{
  "commits": {
    "315453@main": {
      "author": "Anthony Tarbinian",
      "avatar": "https://www.gravatar.com/avatar/ef46154a1a21c6a5ef593e952ebc62f4?d=identicon\u0026s=64",
      "cl": "315453@main",
      "clUrl": "https://commits.webkit.org/315453@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321984\nrdar://185159613\n\nReviewed by Timothy Hatcher.\n\nhttps://commits.webkit.org/315453@main added an allowlist of\nWebExtension icon types which were permitted to be decoded in the\nUIProcess.\n\nPDFs were not on the allowlist, but they are a supported extension icon\nimage format.\n\nThis patch adds back PDF decoding in the UIProcess for WebExtension\nicons via NSPDFImageRep matching how it was decoded with NSImage before\n315453@main. Note that this only affects macOS since UIImage never\ndecoded PDFs.\n\nI couldn't simply add PDFs to the allowlist of supported images since\nPDFs are not handled by CGImageSource (which is what the\nWebCore::isSupportedImageType allowlist gates). So, I had to explicitly\ndecode PDFs separately like I did for SVGs in 315453@main.\n\nAdds API tests: PDFIconLoads, PDFActionIconAsStringLoads,\nMixedBitmapAndPDFIconsBothResolve and MalformedPDFIconIsReported.\n\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionCocoa.mm:\n(WebKit::WebExtension::iconForPath):\n    Add a case to decode PDF WebExtension icons with NSPDFImageRep.\n* Tools/TestWebKitAPI/Helpers/cocoa/TestCocoaImageAndCocoaColor.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/TestCocoaImageAndCocoaColor.mm:\n(TestWebKitAPI::Util::makePDFData):\n    Helper to construct an array of bytes which represents a PDF.\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtension.mm:\n(TestWebKitAPI::TEST(WKWebExtension, PDFIconLoads)):\n    Test that we can load the PDF icon of a WKWebExtension.\n(TestWebKitAPI::TEST(WKWebExtension, MixedBitmapAndPDFIconsBothResolve)):\n    Tests that different types of icon formats can be combined with PDFs in the\n    extension manifest { \"16\": \"icon-16.pdf\", \"128\": \"icon-128.png\" }\n(TestWebKitAPI::TEST(WKWebExtension, PDFActionIconAsStringLoads)):\n    Test for when an icon is described using the \"action\" manifest key:\n        \"action\": { \"default_icon\": \"action-icon.pdf\" }\n(TestWebKitAPI::TEST(WKWebExtension, MalformedPDFIconIsReported)):\n    Check that a PDF decoding error shows up after the decode fails.\n\nCanonical link: https://commits.webkit.org/319970@main",
      "email": "a_tarbinian@apple.com",
      "hash": "8d764ee4313bf77fd932bb97788e43cb44c9a4f7",
      "subject": "Decode WebExtension PDF icons in WebContent process"
    },
    "319912@main": {
      "author": "Brian Weinstein",
      "avatar": "https://www.gravatar.com/avatar/2892a9aaa68f537ee65c6f95ef0768a6?d=identicon\u0026s=64",
      "cl": "319912@main",
      "clUrl": "https://commits.webkit.org/319912@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322618\nrdar://184269255\n\nReviewed by Kiara Rose.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIOffscreen.mm\n\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPINamespace.cpp:\n(WebKit::WebExtensionAPINamespace::isPropertyAllowed):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIOffscreen.mm:\n(TestWebKitAPI::TEST_F(WKWebExtensionAPIOffscreen, OffscreenDocumentAPIAvailability)):\n\nCanonical link: https://commits.webkit.org/319912@main",
      "email": "bweinstein@apple.com",
      "hash": "eff8dd166bf9270a24ccba02cdfb5d6881390108",
      "subject": "browser.offscreen shouldn't be available to offscreen pages"
    },
    "319913@main": {
      "author": "Elliott Williams",
      "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64",
      "cl": "319913@main",
      "clUrl": "https://commits.webkit.org/319913@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322312\n\nReviewed by Adrian Taylor and Richard Robinson.\n\nRemove all [1] the custom argument rewriting done in `swiftc-wrapper.py`\nand change the build config to coherently pass them. Now, the compiler\nand linker arguments as described by CMake apply directly to swift.\n\nThis also makes it easy to drop in a replacement compiler instead of\nusing swiftc-wrapper; previously doing so would fail the build.\n\nFor the most part, this entails using `LINKER:` to instruct CMake to\npass arguments through swift's frontend to ld.\n\nOne bit of complexity is a new way of handling preprocessor definitions.\nSwift supports valueless definitions only (i.e. -DFOO, not -DFOO=VALUE):\nAdd `webkit_add_compile_definitions` and\n`webkit_target_compile_definitions` which wrap their respective CMake\nfunctions, and process the the declarations into ones that can and\ncannot be expressed to Swift. The ones that cannot be expressed are\nhidden via genexprs, but they are still passed *through* Swift to the\nclang importer.\n\nSimilarly, add a `webkit_pkg_check_modules` wrapper for 3rd-party\nlibraries. For vendored code that we include without using FindPackage,\nadd a `webkit_scope_target_interface_definitions` function that rewrites\nthe compiler definitions post-hoc, to avoid editing upstream code.\n\n[1]: AFAICT, we still need to rewrite Windows linker arguments, because\n     CMake itself incorrectly passes those through to swift. So, retain that\n     one case.\n\n* CMakeLists.txt:\n* Source/JavaScriptCore/PlatformCocoa.cmake:\n* Source/WebCore/PlatformCocoa.cmake:\n* Source/WebGPU/WebGPU/CMakeLists.txt:\n* Source/WebKit/PlatformCocoa.cmake:\n* Source/WebKit/PlatformGTK.cmake:\n* Source/WebKit/PlatformWPE.cmake:\n* Source/WebKitLegacy/PlatformCocoa.cmake:\n\nThe Find* modules for GTK builds propagate some pkg-config CFLAGS that\nare irrelevant to Swift. Add some shared logic to turn them into\ngenexprs that filter them out.\n\n* Source/cmake/BubblewrapSandboxChecks.cmake:\n* Source/cmake/FindCairo.cmake:\n* Source/cmake/FindEpoxy.cmake:\n* Source/cmake/FindGLib.cmake:\n* Source/cmake/FindHarfBuzz.cmake:\n* Source/cmake/FindOpenGL.cmake:\n* Source/cmake/FindSoup3.cmake:\n* Source/cmake/FindWPE.cmake:\n* Source/cmake/OptionsCocoa.cmake:\n* Source/cmake/OptionsCommon.cmake:\n* Source/cmake/OptionsGTK.cmake:\n* Source/cmake/OptionsPlayStation.cmake:\n* Source/cmake/OptionsWPE.cmake:\n* Source/cmake/WebKitCompilerFlags.cmake:\n* Source/cmake/WebKitMacros.cmake:\n* Tools/MiniBrowser/playstation/CMakeLists.txt:\n* Tools/Scripts/swift/swiftc-wrapper.py:\n(main):\n(expand_response_file): Deleted.\n(process_args): Deleted.\n(filter_benign_warnings):\n* Tools/TestWebKitAPI/CMakeLists.txt:\n* Tools/TestWebKitAPI/PlatformCocoa.cmake:\n* Tools/WebKitTestRunner/PlatformCocoa.cmake:\n* Tools/gtk/manifest.txt.in:\n* Tools/wpe/manifest.txt.in:\n* Source/CMakeLists.txt:\n* Source/cmake/FindATK.cmake:\n* Source/cmake/FindATKBridge.cmake:\n* Source/cmake/FindAVIF.cmake:\n* Source/cmake/FindBreakpad.cmake:\n* Source/cmake/FindBrotli.cmake:\n* Source/cmake/FindEnchant.cmake:\n* Source/cmake/FindGBM.cmake:\n* Source/cmake/FindJPEGXL.cmake:\n* Source/cmake/FindJournald.cmake:\n* Source/cmake/FindLCMS2.cmake:\n* Source/cmake/FindLibGcrypt.cmake:\n* Source/cmake/FindLibInput.cmake:\n* Source/cmake/FindLibPSL.cmake:\n* Source/cmake/FindLibseccomp.cmake:\n* Source/cmake/FindManette.cmake:\n* Source/cmake/FindOpenGLES2.cmake:\n* Source/cmake/FindSysProfCapture.cmake:\n* Source/cmake/FindTasn1.cmake:\n* Source/cmake/FindUdev.cmake:\n* Source/cmake/FindWOFF2.cmake:\n* Source/cmake/FindWPEBackendFDO.cmake:\n* Source/cmake/FindWebP.cmake:\n* Source/cmake/WebKitCommon.cmake:\n* Source/cmake/FindATSPI.cmake:\n* Source/cmake/FindGTK.cmake:\n* Source/cmake/FindSecret.cmake:\n* Source/cmake/FindXkbCommon.cmake:\n\nCanonical link: https://commits.webkit.org/319913@main",
      "email": "emw@apple.com",
      "hash": "82220a2f11379d6f8a9b39ffecf311a9472721f2",
      "subject": "[CMake] Stop rewriting arguments in swiftc-wrapper"
    },
    "319914@main": {
      "author": "Brady Eidson",
      "avatar": "https://www.gravatar.com/avatar/31bed81d6d8ef517f93b30add03f5651?d=identicon\u0026s=64",
      "cl": "319914@main",
      "clUrl": "https://commits.webkit.org/319914@main",
      "description": "rdar://172230453\n\nReviewed by Charlie Wolfe.\n\nA compromised web content process can send a malicious message to the Networking process\nto register for broadcast channel messages it should not have access to.\n\nThis adds message checks to validate that the IPC::Connection these messages are\ncoming from has access to the top security origin claimed.\n\nTests: Tools/TestWebKitAPI/Tests/WebKitCocoa/BroadcastChannelOriginSpoof.mm\n\n* Source/WebKit/NetworkProcess/NetworkBroadcastChannelRegistry.cpp:\n(WebKit::NetworkBroadcastChannelRegistry::isOriginAllowedForConnection const):\n(WebKit::NetworkBroadcastChannelRegistry::registerChannel):\n(WebKit::NetworkBroadcastChannelRegistry::unregisterChannel):\n(WebKit::NetworkBroadcastChannelRegistry::postMessage):\n* Source/WebKit/NetworkProcess/NetworkBroadcastChannelRegistry.h:\n* Source/WebKit/NetworkProcess/NetworkProcess.cpp:\n(WebKit::NetworkProcess::allowsFirstPartyForCookies): Remove an unnecessary ASSERT that prevents\n  this from being tested in the debug configuration.\n\n* Tools/TestWebKitAPI/Tests/WebKitCocoa/NetworkProcess.mm:\n(-[BroadcastChannelSpoofMessageHandler userContentController:didReceiveScriptMessage:]):\n((NetworkProcess, BroadcastChannelOriginSpoof)):\n* Tools/TestWebKitAPI/Tests/WebKitCocoa/PasteHTML.mm:\n\nOriginally-landed-as: 305413.560@safari-7624-branch (e1706a288fb5). rdar://185459196\nCanonical link: https://commits.webkit.org/319914@main",
      "email": "beidson@apple.com",
      "hash": "e88c8b010e7f325019231b36d6031c41462c5ee8",
      "subject": "BroadcastChannel cross-origin spoof"
    },
    "319915@main": {
      "author": "Alex Christensen",
      "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64",
      "cl": "319915@main",
      "clUrl": "https://commits.webkit.org/319915@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=283929\nrdar://141168403\n\nReviewed by David Kilzer.\n\nThreadSafeWeakPtr needs more information than just a pointer to support multiple inheritance.\nThis is tested in the existing test WTF_ThreadSafeWeakPtr.MultipleInheritance.\nThis was implemented by keeping two pointers, but that makes it so that if multiple threads\nare accessing the same ThreadSafeWeakPtr from multiple threads and mutating it, there can\nbe inconsistent state, which leads to crashes.  See rdar://184638719.  ThreadSafeWeakPtr\nwas as safe as std::shared_ptr\u003cT\u003e, but this makes it as safe as std::atomic\u003cstd::shared_ptr\u003cT\u003e\u003e.\n\nInstead of keeping two pointers, I keep a pointer and a 16-bit offset to make room for a Lock.\n\nRemoteAudioVideoRendererProxyManager needed to be fixed to fit into this new model.  It was\nreturning the control block of the GPUConnectionToWebProcess, which resulted in arbitrarily\nlarge offsets needing to be stored because it was the difference of two pointers to two\ndifferent objects not related by inheritance.  I made RemoteAudioVideoRendererProxyManager\nhave its own control block to fix this.\n\nI added some AI-generated tests that showed some threading issues before this fix.\n\nI measured the performance of this change with this simple benchmark:\n\nRef counter = adoptRef(*new ThreadSafeInstanceCounter());\nWallTime begin = WallTime::now();\nfor (size_t i = 0; i \u003c 1000000; i++) {\n    ThreadSafeWeakPtr weakPtr { counter.get() };\n    RefPtr getResult = weakPtr.get();\n}\nWallTime end = WallTime::now();\nWTFLogAlways(\"%f ms\", (end - begin).milliseconds());\n\nThe time spent before this change was about 8ms:\n8.530140 ms\n8.382082 ms\n8.578062 ms\n8.245945 ms\n8.296013 ms\n\nThe time spent after this change was about 19ms:\n19.480944 ms\n19.495010 ms\n19.415855 ms\n19.705057 ms\n19.248009 ms\n\nSo this does make this lightweight operation about twice as expensive, but that's the\ncost of thread safety.  If this is found to be a performance bottleneck for anything,\nwe could either use WeakPtr or make a non-mutable version of ThreadSafeWeakPtr that\ndoesn't have a lock, or we could rewrite the code to not be so dependent on\nThreadSafeWeakPtr performance.\n\nTest: Tools/TestWebKitAPI/Tests/WTF/WeakPtr.cpp\n\n* Source/WTF/wtf/Forward.h:\n* Source/WTF/wtf/Ref.h:\n* Source/WTF/wtf/RefPtr.h:\n* Source/WTF/wtf/ThreadSafeWeakPtr.h:\n(WTF::ThreadSafeWeakPtrControlBlock::makeStrongReferenceIfPossible const):\n(WTF::ThreadSafeWeakPtrControlBlock::objectOffset const):\n(WTF::ThreadSafeWeakPtrControlBlock::refObjectIfAlive const):\n(WTF::ThreadSafeWeakPtrStorage::ThreadSafeWeakPtrStorage):\n(WTF::ThreadSafeWeakPtrStorage::~ThreadSafeWeakPtrStorage):\n(WTF::ThreadSafeWeakPtrStorage::makeStrongReferenceIfPossible const):\n(WTF::ThreadSafeWeakPtrStorage::set):\n(WTF::ThreadSafeWeakPtrStorage::clear):\n(WTF::ThreadSafeWeakPtrStorage::copyFrom):\n(WTF::ThreadSafeWeakPtrStorage::moveFrom):\n(WTF::ThreadSafeWeakPtrStorage::adopt):\n(WTF::ThreadSafeWeakPtrStorage::WTF_GUARDED_BY_LOCK):\n(WTF::ThreadSafeWeakPtr::ThreadSafeWeakPtr):\n(WTF::ThreadSafeWeakPtr::operator=):\n(WTF::ThreadSafeWeakPtr::get const):\n(WTF::ThreadSafeWeakPtr::controlBlockAndObjectOffset):\n(WTF::ThreadSafeWeakRef::ThreadSafeWeakRef):\n(WTF::ThreadSafeWeakRef::operator=):\n(WTF::ThreadSafeWeakRef::get const):\n(WTF::ThreadSafeWeakRef::controlBlockAndObjectOffset):\n(WTF::protect):\n* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.cpp:\n(WebKit::GPUConnectionToWebProcess::remoteAudioVideoRendererProxyManager):\n* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.h:\n* Source/WebKit/GPUProcess/media/RemoteAudioVideoRendererProxyManager.cpp:\n(WebKit::RemoteAudioVideoRendererProxyManager::create):\n(WebKit::RemoteAudioVideoRendererProxyManager::createManager):\n(WebKit::RemoteAudioVideoRendererProxyManager::ref const): Deleted.\n(WebKit::RemoteAudioVideoRendererProxyManager::deref const): Deleted.\n(WebKit::RemoteAudioVideoRendererProxyManager::controlBlock const): Deleted.\n* Source/WebKit/GPUProcess/media/RemoteAudioVideoRendererProxyManager.h:\n* Source/WebKit/GPUProcess/media/RemoteAudioVideoRendererProxyManager.messages.in:\n* Source/WebKit/WebProcess/GPU/media/AudioVideoRendererRemote.cpp:\n(WebKit::AudioVideoRendererRemote::AudioVideoRendererRemote):\n* Tools/TestWebKitAPI/Tests/WTF/WeakPtr.cpp:\n(TestWebKitAPI::performWithOptionalLock):\n(TestWebKitAPI::testTornPairOnAssignment):\n(TestWebKitAPI::TEST(WTF_ThreadSafeWeakPtr, TornPairOnAssignment)):\n(TestWebKitAPI::testControlBlockFreedUnderReader):\n(TestWebKitAPI::TEST(WTF_ThreadSafeWeakPtr, ControlBlockFreedUnderReader)):\n(TestWebKitAPI::TEST(WTF_ThreadSafeWeakPtr, GetRacingWithLastWeakReferenceRelease)):\n(TestWebKitAPI::testDoubleWeakDeref):\n(TestWebKitAPI::TEST(WTF_ThreadSafeWeakPtr, DoubleWeakDeref)):\n(TestWebKitAPI::testWeakHashSetTimeOfCheckTimeOfUse):\n(TestWebKitAPI::TEST(WTF_ThreadSafeWeakPtr, WeakHashSetTimeOfCheckTimeOfUse)):\n\nCanonical link: https://commits.webkit.org/319915@main",
      "email": "achristensen@apple.com",
      "hash": "a90ff51d22256639ba1250a1d589f75a73c5ca9f",
      "subject": "Make ThreadSafeWeakPtr safe to mutate from different threads"
    },
    "319916@main": {
      "author": "Sihui Liu",
      "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64",
      "cl": "319916@main",
      "clUrl": "https://commits.webkit.org/319916@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322446\nrdar://185728345\n\nReviewed by Per Arne Vollan.\n\nWith the shared process enabled, removing the last frame hosted in the shared process leaves that process holding a page\nwith no frames in it, and this could cause API test SiteIsolation.RemoveFrames to fail -- the test still finds a remote\nframe tree after both example.com frames are gone. This is because BrowsingContextGroup tracks the shared FrameProcess\nweakly and only disconnects the process's RemotePageProxy from ~FrameProcess, so any strong reference outliving the\nframes keeps the page, and the process, alive.\n\nThe root cause is API::Navigation takes a strong reference to the shared FrameProcess via setPendingSharedProcess(). The\nreference was added to bridge the gap between the point a process is picked for a navigation and the point a\nProvisionalFrameProxy or ProvisionalPageProxy takes ownership of it (see 301070@main), with WebFrameProxy taking over on\ncommit through takeFrameProcess(). However, API::Navigation never releases the reference, so the FrameProcess ends up\nliving as long as the API::Navigation, which outlives the frames that use the process.\n\nTo fix this, this patch captures the strong reference in the completion handler passed to\nBrowsingContextGroup::sharedProcessForSite() instead. The reference is released once continueWithProcessForNavigation()\nreturns, by which point either a ProvisionalFrameProxy or a ProvisionalPageProxy owns the FrameProcess, or the\nnavigation has been abandoned and nobody needs it. It has to cover that whole call rather than stop at the handoff,\nbecause prepareForProvisionalLoadInProcess() destroys the previous provisional frame before calling\nensureProcessForSite(), which would otherwise find a null m_sharedProcess for a process that still reports\nisSharedProcess().\n\nThe fix above exposes another bug, since a shared process can now be torn down and recreated within a page's lifetime:\nremoveFrameProcess() cleared m_sharedProcess and m_sharedProcessSites but not m_pagesInSharedProcess, which records the\npages already injected into the shared process. BCG would therefore skip injecting a page into the newly created shared\nprocess even though that process does not have the page, and the page's LoadRequest would go unhandled.\n\nIt also makes SiteIsolation.SharedProcessBasicWebProcessCacheCrash fail on the bots, where the child frames ended up in\na different process after the second navigation. Now that the shared process is really released, it is put in the\nWebProcessCache and taken back out within the same navigation, and addProcessIfPossible() only adds a process to\nm_sharedProcessesPerSite once a responsiveness ping to that process comes back. takeSharedProcess() only looked at that\nmap, so whenever the next navigation picked a process before the ping returned, it started a second process for the same\nsite instead. Let takeSharedProcess() also return a process still sitting in m_pendingAddRequests; removeProcess()\nalready treats those entries as part of the cache, and taking the process back cancels the pending add, since the ping\nhandler drops a request that is no longer there. takeProcess() has the same gap, but is left alone here.\n\nSiteIsolation.RemoveFrames covers this once SiteIsolationSharedProcessEnabled is on, and\nSiteIsolation.SharedProcessBasicWebProcessCacheCrash covers the rebuild path. The preference is off by default, so no\ntest change is included.\n\n* Source/WebKit/UIProcess/API/APINavigation.cpp:\n(API::Navigation::setPendingSharedProcess): Deleted.\n* Source/WebKit/UIProcess/API/APINavigation.h:\n* Source/WebKit/UIProcess/BrowsingContextGroup.cpp:\n(WebKit::BrowsingContextGroup::removeFrameProcess):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::receivedNavigationActionPolicyDecision):\n* Source/WebKit/UIProcess/WebProcessCache.cpp:\n(WebKit::WebProcessCache::takeSharedProcess):\n\nCanonical link: https://commits.webkit.org/319916@main",
      "email": "sihui_liu@apple.com",
      "hash": "bcee9e49e4dce52384ea23f7d7ab8afee3482367",
      "subject": "[Site Isolation] Shared process outlives every frame using it because API::Navigation keeps a reference"
    },
    "319917@main": {
      "author": "Brent Fulgham",
      "avatar": "https://www.gravatar.com/avatar/c6989a65afef0d015b55c65406e37ccc?d=identicon\u0026s=64",
      "cl": "319917@main",
      "clUrl": "https://commits.webkit.org/319917@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322612\nrdar://185831651\n\nReviewed by Alan Baradlay and Sammy Gill.\n\nAn \u003csvg\u003e whose only intrinsic sizing information is an aspect ratio (e.g, a viewBox with\nno width/height attributes), absolutely positioned with left and right both non-auto and\nwidth:auto, was getting stretched to the full width of its containing block, ignoring its\n`max-width` property.\n\ncomputeReplacedLogicalWidth()` has a carve-out for an out-of-flow replaced box with both\ninline insets set, with a comment that implies that it was only intended for intrinsic\nkeywords. It calculated the width from left/right per CSS 2.1 10.3.7 and returns early,\nskipping `computeReplacedLogicalWidthRespectingMinMaxWidth()`. But the condition did not\nrestrict its behavior, discarding all `max-width` cases. `min-width` did not suffer from\nthis issue because it is applied inside the block.\n\nThis patch corrects this issue by applying the `max-width` clamp inside the carve-out,\nstill ignoring it when it is an intrinsic keyword, so lengths and percentages constrain\nthe box while the keywords keep the behavior for which the carve-out was added.\n\nA new WPT is included to protect this from regressing.\n\nTests: fast/replaced/max-width-on-positioned-replaced-with-intrinsic-ratio.html\n       imported/w3c/web-platform-tests/css/css-position/position-absolute-replaced-minmax.html\n\n* LayoutTests/fast/replaced/max-width-on-positioned-replaced-with-intrinsic-ratio-expected.txt: Added.\n* LayoutTests/fast/replaced/max-width-on-positioned-replaced-with-intrinsic-ratio.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-position/position-absolute-replaced-minmax-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-position/position-absolute-replaced-minmax.html:\n* Source/WebCore/rendering/RenderReplaced.cpp:\n(WebCore::RenderReplaced::computeReplacedLogicalWidth const):\nClamp to max-width unless it is an intrinsic keyword or none.\n\nCanonical link: https://commits.webkit.org/319917@main",
      "email": "bfulgham@apple.com",
      "hash": "e6ef3220723e0ec983018314278e9f2a8291ecc9",
      "subject": "Honor a non-keyword max-width on an out-of-flow replaced box with an intrinsic ratio"
    },
    "319918@main": {
      "author": "Ian Gower",
      "avatar": "https://www.gravatar.com/avatar/cc2e677bc728b92e5463660d8b8d9ed8?d=identicon\u0026s=64",
      "cl": "319918@main",
      "clUrl": "https://commits.webkit.org/319918@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321725\nrdar://184859143\n\nReviewed by Pascoe.\n\nWidens IP address space classification beyond the ranges the Local Network Access spec\nenumerates, and replaces string comparison on the host with a prefix-table match over raw\naddress bytes. See https://wicg.github.io/local-network-access/#ip-address-space-section and\nhttps://github.com/WICG/local-network-access/issues/6, /issues/13 and /issues/15.\n\nThe previous implementation compared host strings (`host == \"::1\"`, `host.contains(':')`),\nwhich missed equivalent spellings of the same address -- `::1` and `0:0:0:0:0:0:0:1` are the\nsame host. Parsing to bytes and matching a prefix table classifies all spellings of an\naddress identically.\n\nClassifying a range as public is the permissive answer here: the check fires only when the\ntarget is less public than the client, so a range left public is reachable from a public page\nwith no permission at all. None of the ranges below can host a publicly-served site.\n\nRanges added beyond the spec, each covered by a test:\n  - as loopback: 0.0.0.0/32 (this host, RFC 1122), 198.18.0.0/15 (benchmarking, RFC 2544),\n    ::/128 (IPv6 unspecified, RFC 4291)\n  - as local: 0.0.0.0/8 (this network, RFC 791), 100.64.0.0/10 (carrier-grade NAT, RFC 6598),\n    192.0.0.0/24 (IETF protocol assignments, RFC 6890), 192.0.2.0/24, 198.51.100.0/24,\n    203.0.113.0/24 (documentation, RFC 5737), 192.88.99.0/24 (deprecated 6to4 relay anycast,\n    RFC 7526), 224.0.0.0/4 (multicast), 240.0.0.0/4 (reserved, RFC 1112)\n  - as local, IPv6: fec0::/10 (deprecated site-local, RFC 3879), 2001:db8::/32 and 3fff::/20\n    (documentation, RFC 3849 and RFC 9637), ff00::/8 (multicast, RFC 4291), 0100::/64\n    (discard-only, RFC 6666)\n  - IPv4-mapped IPv6 forms, which now classify as their embedded IPv4 address does\n  - NAT64 (RFC 6052), which likewise classifies as the IPv4 address it carries: the Well-Known\n    Prefix 64:ff9b::/96, and 64:ff9b:1::/48 reserved for local use (RFC 8215). Without this a\n    public page could reach a private host through a NAT64 prefix with no permission. At /48 the\n    embedded address straddles the octet at bits 64-71 that the addressing architecture reserves,\n    so 64:ff9b:1:c0a8:1:100:: carries 192.168.1.1. An operator's network-specific prefix cannot be\n    recognised here, so only these two fixed prefixes are handled.\n\nAlso recognises localhost and .local by name, which the previous host-string path did not.\n\nNon-dotted IPv4 hosts are canonicalised by the URL parser before classification sees them, so\nhttp://2130706433/ and http://0x7f000001/ arrive as 127.0.0.1. Asserted rather than assumed, since\nclassifyHost() only parses dotted quads and would return Public for any form the parser stopped\nnormalising.\n\nAdds Tests/WebCore/IPAddressSpaceTests.cpp to Tools/TestWebKitAPI/CMakeLists.txt. It was never\nlisted, so every CMake port has been skipping these tests entirely.\n\nAlso gates BrowsingContextGroup's shared-process exclusion on the LocalNetworkAccessEnabled\npreference. Widening the classifier changes what isLoopbackOrLocalNetworkSite() returns, and\nwithout the gate that would alter site-isolation process placement for embedders with the\nfeature off. Ordinary hostnames are unaffected either way: classifyHost() returns Public for\nanything that is not an address literal, so only literals, localhost and .local names are\nexcluded from the shared process.\n\nTwo entry points share the tables: determineIPAddressSpace(URL/Site), used before any\nconnection exists by fetch()'s targetAddressSpace derivation and site-isolation process\nplacement; and classifyIPAddressSpace(IPAddress), used for a resolved peer address.\n\nNo behaviour change with LocalNetworkAccessEnabled off.\n\n* Source/WebCore/Modules/fetch/IPAddressSpace.cpp:\n(WebCore::matchesPrefix):\n(WebCore::classifyAddress):\n(WebCore::classifyIPv4Address):\n(WebCore::nat64EmbeddedIPv4Address):\n(WebCore::classifyIPv6Address):\n(WebCore::determineIPAddressSpaceFromHost):\n* Source/WebKit/UIProcess/BrowsingContextGroup.cpp:\n(WebKit::isLoopbackOrLocalNetworkSite):\n(WebKit::BrowsingContextGroup::sharedProcessForSite):\n* Tools/TestWebKitAPI/CMakeLists.txt:\n* Tools/TestWebKitAPI/Tests/WebCore/IPAddressSpaceTests.cpp:\n\nCanonical link: https://commits.webkit.org/319918@main",
      "email": "i_gower@apple.com",
      "hash": "c7a6160aac237c2d5392fe0fcc5ba8920d002e4a",
      "subject": "Classify address spaces beyond the ranges in the Local Network Access spec"
    },
    "319919@main": {
      "author": "Adrian Perez de Castro",
      "avatar": "https://www.gravatar.com/avatar/30ffea8cf404586741a8f5f7110c0914?d=identicon\u0026s=64",
      "cl": "319919@main",
      "clUrl": "https://commits.webkit.org/319919@main",
      "description": "* Source/cmake/OptionsWPE.cmake:\n\nCanonical link: https://commits.webkit.org/319919@main",
      "email": "aperez@igalia.com",
      "hash": "b5d5bff09efd04c057a1199d3b85e4cf09bb5b07",
      "subject": "Unreviewed. [WPE] Bump version numbers"
    },
    "319920@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "319920@main",
      "clUrl": "https://commits.webkit.org/319920@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322621\nrdar://problem/185923771\n\nReviewed by Brent Fulgham.\n\nWe currently have a member variable to keep track of the number of\ntracks in the grid axis as well as a list of the running positions in\nthe grid. However, there is exactly one running position per track in\nthe grid axis so the former is redundant since it is captured in the\nsize of the Vector for the running positions. So we can just drop the\nmember variable dedicated for the the grid axis tracks count and derive\nit from the size of the Vector.\n\nCanonical link: https://commits.webkit.org/319920@main",
      "email": "sammy.gill@apple.com",
      "hash": "53d02d6d6e07ddcd52cccc5b2fb34033db7f68a2",
      "subject": "[Grid Lanes][Cleanup] Grid axis track count member variable is redundant."
