](https://commits.webkit.org/319844@main)\n- **Build** Gardening for imported wasm serialization memory tests was removed. [commit 319833@main](https://commits.webkit.org/319833@main)\n\n## Reverts \u0026 Reapplies\n- None.", "repo": "webkit", "repoDisplay": "WebKit", "rollGroups": [], "since": "2026-08-26", "totals": { "commits": 80, "features": 80, "rolls": 0 }, "until": "2026-08-26" }