{ "commits": { "319999@main": { "author": "Mike Gorse", "avatar": "https://www.gravatar.com/avatar/9953e4848ac7a1e3808f50f333429369?d=identicon\u0026s=64", "cl": "319999@main", "clUrl": "https://commits.webkit.org/319999@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322108\n\nReviewed by Adrian Perez de Castro.\n\nEpoxy.h can pull in xlib.h, which pollutes the namespace and causes problems\nlater with unified sources.\n\n* Source/WebKit/SourcesGTK.txt:\n* Source/WebKit/SourcesWPE.txt:\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/NonCompositedFrameRenderer.cpp:\n(WebKit::NonCompositedFrameRenderer::foreachRegionInDamageHistoryForTesting const):\n\nCanonical link: https://commits.webkit.org/319999@main", "email": "mgorse@suse.com", "hash": "c2d659a809a23d45d901eb1ab4443b989b638fd1", "subject": "Build failure: Xlib defines causing conflicts" }, "320000@main": { "author": "Marcus Plutowski", "avatar": "https://www.gravatar.com/avatar/0dc4fa1c337348e333de44505752edb8?d=identicon\u0026s=64", "cl": "320000@main", "clUrl": "https://commits.webkit.org/320000@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321197\nrdar://184255766\n\nReviewed by Yusuke Suzuki.\n\nThis provides no extra semantic information, so there's no need for an\nindirection. Remove in line with our general push to de-macroify libpas'\nMTE implementation.\n\nNo new tests because this is a purely syntactic change.\n\n* Source/bmalloc/libpas/src/libpas/pas_fast_megapage_table.h:\n(pas_fast_megapage_table_get):\n* Source/bmalloc/libpas/src/libpas/pas_large_map.c:\n(pas_large_map_find):\n(pas_large_map_add):\n(pas_large_map_take):\n* Source/bmalloc/libpas/src/libpas/pas_large_sharing_pool.c:\n(pas_large_sharing_pool_boot_free):\n(pas_large_sharing_pool_free):\n(pas_large_sharing_pool_allocate_and_commit):\n(pas_large_sharing_pool_compute_summary):\n* Source/bmalloc/libpas/src/libpas/pas_megapage_cache.c:\n(megapage_cache_allocate_aligned):\n* Source/bmalloc/libpas/src/libpas/pas_mte.h:\n* Source/bmalloc/libpas/src/libpas/pas_page_header_table.c:\n(pas_page_header_table_add):\n* Source/bmalloc/libpas/src/libpas/pas_page_header_table.h:\n(pas_page_header_table_get_for_boundary):\n* Source/bmalloc/libpas/src/libpas/pas_probabilistic_guard_malloc_allocator.c:\n(pas_probabilistic_guard_malloc_allocate):\n(pas_probabilistic_guard_malloc_deallocate):\n* Source/bmalloc/libpas/src/libpas/pas_allocation_result.h:\n(pas_allocation_result_zero):\n\n* Source/bmalloc/libpas/src/libpas/pas_allocation_result.c:\n(pas_allocation_result_zero_large_slow):\n\nCanonical link: https://commits.webkit.org/320000@main", "email": "marcus_plutowski@apple.com", "hash": "f918fec1e1d9dfe1dfe2d7e8a5466af0f47e5acb", "subject": "[libpas] Inline PAS_MTE_HANDLEs which resolve to PAS_MTE_CLEAR*" }, "320001@main": { "author": "Ryosuke Niwa", "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64", "cl": "320001@main", "clUrl": "https://commits.webkit.org/320001@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322757\n\nUnreviewed. Update safer C++ expectations.\n\n* Source/JavaScriptCore/SaferCPPExpectations/ForwardDeclCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/NoDeleteCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/UncheckedLocalVarsCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/UncountedLambdaCapturesCheckerExpectations:\n\nCanonical link: https://commits.webkit.org/320001@main", "email": "rniwa@webkit.org", "hash": "ada29caa0f6a1b112906981e7ffe3e506fec9c78", "subject": "Update safer C++ expectations (2026-08-27)" }, "320002@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "320002@main", "clUrl": "https://commits.webkit.org/320002@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=198506\n\nReviewed by Yusuke Suzuki.\n\nBBQ and OMG now emit a bounds check against Table length and a load from\nExternOrAnyRefTable::m_jsValues.\n\n* Source/JavaScriptCore/b3/B3AbstractHeapRepository.h:\n* Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp:\n* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:\n* Source/JavaScriptCore/wasm/WasmTable.h:\n\nCanonical link: https://commits.webkit.org/320002@main", "email": "chi187@gmail.com", "hash": "798b6ba2bd68b9c0b55d6086a0c180ece54b5c0f", "subject": "[JSC][Wasm] Inline table.get for externref and anyref" }, "320003@main": { "author": "Ryosuke Niwa", "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64", "cl": "320003@main", "clUrl": "https://commits.webkit.org/320003@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322723\n\nReviewed by Geoffrey Garen.\n\nMake the destruction of WeakPtr NODELETE.\n\nNo new tests since there should be no behavioral differences.\n\n* Source/WTF/wtf/WeakPtrImpl.h:\n\nCanonical link: https://commits.webkit.org/320003@main", "email": "rniwa@webkit.org", "hash": "b13574b29bdb783714d9c83ee80e780a953558d9", "subject": "Destroying a WeakPtr should be considered as no-delete" }, "320004@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "320004@main", "clUrl": "https://commits.webkit.org/320004@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322520\n\nReviewed by Yusuke Suzuki.\n\nBBQ and OMG load Table length instead of calling operationGetWasmTableSize.\n\n* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:\n* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:\n\nCanonical link: https://commits.webkit.org/320004@main", "email": "chi187@gmail.com", "hash": "5bbcf5a4c9180f13ad9a7a6e4bdf834d91d81b1e", "subject": "[JSC][Wasm] Inline table.size" }, "320005@main": { "author": "Gerald Squelart", "avatar": "https://www.gravatar.com/avatar/894904f08d85651bf2a76868a4d2f1b3?d=identicon\u0026s=64", "cl": "320005@main", "clUrl": "https://commits.webkit.org/320005@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322666\nrdar://185939202\n\nReviewed by Mike Wyrzykowski.\n\nInstead of a full run-time sequence of decisions to determine which CG\naccelerated functions to use for different sets of pixel formats and\nalpha un/premultiplications, create a compile-time table pointing at\nsimple functions, or at a templated special-case function that can\nbe statically tailored (with `if constexpr` tests) to precise inputs.\nE.g.:\n- Same -\u003e same: copyImagePixels().\n- Premul -\u003e Unpremul: Special case that will only do CG unpremul.\n- RGB -\u003e BGR: Only CG permute channels.\n- Anything more complicated: CG any-to-any.\n- If anything goes wrong, ensure that the destination buffer is zeroed.\n\nThis function table currently requires specific numeric values of\nPixelFormat and AlphaPremultiplication enums so that they can be\nefficiently used as indices; that's why RGBA16F was moved to 4th\nposition. These constraints are statically checked.\n\nUse a similar set of template functions for the unaccelerated path.\nAnd use the same premultiply and unpremultiply formulas as vImage\nfunctions, for consistent results across platforms and easier testing.\n\nAlso properly handle BGRX8, always treating it as effectively\npremultiplied, and avoiding incorrect channel permutations.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/PixelBufferConversionTests.cpp\n\n* Source/WebCore/platform/graphics/PixelBufferConversion.cpp:\n(WebCore::copyImagePixels):\n(WebCore::makeVImageCGImageFormat):\n(WebCore::convertImagePixelsAcceleratedAnyToAny):\n(WebCore::convertImagePixelsAccelerated4DifferentFormats):\n(WebCore::ConvertImagePixelsFunctionTable::ConvertImagePixelsFunctionTable):\n(WebCore::ConvertImagePixelsFunctionTable::get const):\n(WebCore::ConvertImagePixelsFunctionTable::CountPackedEnums::static_assert):\n(WebCore::ConvertImagePixelsFunctionTable::convertImagePixels4Function):\n(WebCore::ConvertImagePixelsFunctionTable::createConvertImagePixels4FunctionTable4):\n(WebCore::ConvertImagePixelsFunctionTable::createConvertImagePixels4FunctionTable3):\n(WebCore::ConvertImagePixelsFunctionTable::createConvertImagePixels4FunctionTable2):\n(WebCore::ConvertImagePixelsFunctionTable::createConvertImagePixels4FunctionTable1):\n(WebCore::ConvertImagePixelsFunctionTable::createConvertImagePixels4FunctionTable):\n(WebCore::convertImagePixelsAccelerated):\n(WebCore::convertImagePixels):\n(WebCore::makeVImageBuffer):\n(WebCore::convertImagePixelsUnaccelerated4):\n(WebCore::convertImagePixelsUnaccelerated3):\n(WebCore::convertImagePixelsUnaccelerated2):\n(WebCore::convertImagePixelsUnaccelerated1):\n(WebCore::convertImagePixelsUnaccelerated):\n(WebCore::hasEnoughBytesForConversion):\n(WebCore::zeroImagePixels):\n(WebCore::convertSinglePixelPremultipliedToPremultiplied): Deleted.\n(WebCore::convertSinglePixelPremultipliedToUnpremultiplied): Deleted.\n(WebCore::convertSinglePixelUnpremultipliedToPremultiplied): Deleted.\n(WebCore::convertSinglePixelUnpremultipliedToUnpremultiplied): Deleted.\n(WebCore::convertFunctor): Deleted.\n(WebCore::premultiply):\n(WebCore::unpremultiply):\n(WebCore::CountPackedEnums::static_assert):\n(WebCore::ConvertImagePixelsFunctionTable::getTableFunction):\n(WebCore::ConvertImagePixelsFunctionTable::createTableDepth4):\n(WebCore::ConvertImagePixelsFunctionTable::createTableDepth3):\n(WebCore::ConvertImagePixelsFunctionTable::createTableDepth2):\n(WebCore::ConvertImagePixelsFunctionTable::createTableDepth1):\n(WebCore::ConvertImagePixelsFunctionTable::createTable):\n(WebCore::convertImagePixelsAcceleratedDifferentFormats):\n(WebCore::ConvertImagePixelsAcceleratedFunctions::get):\n(WebCore::convertImagePixelsUnacceleratedFunction):\n(WebCore::ConvertImagePixelsUnacceleratedFunctions::get):\n(WebCore::ConvertImagePixelsFunctionTable::invoke const):\n(WebCore::ConvertImagePixelsFunctionTable::selectTableFunction):\n(WebCore::ConvertImagePixelsAcceleratedFunctions::selectFunction):\n(WebCore::ConvertImagePixelsUnacceleratedFunctions::selectFunction):\n* Source/WebCore/platform/graphics/PixelFormat.h:\n(WebCore::pixelComponentOrder):\n* Tools/TestWebKitAPI/Tests/WebCore/PixelBufferConversionTests.cpp:\n(TestWebKitAPI::TEST(PixelBufferConversionTests, convertImagePixels)):\n(TestWebKitAPI::TEST(PixelBufferConversionTests, convertImagePixels2)):\n* Source/WTF/wtf/StdLibExtras.h:\n(WTF::memcpySpan):\n* Source/WebCore/SaferCPPExpectations/UncheckedCallArgsCheckerExpectations:\n* Source/WebCore/SaferCPPExpectations/UncountedCallArgsCheckerExpectations:\n\nCanonical link: https://commits.webkit.org/320005@main", "email": "g_squelart@apple.com", "hash": "23d9fb2bf1504bff9a298b56181a4da23c4b5ed8", "subject": "Use a compile-time table of un/accelerated convertImagePixels functions, fix BGRX8" }, "320006@main": { "author": "Sam Sneddon", "avatar": "https://www.gravatar.com/avatar/99f6b56d9db9d32920dfcc56deae86fc?d=identicon\u0026s=64", "cl": "320006@main", "clUrl": "https://commits.webkit.org/320006@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320507\nrdar://183470357\n\nReviewed by Ryan Haddad.\n\n259248@main fixed this bug in Package.archives(), switching from\nVersion's __contains__ prefix matching to an exact one, but left\nPackage.is_cached() comparing the cached manifest version with\n__contains__. A manifest cached under a looser pin (or from before\n259248@main) can therefore still read as up to date even though it\nisn't an exact match. Switch is_cached() to the same exact-match\ncomparison, so such a manifest is correctly treated as stale and\nreinstalled.\n\n* Tools/Scripts/libraries/webkitcorepy/webkitcorepy/autoinstall.py:\n(Package.is_cached): Use != instead of not in for the version comparison.\n* Tools/Scripts/libraries/webkitcorepy/webkitcorepy/tests/autoinstall_unittest.py:\n(IsCachedTest):\n(IsCachedTest.setUp):\n(IsCachedTest.test_is_cached_rejects_loose_version_match):\n(IsCachedTest.test_is_cached_accepts_exact_version_match):\n\nCanonical link: https://commits.webkit.org/320006@main", "email": "gsnedders@apple.com", "hash": "82407cd47dd16a25b04dbc974c520566ef171480", "subject": "Package.is_cached() should use exact version matching" }, "320007@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "320007@main", "clUrl": "https://commits.webkit.org/320007@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322713\n\nReviewed by Yusuke Suzuki.\n\nDFG::VariableEventStream keeps one 14 byte VariableEvent per event for as long\nas the DFG code lives, and its only reader is reconstruct() on OSR exit, which\nseeks back to the last Reset and replays the events from there. On JetStream3\n(25,095 DFG compiles) the streams hold 4.76 million events, 66.6 MB over the run\nand 2.65 KB per DFG compile, mostly SetLocal and MovHint events whose payloads\nare small integers.\n\nThis patch makes VariableEventStreamBuilder encode each event into a byte stream\nas SpeculativeJIT emits it, in the format described above the class in\nDFGVariableEventStream.h, and record the byte offset of every Reset in a side\ntable. The stream index that SpeculativeJIT captures for each OSR exit, slow\npath and OSR entry is now a byte offset, so nothing has to map event counts to\noffsets afterwards; reconstruct() binary-searches the Reset table for the\ncheckpoint and decodes forward to that offset. The events are still\nVariableEvents on both sides of the stream, so the emitters and the replay\nswitch are unchanged; VariableEvent only loses the Packed\u003c\u003e wrappers that\nexisted to make the stored array dense.\n\nThis is the DFG counterpart of 319934@main, which did the same for\nFTL::OSRExitDescriptor. The LEB128 encoders that both streams need move to a\nnew wtf/LEBEncoder.h, the counterpart of LEBDecoder.h, which in turn gains\ndecode*OrCrash() for streams the process encoded itself, and the FTL stream\nswitches its hand-rolled zigzag register offsets to the SLEB128 that WTF\nalready decodes.\n\nOn the same JetStream3 run the byte streams and Reset tables total 17.8 MB (3.7\nbytes per event, -73%), 0.71 KB per DFG compile. Decoding adds 0.5 us to each\nreconstruct().\n\nTest: Tools/TestWebKitAPI/Tests/WTF/LEBEncoder.cpp\n\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:\n(JSC::DFG::SpeculativeJIT::finalizeEventStream):\n* Source/JavaScriptCore/dfg/DFGVariableEvent.h:\n(JSC::DFG::VariableEvent::fillGPR):\n(JSC::DFG::VariableEvent::fillFPR):\n(JSC::DFG::VariableEvent::birth):\n(JSC::DFG::VariableEvent::spill):\n(JSC::DFG::VariableEvent::death):\n(JSC::DFG::VariableEvent::setLocal):\n(JSC::DFG::VariableEvent::movHint):\n(JSC::DFG::VariableEvent::id const):\n(JSC::DFG::VariableEvent::gpr const):\n(JSC::DFG::VariableEvent::fpr const):\n(JSC::DFG::VariableEvent::spillRegister const):\n(JSC::DFG::VariableEvent::operand const):\n(JSC::DFG::VariableEvent::machineRegister const):\n(JSC::DFG::VariableEvent::variableRepresentation const):\n* Source/JavaScriptCore/dfg/DFGVariableEventStream.cpp:\n(JSC::DFG::VariableEventStreamBuilder::logEvent):\n(JSC::DFG::VariableEventStream::encode):\n(JSC::DFG::VariableEventStream::decode):\n(JSC::DFG::VariableEventStream::reconstruct const):\n* Source/JavaScriptCore/dfg/DFGVariableEventStream.h:\n(JSC::DFG::VariableEventStream::VariableEventStream):\n(JSC::DFG::VariableEventStreamBuilder::VariableEventStreamBuilder):\n(JSC::DFG::VariableEventStreamBuilder::appendAndLog):\n(JSC::DFG::VariableEventStreamBuilder::size const):\n(JSC::DFG::VariableEventStreamBuilder::finalize):\n* Source/JavaScriptCore/ftl/FTLOSRExit.cpp:\n(JSC::FTL::OSRExitValues::encode):\n(JSC::FTL::OSRExitValues::decode const):\n(JSC::FTL::DFG::appendLEB): Deleted.\n(JSC::FTL::DFG::readLEB): Deleted.\n* Source/JavaScriptCore/ftl/FTLOSRExit.h:\n* Source/WTF/WTF.xcodeproj/project.pbxproj:\n* Source/WTF/wtf/CMakeLists.txt:\n* Source/WTF/wtf/LEBDecoder.h:\n(WTF::LEBDecoder::decodeUIntOrCrash):\n(WTF::LEBDecoder::decodeIntOrCrash):\n(WTF::LEBDecoder::decodeUInt32OrCrash):\n(WTF::LEBDecoder::decodeUInt64OrCrash):\n(WTF::LEBDecoder::decodeInt32OrCrash):\n(WTF::LEBDecoder::decodeInt64OrCrash):\n* Source/WTF/wtf/LEBEncoder.h: Added.\n(WTF::LEBEncoder::encodeUInt):\n(WTF::LEBEncoder::encodeInt):\n(WTF::LEBEncoder::encodeUInt32):\n(WTF::LEBEncoder::encodeUInt64):\n(WTF::LEBEncoder::encodeInt32):\n(WTF::LEBEncoder::encodeInt64):\n* Tools/TestWebKitAPI/CMakeLists.txt:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WTF/LEBEncoder.cpp: Added.\n(TestWebKitAPI::testUInt32LEBEncode):\n(TestWebKitAPI::testInt32LEBEncode):\n(TestWebKitAPI::TEST(WTF, LEBEncoderUInt32)):\n(TestWebKitAPI::TEST(WTF, LEBEncoderInt32)):\n(TestWebKitAPI::TEST(WTF, LEBEncoderRoundTrip64)):\n\nCanonical link: https://commits.webkit.org/320007@main", "email": "sosuke@bun.sh", "hash": "48985e195c6fddb7395ad65e72a7614f12366ae2", "subject": "[JSC] Store the DFG `VariableEventStream` as a byte stream" }, "320008@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "320008@main", "clUrl": "https://commits.webkit.org/320008@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322736\nrdar://186006463\n\nReviewed by Simon Fraser.\n\nAn SVG image whose natural aspect ratio is extreme e.g. a viewBox of\n\"0 0 1 2147483647\" with one specified dimension, rounds the derived\ndimension of its resolved intrinsic size down to zero in\nRenderBoxModelObject::calculateImageIntrinsicDimensions() (8 * 1 / 2147483647\nfloors to 0 as a LayoutUnit). BackgroundPainter::calculateFillTileSize()'s\ncover/contain handling then scales that intrinsic size by a single factor,\nwhich can never recover the lost dimension: it hits the isEmpty() guard and\nreturns an empty tile, so nothing is painted. cover on such an image is\nsupposed to fill the positioning area.\n\nThe cover and contain concrete object size depends only on the natural aspect\nratio and the constraint rectangle, not on the (possibly sub-pixel, rounded)\nintrinsic pixel size. When the resolved intrinsic size has collapsed to empty\nbut the image still reports a non-empty natural ratio, derive the concrete\nsize from the ratio and the positioning area directly:\n\n \"A contain constraint is resolved by setting the concrete object size to the\n largest rectangle that has the object's natural aspect ratio and\n additionally has neither width nor height larger than the constraint\n rectangle's [...]. A cover constraint is resolved by setting the concrete\n object size to the smallest rectangle that has the object's natural aspect\n ratio and additionally has neither width nor height smaller than the\n constraint rectangle's [...].\" [1]\n\nFor an extreme ratio contain collapses the tiny axis to zero (empty, matching\nthe -empty references) while cover expands it to fill the area (matching the\n-lime references). The new path only runs when the resolved intrinsic size is\nempty and a natural ratio exists, so ordinary cover/contain sizing is\nunchanged.\n\nThis is CSS box code shared by both the legacy and layer-based SVG engines;\nthe SVG image's natural ratio comes from SVGImage::computeIntrinsicDimensions.\n\n[1] https://drafts.csswg.org/css-images-3/#cover-contain\n\n* LayoutTests/TestExpectations: Unskip now passing tests\n* Source/WebCore/rendering/BackgroundPainter.cpp:\n(WebCore::BackgroundPainter::calculateFillTileSize):\n\nCanonical link: https://commits.webkit.org/320008@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "6b879687ee9429781c5dacc0d123e73105f06511", "subject": "background-size: cover paints nothing for an SVG image with an extreme natural aspect ratio" }, "320009@main": { "author": "Youenn Fablet", "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64", "cl": "320009@main", "clUrl": "https://commits.webkit.org/320009@main", "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=322761\u003e\n\u003crdar://176978345\u003e\n\nReviewed by Jean-Yves Avenard.\n\ncopyVideoFrameBuffer used i420Frame-\u003ewidth() / i010Frame-\u003ewidth() as both the destination row pitch and the UV plane size.\nlibyuv's I420ToNV12 / I010ToP010 round chroma dimensions up: they emit ((width + 1) / 2) * 2 bytes per UV row and (height + 1) / 2 UV rows.\nFor odd width, libyuv writes one byte (I420) or two bytes (I010) past each UV row, with the final row's overrun landing past the end of the SharedMemory mapping.\nFor odd height, an entire UV row's worth of data (~width or 2*width bytes) lands past the mapping.\n\nRound chroma dimensions up to match libyuv.\nSharedVideoFrameInfo::fromVideoFrameBuffer now sizes the UV plane via computeStrideUV\u003cbyteType\u003e(frame) (sizeof(byteType) * (width rounded up to even)) and computeHeightUV(frame) ((height + 1) / 2).\ncopyVideoFrameBuffer applies the same rounding to the strideUV it hands to libyuv, so writer row pitch matches the receiver's m_bytesPerRowPlaneB and rows no longer overlap.\n\nRe-land 319878@main, reverted by 319927@main for breaking ASan builds.\nThe added tests make TestWebKitAPI a libwebrtc client, but its\nConfigurations/Base.xcconfig searched neither the webrtc header\ndirectory nor the directory libwebrtc.dylib installs into, so the\nbuild failed first at `api/scoped_refptr.h` and then at `-lwebrtc`.\nGive it both search paths, so it resolves libwebrtc the same way\nWebCore.xcconfig and WebKit.xcconfig already do.\n\nCovered by added API tests.\n\n* Source/ThirdParty/libwebrtc/Configurations/libwebrtc.exp:\n* Source/ThirdParty/libwebrtc/Configurations/libwebrtc.xcconfig:\n* Source/ThirdParty/libwebrtc/Source/webrtc/webkit_sdk/WebKit/WebKitUtilities.mm:\n(webrtc::copyVideoFrameBuffer):\n* Source/WebCore/platform/cocoa/SharedVideoFrameInfo.mm:\n(WebCore::computeStrideY):\n(WebCore::computeStrideUV):\n(WebCore::computeWidthUV):\n(WebCore::computeHeightUV):\n(WebCore::SharedVideoFrameInfo::fromVideoFrameBuffer):\n* Tools/TestWebKitAPI/Configurations/Base.xcconfig:\n* Tools/TestWebKitAPI/Configurations/TestWebKitAPIBase.xcconfig:\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/SharedVideoFrame.mm:\n(TestWebKitAPI::TEST(SharedVideoFrame, PlaneAlphaSize)):\n(TestWebKitAPI::testSharedVideoFrameInfoRoundTrip):\n(TestWebKitAPI::TEST(SharedVideoFrame, OddWidthI420)):\n(TestWebKitAPI::TEST(SharedVideoFrame, OddHeightI420)):\n(TestWebKitAPI::TEST(SharedVideoFrame, OddWidthAndHeightI420)):\n(TestWebKitAPI::TEST(SharedVideoFrame, OddWidthI010)):\n(TestWebKitAPI::TEST(SharedVideoFrame, OddHeightI010)):\n(TestWebKitAPI::TEST(SharedVideoFrame, OddWidthAndHeightI010)):\n(TestWebKitAPI::TEST(WebCore, SharedVideoFramePlaneAlphaSize)): Deleted.