    },
    "319921@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "319921@main",
      "clUrl": "https://commits.webkit.org/319921@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322392\n\nReviewed by Yusuke Suzuki and Ryosuke Niwa.\n\nWhen fetching a module script, we never set a referrer on the request, so the load fell back to the\nfetch client's outgoing referrer: the document URL for documents, and the global scope URL for\nworkers and worklets (which, for a threaded worklet, is the URL of the window that created it).\n\nPer HTML, the referrer of a module fetch is the referring script's base URL: \"fetch the descendants\nof a module script\" passes \"module script's base URL\" as the referrer for each descendant, and\nHostLoadImportedModule likewise uses the referencing script's base URL for dynamic import(). Only a\nfetch with no referring script — a script element or worker top-level fetch — uses the fetch client's\nreferrer. Both Blink and Gecko implement this.\n\nThe referrer was not available where the fetch happens, because JSC's moduleLoaderFetch hook only\nreceives the module key. Pass the referring script's base URL through the hook as a String:\nJSModuleLoader::hostLoadImportedModule already resolves the specifier against the referring module's\nkey, and requestImportModule() has the importing script's base URL for dynamic import(). Both now\nforward it to JSModuleLoader::fetch(), which hands it to the host.\n\nScriptModuleLoader::fetch() maps a module key through responseURLFromRequestURL(), so a redirected\nimporter contributes its response URL. A dynamic import's base URL is already a response URL and is\nnot a key in that map, so it comes back unchanged. An inline module script has no URL of its own, its\nkey being a Symbol, so the hook passes the empty string and ScriptModuleLoader substitutes the\nscript's base URL — the same URL resolve() resolves its specifiers against, and not necessarily the\ndocument URL, since a \u003cbase\u003e element can move it. A null referrer means there is no referring script\nand keeps the previous behavior of falling back to the fetch client's outgoing referrer.\n\nThe two loaders apply it differently. WorkerModuleScriptLoader passes it as the ThreadableLoader\nreferrer rather than setting it on the ResourceRequest, since referrer and origin headers are only\nset after a preflight and DocumentThreadableLoader asserts the request carries neither.\nCachedScriptFetcher sets it on the request directly, but only for an HTTP(S) URL, because\nCachedResourceLoader::requestResource() calls updateHTTPRequestHeaders() only for those: on any other\nscheme the referrer would never have the referrer policy applied to it and would be sent unfiltered,\ne.g. to a URL scheme handler, even under Referrer-Policy: no-referrer. For an HTTP(S) request,\nCachedResourceRequest::updateReferrerAndOriginHeaders() prefers the pre-set referrer and applies the\nreferrer policy to it.\n\nTests: imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/module-import-referrer-base-url.html\n       imported/w3c/web-platform-tests/worklets/audio-worklet-referrer.https.html\n       imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/module-import-referrer.html\n       imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/referrer-strict-policies.sub.html\n       URLSchemeHandler.ModuleDescendantFetchDoesNotSendReferrer\n\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/module-import-referrer-base-url-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/module-import-referrer-base-url.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/module-import-referrer-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/referrer-strict-policies.sub-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/worklets/audio-worklet-referrer.https-expected.txt:\n* Source/JavaScriptCore/API/JSAPIGlobalObject.h:\n* Source/JavaScriptCore/API/JSAPIGlobalObject.mm:\n(JSC::JSAPIGlobalObject::moduleLoaderFetch):\n* Source/JavaScriptCore/jsc.cpp:\n(GlobalObject::moduleLoaderFetch):\n* Source/JavaScriptCore/runtime/GlobalObjectMethodTable.h:\n* Source/JavaScriptCore/runtime/JSModuleLoader.cpp:\n(JSC::moduleReferrer):\n(JSC::JSModuleLoader::loadModule):\n(JSC::JSModuleLoader::requestImportModule):\n(JSC::JSModuleLoader::fetch):\n(JSC::JSModuleLoader::hostLoadImportedModule):\n* Source/JavaScriptCore/runtime/JSModuleLoader.h:\n* Source/WebCore/bindings/js/CachedModuleScriptLoader.cpp:\n(WebCore::CachedModuleScriptLoader::load):\n* Source/WebCore/bindings/js/CachedModuleScriptLoader.h:\n* Source/WebCore/bindings/js/CachedScriptFetcher.cpp:\n(WebCore::CachedScriptFetcher::requestModuleScript const):\n(WebCore::CachedScriptFetcher::requestScriptWithCache const):\n* Source/WebCore/bindings/js/CachedScriptFetcher.h:\n(WebCore::CachedScriptFetcher::requestScriptWithCache):\n* Source/WebCore/bindings/js/JSDOMGlobalObject.cpp:\n(WebCore::JSDOMGlobalObject::moduleLoaderFetch):\n* Source/WebCore/bindings/js/JSDOMGlobalObject.h:\n* Source/WebCore/bindings/js/ScriptModuleLoader.cpp:\n(WebCore::ScriptModuleLoader::fetch):\n(WebCore::ScriptModuleLoader::responseURLFromRequestURL):\n(WebCore::ScriptModuleLoader::baseURLForScriptWithoutURL):\n* Source/WebCore/bindings/js/ScriptModuleLoader.h:\n* Source/WebCore/bindings/js/WorkerModuleScriptLoader.cpp:\n(WebCore::WorkerModuleScriptLoader::load):\n* Source/WebCore/bindings/js/WorkerModuleScriptLoader.h:\n* Source/WebCore/dom/ScriptElementCachedScriptFetcher.cpp:\n(WebCore::ScriptElementCachedScriptFetcher::requestModuleScript const):\n* Source/WebCore/dom/ScriptElementCachedScriptFetcher.h:\n* Source/WebCore/workers/WorkerScriptLoader.cpp:\n(WebCore::WorkerScriptLoader::loadAsynchronously):\n* Source/WebCore/workers/WorkerScriptLoader.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKURLSchemeHandler-1.mm:\n((URLSchemeHandler, ModuleDescendantFetchDoesNotSendReferrer)):\n\nCanonical link: https://commits.webkit.org/319921@main",
      "email": "cdumez@apple.com",
      "hash": "c8fdf5eb819d6b75b99ab2288ce2887d33326d27",
      "subject": "Descendant and dynamic module script fetches send the wrong Referer header"
    },
    "319922@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "319922@main",
      "clUrl": "https://commits.webkit.org/319922@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322474\n\nReviewed by Anne van Kesteren.\n\nDOMParser.parseFromString() must parse XML with XML scripting support disabled,\nso the resulting script elements have to stay inert. They did, but only by\naccident: the XML parser creates them with createdByParser = true, which makes\nthem parser-inserted, and ScriptElement::postConnectionSteps() skips\nparser-inserted scripts. Their \"already started\" flag was never set, because\nXMLDocumentParser::endElementNs() returns early -- before prepareScript() --\nwhen the document has no frame view.\n\nCloning drops parser-insertedness but copies \"already started\", so\ndocument.importNode() of an XML-parsed script produced a script element with\nneither flag set. Appending it to a live document ran it.\n\nThe HTML side doesn't have this problem: the HTML parser calls prepareScript(),\nwhich sets \"already started\" before bailing out at the \"no frame\" check, so\nHTML DOMParser documents already hand out inert clones.\n\nSet \"already started\" on script elements in the XML parser path that never\nprepares them, matching what HTMLConstructionSite does for the HTML fragment\nparser. This keys off isScriptElement() rather than a QualifiedName comparison,\nso prefixed script elements (\u003cxx:script\u003e) are covered too, and it honours\nParserContentPolicy::DoNotMarkAlreadyStarted so createContextualFragment()\nkeeps executing its scripts.\n\nThis also covers XML fragment parsing (XHTML innerHTML), whose scripts were\nlikewise only inert by virtue of being parser-inserted, as well as\nXMLHttpRequest.responseXML and XSLT result documents -- every XML parse where\nWebKit does not run scripts.\n\nFirefox marks these already started via nsXMLContentSink calling\nAttemptToExecute(); Chromium recently did the same in its XML parser, scoped to\nDOMParser documents. Also resyncs the test from upstream, which grew a subtest\ncovering the prefixed form.\n\n* LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-scripting-support-disabled-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-scripting-support-disabled.html:\n* Source/WebCore/dom/ScriptElement.h:\n(WebCore::ScriptElement::markAlreadyStarted):\n* Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp:\n(WebCore::XMLDocumentParser::endElementNs):\n\nCanonical link: https://commits.webkit.org/319922@main",
      "email": "cdumez@apple.com",
      "hash": "542a224086b9fb0e0ec89ffb7ba02ea2dfbb8194",
      "subject": "DOMParser-parsed XML script elements execute after being cloned"
    },
    "319923@main": {
      "author": "Jonathan Bedard",
      "avatar": "https://www.gravatar.com/avatar/24548a6c84377efe7594acc92601e839?d=identicon\u0026s=64",
      "cl": "319923@main",
      "clUrl": "https://commits.webkit.org/319923@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322667\nrdar://problem/185938701\n\nUnreviewed build fix.\n\n* Tools/TestWebKitAPI/Configurations/Base.xcconfig:\n\nCanonical link: https://commits.webkit.org/319923@main",
      "email": "jbedard@apple.com",
      "hash": "3ce67ec0a31b8ff06715127893fddc03b41ac4c5",
      "subject": "REGRESSION(319878@main): Broke ASan builds"
    },
    "319924@main": {
      "author": "Mark Lam",
      "avatar": "https://www.gravatar.com/avatar/87a4219a10aeda88757492c63da746de?d=identicon\u0026s=64",
      "cl": "319924@main",
      "clUrl": "https://commits.webkit.org/319924@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322664\nrdar://185937092\n\nUnreviewed build fix.\n\nReverting patch for \"Introducing Mya, a MemorY Analyzer, and libJavaScriptCoreTools.\"\n\n* Source/JavaScriptCore/CMakeLists.txt:\n* Source/JavaScriptCore/Configurations/Mya.xcconfig: Removed.\n* Source/JavaScriptCore/Configurations/TestLibJSCTools.xcconfig: Removed.\n* Source/JavaScriptCore/Configurations/libJavaScriptCoreTools.xcconfig: Removed.\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/Scripts/process-entitlements.sh:\n* Source/JavaScriptCore/corpse/CMakeLists.txt: Removed.\n* Source/JavaScriptCore/corpse/CorpseAddress.h: Removed.\n* Source/JavaScriptCore/corpse/CorpseByteParser.cpp: Removed.\n* Source/JavaScriptCore/corpse/CorpseByteParser.h: Removed.\n* Source/JavaScriptCore/corpse/CorpseClient.cpp: Removed.\n* Source/JavaScriptCore/corpse/CorpseClient.h: Removed.\n* Source/JavaScriptCore/corpse/CorpseError.cpp: Removed.\n* Source/JavaScriptCore/corpse/CorpseError.h: Removed.\n* Source/JavaScriptCore/corpse/CorpseExportsTrie.cpp: Removed.\n* Source/JavaScriptCore/corpse/CorpseExportsTrie.h: Removed.\n* Source/JavaScriptCore/corpse/CorpseProcess.cpp: Removed.\n* Source/JavaScriptCore/corpse/CorpseProcess.h: Removed.\n* Source/JavaScriptCore/corpse/CorpseRegion.cpp: Removed.\n* Source/JavaScriptCore/corpse/CorpseRegion.h: Removed.\n* Source/JavaScriptCore/corpse/CorpseSnapshot.cpp: Removed.\n* Source/JavaScriptCore/corpse/CorpseSnapshot.h: Removed.\n* Source/JavaScriptCore/corpse/CorpseSymbol.cpp: Removed.\n* Source/JavaScriptCore/corpse/CorpseSymbol.h: Removed.\n* Source/JavaScriptCore/corpse/CorpseThread.cpp: Removed.\n* Source/JavaScriptCore/corpse/CorpseThread.h: Removed.\n* Source/JavaScriptCore/corpse/testLibJSCTools.cpp: Removed.\n* Source/JavaScriptCore/corpse/tests/CorpseAddressTest.cpp: Removed.\n* Source/JavaScriptCore/corpse/tests/CorpseAddressTest.h: Removed.\n* Source/JavaScriptCore/corpse/tests/CorpseByteParserTest.cpp: Removed.\n* Source/JavaScriptCore/corpse/tests/CorpseByteParserTest.h: Removed.\n* Source/JavaScriptCore/corpse/tests/CorpseExportsTrieTest.cpp: Removed.\n* Source/JavaScriptCore/corpse/tests/CorpseExportsTrieTest.h: Removed.\n* Source/JavaScriptCore/corpse/tests/CorpseProcessTest.cpp: Removed.\n* Source/JavaScriptCore/corpse/tests/CorpseProcessTest.h: Removed.\n* Source/JavaScriptCore/corpse/tests/CorpseRegionTest.cpp: Removed.\n* Source/JavaScriptCore/corpse/tests/CorpseRegionTest.h: Removed.\n* Source/JavaScriptCore/corpse/tests/CorpseSnapshotTest.cpp: Removed.\n* Source/JavaScriptCore/corpse/tests/CorpseSnapshotTest.h: Removed.\n* Source/JavaScriptCore/corpse/tests/CorpseSymbolTest.cpp: Removed.\n* Source/JavaScriptCore/corpse/tests/CorpseSymbolTest.h: Removed.\n* Source/JavaScriptCore/corpse/tests/CorpseThreadTest.cpp: Removed.\n* Source/JavaScriptCore/corpse/tests/CorpseThreadTest.h: Removed.\n* Source/JavaScriptCore/corpse/tests/LibJSCToolsTestUtilities.cpp: Removed.\n* Source/JavaScriptCore/corpse/tests/LibJSCToolsTestUtilities.h: Removed.\n* Source/JavaScriptCore/mya/mya.cpp: Removed.\n* Source/JavaScriptCore/shell/CMakeLists.txt:\n* Source/JavaScriptCore/shell/PlatformCocoa.cmake:\n* Tools/CISupport/ews-build/steps.py:\n(RunJavaScriptCoreTests.runCommand):\n* Tools/Scripts/run-javascriptcore-tests:\n* Tools/Scripts/webkitperl/BuildSubproject.pm:\n* Tools/Scripts/webkitpy/common/config/ports.py:\n(JscOnlyPort.run_javascriptcore_tests_command):\n* Tools/Scripts/webkitpy/common/config/ports_unittest.py:\n(DeprecatedPortTest.test_jsconly_port):\n\nCanonical link: https://commits.webkit.org/319924@main",
      "email": "mark.lam@apple.com",
      "hash": "118f67766359c01f9d00b71bcbf985b2edb29b69",
      "subject": "Reverting 319904@main: Broke Simulator and Catalyst builds."