\n\nOriginally-landed-as: 305413.997@safari-7624.5-branch (881cd542f818). rdar://185368288\nCanonical link: https://commits.webkit.org/320009@main", "email": "youenn@apple.com", "hash": "c18f11b0d1e989215dbd05221e763ef6c0208fc9", "subject": "[WebRTC] Out-of-bounds write in copyVideoFrameBuffer for odd-width I420/I010 frames" }, "320010@main": { "author": "Issac Roy", "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64", "cl": "320010@main", "clUrl": "https://commits.webkit.org/320010@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322308\nrdar://problem/185553192\n\nReviewed by Sam Sneddon.\n\nRelations could only be added. Bugzilla's 'relate' sent '{\"add\": [...]}' and\nradar's created a relationship, with no way to undo either, so a tool which\nrecords a dependency between two issues cannot later forget it and a stale\nrelation has to be removed by hand.\n\nAdd 'unrelate', which Bugzilla implements by sending '{\"remove\": [...]}'\nthrough the request 'relate' already builds and radar by deleting a\nrelationship the radar already holds. 'duplicate-of' and 'original-of' are not\nremovable this way, since they are recorded as a resolution rather than as a\nrelationship.\n\n* Tools/Scripts/libraries/webkitbugspy/webkitbugspy/__init__.py:\n* Tools/Scripts/libraries/webkitbugspy/webkitbugspy/bugzilla.py:\n(Tracker):\n\n* Tools/Scripts/libraries/webkitbugspy/webkitbugspy/__init__.py:\n* Tools/Scripts/libraries/webkitbugspy/webkitbugspy/bugzilla.py:\n(Tracker):\n(Tracker._modify_relations):\n(Tracker.relate):\n(Tracker.unrelate):\n* Tools/Scripts/libraries/webkitbugspy/webkitbugspy/issue.py:\n(Issue.unrelate):\n* Tools/Scripts/libraries/webkitbugspy/webkitbugspy/mocks/bugzilla.py:\n(Bugzilla._issue):\n(Bugzilla._issue.related_for):\n* Tools/Scripts/libraries/webkitbugspy/webkitbugspy/mocks/radar.py:\n(RadarModel.__init__):\n(RadarModel.commit_changes):\n(RadarModel.delete_relationship):\n* Tools/Scripts/libraries/webkitbugspy/webkitbugspy/radar.py:\n(Tracker.remove_relationship):\n(Tracker):\n(Tracker.unrelate):\n(Tracker.relation_key):\n* Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tests/bugzilla_unittest.py:\n(test_relate_simple):\n* Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tests/radar_unittest.py:\n* Tools/Scripts/libraries/webkitbugspy/webkitbugspy/tracker.py:\n(Tracker.unrelate):\n(Tracker):\n(Tracker.relation_key):\n\nCanonical link: https://commits.webkit.org/320010@main", "email": "issacroy05@gmail.com", "hash": "92e0ba83201799cf2b06703b37758746c091eeea", "subject": "[webkitbugspy] Cannot remove a relation between two issues" }, "320011@main": { "author": "Dominic Mazzoni", "avatar": "https://www.gravatar.com/avatar/f76643c44a7ee3be45148e66d97ed8e4?d=identicon\u0026s=64", "cl": "320011@main", "clUrl": "https://commits.webkit.org/320011@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322688\nrdar://185960907\n\nReviewed by Tyler Wilcock.\n\nOn the live AX tree, asking for a \u003ctextarea\u003e's or \u003cinput type=text\u003e's\ntext marker range was giving back a range whose string was a single object\nreplacement character (U+FFFC) and whose endpoints carried no useful\nindex. This doesn't match the isolated tree, which returns a useful\nrange derived from its shadow tree.\n\ntextMarkerRange() now descends into the inner text element for native text\ncontrols, leaving out the trailing placeholder \u003cbr\u003e to match other APIs\nlike AXNumberOfCharacters.\n\nA special case is needed for a control with no value.\n\nTests: accessibility/isolated-tree/mac/text-marker-range-for-text-control.html\n accessibility/mac/text-marker-range-for-text-control.html\n\n* LayoutTests/accessibility/isolated-tree/mac/text-marker-range-for-text-control-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/text-marker-range-for-text-control.html: Added.\n* LayoutTests/accessibility/mac/text-marker-range-for-text-control-expected.txt: Added.\n* LayoutTests/accessibility/mac/text-marker-range-for-text-control.html: Added.\n* Source/WebCore/accessibility/AccessibilityNodeObject.cpp:\n(WebCore::AccessibilityNodeObject::isNativeTextControl const): Deleted.\n(WebCore::AccessibilityNodeObject::text const):\n* Source/WebCore/accessibility/AccessibilityNodeObject.h:\n* Source/WebCore/accessibility/AccessibilityObject.cpp:\n(WebCore::AccessibilityObject::nativeTextControl const):\n(WebCore::AccessibilityObject::textMarkerRange const):\n* Source/WebCore/accessibility/AccessibilityObject.h:\n(WebCore::AccessibilityObject::isNativeTextControl const):\n* Source/WebCore/accessibility/AccessibilityObjectInlines.h:\n(WebCore::AccessibilityObject::textMarkerRange const): Deleted.\n* Source/WebCore/accessibility/AccessibilityRenderObject.cpp:\n(WebCore::AccessibilityRenderObject::setSelectedVisiblePositionRange):\n\nCanonical link: https://commits.webkit.org/320011@main", "email": "dm_mazzoni@apple.com", "hash": "585cb45609b37a90566b0b114c25043c7f3f6680", "subject": "AX: AXTextMarkerRangeForUIElement covers a native text control as a replaced object rather than its value" }, "320012@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "320012@main", "clUrl": "https://commits.webkit.org/320012@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322755\nrdar://186016244\n\nReviewed by Yijia Huang.\n\nWe are updating profiles at GC end phase since it is also clearing cells\nwhich will be dead after this GC end phase. So this is necessary, but\nupdating many profiles are costly. We are iterating all live CodeBlocks\nand updating them takes long time.\n\nThis patch speculatively updates profiles when marking CodeBlock from GC.\nSo then values get updated and cleared concurrently. We still need to\nupdate the profiles at GC end phase, but it is likely that there are\nmany empty profiled values remaining if we are not executing this\nCodeBlock after GC scan happens, so we can significantly reduce the cost\nof sequential execution of profile update.\n\n* Source/JavaScriptCore/bytecode/CodeBlock.cpp:\n(JSC::CodeBlock::visitChildren):\n\nCanonical link: https://commits.webkit.org/320012@main", "email": "ysuzuki@apple.com", "hash": "0fb9b2cf502b80dcf30a9387f4a49bc602d4d474", "subject": "[JSC] Update profile concurrently from GC marker threads" }, "320013@main": { "author": "Dominic Mazzoni", "avatar": "https://www.gravatar.com/avatar/f76643c44a7ee3be45148e66d97ed8e4?d=identicon\u0026s=64", "cl": "320013@main", "clUrl": "https://commits.webkit.org/320013@main", "description": "rdar://186004521\n\nReviewed by Tyler Wilcock.\n\nAccessibilityObject::replaceTextInRange resolved the character range\nthrough rangeForCharacterRange, which walks CharacterOffsets. A\nCharacterOffset names a node and a side of it, so at a block boundary\na single character index belongs to two of them: the position after\nthe \u003cbr\u003e that ends the preceding block, and the position starting the\nnext block. The walk picked the former. That is not a caret position\n-- a \u003cbr\u003e ending a block is collapsed out by rendering and has nothing\nafter it -- so it canonicalized back over the \u003cbr\u003e, one character\nearly. Resolving the same index through visiblePositionForIndex lands\non the position that renders where the caller means, so\nreplaceTextInRange now uses that.\n\nTests: accessibility/isolated-tree/mac/replace-range-at-block-boundary.html\n accessibility/mac/replace-range-at-block-boundary.html\n\n* LayoutTests/accessibility/isolated-tree/mac/replace-range-at-block-boundary-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/replace-range-at-block-boundary.html: Added.\n* LayoutTests/accessibility/mac/replace-range-at-block-boundary-expected.txt: Added.\n* LayoutTests/accessibility/mac/replace-range-at-block-boundary.html: Added.\n* Source/WebCore/accessibility/AccessibilityObject.cpp:\n(WebCore::AccessibilityObject::replaceTextInRange):\n\nCanonical link: https://commits.webkit.org/320013@main", "email": "dm_mazzoni@apple.com", "hash": "b2177e4ae385e3c4d991a2dc4a61ba96bd783e8e", "subject": "AX: AXReplaceRangeWithText inserts text at the wrong index" }, "320014@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "320014@main", "clUrl": "https://commits.webkit.org/320014@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322707\n\nReviewed by Ryosuke Niwa.\n\nThe point of this assertion was to make sure that we do not forget to\nadopt a RefCounted object after constructing it. However, it also\nprevents ref'ing the object while it is in the middle of construction.\n\nRef'ing the object while it is in the middle of construction is safer\nand something that happens routinely, especially when adopting our\nmodern safer cpp programming patterns. This assertion was thus slowing\ndown safer cpp adoption and we would keep addressing the crashes by\nadding calls to `relaxAdoptionRequirement()`, which disables the\nadoption requirement assertion for a specific object type.\n\nAs a result, it makes little sense to keep this assertion around and\nI am thus removing it in this patch.\n\n* Source/WTF/wtf/NeverDestroyed.h:\n(WTF::NeverDestroyed::NeverDestroyed):\n(WTF::LazyNeverDestroyed::constructWithoutAccessCheck):\n(WTF::NeverDestroyed::MaybeRelax::MaybeRelax): Deleted.\n(): Deleted.\n(WTF::LazyNeverDestroyed::MaybeRelax::MaybeRelax): Deleted.\n* Source/WTF/wtf/Ref.h:\n(WTF::adoptRef):\n(WTF::adopted): Deleted.\n* Source/WTF/wtf/RefCountDebugger.h:\n(WTF::RefCountDebuggerImpl::~RefCountDebuggerImpl):\n(WTF::RefCountDebuggerImpl::willRef const):\n(WTF::RefCountDebuggerImpl::willDeref const):\n(WTF::RefCountDebuggerImpl::adopted): Deleted.\n(WTF::RefCountDebuggerImpl::relaxAdoptionRequirement): Deleted.\n* Source/WTF/wtf/RefCounted.h:\n(WTF::RefCountedBase::adopted): Deleted.\n(WTF::RefCountedBase::relaxAdoptionRequirement): Deleted.\n(WTF::adopted): Deleted.\n* Source/WTF/wtf/RefCountedWithInlineWeakPtr.h:\n(WTF::adopted): Deleted.\n* Source/WTF/wtf/RefPtr.h:\n(WTF::adoptRef):\n* Source/WTF/wtf/ThreadSafeRefCounted.h:\n(WTF::adopted): Deleted.\n* Source/WTF/wtf/ThreadSafeRefCountedWithSuppressingSaferCPPChecking.h:\n(WTF::adopted): Deleted.\n* Source/WTF/wtf/UniquelyOwnedPtr.h:\n(WTF::makeUniquelyOwned):\n* Source/WTF/wtf/glib/SocketConnection.cpp:\n(WTF::SocketConnection::SocketConnection):\n* Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp:\n(WebCore::MediaStreamTrack::MediaStreamTrack):\n* Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp:\n(WebCore::RTCPeerConnection::RTCPeerConnection):\n* Source/WebCore/Modules/notifications/NotificationResourcesLoader.cpp:\n(WebCore::NotificationResourcesLoader::ResourceLoader::ResourceLoader):\n* Source/WebCore/accessibility/AccessibilityMenuList.cpp:\n(WebCore::AccessibilityMenuList::create):\n* Source/WebCore/accessibility/AccessibilitySpinButton.cpp:\n(WebCore::AccessibilitySpinButton::create):\n* Source/WebCore/dom/EmptyScriptExecutionContext.h:\n* Source/WebCore/dom/Node.cpp:\n(WebCore::Node::Node):\n(WebCore::Node::~Node):\n* Source/WebCore/dom/Node.h:\n(WebCore::Node::ref const):\n(WebCore::Node::deref const):\n(WebCore::adopted): Deleted.\n* Source/WebCore/dom/NodeInlines.h:\n(WebCore::Node::relaxAdoptionRequirement): Deleted.\n* Source/WebCore/dom/Subscriber.cpp:\n(WebCore::Subscriber::Subscriber):\n* Source/WebCore/dom/messageports/MessagePortChannel.cpp:\n(WebCore::m_registry):\n* Source/WebCore/fileapi/Blob.cpp:\n(WebCore::Blob::stream):\n* Source/WebCore/loader/DocumentThreadableLoader.cpp:\n(WebCore::DocumentThreadableLoader::DocumentThreadableLoader):\n* Source/WebCore/page/Frame.cpp:\n(WebCore::Frame::Frame):\n* Source/WebCore/page/Page.cpp:\n(WebCore::createMainFrame):\n* Source/WebCore/platform/graphics/Font.cpp:\n(WebCore::m_shouldNotBeUsedForArabic):\n* Source/WebCore/rendering/RenderScrollbar.cpp:\n(WebCore::RenderScrollbar::RenderScrollbar):\n* Source/WebCore/rendering/RenderWidget.cpp:\n(WebCore::RenderWidget::RenderWidget):\n* Source/WebCore/workers/WorkerOrWorkletGlobalScope.cpp:\n(WebCore::WorkerOrWorkletGlobalScope::WorkerOrWorkletGlobalScope):\n* Source/WebCore/workers/service/ServiceWorker.cpp:\n(WebCore::ServiceWorker::ServiceWorker):\n* Source/WebCore/workers/service/ServiceWorkerContainer.cpp:\n(WebCore::ServiceWorkerContainer::ensureSWClientConnection):\n* Source/WebCore/workers/service/ServiceWorkerRegistration.cpp:\n(WebCore::ServiceWorkerRegistration::ServiceWorkerRegistration):\n* Source/WebKit/NetworkProcess/Downloads/PendingDownload.cpp:\n(WebKit::PendingDownload::PendingDownload):\n* Source/WebKit/NetworkProcess/NetworkLoad.cpp:\n(WebKit::NetworkLoad::NetworkLoad):\n* Source/WebKit/NetworkProcess/NetworkSocketChannel.cpp:\n(WebKit::NetworkSocketChannel::NetworkSocketChannel):\n* Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerNavigationPreloader.cpp:\n(WebKit::ServiceWorkerNavigationPreloader::ServiceWorkerNavigationPreloader):\n* Source/WebKit/NetworkProcess/SharedWorker/WebSharedWorkerServerToContextConnection.cpp:\n(WebKit::WebSharedWorkerServerToContextConnection::WebSharedWorkerServerToContextConnection):\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionMenuItemCocoa.mm:\n(WebKit::WebExtensionMenuItem::WebExtensionMenuItem):\n* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:\n(WebKit::ProvisionalPageProxy::ProvisionalPageProxy):\n* Source/WebKit/WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp:\n(WebKit::WebIDBConnectionToServer::WebIDBConnectionToServer):\n* Source/WebKit/webpushd/PushService.mm:\n(WebPushD::PushService::PushService):\n\nCanonical link: https://commits.webkit.org/320014@main", "email": "cdumez@apple.com", "hash": "0d9f8faf3642c18971c354d7a3d756d116b5fa9b", "subject": "Drop RefCounted's adoption requirement assertion" }, "320015@main": { "author": "Brian Weinstein", "avatar": "https://www.gravatar.com/avatar/2892a9aaa68f537ee65c6f95ef0768a6?d=identicon\u0026s=64", "cl": "320015@main", "clUrl": "https://commits.webkit.org/320015@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322782\nrdar://184269255\n\nReviewed by Timothy Hatcher.\n\n-[UIWindow initWithFrame] is deprecated in iOS 26. Use -initWithWindowScene: instead, and have\nthe class choose a foreground scene to use.\n\n* Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPIOffscreenCocoa.mm:\n(WebKit::windowScene):\n(WebKit::WebExtensionContext::offscreenCreateDocument):\n\nCanonical link: https://commits.webkit.org/320015@main", "email": "bweinstein@apple.com", "hash": "4ae53427d5d8e52791da2cfe0c0c98b877b2b5d5", "subject": "Fix compilation issue with WK_WEB_EXTENSIONS_OFFSCREEN on iOS" }, "320016@main": { "author": "Brent Fulgham", "avatar": "https://www.gravatar.com/avatar/c6989a65afef0d015b55c65406e37ccc?d=identicon\u0026s=64", "cl": "320016@main", "clUrl": "https://commits.webkit.org/320016@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322546\nrdar://185840799\n\nReviewed by Matthew Finkel.\n\nCFNetwork's cookie-date parser rejects a cookie-date containing a month-before-day date\nformat. Unfortunately, this is the format JavaScript's Date.prototype.toString() method\nproduces (at least in some locales). This causes cookies with an Expires attribute of\nthat form to be silently ignored, converting the cookie from a persistent value to a\nsession cookie (which disappears when the browser quits).\n\nThis patch introduces an initial scan for month-first date formats, and fixes up the\nstring if necessary. We perform the date fix-up prior to handing off to CFNetwork (or\nlibSOUP) so that we only have to perform the cookie parsing logic once. The cURL ports\nnever rejected month-before-day strings, so did not suffer from this behavior.\n\nWhile this patch is largely a workaround until CFNetwork and libSOUP fix their underlying\nimplementations, it also allows us to improve behavior for downlevel shipment of Safari\nas well as Safari Technology Preview.\n\nThis fix can only cover document.cookie cases. The Set-Cookie response-header path is parsed\ninside NSURLSession before WebKit sees the response, so there is no interception point;\nthat half is fixed only by rdar://185837942.\n\n* LayoutTests/imported/w3c/web-platform-tests/cookies/attributes/expires-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/cookies/attributes/expires.html:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/platform/Cookie.h:\n* Source/WebCore/platform/network/Cookie.cpp:\n(WebCore::CookieUtil::isMonthNameToken):\n(WebCore::CookieUtil::cookieStringWithDayFirstExpires):\n* Source/WebCore/platform/network/cocoa/NetworkStorageSessionCocoa.mm:\n(WebCore::parseDOMCookie): Repair the parsed cookie before adjusting it.\n* Source/WebCore/platform/network/soup/NetworkStorageSessionSoup.cpp:\n(WebCore::NetworkStorageSession::setCookiesFromDOM const):\n\nCanonical link: https://commits.webkit.org/320016@main", "email": "bfulgham@apple.com", "hash": "d01d085ea0fdef14a17d1c9765c49b8fee40fa67", "subject": "[CFNetwork] Honor Expires cookie dates that use JS Date.toString() dates (month-before-day Expires values)" }, "320017@main": { "author": "Abrar Rahman Protyasha", "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64", "cl": "320017@main", "clUrl": "https://commits.webkit.org/320017@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322776\nrdar://186040671\n\nReviewed by Wenson Hsieh.\n\n319888@main started clamping the delta of the wheel events produced by\nthe pan GR along any pinned axis, with the intention that a sideways\nscroll component during a simultaneous pan + transient zoom could not\nturn into a rubberband stretch (which makes the scrolling tree discard\nthe orthogonal delta for the rest of the gesture).\n\nThe wheel event in question feeds two systems, though; the swipe tracker\nmaintained by view gesture controller, and the actual page. For the\nformer, our clamping means we remove the signal used to determine\nPendingSwipeTracker::scrollEventCanBecomeSwipe(), and as such we\ninadvertently broke swiping -\u003e page navigation when the horizontal axis\nis pinned, i.e. the common case at the default page scale.\n\nIn this patch, we build a separate event per consumer. The swipe tracker\ngets the unclamped delta, and only the event that reaches the page is\nclamped. A more principled fix would be to make the scrolling tree _not_\ndiscard the orthogonal component of a scroll delta from the motivation\nfor 319888@main, but that is riskier and certainly not right in exactly\nthe form I described.\n\nTest: AppKitGesturesTests.Basic.swipingAtPinnedStateShouldTriggerPageNavigation\n\n* Source/WebKit/UIProcess/mac/AppKitGestures/WKAppKitGestureController.mm:\n(-[WKAppKitGestureController sendWheelEventForGesture:]):\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift:\n\nCanonical link: https://commits.webkit.org/320017@main", "email": "a_protyasha@apple.com", "hash": "2715812bcdba4065f929c0633a226cf4755fc11d", "subject": "REGRESSION(319888@main): [AppKit Gestures] Cannot back/forward navigate with gesture-driven swipe" }, "320018@main": { "author": "Keith Miller", "avatar": "https://www.gravatar.com/avatar/bddc1595b29098429a6ce7c8bf4aced2?d=identicon\u0026s=64", "cl": "320018@main", "clUrl": "https://commits.webkit.org/320018@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318480\nrdar://180535979\n\nReviewed by Yusuke Suzuki.\n\nIn 305413.1013@safari-7624.5-branch we fixed how result types were\npushed onto the wasm value stack, widening them to the expected type\nrather than the last predecessor's type at the merge.\n\nThis missed the case for unreachable expressions in the block, which\nis fixed in this patch.\n\nOriginally-landed-as: 305413.1080@safari-7624.5-branch (f65ca49ea4a7). rdar://185368954\nCanonical link: https://commits.webkit.org/320018@main", "email": "keith_miller@apple.com", "hash": "36058b8e69ac846ca93e33feb106b09d4b2fd787", "subject": "[Wasm] Unreachable end ops don't widen result types" }, "320019@main": { "author": "Tyler Wilcock", "avatar": "https://www.gravatar.com/avatar/9545082e6bed96158a9f52dac6e4b869?d=identicon\u0026s=64", "cl": "320019@main", "clUrl": "https://commits.webkit.org/320019@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322442\nrdar://185725689\n\nReviewed by Dominic Mazzoni.\n\nLayout drops the space a line soft-wraps at, but AccessibilityRenderObject::textRuns\nre-adds it to the end of the wrapping line's run, so that a range spanning the wrap\nstill reads \"foo bar\" rather than \"foobar\". A line's range therefore ended one\ncharacter past the line's rendered text, and AXStringForTextMarkerRange over the range\nAXTextMarkerRangeForLine returned included a space that renders on no line, e.g. for\n\u003cp style=\"width: 4ch\"\u003eaaa bbb\u003c/p\u003e, \"aaa \" rather than \"aaa\".\n\nThe live tree ends that range before the space. endOfLine() produces an upstream\nposition, and AXTextMarker::operator CharacterOffset() maps an upstream marker through\npreviousCharacterOffset().\n\nWith this commit, we do the same in the isolated tree by moving the returned\nrange's end marker back over the wrap space, which also brings its length and end\nindex in line with the live tree's (3, not 4).\n\n* LayoutTests/accessibility/isolated-tree/empty-final-line-range-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/empty-final-line-range.html: Added.\n* LayoutTests/accessibility/mac/line-range-at-soft-break-excludes-space-expected.txt: Added.\n* LayoutTests/accessibility/mac/line-range-at-soft-break-excludes-space.html: Added.\n* Source/WebCore/accessibility/AXTextMarker.cpp:\n(WebCore::lineRangeWithout):\n(WebCore::AXTextMarker::characterRangeForLine const):\n(WebCore::AXTextMarker::markerRangeForLineIndex const):\n(WebCore::AXTextMarker::lineNumberForIndex const):\n(WebCore::AXTextMarker::lineRange const):\n(WebCore::lineRangeWithoutCollapsedTrailingNewline): Deleted.\n\nCanonical link: https://commits.webkit.org/320019@main", "email": "tyler_w@apple.com", "hash": "befc99869859fc54f2f0931042518f037996252a", "subject": "AX: In isolated tree mode, AXStringForTextMarkerRange unexpectedly includes a whitespace at a soft line break" }, "320020@main": { "author": "Carlos Garcia Campos", "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64", "cl": "320020@main", "clUrl": "https://commits.webkit.org/320020@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322711\n\nReviewed by Nikolas Zimmermann.\n\nIt's unused since 286605@main\n\n* Source/WebCore/platform/graphics/egl/BitmapTexture.cpp:\n(WebCore::BitmapTexture::swapTexture):\n(WebCore::BitmapTexture::reset):\n(WebCore::BitmapTexture::initializeStencil):\n(WebCore::BitmapTexture::createFboIfNeeded):\n(WebCore::BitmapTexture::bindAsSurface):\n(WebCore::BitmapTexture::~BitmapTexture):\n(WebCore::BitmapTexture::initializeDepthBuffer): Deleted.\n(WebCore::depthBufferFormat): Deleted.\n* Source/WebCore/platform/graphics/egl/BitmapTexture.h:\n* Source/WebCore/platform/graphics/egl/BitmapTexturePool.cpp:\n(WebCore::BitmapTexturePool::acquireTexture):\n\nCanonical link: https://commits.webkit.org/320020@main", "email": "cgarcia@igalia.com", "hash": "31dc597d97b73503dba0b54721d70db30f0ffb78", "subject": "[TextureMapper] Remove unused BitmapTexture::Flags::DepthBuffer" }, "320021@main": { "author": "Anne van Kesteren", "avatar": "https://www.gravatar.com/avatar/09bb44ac3625a121017cd98d0a7dc52c?d=identicon\u0026s=64", "cl": "320021@main", "clUrl": "https://commits.webkit.org/320021@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322720\n\nReviewed by Tim Nguyen.\n\nA Document's target element is only set by the scroll to the fragment\nalgorithm; nothing sets it to null when the element is removed from the\ndocument. WebKit cleared it on removal since 2008 (23144@main) to avoid a\ndangling raw pointer, which is no longer a concern now that m_cssTarget\nis a WeakPtr. Gecko already behaved this way and Chromium made the same\nchange in 2024, so this aligns all engines with the HTML Standard.\n\nTests: imported/w3c/web-platform-tests/html/browsers/browsing-the-web/scroll-to-fragid/target-pseudo-after-adoption.html\n imported/w3c/web-platform-tests/html/interaction/focus/the-autofocus-attribute/document-with-fragment-removed-target.html\n\nWPT PR: https://github.com/web-platform-tests/wpt/pull/62238\n\nCanonical link: https://commits.webkit.org/320021@main", "email": "annevk@annevk.nl", "hash": "cec9d207c1b775717dcdd9b63460b99d7907e661", "subject": ":target should keep matching a target element that is removed and reinserted" }, "320022@main": { "author": "Antti Koivisto", "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64", "cl": "320022@main", "clUrl": "https://commits.webkit.org/320022@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322710\nrdar://185975255\n\nReviewed by Sam Weinig.\n\nImplement https://github.com/w3c/csswg-drafts/issues/14338\n\nThis mostly affects cycle detection:\n\n@function --double(--len \u003clength\u003e) returns \u003clength\u003e { result: calc(var(--len) * 2); }\nfont-size: --double(1em);\n\nused to be cycle because `em` unit was resolved in function context where we can't reference the\nproperty we are computing. In calling context it evaluates against parent font-size which is fine.\n\nA major benefit is that this allows significant code simplifications. We no longer need to instantiate a separate\nStyle::Builder to resolve arguments.\n\nArguments are now computed directly against the calling element, so first-valid() over the argument and\nthe default becomes a plain loop instead of a synthesized -internal-first-valid() token stream that had\nto be substituted a second time.\n\nThe hypothetical element the body is applied to now inherits a font, since font-relative units resolve\nagainst the element being styled rather than the parent style.\n\nA default can reference an earlier parameter, so parameters are tracked while they resolve. They are all\nseeded first, so referencing a later one gives the guaranteed-invalid value rather than the calling\nelement's property of that name. A \u003cdashed-function\u003e in a default is looked up in the scope the function\nwas defined in.\n\nTests: imported/w3c/web-platform-tests/css/css-mixins/function-definition-scope.html\n imported/w3c/web-platform-tests/css/css-mixins/function-parameter-scoping.html\n imported/w3c/web-platform-tests/css/css-mixins/function-relative-units.html\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-definition-scope-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-definition-scope.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-parameter-scoping-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-parameter-scoping.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-relative-units-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-relative-units.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-in-custom-function.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-in-custom-function.tentative.html:\n* Source/WebCore/style/StyleBuilder.cpp:\n(WebCore::Style::Builder::resolveCustomPropertyValue):\n(WebCore::Style::Builder::computeCustomPropertyValueForSyntax):\n* Source/WebCore/style/StyleBuilder.h:\n* Source/WebCore/style/StyleSubstitutionResolver.cpp:\n(WebCore::Style::SubstitutionResolver::propertyValueForVariableName):\n(WebCore::Style::SubstitutionResolver::resolveAndRegisterDashedFunctionArguments):\n(WebCore::Style::SubstitutionResolver::substituteDashedFunction):\n(WebCore::Style::createFirstValidVariableData): Deleted.\n* Source/WebCore/style/StyleSubstitutionResolver.h:\n\nCanonical link: https://commits.webkit.org/320022@main", "email": "antti@apple.com", "hash": "3b492a1ce76278e13f709737c5606545de35d189", "subject": "[css-mixins-1] Registered function arguments should evaluate in calling context" }, "320023@main": { "author": "Tim Nguyen", "avatar": "https://www.gravatar.com/avatar/208c05ac2decdf818a4a08ada568328e?d=identicon\u0026s=64", "cl": "320023@main", "clUrl": "https://commits.webkit.org/320023@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=27545\nrdar://94415937\n\nReviewed by Alan Baradlay.\n\nAdd support for the \u003cstring\u003e value of text-overflow, alongside the existing clip and ellipsis\nkeywords, per the css-overflow-4 spec. text-overflow now mirrors block-ellipsis's representation:\nStyle::TextOverflow is a variant-like type holding either the clip/ellipsis keywords or a custom\nstring, replacing the old boolean TextOverflow enum.\n\nRendering was updated so InlineDisplayLineBuilder::applyEllipsisIfNeeded reads the custom string\nfrom style when truncating overflowing inline content, the same way it already does for\nblock-ellipsis. The generated ellipsis TextRun now also carries the line's actual base direction\ninstead of defaulting to LTR, so a custom ellipsis string composed of mixed-direction characters is\nbidi-resolved against the correct paragraph direction (matters for RTL paragraphs and\nunicode-bidi: plaintext content whose resolved direction differs from the dir attribute).\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/text-overflow-computed-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/text-overflow-valid-expected.txt:\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/css/CSSProperties.json:\n* Source/WebCore/html/HTMLInputElement.cpp:\n(WebCore::HTMLInputElement::shouldTruncateText const):\n(WebCore::HTMLInputElement::invalidateStyleOnFocusChangeIfNeeded):\n(WebCore::HTMLInputElement::createInnerTextStyle):\n* Source/WebCore/html/shadow/TextControlInnerElements.cpp:\n(WebCore::TextControlInnerElement::resolveCustomStyle):\n(WebCore::TextControlPlaceholderElement::resolveCustomStyle):\n* Source/WebCore/layout/formattingContexts/inline/InlineFormattingUtils.cpp:\n(WebCore::Layout::InlineFormattingUtils::lineEndingTruncationPolicy):\n* Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayLineBuilder.cpp:\n(WebCore::Layout::InlineDisplayLineBuilder::applyEllipsisIfNeeded):\n* Source/WebCore/layout/integration/LayoutIntegrationBoxTreeUpdater.cpp:\n(WebCore::LayoutIntegration::BoxTreeUpdater::adjustStyleIfNeeded):\n* Source/WebCore/layout/integration/inline/InlineIteratorLineBoxModernPath.h:\n(WebCore::InlineIterator::LineBoxIteratorModernPath::ellipsisText const):\n* Source/WebCore/rendering/HitTestResult.cpp:\n(WebCore::HitTestResult::innerTextIfTruncated const):\n* Source/WebCore/rendering/TextAutoSizing.cpp:\n(WebCore::TextAutoSizingHashTranslator::hash):\n* Source/WebCore/rendering/style/RenderStyleConstants.cpp:\n* Source/WebCore/rendering/style/RenderStyleConstants.h:\n* Source/WebCore/style/computed/StyleComputedStyleBase.h:\n* Source/WebCore/style/computed/data/StyleNonInheritedMiscData.cpp:\n(WebCore::Style::NonInheritedMiscData::NonInheritedMiscData):\n(WebCore::Style::NonInheritedMiscData::operator== const):\n(WebCore::Style::NonInheritedMiscData::dumpDifferences const):\n* Source/WebCore/style/computed/data/StyleNonInheritedMiscData.h:\n* Source/WebCore/style/values/overflow/StyleTextOverflow.cpp: Added.\n(WebCore::Style::CSSValueConversion\u003cTextOverflow\u003e::operator):\n* Source/WebCore/style/values/overflow/StyleTextOverflow.h: Added.\n(WebCore::Style::TextOverflow::TextOverflow):\n(WebCore::Style::TextOverflow::isClip const):\n(WebCore::Style::TextOverflow::isEllipsis const):\n(WebCore::Style::TextOverflow::isString const):\n(WebCore::Style::TextOverflow::switchOn const):\n* Source/WebCore/style/values/primitives/StyleKeyword+Mappings.h:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-typed-om/the-stylepropertymap/properties/text-overflow-expected.txt:\n\nCanonical link: https://commits.webkit.org/320023@main", "email": "ntim@apple.com", "hash": "2257a2c9dda1a6fb73c4fe4a93fb7936374020bf", "subject": "[css-overflow-4] Support `text-overflow: \u003cstring\u003e`" }, "320025@main": { "author": "Mark Lam", "avatar": "https://www.gravatar.com/avatar/87a4219a10aeda88757492c63da746de?d=identicon\u0026s=64", "cl": "320025@main", "clUrl": "https://commits.webkit.org/320025@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321334\nrdar://184365506\n\nReviewed by Elliott Williams and Dan Hecht.\n\nMya (pronounced like Maya) is a new command line tool for examining the JSC and\nWebKit memory use in a running process. It attaches to a target by PID and captures\nsnapshots of its memory (read-only Mach corpses of the process), and then enables\nqueries on these snapshots via a REPL.\n\nHere is an example user work flow:\n\n # mya --help // Prints help text and exit.\n\n # mya --pid 12345 // Attach to the process, and take a snapshot.\n Attached to 12345\n Captured Snapshot #1 of 12345\n\n \u003e\u003e\u003e snapshot list // Lists all existing snapshots.\n #1: pid 12345 ... // Only one so far.\n\n \u003e\u003e\u003e snapshot // Take another snapshot, and switch to it.\n Captured Snapshot #2 of 12345 // Capture and switch to snapshot 2.\n\n \u003e\u003e\u003e status // Shows current pid and snapshot being examined.\n Using snapshot 2 of pid 12345 // The snapshot command above switched us.\n\n \u003e\u003e\u003e snapshot --pid 23456\n Attached to 23456 // Attach and switch to this second process.\n Captured Snapshot #3 of 23456 // Capture and switch to snapshot 3.\n\n \u003e\u003e\u003e snapshot list // Lists all existing snapshots.\n #1: pid 12345 ...\n #2: pid 12345 ...\n #3: pid 23456 ...\n\n \u003e\u003e\u003e status // Shows current pid and snapshot being examined.\n Using snapshot 2 of pid 23456 // Note: the snapshot command above switched us.\n\n \u003e\u003e\u003e detach // Detach from the current process.\n Detached from 23456\n\n \u003e\u003e\u003e snapshot // Fails. No attached process.\n Unable to capture snapshot. Not attached to any process. Use `attach` command or specify `--pid` argument for the snapshot command.\n\n \u003e\u003e snapshot info 1 // Show info on snapshot 1.\n ...\n\n \u003e\u003e\u003e snapshot delete 2 // Delete snapshot 2.\n ...\n\n \u003e\u003e\u003e snapshot diff 1 3 // Diff between snapshots 1 and 3. Not yet implemented.\n ...\n\n \u003e\u003e snapshot 1 // Select snapshot 1 for analysis.\n\n \u003e\u003e\u003e thread list // Prints info on all thread in the current snapshot.\n Threads in snapshot #1 (pid 12345):\n INDEX TID STATE USER(ms) SYS(ms) SP STACK SIZE PAGES RESIDENT DIRTY NAME\n 1 0x12278c6 halted 23645.003 2937.065 0x16b7361e0 0x16af3c000-0x16b738000 7.98 MB 511 7 7 -\n 2 0x12278c7 halted 56.147 23.816 0x167386aa0 0x167304000-0x16738c000 544 KB 34 1 1 WebCore: ServiceWorker\n 3 0x12278c8 halted 0.211 0.472 0x105986b30 0x105904000-0x10598c000 544 KB 34 1 1 -\n\n \u003e\u003e\u003e p/x \u0026g_config // Prints the address of the g_config record.\n \u0026g_config = 0x1f48e0000\n\nThe corpse management and analysis machinery lives in libJavaScriptCoreTools, a new\nstatic library built alongside the JavaScriptCore framework. Clients that need to do\nthis type of snapshot analysis can link against it. By design, the corpse management\nand analysis code is not linked and packaged with the JavaScriptCore framework by\ndefault because they are not needed there.\n\nlibJavaScriptCoreTools provides abstractions like Address, Process, Snapshot, Thread,\nRegion, Symbol, etc. for inspecting and analyzing such WebKit and JSC corpses. Corpse\nAddresses are numbered based on the target process' address space mapping, not the\nclient tool like mya. Currently, libJavaScriptCoreTools copies over memory from the\ncorpse for inspection as an initial bootstrap implementation. In subsequent patches,\nwe will introduce a Memory Manager that will make reading corpse memory more efficient.\n\nSymbol lookup resolves a name to an address by walking the dyld exports trie of\neach image loaded in the corpse. That needs no cooperation from the target and no\ndebug information, but it only finds exported symbols.\n\nEverything read out of a corpse is untrusted input: a corrupted target could otherwise\nsteer mya into unbounded work or bad reads. The parsing paths therefore bound the work\nthey will do and reject implausible sizes, counts, and offsets rather than trusting what\nthe target claims.\n\nmya and libJavaScriptCoreTools are only for Apple platforms, since they are built on\nMach task APIs, which are only available on Apple platforms.\n\nAlso, it is not a goal to support analysis of Rosetta processes. Some subset of\nfunctionality may still work, but only on a WYSIWYG basis.\n\nTests: Source/JavaScriptCore/corpse/tests/\n\ntestLibJSCTools is a new test tool for libJavaScriptCoreTools, built with the other\nJSC test tools and run by:\n\n run-javascriptcore-tests --testlibjsctools\n\nA task may take a corpse of itself with no entitlement and no privilege, and the\ntests are built on that: they snapshot the running test process and check what the\ncorpse reports against what that process already knows about itself. A symbol\nresolved out of the corpse, for instance, has to land on the address this process\nuses for it. The suites are:\n\n ByteParser ULEB128 and C string decoding, including the truncated and out of\n range encodings that untrusted data can hold.\n ExportsTrie terminal and edge decoding for every export kind and flag, the\n malformed tries that a corrupt corpse can present, and that a\n cyclic trie still terminates. Also fuzzed from a fixed seed on\n every run, under a watchdog, because the decoder's contract is to\n bound its work on any input at all.\n Address null, ordering, arithmetic, and the ptrauth and top-byte stripping\n that a pointer out of a corpse needs.\n Process attach, detach, re-attach, a pid that has exited, and a target\n running under Rosetta translation.\n Snapshot validity, identifier assignment, and that repeatedly snapshotting\n leaves no Mach port behind.\n Region a mapping of known size and residency, an unmapped hole, and an\n address inside the shared cache submap.\n Thread thread names and their truncation, and that a thread's stack\n pointer lies inside the stack region reported for it.\n Symbol g_config, malloc and environ resolved out of a corpse of this\n process, each compared against the address it has locally, plus\n the names that are deliberately not found: a symbol hidden from\n the linker, and a name given with its underscore already attached.\n\nFor the build, libJavaScriptCoreTools, mya, and testLibJSCTools are deliberately put in\njsc's dependency closure in the JavaScriptCore_executables XBS project. This is so that\nthey can piggy-back off of jsc shell's build phase i.e. only trigger a build after\nJavaScriptCore.framework is done building, and trigger an install like the jsc shell is\n(albeit to their respective install destinations, which may defer).\n\nUpdate: fixes simulators and MacCatalyst builds to actually not install mya, and not\nbuild libJavaScriptCore. A stubbed version of testLibJSCTools is still being build and\ninstalled. This is to keep run-javascriptcore-tests from failing due to a missing\ntestLibJSCTools executable.\n\n* Source/JavaScriptCore/CMakeLists.txt:\n* Source/JavaScriptCore/Configurations/Mya.xcconfig: Added.\n* Source/JavaScriptCore/Configurations/TestLibJSCTools.xcconfig: Added.\n* Source/JavaScriptCore/Configurations/libJavaScriptCoreTools.xcconfig: Added.\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/Scripts/process-entitlements.sh:\n* Source/JavaScriptCore/corpse/CMakeLists.txt: Added.\n* Source/JavaScriptCore/corpse/CorpseAddress.h: Added.\n* Source/JavaScriptCore/corpse/CorpseByteParser.cpp: Added.\n* Source/JavaScriptCore/corpse/CorpseByteParser.h: Added.\n* Source/JavaScriptCore/corpse/CorpseClient.cpp: Added.\n* Source/JavaScriptCore/corpse/CorpseClient.h: Added.\n* Source/JavaScriptCore/corpse/CorpseError.cpp: Added.\n* Source/JavaScriptCore/corpse/CorpseError.h: Added.\n* Source/JavaScriptCore/corpse/CorpseExportsTrie.cpp: Added.\n* Source/JavaScriptCore/corpse/CorpseExportsTrie.h: Added.\n* Source/JavaScriptCore/corpse/CorpseProcess.cpp: Added.\n* Source/JavaScriptCore/corpse/CorpseProcess.h: Added.\n* Source/JavaScriptCore/corpse/CorpseRegion.cpp: Added.\n* Source/JavaScriptCore/corpse/CorpseRegion.h: Added.\n* Source/JavaScriptCore/corpse/CorpseSnapshot.cpp: Added.\n* Source/JavaScriptCore/corpse/CorpseSnapshot.h: Added.\n* Source/JavaScriptCore/corpse/CorpseSymbol.cpp: Added.\n* Source/JavaScriptCore/corpse/CorpseSymbol.h: Added.\n* Source/JavaScriptCore/corpse/CorpseThread.cpp: Added.\n* Source/JavaScriptCore/corpse/CorpseThread.h: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseAddressTest.cpp: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseAddressTest.h: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseByteParserTest.cpp: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseByteParserTest.h: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseExportsTrieTest.cpp: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseExportsTrieTest.h: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseProcessTest.cpp: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseProcessTest.h: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseRegionTest.cpp: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseRegionTest.h: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseSnapshotTest.cpp: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseSnapshotTest.h: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseSymbolTest.cpp: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseSymbolTest.h: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseThreadTest.cpp: Added.\n* Source/JavaScriptCore/corpse/tests/CorpseThreadTest.h: Added.\n* Source/JavaScriptCore/corpse/tests/LibJSCToolsTestUtilities.cpp: Added.\n* Source/JavaScriptCore/corpse/tests/LibJSCToolsTestUtilities.h: Added.\n* Source/JavaScriptCore/corpse/tests/testLibJSCTools.cpp: Added.\n* Source/JavaScriptCore/mya/mya.cpp: Added.\n* Source/JavaScriptCore/shell/CMakeLists.txt:\n* Source/JavaScriptCore/shell/PlatformCocoa.cmake:\n* Tools/CISupport/ews-build/steps.py:\n* Tools/Scripts/run-javascriptcore-tests:\n* Tools/Scripts/webkitperl/BuildSubproject.pm:\n* Tools/Scripts/webkitpy/common/config/ports.py:\n* Tools/Scripts/webkitpy/common/config/ports_unittest.py:\n\nCanonical link: https://commits.webkit.org/320025@main", "email": "mark.lam@apple.com", "hash": "96b67294979146c46c763f8c41a15883f5384f79", "subject": "[Re-landing] Introducing Mya, a MemorY Analyzer, and libJavaScriptCoreTools." }, "320026@main": { "author": "Antoine Quint", "avatar": "https://www.gravatar.com/avatar/9b3ef1e754f8d994f21ff67c660cbbe6?d=identicon\u0026s=64", "cl": "320026@main", "clUrl": "https://commits.webkit.org/320026@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322739\nrdar://186008235\n\nReviewed by Anne van Kesteren.\n\nTrack the style scope when parsing the `animation-timeline`, `scroll-timeline-name` and\n`view-timeline-name` properties such that in a future patch we may correctly look up\nprogress-based timelines across style scopes and address bug 322013.