    },
    "319925@main": {
      "author": "Elliott Williams",
      "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64",
      "cl": "319925@main",
      "clUrl": "https://commits.webkit.org/319925@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322660\nrdar://185932894\n\nReviewed by Jonathan Bedard.\n\nRemove the 2024 OSes from WebKitLibraries/SDKs. This includes SDKs for\nolder but still supported releases of macOS, since these are now built\nback-deployed from a modern SDK.\n\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/SDKSettings.plist: Removed.\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/SymlinkedHeaders-output.xcfilelist: Removed.\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/SymlinkedHeaders.xcfilelist: Removed.\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/System/Library/Frameworks/IOKit.framework/IOKit.tbd: Removed.\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit.tbd: Removed.\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/System/Library/Frameworks/IOKit.framework/Versions/Current: Removed.\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/System/Library/Frameworks/LocalAuthentication.framework/LocalAuthentication.tbd: Removed.\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/System/Library/PrivateFrameworks/AppServerSupport.framework/AppServerSupport.tbd: Removed.\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/System/Library/PrivateFrameworks/AppSupport.framework/AppSupport.tbd: Removed.\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/System/Library/PrivateFrameworks/CorePrediction.framework/CorePrediction.tbd: Removed.\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/System/Library/PrivateFrameworks/FontServices.framework/libFontParser.tbd: Removed.\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/System/Library/PrivateFrameworks/FrontBoardServices.framework/FrontBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/System/Library/PrivateFrameworks/GraphicsServices.framework/GraphicsServices.tbd: Removed.\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/System/Library/PrivateFrameworks/IOSurfaceAccelerator.framework/IOSurfaceAccelerator.tbd: Removed.\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/System/Library/PrivateFrameworks/IdleTimerServices.framework/IdleTimerServices.tbd: Removed.\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/System/Library/PrivateFrameworks/PrototypeTools.framework/PrototypeTools.tbd: Removed.\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/System/Library/PrivateFrameworks/RemotePairingDevice.framework/RemotePairingDevice.tbd: Removed.\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/System/Library/PrivateFrameworks/RunningBoardServices.framework/RunningBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/System/Library/PrivateFrameworks/UIIntelligenceSupport.framework/UIIntelligenceSupport.tbd: Removed.\n* WebKitLibraries/SDKs/appletvos18.0-additions.sdk/usr/lib/swift/libswiftXPC.tbd: Removed.\n* WebKitLibraries/SDKs/appletvsimulator18.0-additions.sdk/SDKSettings.plist: Removed.\n* WebKitLibraries/SDKs/appletvsimulator18.0-additions.sdk/SymlinkedHeaders-output.xcfilelist: Removed.\n* WebKitLibraries/SDKs/appletvsimulator18.0-additions.sdk/SymlinkedHeaders.xcfilelist: Removed.\n* WebKitLibraries/SDKs/appletvsimulator18.0-additions.sdk/System/Library/PrivateFrameworks/AppServerSupport.framework/AppServerSupport.tbd: Removed.\n* WebKitLibraries/SDKs/appletvsimulator18.0-additions.sdk/System/Library/PrivateFrameworks/AppSupport.framework/AppSupport.tbd: Removed.\n* WebKitLibraries/SDKs/appletvsimulator18.0-additions.sdk/System/Library/PrivateFrameworks/CorePrediction.framework/CorePrediction.tbd: Removed.\n* WebKitLibraries/SDKs/appletvsimulator18.0-additions.sdk/System/Library/PrivateFrameworks/FontServices.framework/libFontParser.tbd: Removed.\n* WebKitLibraries/SDKs/appletvsimulator18.0-additions.sdk/System/Library/PrivateFrameworks/FrontBoardServices.framework/FrontBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/appletvsimulator18.0-additions.sdk/System/Library/PrivateFrameworks/GraphicsServices.framework/GraphicsServices.tbd: Removed.\n* WebKitLibraries/SDKs/appletvsimulator18.0-additions.sdk/System/Library/PrivateFrameworks/IdleTimerServices.framework/IdleTimerServices.tbd: Removed.\n* WebKitLibraries/SDKs/appletvsimulator18.0-additions.sdk/System/Library/PrivateFrameworks/PrototypeTools.framework/PrototypeTools.tbd: Removed.\n* WebKitLibraries/SDKs/appletvsimulator18.0-additions.sdk/System/Library/PrivateFrameworks/RunningBoardServices.framework/RunningBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/SDKSettings.plist: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/SymlinkedHeaders-output.xcfilelist: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/SymlinkedHeaders.xcfilelist: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/AppServerSupport.framework/AppServerSupport.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/AppStoreDaemon.framework/AppStoreDaemon.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/AppSupport.framework/AppSupport.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/ApplePushService.framework/ApplePushService.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/AuthKit.framework/AuthKit.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/BackBoardServices.framework/BackBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/CoreAnalytics.framework/CoreAnalytics.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/CorePrediction.framework/CorePrediction.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/FontServices.framework/libFontParser.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/FrontBoardServices.framework/FrontBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/GraphicsServices.framework/GraphicsServices.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/IOSurfaceAccelerator.framework/IOSurfaceAccelerator.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/IconServices.framework/IconServices.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/IdleTimerServices.framework/IdleTimerServices.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/InstallCoordination.framework/InstallCoordination.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/MobileKeyBag.framework/MobileKeyBag.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/PrototypeTools.framework/PrototypeTools.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/RemotePairingDevice.framework/RemotePairingDevice.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/RunningBoardServices.framework/RunningBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/SafariSafeBrowsing.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/SharedWebCredentials.framework/SharedWebCredentials.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/SpringBoardServices.framework/SpringBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/UIIntelligenceSupport.framework/UIIntelligenceSupport.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/UIKitServices.framework/UIKitServices.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/URLFormatting.framework/URLFormatting.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/VisionKitCore.framework/VisionKitCore.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/WritingTools.framework/WritingTools.tbd: Removed.\n* WebKitLibraries/SDKs/iphoneos18.0-additions.sdk/System/Library/PrivateFrameworks/WritingToolsUI.framework/WritingToolsUI.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/SDKSettings.plist: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/SymlinkedHeaders-output.xcfilelist: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/SymlinkedHeaders.xcfilelist: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/AppServerSupport.framework/AppServerSupport.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/AppStoreDaemon.framework/AppStoreDaemon.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/AppSupport.framework/AppSupport.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/ApplePushService.framework/ApplePushService.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/AuthKit.framework/AuthKit.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/BackBoardServices.framework/BackBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/CoreAnalytics.framework/CoreAnalytics.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/CorePrediction.framework/CorePrediction.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/FontServices.framework/libFontParser.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/FrontBoardServices.framework/FrontBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/GraphicsServices.framework/GraphicsServices.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/IconServices.framework/IconServices.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/IdleTimerServices.framework/IdleTimerServices.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/InstallCoordination.framework/InstallCoordination.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/PrototypeTools.framework/PrototypeTools.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/RunningBoardServices.framework/RunningBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/SafariSafeBrowsing.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/SharedWebCredentials.framework/SharedWebCredentials.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/SpringBoardServices.framework/SpringBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/UIIntelligenceSupport.framework/UIIntelligenceSupport.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/UIKitServices.framework/UIKitServices.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/URLFormatting.framework/URLFormatting.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/VisionKitCore.framework/VisionKitCore.tbd: Removed.\n* WebKitLibraries/SDKs/iphonesimulator18.0-additions.sdk/System/Library/PrivateFrameworks/WritingTools.framework/WritingTools.tbd: Removed.\n* WebKitLibraries/SDKs/macosx13.0-additions.sdk/SDKSettings.plist: Removed.\n* WebKitLibraries/SDKs/macosx13.0-additions.sdk/SymlinkedHeaders-output.xcfilelist: Removed.\n* WebKitLibraries/SDKs/macosx13.0-additions.sdk/SymlinkedHeaders.xcfilelist: Removed.\n* WebKitLibraries/SDKs/macosx13.0-additions.sdk/System/Library/PrivateFrameworks/AppleJPEGXL.framework/AppleJPEGXL.tbd: Removed.\n* WebKitLibraries/SDKs/macosx13.0-additions.sdk/System/Library/PrivateFrameworks/FontServices.framework/libFontParser.tbd: Removed.\n* WebKitLibraries/SDKs/macosx13.0.internal-additions.sdk/SDKSettings.plist: Removed.\n* WebKitLibraries/SDKs/macosx13.0.internal-additions.sdk/System/Library/PrivateFrameworks/AppleJPEGXL.framework/AppleJPEGXL.tbd: Removed.\n* WebKitLibraries/SDKs/macosx14.0-additions.sdk/SDKSettings.plist: Removed.\n* WebKitLibraries/SDKs/macosx14.0-additions.sdk/SymlinkedHeaders-output.xcfilelist: Removed.\n* WebKitLibraries/SDKs/macosx14.0-additions.sdk/SymlinkedHeaders.xcfilelist: Removed.\n* WebKitLibraries/SDKs/macosx14.0-additions.sdk/System/Library/PrivateFrameworks/FontServices.framework/libFontParser.tbd: Removed.\n* WebKitLibraries/SDKs/macosx15.0-additions.sdk/SDKSettings.plist: Removed.\n* WebKitLibraries/SDKs/macosx15.0-additions.sdk/SymlinkedHeaders-output.xcfilelist: Removed.\n* WebKitLibraries/SDKs/macosx15.0-additions.sdk/SymlinkedHeaders.xcfilelist: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/SDKSettings.plist: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/SymlinkedHeaders-output.xcfilelist: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/SymlinkedHeaders.xcfilelist: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/Frameworks/AudioToolbox.framework/AudioToolbox.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/Frameworks/CoreImage.framework/CoreImage.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/Frameworks/IOKit.framework/IOKit.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/Frameworks/IOKit.framework/Versions/Current: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/Frameworks/IOSurface.framework/IOSurface.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/Frameworks/Metal.framework/Metal.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/PrivateFrameworks/AppServerSupport.framework/AppServerSupport.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/PrivateFrameworks/AppSupport.framework/AppSupport.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/PrivateFrameworks/CorePrediction.framework/CorePrediction.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/PrivateFrameworks/FontServices.framework/libFontParser.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/PrivateFrameworks/FrontBoardServices.framework/FrontBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/PrivateFrameworks/GraphicsServices.framework/GraphicsServices.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/PrivateFrameworks/IOSurfaceAccelerator.framework/IOSurfaceAccelerator.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/PrivateFrameworks/IconServices.framework/IconServices.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/PrivateFrameworks/IdleTimerServices.framework/IdleTimerServices.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/PrivateFrameworks/PepperUICore.framework/PepperUICore.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/PrivateFrameworks/PrototypeTools.framework/PrototypeTools.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/PrivateFrameworks/RemotePairingDevice.framework/RemotePairingDevice.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/PrivateFrameworks/RunningBoardServices.framework/RunningBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/SafariSafeBrowsing.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/PrivateFrameworks/UIIntelligenceSupport.framework/UIIntelligenceSupport.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/System/Library/PrivateFrameworks/URLFormatting.framework/URLFormatting.tbd: Removed.\n* WebKitLibraries/SDKs/watchos11.0-additions.sdk/usr/lib/swift/libswiftXPC.tbd: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/SDKSettings.plist: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/SymlinkedHeaders-output.xcfilelist: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/SymlinkedHeaders.xcfilelist: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/System/Library/Frameworks/AudioToolbox.framework/AudioToolbox.tbd: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/System/Library/Frameworks/CoreImage.framework/CoreImage.tbd: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/System/Library/Frameworks/IOKit.framework/IOKit.tbd: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit.tbd: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/System/Library/Frameworks/IOKit.framework/Versions/Current: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/System/Library/Frameworks/IOSurface.framework/IOSurface.tbd: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/System/Library/Frameworks/Metal.framework/Metal.tbd: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/System/Library/PrivateFrameworks/AppServerSupport.framework/AppServerSupport.tbd: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/System/Library/PrivateFrameworks/AppSupport.framework/AppSupport.tbd: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/System/Library/PrivateFrameworks/CorePrediction.framework/CorePrediction.tbd: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/System/Library/PrivateFrameworks/FontServices.framework/libFontParser.tbd: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/System/Library/PrivateFrameworks/FrontBoardServices.framework/FrontBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/System/Library/PrivateFrameworks/GraphicsServices.framework/GraphicsServices.tbd: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/System/Library/PrivateFrameworks/IconServices.framework/IconServices.tbd: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/System/Library/PrivateFrameworks/IdleTimerServices.framework/IdleTimerServices.tbd: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/System/Library/PrivateFrameworks/PepperUICore.framework/PepperUICore.tbd: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/System/Library/PrivateFrameworks/PrototypeTools.framework/PrototypeTools.tbd: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/System/Library/PrivateFrameworks/RunningBoardServices.framework/RunningBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/SafariSafeBrowsing.tbd: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/System/Library/PrivateFrameworks/UIIntelligenceSupport.framework/UIIntelligenceSupport.tbd: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/System/Library/PrivateFrameworks/URLFormatting.framework/URLFormatting.tbd: Removed.\n* WebKitLibraries/SDKs/watchsimulator11.0-additions.sdk/usr/lib/swift/libswiftXPC.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/AppleInternal/Developer/Library/Frameworks/Testing.framework/Testing.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/Developer/usr/lib/libXCTestSwiftSupport.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/SDKSettings.plist: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/SymlinkedHeaders-output.xcfilelist: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/SymlinkedHeaders.xcfilelist: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/AppServerSupport.framework/AppServerSupport.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/AppStoreDaemon.framework/AppStoreDaemon.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/AppSupport.framework/AppSupport.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/ApplePushService.framework/ApplePushService.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/AuthKit.framework/AuthKit.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/BackBoardServices.framework/BackBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/BaseBoard.framework/BaseBoard.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/CorePrediction.framework/CorePrediction.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/CoreRE.framework/CoreRE.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/FontServices.framework/libFontParser.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/FrontBoardServices.framework/FrontBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/GraphicsServices.framework/GraphicsServices.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/IOSurfaceAccelerator.framework/IOSurfaceAccelerator.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/IconServices.framework/IconServices.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/IdleTimerServices.framework/IdleTimerServices.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/InstallCoordination.framework/InstallCoordination.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/LinearMediaKit.framework/LinearMediaKit.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/MRUIKit.framework/MRUIKit.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/PrototypeTools.framework/PrototypeTools.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/RemotePairingDevice.framework/RemotePairingDevice.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/RunningBoardServices.framework/RunningBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/SafariSafeBrowsing.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/UIIntelligenceSupport.framework/UIIntelligenceSupport.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/URLFormatting.framework/URLFormatting.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/VisionKitCore.framework/VisionKitCore.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/System/Library/PrivateFrameworks/WritingTools.framework/WritingTools.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/usr/lib/swift/libswiftGLKit.tbd: Removed.\n* WebKitLibraries/SDKs/xros2.0-additions.sdk/usr/lib/swift/libswiftXPC.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/SDKSettings.plist: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/SymlinkedHeaders-output.xcfilelist: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/SymlinkedHeaders.xcfilelist: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/AppServerSupport.framework/AppServerSupport.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/AppStoreDaemon.framework/AppStoreDaemon.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/AppSupport.framework/AppSupport.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/ApplePushService.framework/ApplePushService.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/AuthKit.framework/AuthKit.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/BackBoardServices.framework/BackBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/BaseBoard.framework/BaseBoard.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/CorePrediction.framework/CorePrediction.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/CoreRE.framework/CoreRE.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/FontServices.framework/libFontParser.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/FrontBoardServices.framework/FrontBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/GraphicsServices.framework/GraphicsServices.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/IconServices.framework/IconServices.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/IdleTimerServices.framework/IdleTimerServices.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/InstallCoordination.framework/InstallCoordination.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/LinearMediaKit.framework/LinearMediaKit.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/MRUIKit.framework/MRUIKit.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/PrototypeTools.framework/PrototypeTools.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/RunningBoardServices.framework/RunningBoardServices.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/SafariSafeBrowsing.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/UIIntelligenceSupport.framework/UIIntelligenceSupport.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/URLFormatting.framework/URLFormatting.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/VisionKitCore.framework/VisionKitCore.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/System/Library/PrivateFrameworks/WritingTools.framework/WritingTools.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/usr/lib/swift/libswiftGLKit.tbd: Removed.\n* WebKitLibraries/SDKs/xrsimulator2.0-additions.sdk/usr/lib/swift/libswiftXPC.tbd: Removed.\n\nCanonical link: https://commits.webkit.org/319925@main",
      "email": "emw@apple.com",
      "hash": "bc9bb88ad05a2666d4bab1a3dee1905db07f5acc",
      "subject": "[Build] Remove SDK additions for unsupported OS versions"
    },
    "319926@main": {
      "author": "Andy Estes",
      "avatar": "https://www.gravatar.com/avatar/643f10f01b26fd94d03482a2013b2ea0?d=identicon\u0026s=64",
      "cl": "319926@main",
      "clUrl": "https://commits.webkit.org/319926@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318837\nrdar://177356913\n\nReviewed by Eric Carlson.\n\nLogger stores raw references to observers in Logger::observers(), so the observer is responsible\nfor removing itself from Logger::observers() prior to destruction. Modified MediaSource's\ndestructor do call Logger::removeObserver, and modified Logger::Observer's destructor to\nRELEASE_ASSERT that the observer has been removed.\n\nTest: media/media-source/worker/media-source-worker-logger-observer-crash.html\n\n* LayoutTests/media/media-source/worker/media-source-worker-logger-observer-crash-expected.txt: Added.\n* LayoutTests/media/media-source/worker/media-source-worker-logger-observer-crash.html: Added.\n* Source/WTF/wtf/Logger.cpp:\n(WTF::Logger::Observer::assertIsNotRegistered const):\n* Source/WTF/wtf/Logger.h:\n(WTF::Logger::Observer::~Observer):\n* Source/WebCore/Modules/mediasource/MediaSource.cpp:\n(WebCore::MediaSource::~MediaSource):\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::configureLoggingChannel):\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\n\nOriginally-landed-as: 305413.1106@safari-7624.5-branch (ed0a2c844690). rdar://185368565\nCanonical link: https://commits.webkit.org/319926@main",
      "email": "aestes@apple.com",
      "hash": "d3699b58389400a9357d99a530102b809da42d6e",
      "subject": "MediaSource should remove itself as a Logger observer on destruction"
    },
    "319928@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "319928@main",
      "clUrl": "https://commits.webkit.org/319928@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322619\nrdar://185922475\n\nReviewed by Keith Miller.\n\nAfter M5, we introduced Super Cores, and we may have three categories,\nSuper, Performance, and Efficiency. And in M6, we started splitting\nPerformance into Super and Performance, so it can have these three\ncategories on one device. But the current code is only detecting P0 and\nP1, and they can be mapped differently based on devices. Sometimes P0 is\nSuper and P1 is Performance. Sometimes, P0 is Performance and P1 is\nEfficiency. So just checking P0 and P1 are wrong metrics.\n\nThis patch introduces CoreCategory and collecting each core number\naccurately.\n\n* Source/JavaScriptCore/assembler/CPU.cpp:\n(JSC::sysctlInt32):\n(JSC::categoryFromPerfLevelName):\n(JSC::categoryFromPerfLevelIndex):\n(JSC::hwNumberOfCores):\n(JSC::hwPerfLevelPhysicalCPUMax): Deleted.\n(JSC::hwNumberOfP0Cores): Deleted.\n(JSC::hwNumberOfP1Cores): Deleted.\n(JSC::hwNumberOfP2Cores): Deleted.\n* Source/JavaScriptCore/assembler/CPU.h:\n* Source/JavaScriptCore/runtime/Options.cpp:\n(JSC::numberOfSuperAndPerformanceCores):\n(JSC::overrideDefaults):\n* Source/JavaScriptCore/runtime/OptionsList.h:\n\nCanonical link: https://commits.webkit.org/319928@main",
      "email": "ysuzuki@apple.com",
      "hash": "d9d2fbd881a5ee2ca3a91e3e3c49709280c4873e",
      "subject": "[JSC] Detect CPU core configurations more accurately"
    },
    "319929@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "319929@main",
      "clUrl": "https://commits.webkit.org/319929@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322620\nrdar://problem/185923265\n\nReviewed by Alan Baradlay.\n\nRenderGrid::layoutGrid() returns as soon as layoutUsingGridFormattingContext() succeeds,\nwhich skips the legacy computeInFlowOverflow() and addOverflowFromOutOfFlowBoxes() calls.\nGridLayout::updateOverflow() only added visual overflow, so nothing a grid container\ncontains ever extended its scrollable overflow area. An ancestor scroller would report a\nscrollWidth/scrollHeight that ignored the grid's contents, leaving that content\nunreachable.\n\nAccumulate the scrollable overflow area alongside the visual overflow rect and hand it to\naddLayoutOverflow(). The grid items and the out-of-flow boxes which the grid container is\nthe containing block for are collected separately, since they are two distinct sources.\n\nBoth use layoutOverflowRectForPropagation(), which already starts from the box's border\nbox and accounts for layout containment, the single-axis overflow: clip cases, a grid\nitem's margin-end contribution, and the paint geometry of relatively positioned and\ntransformed boxes. A grid item's own subtree is laid out outside of the grid formatting\ncontext, so the overflow it generates is only available from the renderer. Fixed\npositioned boxes are skipped because they do not scroll with the content.\n\nTest: imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-from-grid-container-contents.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-from-grid-container-contents-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/scrollable-overflow-from-grid-container-contents.html: Added.\n* Source/WebCore/layout/integration/grid/LayoutIntegrationGridLayout.cpp:\n(WebCore::LayoutIntegration::GridLayout::updateOverflow): Compute the scrollable overflow\narea from the grid items and from the out-of-flow boxes the grid container contains, in\naddition to the visual overflow rect.\n\nCanonical link: https://commits.webkit.org/319929@main",
      "email": "sammy.gill@apple.com",
      "hash": "ccdac12e77a9fb9a990d03335aadbe84efcc76c3",
      "subject": "[GFC][Integration] Grid content does not contribute to the scrollable overflow area"
    },
    "319930@main": {
      "author": "Cole Carley",
      "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64",
      "cl": "319930@main",
      "clUrl": "https://commits.webkit.org/319930@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322674\nrdar://185947168\n\nReviewed by Brent Fulgham.\n\nThis patch moves the Quirk table to it's own file.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/Quirks.cpp\n\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/page/QuirkMatch.cpp:\n(WebCore::Quirk::apply const): Deleted.\n* Source/WebCore/page/QuirkMatch.h:\n(WebCore::QuirkBehaviors::QuirkBehaviors): Deleted.\n* Source/WebCore/page/QuirkTable.cpp: Added.\n(WebCore::Quirk::apply const):\n(WebCore::resolveSiteSpecificQuirks):\n* Source/WebCore/page/QuirkTable.h: Added.\n(WebCore::QuirkBehaviors::QuirkBehaviors):\n* Source/WebCore/page/Quirks.cpp:\n* Tools/TestWebKitAPI/Tests/WebCore/Quirks.cpp:\n\nCanonical link: https://commits.webkit.org/319930@main",
      "email": "ccarley2@apple.com",
      "hash": "126d3c1f11726e714a9cc189a78ade51f48ab85d",
      "subject": "[Quirks] Move the Quirk table to it's own file"
    },
    "319931@main": {
      "author": "Anne van Kesteren",
      "avatar": "https://www.gravatar.com/avatar/09bb44ac3625a121017cd98d0a7dc52c?d=identicon\u0026s=64",
      "cl": "319931@main",
      "clUrl": "https://commits.webkit.org/319931@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322177\n\nReviewed by Abrar Rahman Protyasha, Aditya Keerthi, and Lily Spiniolas.\n\nThis effect is not desired.\n\nCanonical link: https://commits.webkit.org/319931@main",