\n\nWe simply change `Style::CustomIdent` to `Style::ScopedName` in `Style::SingleAnimationTimeline`\nand `Style::ProgressTimelineName` and additionally switch from `AtomString` to `Style::ScopedName`\nto represent a progress-based timeline's name.\n\n* Source/WebCore/animation/CSSAnimation.cpp:\n(WebCore::CSSAnimation::syncStyleOriginatedTimeline):\n* Source/WebCore/animation/ScrollTimeline.cpp:\n(WebCore::ScrollTimeline::create):\n(WebCore::ScrollTimeline::createInactiveStyleOriginatedTimeline):\n(WebCore::ScrollTimeline::ScrollTimeline):\n(WebCore::ScrollTimeline::matchesAnonymousScrollFunctionForSource const):\n* Source/WebCore/animation/ScrollTimeline.h:\n(WebCore::ScrollTimeline::setName):\n* Source/WebCore/animation/StyleOriginatedTimelinesController.cpp:\n(WebCore::StyleOriginatedTimelinesController::registerNamedScrollTimeline):\n(WebCore::StyleOriginatedTimelinesController::updateCSSAnimationsAssociatedWithNamedTimeline):\n(WebCore::StyleOriginatedTimelinesController::registerNamedViewTimeline):\n(WebCore::StyleOriginatedTimelinesController::attachAnimation):\n(WebCore::StyleOriginatedTimelinesController::updateNamedTimelineMapForTimelineScope):\n* Source/WebCore/animation/StyleOriginatedTimelinesController.h:\n* Source/WebCore/animation/ViewTimeline.cpp:\n(WebCore::ViewTimeline::create):\n(WebCore::ViewTimeline::ViewTimeline):\n(WebCore::ViewTimeline::matchesAnonymousViewFunctionForSubject const):\n* Source/WebCore/animation/ViewTimeline.h:\n* Source/WebCore/style/Styleable.cpp:\n(WebCore::Styleable::updateCSSScrollTimelines const):\n(WebCore::Styleable::updateCSSViewTimelines const):\n* Source/WebCore/style/values/animations/StyleSingleAnimationTimeline.cpp:\n(WebCore::Style::CSSValueConversion\u003cSingleAnimationTimeline\u003e::operator):\n* Source/WebCore/style/values/animations/StyleSingleAnimationTimeline.h:\n(WebCore::Style::SingleAnimationTimeline::SingleAnimationTimeline):\n(WebCore::Style::SingleAnimationTimeline::isScopedName const):\n(WebCore::Style::SingleAnimationTimeline::tryScopedName const):\n(WebCore::Style::SingleAnimationTimeline::isCustomIdent const): Deleted.\n(WebCore::Style::SingleAnimationTimeline::tryCustomIdent const): Deleted.\n* Source/WebCore/style/values/scroll-animations/StyleProgressTimelineName.h:\n\nCanonical link: https://commits.webkit.org/320026@main", "email": "graouts@webkit.org", "hash": "f54d0579631ecf491974f33c46fcae9e47cee8bc", "subject": "[scroll-animations] keep track of style scope for `animation-timeline` and `{scroll|view}-timeline-name` properties" }, "320027@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "320027@main", "clUrl": "https://commits.webkit.org/320027@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322526\n\nReviewed by Yusuke Suzuki.\n\nBBQ array.new_default of v128 still called operationWasmArrayNewEmpty.\nPin a zero vector and use the existing store loop.\n\n* Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp:\n\nCanonical link: https://commits.webkit.org/320027@main", "email": "chi187@gmail.com", "hash": "5f47279d0d16d660d14660d902f81cf04877eca5", "subject": "[JSC][Wasm] Inline BBQ array.new_default for v128" }, "320028@main": { "author": "Diego Pino Garcia", "avatar": "https://www.gravatar.com/avatar/e8cce88637f1a6e79155e8371e24b2e8?d=identicon\u0026s=64", "cl": "320028@main", "clUrl": "https://commits.webkit.org/320028@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=206001\n\nReviewed by Carlos Garcia Campos.\n\nThe test fails because two divs of expected same size are actually\ndifferent. One of the divs uses 'writing-mode: vertical-rl' with a\ncustom 'OpenType @font-face' and 'width: 5ch'. This information is\nrelevant because GLIB ports always build with OPENTYPE_VERTICAL enabled.\n\nA Font's constructor calls 'platformGlyphInit', which computes the\nfont's zero-glyph width (used to resolve the CSS 'ch' unit) via\n'FontInlines::widthForGlyph'. That method decides between the glyph's\nhorizontal and vertical advance based on whether 'm_verticalData' is\nset, but at that point in construction it isn't set yet (it's only\ninitialized further down in the constructor), so the width is always\ncomputed as horizontal, even for a genuinely vertical font.\n\nSimply moving initialization of 'm_verticalData' earlier doesn't work,\nas it creates side effects in a few tests that are legitimately passing\n(e.g fast/writing-mode/text-orientation-basic.html). Instead, this change\nleaves 'm_verticalData' initialization where it is and performs an\nindependent 'OpenTypeVerticalData' lookup inside 'platformGlyphInit', with\nthe goal of computing 'zero-glyph''s width correctly.\n\nAs a result of this change, a few 'ch-units-vrl-XXX' tests which were wrongly\npassing before are now failing.\n\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebCore/platform/graphics/Font.cpp:\n(WebCore::m_shouldNotBeUsedForArabic):\n(WebCore::Font::platformGlyphInit):\n\nCanonical link: https://commits.webkit.org/320028@main", "email": "dpino@igalia.com", "hash": "ff8fd01e634aff2e9a52c7b8a280f4f74cf60df4", "subject": "[GLIB] imported/w3c/web-platform-tests/css/css-values/ch-unit-017.html is failing" }, "320029@main": { "author": "Nikolas Zimmermann", "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64", "cl": "320029@main", "clUrl": "https://commits.webkit.org/320029@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322589\n\nReviewed by Carlos Garcia Campos.\n\nwebkit-sysprof analyze reports 'theoretical FPS', the number of frames the\nengine produced over the analyzed duration. That says nothing about how long\none frame took, nor where its time went.\n\nAdd a 'frame cycle' reconstruction: a cycle runs from one\nLayerTreeHostRenderingUpdate of a process to the next, so the frame rate is\n1 / cycle duration, and it splits into the rendering update, waiting for\ncompositing, compositing and idle. The report gives the phase medians, how\nmuch of the analyzed duration the cycles cover, and the implied FPS while\nrendering, so a rate falling short can be told from a phase.\n\nAlso add --explain, off by default, which prints what the report does and does\nnot measure, and reject a timespan of no length rather than reporting zeroes\nfor it.\n\n* Tools/Scripts/webkit-sysprof/README.md:\n* Tools/Scripts/webkit-sysprof/pyproject.toml:\n* Tools/Scripts/webkit-sysprof/webkitsysprof/__main__.py:\n(_add_subcommand):\n(build_parser):\n(main):\n* Tools/Scripts/webkit-sysprof/webkitsysprof/analyze/__init__.py:\n(_frame_rendering_reason):\n(_counted):\n(analyze):\n(_calculate_statistics):\n(_prepare_report):\n(_prepare_rendering_report):\n(_covered_duration):\n(_cycle_in_vblank_intervals):\n(_prepare_frame_cycle_report):\n(_calculate_frame_compositions_per_vblank):\n(_calculate_vblanks_per_rendering_update):\n(_render_text_report):\n(_analyzed_duration_sec):\n(_theoretical_fps_explanation):\n(_refresh_rate_explanation):\n(_percentile_strings):\n(_analyzed_cycles):\n(_render_frame_cycle_numbers):\n(_statistics_to_strings):\n(format_statistic):\n(_sysprof_data_to_high_level_representation): Deleted.\n(_statistics_to_strings.format_statistic): Deleted.\n* Tools/Scripts/webkit-sysprof/webkitsysprof/analyze/explanations.py: Added.\n* Tools/Scripts/webkit-sysprof/webkitsysprof/cycles/__init__.py: Added.\n(_MarkIndex):\n(_MarkIndex.__init__):\n(_MarkIndex.spans_within):\n(_MarkIndex.last_end_of_marks_beginning_within):\n(_marks_beginning_within):\n(within):\n(_compositing_indices_by_process):\n(_compositing_spans):\n(_own_compositing_end):\n(calculate_frame_cycles):\n(_cycles_of_one_process):\n* Tools/Scripts/webkit-sysprof/webkitsysprof/dump/__init__.py:\n(dump):\n(_marks_to_rows):\n* Tools/Scripts/webkit-sysprof/webkitsysprof/histogram/__init__.py:\n(delta_histogram):\n(_delta_times_ms):\n(_calculate_optimal_bins):\n(_plot_delta_time_distribution):\n(_calculate_delta_times_ms): Deleted.\n* Tools/Scripts/webkit-sysprof/webkitsysprof/parser/direct_parser.py:\n* Tools/Scripts/webkit-sysprof/webkitsysprof/summary/__init__.py:\n(_print_document_summary):\n* Tools/Scripts/webkit-sysprof/webkitsysprof/tests/frame_cycles_unittest.py: Added.\n(frame_cycle_report):\n(FrameCyclesTest):\n(FrameCyclesTest.test_phases_partition_every_resolved_cycle):\n(FrameCyclesTest.test_composition_ending_after_the_cycle_is_reported_as_an_overrun):\n(FrameCyclesTest.test_a_cycle_after_an_overrunning_composition_still_resolves):\n(FrameCyclesTest.test_cycles_without_compositing_marks_are_counted_but_not_analyzed):\n(FrameCyclesTest.test_the_gap_between_two_rendering_periods_is_reported_as_a_long_cycle):\n(FrameCyclesTest.test_the_compositing_mark_name_is_resolved_per_cycle):\n(FrameCyclesTest.test_compositing_is_over_when_the_last_compositing_mark_is):\n(FrameCyclesTest.test_compositing_overlapping_the_rendering_update_still_counts):\n(FrameCyclesTest.test_a_cycle_reaching_past_the_timespan_is_left_out_of_it):\n(FrameCyclesTest.test_a_capture_without_compositing_marks_keeps_its_cycles):\n(FrameCyclesTest.test_coverage_is_the_share_of_the_window_the_analyzed_cycles_took):\n(FrameCyclesTest.test_a_single_cycle_reports_no_percentiles_rather_than_failing):\n(FrameCyclesTest.test_no_cycles_at_all):\n(FrameCyclesTest.test_cycles_per_vblank_interval_is_unknown_without_vblank_marks):\n(FrameCyclesTest.test_cycles_are_restricted_to_the_ones_lying_within_the_timespan):\n(FrameCyclesTest.test_compositing_running_inside_the_rendering_update_still_resolves):\n(FrameCyclesTest.test_a_cycle_never_runs_between_two_processes):\n(FrameCyclesTest.test_a_cycle_spent_entirely_on_an_earlier_composition_is_analyzed):\n(FrameCyclesTest.test_coverage_merges_the_cycles_of_two_processes):\n(FrameCyclesTest.test_a_composition_begun_before_the_window_is_still_seen_in_it):\n(FrameCyclesTest.test_a_stall_is_seen_past_a_shorter_mark_of_the_same_name):\n(FrameCyclesTest.test_a_capture_of_negative_length_reports_no_rate):\n(FrameCyclesTest.test_no_cycles_says_so_rather_than_blaming_a_zero_median):\n(FrameCyclesTest.test_every_overrunning_composition_of_a_stall_is_counted):\n(FrameCyclesTest.test_a_cycle_running_a_sliver_of_an_inherited_composition_is_measured):\n(FrameCyclesTest.test_a_cycle_running_only_an_inherited_composition_is_measured):\n(FrameCyclesTest.test_a_cycle_composited_beside_its_update_only_is_measured_as_zero):\n(FrameCyclesTest.test_a_mark_ending_before_the_capture_keeps_its_own_end):\n(FrameCyclesTest.test_a_gap_between_two_compositions_is_a_wait_not_compositing):\n(FrameCyclesTest.test_two_renderers_of_one_kind_are_told_apart_by_their_process):\n(FrameCyclesTest.test_two_updates_at_one_instant_belong_to_two_processes):\n(FrameCyclesTest.test_a_report_without_a_rate_prints_no_rate):\n(FrameCyclesTest.test_a_steady_slow_capture_keeps_its_cycles):\n(FrameCyclesTest.test_the_composition_overrun_median_describes_the_overrunning_cycles):\n(FrameCyclesTest.test_an_unknown_refresh_rate_is_not_reported_as_zero):\n(FrameCyclesTest.test_a_zero_median_vblank_interval_is_not_reported_as_shared_timestamps):\n* Tools/Scripts/webkit-sysprof/webkitsysprof/tests/helpers.py: Added.\n(mark):\n(sysprof_data):\n(approx):\n(approx.__init__):\n(approx.__eq__):\n(approx.__repr__):\n(SysprofTestCase):\n(SysprofTestCase.setUp):\n(SysprofTestCase.stdout):\n* Tools/Scripts/webkit-sysprof/webkitsysprof/tests/subcommands_unittest.py:\n(SubcommandsTest):\n(SubcommandsTest.test_summary):\n(SubcommandsTest.test_dump_marks_csv):\n(SubcommandsTest.test_dump_counters_csv):\n(SubcommandsTest.test_dump_marks_json):\n(SubcommandsTest.test_dump_counters_json):\n(SubcommandsTest.test_analyze_text):\n(SubcommandsTest.test_analyze_text_with_explanations):\n(SubcommandsTest.test_analyze_json_percentiles_stay_within_the_data_range):\n(SubcommandsTest.test_analyze_json):\n(SubcommandsTest.test_analyze_json_frame_cycle_phases_add_up_to_cycle_duration):\n(SubcommandsTest.test_analyze_json_statistics_cover_all_relevant_marks):\n(SubcommandsTest.test_analyze_with_a_timespan_holding_vblanks_but_no_rendering_update):\n(SubcommandsTest.test_analyze_json_leaves_out_a_cycle_reaching_past_the_timespan):\n(SubcommandsTest.test_analyze_resolves_a_cycle_whose_compositing_marks_trimming_drops):\n(SubcommandsTest.test_explain_is_rejected_for_the_json_format_by_the_module_api):\n(SubcommandsTest.test_analyze_rejects_a_timespan_it_cannot_honour):\n(SubcommandsTest.test_analyze_clamps_a_timespan_reaching_past_the_capture):\n(SubcommandsTest.test_vblanks_per_rendering_update_does_not_depend_on_the_mark_order):\n(SubcommandsTest.test_a_capture_of_no_length_reports_no_rate):\n(SubcommandsTest.test_delta_histogram_deltas_come_from_the_requested_mark):\n(SubcommandsTest.test_delta_histogram_honours_the_timespan):\n(SubcommandsTest.test_analyze_json_counts_every_vblank_interval_of_the_timespan):\n(SubcommandsTest.test_frame_compositions_outside_the_vblank_range_are_left_out):\n(SubcommandsTest.test_frame_rendering_reasons_bucket_a_frame_that_named_none):\n(SubcommandsTest.test_frame_rendering_reasons_bucket_a_frame_that_named_none.did_render_frame):\n(SubcommandsTest.test_explain_reaches_the_report_through_the_command_line):\n(SubcommandsTest.test_a_capture_of_its_own_broken_timespan_is_no_usage_error):\n(SubcommandsTest.test_statistics_are_matched_by_wording_rather_than_word_position):\n(SubcommandsTest.test_explaining_an_empty_frame_cycle_section_still_explains_it):\n(SubcommandsTest.test_a_broken_capture_is_no_usage_error_even_with_a_timespan):\n(SubcommandsTest.test_a_window_meeting_the_capture_at_one_point_is_rejected):\n(SubcommandsTest.test_json_percentiles_keep_the_fiftieth):\n(SubcommandsTest.test_delta_histogram_keeps_the_processes_apart):\n(SubcommandsTest.test_composition_overrun_says_nothing_where_nothing_was_analyzed):\n(SubcommandsTest.test_an_update_ending_on_the_first_refresh_spans_it):\n(SubcommandsTest.test_refreshes_that_composited_nothing_are_samples_of_nothing):\n(SubcommandsTest.test_dump_csv_carries_every_column_of_a_row):\n(SubcommandsTest.test_a_window_without_refreshes_keeps_the_capture_interval):\n(SubcommandsTest.test_analyze_with_custom_timespan):\n(SubcommandsTest.test_analyze_with_custom_timespan_begin):\n(SubcommandsTest.test_analyze_with_custom_timespan_end):\n(_capture_stdout): Deleted.\n* Tools/Scripts/webkit-sysprof/webkitsysprof/tests/utils_unittest.py: Added.\n(UtilsTest):\n(UtilsTest.test_spans_are_merged_where_they_overlap_or_touch):\n(UtilsTest.test_a_timespan_bound_is_digits_and_nothing_else):\n(UtilsTest.test_percentiles_outside_the_range_of_the_quantiles_are_rejected):\n(UtilsTest.test_a_bare_bound_is_the_begin_of_the_timespan):\n(UtilsTest.test_vblank_intervals_do_not_depend_on_the_order_of_the_marks):\n(UtilsTest.test_reshaping_the_same_parsed_data_twice_yields_the_same_result):\n* Tools/Scripts/webkit-sysprof/webkitsysprof/utils/__init__.py:\n(msec_to_nsec):\n(UsageError):\n(mark_begin):\n(parse_timespan_argument):\n(parse_timespan_argument.parse_bound):\n(sysprof_data_with_marks_by_name):\n(check_timespan_holds_data):\n(trim_marks_by_name_to_timespan):\n(mark_in_timespan):\n(merged_spans):\n(sample_statistics):\n(percentiles):\n(mark_pid):\n(marks_by_process):\n(marks_in_time_order):\n(intervals_between_marks):\n(display_refreshes):\n(median_vblank_interval):\n(trim_sysprof_data_to_timespan): Deleted.\n\nCanonical link: https://commits.webkit.org/320029@main", "email": "nzimmermann@igalia.com", "hash": "5c1c95db5e0ea336071ae634567cda9aaa80c181", "subject": "[webkit-sysprof] Add a frame cycle breakdown to analyze" }, "320030@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "320030@main", "clUrl": "https://commits.webkit.org/320030@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322699\n\nReviewed by Ryosuke Niwa.\n\nWebEvent subclassed CanMakeThreadSafeCheckedPtr with CheckedPtrDeleteCheckException::Yes,\nbecause CanMakeCheckedPtr only works as intended for heap-allocated objects: WebEvent and its\nsubclasses were routinely stack-allocated, so operator delete never ran,\nsetDidBeginCheckedPtrDeletion() was never called, and the delete check in\n~CanMakeCheckedPtrBase() could not hold.\n\nMake the hierarchy always heap-allocated instead. WebEvent now derives from\nThreadSafeRefCounted\u003cWebEvent\u003e and each concrete class is created through a static create()\nreturning Ref\u003c\u003e. CanMakeThreadSafeCheckedPtr, WTF_OVERRIDE_DELETE_FOR_CHECKED_PTR and the\nCheckedPtrDeleteCheckException::Yes exception are all removed from WebEvent. Refcounting is\nthread-safe because EventDispatcher handles wheel and touch events on the IPC background queue\nbefore hopping to the main thread, which is also why the class opted into the thread-safe\nchecked-ptr variant previously.\n\nEach subclass previously took a WebEvent\u0026\u0026 and move-constructed its base, which forced callers\nto materialize a stack WebEvent - precisely what the delete check cannot tolerate, and\nimpossible once the base is refcounted, since ThreadSafeRefCountedBase holds a\nstd::atomic\u003cunsigned\u003e and so has no copy or move constructor. That pattern is replaced by plain\ndata structs: WebEventData for the fields common to every event, plus a per-class\nWebMouseEventData / WebKeyboardEventData / WebWheelEventData / WebTouchEventData /\nWebGestureEventData. Each event class stores exactly one of these and its accessors delegate to\nit.\n\nThe per-port WebEventFactory functions returned event values, and each NativeWebXEvent\nconstructor sliced its base from one. They now return a WebXEventInit (a WebEventData plus a\nWebXEventData), which both WebXEvent::create() and NativeWebXEvent::create() consume, so a\nnative event is still only parsed once.\n\nFields that no constructor on a given platform ever set are no longer stored, and their\naccessors return the constant instead: pointerId/pointerType on MAC, unmodifiedText/macCharCode/\nisSystemKey on GTK and WPE, and directionInvertedFromDevice/momentumEndType off COCOA. This is\nwhat makes \"the data struct is exactly the serialized fields\" true on every platform.\n\nThe IPC wire format is unchanged. Each event class is [RefCounted] in WebEvent.serialization.in\nwith two members, eventData() and xData(), whose fields are declared in the same order as\nbefore, so the same values are encoded in the same sequence. Predicted mouse events are\ndeliberately still not serialized - WebMouseEvent keeps them outside its data struct - because\nputting them on the wire would switch on a currently dormant PointerEvent.getPredictedEvents()\npath for mouse. The data structs are [CustomHeader] since they live in their event class's\nheader rather than one named after themselves.\n\nThree sites copied an event and then mutated the copy, which was safe only while events had\nvalue semantics: EventDispatcher coalescing touch moves, WebPageProxy::sendWheelEvent capturing\nthe event before adjusting its position, and the remote-frame transform in WebPageIOS. They now\ncall an explicit copy(). WebTouchEvent::copy() is a deep copy because\ntransformToRemoteFrameCoordinates() mutates the coalesced and predicted children in place.\nRelatedly, processNextQueuedMouseEvent() appended the event into the very vector the event was\nabout to own, which as a Ref would have been a reference cycle; it now appends a copy.\n\nEvery concrete class gets its own WTF_MAKE_TZONE_ALLOCATED. Allocating subclasses through\nWebEvent's allocator would compile, but TZoneHeap's operator new only takes the fast path when\nsize == sizeof(the declaring type), so every event would have fallen through to operatorNewSlow\nand lost TZone's per-type isolation.\n\nWebWheelEvent::Granularity and ::MomentumEndType move to namespace scope as\nWebWheelEventGranularity and WebWheelEventMomentumEndType, with using aliases left in the class,\nbecause a namespace-scope WebWheelEventData cannot name enums nested inside WebWheelEvent. All\nexisting WebWheelEvent::Granularity spellings keep working.\n\nThe two remaining CheckedPtr clients become RefPtr: CurrentEvent::m_previousCurrentEvent in\nWebPage.cpp and the local in PluginView.cpp. Both are synchronous and the event is guaranteed\nlive, so an owning reference is both cheaper and safer than a checked one. The g_currentEvent\nglobal stays a raw pointer so that dispatching an event, which happens for every mouse move,\ndoes not touch a refcount.\n\n* Source/WebKit/Shared/NativeWebGestureEvent.h:\n* Source/WebKit/Shared/NativeWebKeyboardEvent.h:\n* Source/WebKit/Shared/NativeWebMouseEvent.h:\n* Source/WebKit/Shared/NativeWebTouchEvent.h:\n* Source/WebKit/Shared/NativeWebWheelEvent.h:\n* Source/WebKit/Shared/RemoteWebTouchEvent.h:\n* Source/WebKit/Shared/RemoteWebTouchEvent.serialization.in:\n* Source/WebKit/Shared/WebEvent.cpp:\n(WebKit::generateSignpostIdentifier):\n(WebKit::WebEvent::WebEvent):\n* Source/WebKit/Shared/WebEvent.h:\n(WebKit::WebEvent::type const):\n(WebKit::WebEvent::shiftKey const):\n(WebKit::WebEvent::controlKey const):\n(WebKit::WebEvent::altKey const):\n(WebKit::WebEvent::metaKey const):\n(WebKit::WebEvent::capsLockKey const):\n(WebKit::WebEvent::modifiers const):\n(WebKit::WebEvent::timestamp const):\n(WebKit::WebEvent::authorizationToken const):\n(WebKit::WebEvent::signpostIdentifier const):\n* Source/WebKit/Shared/WebEvent.serialization.in:\n* Source/WebKit/Shared/WebEventConversion.cpp:\n(WebKit::WebKit2PlatformMouseEvent::WebKit2PlatformMouseEvent):\n(WebKit::WebKit2PlatformTouchEvent::WebKit2PlatformTouchEvent):\n* Source/WebKit/Shared/WebKeyboardEvent.cpp:\n(WebKit::WebKeyboardEvent::create):\n(WebKit::WebKeyboardEvent::WebKeyboardEvent):\n* Source/WebKit/Shared/WebKeyboardEvent.h:\n(WebKit::WebKeyboardEvent::windowsVirtualKeyCode const):\n(WebKit::WebKeyboardEvent::setWindowsVirtualKeyCode):\n(WebKit::WebKeyboardEvent::nativeVirtualKeyCode const):\n(WebKit::WebKeyboardEvent::macCharCode const):\n(WebKit::WebKeyboardEvent::handledByInputMethod const):\n(WebKit::WebKeyboardEvent::isAutoRepeat const):\n(WebKit::WebKeyboardEvent::isKeypad const):\n(WebKit::WebKeyboardEvent::isSystemKey const):\n* Source/WebKit/Shared/WebMouseEvent.cpp:\n(WebKit::WebMouseEvent::create):\n(WebKit::WebMouseEvent::copy const):\n(WebKit::WebMouseEvent::WebMouseEvent):\n* Source/WebKit/Shared/WebMouseEvent.h:\n(WebKit::WebMouseEvent::button const):\n(WebKit::WebMouseEvent::buttons const):\n(WebKit::WebMouseEvent::setPosition):\n(WebKit::WebMouseEvent::deltaX const):\n(WebKit::WebMouseEvent::deltaY const):\n(WebKit::WebMouseEvent::deltaZ const):\n(WebKit::WebMouseEvent::clickCount const):\n(WebKit::WebMouseEvent::eventNumber const):\n(WebKit::WebMouseEvent::menuTypeForEvent const):\n(WebKit::WebMouseEvent::isTouchEvent const):\n(WebKit::WebMouseEvent::force const):\n(WebKit::WebMouseEvent::inputSource const):\n(WebKit::WebMouseEvent::canInitiateDrag const):\n(WebKit::WebMouseEvent::syntheticClickType const):\n(WebKit::WebMouseEvent::pointerId const):\n(WebKit::WebMouseEvent::gestureWasCancelled const):\n(WebKit::WebMouseEvent::setCoalescedEvents):\n(WebKit::WebMouseEvent::setPredictedEvents):\n(WebKit::WebMouseEvent::WebMouseEvent): Deleted.\n(WebKit::WebMouseEvent::position const): Deleted.\n(WebKit::WebMouseEvent::coalescedEvents const): Deleted.\n(WebKit::WebMouseEvent::predictedEvents const): Deleted.\n* Source/WebKit/Shared/WebTouchEvent.cpp:\n(WebKit::WebTouchEvent::create):\n(WebKit::WebTouchEvent::WebTouchEvent):\n(WebKit::WebTouchEvent::copy const):\n(WebKit::WebTouchEvent::transformToRemoteFrameCoordinates):\n* Source/WebKit/Shared/WebTouchEvent.h:\n(WebKit::WebTouchEvent::setCoalescedEvents):\n(WebKit::WebTouchEvent::setPredictedEvents):\n(WebKit::WebTouchEvent::position const):\n(WebKit::WebTouchEvent::isPotentialTap const):\n(WebKit::WebTouchEvent::isGesture const):\n(WebKit::WebTouchEvent::gestureScale const):\n(WebKit::WebTouchEvent::gestureRotation const):\n(WebKit::WebTouchEvent::canPreventNativeGestures const):\n(WebKit::WebTouchEvent::setCanPreventNativeGestures):\n(WebKit::WebTouchEvent::WebTouchEvent): Deleted.\n* Source/WebKit/Shared/WebWheelEvent.cpp:\n(WebKit::WebWheelEvent::create):\n(WebKit::WebWheelEvent::copy const):\n(WebKit::WebWheelEvent::WebWheelEvent):\n* Source/WebKit/Shared/WebWheelEvent.h:\n(WebKit::WebWheelEvent::position const):\n(WebKit::WebWheelEvent::setPosition):\n(WebKit::WebWheelEvent::globalPosition const):\n(WebKit::WebWheelEvent::delta const):\n(WebKit::WebWheelEvent::wheelTicks const):\n(WebKit::WebWheelEvent::granularity const):\n(WebKit::WebWheelEvent::directionInvertedFromDevice const):\n(WebKit::WebWheelEvent::momentumEndType const):\n(WebKit::WebWheelEvent::phase const):\n(WebKit::WebWheelEvent::momentumPhase const):\n(WebKit::WebWheelEvent::hasPreciseScrollingDeltas const):\n(WebKit::WebWheelEvent::ioHIDEventTimestamp const):\n(WebKit::WebWheelEvent::rawPlatformDelta const):\n(WebKit::WebWheelEvent::setRawPlatformDelta):\n(WebKit::WebWheelEvent::scrollCount const):\n(WebKit::WebWheelEvent::inputSource const):\n(WebKit::WebWheelEvent::momentumFastScrollMultiplier const):\n(WebKit::WebWheelEvent::setMomentumFastScrollMultiplier):\n* Source/WebKit/Shared/WebWheelEventCoalescer.cpp:\n(WebKit::WebWheelEventCoalescer::coalesce):\n(WebKit::WebWheelEventCoalescer::nextEventToDispatch):\n(WebKit::WebWheelEventCoalescer::shouldDispatchEvent):\n(WebKit::WebWheelEventCoalescer::takeOldestEventBeingProcessed):\n(WebKit::operator\u003c\u003c): Deleted.\n* Source/WebKit/Shared/WebWheelEventCoalescer.h:\n* Source/WebKit/Shared/gtk/NativeWebKeyboardEventGtk.cpp:\n(WebKit::NativeWebKeyboardEvent::create):\n(WebKit::NativeWebKeyboardEvent::NativeWebKeyboardEvent):\n(): Deleted.\n* Source/WebKit/Shared/gtk/NativeWebMouseEventGtk.cpp:\n(WebKit::NativeWebMouseEvent::create):\n(WebKit::NativeWebMouseEvent::NativeWebMouseEvent):\n* Source/WebKit/Shared/gtk/NativeWebTouchEventGtk.cpp:\n(WebKit::NativeWebTouchEvent::create):\n(WebKit::NativeWebTouchEvent::NativeWebTouchEvent):\n(): Deleted.\n* Source/WebKit/Shared/gtk/NativeWebWheelEventGtk.cpp:\n(WebKit::NativeWebWheelEvent::create):\n(WebKit::NativeWebWheelEvent::NativeWebWheelEvent):\n* Source/WebKit/Shared/gtk/WebEventFactory.cpp:\n(WebKit::WebEventFactory::createWebMouseEvent):\n(WebKit::WebEventFactory::createWebKeyboardEvent):\n(WebKit::WebEventFactory::createWebTouchEvent):\n(WebKit::WebEventFactory::createWebWheelEvent):\n* Source/WebKit/Shared/gtk/WebEventFactory.h:\n* Source/WebKit/Shared/ios/NativeWebKeyboardEventIOS.mm:\n(WebKit::NativeWebKeyboardEvent::create):\n(WebKit::NativeWebKeyboardEvent::NativeWebKeyboardEvent):\n* Source/WebKit/Shared/ios/NativeWebMouseEventIOS.mm:\n(WebKit::NativeWebMouseEvent::create):\n(WebKit::NativeWebMouseEvent::NativeWebMouseEvent):\n(): Deleted.\n* Source/WebKit/Shared/ios/NativeWebTouchEventIOS.mm:\n(WebKit::NativeWebTouchEvent::extractCoalescedWebTouchEvents):\n(WebKit::NativeWebTouchEvent::extractPredictedWebTouchEvents):\n(WebKit::NativeWebTouchEvent::create):\n(WebKit::NativeWebTouchEvent::NativeWebTouchEvent):\n(): Deleted.\n* Source/WebKit/Shared/ios/WebIOSEventFactory.h:\n* Source/WebKit/Shared/ios/WebIOSEventFactory.mm:\n(WebKit::WebIOSEventFactory::createWebKeyboardEvent):\n(WebKit::WebIOSEventFactory::createWebMouseEvent):\n(WebKit::WebIOSEventFactory::createWebWheelEvent):\n* Source/WebKit/Shared/libwpe/NativeWebKeyboardEventLibWPE.cpp:\n(WebKit::NativeWebKeyboardEvent::create):\n(WebKit::NativeWebKeyboardEvent::NativeWebKeyboardEvent):\n* Source/WebKit/Shared/libwpe/NativeWebMouseEventLibWPE.cpp:\n(WebKit::NativeWebMouseEvent::create):\n(WebKit::NativeWebMouseEvent::NativeWebMouseEvent):\n* Source/WebKit/Shared/libwpe/NativeWebTouchEventLibWPE.cpp:\n(WebKit::NativeWebTouchEvent::create):\n(WebKit::NativeWebTouchEvent::NativeWebTouchEvent):\n* Source/WebKit/Shared/libwpe/NativeWebWheelEventLibWPE.cpp:\n(WebKit::NativeWebWheelEvent::create):\n(WebKit::NativeWebWheelEvent::NativeWebWheelEvent):\n* Source/WebKit/Shared/libwpe/WebEventFactory.cpp:\n(WebKit::WebEventFactory::createWebKeyboardEvent):\n(WebKit::WebEventFactory::createWebMouseEvent):\n(WebKit::WebEventFactory::createWebWheelEvent):\n(WebKit::WebEventFactory::createWebTouchEvent):\n* Source/WebKit/Shared/libwpe/WebEventFactory.h:\n* Source/WebKit/Shared/mac/NativeWebGestureEventMac.mm:\n(WebKit::NativeWebGestureEvent::create):\n(WebKit::NativeWebGestureEvent::NativeWebGestureEvent):\n* Source/WebKit/Shared/mac/NativeWebKeyboardEventMac.mm:\n(WebKit::NativeWebKeyboardEvent::create):\n(WebKit::NativeWebKeyboardEvent::NativeWebKeyboardEvent):\n* Source/WebKit/Shared/mac/NativeWebMouseEventMac.mm:\n(WebKit::NativeWebMouseEvent::create):\n(WebKit::NativeWebMouseEvent::NativeWebMouseEvent):\n* Source/WebKit/Shared/mac/NativeWebWheelEventMac.mm:\n(WebKit::NativeWebWheelEvent::create):\n(WebKit::NativeWebWheelEvent::NativeWebWheelEvent):\n* Source/WebKit/Shared/mac/WebEventFactory.h:\n* Source/WebKit/Shared/mac/WebEventFactory.mm:\n(WebKit::WebEventFactory::createWebMouseEvent):\n(WebKit::WebEventFactory::createWebWheelEvent):\n(WebKit::WebEventFactory::createWebKeyboardEvent):\n* Source/WebKit/Shared/mac/WebGestureEvent.cpp:\n(WebKit::WebGestureEvent::create):\n(WebKit::WebGestureEvent::WebGestureEvent):\n(WebKit::WebGestureEvent::isGestureEventType):\n(WebKit::WebGestureEvent::isGestureEventType const): Deleted.\n* Source/WebKit/Shared/mac/WebGestureEvent.h:\n(WebKit::WebGestureEvent::position const):\n(WebKit::WebGestureEvent::gestureScale const):\n(WebKit::WebGestureEvent::gestureRotation const):\n(WebKit::WebGestureEvent::phase const):\n(WebKit::WebGestureEvent::WebGestureEvent): Deleted.\n* Source/WebKit/Shared/win/NativeWebKeyboardEventWin.cpp:\n(WebKit::NativeWebKeyboardEvent::create):\n(WebKit::NativeWebKeyboardEvent::NativeWebKeyboardEvent):\n* Source/WebKit/Shared/win/NativeWebMouseEventWin.cpp:\n(WebKit::NativeWebMouseEvent::create):\n(WebKit::NativeWebMouseEvent::NativeWebMouseEvent):\n* Source/WebKit/Shared/win/NativeWebTouchEventWin.cpp:\n(WebKit::NativeWebTouchEvent::create):\n(WebKit::NativeWebTouchEvent::NativeWebTouchEvent):\n* Source/WebKit/Shared/win/NativeWebWheelEventWin.cpp:\n(WebKit::NativeWebWheelEvent::create):\n(WebKit::NativeWebWheelEvent::NativeWebWheelEvent):\n* Source/WebKit/Shared/win/WebEventFactory.cpp:\n(WebKit::WebEventFactory::createWebMouseEvent):\n(WebKit::WebEventFactory::createWebWheelEvent):\n(WebKit::WebEventFactory::createWebKeyboardEvent):\n(WebKit::WebEventFactory::createWebTouchEvent):\n* Source/WebKit/Shared/win/WebEventFactory.h:\n* Source/WebKit/Shared/wpe/NativeWebKeyboardEventWPE.cpp:\n(WebKit::NativeWebKeyboardEvent::create):\n(WebKit::NativeWebKeyboardEvent::NativeWebKeyboardEvent): Deleted.\n(): Deleted.\n* Source/WebKit/Shared/wpe/NativeWebMouseEventWPE.cpp:\n(WebKit::NativeWebMouseEvent::create):\n(WebKit::NativeWebMouseEvent::NativeWebMouseEvent): Deleted.\n* Source/WebKit/Shared/wpe/NativeWebTouchEventWPE.cpp:\n(WebKit::NativeWebTouchEvent::create):\n(WebKit::NativeWebTouchEvent::NativeWebTouchEvent):\n* Source/WebKit/Shared/wpe/NativeWebWheelEventWPE.cpp:\n(WebKit::NativeWebWheelEvent::create):\n(WebKit::NativeWebWheelEvent::NativeWebWheelEvent): Deleted.\n* Source/WebKit/Shared/wpe/WebEventFactoryWPE.cpp:\n(WebKit::WebEventFactory::createWebMouseEvent):\n(WebKit::WebEventFactory::createWebWheelEvent):\n(WebKit::WebEventFactory::createWebKeyboardEvent):\n(WebKit::WebEventFactory::createWebTouchEvent):\n* Source/WebKit/UIProcess/API/C/playstation/WKPagePrivatePlayStation.cpp:\n(WKPageHandleKeyboardEvent):\n(WKPageHandleMouseEvent):\n(WKPageHandleWheelEvent):\n* Source/WebKit/UIProcess/API/C/wpe/WKPagePrivateWPE.cpp:\n(WKPageHandleKeyboardEvent):\n(WKPageHandleMouseEvent):\n* Source/WebKit/UIProcess/API/gtk/WebKitWebViewBase.cpp:\n(webkitWebViewBaseKeyPressEvent):\n(webkitWebViewBaseKeyReleaseEvent):\n(webkitWebViewBaseKeyPressed):\n(webkitWebViewBaseKeyReleased):\n(webkitWebViewBaseHandleMouseEvent):\n(webkitWebViewBaseButtonPressed):\n(webkitWebViewBaseButtonReleased):\n(webkitWebViewBaseScrollEvent):\n(handleScroll):\n(webkitWebViewBaseEnter):\n(webkitWebViewBaseMotion):\n(webkitWebViewBaseLeave):\n(webkitWebViewBaseTouchEvent):\n(webkitWebViewBaseSynthesizeCompositionKeyPress):\n(webkitWebViewBaseSynthesizeMouseEvent):\n(webkitWebViewBaseSynthesizeKeyEvent):\n(webkitWebViewBaseSynthesizeWheelEvent):\n(webkitWebViewBaseSynthesizeTouchEvent):\n* Source/WebKit/UIProcess/API/wpe/PageClientImpl.cpp:\n(WebKit::PageClientImpl::doneWithTouchEvent):\n* Source/WebKit/UIProcess/API/wpe/WPEWebViewLegacy.cpp:\n(WKWPE::ViewLegacy::ViewLegacy):\n(WKWPE::ViewLegacy::handleKeyboardEvent):\n(WKWPE::ViewLegacy::synthesizeCompositionKeyPress):\n* Source/WebKit/UIProcess/API/wpe/WPEWebViewPlatform.cpp:\n(WKWPE::ViewPlatform::handleEvent):\n(WKWPE::ViewPlatform::handleGesture):\n(WKWPE::ViewPlatform::synthesizeCompositionKeyPress):\n* Source/WebKit/UIProcess/Automation/win/WebAutomationSessionWin.cpp:\n(WebKit::doMouseButtonEvent):\n(WebKit::WebAutomationSession::platformSimulateKeyboardInteraction):\n(WebKit::WebAutomationSession::platformSimulateKeySequence):\n* Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.cpp:\n(WebKit::RemoteScrollingCoordinatorProxy::handleWheelEvent):\n(WebKit::RemoteScrollingCoordinatorProxy::continueWheelEventHandling):\n* Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.h:\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.h:\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.mm:\n(WebKit::RemoteLayerTreeEventDispatcher::willHandleWheelEvent):\n(WebKit::RemoteLayerTreeEventDispatcher::handleWheelEvent):\n(WebKit::RemoteLayerTreeEventDispatcher::continueWheelEventHandling):\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteScrollingCoordinatorProxyMac.h:\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteScrollingCoordinatorProxyMac.mm:\n(WebKit::RemoteScrollingCoordinatorProxyMac::handleWheelEvent):\n* Source/WebKit/UIProcess/ViewGestureController.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::setInitialFocus):\n(WebKit::removeOldRedundantEvent):\n(WebKit::WebPageProxy::sendMouseEvent):\n(WebKit::WebPageProxy::handleMouseEvent):\n(WebKit::WebPageProxy::dispatchMouseDidMoveOverElementAsynchronously):\n(WebKit::WebPageProxy::processNextQueuedMouseEvent):\n(WebKit::WebPageProxy::processNextQueuedGestureEvent):\n(WebKit::WebPageProxy::handleNativeWheelEvent):\n(WebKit::WebPageProxy::handleWheelEvent):\n(WebKit::WebPageProxy::continueWheelEventHandling):\n(WebKit::WebPageProxy::sendWheelEvent):\n(WebKit::WebPageProxy::wheelEventHandlingCompleted):\n(WebKit::WebPageProxy::sendKeyEvent):\n(WebKit::WebPageProxy::handleKeyboardEvent):\n(WebKit::WebPageProxy::sendGestureEvent):\n(WebKit::WebPageProxy::handleGestureEvent):\n(WebKit::WebPageProxy::processNextQueuedTouchEvent):\n(WebKit::WebPageProxy::handleTouchEvent):\n(WebKit::WebPageProxy::touchEventHandlingCompleted):\n(WebKit::WebPageProxy::Internals::currentlyProcessedMouseDownEvent):\n(WebKit::WebPageProxy::mouseEventHandlingCompleted):\n(WebKit::WebPageProxy::gestureEventHandlingCompleted):\n(WebKit::WebPageProxy::keyEventHandlingCompleted):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxyInternals.h:\n(WebKit::QueuedTouchEvents::QueuedTouchEvents):\n* Source/WebKit/UIProcess/gtk/PointerLockManager.cpp:\n(WebKit::PointerLockManager::handleMotion):\n* Source/WebKit/UIProcess/ios/WKContentViewInteraction.mm:\n(-[WKContentView _touchEventsRecognized]):\n* Source/WebKit/UIProcess/ios/WKMouseInteraction.mm:\n(-[WKMouseInteraction createMouseEventWithType:wasCancelled:]):\n(-[WKMouseInteraction handleGameControllerMouseMove:deltaY:]):\n* Source/WebKit/UIProcess/mac/AppKitGestures/WKAppKitGestureController.mm:\n(-[WKAppKitGestureController sendWheelEventForGesture:]):\n(-[WKAppKitGestureController startMomentumIfNeededForGesture:]):\n* Source/WebKit/UIProcess/mac/ViewGestureControllerMac.mm:\n(WebKit::ViewGestureController::PendingSwipeTracker::scrollEventCanStartSwipe):\n(WebKit::ViewGestureController::PendingSwipeTracker::scrollEventCanEndSwipe):\n(WebKit::ViewGestureController::PendingSwipeTracker::scrollEventCanInfluenceSwipe):\n(WebKit::ViewGestureController::PendingSwipeTracker::scrollEventGetScrollingDeltas):\n(WebKit::ViewGestureController::handleScrollWheelEvent):\n* Source/WebKit/UIProcess/mac/WKFullScreenWindowController.mm:\n(-[WKFullScreenWindowController finishedEnterFullScreenAnimation:]):\n* Source/WebKit/UIProcess/mac/WebPageProxyMac.mm:\n(WebKit::WebPageProxy::shouldDelayWindowOrderingForEvent):\n(WebKit::WebPageProxy::acceptsFirstMouse):\n(WebKit::WebPageProxy::interruptSyntheticMomentumScrolling):\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::becomeFirstResponder):\n(WebKit::WebViewImpl::acceptsFirstMouse):\n(WebKit::WebViewImpl::shouldDelayWindowOrderingForEvent):\n(WebKit::WebViewImpl::scheduleMouseDidMoveOverElement):\n(WebKit::WebViewImpl::pressureChangeWithEvent):\n(WebKit::WebViewImpl::tryToSwipeWithEvent):\n(WebKit::WebViewImpl::scrollWheel):\n(WebKit::WebViewImpl::performKeyEquivalent):\n(WebKit::WebViewImpl::keyUp):\n(WebKit::WebViewImpl::keyDown):\n(WebKit::WebViewImpl::flagsChanged):\n(WebKit::WebViewImpl::nativeMouseEventHandler):\n* Source/WebKit/UIProcess/win/WebPageProxyWin.cpp:\n(WebKit::WebPageProxy::dispatchPendingCharEvents):\n* Source/WebKit/UIProcess/win/WebView.cpp:\n(WebKit::WebView::onMouseEvent):\n(WebKit::WebView::onWheelEvent):\n(WebKit::WebView::onKeyEvent):\n* Source/WebKit/WebProcess/Plugins/PDF/PDFPlugin.mm:\n(WebKit::PDFPlugin::showContextMenuAtPoint):\n* Source/WebKit/WebProcess/Plugins/PDF/PDFPluginBase.mm:\n(WebKit::PDFPluginBase::showContextMenuAtPoint):\n* Source/WebKit/WebProcess/Plugins/PluginView.cpp:\n(WebKit::PluginView::handleEvent):\n* Source/WebKit/WebProcess/WebPage/EventDispatcher.cpp:\n(WebKit::EventDispatcher::internalWheelEvent):\n(WebKit::EventDispatcher::wheelEvent):\n(WebKit::EventDispatcher::gestureEvent):\n(WebKit::TouchEventData::TouchEventData):\n(WebKit::EventDispatcher::touchEvent):\n(WebKit::EventDispatcher::dispatchWheelEventViaMainThread):\n* Source/WebKit/WebProcess/WebPage/EventDispatcher.h:\n* Source/WebKit/WebProcess/WebPage/EventDispatcher.messages.in:\n* Source/WebKit/WebProcess/WebPage/MomentumEventDispatcher.cpp:\n(WebKit::MomentumEventDispatcher::handleWheelEvent):\n(WebKit::MomentumEventDispatcher::dispatchSyntheticMomentumEvent):\n(WebKit::MomentumEventDispatcher::didStartMomentumPhase):\n* Source/WebKit/WebProcess/WebPage/MomentumEventDispatcher.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::mouseEvent):\n(WebKit::WebPage::performHitTestForMouseEvent):\n(WebKit::WebPage::handleWheelEvent):\n(WebKit::WebPage::dispatchWheelEventWithoutScrolling):\n(WebKit::WebPage::keyEvent):\n(WebKit::WebPage::touchEvent):\n(WebKit::WebPage::setInitialFocus):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.messages.in:\n* Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm:\n(WebKit::transformEventIfNecessary):\n(WebKit::WebPage::dispatchAsynchronousTouchEvents):\n* Source/WebKit/WebProcess/WebPage/mac/WebPageMac.mm:\n(WebKit::WebPage::shouldDelayWindowOrderingEvent):\n(WebKit::WebPage::requestAcceptsFirstMouse):\n\nCanonical link: https://commits.webkit.org/320030@main", "email": "cdumez@apple.com", "hash": "70826d7c1dcbf58ac38c6e4d7378e5a1806b5052", "subject": "WebEvent and its subclasses should always be heap-allocated" }, "320031@main": { "author": "Claudio Saavedra", "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64", "cl": "320031@main", "clUrl": "https://commits.webkit.org/320031@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322614\n\nReviewed by Carlos Alberto Lopez Perez.\n\nThe test reports two types that reach IPC on the ports using Unix domain sockets\nand cannot be described.\n\nUnixFileDescriptor is their IPC::Attachment, the role MachSendRight has on Darwin\n(Platform/IPC/Attachment.h); attachments are passed out of band by a hand-written\ncoder and have no members, which is why MachSendRight is already allowlisted. It\nwas also spelled two ways, and only the unqualified form is registered.\n\nGTlsCertificateFlags is a GIO C flags enum, and the generator only parses enum\nclass, the same reason WebCore::ContextMenuAction is allowlisted. Describing it\nwould mean mirroring GIO's flags in WebKit.\n\nAllowlist both and unskip. GTK and WPE report identical sets, so one line covers\nthem.\n\n* LayoutTests/ipc/serialized-type-info.html:\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebKit/Shared/WebGL.serialization.in:\n* Source/WebKit/Shared/XR/PlatformXR.serialization.in:\n* Source/WebKit/Shared/glib/CoreIPCGUnixFDList.serialization.in:\n* Source/WebKit/Shared/glib/DMABufBufferAttributes.serialization.in:\n\nCanonical link: https://commits.webkit.org/320031@main", "email": "csaavedra@igalia.com", "hash": "ffbf2c925325a2780830d333468cc8d71de71b71", "subject": "[GLIB] Unskip ipc/serialized-type-info.html" }, "320032@main": { "author": "Richard Robinson", "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64", "cl": "320032@main", "clUrl": "https://commits.webkit.org/320032@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322806\nrdar://186056463\n\nReviewed by Adrian Taylor.\n\nAdd new CxxExpected and CxxConsumingExpected Swift protocols to be able to easily interoperate\nwith `std::expected` types.\n\nTest: Tools/TestWebKitAPI/Tests/WTF/cocoa/SwiftCxxInteropTests.swift\n\n* Source/WebKit/Shared/WTFExpected+Extras.swift: Added.\n(CxxExpectedBase.has_value):\n(CxxExpectedBase.__valueUnsafe):\n(CxxExpectedBase.__errorUnsafe):\n(CxxExpected.value):\n(CxxConsumingExpected.__take(_:)):\n(CxxConsumingExpected.consume() throws(CxxUnexpected\u003cFailure\u003e:)):\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Helpers/WTFExpected+Extras.swift: Added.\n(CxxExpectedBase.has_value):\n(CxxExpectedBase.__valueUnsafe):\n(CxxExpectedBase.__errorUnsafe):\n(CxxExpected.value):\n(CxxConsumingExpected.__take(_:)):\n(CxxConsumingExpected.consume() throws(CxxUnexpected\u003cFailure\u003e:)):\n* Tools/TestWebKitAPI/TestWTFLibrary/SwiftCxxInteropTestbed.cpp:\n(SwiftCxxInteropTestbed::sharedProbeRefCount):\n(SwiftCxxInteropTestbed::makeIntExpected):\n(SwiftCxxInteropTestbed::makeIntUnexpected):\n(SwiftCxxInteropTestbed::makeCopyCountingProbeExpected):\n(SwiftCxxInteropTestbed::makeCopyCountingProbeUnexpected):\n(SwiftCxxInteropTestbed::makeSharedProbeHolderExpected):\n(SwiftCxxInteropTestbed::makeMoveOnlyProbeExpected):\n(SwiftCxxInteropTestbed::makeMoveOnlyProbeUnexpected):\n(SwiftCxxInteropTestbed::makeSelfReferentialProbeExpected):\n* Tools/TestWebKitAPI/TestWTFLibrary/SwiftCxxInteropTestbed.h:\n(SwiftCxxInteropTestbed::takeMoveOnlyProbeValue):\n(SwiftCxxInteropTestbed::takeSelfReferentialProbeValue):\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WTF/cocoa/SwiftCxxInteropTests.swift:\n(Cxx.__take(_:)):\n(SwiftCxxInteropTests.expectedExposesItsValue):\n(SwiftCxxInteropTests.unexpectedThrowsItsError):\n(SwiftCxxInteropTests.readingTheValueLeavesTheExpectedAlone):\n(SwiftCxxInteropTests.readingAnUnexpectedLeavesTheErrorInPlace):\n(SwiftCxxInteropTests.readingACopyableValueCopiesItExactlyOnce):\n(SwiftCxxInteropTests.theValueOutlivesTheExpectedItWasReadFrom):\n(SwiftCxxInteropTests.readingAnUnexpectedNeverTouchesTheValue):\n(SwiftCxxInteropTests.valueHoldingAManagedReferenceLeavesTheCallersCountAlone):\n(SwiftCxxInteropTests.noncopyableValueCanBeConsumed):\n(SwiftCxxInteropTests.consumingAnUnexpectedThrowsItsError):\n(SwiftCxxInteropTests.consumedNoncopyableValueIsRelocatedWithItsMoveConstructor):\n\nCanonical link: https://commits.webkit.org/320032@main", "email": "richard_robinson2@apple.com", "hash": "00c991b3e660e26f50328266eb11bfb095f2461f", "subject": "[Swift in WebKit] Introduce a bridging mechanism to create `std::expected`s in Swift" }, "320033@main": { "author": "Kate Lee", "avatar": "https://www.gravatar.com/avatar/35a2c13193d9f38e92785754264aa7da?d=identicon\u0026s=64", "cl": "320033@main", "clUrl": "https://commits.webkit.org/320033@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322823\n\nUnreviewed gardening.