      "email": "annevk@annevk.nl",
      "hash": "c2eb0516718010367f1bde2e707e1b9a360e3783",
      "subject": "\u003cinput type=checkbox switch\u003e: stop tinting a pressed thumb on macOS"
    },
    "319932@main": {
      "author": "Anne van Kesteren",
      "avatar": "https://www.gravatar.com/avatar/09bb44ac3625a121017cd98d0a7dc52c?d=identicon\u0026s=64",
      "cl": "319932@main",
      "clUrl": "https://commits.webkit.org/319932@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322591\n\nReviewed by Chris Dumez.\n\nThe name lookup in \"the rules for choosing a navigable\" ignores noopener, so\nwindow.open() can reuse an existing navigable when noopener is set. Two things\nwere wrong when it did: the reused navigable got its opener set to the caller,\nand _self returned null instead of that navigable. _parent and _top were already\ncorrect, as open() resolves them without reaching createWindow().\n\nSpec changes: https://github.com/whatwg/html/pull/12845\n\nTests: imported/w3c/web-platform-tests/html/browsers/the-window-object/window-open-noopener-existing-iframe.html\n       imported/w3c/web-platform-tests/html/browsers/the-window-object/window-open-noopener.html\n\nTests upstream: https://github.com/web-platform-tests/wpt/pull/62213\n\nCanonical link: https://commits.webkit.org/319932@main",
      "email": "annevk@annevk.nl",
      "hash": "075a8d041b63a6ae6a4cc690e2f96dd635914df9",
      "subject": "window.open() with noopener should not always return null"
    },
    "319933@main": {
      "author": "Said Abou-Hallawa",
      "avatar": "https://www.gravatar.com/avatar/ae80a929a378a055822829ae63903296?d=identicon\u0026s=64",
      "cl": "319933@main",
      "clUrl": "https://commits.webkit.org/319933@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316439\nrdar://176382472\n\nReviewed by Simon Fraser.\n\nRemoteRenderingBackend::allocateImageBuffer() is called from\n1. RemoteRenderingBackend::createImageBuffer()\n2. RemoteImageBufferSet::ensureBufferForDisplay().\n\nIn 311931@main, which fixes bug 307843, a MESSAGE_CHECK() was added in\nRemoteRenderingBackend::allocateImageBuffer() to prevent creating a remote\nImageBufferDisplayListBackend. But this change left the call from\nRemoteImageBufferSet::ensureBufferForDisplay().\n\nThe fix is to move the MESSAGE_CHECK from RemoteRenderingBackend::createImageBuffer()\nto RemoteRenderingBackend::allocateImageBuffer().\n\n* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp:\n(WebKit::RemoteRenderingBackend::allocateImageBuffer):\n(WebKit::RemoteRenderingBackend::createImageBuffer):\n\nOriginally-landed-as: 305413.1016@safari-7624.5-branch (33120ad29238). rdar://185369537\nCanonical link: https://commits.webkit.org/319933@main",
      "email": "said@apple.com",
      "hash": "d9bb3e407db807fe781871c581674ab117cd2187",
      "subject": "RemoteRenderingBackend can still allocateImageBuffer() with RenderingMode::DisplayList"
    },
    "319934@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "319934@main",
      "clUrl": "https://commits.webkit.org/319934@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322369\n\nReviewed by Yusuke Suzuki.\n\nFTL::OSRExitDescriptor::m_values is a FixedOperands\u003cExitValue\u003e with one 9 byte\nentry per argument, local and tmp of the whole inline stack, and it is kept for\nas long as the FTL code lives. Most entries carry almost no information. On\nJetStream3 (5,455 FTL compiles, 161,428 descriptors, 60 entries per descriptor\non average) 83% of the entries are Dead, 4% are arguments flushed to their own\nstack slot, and 4% are constants of which only 7% are distinct within one\nJITCode. The dense arrays hold 86 MB over the run, 15.5 KB per FTL compile,\nwhich makes them the largest part of the per-CodeBlock footprint of FTL code.\n\nThis patch replaces the dense array with OSRExitValues, which stores the same\ninformation as a tag + payload byte stream; the format is described in the\ncomment above the class in FTLOSRExit.h. Dead values are run-length encoded\nand constants are shared through a per-JITCode table. LowerDFGToB3 builds the\nOperands\u003cExitValue\u003e as before and encodes it once. operationCompileFTLOSRExit\ndecodes the stream into a stack-local FixedOperands\u003cExitValue\u003e and passes it to\ncompileStub; this runs once per exit site, so the rest of the exit compiler is\nunchanged. The localsOffset adjustment that FTL::compile applied to every entry\nof every descriptor is now stored once in FTL::JITCode and applied while\ndecoding.\n\nOn the same JetStream3 run the byte streams and constant tables total 4.77 MB\n(0.50 bytes per entry, -94.5%), 0.85 KB per FTL compile. Encoding takes 122 ns\nper descriptor (0.3% of the FTL lowering time) and decoding 104 ns per exit stub\n(1.3% of compileStub).\n\n* Source/JavaScriptCore/ftl/FTLCompile.cpp:\n* Source/JavaScriptCore/ftl/FTLExitValue.h:\n* Source/JavaScriptCore/ftl/FTLJITCode.cpp:\n* Source/JavaScriptCore/ftl/FTLJITCode.h:\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n* Source/JavaScriptCore/ftl/FTLOSRExit.cpp:\n* Source/JavaScriptCore/ftl/FTLOSRExit.h:\n* Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp:\n\nCanonical link: https://commits.webkit.org/319934@main",
      "email": "sosuke@bun.sh",
      "hash": "580b6dade24924fbe758fc530211de0faf00fb43",
      "subject": "[JSC] Store `OSRExitDescriptor` exit values as a compact byte stream"
    },
    "319935@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "319935@main",
      "clUrl": "https://commits.webkit.org/319935@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322371\n\nReviewed by Yusuke Suzuki.\n\nDFGFixupPhase cleared NodeMustGenerate on these nodes even when it had just\nselected Arith::CheckOverflow or Arith::CheckOverflowAndNegativeZero. The\nabstract interpreter then proves the result is Int32 (and not -0) on the\nstrength of that check, folds users such as `(y | 0) === y` to constants, and\nMovHintRemoval + DCE delete the node together with the check that justified the\nproof. This is the same shape as bug 315213 for Inc / Dec.\n\nClear NodeMustGenerate only on the Arith::Unchecked branches, which DFGMayExit\nalready treats as non-exiting, so the DCE introduced for unused unchecked\ndiv / mod is preserved. Int52 ArithMul / ArithNegate have no unchecked mode and\nkeep NodeMustGenerate unconditionally.\n\nTest: JSTests/stress/arith-checked-int-must-generate-dce.js\n\n* JSTests/stress/arith-checked-int-must-generate-dce.js: Added.\n(shouldBe):\n(mulOverflow):\n(mulNegativeZero):\n(divNonInteger):\n(modNegativeZero):\n(negateOverflow):\n(negateNegativeZero):\n(absOverflow):\n* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:\n(JSC::DFG::FixupPhase::fixupArithDivInt32):\n(JSC::DFG::FixupPhase::fixupArithDiv):\n(JSC::DFG::FixupPhase::fixupArithMul):\n(JSC::DFG::FixupPhase::fixupNode):\n\nCanonical link: https://commits.webkit.org/319935@main",
      "email": "sosuke@bun.sh",
      "hash": "9f3eea6f466175106d4e9073964cd4bb000895dc",
      "subject": "[JSC] `DFGFixupPhase` should not clear `NodeMustGenerate` on checked arith nodes"
    },
    "319936@main": {
      "author": "Kiet Ho",
      "avatar": "https://www.gravatar.com/avatar/d9058b37006dce1f55f91b8ccc82f9a3?d=identicon\u0026s=64",
      "cl": "319936@main",
      "clUrl": "https://commits.webkit.org/319936@main",
      "description": "rdar://184664687\nhttps://bugs.webkit.org/show_bug.cgi?id=321556\n\nReviewed by Tim Nguyen and Antti Koivisto.\n\n@supports at-rule() doesn't take into account when an at-rule is controlled by\na feature flag. For example, @function is controlled by CSSFunctionAtRuleEnabled,\nso it's only supported when CSSFunctionAtRuleEnabled is enabled, but\n`@supports at-rule(@function)` returns true at all time.\n\nFix it so that @supports at-rule() consults the feature flag if an at-rule is\ncontrolled by one.\n\nTest: css3/supports-at-rule-when-feature-flag-disabled.html\n\n* LayoutTests/css3/supports-at-rule-when-feature-flag-disabled-expected.txt: Added.\n* LayoutTests/css3/supports-at-rule-when-feature-flag-disabled.html: Added.\n* Source/WebCore/css/parser/CSSSupportsParser.cpp:\n(WebCore::CSSSupportsParser::consumeSupportsAtRuleFunction):\n\nCanonical link: https://commits.webkit.org/319936@main",
      "email": "kiet.ho@apple.com",
      "hash": "0ba64924f939b269a8acda143660ea80eec4161e",
      "subject": "[css-conditional-5] @supports at-rule should check whether an at-rule is enabled via feature flags"
    },
    "319937@main": {
      "author": "Tadeu Zagallo",
      "avatar": "https://www.gravatar.com/avatar/d517fd5480efde083cc7b6af36c73ced?d=identicon\u0026s=64",
      "cl": "319937@main",
      "clUrl": "https://commits.webkit.org/319937@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322405\nrdar://183462752\n\nReviewed by Yusuke Suzuki.\n\nsetMemory() anchors an instance on every imported memory's BufferMemoryHandle, so\ngrowing a shared memory reaches every instance that imported it, on every thread,\nand updateCachedMemories() reloaded all of that instance's memories -- including\nits non-shared siblings. Those belong to the thread that owns the instance, whose\nown Memory::grow() frees the old handle when it swaps it in BoundsChecking mode.\nThe two share no lock, so the refresh reads a freed handle, and what it caches is\nthe {base, boundsCheckingSize} pair the JIT bounds every access with.\n\nRefresh only the slots backed by the memory that grew, matched on\nWasm::Memory::shared(), which is fixed at creation -- so the comparison reads\nimmutable state instead of a sibling handle.\n\nMemory::grow() keeps the full refresh for the non-shared case: every anchor on a\nnon-shared handle is an instance on the growing thread, and the shared memories\nthose instances also import are safe to read concurrently, since growing a shared\nmemory never frees its handle.\n\nTest: JSTests/wasm/stress/multimemory-shared-grow-refreshes-only-its-own-slots.js\n\n* JSTests/wasm/stress/multimemory-shared-grow-refreshes-only-its-own-slots.js: Added.\n* Source/JavaScriptCore/runtime/ArrayBuffer.cpp:\n(JSC::SharedArrayBufferContents::tryGrow):\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h:\n\nCanonical link: https://commits.webkit.org/319937@main",
      "email": "tzagallo@apple.com",
      "hash": "4002a938c8699bcd479e7b3cb998a9675738c8a1",
      "subject": "[JSC][Wasm] Growing a shared memory reads its instances' sibling memory handles across threads"
    },
    "319938@main": {
      "author": "Carlos Garcia Campos",
      "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64",
      "cl": "319938@main",
      "clUrl": "https://commits.webkit.org/319938@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322590\n\nReviewed by Nikolas Zimmermann.\n\nThey are actually classes to handle EGL textures, nothing specific to\ntexture mapper.\n\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/PlatformPlayStation.cmake:\n* Source/WebCore/PlatformWin.cmake:\n* Source/WebCore/SourcesGTK.txt:\n* Source/WebCore/SourcesWPE.txt:\n* Source/WebCore/platform/SourcesSkia.txt:\n* Source/WebCore/platform/TextureMapper.cmake:\n* Source/WebCore/platform/graphics/egl/BitmapTexture.cpp: Renamed from Source/WebCore/platform/graphics/texmap/BitmapTexture.cpp.\n(WebCore::BitmapTexture::determineRenderTargetAndBinding):\n(WebCore::BitmapTexture::textureFormat const):\n(WebCore::depthBufferFormat):\n(WebCore::BitmapTexture::BitmapTexture):\n(WebCore::BitmapTexture::createTexture):\n(WebCore::BitmapTexture::allocateTexture):\n(WebCore::BitmapTexture::sizeInBytes const):\n(WebCore::BitmapTexture::allocatedSize const):\n(WebCore::BitmapTexture::allocateTextureFromMemoryMappedGPUBuffer):\n(WebCore::BitmapTexture::swapTexture):\n(WebCore::BitmapTexture::reset):\n(WebCore::BitmapTexture::updateContents):\n(WebCore::BitmapTexture::initializeStencil):\n(WebCore::BitmapTexture::initializeDepthBuffer):\n(WebCore::BitmapTexture::clearIfNeeded):\n(WebCore::BitmapTexture::createFboIfNeeded):\n(WebCore::BitmapTexture::bindAsSurface):\n(WebCore::BitmapTexture::~BitmapTexture):\n(WebCore::BitmapTexture::copyFromExternalTexture):\n(WebCore::BitmapTexture::colorConvertFlags const):\n(WebCore::BitmapTexture::createSkiaBackendTexture const):\n(WebCore::BitmapTexture::createSkiaSurface const):\n* Source/WebCore/platform/graphics/egl/BitmapTexture.h: Renamed from Source/WebCore/platform/graphics/texmap/BitmapTexture.h.\n* Source/WebCore/platform/graphics/egl/BitmapTexturePool.cpp: Renamed from Source/WebCore/platform/graphics/texmap/BitmapTexturePool.cpp.\n(WebCore::BitmapTexturePool::singleton):\n(WebCore::BitmapTexturePool::BitmapTexturePool):\n(WebCore::BitmapTexturePool::acquireTexture):\n(WebCore::BitmapTexturePool::createTextureForImage):\n(WebCore::BitmapTexturePool::scheduleReleaseUnusedTextures):\n(WebCore::BitmapTexturePool::releaseUnusedTexturesTimerFired):\n(WebCore::BitmapTexturePool::enterLimitExceededModeIfNeeded):\n(WebCore::BitmapTexturePool::exitLimitExceededModeIfNeeded):\n* Source/WebCore/platform/graphics/egl/BitmapTexturePool.h: Renamed from Source/WebCore/platform/graphics/texmap/BitmapTexturePool.h.\n* Source/WebCore/platform/graphics/skia/SkiaBackingStore.cpp:\n* Source/WebCore/platform/graphics/skia/SkiaUtilities.cpp:\n\nCanonical link: https://commits.webkit.org/319938@main",
      "email": "cgarcia@igalia.com",
      "hash": "6e990fd032628cad2be06bfb42db44f738a3e004",
      "subject": "[TextureMapper] Move BitmapTexture and BitmapTexturePool from texmap to egl directory"
    },
    "319939@main": {
      "author": "Yousuke Kimoto",
      "avatar": "https://www.gravatar.com/avatar/a0eb7d0008e888d1966be14822a565e4?d=identicon\u0026s=64",
      "cl": "319939@main",
      "clUrl": "https://commits.webkit.org/319939@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322681\n\nReviewed by Pascoe.\n\n* metadata/contributors.json:\n\nCanonical link: https://commits.webkit.org/319939@main",
      "email": "yousuke.kimoto@gmail.com",
      "hash": "6bffc6b2e93b148104470d36249205892a804491",
      "subject": "Change email for Yousuke Kimoto"
    },
    "319940@main": {
      "author": "Carlos Garcia Campos",
      "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64",
      "cl": "319940@main",
      "clUrl": "https://commits.webkit.org/319940@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322585\n\nReviewed by Nikolas Zimmermann.\n\nWe only want to support DDL for GPU rendering to avoid creating skia gl\ncontexts in worker threads.\n\n* Source/WebCore/platform/graphics/skia/SkiaBackingStore.cpp:\n(WebCore::SkiaBackingStore::Tile::update):\n* Source/WebCore/platform/graphics/skia/SkiaPaintingEngine.cpp:\n(WebCore::SkiaPaintingEngine::SkiaPaintingEngine):\n(WebCore::SkiaPaintingEngine::createBuffer const):\n(WebCore::SkiaPaintingEngine::createAtlas):\n(WebCore::SkiaPaintingEngine::record):\n(WebCore::SkiaPaintingEngine::replay):\n(WebCore::SkiaPaintingEngine::isDDLEnabled): Deleted.\n(WebCore::SkiaPaintingEngine::canUseDDL const): Deleted.\n* Source/WebCore/platform/graphics/skia/SkiaPaintingEngine.h:\n\nCanonical link: https://commits.webkit.org/319940@main",
      "email": "cgarcia@igalia.com",
      "hash": "63929b8114add14bf36974aee1bd3456aeba034b",
      "subject": "[GTK][WPE] Skia compositor: remove the support for GPU rendering without DDL"
    },
    "319941@main": {
      "author": "Claudio Saavedra",
      "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64",
      "cl": "319941@main",
      "clUrl": "https://commits.webkit.org/319941@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322613\n\nReviewed by Carlos Garcia Campos.\n\nSix ipc/ tests exercise IPC that only exists on Cocoa: an AppKit selector\nendpoint, the AVSampleBufferDisplayLayer and LibWebRTC codec proxies, a capture\nmanager built only from SourcesCocoa.txt, the CoreIPCCGColorSpace coder, and\nCoreIPCNSURLRequest. Every non-Cocoa port had to list them one by one, and a new\none lands as an unexplained GLib failure until someone does.\n\nMove them to ipc/cocoa, skipped in the generic expectations and re-enabled on\nmac-wk2, ios and visionos, as ipc/mac and ipc/ios already are. Their imports of\ncoreipc.js are now relative to the parent directory.\n\nThe remaining colorspace skips stay: those cover cross-platform regressions and\nonly need their payload ported to Skia's colorspace format. Group them under one\ncomment saying so.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/ipc/cocoa/LocalSampleBufferDisplayLayer-flushAndRemoveImage-cross-thread-uaf-expected.txt: Renamed from LayoutTests/ipc/LocalSampleBufferDisplayLayer-flushAndRemoveImage-cross-thread-uaf-expected.txt.\n* LayoutTests/ipc/cocoa/LocalSampleBufferDisplayLayer-flushAndRemoveImage-cross-thread-uaf.html: Renamed from LayoutTests/ipc/LocalSampleBufferDisplayLayer-flushAndRemoveImage-cross-thread-uaf.html.\n* LayoutTests/ipc/cocoa/indexed-colorspace-null-inner-crash-expected.txt: Renamed from LayoutTests/ipc/indexed-colorspace-null-inner-crash-expected.txt.\n* LayoutTests/ipc/cocoa/indexed-colorspace-null-inner-crash.html: Renamed from LayoutTests/ipc/indexed-colorspace-null-inner-crash.html.\n* LayoutTests/ipc/cocoa/networksessioncocoa-empty-resource-request-expected.txt: Renamed from LayoutTests/ipc/networksessioncocoa-empty-resource-request-expected.txt.\n* LayoutTests/ipc/cocoa/networksessioncocoa-empty-resource-request.html: Renamed from LayoutTests/ipc/networksessioncocoa-empty-resource-request.html.\n* LayoutTests/ipc/cocoa/send-invalid-message-expected.txt: Renamed from LayoutTests/ipc/send-invalid-message-expected.txt.\n* LayoutTests/ipc/cocoa/send-invalid-message.html: Renamed from LayoutTests/ipc/send-invalid-message.html.\n* LayoutTests/ipc/cocoa/usermedia-capture-start-producing-data-race-expected.txt: Renamed from LayoutTests/ipc/usermedia-capture-start-producing-data-race-expected.txt.\n* LayoutTests/ipc/cocoa/usermedia-capture-start-producing-data-race.html: Renamed from LayoutTests/ipc/usermedia-capture-start-producing-data-race.html.\n* LayoutTests/ipc/cocoa/videoEncode-expected.txt: Renamed from LayoutTests/ipc/videoEncode-expected.txt.\n* LayoutTests/ipc/cocoa/videoEncode.html: Renamed from LayoutTests/ipc/videoEncode.html.\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n* LayoutTests/platform/visionos/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319941@main",
      "email": "csaavedra@igalia.com",
      "hash": "9abf8d489cc3afce78baef3a2e6c2dcdc425b6dc",
      "subject": "Move the Cocoa-only ipc/ tests into ipc/cocoa"
    },
    "319942@main": {
      "author": "Jean-Yves Avenard",
      "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64",
      "cl": "319942@main",
      "clUrl": "https://commits.webkit.org/319942@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322696\nrdar://185963323\n\nUnreviewed build fix.\n\n319938@main added two new files and updated all the cmakefile except the cocoa one.\n\n* Source/WebCore/PlatformCocoa.cmake:\n\nCanonical link: https://commits.webkit.org/319942@main",
      "email": "jya@apple.com",
      "hash": "32f4474c5683ef94d80ff419549015da0a88c056",
      "subject": "(319938@main) [cmake] build failure"
    },
    "319943@main": {
      "author": "Carlos Garcia Campos",
      "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64",
      "cl": "319943@main",
      "clUrl": "https://commits.webkit.org/319943@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322574\n\nReviewed by Nikolas Zimmermann.\n\nFor now only use promise images for video buffers using DMA-BUF, because\nwe can keep the DMABufBuffer alive until the promise image is released.\nFor other buffers we will probably have to make CoordinatedPlatformLayerBuffer\nref counted.\n\n* Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:\n(WebCore::MediaPlayerPrivateGStreamer::pushTextureToCompositor):\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferDMABuf.cpp:\n(WebCore::yuvFormatFromDRMFourcc):\n(WebCore::importYUV):\n(WebCore::CoordinatedPlatformLayerBufferDMABuf::importDMABuf const):\n(WebCore::PromiseDMABufYUVPlaneContext::PromiseDMABufYUVPlaneContext):\n(WebCore::CoordinatedPlatformLayerBufferDMABuf::createSkiaImageIfNeeded):\n(WebCore::CoordinatedPlatformLayerBufferDMABuf::importYUV const): Deleted.\n(WebCore::PromiseDMABufImageContext::PromiseDMABufImageContext): Deleted.\n(WebCore::PromiseDMABufImageContext::promiseImageTexture): Deleted.\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferDMABuf.h:\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferProxy.cpp:\n(WebCore::CoordinatedPlatformLayerBufferProxy::threadSafeGrContext const):\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferProxy.h:\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferVideo.cpp:\n(WebCore::CoordinatedPlatformLayerBufferVideo::create):\n(WebCore::CoordinatedPlatformLayerBufferVideo::CoordinatedPlatformLayerBufferVideo):\n(WebCore::CoordinatedPlatformLayerBufferVideo::createBufferIfNeeded):\n(WebCore::CoordinatedPlatformLayerBufferVideo::createBufferFromDMABufMemory):\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferVideo.h:\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferYUV.h:\n\nCanonical link: https://commits.webkit.org/319943@main",
      "email": "cgarcia@igalia.com",
      "hash": "1d650ab2580f217ea18e116bb3e62f3f3b6fc2e5",
      "subject": "[GTK][WPE] Skia compositor: use promise images for video DMA-BUF buffers"
    },
    "319944@main": {
      "author": "Adrian Taylor",
      "avatar": "https://www.gravatar.com/avatar/d2acb8ad2e2670ff74ae0d65fb27014c?d=identicon\u0026s=64",
      "cl": "319944@main",
      "clUrl": "https://commits.webkit.org/319944@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322700\nrdar://185966285\n\nReviewed by Yusuke Suzuki.\n\nAdds a bracket that was accidentally omitted from CommonBase.xcconfig.\n\nCanonical link: https://commits.webkit.org/319944@main",
      "email": "adrian_taylor@apple.com",
      "hash": "061aabf2b0634e8c3ef9a97c59b3bb339babb4de",
      "subject": "Fix missing bracket"
    },
    "319945@main": {
      "author": "Carlos Garcia Campos",
      "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64",
      "cl": "319945@main",
      "clUrl": "https://commits.webkit.org/319945@main",
      "description": "Unreviewed test gardening.\n\n* LayoutTests/platform/glib/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319945@main",
      "email": "cgarcia@igalia.com",
      "hash": "3bdf3becf913c5592a53fe7d09b0693215601e80",
      "subject": "[Gardening][GLIB] Test media/media-source/worker/media-source-worker-logger-observer-crash.html times out"
    },
    "319946@main": {
      "author": "Carlos Garcia Campos",
      "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64",
      "cl": "319946@main",
      "clUrl": "https://commits.webkit.org/319946@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321395\n\nReviewed by Alex Christensen.\n\nWhen continuing a load on new process after a process swap on navigation\nresponse, the provisional certificate used for the new frame proxy is\ncopied from the previous committed load, but the new certificate was\nactually received from the network process in the previous provisional frame.\nIf there's a previous provisional frame having a provisional certificate\nreceived from the network process it should be used, falling back to the\nprevious commited frame otherwise. This patch handles both cases from\ncontinueNavigationInNewProcess(), passing the certitifate info to the\nnew ProvisionalPageProxy construtor.\n\n* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:\n(WebKit::ProvisionalPageProxy::ProvisionalPageProxy):\n* Source/WebKit/UIProcess/ProvisionalPageProxy.h:\n* Source/WebKit/UIProcess/WebFrameProxy.cpp:\n(WebKit::WebFrameProxy::provisionalCertificateInfoFromNetworkProcess const):\n(WebKit::WebFrameProxy::commitCertificateInfo):\n(WebKit::WebFrameProxy::setCertificateInfoForProcessSwapOnNavigationResponse):\n(WebKit::WebFrameProxy::certificateInfoFromNetworkProcess const): Deleted.\n(WebKit::WebFrameProxy::copyCertificateInfoForProcessSwapOnNavigationResponse): Deleted.\n* Source/WebKit/UIProcess/WebFrameProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::continueNavigationInNewProcess):\n\nCanonical link: https://commits.webkit.org/319946@main",
      "email": "cgarcia@igalia.com",
      "hash": "0988eec0c5a2100add99512ec7ebc3944242dc6d",
      "subject": "REGRESSION(316854@main): Frame CertificateInfo is empty after process swap on navigation"
    },
    "319947@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "319947@main",
      "clUrl": "https://commits.webkit.org/319947@main",
      "description": "rdar://185876971\nhttps://bugs.webkit.org/show_bug.cgi?id=322580\n\nReviewed by Jean-Yves Avenard.\n\n* Source/WebCore/PAL/ThirdParty/dav1d: Resynced.\n* Source/WebCore/PAL/ThirdParty/dav1d/dav1d.xcodeproj/project.pbxproj: Remove references to no longer existing files.\n\nCanonical link: https://commits.webkit.org/319947@main",
      "email": "youenn@apple.com",
      "hash": "0788d4a824340a6fb34a32c0c41388644b6b2de3",
      "subject": "Resync dav1d up to M152"
    },
    "319948@main": {
      "author": "Carlos Garcia Campos",
      "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64",
      "cl": "319948@main",
      "clUrl": "https://commits.webkit.org/319948@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322485\n\nReviewed by Alex Christensen.\n\nServiceWorkerFetchTask::processResponse() passes the response to the\nloader by calling sendDidReceiveResponseWithPotentialProcessSwap(), so\ndidReceiveMainResourceResponse(), that sends the certificate info the UI\nprocess, is not called.\n\nThis patch adds WebSWServerConnection::fetchTaskReceivedMainResourceResponse()\nthat is called from ServiceWorkerFetchTask::processResponse() for main frame\nloads to send the ReceivedMainResourceResponseWithCertificateInfo to the UI process.\n\n* Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerFetchTask.cpp:\n(WebKit::ServiceWorkerFetchTask::processResponse):\n* Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerConnection.cpp:\n(WebKit::WebSWServerConnection::fetchTaskReceivedMainResourceResponse):\n(WebKit::WebSWServerConnection::resolveUnregistrationJobInClient):\n* Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerConnection.h:\n\nCanonical link: https://commits.webkit.org/319948@main",
      "email": "cgarcia@igalia.com",
      "hash": "0c2c3da31e37476bd95d06f17af5143eae171ec0",
      "subject": "REGRESSION(316854@main): CertificateInfo is not sent to the UI process for service worker fetch loads"
    },
    "319949@main": {
      "author": "Philippe Normand",
      "avatar": "https://www.gravatar.com/avatar/eef27203750af3510263cc29af21a16e?d=identicon\u0026s=64",
      "cl": "319949@main",
      "clUrl": "https://commits.webkit.org/319949@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321281\n\nUnreviewed, update expectations for WebRTC tests no longer flaky-crashing after 319787@main.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/gtk/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319949@main",
      "email": "philn@igalia.com",
      "hash": "a5b2b89dc868ae220dd41e28b3fdca48bf75ee90",
      "subject": "[GTK] webrtc/video-disabled-black.html crashes"
    },
    "319950@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "319950@main",
      "clUrl": "https://commits.webkit.org/319950@main",
      "description": "rdar://184651790\nhttps://bugs.webkit.org/show_bug.cgi?id=322592\n\nReviewed by Chris Dumez.\n\nThe newly added MESSAGE_CHECK for request pending connection domain is too strict.\nRequesting a context connection is starting in network process, then goes to UIProcess via IPC, then to WebProcess via IPC and then finally to NetworkConnectionToWebProcess::establishSWContextConnection via IPC.\nBetween the start of requesting a context connection and NetworkConnectionToWebProcess::establishSWContextConnection, the networking process may have cleared the SWServer.\nWe now simply return early when there is no pending connection domain.\n\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:\n(WebKit::NetworkConnectionToWebProcess::establishSWContextConnection):\n\nCanonical link: https://commits.webkit.org/319950@main",
      "email": "youenn@apple.com",
      "hash": "d8889ce6b343f71bea60b92032c0627093b00004",
      "subject": "NetworkConnectionToWebProcess::establishSWContextConnection hits MESSAGE_CHECK(swServer-\u003ehasPendingConnectionDomain({ site.domain(), crossOriginEmbedderPolicy }))"
    },
    "319951@main": {
      "author": "Cole Carley",
      "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64",
      "cl": "319951@main",
      "clUrl": "https://commits.webkit.org/319951@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322673\nrdar://185945200\n\nReviewed by Brent Fulgham.\n\nMove the quirk names and sites to their own headers.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/Quirks.cpp\n\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/page/QuirkNames.h: Added.\n* Source/WebCore/page/QuirkTable.cpp:\n* Source/WebCore/page/QuirkTable.h:\n(WebCore::QuirkBehaviors::QuirkBehaviors):\n* Source/WebCore/page/Quirks.cpp:\n* Source/WebCore/page/Quirks.h:\n(WebCore::Quirks::shouldAllowPopupFromMicrosoftOfficeToOneDrive const):\n(WebCore::Quirks::quirkIsEnabledAfterProbing const):\n* Source/WebCore/page/QuirksData.h:\n* Tools/TestWebKitAPI/Tests/WebCore/Quirks.cpp:\n(TestWebKitAPI::TEST_F(QuirksTest, SiteSpecificQuirksResolveWithoutADocument)):\n\nCanonical link: https://commits.webkit.org/319951@main",
      "email": "ccarley2@apple.com",
      "hash": "38a4d7bce156aac4c6f8d72919e48b788703452a",
      "subject": "[Quirks] Move site specific quirk names to QuirkNames.h"
    },
    "319952@main": {
      "author": "Keith Miller",
      "avatar": "https://www.gravatar.com/avatar/bddc1595b29098429a6ce7c8bf4aced2?d=identicon\u0026s=64",
      "cl": "319952@main",
      "clUrl": "https://commits.webkit.org/319952@main",
      "description": "rdar://185934634\n\nReviewed by Yusuke Suzuki.\n\n319782@main added .stack (and similar) properties to DOMException\nobjects. However, it failed to add a weak reference reconciliation\nmechanism so the stack traces collected could be collected under the\ninstance. This patch adds a reconcileWeakReferencesAtGCEnd hook to\nJSClientData, which forwards to the various ErrorInstance subclasses'\nISOSubspaces.\n\nTest: fast/dom/DOMException/stack-trace-survives-gc.html\nCanonical link: https://commits.webkit.org/319952@main",
      "email": "keith_miller@apple.com",
      "hash": "4d79cb17ccd3cf72215b33bdccf186af491affce",
      "subject": "JSDOMException is not reconciling it's weak stack trace"
    },
    "319953@main": {
      "author": "Eric Carlson",
      "avatar": "https://www.gravatar.com/avatar/e227ff07cc6d645fc1c69fd56c2c8cb8?d=identicon\u0026s=64",
      "cl": "319953@main",
      "clUrl": "https://commits.webkit.org/319953@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322598\nrdar://185903230\n\nReviewed by Jer Noble.\n\nThe following tests pass after 319006@main, 319230@main and 319249@main so remove\nthem from iOS site isolation TestExpectations.\n\nmedia/audio-play-with-video-element.html, media/audio-playback-restriction-play.html\nmedia/audio-session-category-play-unmute-pause.html\nmedia/audio-session-category.html\nmedia/audioSession/audioSessionType.html\nmedia/auto-play-web-audio-in-about-blank-iframe.html\nmedia/deactivate-audio-session.html\nmedia/video-audio-session-mode.html\n\n* LayoutTests/platform/ios-site-isolation/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319953@main",
      "email": "eric.carlson@apple.com",
      "hash": "34625d16e6b3aab47e4e17aff0d22c57495b9b29",
      "subject": "[Site Isolation] Cleanup TestExpectations after recent AudioSession fixes"
    },
    "319954@main": {
      "author": "Philippe Normand",
      "avatar": "https://www.gravatar.com/avatar/eef27203750af3510263cc29af21a16e?d=identicon\u0026s=64",
      "cl": "319954@main",
      "clUrl": "https://commits.webkit.org/319954@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322633\n\nReviewed by Xabier Rodriguez-Calvar.\n\nThe GStreamerVideoEncoderFactory relies on the GStreamer registry scanner and on the internal\nGStreamer video encoder element, so we need to make sure the registry has an up-to-date cache and\nthat the encoder has been registered as well.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/gtk/TestExpectations:\n* Source/WebCore/platform/mediastream/libwebrtc/gstreamer/GStreamerVideoEncoderFactory.cpp:\n(WebCore::GStreamerVideoEncoderFactory::GStreamerVideoEncoderFactory):\n\nCanonical link: https://commits.webkit.org/319954@main",
      "email": "philn@igalia.com",
      "hash": "dc36ab851de9ea91289369eb4721cf1292577d1a",
      "subject": "[GTK][WPE] webrtc/protocol/additional-codecs.html and webrtc/msection-recycling.html crash in GStreamerRegistryScanner::isCodecSupported"
    },
    "319955@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "319955@main",
      "clUrl": "https://commits.webkit.org/319955@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322482\n\nReviewed by Ryosuke Niwa and David Kilzer.\n\n* Source/WebKit/GPUProcess/webrtc/RemoteAudioMediaStreamTrackRendererInternalUnitManager.cpp:\n(WebKit::RemoteAudioMediaStreamTrackRendererInternalUnitManagerUnit::RemoteAudioMediaStreamTrackRendererInternalUnitManagerUnit):\n* Source/WebKit/NetworkProcess/BackgroundFetchLoad.cpp:\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:\n(WebKit::NetworkConnectionToWebProcess::NetworkConnectionToWebProcess):\n* Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerSoftUpdateLoader.cpp:\n(WebKit::ServiceWorkerSoftUpdateLoader::ServiceWorkerSoftUpdateLoader):\n* Source/WebKit/NetworkProcess/cache/AsyncRevalidation.cpp:\n(WebKit::NetworkCache::AsyncRevalidation::AsyncRevalidation):\n* Source/WebKit/NetworkProcess/cache/NetworkCache.cpp:\n(WebKit::NetworkCache::Cache::Cache):\n* Source/WebKit/NetworkProcess/cache/NetworkCacheSpeculativeLoadManager.cpp:\n(WebKit::NetworkCache::SpeculativeLoadManager::PendingFrameLoad::PendingFrameLoad):\n* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp:\n(WebKit::NetworkStorageManager::NetworkStorageManager):\n* Source/WebKit/UIProcess/Cocoa/GroupActivities/GroupActivitiesSession.h:\n* Source/WebKit/UIProcess/Cocoa/GroupActivities/GroupActivitiesSession.mm:\n(WebKit::GroupActivitiesSession::GroupActivitiesSession):\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.mm:\n(WebKit::m_wheelEventActivityHysteresis):\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::WebProcessProxy):\n(WebKit::m_shutdownPreventingScopeCounter):\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::WebViewImpl):\n* Source/WebKit/WebProcess/WebProcess.cpp:\n(WebKit::WebProcess::WebProcess):\n\nCanonical link: https://commits.webkit.org/319955@main",
      "email": "cdumez@apple.com",
      "hash": "5c7edee974ae5800eb66b7dc2198e1a2003cc271",
      "subject": "[SaferCPP] Address some failures found by the latest static analyzer in Source/WebKit"
    },
    "319956@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "319956@main",
      "clUrl": "https://commits.webkit.org/319956@main",
      "description": "rdar://185906103\nhttps://bugs.webkit.org/show_bug.cgi?id=322603\n\nReviewed by Jean-Yves Avenard.\n\nWe add a runtime flag that controls whether WebRTC can bypass private relay, for instance if user granted camera and microphone.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebKit/WebProcess/Network/webrtc/LibWebRTCNetworkManager.cpp:\n(WebKit::LibWebRTCNetworkManager::networksChanged):\n* Source/WebKit/WebProcess/Network/webrtc/LibWebRTCProvider.cpp:\n(WebKit::RTCSocketFactory::RTCSocketFactory):\n(WebKit::LibWebRTCProvider::createSocketFactory):\n\nCanonical link: https://commits.webkit.org/319956@main",
      "email": "youenn@apple.com",
      "hash": "37787f8a4de26858b7ed63c68daff02d3f0d877f",
      "subject": "Add a flag to support disabling WebRTC private relay bypass"
    },
    "319957@main": {
      "author": "Michael Catanzaro",
      "avatar": "https://www.gravatar.com/avatar/213b4484d2078dbdd03dcd3256564c2c?d=identicon\u0026s=64",
      "cl": "319957@main",
      "clUrl": "https://commits.webkit.org/319957@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322295\n\nReviewed by Justin Michaud.\n\nThis option is not hooked up to anything since 313922@main. My proposed\nsolution in https://github.com/WebKit/WebKit/pull/72147 was rejected.\nNext best thing to do is just remove it.\n\nCanonical link: https://commits.webkit.org/319957@main",
      "email": "mcatanzaro@gnome.org",
      "hash": "6d1e650ea8fcfb1accedea93b443e81ff97ff1b0",
      "subject": "Remove ENABLE_JSC_RESTRICTED_OPTIONS_BY_DEFAULT"
    },
    "319958@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319958@main",
      "clUrl": "https://commits.webkit.org/319958@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=261656\nrdar://115963075\n\nReviewed by Taher Ali.\n\nThis patch adds test coverage for whitespace handling in SVG attributes\nusing \u003cangle\u003e, matching Gecko / Firefox and Blink / Chromium behavior.\n\nMerge: https://github.com/chromium/chromium/commit/77c8625da85bd956992b81233d451b87c39e7dea\n\nThis bug is fixed in 319893@main.\n\n* LayoutTests/svg/parser/whitespace-angle-1-expected.txt: Added.\n* LayoutTests/svg/parser/whitespace-angle-1.html: Added.\n* LayoutTests/svg/parser/whitespace-angle-2-expected.txt: Added.\n* LayoutTests/svg/parser/whitespace-angle-2.html: Added.\n\nCanonical link: https://commits.webkit.org/319958@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "2fa7080d7d85fe35d18be308ec6e2b794ed5afac",
      "subject": "[Test Coverage] [SVG2] Allow leading and trailing whitespace in svg attributes using \u003cangle\u003e"
    },
    "319959@main": {
      "author": "Claudio Saavedra",
      "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64",
      "cl": "319959@main",
      "clUrl": "https://commits.webkit.org/319959@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322715\n\nReviewed by Justin Michaud.\n\nThe singleton is built by the first high priority thread to start, since\nThread::initializeSchedulingAttributes() runs on the thread being started. The\nmember function form of RunLoop::Timer captures a WeakPtr bound to that thread,\nwhile the timer runs on the main run loop; firing it trips the WeakPtr thread\nassertion.\n\nGive the timer a lambda that goes through singleton() instead. The object\noutlives every run loop, so neither the weak reference nor the no-op ref/deref\nthat supported it were needed.\n\n* Source/WTF/wtf/linux/HighPriorityThreads.cpp:\n(WTF::HighPriorityThreads::HighPriorityThreads):\n* Source/WTF/wtf/linux/HighPriorityThreads.h:\n(WTF::HighPriorityThreads::ref const): Deleted.\n(WTF::HighPriorityThreads::deref const): Deleted.\n\nCanonical link: https://commits.webkit.org/319959@main",
      "email": "csaavedra@igalia.com",
      "hash": "1afb343a6d30aa01e0ce2fa57d7fa5e953baae06",
      "subject": "[GLIB] HighPriorityThreads hits an assertion crash when its RealtimeKit proxy timer fires"
    },
    "319960@main": {
      "author": "Pablo Saavedra",
      "avatar": "https://www.gravatar.com/avatar/9699c426748aafa71670832c5e95a389?d=identicon\u0026s=64",
      "cl": "319960@main",
      "clUrl": "https://commits.webkit.org/319960@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322698\n\nReviewed by Fujii Hironori.\n\n319347@main ([GTK][WPE] Support touch event asynchronous scrolling) introduced a\nserialized touch event queue in the UI process for the COORDINATED_TOUCH_EVENTS\npath, which coalesces consecutive touch moves onto the queued one. The coalescing\ncondition, however, has no fallback:\n\n    if (event.type() == WebEventType::TouchMove \u0026\u0026 !touchEventQueue.isEmpty()) {\n        QueuedTouchEvents\u0026 lastEvent = touchEventQueue.last();\n        if (lastEvent.forwardedEvent.type() == WebEventType::TouchMove)\n            lastEvent.deferredTouchEvents.append(event);\n    } else {\n        touchEventQueue.append(event);\n        ...\n    }\n\nWhen a TouchMove arrives while the queue is non-empty but the last queued event is\nnot itself a TouchMove -- that is, while the TouchStart is still awaiting its\nasynchronous reply from the web process -- neither branch runs and the event is\nsilently discarded. It is not forwarded to the web process and it is not appended\nto deferredTouchEvents, so it never reaches the DOM and, because\nPageClientImpl::doneWithTouchEvent() is only called for events that made it into\nthe queue, it never reaches the WPE gesture controller either.\n\nThe practical effect is that a touch drag delivered as a back-to-back\ndown/move/up burst degenerates into a second tap: the page observes touchstart\nand touchend with no touchmove, the gesture controller sees no motion and\nsynthesizes mousemove/mousedown/mouseup/click, and nothing scrolls. This is how\ntouch events arrive both from a real touchscreen and from WebDriver, which emits\na single WPE_EVENT_TOUCH_MOVE per move action with no interpolation and no wait\nbetween events (see the TODO in WebAutomationSession::platformSimulateTouchInteraction,\nhttps://bugs.webkit.org/show_bug.cgi?id=275031).\n\nBefore 319347@main, the generic ENABLE(TOUCH_EVENTS) path sent every touch event\nstraight through with sendWithAsyncReply and no queue at all, and on non-Cocoa\nplatforms updateTouchEventTracking() unconditionally marked every tracking type\nSynchronous, so every touchmove reached the DOM.\n\nRestructure the condition so that coalescing is an early return and every other\nevent, including a TouchMove that cannot be coalesced, falls through to the\nenqueue path. The intended coalescing behaviour is unchanged.\n\nThis went unnoticed because every test in fast/events/touch/ drives the engine\nthrough eventSender.asyncTouchStart()/asyncTouchMove()/asyncTouchEnd(), each of\nwhich awaits its round trip via doAfterProcessingAllPendingTouchAndWheelEvents().\nThe queue is therefore always empty by the time the next event is dispatched, and\nthe dropped-event path is never exercised.\n\nThe new test uses the synchronous eventSender touch API instead, which dispatches\nthe event and returns without waiting, so the whole sequence is pushed back to\nback the way a touchscreen or WebDriver delivers it. Its listeners are registered\nnon-passive so that the touch start is tracked synchronously: its reply then\nrequires the web process main thread, which is blocked in the synchronous\neventSender message for the touch move, making the reproduction deterministic\nrather than a race.\n\nTest: fast/events/touch/touch-move-during-pending-touch-start.html\n* LayoutTests/fast/events/touch/touch-move-during-pending-touch-start-expected.txt: Added.\n* LayoutTests/fast/events/touch/touch-move-during-pending-touch-start.html: Added.\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::handleTouchEvent):\n\nCo-Authored-By: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nCanonical link: https://commits.webkit.org/319960@main",
      "email": "psaavedra@igalia.com",
      "hash": "f0c538173039a9a42c2e4ee039fa4a536f81a8b1",
      "subject": "REGRESSION(319347@main): Touchmove is dropped when it arrives while touchstart is still in flight"
    },
    "319961@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "319961@main",
      "clUrl": "https://commits.webkit.org/319961@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322565\n\nReviewed by Sam Weinig.\n\nAnnotate Lock functions as NODELETE.\n\n* Source/JavaScriptCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations:\n* Source/WTF/wtf/Lock.h:\n* Source/WTF/wtf/WordLock.h:\n* Source/WebCore/SaferCPPExpectations/UncheckedCallArgsCheckerExpectations:\n\nCanonical link: https://commits.webkit.org/319961@main",
      "email": "rniwa@webkit.org",
      "hash": "e6f6ed997eeed2c641bbf77ad6c6f0be8a788f22",
      "subject": "Annotate Lock functions as NODELETE"
    },
    "319962@main": {
      "author": "Antoine Quint",
      "avatar": "https://www.gravatar.com/avatar/9b3ef1e754f8d994f21ff67c660cbbe6?d=identicon\u0026s=64",
      "cl": "319962@main",
      "clUrl": "https://commits.webkit.org/319962@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322704\nrdar://185970209\n\nReviewed by Dan Glastonbury.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/32e9879045d3231fb45d1ea479aeed00888f7117\n\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/animation-trigger-play-forwards-backwards.tentative.html:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/animation-trigger-play.tentative.html:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/animation-trigger-replay.tentative.html:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/parsing/timeline-trigger-shorthand.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/parsing/timeline-trigger-shorthand.tentative.html:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/support/support.js:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/timeline-trigger-none-auto.tentative-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/timeline-trigger-none-auto.tentative.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/animation-trigger/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/crashtests/change-timeline-from-finite-to-monotonic-crash-002.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/crashtests/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/animation-timeline-named-scroll-progress-timeline.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/animation-timeline-named-scroll-progress-timeline.tentative.html:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/animation-timeline-none-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/animation-timeline-none.html:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/scroll-timeline-anonymous-reuse-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/scroll-timeline-anonymous-reuse.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/scroll-timeline-dynamic.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/scroll-timeline-dynamic.tentative.html:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/timeline-scope-all-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/timeline-scope-all.html:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/timeline-scope-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/timeline-scope.html:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/scroll-timelines/scroll-timeline-range-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/scroll-timelines/scroll-timeline-range.html:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/view-timelines/intermediate-transform-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/view-timelines/intermediate-transform.html:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/view-timelines/view-timeline-range-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/view-timelines/view-timeline-range.html:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/view-timelines/w3c-import.log:\n\nCanonical link: https://commits.webkit.org/319962@main",
      "email": "graouts@webkit.org",
      "hash": "35ba184789d512edadc119d464f3a1fa48801b6d",
      "subject": "[scroll-animations] sync WPT tests"
    },
    "319963@main": {
      "author": "Dominic Mazzoni",
      "avatar": "https://www.gravatar.com/avatar/f76643c44a7ee3be45148e66d97ed8e4?d=identicon\u0026s=64",
      "cl": "319963@main",
      "clUrl": "https://commits.webkit.org/319963@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322690\nrdar://185961392\n\nReviewed by Tyler Wilcock.\n\nIf there are n characters in a text field, then AXLineForIndex should\nreturn a valid line index range for 0...n, inclusive. AXInsertionPointLineNumber\nalready handled this case correctly.\n\nThere were two separate bugs:\n\nAccessibilityObject::doAXLineForIndex passed lastIndexOK = false to\nAccessibilityRenderObject::visiblePositionForIndex, so it returned null instead\nof a valid VisiblePosition at the text length.\n\nAXTextMarker::lineNumberForIndex walked lines and asked whether the index fell\ninside one, but the index at the very end of the last line fell outside every line.\n\nAlso found and fixed while writing these tests: AXIsolatedObject::insertionPointLineNumber\nfailed for a multiline field with no text, now fixed to return 0.\n\nTests: accessibility/isolated-tree/mac/line-for-index-at-end-of-value.html\n       accessibility/isolated-tree/mac/range-for-line-trailing-blank-line.html\n       accessibility/isolated-tree/textarea-line-for-index.html\n       accessibility/mac/line-for-index-at-end-of-value.html\n\n* LayoutTests/accessibility/isolated-tree/mac/line-for-index-at-end-of-value-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/line-for-index-at-end-of-value.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/range-for-line-trailing-blank-line-expected.txt: Copied from LayoutTests/accessibility/mac/range-for-line-trailing-blank-line-expected.txt.\n* LayoutTests/accessibility/isolated-tree/mac/range-for-line-trailing-blank-line.html: Copied from LayoutTests/accessibility/mac/range-for-line-trailing-blank-line.html.\n* LayoutTests/accessibility/isolated-tree/mac/range-for-line-with-block-line-breaks-expected.txt:\n* LayoutTests/accessibility/isolated-tree/mac/range-for-line-with-block-line-breaks.html:\n* LayoutTests/accessibility/isolated-tree/mac/textarea-line-range-after-dynamic-edit-expected.txt:\n* LayoutTests/accessibility/isolated-tree/mac/textarea-line-range-after-dynamic-edit.html:\n* LayoutTests/accessibility/isolated-tree/mac/textarea-line-range-with-trailing-newline-expected.txt:\n* LayoutTests/accessibility/isolated-tree/mac/textarea-line-range-with-trailing-newline.html:\n* LayoutTests/accessibility/isolated-tree/textarea-line-for-index-expected.txt: Copied from LayoutTests/accessibility/textarea-line-for-index-expected.txt.\n* LayoutTests/accessibility/isolated-tree/textarea-line-for-index.html: Added.\n* LayoutTests/accessibility/mac/line-for-index-at-end-of-value-expected.txt: Added.\n* LayoutTests/accessibility/mac/line-for-index-at-end-of-value.html: Added.\n* LayoutTests/accessibility/mac/range-for-line-trailing-blank-line-expected.txt:\n* LayoutTests/accessibility/mac/range-for-line-trailing-blank-line.html:\n* LayoutTests/accessibility/mac/range-for-line-with-block-line-breaks-expected.txt:\n* LayoutTests/accessibility/mac/range-for-line-with-block-line-breaks.html:\n* LayoutTests/accessibility/mac/textarea-line-range-after-dynamic-edit-expected.txt:\n* LayoutTests/accessibility/mac/textarea-line-range-after-dynamic-edit.html:\n* LayoutTests/accessibility/mac/textarea-line-range-with-trailing-newline-expected.txt:\n* LayoutTests/accessibility/mac/textarea-line-range-with-trailing-newline.html:\n* LayoutTests/accessibility/textarea-line-for-index-expected.txt:\n* Source/WebCore/accessibility/AXTextMarker.cpp:\n(WebCore::AXTextMarker::lineNumberForIndex const):\n* Source/WebCore/accessibility/AccessibilityObject.cpp:\n(WebCore::AccessibilityObject::doAXLineForIndex):\n* Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp:\n(WebCore::AXIsolatedObject::insertionPointLineNumber const):\n\nCanonical link: https://commits.webkit.org/319963@main",
      "email": "dm_mazzoni@apple.com",
      "hash": "40976d39a2c1327795871923d5f90f7329d20537",
      "subject": "AX: AXLineForIndex fails when passed an index equal to the length of the field"
    },
    "319964@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "319964@main",
      "clUrl": "https://commits.webkit.org/319964@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322701\nrdar://185966544\n\nReviewed by Keith Miller.\n\nValueProfile collection was taking a lock only on 32bit before, and\nvalueProfileLock was empty on 64bit. Now 32bit JIT is dropped and we no\nlonger need to consider about this locking case. This patch removes\nvalueProfileLock (It was NoLockingNecessaryTag so no effect).\n\n* Source/JavaScriptCore/bytecode/CodeBlock.cpp:\n(JSC::CodeBlock::updateAllNonLazyValueProfilePredictionsAndCountLiveness):\n(JSC::CodeBlock::updateAllNonLazyValueProfilePredictions):\n(JSC::CodeBlock::updateAllLazyValueProfilePredictions):\n(JSC::CodeBlock::updateAllPredictions):\n(JSC::CodeBlock::shouldOptimizeNowFromBaseline):\n(JSC::CodeBlock::valueProfilePredictionForBytecodeIndex):\n* Source/JavaScriptCore/bytecode/CodeBlock.h:\n(JSC::CodeBlock::valueProfileLock): Deleted.\n* Source/JavaScriptCore/bytecode/LazyValueProfile.cpp:\n(JSC::CompressedLazyValueProfileHolder::computeUpdatedPredictions):\n(JSC::LazyOperandValueProfileParser::prediction const):\n* Source/JavaScriptCore/bytecode/LazyValueProfile.h:\n* Source/JavaScriptCore/bytecode/ValueProfile.h:\n(JSC::ValueProfileBase::briefDescription):\n(JSC::ValueProfileBase::computeUpdatedPrediction):\n(JSC::ValueProfileBase::computeUpdatedPredictionForExtraValue):\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::ByteCodeParser::injectLazyOperandSpeculation):\n(JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):\n(JSC::DFG::ByteCodeParser::handleVarargsInlining):\n(JSC::DFG::ByteCodeParser::parseBlock):\n* Source/JavaScriptCore/dfg/DFGPredictionInjectionPhase.cpp:\n(JSC::DFG::PredictionInjectionPhase::run):\n* Source/JavaScriptCore/jit/BaselineJITPlan.cpp:\n(JSC::BaselineJITPlan::compileInThreadImpl):\n* Source/JavaScriptCore/profiler/ProfilerBytecodeSequence.cpp:\n(JSC::Profiler::BytecodeSequence::BytecodeSequence):\n\nCanonical link: https://commits.webkit.org/319964@main",
      "email": "ysuzuki@apple.com",
      "hash": "f6a959b7e8e4d37d7e891d3a37cf7f45072d15bd",
      "subject": "[JSC] Remove valueProfileLock"
    },
    "319965@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "319965@main",
      "clUrl": "https://commits.webkit.org/319965@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322693\nrdar://185962296\n\nReviewed by Keith Miller.\n\nTighten MarkedSpace::stopAllocating faster by,\n\n1. introducing BitSet::clearEachNthBit, which clears m_newlyAllocated in\n   bulk style.\n2. introducing freeList.forEachInterval, avoiding per cell processing\n   and making zap loop excluded when it is not necessary.\n\nTest: Tools/TestWebKitAPI/Tests/WTF/BitSet.cpp\n\n* Source/JavaScriptCore/heap/FreeList.h:\n* Source/JavaScriptCore/heap/FreeListInlines.h:\n(JSC::FreeList::allocateWithCellSize):\n(JSC::FreeList::forEachInterval const):\n(JSC::FreeList::forEach const):\n* Source/JavaScriptCore/heap/MarkedBlock.cpp:\n(JSC::MarkedBlock::Handle::stopAllocating):\n* Source/WTF/wtf/BitSet.h:\n(WTF::WordType\u003e::clearEachNthBit):\n* Tools/TestWebKitAPI/Tests/WTF/BitSet.cpp:\n(TestWebKitAPI::testBitSetClearEachNthBitImpl):\n(TestWebKitAPI::testBitSetClearEachNthBit):\n(TestWebKitAPI::TEST(WTF_BitSet, ClearEachNthBit_uint32_t)):\n(TestWebKitAPI::TEST(WTF_BitSet, ClearEachNthBit_uint64_t)):\n\nCanonical link: https://commits.webkit.org/319965@main",
      "email": "ysuzuki@apple.com",
      "hash": "041ad12a187e01224e67d9cb591b4e1b7197c84e",
      "subject": "[JSC] Make MarkedSpace::stopAllocating faster"
    },
    "319966@main": {
      "author": "Yulun Wu",
      "avatar": "https://www.gravatar.com/avatar/9e34d6632f4d926cdf6fe8dce07f9cb7?d=identicon\u0026s=64",
      "cl": "319966@main",
      "clUrl": "https://commits.webkit.org/319966@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322656\n\u003crdar://185927722\u003e\n\nReviewed by Sammy Gill.\n\nAdd an early return to sizeTracksToFitNonSpanningItems() when the track\ndoes not contain any non-spanning items.\n\n* Source/WebCore/layout/formattingContexts/grid/TrackSizingAlgorithm.cpp:\n(WebCore::Layout::sizeTracksToFitNonSpanningItems):\n\nCanonical link: https://commits.webkit.org/319966@main",
      "email": "yulun_wu@apple.com",
      "hash": "573d93de8e4b87505a861a6e119466a2dcab6945",
      "subject": "[GFC] Add an early return to skip tracks without single span items"
    },
    "319967@main": {
      "author": "Kimmo Kinnunen",
      "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64",
      "cl": "319967@main",
      "clUrl": "https://commits.webkit.org/319967@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322254\nrdar://185487825\n\nReviewed by Dan Glastonbury.\n\nObtain the draw source as NativeImage in\nCanvasRenderingContext2DBase::drawImage().  This continues the refactor\nto use NativeImages as the only draw source, removing ImageBuffers.\n\nImplements the fast path for WebGL as an example: WebGL provides\nthe GPUP side NativeImage as the result.\n\nLater commits will modify other canvas rendering contexts to obtain\nthe image directly as a NativeImage.\n\nFixes Skia GraphicsContextGLImageExtractor to not assume\nNativeImages are BGRA. The below\nGraphicsContextGL::createNativeImageFromPixelBuffer already produces\nRGBA images.\n\n* Source/WebCore/html/CanvasBase.cpp:\n(WebCore::CanvasBase::copyNativeImage const):\n* Source/WebCore/html/CanvasBase.h:\n* Source/WebCore/html/HTMLCanvasElement.cpp:\n(WebCore::HTMLCanvasElement::copiedImage const):\n* Source/WebCore/html/OffscreenCanvas.cpp:\n(WebCore::OffscreenCanvas::copiedImage const):\n* Source/WebCore/html/canvas/CanvasRenderingContext.h:\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:\n(WebCore::CanvasRenderingContext2DBase::surfaceBufferToNativeImage):\n(WebCore::CanvasRenderingContext2DBase::didUpdateCanvasSizeProperties):\n(WebCore::CanvasRenderingContext2DBase::drawImage):\n(WebCore::CanvasRenderingContext2DBase::clearCanvas):\n(WebCore::drawImageToContext):\n(WebCore::CanvasRenderingContext2DBase::drawSourceImage):\n(WebCore::CanvasRenderingContext2DBase::didDraw):\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.h:\n* Source/WebCore/html/canvas/GPUCanvasContextCocoa.h:\n* Source/WebCore/html/canvas/GPUCanvasContextCocoa.mm:\n(WebCore::GPUCanvasContextCocoa::didUpdateCanvasSizeProperties):\n(WebCore::GPUCanvasContextCocoa::surfaceBufferToNativeImage):\n(WebCore::GPUCanvasContextCocoa::transferToImageBuffer):\n(WebCore::GPUCanvasContextCocoa::unconfigure):\n(WebCore::GPUCanvasContextCocoa::prepareForDisplay):\n(WebCore::GPUCanvasContextCocoa::markContextChangedAndNotifyCanvasObservers):\n(WebCore::GPUCanvasContextCocoa::updateMemoryCost const):\n* Source/WebCore/html/canvas/ImageBitmapRenderingContext.cpp:\n(WebCore::ImageBitmapRenderingContext::transferFromImageBitmap):\n(WebCore::ImageBitmapRenderingContext::transferToImageBuffer):\n(WebCore::ImageBitmapRenderingContext::surfaceBufferToNativeImage):\n* Source/WebCore/html/canvas/ImageBitmapRenderingContext.h:\n* Source/WebCore/html/canvas/PlaceholderRenderingContext.cpp:\n(WebCore::PlaceholderRenderingContext::setPlaceholderBuffer):\n(WebCore::PlaceholderRenderingContext::surfaceBufferToNativeImage):\n* Source/WebCore/html/canvas/PlaceholderRenderingContext.h:\n* Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp:\n(WebCore::WebGLRenderingContextBase::initializeContextState):\n(WebCore::WebGLRenderingContextBase::markContextChangedAndNotifyCanvasObserver):\n(WebCore::WebGLRenderingContextBase::ReadSurfaceBuffer::clear):\n(WebCore::WebGLRenderingContextBase::ReadSurfaceBuffer::memoryCost const):\n(WebCore::WebGLRenderingContextBase::readSurfaceBuffer):\n(WebCore::WebGLRenderingContextBase::surfaceBufferToNativeImage):\n(WebCore::WebGLRenderingContextBase::surfaceBufferToImageBuffer):\n(WebCore::WebGLRenderingContextBase::didUpdateCanvasSizeProperties):\n(WebCore::WebGLRenderingContextBase::prepareForDisplay):\n(WebCore::WebGLRenderingContextBase::updateMemoryCost const):\n* Source/WebCore/html/canvas/WebGLRenderingContextBase.h:\n(WebCore::WebGLRenderingContextBase::ReadSurfaceBuffer::isEmpty const):\n* Source/WebCore/platform/graphics/skia/GraphicsContextGLSkia.cpp:\n(WebCore::dataFormatForColorType):\n(WebCore::GraphicsContextGLImageExtractor::extractImage):\n\nCanonical link: https://commits.webkit.org/319967@main",