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/gtk/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320033@main", "email": "klee@igalia.com", "hash": "969d785301481e0141ae6aba801611296ffe26ec", "subject": "[GTK][WPE] Gardening of tests - 2026-08-28" }, "320034@main": { "author": "Antoine Quint", "avatar": "https://www.gravatar.com/avatar/9b3ef1e754f8d994f21ff67c660cbbe6?d=identicon\u0026s=64", "cl": "320034@main", "clUrl": "https://commits.webkit.org/320034@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321274\nrdar://184322389\n\nReviewed by Sam Weinig.\n\nEnsure we don't enter an infinite loop under `UnitBezier::solveCurveX()` by\nenforcing a minimal value for `epsilon` larger than 0.\n\nTest: imported/w3c/web-platform-tests/css/css-transitions/transition-duration-infinite-cancelation.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/transition-duration-infinite-cancelation-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/transition-duration-infinite-cancelation.html: Added.\n* Source/WebCore/platform/graphics/UnitBezier.h:\n(WebCore::UnitBezier::solveCurveX):\n\nCanonical link: https://commits.webkit.org/320034@main", "email": "graouts@webkit.org", "hash": "029da7d3d074a75a24c2413e98b183a8bbfcfb62", "subject": "Page freezes with CSS transition duration calc(infinity * 1s)" }, "320035@main": { "author": "Diego Pino Garcia", "avatar": "https://www.gravatar.com/avatar/e8cce88637f1a6e79155e8371e24b2e8?d=identicon\u0026s=64", "cl": "320035@main", "clUrl": "https://commits.webkit.org/320035@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317644\n\nReviewed by Adrian Perez de Castro.\n\nThis patch adds the packages 'monado-cli', 'monado-service' and\n'libopenxr1-monado' to the APT dependencies list. All these packages are\navailable on the currently supported distributions, except for Debian 12.\nThus, the packages are guarded by 'aptIfExists'.\n\n* Tools/glib/dependencies/apt:\n\nCanonical link: https://commits.webkit.org/320035@main", "email": "dpino@igalia.com", "hash": "129c7bc8c6be1a8736bf74a4d8090bf1c9c725cd", "subject": "[GLib] Add monado packages to system dependencies list" }, "320036@main": { "author": "Adrian Taylor", "avatar": "https://www.gravatar.com/avatar/d2acb8ad2e2670ff74ae0d65fb27014c?d=identicon\u0026s=64", "cl": "320036@main", "clUrl": "https://commits.webkit.org/320036@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322829\n\nReviewed by Ross Kirsling.\n\nThe LINKER: prefix is built into CMake and arranges for tools to pass\narguments through compiler drivers directly to linkers. In the case of the\nPlayStation port, this LINKER: prefix is being substituted for -Xlinker, but\nit appears that -Wl is more likely correct.\n\nCanonical link: https://commits.webkit.org/320036@main", "email": "adrian_taylor@apple.com", "hash": "0c7b760ec659dbc17ea0653bc48893872490c879", "subject": "Pass correct linker prefix on PlayStation platform" }, "320037@main": { "author": "Fady Farag", "avatar": "https://www.gravatar.com/avatar/0ac5127c69f90d0c57054173ae4c3108?d=identicon\u0026s=64", "cl": "320037@main", "clUrl": "https://commits.webkit.org/320037@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322769\nrdar://186031593\n\nReviewed by Mike Wyrzykowski.\n\nBoth strings appear in WGSL diagnostics.\n\n* Source/WebGPU/WGSL/GlobalVariableRewriter.cpp:\n(WGSL::nameForPrimitiveKind):\n* Source/WebGPU/WGSL/Types.h:\n\nCanonical link: https://commits.webkit.org/320037@main", "email": "com.webkit.iidmsa@gmail.com", "hash": "c67740bfb13bb1719cd1be0a480c4970aedb0189", "subject": "Fix typo in `WGSL::Types::Primitive` and `WGSL::nameForPrimitiveKind`" }, "320038@main": { "author": "Justin Michaud", "avatar": "https://www.gravatar.com/avatar/36e0433ee725a08f7e1122a6bc584b57?d=identicon\u0026s=64", "cl": "320038@main", "clUrl": "https://commits.webkit.org/320038@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321751\n\nReviewed by Adrian Perez de Castro.\n\nThe reporter fixed this upstream, just add a test.\n\nCanonical link: https://commits.webkit.org/320038@main", "email": "jmichaud@igalia.com", "hash": "2668e2d7adfe98f5191c1929948f40214bd4da46", "subject": "[non-cocoa][fuzz] OOB write in APNG ICC conversion" }, "320039@main": { "author": "Ryosuke Niwa", "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64", "cl": "320039@main", "clUrl": "https://commits.webkit.org/320039@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322826\n\nReviewed by Chris Dumez.\n\nAdd NODELETE with SUPPRESS_NODELETE on functions in ThreadSafeWeakPtr so that\ncreating a destroying a ThreadSafeWeakPtr is considered no-delete compliant.\n\n* Source/WTF/wtf/ThreadSafeWeakPtr.h:\n(WTF::ThreadSafeWeakPtrControlBlock::weakDeref):\n(WTF::ThreadSafeRefCountedAndCanMakeThreadSafeWeakPtr::controlBlock const):\n\nCanonical link: https://commits.webkit.org/320039@main", "email": "rniwa@webkit.org", "hash": "18e08875bad5ffc5ba0e934ecff74dab03c6bd81", "subject": "Creating or destroying a ThreadSafeWeakPtr should be considered no-delete" }, "320040@main": { "author": "Antoine Quint", "avatar": "https://www.gravatar.com/avatar/9b3ef1e754f8d994f21ff67c660cbbe6?d=identicon\u0026s=64", "cl": "320040@main", "clUrl": "https://commits.webkit.org/320040@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322013\nrdar://185206745\n\nReviewed by Anne van Kesteren.\n\nNow that we have the `animation-timeline`, `scroll-timeline-name` and `view-timeline-name`\nCSS properties track their style scope (see 320026@main) we can use `Style::resolveTreeScopedReference()`\nto correctly match style-originated timelines.\n\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/scroll-timeline-name-shadow-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/view-timeline-name-shadow-expected.txt:\n* Source/WebCore/animation/StyleOriginatedTimelinesController.cpp:\n(WebCore::timelineIsInScopeForTarget):\n(WebCore::StyleOriginatedTimelinesController::determineTimelineForElement):\n(WebCore::StyleOriginatedTimelinesController::attachAnimation):\n* Source/WebCore/animation/StyleOriginatedTimelinesController.h:\n\nCanonical link: https://commits.webkit.org/320040@main", "email": "graouts@webkit.org", "hash": "d729ce684003576e8ba3bceb657927685fac982f", "subject": "[scroll-animations] make timeline names loosely-matched" }, "320041@main": { "author": "Karl Rackler", "avatar": "https://www.gravatar.com/avatar/809e306d02face15d5e29b561026f7c2?d=identicon\u0026s=64", "cl": "320041@main", "clUrl": "https://commits.webkit.org/320041@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322840\nrdar://186082244\n\nUnreviewed test gardening.\n\nAdd test expectation.\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320041@main", "email": "rackler@apple.com", "hash": "27441f0bb3d1de2fa8f5bcb1fcf3aa10a78bed8b", "subject": "[Gardening]: (REGRESSION(318498@main): [Tahoe] 11 imported/w3c/web-platform-tests/encrypted-media/drm-mp4 tests are a constant CRASH)" }, "320042@main": { "author": "Ben Nham", "avatar": "https://www.gravatar.com/avatar/dc0914eabf69047ee3397794c2d17bf7?d=identicon\u0026s=64", "cl": "320042@main", "clUrl": "https://commits.webkit.org/320042@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=290004\nrdar://147361301\n\nReviewed by Per Arne Vollan.\n\nFor legacy reasons, dispatch queues do not drain an autorelease pool for each work item. Instead,\nroot autoreleased objects will accumulate in a last-resort pool which drains when the worker thread\nbacking the queue exits.\n\nTo fix this, use the `WITH_AUTORELEASE_POOL` attribute when creating dispatch queues so each work\nitem is executed with its own autorelease pool. Also add a style rule to enforce this in the future.\n\n* Source/JavaScriptCore/API/tests/Regress141275.mm:\n(-[JSTEvaluator init]):\n* Source/JavaScriptCore/inspector/remote/cocoa/RemoteInspectorCocoa.mm:\n(Inspector::RemoteInspector::RemoteInspector):\n* Source/JavaScriptCore/jsc.cpp:\n(jscmain):\n* Source/WTF/wtf/cocoa/WorkQueueCocoa.cpp:\n(WTF::WorkQueueBase::platformInitialize):\n* Source/WTF/wtf/darwin/DispatchExtras.h:\n(WTF::serialQueueWithAutoreleasePoolAttrSingleton):\n(WTF::concurrentQueueWithAutoreleasePoolAttrSingleton):\n* Source/WebCore/platform/cocoa/NetworkExtensionContentFilter.mm:\n(WebCore::NetworkExtensionContentFilter::initialize):\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:\n(WebCore::globalLoaderDelegateQueue):\n* Source/WebCore/platform/graphics/avfoundation/objc/QueuedVideoOutput.mm:\n(WebCore::globalOutputDelegateQueue):\n* Source/WebCore/platform/graphics/cocoa/PeriodicSharedTimer.mm:\n(WebCore::PeriodicSharedTimer::PeriodicSharedTimer):\n* Source/WebCore/platform/mac/PowerObserverMac.cpp:\n(WebCore::PowerObserver::PowerObserver):\n* Source/WebCore/platform/mediastream/cocoa/AVVideoCaptureSource.mm:\n(WebCore::globaVideoCaptureSerialQueue):\n* Source/WebCore/platform/mediastream/cocoa/ScreenCaptureKitCaptureSource.mm:\n(WebCore::ScreenCaptureKitCaptureSource::captureQueue):\n* Source/WebKit/NetworkProcess/webrtc/NetworkRTCTCPSocketCocoa.mm:\n(WebKit::tcpSocketQueueSingleton):\n* Source/WebKit/NetworkProcess/webrtc/NetworkRTCUDPSocketCocoa.mm:\n(WebKit::udpSocketQueueSingleton):\n* Source/WebKit/UIProcess/Cocoa/WKScreenTimeConfigurationObserver.mm:\n(screenTimeUpdateQueueSingleton):\n* Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm:\n(WebKit::WebProcessPool::setMediaAccessibilityPreferences):\n* Source/WebKit/UIProcess/XR/ios/WKARPresentationSession.mm:\n(-[_WKTransientGestureRecognizer initWithSession:]):\n* Source/WebKit/UIProcess/XR/xros/WKXRTrackingManager.mm:\n(-[WKXRTrackingManager initWithHandTrackingEnabled:layerRenderer:controllerManager:]):\n* Source/WebKit/UIProcess/ios/WKWebGeolocationPolicyDeciderIOS.mm:\n(-[WKWebGeolocationPolicyDecider init]):\n* Source/WebKit/UIProcess/mac/ServicesController.mm:\n(WebKit::ServicesController::ServicesController):\n* Source/WebKit/webpushd/_WKMockUserNotificationCenter.mm:\n(-[_WKMockUserNotificationCenter initWithBundleIdentifierInternal:]):\n* Source/WebKitLegacy/mac/WebView/WebPreferences.mm:\n(WebPreferencesPrivate::WebPreferencesPrivate):\n* Tools/Scripts/webkitpy/style/checkers/cpp.py:\n(check_language):\n(CppChecker):\n* Tools/Scripts/webkitpy/style/checkers/cpp_unittest.py:\n(CppStyleTest):\n(WebKitStyleTest.test_auto_with_adopt):\n(WebKitStyleTest.test_wtf_os_object_ptr):\n* Tools/TestWebKitAPI/Helpers/mac/VirtualGamepad.mm:\n(TestWebKitAPI::VirtualGamepad::VirtualGamepad):\n* Tools/TestWebKitAPI/Tests/WTF/darwin/OSObjectPtr.cpp:\n(TestWebKitAPI::TEST(OS_OBJECT_PTR_TEST_NAME, AdoptOSObject)):\n(TestWebKitAPI::TEST(OS_OBJECT_PTR_TEST_NAME, RetainRelease)):\n(TestWebKitAPI::TEST(OS_OBJECT_PTR_TEST_NAME, LeakRef)):\n\nCanonical link: https://commits.webkit.org/320042@main", "email": "nham@apple.com", "hash": "05b6f71120e1843b3f7461a3033edc833e3f2d30", "subject": "Create dispatch queues with autorelease pools" }, "320043@main": { "author": "Ben Nham", "avatar": "https://www.gravatar.com/avatar/dc0914eabf69047ee3397794c2d17bf7?d=identicon\u0026s=64", "cl": "320043@main", "clUrl": "https://commits.webkit.org/320043@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322691\nrdar://problem/185961490\n\nReviewed by Alex Christensen and Kiet Ho.\n\nWhen Site Isolation is enabled, we currently send three separate frame geometry related IPCs in\nPage::syncLocalFrameInfoToRemote(). Consolidate these in to a single IPC instead.\n\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/page/Frame.cpp:\n(WebCore::Frame::updateFrameTreeSyncData):\n* Source/WebCore/page/FrameGeometrySyncData.cpp: Added.\n(WebCore::operator\u003c\u003c):\n* Source/WebCore/page/FrameGeometrySyncData.h: Added.\n* Source/WebCore/page/FrameTreeSyncData.in:\n* Source/WebCore/page/LocalFrameView.cpp:\n(WebCore::LocalFrameView::updateLayoutViewportRect): Deleted.\n(WebCore::LocalFrameView::updateContentsSizeForRemoteFrames): Deleted.\n* Source/WebCore/page/LocalFrameView.h:\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::syncLocalFrameInfoToRemote):\n* Source/WebCore/page/RemoteFrame.cpp:\n(WebCore::RemoteFrame::usedZoomForChild const):\n* Source/WebCore/page/RemoteFrameLayoutInfo.cpp:\n(WebCore::operator\u003c\u003c):\n* Source/WebCore/page/RemoteFrameLayoutInfo.h:\n* Source/WebCore/page/RemoteFrameView.cpp:\n(WebCore::RemoteFrameView::layoutViewportRect const):\n(WebCore::RemoteFrameView::contentsSize const):\n(WebCore::RemoteFrameView::visibleRectOfChild const):\n(WebCore::RemoteFrameView::appearanceOfOwnerElementOfChildFrame const):\n(WebCore::RemoteFrameView::childFrameOwnerContentBoxLocation const):\n(WebCore::RemoteFrameView::childFrameOwnerToRootContentTransform const):\n(WebCore::RemoteFrameView::absoluteToChildFrameOwnerLocalTransform const):\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Source/WebKit/UIProcess/WebFrameProxy.cpp:\n(WebKit::WebFrameProxy::calculateFrameTreeSyncData const):\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::frameTreeSyncDataChangedInAnotherProcess):\n(WebKit::WebPage::updateChildFrameVisibleRectsFromParent):\n\nCanonical link: https://commits.webkit.org/320043@main", "email": "nham@apple.com", "hash": "119fd8268d356250ef15a870e5dd136fee765972", "subject": "[Site Isolation] Coalesce per-rendering-update frame geometry IPCs" }, "320044@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "320044@main", "clUrl": "https://commits.webkit.org/320044@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322718\n\u003crdar://problem/185985708\u003e\n\nReviewed by Antti Koivisto.\n\ncollectInkOverflowForTextDecorations() measured each text box's decoration overflow\nfrom displayBox.layoutBox().parent().style(). The decoration properties are not\ninherited, so when a decoration propagates from an ancestor to a descendant inline box\nthat immediate parent carries the initial values, and the overflow came out too small.\nThe decoration was still painted in the right place - TextBoxPainter walks up to the\noriginating box - so it got clipped to the undersized overflow instead.\n\nTest: imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-propagated-ink-overflow.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-propagated-ink-overflow.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-propagated-ink-overflow-expected.html: Added.\n* Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayContentBuilder.cpp:\n(WebCore::Layout::InlineDisplayContentBuilder::collectInkOverflowForTextDecorations):\n\nCanonical link: https://commits.webkit.org/320044@main", "email": "zalan@apple.com", "hash": "845882297cd22aeb22135aecf95aebbe4638842a", "subject": "[css-text-decor] Negative text-decoration-inset is clipped when the decoration propagates to a descendant inline box" }, "320045@main": { "author": "Nikolas Zimmermann", "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64", "cl": "320045@main", "clUrl": "https://commits.webkit.org/320045@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322219\n\nReviewed by Simon Fraser.\n\nA nested \u003csvg\u003e and a \u003cmarker\u003e clip their content to their viewport, and we apply\nthat clip even when the whole content is already inside it. Nothing pixel-snaps\nthe clip for them, because rendererNeedsPixelSnapping() opts every SVG renderer\nbelow the outermost \u003csvg\u003e out. The viewport border can therefore fall between\ntwo device pixels, and content drawn exactly on it loses part of its outer edge.\nIn svg/custom/viewbox-syntax.svg that is the red stroke around each nested\n\u003csvg\u003e. A marker viewport does the same to its content, in painting-marker-03-f,\nmarker-default-width-height, shapes-supporting-markers and the two\njs-late-marker tests. All of them have subtle pixel test failures, compared\nto the legacy SVG engine.\n\nThe fix is to not apply a clip that removes nothing, but just causes undesired\nside effects. To achieve this the existing overflow clip handling in LBSE\nwas overhauled: overflowClipRect() keeps returning the rectangle itself, the way\nRenderBox does, for whoever needs to intersect a rectangle against it, currently\nSVGBoundingBoxComputation::handleRootOrContainer() and\nRenderSVGModelObject::updateCachedVisualOverflowRect(). The painting paths now\nquery overflowClipRectForPainting() instead, which returns the infinite rectangle\nas long as the content stays inside the viewport, and overflowClipRect() otherwise.\n\nRebaseline a few tests that gain the restored edge or no longer show clip\nannotations in the render tree dumps, covered by existing tests.\n\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/coords-viewattr-01-b-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/filters-comptran-01-b-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/filters-example-01-b-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/painting-marker-03-f-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/W3C-SVG-1.1/types-basicDOM-01-b-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/container-opacity-clip-viewBox-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/container-opacity-clip-viewBox-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/feComponentTransfer-Discrete-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/feComponentTransfer-Gamma-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/feComponentTransfer-Linear-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/feComponentTransfer-Table-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/js-late-marker-and-object-creation-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/js-late-marker-creation-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/marker-default-width-height-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/preserve-aspect-ratio-syntax-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/preserve-aspect-ratio-syntax-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/relative-sized-inner-svg-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/relative-sized-use-on-symbol-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/relative-sized-use-without-attributes-on-symbol-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/root-container-opacity-clip-viewBox-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/shapes-supporting-markers-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/text-rotated-gradient-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-in-symbol-with-offset-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-svg-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-svg1-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-svg2-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-symbol-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-symbol1-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/use-transfer-width-height-properties-to-symbol2-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/viewbox-syntax-expected.png: Added.\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/custom/viewbox-syntax-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/text/text-viewbox-rescale-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/page/zoom-coords-viewattr-01-b-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/page/zoom-coords-viewattr-01-b-expected.txt:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/text/zoom-coords-viewattr-01-b-expected.png:\n* LayoutTests/platform/mac-tahoe-wk2-lbse-text/svg/zoom/text/zoom-coords-viewattr-01-b-expected.txt:\n* Source/WebCore/rendering/RenderLayer.cpp:\n(WebCore::RenderLayer::calculateClipRects const):\n* Source/WebCore/rendering/RenderLayer.h:\n* Source/WebCore/rendering/RenderLayerSVGAdditions.cpp:\n(WebCore::RenderLayer::appendChildrenInDOMOrderForSVG):\n* Source/WebCore/rendering/svg/RenderSVGContainer.cpp:\n(WebCore::RenderSVGContainer::paint):\n* Source/WebCore/rendering/svg/RenderSVGModelObject.cpp:\n(WebCore::RenderSVGModelObject::requiresLayer const):\n(WebCore::RenderSVGModelObject::overflowClipRectForPainting const):\n* Source/WebCore/rendering/svg/RenderSVGModelObject.h:\n(WebCore::RenderSVGModelObject::locationOffsetEquivalent const):\n(WebCore::RenderSVGModelObject::visualOverflowRectEquivalent const):\n(WebCore::RenderSVGModelObject::cachedVisualOverflowRectIfAvailable const):\n(WebCore::RenderSVGModelObject::updateCachedVisualOverflowRect const):\n(WebCore::RenderSVGModelObject::overflowClipRectForChildLayers):\n(WebCore::RenderSVGModelObject::updateCachedVisualOverflowRect): Deleted.\n* Source/WebCore/rendering/svg/RenderSVGModelObjectInlines.h:\n(WebCore::RenderSVGModelObject::clipsSubtree):\n* Source/WebCore/rendering/svg/SVGBoundingBoxComputation.cpp:\n(WebCore::SVGBoundingBoxComputation::handleRootOrContainer const):\n(WebCore::computeVisualOverflowRectWithOptions):\n(WebCore::SVGBoundingBoxComputation::computeVisualOverflowRect):\n(WebCore::SVGBoundingBoxComputation::computeVisualOverflowRectIgnoringViewportClip):\n* Source/WebCore/rendering/svg/SVGBoundingBoxComputation.h:\n\nCanonical link: https://commits.webkit.org/320045@main", "email": "nzimmermann@igalia.com", "hash": "1aa99d7546d2e0a6a3efb1fa652cfa450ebc45ff", "subject": "[LBSE] Fix viewport clipping issues" }, "320046@main": { "author": "Karl Rackler", "avatar": "https://www.gravatar.com/avatar/809e306d02face15d5e29b561026f7c2?d=identicon\u0026s=64", "cl": "320046@main", "clUrl": "https://commits.webkit.org/320046@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322847\nrdar://186086174\n\nUnreviewed test gardening.