      "email": "kkinnunen@apple.com",
      "hash": "ef17f9b10e301dea11025d6d1cb0c8cdb0573328",
      "subject": "Use copyNativeImage in 2D context drawImage"
    },
    "319968@main": {
      "author": "Sihui Liu",
      "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64",
      "cl": "319968@main",
      "clUrl": "https://commits.webkit.org/319968@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322553\nrdar://185844156\n\nReviewed by Ryosuke Niwa.\n\nWebProcessProxy::initializePreferencesForGPUAndNetworkProcesses currently asserts that a page joining a process has the\nsame preferences as the shared preferences of the process. That does not hold for a dummy process proxy, which is keyed\nonly by session -- a dummy process proxy could be picked for a page's use even if the dummy process proxy is already\nserving pages with different preferences. Picking it regardless of preferences makes sense because a dummy process is\nnot backed by a real process -- it only acts as a placeholder before a real web process (with a non-dummy proxy) is\nlaunched.\n\nTo fix the assertion failure in WebProcessProxy::initializePreferencesForGPUAndNetworkProcesses, add an early return if\nthe proxy is dummy. We decide to skip the whole function instead of just the assertion because the shared preferences\nwill only ever come into effect when there is a real process -- GPU process and network process read one\nSharedPreferencesForWebProcess per web process connection; there is no point in keeping track of the preferences value\nfor dummy process proxy.\n\nAPI test: WebKit.StorageBlockingPolicyMismatchWithDelayedProcessLaunch\n\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::initializePreferencesForGPUAndNetworkProcesses):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/Preferences.mm:\n(configurationWithStorageBlockingPolicy):\n(TEST(WebKit, StorageBlockingPolicyMismatchWithDelayedProcessLaunch)):\n\nCanonical link: https://commits.webkit.org/319968@main",
      "email": "sihui_liu@apple.com",
      "hash": "75da5d772467e31458a65400033d35e4eb1104eb",
      "subject": "Do not compute shared preferences for a dummy process proxy"
    },
    "319969@main": {
      "author": "Sihui Liu",
      "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64",
      "cl": "319969@main",
      "clUrl": "https://commits.webkit.org/319969@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322665\nrdar://185246724\n\nReviewed by Per Arne Vollan.\n\nUnder site isolation, every frame of a page loading a webarchive has to stay in the same archive process because the\narchive's subresources are only loaded into that process. There is a check in WebProcessPool::processForNavigation to\nmake sure subframe loads reuse the archive process. However, when shared process mode is on, we look for a shared\nprocess (BrowsingContextGroup::sharedProcessForSite) before looking for a process in the process pool\n(WebProcessPool::processForNavigation), so the check is skipped, and we might pick a shared process instead of the\narchive process for loading a subframe. Move the check earlier to before the sharedProcessForSite call.\n\nAdd SiteIsolation.LoadWebArchiveWithSharedProcess, which pins SiteIsolationSharedProcessEnabled on and would have caught\nthis. SiteIsolation.LoadWebArchive only inherited the default value of the preference, and it now pins it off so we also\nget coverage for full isolation mode (even if the default becomes shared process mode).\n\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::receivedNavigationActionPolicyDecision):\n* Source/WebKit/UIProcess/WebProcessPool.cpp:\n(WebKit::WebProcessPool::processForNavigation):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, LoadWebArchive)):\n(TestWebKitAPI::(SiteIsolation, LoadWebArchiveWithSharedProcess)):\n\nCanonical link: https://commits.webkit.org/319969@main",
      "email": "sihui_liu@apple.com",
      "hash": "6e575fc4461fd3fab4fa0cb1db22d9726a6e16b6",
      "subject": "[Site Isolation] Cross-site frame in webarchive does not load when shared process mode is on"
    },
    "319971@main": {
      "author": "Qianlang Chen",
      "avatar": "https://www.gravatar.com/avatar/0fd54e904334f604739d0205aa6e2130?d=identicon\u0026s=64",
      "cl": "319971@main",
      "clUrl": "https://commits.webkit.org/319971@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322229\nrdar://185461510\n\nReviewed by BJ Burg.\n\nThis is a step toward enabling frame target, vending them and using them\nin the frontend, by preemptively reworking layout tests that fail when\nframe targets are enabled by a fix to webkit.org/b/321734.\n\nA protocol test cannot pick which target a command goes to, so its\nDOM.getDocument is answered by the main frame's DOM agent. The node id\nin Animation.trackingUpdate comes from the page's DOM agent instead,\nwhich will not push a node before its own document has been requested,\nso the event omits nodeId and the \"Event should have a node ID\"\nassertion fails. Every other assertion in the test passes, which is why\nthis failure reads as unrelated to node ids at first.\n\nRewrite the test as a frontend inspector test instead, where\nWI.domManager requests the document from the page target, which is the\nagent the ids in the event come from.\n\n- That dependency is temporary. Once Animation is served per frame, its\n  node ids will be minted by the frame's DOM agent instead, and the\n  WI.domManager call here is the line that will have to follow them.\n  Resolving them that way today would compare ids from two different\n  spaces, which is the failure this patch removes.\n\nThese tracking events have no frontend model of their own:\nAnimationObserver forwards them to WI.timelineManager, which drops them\nunless a timeline recording is active. The test stubs those three\nmethods instead of starting a recording, so it keeps testing the\nAnimation domain rather than acquiring a dependency on the Timeline\ndomain, which is still page-level and has frame-target problems of its\nown.\n\nWhile here, check what the node id resolves to. Asserting only that\nnodeId is a number would also have passed on an id from the wrong\nagent's space, which is the bug this test now covers, so the node is\nlooked up through WI.domManager and matched against the animating\nelement. The baseline also loses a doubled word in one assertion\nmessage.\n\nNo behavior change. inspector/animation/tracking.html now also passes\nwith frame targets enabled.\n\n* LayoutTests/inspector/animation/tracking-expected.txt:\n* LayoutTests/inspector/animation/tracking.html:\n\nCanonical link: https://commits.webkit.org/319971@main",
      "email": "qianlangchen@apple.com",
      "hash": "0aa45699cc77928adace2bfa1e5c8ea4f46a520f",
      "subject": "[Site Isolation] Web Inspector: Rework protocol test inspector/animation/tracking.html to prep for frame target enablement"
    },
    "319972@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "319972@main",
      "clUrl": "https://commits.webkit.org/319972@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322705\nrdar://185970333\n\nReviewed by Simon Fraser.\n\nBackgroundPainter::calculateFillTileSize() did not correctly implement the\nCSS default sizing algorithm for images that have exactly one intrinsic\ndimension and no intrinsic aspect ratio, such as an SVG with a single\nnon-percent width/height and no viewBox.\n\nTwo problems:\n\n1. contain/cover scaled the image by a single uniform factor, which is only\n   correct when the image has a natural aspect ratio. The spec resolves both\n   keywords against the constraint rectangle using the object's aspect ratio,\n   but:\n\n     \"In both cases, if the object doesn't have a natural aspect ratio, the\n      concrete object size is the specified constraint rectangle.\" [1]\n\n   For a background the constraint rectangle is the background positioning\n   area, so a ratio-less image fills the whole area. Because the missing\n   dimension had already been substituted with the positioning-area size, the\n   limiting scale factor collapsed to 1 and the tile kept its intrinsic (e.g.\n   8px) width instead of filling the area.\n\n2. When one background-size axis was auto and the other a definite length, the\n   auto axis was only resolved through the aspect ratio. With no ratio it was\n   left at the positioning-area size, ignoring the image's intrinsic length on\n   that axis. The spec resolves the missing dimension as:\n\n     \"If the object has a natural aspect ratio, the missing dimension [...] is\n      calculated using that aspect ratio and the present dimension.\n      Otherwise, if the missing dimension is present in the object's natural\n      dimensions, the missing dimension is taken from the object's natural\n      dimensions.\n      Otherwise, the missing dimension [...] is taken from the default object\n      size.\" [2]\n\n   The auto axis now falls back to the image's intrinsic dimension.\n   calculateImageIntrinsicDimensions() already returns the natural dimension\n   when present and otherwise substitutes the default object size (the\n   positioning area), so the single fallback covers both \"otherwise\" clauses\n   and preserves existing behavior for images with no natural length on that\n   axis.\n\nCovers the no-viewBox contain/cover and auto/length cases in the\ncss-backgrounds/background-size/vector WPT suite. The extreme-viewBox cover\ncases remain a separate degenerate-ratio precision issue.\n\n[1] https://drafts.csswg.org/css-images-3/#cover-contain\n[2] https://drafts.csswg.org/css-images-3/#default-sizing\n\n* LayoutTests/TestExpectations: Unskip now passing tests\n* Source/WebCore/rendering/BackgroundPainter.cpp:\n(WebCore::BackgroundPainter::calculateFillTileSize):\n\nCanonical link: https://commits.webkit.org/319972@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "854eb722df0f08bb9414096e480860dca2c8d77b",
      "subject": "background-size: contain/cover and auto sizing ignore SVG images with one intrinsic dimension and no aspect ratio"
    },
    "319973@main": {
      "author": "Pascoe",
      "avatar": "https://www.gravatar.com/avatar/7a6e50b09dba6a185f45250268683d71?d=identicon\u0026s=64",
      "cl": "319973@main",
      "clUrl": "https://commits.webkit.org/319973@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321380\nrdar://problem/184430447\n\nReviewed by Abrar Rahman Protyasha.\n\nValidate related origins in WebKit by fetching the RP's well-known resource on the page's\nnetwork session.\n\nThe rules live in WebCore as WellKnownOriginList, which takes the endpoint path and JSON\nmember name as arguments so that another feature can reuse them. The fetch is\nWellKnownResourceFetcher, bounded in both directions since the host is page controlled.\n\n33 unit tests cover the parsing and matching logic (label limits, malformed JSON, scheme\nvalidation, redirect policy). 15 API tests cover the fetch lifecycle including timeout,\nsize limits, redirects, MIME enforcement, and the delegate receiving validated origins.\n\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Modules/webauthn/WellKnownOriginList.cpp: Added.\n(WebCore::wellKnownURL):\n(WebCore::isWellKnownResponseAcceptable):\n(WebCore::isWellKnownRedirectAllowed):\n(WebCore::findOriginInWellKnownList):\n(WebCore::parseOriginsFromWellKnownList):\n* Source/WebCore/Modules/webauthn/WellKnownOriginList.h: Added.\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebKit/Sources.txt:\n* Source/WebKit/UIProcess/API/APIUIClient.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKUIDelegatePrivate.h:\n* Source/WebKit/UIProcess/Cocoa/UIDelegate.h:\n* Source/WebKit/UIProcess/Cocoa/UIDelegate.mm:\n* Source/WebKit/UIProcess/WebAuthentication/Cocoa/WebAuthenticatorCoordinatorProxy.mm:\n(WebKit::WebAuthenticatorCoordinatorProxy::performRequest):\n(WebKit::WebAuthenticatorCoordinatorProxy::performRequestWithValidatedRelyingPartyIdentifier):\n* Source/WebKit/UIProcess/WebAuthentication/RelatedOriginsValidator.cpp: Added.\n(WebKit::RelatedOriginsValidation::validate):\n* Source/WebKit/UIProcess/WebAuthentication/RelatedOriginsValidator.h: Added.\n* Source/WebKit/UIProcess/WebAuthentication/WebAuthenticatorCoordinatorProxy.cpp:\n(WebKit::WebAuthenticatorCoordinatorProxy::handleRequest):\n* Source/WebKit/UIProcess/WebAuthentication/WebAuthenticatorCoordinatorProxy.h:\n* Source/WebKit/UIProcess/WellKnownResourceFetcher.cpp: Added.\n(WebKit::WellKnownResourceFetcher::fetch):\n* Source/WebKit/UIProcess/WellKnownResourceFetcher.h: Added.\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Tools/Scripts/webkitpy/api_tests/allowlist.txt:\n* Tools/TestWebKitAPI/CMakeLists.txt:\n* Tools/TestWebKitAPI/SourcesCocoa.txt:\n* Tools/TestWebKitAPI/Tests/WebCore/WellKnownOriginList.cpp: Added.\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebAuthnRelatedOriginsFetch.mm: Added.\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/319973@main",
      "email": "pascoe@apple.com",
      "hash": "86e957015e02f6e737e1f7c6d5217499ff36ab2f",
      "subject": "[WebAuthn] Perform validation of related origins"
    },
    "319974@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/3d43be18ce5ee6b92ba9151b63591125?d=identicon\u0026s=64",
      "cl": "319974@main",
      "clUrl": "https://commits.webkit.org/319974@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322679\n\nReviewed by Ryosuke Niwa.\n\ntrackIndexCompare computed `a-\u003etrackIndex() - b-\u003etrackIndex() \u003c 0` as a\nstrict-weak-ordering predicate for std::ranges::sort. Subtracting two ints\ncan overflow, which would flip the comparison sign and violate the sort's\nordering invariant. Compare the indices directly instead.\n\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::trackIndexCompare):\n\nCanonical link: https://commits.webkit.org/319974@main",
      "email": "ahmad.saleem792@gmail.com",
      "hash": "456e79b9bc5868a64f5ab86d3a7de7e6b0516bb7",
      "subject": "trackIndexCompare uses int subtraction that can overflow"
    },
    "319975@main": {
      "author": "Joanne Pan",
      "avatar": "https://www.gravatar.com/avatar/5cbbf578426a0c98cb5c977ca2dd88fc?d=identicon\u0026s=64",
      "cl": "319975@main",
      "clUrl": "https://commits.webkit.org/319975@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322506\nrdar://174933173\n\nReviewed by Ryosuke Niwa and Wenson Hsieh.\n\nThe problem:\nCopying dark text from a light page and pasting into an editor that themes\nitself dark via author CSS, such as mail.yahoo.com's compose body, leaves the\ncaret painted in the pasted text's color against the dark surface. On Yahoo,\nwith text pasted from https://www.phoronix.com/news/Linux-6.19-KVM, that is an\nrgb(18, 18, 18) caret on rgb(50, 50, 50), 1.46:1. Two things cause it:\n- Copy serializes caret-color: auto as the color it resolved to, so it arrives\n  in the destination as an author declaration and the code paths conditioned on\n  the value being auto no longer apply. Because auto resolves to currentColor,\n  the color that lands is one chosen against the source page's background and\n  then used against a different one.\n- An inline box's background covers only the text on each line, so a caret\n  positioned past the end of that box sits on the editor's surface while still\n  using the color chosen for white. A line that wrapped keeps its trailing space\n  inside the box, so the caret is only past the edge where no such space\n  follows, as at the end of the pasted run.\n\nThe fix:\nDrop caret-color from the wrapping style in\nEditingStyle::wrappingStyleForSerialization, in the annotating branch, when the\ncopy context computed to auto.\n\nIn CaretBase::computeCaretColor, when caret-color is auto, treat an inline\nancestor's opaque background as sitting behind the caret when the caret's\nmidpoint along the inline axis falls inside one of that inline's boxes. The caret\nrect picks up in-flow position offsets on the way to the caret painter through\noffsetFromContainer, while an inline's display box rect does not, so the box\nrects are translated by the same offsets before comparing. Walking outward, the\nfirst opaque inline that does cover the caret wins. Where none reaches it, use\nthe style that would have applied without those inlines. Otherwise measure\nagainst the background that does reach it and substitute a color clearing 3:1.\nThe caret painter's own color is preferred, so an editor that themes itself keeps\npainting the caret the color it already uses elsewhere. The system accent comes\nnext, and then black or white, because four of the eight macOS accent colors fall\nshort of 3:1 against one surface or the other.\n\nThe accumulation starts at the parent when the node's renderer is a RenderText,\nbecause RenderText::style() returns its parent's style and the innermost\nbackground would otherwise be counted twice.\n\nOnly auto is adjusted. CSS UI 4 § 5.2.1\n(https://drafts.csswg.org/css-ui-4/#caret-color) permits it there, \"User agents\nmay automatically adjust the color of caret to ensure good visibility and\ncontrast with the surrounding content\", and rules it out for an explicit value:\n\"The caret is colored with the specified color.\"\n\nThe wrapping style is the right place for the removal because it sits downstream\nof both base style computations. The other candidate, the\nEditingStyle(Position, PropertiesToInclude) constructor, is upstream of them.\nRemoving the property there deletes an authored caret-color: transparent through\nprepareToApplyAt, which compares caret-color without first checking that the base\nstyle has the property, a guard extractPropertiesNotIn does have. It also stops\nextractPropertiesNotIn subtracting the property at all, serializing caret-color\ninto copy and paste across a shadow boundary where there had been none.\n\nMeasured with internals.paintedCaretColor(), which is added because the painted color\nis not observable from computed style. Against the editor's rgb(50, 50, 50) the\npasted rgb(68, 68, 68) caret is 1.32:1. Right after paste, after inserting a\nparagraph, after typing a character, and at the end of a wrapped run it becomes\nthe editor's own rgb(253, 253, 253) at 12.6:1. Mid-run, where the caret really is\nover the pasted white background, it stays rgb(68, 68, 68) at 9.7:1. A source\npage with no declared background has no white to inherit from, and the accent\nsubstitutes at 3.2:1.\n\nContent copied by a build without this change carries an explicit caret-color,\nwhich is an author declaration and is left alone, so pasting from an older build\nor an existing draft is unchanged.\n\nThe test asserts a contrast ratio. It does not assert exact colors, because the\naccent comes from NSColor.controlAccentColor at runtime and the test harness does\nnot pin it. It is skipped where HAVE(REDESIGNED_TEXT_CURSOR) is off, and on iOS,\nwhich paints the caret in the tint color.\n\nBlink resolves caret-color with no contrast fallback. In\ncaret_display_item_client.cc it calls ResolveColor, and the only adjustment is a\n0.5 alpha for block carets. Gecko has contrast helpers, RelativeLuminanceUtils\nand NS_LUMINOSITY_DIFFERENCE, applied to selection text and theme colors. Its\ncaret path leaves the color alone, and nsIFrame::GetCaretColorAt returns the\ncomputed value unmodified.\n\nTest: editing/caret/caret-color-all-configurations.html\n\n* LayoutTests/editing/caret/caret-color-all-configurations-expected.txt: Added.\n* LayoutTests/editing/caret/caret-color-all-configurations.html: Added.\n* LayoutTests/editing/pasteboard/copy-multiparagraph-with-background-color-expected.txt:\n* LayoutTests/editing/pasteboard/do-not-copy-unnecessary-styles-2-expected.txt:\n* LayoutTests/editing/pasteboard/paste-dark-mode-color-filtered-expected.txt:\n* LayoutTests/editing/pasteboard/paste-dark-mode-color-filtered.html:\n* LayoutTests/editing/pasteboard/preserve-underline-color-expected.txt:\n* LayoutTests/fast/events/input-events-paste-rich-datatransfer-expected.txt:\n* LayoutTests/platform/glib/editing/style/5065910-expected.txt:\n* LayoutTests/platform/mac/editing/style/5065910-expected.txt:\n* LayoutTests/platform/mac/fast/events/ondrop-text-html-expected.txt:\n* LayoutTests/platform/win/editing/style/5065910-expected.txt:\n* Source/WebCore/editing/EditingStyle.cpp:\n(WebCore::EditingStyle::wrappingStyleForSerialization):\n* Source/WebCore/editing/FrameSelection.cpp:\n(WebCore::backgroundPaintsUnderCaret):\n(WebCore::rendererSkippingInlinesNotPaintingUnderCaret):\n(WebCore::CaretBase::computeCaretColor):\n(WebCore::caretColorForNode):\n(WebCore::FrameSelection::paintedCaretColor):\n(WebCore::CaretBase::paintCaret const):\n* Source/WebCore/editing/FrameSelection.h:\n* Source/WebCore/rendering/ios/RenderThemeIOS.mm:\n(WebCore::RenderThemeIOS::autocorrectionReplacementMarkerColor const):\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::caretColor):\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\n* Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm:\n(WebKit::WebPage::getPlatformEditorState const):\n* Source/WebKitLegacy/mac/WebView/WebFrame.mm:\n(-[WebFrame caretColor]):\n\nCanonical link: https://commits.webkit.org/319975@main",
      "email": "jpan0917@gmail.com",
      "hash": "07e24414b519ed16b9978efe831fc90564782bd4",
      "subject": "mail.yahoo.com: Copying Text change caret color to text color from copied article and make it difficult to find (when Dark Mode + Dark Text copied)"
    },
    "319976@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "319976@main",
      "clUrl": "https://commits.webkit.org/319976@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=322725\u003e\n\u003crdar://185997724\u003e\n\nReviewed by Elliott Williams.\n\nGuard the public-SDK geometry fallbacks so they cannot redeclare\n`CGRect` and `CGSize`.  `IntRect.h` and `IntSize.h` define `NSRect` and\n`NSSize` as object-like macros for `CGRect` and `CGSize` on iOS, so in\na translation unit that included either header first the fallback\ntypedefs expand into a second declaration of `CGRect` and of `CGSize`,\nand Swift cannot resolve a cross-reference when two candidates carry\nthe same name.  `WAKAppKitStubs.h` includes neither header, and is\nalso consumed where those macros are absent, so it cannot assume\neither state.\n\nEvery other definition in the same block is already `#ifndef`-guarded,\nso guarding these three restores the block's own invariant while\nleaving the standalone case intact: a translation unit with no macro\nin scope still gets real `NSPoint`, `NSRect` and `NSSize` typedefs.\nNo `#define NSPoint CGPoint` currently exists, so that guard is\ndefensive.\n\nNo new tests since this change is not directly testable.\n\n* Source/WebCore/platform/ios/wak/WAKAppKitStubs.h:\n\nCanonical link: https://commits.webkit.org/319976@main",
      "email": "ddkilzer@apple.com",
      "hash": "874029ca893872b29e0634e3d7ebd54b1b76579c",
      "subject": "WAKAppKitStubs.h declares duplicate CGRect and CGSize type aliases when building against the public SDK"
    },
    "319977@main": {
      "author": "Roberto Rodriguez",
      "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64",
      "cl": "319977@main",
      "clUrl": "https://commits.webkit.org/319977@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322224\nrdar://181806881\n\nReviewed by Kimmo Kinnunen.\n\nIn a fragment shader, calling interpolateAt on a single element of an input array\nmarks the whole array as an interpolant. ANGLE's MSL translator then has to wrap\nother references to it in an interpolation function. Since no overload takes an\nentire array the internal symbol table returns nullptr. The caller then asserts\nnon-null in debug builds and dereferences the nullptr in release, crashing\neither way.\n\nFix by interpolating each element and building a new array from the results. The\nnew array is just a temp, so it is not an interpolant itself. Each element gets\nits own copy of the original reference, so the original is dropped rather than\nreused.\n\n* Source/ThirdParty/ANGLE/src/compiler/translator/tree_ops/msl/RewriteInterpolants.cpp:\n* Source/ThirdParty/ANGLE/src/tests/gl_tests/ShaderMultisampleInterpolation.cpp:\n\nCanonical link: https://commits.webkit.org/319977@main",
      "email": "roberto_rodriguez2@apple.com",
      "hash": "37cb0315e58b50bdaacded723a686faa123cc176",
      "subject": "[ANGLE] Correctly rewrite unindexed interpolant array references"
    },
    "319978@main": {
      "author": "Claudio Saavedra",
      "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64",
      "cl": "319978@main",
      "clUrl": "https://commits.webkit.org/319978@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318258\n\nReviewed by Nikolas Zimmermann.\n\n311720@main replaced WebCore::SVGFilterRenderer's isShowingDebugOverlay with an\nOptionSet\u003cFilterRenderingOption\u003e. The test still sends the old field, so\nserialization rejects the payload and the message never reaches the case being\ntested. Send renderingOptions instead and remove the expectations.\n\n* LayoutTests/ipc/fecolormatrix-type-values-mismatch-crash.html:\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319978@main",
      "email": "csaavedra@igalia.com",
      "hash": "eb1d4acd949bce09871ee4b5a320630283cfe3b0",
      "subject": "NEW TEST(315306@main): [ iOS macOS Debug ] ipc/fecolormatrix-type-values-mismatch-crash.html is a constant failure (TEXT)"
    },
    "319979@main": {
      "author": "Kai Tamkun",
      "avatar": "https://www.gravatar.com/avatar/dff073cba21885df4d9f73ed3cc493c2?d=identicon\u0026s=64",
      "cl": "319979@main",
      "clUrl": "https://commits.webkit.org/319979@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317450\nrdar://179017779\n\nReviewed by Yusuke Suzuki.\n\nThis patch expands an expression stack check to force the signature\nin all cases, not just for if/else.\n\nTest: JSTests/wasm/regress/try-catch-result-type.js\n\n* JSTests/wasm/regress/try-catch-result-type.js: Added.\n* Source/JavaScriptCore/wasm/WasmFunctionParser.h:\n(JSC::Wasm::FunctionParser\u003cContext\u003e::parseExpression):\n\nOriginally-landed-as: 305413.1013@safari-7624.5-branch (39a1fcf84d47). rdar://185368910\nCanonical link: https://commits.webkit.org/319979@main",
      "email": "k_tamkun@apple.com",
      "hash": "8f229fb72961093d2f552ecfef65a8f13afd402a",
      "subject": "[JSC] WebAssembly try/catch result-type confusion omits optimized reference checks"
    },
    "319980@main": {
      "author": "Tim Nguyen",
      "avatar": "https://www.gravatar.com/avatar/208c05ac2decdf818a4a08ada568328e?d=identicon\u0026s=64",
      "cl": "319980@main",
      "clUrl": "https://commits.webkit.org/319980@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322732\nrdar://186002281\n\nReviewed by Simon Fraser.\n\n* Source/WebCore/style/computed/data/StyleNonInheritedMiscData.cpp:\n(WebCore::Style::NonInheritedMiscData::dumpDifferences const):\n\nCanonical link: https://commits.webkit.org/319980@main",
      "email": "ntim@apple.com",
      "hash": "ed6717d3e229c14e13152fd47803508d41cb913a",
      "subject": "Fix typos in `NonInheritedMiscData::dumpDifferences`"
    },
    "319981@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "319981@main",
      "clUrl": "https://commits.webkit.org/319981@main",
      "description": "rdar://185883588\nhttps://bugs.webkit.org/show_bug.cgi?id=322545\n\nReviewed by Alex Christensen.\n\nWhen the stream is pulling the FetchBodySource, we check whether the FetchResponse has already received some data.\nIf so, we enqueue the data on the readable stream. This is implemented via FetchResponse::feedStream().\n\nTest: imported/w3c/web-platform-tests/fetch/api/response/response-body-stashed-chunk.html\n\n* LayoutTests/imported/w3c/web-platform-tests/fetch/api/resources/stashed-chunk.py: Added.\n(main):\n* LayoutTests/imported/w3c/web-platform-tests/fetch/api/response/response-body-stashed-chunk-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/fetch/api/response/response-body-stashed-chunk.html: Added.\n* Source/WebCore/Modules/fetch/FetchBodySource.cpp:\n(WebCore::FetchBodySource::pull):\n\nCanonical link: https://commits.webkit.org/319981@main",
      "email": "youenn@apple.com",
      "hash": "718031552ba1f92ec2e38be89387408077d3f7ba",
      "subject": "REGRESSION: streaming fetch() body is withheld until the next network chunk when the reader is busy"
    },
    "319982@main": {
      "author": "Fady Farag",
      "avatar": "https://www.gravatar.com/avatar/0ac5127c69f90d0c57054173ae4c3108?d=identicon\u0026s=64",
      "cl": "319982@main",
      "clUrl": "https://commits.webkit.org/319982@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322668\nrdar://185940168\n\nReviewed by Chris Dumez.\n\nThis makes `DateTimeFieldElementFieldOwner` ref-countable since nothing enforces\nthat the owner stays alive across its virtual functions.\n\nNo new tests since there should be no behavioral changes.\n\n* Source/WebCore/html/shadow/DateTimeEditElement.h:\n* Source/WebCore/html/shadow/DateTimeFieldElement.cpp:\n(WebCore::DateTimeFieldElement::defaultKeyboardEventHandler):\n(WebCore::DateTimeFieldElement::isFieldOwnerDisabled const):\n(WebCore::DateTimeFieldElement::isFieldOwnerReadOnly const):\n(WebCore::DateTimeFieldElement::isFieldOwnerHorizontal const):\n(WebCore::DateTimeFieldElement::handleBlurEvent):\n(WebCore::DateTimeFieldElement::localeIdentifier const):\n(WebCore::DateTimeFieldElement::updateVisibleValue):\n(WebCore::DateTimeFieldElement::transferredFocusToPicker const):\n(WebCore::DateTimeFieldElement::didSuppressBlurDueToPickerFocusTransfer):\n* Source/WebCore/html/shadow/DateTimeFieldElement.h:\n\nCanonical link: https://commits.webkit.org/319982@main",
      "email": "com.webkit.iidmsa@gmail.com",
      "hash": "a7c0b0f9062b64c36bba6b192ab725c010990afb",
      "subject": "Harden `DateTimeFieldElement` by making `DateTimeFieldElementFieldOwner` ref-countable"
    },
    "319983@main": {
      "author": "Jessica Lee",
      "avatar": "https://www.gravatar.com/avatar/fc717c99321d09f31fb9187418a8ffc5?d=identicon\u0026s=64",
      "cl": "319983@main",
      "clUrl": "https://commits.webkit.org/319983@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322702\nrdar://185968683\n\nReviewed by Sihui Liu.\n\nresults.webkit.org shows these tests as passing now.\n\n* LayoutTests/platform/ios-site-isolation/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319983@main",
      "email": "jlee53@apple.com",
      "hash": "cc7fb4f50c14778a058e17c6d76eaaddf6dd62e4",
      "subject": "[Site Isolation] Remove failing expectations for authentication-redirect layout tests"
    },
    "319984@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "319984@main",
      "clUrl": "https://commits.webkit.org/319984@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322703\nrdar://185969611\n\nReviewed by Keith Miller.\n\nWe optimize StructureCache lookup cases.\n\n1. When inserting a new entry, we set mayBePrototype bit and then insert\n   it into the Map. This means that, if your prototype is not having\n   mayBePrototype bit, it must not exist in the Map. So we can skip\n   looking up.\n2. emptyStructureForPrototypeFromBaseStructure caller is caching the\n   result in InternalFunction::createSubclassStructure by storing the\n   result into targetFunction-\u003eensureRareData()-\u003einternalFunctionAllocationProfile().\n   We skip using a cache when it is cached in a different way.\n\n* Source/JavaScriptCore/bytecode/InternalFunctionAllocationProfile.h:\n(JSC::InternalFunctionAllocationProfile::createAllocationStructureFromBase):\n* Source/JavaScriptCore/runtime/StructureCache.cpp:\n(JSC::StructureCache::createEmptyStructure):\n(JSC::StructureCache::emptyStructureForPrototypeFromBaseStructure):\n(JSC::StructureCache::emptyObjectStructureForPrototype):\n* Source/JavaScriptCore/runtime/StructureCache.h:\n\nCanonical link: https://commits.webkit.org/319984@main",
      "email": "ysuzuki@apple.com",
      "hash": "57d983744d8291b14fccd688f04669011fe80254",
      "subject": "[JSC] Skip the global StructureCache when the prototype has never been a prototype"
    },
    "319985@main": {
      "author": "Robert Jenner",
      "avatar": "https://www.gravatar.com/avatar/05a1bd874251a1f64c7b6a0ed8120640?d=identicon\u0026s=64",
      "cl": "319985@main",
      "clUrl": "https://commits.webkit.org/319985@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322733\nrdar://186004697\n\nReviewed by Aakash Jain.\n\n* Tools/CISupport/build-webkit-org/public_html/dashboard/Images/GoldenGate.png: Added.\n* Tools/CISupport/build-webkit-org/public_html/dashboard/Images/IOS27.png: Added.\n* Tools/CISupport/build-webkit-org/public_html/dashboard/Images/IOS27Simulator.png: Added.\n* Tools/CISupport/build-webkit-org/public_html/dashboard/Images/WatchOS27Simulator.png: Added.\n* Tools/CISupport/build-webkit-org/public_html/dashboard/Images/tvOS27.png: Added.\n* Tools/CISupport/build-webkit-org/public_html/dashboard/Images/tvOS27Simulator.png: Added.\n* Tools/CISupport/build-webkit-org/public_html/dashboard/Images/visionOS27.png: Added.\n* Tools/CISupport/build-webkit-org/public_html/dashboard/Images/visionOS27Simulator.png: Added.\n* Tools/CISupport/build-webkit-org/public_html/dashboard/Images/watchOS27.png: Added.\n\nCanonical link: https://commits.webkit.org/319985@main",
      "email": "jenner@apple.com",
      "hash": "34e16869fec3c9e4dd68b3ab4adc1071457e64b6",
      "subject": "Add OS 27 family OS images for use on the dashboard"
    },
    "319986@main": {
      "author": "Qianlang Chen",
      "avatar": "https://www.gravatar.com/avatar/0fd54e904334f604739d0205aa6e2130?d=identicon\u0026s=64",
      "cl": "319986@main",
      "clUrl": "https://commits.webkit.org/319986@main",
      "description": "rdar://185371675\nhttps://bugs.webkit.org/show_bug.cgi?id=322150\n\nReviewed by BJ Burg.\n\nThis is a step toward enabling frame target, vending them and using them\nin the frontend, by preemptively reworking layout tests that fail when\nframe targets are enabled by a fix to webkit.org/b/321734.\n\nProtocol tests send every command to the main frame's inspector\ncontroller first, and only the domains that frame does not serve fall\nback to the page, because InspectorStubFrontend is created with\nDispatchBackendTarget::MainFrame. DOM is served per frame and LayerTree\nis not, so DOM.getDocument is answered by FrameDOMAgent and primes that\nagent's node-id space, while LayerTree.layersForNode keeps resolving\nnode ids through the page's InspectorDOMAgent, whose document was never\nrequested. The two id spaces are disjoint, and the command fails with\n\"Missing node for given nodeId\".\n\nA protocol test cannot choose which target a command goes to, and there\nis no plan to teach it how. These tests are rewritten as frontend tests\ninstead, where WI.domManager sources nodes from the page target for\nboth sides of the call, which is also the path the product itself\ntakes.\n\nAll six tests in the directory are converted, not only the three the\nEWS run reported as regressions. The other three failed identically,\nbut already carried lenient Pass Failure expectations, so their\nfailures counted as expected results and never surfaced. Those\nexpectations are removed. The rewritten tests wait for an event the\npage sends once the new layer has reached the layer tree, instead of\nre-reading the tree after a bare requestAnimationFrame, and they report\nonly the geometry they assert on instead of serializing every layer.\n\n- LayerTree.layerTreeDidChange would be the more direct thing to wait\n  for, since the backend dispatches it at the end of the compositing\n  update that creates the layer, but it cannot be used here. The agent\n  sends that event at most once per LayerTree.layersForNode call, so any\n  unrelated compositing update between the test's first request and its\n  mutation consumes the one event the mutation would have produced, and\n  the test would then be left waiting for an event that never arrives.\n\n- The recorded layer set changes as a side effect. layers-for-node used\n  to record six layers before its mutation, including a second\n  window-sized layer, where the converted test records five. Five is\n  what the neighboring layer-tree-manager.html asserts for the same set\n  of composited divs, and that test has never needed a lenient\n  expectation. The old test read the tree immediately after enabling the\n  agent and receiving the first layerTreeDidChange, which is a different\n  point in the layer-tree lifecycle than where the converted test reads\n  it.\n\nNo behavior change. The tests in inspector/layers that used to be\nprotocol tests now progress when frame targets are surfaced and used.\n\n* LayoutTests/inspector/layers/layers-anonymous-expected.txt:\n* LayoutTests/inspector/layers/layers-anonymous.html:\n* LayoutTests/inspector/layers/layers-blending-compositing-reasons-expected.txt:\n* LayoutTests/inspector/layers/layers-blending-compositing-reasons.html:\n* LayoutTests/inspector/layers/layers-compositing-reasons-expected.txt:\n* LayoutTests/inspector/layers/layers-compositing-reasons.html:\n* LayoutTests/inspector/layers/layers-for-node-expected.txt:\n* LayoutTests/inspector/layers/layers-for-node.html:\n* LayoutTests/inspector/layers/layers-generated-content-expected.txt:\n* LayoutTests/inspector/layers/layers-generated-content.html:\n* LayoutTests/inspector/layers/layers-reflected-content-expected.txt:\n* LayoutTests/inspector/layers/layers-reflected-content.html:\n* LayoutTests/inspector/layers/resources/layer-utilities.js: Added.\n(TestPage.registerInitializer.window.getLayersForNode):\n(TestPage.registerInitializer.window.getReasonsForCompositingLayer):\n(TestPage.registerInitializer.async let):\n(TestPage.registerInitializer.window.getDocumentAndLayers):\n* LayoutTests/platform/mac/TestExpectations:\n\nCanonical link: https://commits.webkit.org/319986@main",
      "email": "qianlangchen@apple.com",
      "hash": "b0dfdebfdb99e029777f57fa38d6360f71a4537f",
      "subject": "[Site Isolation] Web Inspector: Rework protocol tests in inspector/layers to prep for frame target enablement"
    },
    "319987@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "319987@main",
      "clUrl": "https://commits.webkit.org/319987@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322722\n\nReviewed by Geoffrey Garen.\n\nAnnotate these functions and their variants with CLANG_POINTER_CONVERSION.\n\nNo new tests since there should be no behavior changes.\n\n* Source/WebKit/WebProcess/InjectedBundle/API/mac/WKDOMInternals.h:\n\nCanonical link: https://commits.webkit.org/319987@main",
      "email": "rniwa@webkit.org",
      "hash": "c64092e902106904e3ce2e345a9d71c3a25a5a68",
      "subject": "Annotate toWebCoreNode / toWKDOMNode as pointer conversion"
    },
    "319988@main": {
      "author": "Kiet Ho",
      "avatar": "https://www.gravatar.com/avatar/d9058b37006dce1f55f91b8ccc82f9a3?d=identicon\u0026s=64",
      "cl": "319988@main",
      "clUrl": "https://commits.webkit.org/319988@main",
      "description": "rdar://185154835\nhttps://bugs.webkit.org/show_bug.cgi?id=321977\n\nReviewed by Antti Koivisto.\n\nCSSWG resolves in 2022 [1] to add CSSMediaRule.matches, which returns\nwhether the query in @media matches or not.\n\nSupposedly, .matches should evaluate the media query against the current media,\nincluding when the page is being printed. This implementation has that, but\nit's not possible to write a test for this, as run-webkit-tests doesn't support\nWPT print reftests.\n\n[1]: https://github.com/w3c/csswg-drafts/issues/4240#issuecomment-1196983719\n\nTests: imported/w3c/web-platform-tests/css/css-conditional/at-media-matches-001.html\n       imported/w3c/web-platform-tests/css/css-conditional/at-media-matches-002.html\n       imported/w3c/web-platform-tests/css/css-conditional/idlharness.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/at-media-matches-001-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/at-media-matches-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/at-media-matches-002-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/at-media-matches-002.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/idlharness-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-conditional/support/at-media-matches-002-iframe.html: Added.\n* Source/WebCore/css/CSSMediaRule.cpp:\n(WebCore::CSSMediaRule::matches const):\n* Source/WebCore/css/CSSMediaRule.h:\n* Source/WebCore/css/CSSMediaRule.idl:\n\nCanonical link: https://commits.webkit.org/319988@main",
      "email": "kiet.ho@apple.com",
      "hash": "965fa913bdf7df5567909e4d438ffad3d9610e63",
      "subject": "[css-conditional-3] Support CSSMediaRule.matches"
    },
    "319989@main": {
      "author": "Dawn Morningstar",
      "avatar": "https://www.gravatar.com/avatar/9b791f3f02553608941e76bb5eecd471?d=identicon\u0026s=64",
      "cl": "319989@main",
      "clUrl": "https://commits.webkit.org/319989@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322737\nrdar://186007334\n\nReviewed by Jonathan Bedard.\n\nCPU_ESTIMATE_PER_SIMULATOR_INSTANCE = 2 overprescribes cpu now, 1 is fine\n\n* Tools/Scripts/webkitpy/xcode/simulated_device.py:\n(SimulatedDeviceManager):\n\nCanonical link: https://commits.webkit.org/319989@main",
      "email": "morningstar@apple.com",
      "hash": "88c3ee4accb454ebd214e4ad8f7f1186fe945f72",
      "subject": "[webkitpy] Lower the per-simulator CPU estimate"
    },
    "319990@main": {
      "author": "Dawn Morningstar",
      "avatar": "https://www.gravatar.com/avatar/9b791f3f02553608941e76bb5eecd471?d=identicon\u0026s=64",
      "cl": "319990@main",
      "clUrl": "https://commits.webkit.org/319990@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322742\nrdar://186010592\n\nReviewed by Jonathan Bedard.\n\n319749@main made dynamic simulator counts accurate, so these queues no longer need to pin\n\n* Tools/CISupport/ews-build/config.json:\n\nCanonical link: https://commits.webkit.org/319990@main",
      "email": "morningstar@apple.com",
      "hash": "bfdfa49a89b2a5020ba6462caf8fc5a245a3dd77",
      "subject": "[ews] Choose the simulator count dynamically on the iOS simulator queues"
    },
    "319991@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "319991@main",
      "clUrl": "https://commits.webkit.org/319991@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322659\nrdar://185932647\n\nReviewed by Adrian Taylor.\n\nCxxCompletionHandler currently has `BitwiseCopyable \u0026 Sendable` for its `Argument` associatedtype,\nand uses `pointer.load(as:)` to copy the value. This is fine for trivial copyable types, but meant\nthat noncopyable argument types were prohibited.\n\nRelax this restriction by changing the requirement to `~Copyable` and transfer the ownership of the\nargument instead of copying it. In the non-trivial case, this works by constructing the argument\ninto a new buffer which Swift then relocates and moves the value out of.\n\nTo facilitate this, a new `CxxConsumingCompletionHandler` protocol is added because the importer\nspells `operator()` as `callAsFunction(consuming:)` when the C++ parameter is an rvalue reference.\n\nTest: Tools/TestWebKitAPI/Tests/WTF/cocoa/SwiftCxxInteropTests.swift\n\n* Source/WTF/wtf/CompletionHandler.h:\n(WTF::CompletionHandler\u003cOut):\n* Source/WTF/wtf/module.modulemap:\n* Source/WebKit/Shared/WTFCompletionHandler+Extras.swift:\n(CxxCompletionHandler.callAsFunction(_:)):\n(CxxConsumingCompletionHandler.callAsFunction(_:)):\n(SwiftClosureBoxBase.call(with:)):\n(SwiftVoidClosureBox.call(with:)):\n(SwiftClosureBox.call(with:)):\n* Tools/TestWebKitAPI/Helpers/WTFCompletionHandler+Extras.swift:\n(CxxCompletionHandler.callAsFunction(_:)):\n(CxxConsumingCompletionHandler.callAsFunction(_:)):\n(SwiftClosureBoxBase.call(with:)):\n(SwiftVoidClosureBox.call(with:)):\n(SwiftClosureBox.call(with:)):\n* Tools/TestWebKitAPI/TestWTFLibrary/SwiftCxxInteropTestbed.cpp:\n(SwiftCxxInteropTestbed::liveMoveOnlyProbes):\n(SwiftCxxInteropTestbed::MoveOnlyProbe::MoveOnlyProbe):\n(SwiftCxxInteropTestbed::MoveOnlyProbe::~MoveOnlyProbe):\n(SwiftCxxInteropTestbed::liveMoveOnlyProbeCount):\n(SwiftCxxInteropTestbed::liveCopyCountingProbes):\n(SwiftCxxInteropTestbed::copyCountingProbeCopies):\n(SwiftCxxInteropTestbed::CopyCountingProbe::CopyCountingProbe):\n(SwiftCxxInteropTestbed::CopyCountingProbe::~CopyCountingProbe):\n(SwiftCxxInteropTestbed::liveCopyCountingProbeCount):\n(SwiftCxxInteropTestbed::copyCountingProbeCopyCount):\n(SwiftCxxInteropTestbed::resetCopyCountingProbeCounts):\n(SwiftCxxInteropTestbed::callMoveOnlyProbeCompletionHandler):\n(SwiftCxxInteropTestbed::callMoveOnlyProbeByValueCompletionHandler):\n(SwiftCxxInteropTestbed::callCopyCountingProbeCompletionHandler):\n(SwiftCxxInteropTestbed::storedMoveOnlyProbeCompletionHandler):\n(SwiftCxxInteropTestbed::storeMoveOnlyProbeCompletionHandler):\n(SwiftCxxInteropTestbed::invokeStoredMoveOnlyProbeCompletionHandler):\n(SwiftCxxInteropTestbed::resetStoredMoveOnlyProbeCompletionHandler):\n* Tools/TestWebKitAPI/TestWTFLibrary/SwiftCxxInteropTestbed.h:\n(SwiftCxxInteropTestbed::MoveOnlyProbe::value const):\n(SwiftCxxInteropTestbed::CopyCountingProbe::value const):\n* Tools/TestWebKitAPI/Tests/WTF/cocoa/SwiftCxxInteropTests.swift:\n(SwiftCxxInteropTests.moveOnlyCompletionHandlerReceivesItsArgument):\n(SwiftCxxInteropTests.moveOnlyByValueCompletionHandlerReceivesItsArgument):\n(SwiftCxxInteropTests.moveOnlyArgumentIsDestroyedWhenTheClosureIgnoresIt):\n(SwiftCxxInteropTests.storedMoveOnlyCompletionHandlerSurvivesUntilInvoked):\n(SwiftCxxInteropTests.copyableArgumentIsCopiedRatherThanTakenFromTheCaller):\n\nCanonical link: https://commits.webkit.org/319991@main",
      "email": "richard_robinson2@apple.com",
      "hash": "436d708da9283630f51ba699e2ef24d8fecd1edb",
      "subject": "[Swift in WebKit] Make it possible for CxxCompletionHandler to be used with noncopyable arguments"
    },
    "319992@main": {
      "author": "Diego Pino Garcia",
      "avatar": "https://www.gravatar.com/avatar/e8cce88637f1a6e79155e8371e24b2e8?d=identicon\u0026s=64",
      "cl": "319992@main",
      "clUrl": "https://commits.webkit.org/319992@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322719\n\nReviewed by Adrian Perez de Castro.\n\nLibbacktrace is an always ON dependency for GTK and WPE ports. Until very\nrecently, this feature had to be explicitly disabled when building with system\npackages because the majority of Linux distributions didn't provide a\npackage for libbacktrace.\n\nNewer distros such as Debian 13 or Ubuntu 26.04 do provide\n'libbacktrace-dev' as a system package, so this package can now be added\nto the list of OS dependencies.\n\n* Tools/glib/dependencies/apt:\n* Tools/glib/dependencies/pacman:\n\nCanonical link: https://commits.webkit.org/319992@main",
      "email": "dpino@igalia.com",
      "hash": "54b0b24f2e8c52747c61266df22aaeebc242789b",
      "subject": "[GLib] Add libbacktrace to system dependencies list"
    },
    "319993@main": {
      "author": "Ben Nham",
      "avatar": "https://www.gravatar.com/avatar/dc0914eabf69047ee3397794c2d17bf7?d=identicon\u0026s=64",
      "cl": "319993@main",
      "clUrl": "https://commits.webkit.org/319993@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322680\nrdar://185951553\n\nReviewed by Alex Christensen and Kiet Ho.\n\nReplace site isolation enabled settings checks with Page::hasRemoteFrames (added in 319884@main) in\nmore places. This is so that a page that has no remote frames doesn't pay the extra IPC cost of Site\nIsolation unless it's necessary.\n\nTests: http/tests/site-isolation/only-broadcast-scroll-position-if-remote-frame-exists.html\n       http/tests/site-isolation/only-broadcast-user-activation-if-remote-frame-exists.html\n\n* LayoutTests/http/tests/site-isolation/only-broadcast-scroll-position-if-remote-frame-exists-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/only-broadcast-scroll-position-if-remote-frame-exists.html: Added.\n* LayoutTests/http/tests/site-isolation/only-broadcast-user-activation-if-remote-frame-exists-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/only-broadcast-user-activation-if-remote-frame-exists.html: Added.\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::enforceSandboxFlags):\n* Source/WebCore/editing/cocoa/EditorCocoa.mm:\n(WebCore::Editor::writeSelectionToPasteboard):\n* Source/WebCore/page/LocalDOMWindow.cpp:\n(WebCore::LocalDOMWindow::consumeTransientActivation):\n(WebCore::LocalDOMWindow::notifyActivated):\n* Source/WebCore/page/LocalFrameView.cpp:\n(WebCore::LocalFrameView::scrollPositionChanged):\n\nCanonical link: https://commits.webkit.org/319993@main",
      "email": "nham@apple.com",
      "hash": "abf4ece815c84c17c7aeafc1bf8b5b75692f5367",
      "subject": "[Site Isolation] Use Page::hasRemoteFrames in more places"
    },
    "319994@main": {
      "author": "Suraj Thanugundla",
      "avatar": "https://www.gravatar.com/avatar/5f5ab8a9e6d06403d932003de0835ada?d=identicon\u0026s=64",
      "cl": "319994@main",
      "clUrl": "https://commits.webkit.org/319994@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321425\n\nReviewed by Antti Koivisto.\n\nWhen an element's attribute changes, the substituted value for properties\nusing attr() with a number or percentage type was never updated and this\nresulted in the stale property value always being used. The new value is\ncompared with the old one and old value is replaced if they are unequal.\nCSSParserToken::operator== is used for comparison and always evaluated\nto true for number or percentage values even when unequal as their\noriginal text is used to check equality rather than the parsed values.\nThe issue was that during attr() substitution, the substituted value’s\ntext was never stored and only parsed value was stored in CSSParserToken.\nIn addition, when such CSS properties are serialized, the original text\nof the substituted value is used and always returned an empty string.\n\nThis change ensures that the original text of the substituted valued is\nalways passed to CSSParserToken constructor during attr() substitution,\nmaking it available for equality checks and serialization later.\n\nTests: imported/w3c/web-platform-tests/css/css-values/attr-number-invalidation.html\n       imported/w3c/web-platform-tests/css/css-values/attr-percent-invalidation.html\n\nattr-pseudo-element-placeholder.html, attr-cycle-expected.html now\npass as property invalidation and serialization work as expected.\n\n* Source/WebCore/style/StyleSubstitutionResolver.cpp:\n(WebCore::Style::SubstitutionResolver::substituteAttrFunction):\nPass the attribute string value instead of an empty StringView\nto CSSParserToken constructor for Number and Percentage types\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/attr-cycle-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/attr-number-invalidation-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/attr-number-invalidation.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/attr-percent-invalidation-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/attr-percent-invalidation.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/attr-all-types-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/attr-all-types.html:\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/mac/TestExpectations:\n* LayoutTests/TestExpectations:\nUpdate test expectations to remove passing tests\n\nCanonical link: https://commits.webkit.org/319994@main",
      "email": "contact@surajt.com",
      "hash": "4a983f13b9fc3a9ca790ebd9d5cc61cef61cd4f6",
      "subject": "[css-values-5] Fix invalidation and serialization of properties using attr() with number or percentage"
    },
    "319995@main": {
      "author": "Philippe Normand",
      "avatar": "https://www.gravatar.com/avatar/eef27203750af3510263cc29af21a16e?d=identicon\u0026s=64",
      "cl": "319995@main",
      "clUrl": "https://commits.webkit.org/319995@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320653\n\nReviewed by Adrian Perez de Castro.\n\nThe audio converted created in the outgoing audio source expects its input buffer to be writable\nbecause it is created with the GST_AUDIO_CONVERTER_FLAG_IN_WRITABLE flag. So when doing actual audio\nconversion the input buffer has to be mapped in read-write mode.\n\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebCore/platform/mediastream/libwebrtc/gstreamer/RealtimeOutgoingAudioSourceLibWebRTC.cpp:\n(WebCore::RealtimeOutgoingAudioSourceLibWebRTC::pullAudioData):\n\nCanonical link: https://commits.webkit.org/319995@main",
      "email": "philn@igalia.com",
      "hash": "c32395413d947c28aed871d04c9cdf9536d7f0d5",
      "subject": "[GStreamer] imported/w3c/web-platform-tests/webrtc/RTCPeerConnection-connectionState.https.html crashes"
    },
    "319996@main": {
      "author": "Dominic Mazzoni",
      "avatar": "https://www.gravatar.com/avatar/f76643c44a7ee3be45148e66d97ed8e4?d=identicon\u0026s=64",
      "cl": "319996@main",
      "clUrl": "https://commits.webkit.org/319996@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321896\nrdar://185074362\n\nReviewed by Tyler Wilcock.\n\nFollow-up to: https://bugs.webkit.org/show_bug.cgi?id=320762\n\n* LayoutTests/accessibility-isolated-tree/TestExpectations:\n* LayoutTests/accessibility/isolated-tree/mac/abbr-acronym-tags-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/abbr-acronym-tags.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/accessibility-make-first-responder-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/accessibility-make-first-responder.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/accesskey-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/accesskey.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/active-descendant-after-visibility-change-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/active-descendant-after-visibility-change.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/active-descendant-with-aria-controls-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/active-descendant-with-aria-controls.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/alt-for-css-content-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/alt-for-css-content.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/apple-pay-labels-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/apple-pay-labels.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/apple-pay-session-v4-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/apple-pay-session-v4.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/area-with-aria-label-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/area-with-aria-label.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-alerts-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-alerts.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-columnrowheaders-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-columnrowheaders.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-current-attribute-exposed-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-current-attribute-exposed.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-describedby-fieldset-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-describedby-fieldset.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-details-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-details.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-directory-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-directory.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-divs-not-ignored-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-divs-not-ignored.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-drag-drop-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-drag-drop.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-errormessage-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-errormessage.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-expanded-not-exposed-when-undefined-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-expanded-not-exposed-when-undefined.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-expanded-notifications-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-expanded-notifications.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-expanded-standard-items-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-expanded-standard-items.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-grid-with-strange-hierarchy-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-grid-with-strange-hierarchy.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-grouping-roles-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-grouping-roles.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-hidden-changes-for-non-ignored-elements-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-hidden-changes-for-non-ignored-elements.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-image-emits-object-replacement-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-image-emits-object-replacement.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-label-overrides-visible-text-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-label-overrides-visible-text.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-labelledby-multiple-child-crash-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-labelledby-multiple-child-crash.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-listbox-selectedchildren-change-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-listbox-selectedchildren-change.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-liveregion-on-image-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-liveregion-on-image.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-liveregions-addedelement-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-liveregions-addedelement.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-liveregions-changedalt-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-liveregions-changedalt.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-liveregions-changedtext-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-liveregions-changedtext.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-liveregions-notifications-always-sent-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-liveregions-notifications-always-sent.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-liveregions-notifications-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-liveregions-notifications.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-liveregions-removedelement-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-liveregions-removedelement.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-menu-closed-notification-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-menu-closed-notification.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-menu-item-selected-notification-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-menu-item-selected-notification.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-menu-open-notification-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-menu-open-notification.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-menu-role-descriptions-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-menu-role-descriptions.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-menubar-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-menubar.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-menuitem-checked-value-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-menuitem-checked-value.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-menuitem-focus-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-menuitem-focus.