\n\nAdd test expectation.\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320046@main", "email": "rackler@apple.com", "hash": "9ec86f1d4f78ebf4ae2dd140de2384723101175f", "subject": "[Gardening]: (New Test(319793@main): [macOS Debug] imported/w3c/web-platform-tests/css/css-grid/grid-lanes/subgrid/grid-subgridded-to-grid-lanes/baseline/row-grid-lanes-item-baseline-subgrid-001.html is a constant CRASH)" }, "320047@main": { "author": "Karl Rackler", "avatar": "https://www.gravatar.com/avatar/809e306d02face15d5e29b561026f7c2?d=identicon\u0026s=64", "cl": "320047@main", "clUrl": "https://commits.webkit.org/320047@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322847\nrdar://186086174\n\nUnreviewed test gardening.\n\nAdd test expectations for row-grid-lanes-item-baseline-subgrid-004.html and\nrow-grid-lanes-item-baseline-subgrid-005.html, which hit the same\nGridTrackSizingAlgorithm assertion on macOS Debug as -001.\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320047@main", "email": "rackler@apple.com", "hash": "cbd439246453ce331023b253f8bfd8c18ab2511a", "subject": "[Gardening]: (New Test(319793@main): [macOS Debug] imported/w3c/web-platform-tests/css/css-grid/grid-lanes/subgrid/grid-subgridded-to-grid-lanes/baseline/row-grid-lanes-item-baseline-subgrid-001.html is a constant CRASH)" }, "320048@main": { "author": "Keith Miller", "avatar": "https://www.gravatar.com/avatar/bddc1595b29098429a6ce7c8bf4aced2?d=identicon\u0026s=64", "cl": "320048@main", "clUrl": "https://commits.webkit.org/320048@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318755\nrdar://181457816\n\nReviewed by Yusuke Suzuki.\n\nThe legacy Delegate wasm bytecode is essentially shorthand for: `Rethrow;\nEnd`. So like other merge points it needs to widen the types on the\nexpression stack. To help avoid this problem in the future add a new\nhelper `endBlockAndCheckResultTypes`, which ensures the types are\nappropriately widened.\n\nTest: JSTests/wasm/stress/delegate-widens-result-type-to-signature.js\n\nOriginally-landed-as: 305413.1096@safari-7624.5-branch (db3010593c27). rdar://185366253\nCanonical link: https://commits.webkit.org/320048@main", "email": "keith_miller@apple.com", "hash": "261bcb42d83f2838cb8245675ffd6e53eebf55bc", "subject": "[Wasm] Delegate should widen types like End" }, "320050@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "320050@main", "clUrl": "https://commits.webkit.org/320050@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=252322\nrdar://105502071\n\nReviewed by Eric Carlson.\n\nChroma location information was lost during the IPC serialisation. The file\nstated Centre and so VideoToolbox defaulted to Left instead.\n\nFly-by: CVFieldCount/CVFieldDetail information was lost, we add it.\nCVPixelAspectRatio was a rational that we converted to floats internally, leading to small\ninnacuracies. We now use integer spacings instead (video in test AR was set as 1.185185...:1 where it should have been 32:27)\n\nPlatformVideoColorSpace gaining a chromaLocation member makes the hand-written\ncolorSpace literal in ipc/cocoa/videoEncode.html incomplete, and coreipc.js's\nserializer throws on a missing member; give it an absent chromaLocation.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/cocoa/CoreMediaUtilities.mm\n\n* LayoutTests/ipc/cocoa/videoEncode.html:\n* LayoutTests/platform/mac/TestExpectations:\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Modules/webcodecs/WebCodecsVideoFrame.cpp:\n(WebCore::WebCodecsVideoFrame::create):\n* Source/WebCore/Modules/webcodecs/WebCodecsVideoFrameAlgorithms.cpp:\n(WebCore::videoFramePickColorSpace):\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/platform/TrackInfo.h:\n(WebCore::VideoInfo::fieldCount const):\n(WebCore::VideoInfo::fieldDetail const):\n* Source/WebCore/platform/cocoa/CoreVideoSoftLink.cpp:\n* Source/WebCore/platform/cocoa/CoreVideoSoftLink.h:\n* Source/WebCore/platform/graphics/PlatformVideoChromaLocation.h: Copied from Source/WebCore/platform/graphics/PlatformVideoColorSpace.h.\n* Source/WebCore/platform/graphics/PlatformVideoColorSpace.cpp:\n(WebCore::operator\u003c\u003c):\n(WebCore::overrideVideoColorSpaceAsNeeded):\n* Source/WebCore/platform/graphics/PlatformVideoColorSpace.h:\n(WebCore::PlatformVideoColorSpace::isValid const):\n* Source/WebCore/platform/graphics/avfoundation/FormatDescriptionUtilities.cpp:\n(WebCore::colorSpaceFromFormatDescription):\n(WebCore::fieldCountFromFormatDescription):\n(WebCore::fieldDetailFromFormatDescription):\n* Source/WebCore/platform/graphics/avfoundation/FormatDescriptionUtilities.h:\n* Source/WebCore/platform/graphics/cocoa/CMUtilities.mm:\n(WebCore::createExtensionsDictionary):\n(WebCore::convertToCMChromaLocation):\n(WebCore::convertToCMFieldDetail):\n(WebCore::createFormatDescriptionFromTrackInfo):\n(WebCore::createVideoInfoFromFormatDescription):\n(WebCore::attachColorSpaceToPixelBuffer):\n(WebCore::computeVideoFrameColorSpace):\n* Source/WebCore/platform/libwebrtc/LibWebRTCVPXVideoEncoder.cpp:\n(WebCore::LibWebRTCVPXInternalVideoEncoder::encode):\n(WebCore::LibWebRTCVPXInternalVideoEncoder::OnEncodedImage):\n* Source/WebCore/platform/mediastream/cocoa/RealtimeOutgoingVideoSourceCocoa.cpp:\n(WebCore::RealtimeOutgoingVideoSourceCocoa::videoFrameAvailable):\n* Source/WebCore/platform/mediastream/libwebrtc/LibWebRTCVideoFrameUtilities.cpp:\n(WebCore::colorSpaceFromLibWebRTCColorSpace):\n* Source/WebCore/platform/mediastream/libwebrtc/VideoFrameLibWebRTC.cpp:\n(WebCore::defaultVPXColorSpace):\n* Source/WebCore/platform/mediastream/libwebrtc/gstreamer/RealtimeOutgoingVideoSourceLibWebRTC.cpp:\n(WebCore::RealtimeOutgoingVideoSourceLibWebRTC::videoFrameAvailable):\n* Source/WebKit/GPUProcess/webrtc/LibWebRTCCodecsProxy.mm:\n(WebKit::LibWebRTCCodecsProxy::createEncoder):\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/CoreMediaUtilities.mm:\n(TestWebKitAPI::TEST(CMUtilities, ChromaLocationRoundTrip)):\n(TestWebKitAPI::TEST(CMUtilities, AbsentChromaLocationStaysAbsent)):\n(TestWebKitAPI::TEST(CMUtilities, ChromaLocationSurvivesFormatDescriptionRoundTrip)):\n(TestWebKitAPI::TEST(CMUtilities, FieldCountAndDetailRoundTrip)):\n(TestWebKitAPI::TEST(CMUtilities, AbsentFieldInfoStaysAbsent)):\n(TestWebKitAPI::TEST(CMUtilities, PixelAspectRatioUsesIntegerSpacings)):\n(TestWebKitAPI::TEST(CMUtilities, SquarePixelAspectRatioEmitsNoExtension)):\n\nCanonical link: https://commits.webkit.org/320050@main", "email": "jya@apple.com", "hash": "2b438524716502ed500bcac9bc8af5fa4aa7927e", "subject": "media/media-source/media-source-video-renders.html is constant ImageOnlyfailure" }, "320051@main": { "author": "Dana Estra", "avatar": "https://www.gravatar.com/avatar/bb57a3e383fc407cd4b341aeef87d877?d=identicon\u0026s=64", "cl": "320051@main", "clUrl": "https://commits.webkit.org/320051@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322670\nrdar://184169028\n\nReviewed by Jer Noble.\n\nWhen exiting video fullscreen on espn.com on iPhone, the video gets stuck in a paused\nstate. The quirk NeedsPauseBeforeFullscreenExit was added to fix this however it no\nlonger works with the current configuration of the website.\n\nThis patch removes the old quirk and adds a new one NeedsSuppressedPauseEventOnFullscreenExit.\nThe quirk prevents the pause event from being dispatched while fullscreen is being exited. This\nallows the site's internal state machine to remain in allignment with the real state of the video.\n\nNo new tests.\n\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::pause):\n(WebCore::HTMLMediaElement::pauseInternal):\n(WebCore::HTMLMediaElement::exitFullscreen):\n* Source/WebCore/html/HTMLMediaElement.h:\n* Source/WebCore/page/Quirks.cpp:\n* Source/WebCore/page/Quirks.h:\n* Source/WebCore/page/QuirksData.h:\n\nCanonical link: https://commits.webkit.org/320051@main", "email": "destra@apple.com", "hash": "e8032440e4aed34eeb637b153757c03f9ecdeac1", "subject": "ESPN.com on iPhone: After exiting full screen, video pauses and tapping the resume button doesn’t do anything on espn.com" }, "320052@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "320052@main", "clUrl": "https://commits.webkit.org/320052@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322441\n\u003crdar://problem/185850399\u003e\n\nReviewed by Antti Koivisto.\n\nWiden text-decoration-inset from \u003clength\u003e{1,2} to \u003clength-percentage\u003e{1,2}, per\nthe CSSWG resolution on csswg-drafts#8403.\n\nA percentage resolves against the inline size of the decorating box for box-decoration-break: slice, or of the individual box fragment for clone.\nSince a sliced box's inline size spans all of its fragments, TextBoxPainter now sums them (DecoratingBoxFragmentInlineSizes) instead of measuring the fragment being painted.\nThat sum also gives the inline size preceding/following this fragment, so a trimming inset larger than one fragment now carries over\ninto the next - a middle fragment can be trimmed, or vanish, without holding either endpoint of the box.\n\nInk overflow cannot resolve these percentages while building a line, because the basis is not known until every fragment exists.\nInlineContentBuilder therefore collects the decorating boxes whose inset may resolve negative while it walks the display boxes, and\nadds the outward overhang in a follow-up pass over the finished lines.\nStyleDifference compares insets with no basis, where two different percentages would look equal, so a change involving one now requires layout outright.\n\nTests: imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-026-ref.html\n imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-027-ref.html\n imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-028-ref.html\n imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-029-ref.html\n imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-percentage-slice-multiline-ref.html\n imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-percentage-slice-ref.html\n imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-026.html\n imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-027.html\n imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-028.html\n imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-029.html\n imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-030.html\n imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-clone.html\n imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-equivalence.html\n imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-grow.html\n imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-incremental.html\n imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-layer.html\n imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-multiline.html\n imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-propagated.html\n imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-repaint.html\n imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative.html\n imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-padding.html\n imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice-multiline.html\n imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice.html\n\n* LayoutTests/TestExpectations: text-decoration-inset-029 sets unprefixed\nbox-decoration-break, which WebKit does not support, so it slices rather than clones;\nit passes once prefixed. 009/014 carry fuzzy annotations for their fractional endpoints\ninstead of expectations.\n* LayoutTests/imported/w3c/resources/resource-files.json:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-computed.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-computed-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-invalid.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-invalid-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-valid.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/parsing/text-decoration-inset-valid-expected.txt: Re-import the upstream\nparsing tests, which now cover percentages and calc().\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-009.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-014.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-026.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-026-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-027.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-027-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-028.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-028-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-029.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-029-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-030.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-030-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice-multiline.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-slice-multiline-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-026-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-027-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-028-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-029-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-percentage-slice-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/reference/text-decoration-inset-percentage-slice-multiline-ref.html: Added. Import the\nupstream percentage tests.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-equivalence.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-equivalence-expected.html: Added. 25% of a 200px\nbox paints as 50px.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-padding.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-padding-expected.html: Added. The basis includes\nthe decorating box's padding and every run inside it, not just the painted run.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-clone.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-clone-expected.html: Added. Per-fragment basis,\nvia -webkit-box-decoration-break.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-layer.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-layer-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-multiline.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-multiline-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-propagated.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-propagated-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-repaint.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-repaint-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-grow.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-grow-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-incremental.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-text-decor/text-decoration-inset-percentage-negative-incremental-expected.html: Added. The\noutward overhang of a negative percentage, across compositing, line wrapping,\npropagation to a descendant, and dynamic/incremental relayout.\n* Source/WebCore/css/CSSProperties.json: \u003clength-percentage\u003e{1,2}.\n* Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.cpp:\n(WebCore::LayoutIntegration::InlineContentBuilder::adjustDisplayLines const):\n(WebCore::LayoutIntegration::InlineContentBuilder::adjustInkOverflowForPercentageTextDecorationInsets const):\n* Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.h:\n* Source/WebCore/rendering/TextBoxPainter.cpp:\n(WebCore::decoratingBoxFragmentInlineSizes):\n(WebCore::TextBoxPainter::insetAdjustedDecorationLocationAndWidth const):\n(WebCore::DecoratingBoxFragmentInlineSizes::total const):\n* Source/WebCore/style/InlineTextBoxStyle.cpp:\n(WebCore::computedInkOverflowForDecorations):\n* Source/WebCore/style/StyleDifference.cpp:\n* Source/WebCore/style/values/text-decoration/StyleTextDecorationInset.cpp:\n(WebCore::Style::TextDecorationInset::hasPercentage const):\n(WebCore::Style::TextDecorationInset::hasNegativePercentage const):\n(WebCore::Style::TextDecorationInset::resolvedStart const):\n(WebCore::Style::TextDecorationInset::resolvedEnd const):\n(WebCore::Style::TextDecorationInset::outwardExtent const):\n(WebCore::Style::CSSValueConversion\u003cTextDecorationInsetPair\u003e::operator):\n* Source/WebCore/style/values/text-decoration/StyleTextDecorationInset.h:\n(WTF::MarkableTraits\u003cWebCore::Style::TextDecorationInsetPair\u003e::isEmptyValue):\n(WTF::MarkableTraits\u003cWebCore::Style::TextDecorationInsetPair\u003e::emptyValue):\n(WebCore::Style::TextDecorationInset::TextDecorationInset):\n\nCanonical link: https://commits.webkit.org/320052@main", "email": "zalan@apple.com", "hash": "64e677b027a4775149d55e010cd991024ea4a979", "subject": "[css-text-decor-4] Support percentages in text-decoration-inset" }, "320053@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "320053@main", "clUrl": "https://commits.webkit.org/320053@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322759\n\nReviewed by Yusuke Suzuki.\n\nWebAssembly.Module.customSections compared each section name by\nbuilding a String. Use WTF::equal against the UTF-8 name span.\n\n* Source/JavaScriptCore/wasm/js/WebAssemblyModuleConstructor.cpp:\n\nCanonical link: https://commits.webkit.org/320053@main", "email": "chi187@gmail.com", "hash": "ad023b35ced0b26ac7fd8e2c86d2daa6ea8a0a16", "subject": "[JSC][Wasm] Compare custom section names without allocating a String" }, "320054@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "320054@main", "clUrl": "https://commits.webkit.org/320054@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322530\n\nReviewed by Yusuke Suzuki.\n\nStore function wrappers in a trailing instance array and load the slot\nin BBQ and OMG. Call ensure only when the slot is empty.\n\n* Source/JavaScriptCore/b3/B3AbstractHeapRepository.h:\n* Source/JavaScriptCore/wasm/WasmBBQJIT.cpp:\n* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp:\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h:\n* JSTests/wasm/stress/ref-func-wrapper-identity.js: Added.\n\nCanonical link: https://commits.webkit.org/320054@main", "email": "chi187@gmail.com", "hash": "98007ce32048c750eb1a67543055cec022e4eef4", "subject": "[JSC][Wasm] Inline ref.func" }, "320055@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "320055@main", "clUrl": "https://commits.webkit.org/320055@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322525\n\nReviewed by Yusuke Suzuki.\n\nThe JS-to-Wasm IC sent every non-externref to the slow path. Accept a JS\nint32 in the i31 range, and null if the type is nullable.\n\n* Source/JavaScriptCore/wasm/js/JSToWasm.cpp:\n* JSTests/wasm/stress/js-to-wasm-i31ref.js: Added.\n\nCanonical link: https://commits.webkit.org/320055@main", "email": "chi187@gmail.com", "hash": "d3e6e0f710a4f913cc4281834f9810ab07962797", "subject": "[JSC][Wasm] Fast-path i31ref in the JS-to-Wasm entry stub" }, "320056@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "320056@main", "clUrl": "https://commits.webkit.org/320056@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322524\n\nReviewed by Keith Miller.\n\nRef fill looped set() so each element took a write barrier. Store with\nsetWithoutWriteBarrier, then one writeBarrier.\n\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyArray.cpp:\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyArray.h:\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyArrayInlines.h:\n\nCanonical link: https://commits.webkit.org/320056@main", "email": "chi187@gmail.com", "hash": "565aa489f1f01a6f05274e682d17d9198410fa99", "subject": "[JSC][Wasm] Fill wasm ref arrays without per-element set()" }, "320057@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "320057@main", "clUrl": "https://commits.webkit.org/320057@main", "description": "Reviewed by Yusuke Suzuki.\n\nEmpty buffers already throw WebAssembly.CompileError. Drop the stale\nFIXME that expected Error (the superclass).\n\n* JSTests/wasm/js-api/test_basic_api.js:\n\nCanonical link: https://commits.webkit.org/320057@main", "email": "chi187@gmail.com", "hash": "bb8cb62b7160699e476f4fd7c5de0acebc037a65", "subject": "[JSC][Wasm] Expect CompileError for an empty WebAssembly.Module" }, "320058@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "320058@main", "clUrl": "https://commits.webkit.org/320058@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322116\n\nReviewed by Yusuke Suzuki.\n\nNamespace get of a mutable Wasm global returns the current value\ninstead of the WebAssembly.Global wrapper. Instance.exports stays\nwrapped. v128 / exnref stay TDZ. Module-namespace IC is not installed\nfor these gets so the value stays live. A JS module that exports a\nmutable WebAssembly.Global is unchanged.\n\n* Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp:\n* JSTests/wasm/modules/js-wasm-mutable-global-namespace.js: Added.\n* JSTests/wasm/modules/mut-global.wasm: Added.\n* JSTests/wasm/modules/mut-global.wat: Added.\n* JSTests/wasm/js-api/js-module-mutable-global-export.js: Added.\n* JSTests/wasm/js-api/js-module-mutable-global-namespace.js: Added.\n* JSTests/wasm/js-api/js-wasm-imported-mut-global-namespace.js: Added.\n* JSTests/wasm/js-api/reexport-js-mut-global.wasm: Added.\n* JSTests/wasm/js-api/reexport-js-mut-global.wat: Added.\n* JSTests/wasm/js-api/js-reexport-wasm-mut-global.js: Added.\n* JSTests/wasm/js-api/js-reexport-wasm-mut-global-namespace.js: Added.\n* LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/global-exports.tentative.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/global-exports.tentative.any.worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/global-exports-live-bindings.tentative.