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-multiple-liveregions-notification-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-multiple-liveregions-notification.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-multiselectable-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-multiselectable.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-notify-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-notify-translated-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-notify-translated.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-notify-translation-dropped-handler-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-notify-translation-dropped-handler.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-notify-translation-failure-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-notify-translation-failure.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-notify-translation-late-reply-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-notify-translation-late-reply.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-notify-translation-not-active-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-notify-translation-not-active.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-notify-translation-ordering-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-notify-translation-ordering.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-notify-translation-timeout-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-notify-translation-timeout.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-notify-with-options.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-notify.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-owned-object-relative-frame-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-owned-object-relative-frame.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-popup-buttons-on-native-elements-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-popup-buttons-on-native-elements.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-popup-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-popup.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-pressed-button-attributes-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-pressed-button-attributes.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-radiobutton-text-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-radiobutton-text.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-radiogroup-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-radiogroup.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-required-popup-button-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-required-popup-button.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-slider-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-slider.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-spinbutton-crash-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-spinbutton-crash.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-spinbutton-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-spinbutton.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-table-with-colspan-cells-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-table-with-colspan-cells.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-toolbar-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-toolbar.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-tree-activedescendant-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-tree-activedescendant.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-tree-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-tree-index-of-items-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-tree-index-of-items.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-tree-item-children-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-tree-item-children.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-tree-item-name-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-tree-item-name.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-tree.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-treegrid-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-treegrid.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-valuetext-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-valuetext-on-native-slider-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-valuetext-on-native-slider.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/aria-valuetext.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/async-increment-decrement-action-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/async-increment-decrement-action.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/attachment-element-replacement-character-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/attachment-element-replacement-character.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/attributed-string-for-table-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/attributed-string-for-table.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/attributed-string-includes-highlighting-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/attributed-string-includes-highlighting.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/attributed-string-includes-insertion-deletion-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/attributed-string-includes-insertion-deletion.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/attributed-string-spanning-multiple-elements-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/attributed-string-spanning-multiple-elements.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/attributed-string-with-image-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/attributed-string-with-image.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/attributed-string/attributed-string-text-styling-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/attributed-string/attributed-string-text-styling.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/blockquote-level-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/blockquote-level.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/bounds-for-range-crash-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/bounds-for-range-crash.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/bounds-for-range-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/bounds-for-range-multibyte-glyphs-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/bounds-for-range-multibyte-glyphs.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/bounds-for-range-multiline-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/bounds-for-range-multiline.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/bounds-for-range-on-empty-text-control-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/bounds-for-range-on-empty-text-control.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/bounds-for-range-vertical-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/bounds-for-range-vertical.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/bounds-for-range.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/br-element-properties-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/br-element-properties.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/br-element-text-selection-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/br-element-text-selection.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/button-shouldnot-have-axvalue-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/button-shouldnot-have-axvalue.html: Added.\n* LayoutTests/platform/mac-sequoia/TestExpectations:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n* LayoutTests/platform/mac/TestExpectations:\n* LayoutTests/platform/mac/accessibility/isolated-tree/mac/aria-notify-with-options-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/319996@main",
      "email": "dm_mazzoni@apple.com",
      "hash": "ffc89239b63db8c513afb5992acd8e716e99d8c1",
      "subject": "AX: run more tests with isolated-tree flag on (4 of many)"
    },
    "319997@main": {
      "author": "Jessica Cheung",
      "avatar": "https://www.gravatar.com/avatar/5c102f093ce6bc01424466a4cfdf1d1f?d=identicon\u0026s=64",
      "cl": "319997@main",
      "clUrl": "https://commits.webkit.org/319997@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322531\nrdar://185827264\n\nReviewed by Wenson Hsieh.\n\nCurrently, lvh and svh do not work with resizes-content. Based on the\nspec, when resizing the layout viewport, the CSS viewport units should\nreflect such changes.\n\nSo, implement support for lvh and svh to respect resizes-content while\nalso respecting override layout parameters. Key changes include:\n\n- _sizeResizedByInteractiveWidget: takes in the size passed and if\nresizes-content, will clamp to keyboard top (old logic in\n_dispatchSetViewLayoutSize which is now extracted to this function)\n\n- _dispatchSetMinimumUnobscuredSize and others: replaces setMinimumUnobscuredSize\nand alike by still calling setMinimumUnobscuredSize, but uses the size of what\nis passed in, and the clamp if it exists. This takes into account override layout\nparameters, will only clamp for resizes-content, and if override layout parameters\nare present with resizes-content, the clamp value only wins if the keyboard is up.\n\n- _dispatchSetActiveUnobscuredSizes: is called if interactiveWidgetValueChanged or\nif keyboardShouldResizeContent, where it will re-push override layout parameters if\nthey exist, and then calls the dispatch functions (taking account of the resizes-content\nclamping if it exists).\n\nAdditionally, add API tests for these cases:\n- overlays-content viewport units\n- resizes-content viewport units\n- override layout parameters with resizes-content viewport units\n\n* Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm:\n(-[WKWebView _recalculateViewportSizesWithMinimumViewportInset:maximumViewportInset:throwOnInvalidInput:]):\n* Source/WebKit/UIProcess/API/ios/WKWebViewIOS.h:\n* Source/WebKit/UIProcess/API/ios/WKWebViewIOS.mm:\n(-[WKWebView _didCommitLayerTree:mainFrameData:pageData:transactionID:]):\n(-[WKWebView _sizeResizedByInteractiveWidget:]):\n(-[WKWebView _dispatchSetViewLayoutSize:]):\n(-[WKWebView _dispatchSetMinimumUnobscuredSize:]):\n(-[WKWebView _dispatchSetMaximumUnobscuredSize:]):\n(-[WKWebView _dispatchSetDefaultUnobscuredSize:]):\n(-[WKWebView _dispatchSetActiveUnobscuredSizes]):\n(-[WKWebView _frameOrBoundsMayHaveChanged]):\n(-[WKWebView _didStopDeferringGeometryUpdates]):\n(-[WKWebView _keyboardChangedWithInfo:adjustScrollView:]):\n(-[WKWebView _beginAnimatedResizeWithUpdates:]):\n(-[WKWebView _overrideLayoutParametersWithMinimumLayoutSize:minimumUnobscuredSizeOverride:maximumUnobscuredSizeOverride:]):\n* Tools/TestWebKitAPI/Resources/cocoa/InteractiveWidgetViewportUnits.html: Added.\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ios/InteractiveWidget.mm: Added.\n(viewportUnitLength):\n(setInteractiveWidget):\n(simulateKeyboardOfHeight):\n(focusInput):\n(TEST(InteractiveWidget, ViewportUnitsOverlaysContent)):\n(TEST(InteractiveWidget, ViewportUnitsResizesContent)):\n(TEST(InteractiveWidget, ViewportUnitsResizesContentWithOverriddenLayoutParameters)):\n\nCanonical link: https://commits.webkit.org/319997@main",
      "email": "jcheung23@apple.com",
      "hash": "a2ccf3506fc2a4ae4a5c8e6d0b7a752a0341068d",
      "subject": "[interactive-widget] lvh and svh do not respect resizes-content value"
    }
  },
  "date": "2026-08-27",
  "days": 1,
  "generatedAt": "2026-08-27T22:06:36Z",
  "markdown": "## Highlights\n\n- **Security** Fixed a WebAssembly try/catch type confusion that could skip optimized reference checks in JSC. [commit 319979@main](https://commits.webkit.org/319979@main)\n- **Security** Closed a cross-origin spoofing issue in BroadcastChannel. [commit 319914@main](https://commits.webkit.org/319914@main)\n- **Web Platform** Fixed a streaming fetch regression so body chunks are no longer stalled while a reader is busy. [bug 322545](https://bugs.webkit.org/show_bug.cgi?id=322545) [commit 319981@main](https://commits.webkit.org/319981@main)\n- **Web Platform** Added `CSSMediaRule.matches`, filling in another CSS conditional rules capability. [bug 321977](https://bugs.webkit.org/show_bug.cgi?id=321977) [commit 319988@main](https://commits.webkit.org/319988@main)\n- **Security** Added related-origin validation for WebAuthn, tightening cross-origin trust checks. [bug 321380](https://bugs.webkit.org/show_bug.cgi?id=321380) [commit 319973@main](https://commits.webkit.org/319973@main)\n- **Networking** Fixed service worker and process-swap certificate propagation regressions that left `CertificateInfo` empty. [bug 322485](https://bugs.webkit.org/show_bug.cgi?id=322485) [commit 319948@main](https://commits.webkit.org/319948@main)\n- **Rendering** Fixed `window.open(..., \"noopener\")` so it does not always return `null`, aligning behavior with the platform. [bug 322591](https://bugs.webkit.org/show_bug.cgi?id=322591) [commit 319932@main](https://commits.webkit.org/319932@main)\n- **Perf** Landed a cluster of JSC runtime wins including faster allocation shutdown, lock removal, and better CPU topology detection. [commit 319965@main](https://commits.webkit.org/319965@main)\n- **GPU** Improved GTK/WPE video compositing by using promise images for DMA-BUF video buffers in the Skia compositor. [bug 322574](https://bugs.webkit.org/show_bug.cgi?id=322574) [commit 319943@main](https://commits.webkit.org/319943@main)\n- **Mobile** Fixed `interactive-widget` sizing so `lvh` and `svh` respect `resizes-content`. [bug 322531](https://bugs.webkit.org/show_bug.cgi?id=322531) [commit 319997@main](https://commits.webkit.org/319997@main)\n\n## What landed by area\n\n### JavaScriptCore and Wasm\n\n- **Security** Fixed a WebAssembly try/catch result-type confusion that omitted optimized reference checks. [bug 317450](https://bugs.webkit.org/show_bug.cgi?id=317450) [commit 319979@main](https://commits.webkit.org/319979@main)\n- **Perf** Skipped the global `StructureCache` when the prototype has never been a prototype, trimming pointless cache work. [bug 322703](https://bugs.webkit.org/show_bug.cgi?id=322703) [commit 319984@main](https://commits.webkit.org/319984@main)\n- **Perf** Made `MarkedSpace::stopAllocating` faster. [bug 322693](https://bugs.webkit.org/show_bug.cgi?id=322693) [commit 319965@main](https://commits.webkit.org/319965@main)\n- **Refactor** Removed `valueProfileLock` from JSC. [bug 322701](https://bugs.webkit.org/show_bug.cgi?id=322701) [commit 319964@main](https://commits.webkit.org/319964@main)\n- **Rendering** Fixed `JSDOMException` so weak stack traces reconcile correctly. [commit 319952@main](https://commits.webkit.org/319952@main)\n- **Security** Fixed shared-memory growth reading sibling memory handles across threads in Wasm. [bug 322405](https://bugs.webkit.org/show_bug.cgi?id=322405) [commit 319937@main](https://commits.webkit.org/319937@main)\n- **Perf** Stopped `DFGFixupPhase` from clearing `NodeMustGenerate` on checked arithmetic nodes. [bug 322371](https://bugs.webkit.org/show_bug.cgi?id=322371) [commit 319935@main](https://commits.webkit.org/319935@main)\n- **Perf** Compacted `OSRExitDescriptor` exit values into a byte stream. [bug 322369](https://bugs.webkit.org/show_bug.cgi?id=322369) [commit 319934@main](https://commits.webkit.org/319934@main)\n- **Perf** Improved CPU core configuration detection accuracy. [bug 322619](https://bugs.webkit.org/show_bug.cgi?id=322619) [commit 319928@main](https://commits.webkit.org/319928@main)\n- **Build** Removed `ENABLE_JSC_RESTRICTED_OPTIONS_BY_DEFAULT`. [bug 322295](https://bugs.webkit.org/show_bug.cgi?id=322295) [commit 319957@main](https://commits.webkit.org/319957@main)\n\n### Networking, loading, and security model\n\n- **Web Platform** Fixed a fetch streaming regression where body delivery could wait for the next network chunk while the reader was busy. [bug 322545](https://bugs.webkit.org/show_bug.cgi?id=322545) [commit 319981@main](https://commits.webkit.org/319981@main)\n- **Privacy** Added a flag to disable WebRTC private relay bypass. [bug 322603](https://bugs.webkit.org/show_bug.cgi?id=322603) [commit 319956@main](https://commits.webkit.org/319956@main)\n- **Networking** Fixed service worker context connection setup hitting a pending-connection message check. [bug 322592](https://bugs.webkit.org/show_bug.cgi?id=322592) [commit 319950@main](https://commits.webkit.org/319950@main)\n- **Networking** Restored `CertificateInfo` delivery to the UI process for service worker fetch loads. [bug 322485](https://bugs.webkit.org/show_bug.cgi?id=322485) [commit 319948@main](https://commits.webkit.org/319948@main)\n- **Networking** Fixed empty frame `CertificateInfo` after process swap on navigation. [bug 321395](https://bugs.webkit.org/show_bug.cgi?id=321395) [commit 319946@main](https://commits.webkit.org/319946@main)\n- **Security** Fixed descendant and dynamic module script fetches sending the wrong `Referer` header. [bug 322392](https://bugs.webkit.org/show_bug.cgi?id=322392) [commit 319921@main](https://commits.webkit.org/319921@main)\n- **Security** Classified address spaces beyond the ranges covered by the Local Network Access spec. [bug 321725](https://bugs.webkit.org/show_bug.cgi?id=321725) [commit 319918@main](https://commits.webkit.org/319918@main)\n- **Security** Closed a cross-origin spoof in BroadcastChannel. [commit 319914@main](https://commits.webkit.org/319914@main)\n\n### CSS, layout, and rendering\n\n- **Mobile** Fixed `lvh` and `svh` so they honor `resizes-content` for `interactive-widget`. [bug 322531](https://bugs.webkit.org/show_bug.cgi?id=322531) [commit 319997@main](https://commits.webkit.org/319997@main)\n- **Rendering** Fixed invalidation and serialization for `attr()` values using number or percentage types. [bug 321425](https://bugs.webkit.org/show_bug.cgi?id=321425) [commit 319994@main](https://commits.webkit.org/319994@main)\n- **Web Platform** Added `CSSMediaRule.matches`. [bug 321977](https://bugs.webkit.org/show_bug.cgi?id=321977) [commit 319988@main](https://commits.webkit.org/319988@main)\n- **Rendering** Fixed `background-size: contain` and `cover` with SVG images that have one intrinsic dimension and no aspect ratio. [bug 322705](https://bugs.webkit.org/show_bug.cgi?id=322705) [commit 319972@main](https://commits.webkit.org/319972@main)\n- **Rendering** Synced scroll-animations WPT coverage. [bug 322704](https://bugs.webkit.org/show_bug.cgi?id=322704) [commit 319962@main](https://commits.webkit.org/319962@main)\n- **Web Platform** Made `@supports` check whether an at-rule is enabled by feature flags. [bug 321556](https://bugs.webkit.org/show_bug.cgi?id=321556) [commit 319936@main](https://commits.webkit.org/319936@main)\n- **Rendering** Fixed grid content contributing to scrollable overflow in Grid Formatting Context integration. [bug 322620](https://bugs.webkit.org/show_bug.cgi?id=322620) [commit 319929@main](https://commits.webkit.org/319929@main)\n- **Refactor** Removed a redundant grid axis track count member. [bug 322621](https://bugs.webkit.org/show_bug.cgi?id=322621) [commit 319920@main](https://commits.webkit.org/319920@main)\n- **Rendering** Honored non-keyword `max-width` on out-of-flow replaced boxes with an intrinsic ratio. [bug 322612](https://bugs.webkit.org/show_bug.cgi?id=322612) [commit 319917@main](https://commits.webkit.org/319917@main)\n\n### DOM, HTML, and input/UI\n\n- **Rendering** Fixed `window.open()` with `noopener` so it does not always return `null`. [bug 322591](https://bugs.webkit.org/show_bug.cgi?id=322591) [commit 319932@main](https://commits.webkit.org/319932@main)\n- **Security** Stopped DOMParser-parsed XML script elements from executing after cloning. [bug 322474](https://bugs.webkit.org/show_bug.cgi?id=322474) [commit 319922@main](https://commits.webkit.org/319922@main)\n- **UI** Stopped tinting the pressed thumb for `\u003cinput type=checkbox switch\u003e` on macOS. [bug 322177](https://bugs.webkit.org/show_bug.cgi?id=322177) [commit 319931@main](https://commits.webkit.org/319931@main)\n- **UI** Fixed a dark mode caret-color issue on Yahoo Mail after copying styled text. [bug 322506](https://bugs.webkit.org/show_bug.cgi?id=322506) [commit 319975@main](https://commits.webkit.org/319975@main)\n- **Security** Hardened `DateTimeFieldElement` by making its field owner ref-countable. [bug 322668](https://bugs.webkit.org/show_bug.cgi?id=322668) [commit 319982@main](https://commits.webkit.org/319982@main)\n- **Mobile** Fixed touchmove getting dropped when it arrived while touchstart was still in flight. [bug 322698](https://bugs.webkit.org/show_bug.cgi?id=322698) [commit 319960@main](https://commits.webkit.org/319960@main)\n\n### Media, WebRTC, and graphics\n\n- **Media** Fixed a GStreamer crash in the WPT `RTCPeerConnection-connectionState` test. [bug 320653](https://bugs.webkit.org/show_bug.cgi?id=320653) [commit 319995@main](https://commits.webkit.org/319995@main)\n- **Media** Added an early return in GFC track handling to skip tracks without single-span items. [bug 322656](https://bugs.webkit.org/show_bug.cgi?id=322656) [commit 319966@main](https://commits.webkit.org/319966@main)\n- **Media** Fixed GTK/WPE WebRTC crashes in codec support checks. [bug 322633](https://bugs.webkit.org/show_bug.cgi?id=322633) [commit 319954@main](https://commits.webkit.org/319954@main)\n- **Media** Fixed a GTK WebRTC crash in `video-disabled-black.html`. [bug 321281](https://bugs.webkit.org/show_bug.cgi?id=321281) [commit 319949@main](https://commits.webkit.org/319949@main)\n- **Media** Resynced dav1d to M152. [bug 322580](https://bugs.webkit.org/show_bug.cgi?id=322580) [commit 319947@main](https://commits.webkit.org/319947@main)\n- **GPU** Switched GTK/WPE Skia video compositing to promise images for DMA-BUF buffers. [bug 322574](https://bugs.webkit.org/show_bug.cgi?id=322574) [commit 319943@main](https://commits.webkit.org/319943@main)\n- **GPU** Removed GTK/WPE support for GPU rendering without DDL in the Skia compositor. [bug 322585](https://bugs.webkit.org/show_bug.cgi?id=322585) [commit 319940@main](https://commits.webkit.org/319940@main)\n- **Refactor** Moved `BitmapTexture` and `BitmapTexturePool` from `texmap` into the EGL directory. [bug 322590](https://bugs.webkit.org/show_bug.cgi?id=322590) [commit 319938@main](https://commits.webkit.org/319938@main)\n- **GPU** Prevented `RemoteRenderingBackend` from allocating image buffers in display-list rendering mode. [bug 316439](https://bugs.webkit.org/show_bug.cgi?id=316439) [commit 319933@main](https://commits.webkit.org/319933@main)\n- **GPU** Made 2D canvas `drawImage` use `copyNativeImage`. [bug 322254](https://bugs.webkit.org/show_bug.cgi?id=322254) [commit 319967@main](https://commits.webkit.org/319967@main)\n- **GPU** Fixed ANGLE rewriting for unindexed interpolant array references. [bug 322224](https://bugs.webkit.org/show_bug.cgi?id=322224) [commit 319977@main](https://commits.webkit.org/319977@main)\n- **Media** Ensured `MediaSource` unregisters itself as a logger observer on destruction. [bug 318837](https://bugs.webkit.org/show_bug.cgi?id=318837) [commit 319926@main](https://commits.webkit.org/319926@main)\n\n### Site isolation, multiprocess, and inspector plumbing\n\n- **Security** Switched more call sites to `Page::hasRemoteFrames` for site isolation. [bug 322680](https://bugs.webkit.org/show_bug.cgi?id=322680) [commit 319993@main](https://commits.webkit.org/319993@main)\n- **DevTools** Reworked inspector layers protocol tests to prepare for frame target enablement. [bug 322150](https://bugs.webkit.org/show_bug.cgi?id=322150) [commit 319986@main](https://commits.webkit.org/319986@main)\n- **Refactor** Removed failing authentication-redirect test expectations after recent site isolation changes. [bug 322702](https://bugs.webkit.org/show_bug.cgi?id=322702) [commit 319983@main](https://commits.webkit.org/319983@main)\n- **DevTools** Reworked inspector animation tracking tests to prepare for frame target enablement. [bug 322229](https://bugs.webkit.org/show_bug.cgi?id=322229) [commit 319971@main](https://commits.webkit.org/319971@main)\n- **Security** Fixed cross-site frames in web archives not loading in shared process mode. [bug 322665](https://bugs.webkit.org/show_bug.cgi?id=322665) [commit 319969@main](https://commits.webkit.org/319969@main)\n- **Refactor** Avoided computing shared preferences for a dummy process proxy. [bug 322553](https://bugs.webkit.org/show_bug.cgi?id=322553) [commit 319968@main](https://commits.webkit.org/319968@main)\n- **Refactor** Cleaned up test expectations after recent AudioSession fixes. [bug 322598](https://bugs.webkit.org/show_bug.cgi?id=322598) [commit 319953@main](https://commits.webkit.org/319953@main)\n- **Security** Fixed shared processes outliving all frames because `API::Navigation` kept a reference alive. [bug 322446](https://bugs.webkit.org/show_bug.cgi?id=322446) [commit 319916@main](https://commits.webkit.org/319916@main)\n- **Perf** Made `ThreadSafeWeakPtr` safe to mutate from different threads. [bug 283929](https://bugs.webkit.org/show_bug.cgi?id=283929) [commit 319915@main](https://commits.webkit.org/319915@main)\n\n### Accessibility and tests\n\n- **A11y** Enabled more AX tests with the isolated-tree flag. [bug 321896](https://bugs.webkit.org/show_bug.cgi?id=321896) [commit 319996@main](https://commits.webkit.org/319996@main)\n- **A11y** Fixed `AXLineForIndex` when the index equals the field length. [bug 322690](https://bugs.webkit.org/show_bug.cgi?id=322690) [commit 319963@main](https://commits.webkit.org/319963@main)\n- **Rendering** Added SVG2 coverage for leading and trailing whitespace in `\u003cangle\u003e` attributes. [bug 261656](https://bugs.webkit.org/show_bug.cgi?id=261656) [commit 319958@main](https://commits.webkit.org/319958@main)\n- **Build** Moved Cocoa-only IPC tests into `ipc/cocoa`. [bug 322613](https://bugs.webkit.org/show_bug.cgi?id=322613) [commit 319941@main](https://commits.webkit.org/319941@main)\n- **Rendering** Added a test for a constant crash in `ipc/fecolormatrix-type-values-mismatch-crash.html`. [bug 318258](https://bugs.webkit.org/show_bug.cgi?id=318258) [commit 319978@main](https://commits.webkit.org/319978@main)\n- **Media** Marked a GLib media-source worker logger observer timeout for gardening. [commit 319945@main](https://commits.webkit.org/319945@main)\n\n### Build, platform, and infrastructure\n\n- **Build** Added `libbacktrace` to GLib system dependencies. [bug 322719](https://bugs.webkit.org/show_bug.cgi?id=322719) [commit 319992@main](https://commits.webkit.org/319992@main)\n- **Build** Made Swift `CxxCompletionHandler` work with noncopyable arguments. [bug 322659](https://bugs.webkit.org/show_bug.cgi?id=322659) [commit 319991@main](https://commits.webkit.org/319991@main)\n- **Build** Made iOS simulator queue sizing dynamic in EWS. [bug 322742](https://bugs.webkit.org/show_bug.cgi?id=322742) [commit 319990@main](https://commits.webkit.org/319990@main)\n- **Build** Lowered the per-simulator CPU estimate in `webkitpy`. [bug 322737](https://bugs.webkit.org/show_bug.cgi?id=322737) [commit 319989@main](https://commits.webkit.org/319989@main)\n- **Refactor** Annotated `toWebCoreNode` and `toWKDOMNode` as pointer conversions. [bug 322722](https://bugs.webkit.org/show_bug.cgi?id=322722) [commit 319987@main](https://commits.webkit.org/319987@main)\n- **Build** Added OS 27 family images for the dashboard. [bug 322733](https://bugs.webkit.org/show_bug.cgi?id=322733) [commit 319985@main](https://commits.webkit.org/319985@main)\n- **Build** Annotated lock functions as `NODELETE`. [bug 322565](https://bugs.webkit.org/show_bug.cgi?id=322565) [commit 319961@main](https://commits.webkit.org/319961@main)\n- **Security** Addressed SaferCPP static analyzer findings in `Source/WebKit`. [bug 322482](https://bugs.webkit.org/show_bug.cgi?id=322482) [commit 319955@main](https://commits.webkit.org/319955@main)\n- **Build** Fixed a CMake build failure. [bug 322696](https://bugs.webkit.org/show_bug.cgi?id=322696) [commit 319942@main](https://commits.webkit.org/319942@main)\n- **Build** Removed SDK additions for unsupported OS versions. [bug 322660](https://bugs.webkit.org/show_bug.cgi?id=322660) [commit 319925@main](https://commits.webkit.org/319925@main)\n- **Build** Fixed ASan builds after a regression. [bug 322667](https://bugs.webkit.org/show_bug.cgi?id=322667) [commit 319923@main](https://commits.webkit.org/319923@main)\n- **Build** Stopped rewriting arguments in `swiftc-wrapper`. [bug 322312](https://bugs.webkit.org/show_bug.cgi?id=322312) [commit 319913@main](https://commits.webkit.org/319913@main)\n\n### Quirks, extensions, and misc platform behavior\n\n- **Refactor** Moved site-specific quirk names into `QuirkNames.h`. [bug 322673](https://bugs.webkit.org/show_bug.cgi?id=322673) [commit 319951@main](https://commits.webkit.org/319951@main)\n- **Refactor** Moved the quirk table into its own file. [bug 322674](https://bugs.webkit.org/show_bug.cgi?id=322674) [commit 319930@main](https://commits.webkit.org/319930@main)\n- **Security** Decoded WebExtension PDF icons in the WebContent process. [bug 321984](https://bugs.webkit.org/show_bug.cgi?id=321984) [commit 315453@main](https://commits.webkit.org/315453@main)\n- **Security** Hid `browser.offscreen` from offscreen pages where it should not be exposed. [bug 322618](https://bugs.webkit.org/show_bug.cgi?id=322618) [commit 319912@main](https://commits.webkit.org/319912@main)\n\n## Reverts \u0026 Reapplies\n\n- **Build** Reverted [commit 319904@main](https://commits.webkit.org/319904@main) after it broke Simulator and Catalyst builds. [bug 322664](https://bugs.webkit.org/show_bug.cgi?id=322664) [commit 319924@main](https://commits.webkit.org/319924@main)",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [
    {
      "name": "Unreviewed",
      "count": 2
    }
  ],
  "since": "2026-08-27",
  "totals": {
    "commits": 87,
    "features": 85,
    "rolls": 2
  },
  "until": "2026-08-27"
}