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/global-exports-live-bindings.tentative.any.worker-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/mutable-global-sharing.tentative.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/mutable-global-sharing.tentative.any.worker-expected.txt:\n\nCanonical link: https://commits.webkit.org/320058@main", "email": "chi187@gmail.com", "hash": "81b5126daf2dac78574dc7c15bf64d88469ee206", "subject": "[JSC][Wasm] ESM mutable globals should be live unwrapped bindings" }, "320059@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "320059@main", "clUrl": "https://commits.webkit.org/320059@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322118\n\nReviewed by Keith Miller.\n\nESM import of a Wasm module should reject reserved wasm: and wasm-js:\nimport names, export names, and wasm-js: module names with\nWebAssembly.LinkError instead of TypeError or a successful load.\nWebAssembly.Instance is unchanged. Enabled wasm: builtins are not\ntreated as reserved.\n\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp:\n* JSTests/wasm/modules/js-wasm-reserved-names.js: Added.\n* JSTests/wasm/modules/reserved-import-name.wat: Added.\n* JSTests/wasm/modules/reserved-import-name.wasm: Added.\n* JSTests/wasm/modules/reserved-import-name-wasm-js.wat: Added.\n* JSTests/wasm/modules/reserved-import-name-wasm-js.wasm: Added.\n* JSTests/wasm/modules/reserved-export-name.wat: Added.\n* JSTests/wasm/modules/reserved-export-name.wasm: Added.\n* JSTests/wasm/modules/reserved-export-name-wasm-js.wat: Added.\n* JSTests/wasm/modules/reserved-export-name-wasm-js.wasm: Added.\n* JSTests/wasm/modules/reserved-import-module.wat: Added.\n* JSTests/wasm/modules/reserved-import-module.wasm: Added.\n* LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/reserved-import-names.tentative.any-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/esm-integration/reserved-import-names.tentative.any.worker-expected.txt:\n\nCanonical link: https://commits.webkit.org/320059@main", "email": "chi187@gmail.com", "hash": "6f7bb45088c88c051ca99c0c0afeb5baf9364f16", "subject": "[JSC][Wasm] Reserved wasm: and wasm-js: names should LinkError in ESM" }, "320060@main": { "author": "Ben Nham", "avatar": "https://www.gravatar.com/avatar/dc0914eabf69047ee3397794c2d17bf7?d=identicon\u0026s=64", "cl": "320060@main", "clUrl": "https://commits.webkit.org/320060@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322756\nrdar://184130213\n\nReviewed by Simon Fraser.\n\nWe are getting hang logs showing that some part of collectScreenProperties (the call to\n`+preferredVideoRangeForDisplays:`) ends up in a sync IPC to WindowServer that can sometimes block\nthe main thread of the UIProcess for multiple seconds.\n\nTo fix this, this patch adds a collectScreenPropertiesAsync function, which moves just the HDR state\ncollection for a display to a background thread. (Note that I considered just running all of\ncollectScreenProperties on a background thread, but after inspection it seems like some NSScreen\nmethods aren't meant to be called off the main thread.)\n\nIn addition, WebProcessPool now caches the last screen properties state and uses it on the\nWebProcess creation path. This removes a sync IPC from the WebProcess creation path.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/cocoa/PlatformScreenTests.mm\n\n* Source/WebCore/platform/PlatformScreen.cpp:\n(WebCore::collectScreenPropertiesAsync):\n* Source/WebCore/platform/PlatformScreen.h:\n* Source/WebCore/platform/mac/PlatformScreenMac.mm:\n(WebCore::collectHDRStateForDisplay):\n(WebCore::collectHDRState):\n(WebCore::collectScreenPropertiesExceptForHDRState):\n(WebCore::collectScreenProperties):\n(WebCore::collectScreenPropertiesAsync):\n* Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm:\n(WebKit::WebProcessPool::platformInitializeWebProcess):\n(WebKit::WebProcessPool::screenPropertiesUpdateTimerFired):\n(WebKit::WebProcessPool::didCollectScreenProperties):\n(WebKit::WebProcessPool::applyEDRSuppressionIfNeeded):\n(WebKit::WebProcessPool::cachedScreenProperties):\n* Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp:\n(WebKit::GPUProcessProxy::updateScreenPropertiesIfNeeded):\n* Source/WebKit/UIProcess/GPU/GPUProcessProxy.h:\n* Source/WebKit/UIProcess/WebProcessPool.cpp:\n(WebKit::WebProcessPool::ensureGPUProcess):\n(WebKit::WebProcessPool::createWebPage):\n* Source/WebKit/UIProcess/WebProcessPool.h:\n* Tools/TestWebKitAPI/PlatformCocoa.cmake:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/PlatformScreenTests.mm: Added.\n(TestWebKitAPI::TEST(PlatformScreen, CollectScreenPropertiesAsync)):\n\nCanonical link: https://commits.webkit.org/320060@main", "email": "nham@apple.com", "hash": "209e271d944ef2a3758bc25ca8ff8ab9bd149155", "subject": "Move some part of collectScreenProperties to a background thread" }, "320061@main": { "author": "Keith Miller", "avatar": "https://www.gravatar.com/avatar/bddc1595b29098429a6ce7c8bf4aced2?d=identicon\u0026s=64", "cl": "320061@main", "clUrl": "https://commits.webkit.org/320061@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317654\nrdar://177693309\n\nReviewed by Yijia Huang.\n\nGPRInfo::wasmBoundsCheckingSizeRegister (callee save) is only pinned in B3 when\nthe OMG callee is compiled for MemoryMode::BoundsChecking. In Signaling mode\nit stays in B3/Air's mutable register set, and createTailCallPatchpoint\ndeclares the full callee-save set as clobberEarly so that B3 does not place\nan input there before the tail-call's parallel move runs. That clobberEarly\ncauses AirHandleCalleeSaves to include regCS4 in the function's\ncalleeSaveRegisterAtOffsetList(). The OMG prologue saves\nwasmBoundsCheckingSizeRegister to the callee save list and when making a\ntail call that callee save is restored after the callee's memory bounds\nare set.\n\nThe wasm ABI already treats the pinned registers as effectively caller-save\nacross wasm-to-wasm calls. Tail calls do not restore them either. Restoring\nwasmBoundsCheckingSizeRegister to the prologue-saved caller value in\nprepareForTailCallImpl is therefore unnecessary.\n\nThis patch teaches emitRestoreCalleeSavesFor to take a dontRestoreRegisters\nset and uses it from prepareForTailCallImpl to skip\nwasmBoundsCheckingSizeRegister. I also added a FIXME at the pinRegister\nsite noting that wasmBoundsCheckingSizeRegister is effectively caller-save\nin the wasm ABI.\n\nOriginally-landed-as: 305413.1027@safari-7624.5-branch (654718255548). rdar://185368944\nCanonical link: https://commits.webkit.org/320061@main", "email": "keith_miller@apple.com", "hash": "929f6e81e0e0881cde4edc161df05074f32541b5", "subject": "[Wasm] Exclude wasmBoundsCheckingSizeRegister from the callee saves restored" }, "320062@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "320062@main", "clUrl": "https://commits.webkit.org/320062@main", "description": "Reviewed by Yusuke Suzuki.\n\nThe parser and table init already support Element::FromGlobal. Enable the\ncommented kind-6 global.get case and collect wasm/extended-const so EWS\nruns it.\n\n* JSTests/wasm/extended-const/extended-const.js:\n* JSTests/wasm.yaml:\n\nCanonical link: https://commits.webkit.org/320062@main", "email": "chi187@gmail.com", "hash": "d95a22ac27020e2a85d22ef67e683de0de274b3e", "subject": "[JSC][Wasm] Cover elem kind 6 initialized from global.get" }, "320063@main": { "author": "lilly", "avatar": "https://www.gravatar.com/avatar/d0533d52eeb271270df480f37629a407?d=identicon\u0026s=64", "cl": "320063@main", "clUrl": "https://commits.webkit.org/320063@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322509\nrdar://185813432\n\nReviewed by Simon Fraser.\n\nGive the backdrop layer its own shape path, set from the outer contour when\nthe corners aren't round, and drop the corners from backdropFiltersRect\nso a shape reaching outside the radius isn't clipped back to it.\n\nPasses existing tests\n\n* Source/WebCore/platform/graphics/GraphicsLayer.h:\n(WebCore::GraphicsLayer::setBackdropFiltersShapePath):\n(WebCore::GraphicsLayer::backdropFiltersShapePath const):\n* Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp:\n(WebCore::shapePathsAreEqual):\n(WebCore::GraphicsLayerCA::setContentsClipShapePath):\n(WebCore::GraphicsLayerCA::setBackdropFiltersShapePath):\n(WebCore::GraphicsLayerCA::updateBackdropFiltersRect):\n(WebCore::GraphicsLayerCA::ensureStructuralLayer):\n(WebCore::contentsClipShapePathsAreEqual): Deleted.\n* Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h:\n* Source/WebCore/rendering/RenderLayerBacking.cpp:\n(WebCore::RenderLayerBacking::updateBackdropFiltersGeometry):\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-backdrop-filter-overflow.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-backdrop-filter.html:\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.cpp:\n(WebCore::SkiaCompositingLayer::paintBackdrop):\n* Source/WebCore/platform/graphics/skia/SkiaCompositingLayer.h:\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.cpp:\n(WebCore::CoordinatedPlatformLayer::setBackdropShapePath):\n(WebCore::CoordinatedPlatformLayer::flushCompositingStateOnTarget):\n(WebCore::CoordinatedPlatformLayer::flushCompositingStateOnSkiaTarget):\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayer.h:\n* Source/WebCore/platform/graphics/texmap/coordinated/GraphicsLayerCoordinated.cpp:\n(WebCore::GraphicsLayerCoordinated::setBackdropFiltersShapePath):\n(WebCore::GraphicsLayerCoordinated::commitLayerChanges):\n* Source/WebCore/platform/graphics/texmap/coordinated/GraphicsLayerCoordinated.h:\n\nCanonical link: https://commits.webkit.org/320063@main", "email": "173393835+cupidsity@users.noreply.github.com", "hash": "4b267e8636a2803d37d11d334f61be96093e5f5c", "subject": "corner-shape: backdrop-filter is clipped to the rounded rect, ignoring corner-shape" }, "320064@main": { "author": "Richard Robinson", "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64", "cl": "320064@main", "clUrl": "https://commits.webkit.org/320064@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322832\nrdar://186070672\n\nReviewed by Aditya Keerthi.\n\nExtract `std::expected\u003cJavaScriptEvaluationResult, std::optional\u003cWebCore::ExceptionDetails\u003e\u003e` into\nits own type, and adopt it where applicable.\n\nThis makes it more organized, and also allows it to be used from Swift.\n\n* Source/WebKit/Modules/Internal/module.modulemap:\n* Source/WebKit/Shared/InspectorExtensionTypes.h:\n* Source/WebKit/Shared/RunJavaScriptResult.h: Copied from Source/WebKit/Shared/InspectorExtensionTypes.h.\n* Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPIDevToolsInspectedWindow.mm:\n(WebKit::WebExtensionContext::devToolsInspectedWindowEval):\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.h:\n* Source/WebKit/UIProcess/Inspector/WebInspectorUIExtensionControllerProxy.cpp:\n(WebKit::WebInspectorUIExtensionControllerProxy::evaluateScriptForExtension):\n(WebKit::WebInspectorUIExtensionControllerProxy::evaluateScriptInExtensionTab):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::runJavaScriptInMainFrame):\n(WebKit::WebPageProxy::runJavaScriptInFrameInScriptWorld):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIDevToolsInspectedWindowCocoa.mm:\n(WebKit::WebExtensionAPIDevToolsInspectedWindow::eval):\n* Source/WebKit/WebProcess/Inspector/WebInspectorUIExtensionController.cpp:\n(WebKit::WebInspectorUIExtensionController::evaluateScriptForExtension):\n(WebKit::WebInspectorUIExtensionController::evaluateScriptInExtensionTab):\n* Source/WebKit/WebProcess/Inspector/WebInspectorUIExtensionController.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::runJavaScript):\n(WebKit::WebPage::runJavaScriptInFrameInScriptWorld):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n\nCanonical link: https://commits.webkit.org/320064@main", "email": "richard_robinson2@apple.com", "hash": "8093ad2f1f0904d24293426c62d3874acdad71ca", "subject": "Refactor `RunJavaScriptResult` into a standalone typed using declaration" }, "320065@main": { "author": "Brent Fulgham", "avatar": "https://www.gravatar.com/avatar/c6989a65afef0d015b55c65406e37ccc?d=identicon\u0026s=64", "cl": "320065@main", "clUrl": "https://commits.webkit.org/320065@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322850\nrdar://186093277\n\nUnreviewed sync with upstream Interop 2026 content.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/9e894db9485551eee017d7c0620be9cdd294670a\n\n* LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/WEB_FEATURES.yml:\n* LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/crashtests/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/css/selectors/invalidation/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-open-movebefore-setup-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-open-movebefore-setup.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inert-node-is-not-highlighted-expected.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inert-svg-hittest-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inert-svg-hittest.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/top-layer-removal-invalidates-ua-styles-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/top-layer-removal-invalidates-ua-styles.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/w3c-import.log:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-beforetoggle-change-type-crash.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-focus-invoker-inside-popover-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-focus-invoker-inside-popover.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-hint-loseinterest-show-child-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/popover-hint-loseinterest-show-child.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/popovers/w3c-import.log:\n\nCanonical link: https://commits.webkit.org/320065@main", "email": "bfulgham@apple.com", "hash": "868c07528b3d79e0f77c30408960246554a483a4", "subject": "[Interop 2026] Sync with upstream WPT for popover related tests" }, "320066@main": { "author": "Sammy Gill", "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64", "cl": "320066@main", "clUrl": "https://commits.webkit.org/320066@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=312152\nrdar://183465635\n\nReviewed by Alan Baradlay.\n\nIn 314501@main we attempted this patch in order to fix the described\nproblem on GitHub.com. This ended up causing a regression on\nflights.google.com so it ended up getting reverted. Here we are\nreattempting the same patch but with a fix for the regression. This\ncommit message will focus on that regression fix almost the entirety of\nthis patch is the same as the original so I will defer the explanation\nof the underlying architecture to that commit message.\n\nThe main difference in this patch is that instead of calling\nsetNeedsLayout() on the affected renderer and invalidating all the way\nup the containing block chain we invalidate only between that renderer\nand the subtree root.\n\nSpecifically, instead of having\n\n```\nif (rendererScrollbarChange.sizesAffectedFromScrollbarChanges.contains(LogicalBoxAxis::Block))\n renderer-\u003esetNeedsLayout();\n```\n\nwe have\n\n```\nif (rendererScrollbarChange.sizesAffectedFromScrollbarChanges.contains(LogicalBoxAxis::Block)) {\n renderer-\u003esetNeedsLayout(MarkingBehavior::MarkOnlyThis);\n renderer-\u003emarkContainingBlocksForLayout(subtreeRoot.ptr());\n}\n```\n\nHere is some markup from the reduced testcase that came out of\nflights.google.com:\n\n \u003cspan id=\"positionedInline\"\u003e position: relative\n \u003cspan id=\"inlineBlock\"\u003e inline-block, width: 600px\n \u003cdiv id=\"flexContainer\"\u003e display: flex, width: 500px, height: auto\n \u003cdiv id=\"flexItem\"\u003e\u003c/div\u003e width: 100px\n \u003cdiv id=\"positionedFlexItem\"\u003e position: relative, flex: 1\n \u003cdiv id=\"scroller\"\u003e position: absolute, width: 100%, overflow-x: auto\n \u003cdiv id=\"overflowingContent\"\u003e width: 300px\n \u003cspan id=\"targetContainingBlock\"\u003e inline-block, position: relative\n \u003cdiv id=\"target\"\u003e\u003c/div\u003e position: absolute, height: 20px\n\n#flexContainer is the subtree root: a block-level flex box with an auto block-size, so\nsizesAffectedByScrollbarsForSubtreeRoot() tracks its block axis. Widening #flexItem to\n450px shrinks #positionedFlexItem, and therefore #scroller, to 50px, so\n#overflowingContent overflows and #scroller gains a horizontal scrollbar during\n#flexContainer's layout.\n\nThe call to setNeedsLayout() on #scroller walks up the containing block chain\nand dirties the renderers past #flexContainer.\n\nFor RenderBlock ancestors above the subtree root this is harmless.\nLayout is descending through them, so they already carry the bit and the walk early-outs, and\nanything that does get set is cleared on the way back out. For\nRenderInline this does not appear to be the case. Before we run inline\nlayout we run some invalidation via RenderBlockFlow::markInlineContentDirtyForLayout().\nIn the above example we would call clearNeedsLayout on #positionedInline\nbefore running layout on the inline block. Then during the inline\nblock's layout we end up dirtying #positionedInline again from the\nresulting scrollbar handling code.\n\nTo get around this we can scope our invalidation only to the subtree\nroot that is handling the scrollbar change. This is much more precise\nanyways since we know for sure we will be running layout again starting\nat that renderer.\n\nCanonical link: https://commits.webkit.org/320066@main", "email": "sammy.gill@apple.com", "hash": "ef84d011acd78015778c666d39ab2b8b788bd44f", "subject": "GitHub.com: v2: emoji reaction overlaps code box in comment" }, "320067@main": { "author": "Sam Sneddon", "avatar": "https://www.gravatar.com/avatar/99f6b56d9db9d32920dfcc56deae86fc?d=identicon\u0026s=64", "cl": "320067@main", "clUrl": "https://commits.webkit.org/320067@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=316832\nrdar://179276740\n\nReviewed by Dewei Zhu.\n\nThis follows the same pattern we're using elsewhere: convert to\nhyphened form, and then parse with parse-trailers.\n\n* Websites/perf.webkit.org/tools/sync-commits.py:\n(GitRepository._revision_from_tokens):\n\nCanonical link: https://commits.webkit.org/320067@main", "email": "gsnedders@apple.com", "hash": "bc80ea5383e3e5e759386744a2a5b5eec88d18b9", "subject": "[perf.webkit.org] Update sync-commits.py to support Canonical-link" }, "320068@main": { "author": "Luke Warlow", "avatar": "https://www.gravatar.com/avatar/262b456ff1e93842b93f9694d1e01a9e?d=identicon\u0026s=64", "cl": "320068@main", "clUrl": "https://commits.webkit.org/320068@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321174\n\nReviewed by Ryosuke Niwa.\n\nReplaces the old bool parameter with a new enum class instead.\n\n* Source/WebCore/dom/ContainerNode.cpp:\n(WebCore::runMovingStepsForShadowIncludingInclusiveDescendants):\n* Source/WebCore/dom/Element.cpp:\n(WebCore::Element::movingSteps):\n* Source/WebCore/dom/Element.h:\n* Source/WebCore/dom/Node.cpp:\n(WebCore::Node::movingSteps):\n* Source/WebCore/dom/Node.h:\n* Source/WebCore/html/HTMLImageElement.cpp:\n(WebCore::HTMLImageElement::movingSteps):\n* Source/WebCore/html/HTMLImageElement.h:\n* Source/WebCore/html/HTMLOptionElement.cpp:\n(WebCore::HTMLOptionElement::movingSteps):\n* Source/WebCore/html/HTMLOptionElement.h:\n* Source/WebCore/html/HTMLSourceElement.cpp:\n(WebCore::HTMLSourceElement::movingSteps):\n* Source/WebCore/html/HTMLSourceElement.h:\n\nCanonical link: https://commits.webkit.org/320068@main", "email": "lwarlow@igalia.com", "hash": "7418d7f57da4fb7271efe147368878ed070cdd9d", "subject": "Change movingSteps isSubtreeRoot parameter to an enum" }, "320069@main": { "author": "Luke Warlow", "avatar": "https://www.gravatar.com/avatar/262b456ff1e93842b93f9694d1e01a9e?d=identicon\u0026s=64", "cl": "320069@main", "clUrl": "https://commits.webkit.org/320069@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=316098\n\nReviewed by Ryosuke Niwa and Darin Adler.\n\nThis adds a new ElementMoved, TextMoved, and NonContentsChildMoved ChildChange type.\nThese are used by moveBefore(), this ensures that children changed steps such as script's\nwhich runs prepareScript, don't run when triggered via moveBefore.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/script-move-before-expected.txt:\n* Source/WebCore/dom/ContainerNode.cpp:\n(WebCore::makeChildChangeForMoveRemoval):\n(WebCore::makeChildChangeForMoveInsertion):\n(WebCore::ContainerNode::moveBefore):\n* Source/WebCore/dom/ContainerNode.h:\n(WebCore::ContainerNode::ChildChange::isInsertion const):\n* Source/WebCore/dom/Element.cpp:\n(WebCore::Element::childrenChanged):\n* Source/WebCore/dom/ShadowRoot.cpp:\n(WebCore::ShadowRoot::childrenChanged):\n* Source/WebCore/html/HTMLSelectElement.cpp:\n(WebCore::HTMLSelectElement::optionToSelectFromChildChangeScope):\n* Source/WebCore/svg/SVGAnimateMotionElement.cpp:\n(WebCore::SVGAnimateMotionElement::childrenChanged):\n\nCanonical link: https://commits.webkit.org/320069@main", "email": "lwarlow@igalia.com", "hash": "0ac697f1a0640b799851de96337bf5f7e7a997cf", "subject": "Add new ChildChange types for moveBefore" }, "320070@main": { "author": "Cole Carley", "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64", "cl": "320070@main", "clUrl": "https://commits.webkit.org/320070@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322687\nrdar://185954750\n\nReviewed by Brent Fulgham.\n\nThis patch removes unused function declarations from Quirks.h.\n\n* Source/WebCore/page/Quirks.h:\n\nCanonical link: https://commits.webkit.org/320070@main", "email": "ccarley2@apple.com", "hash": "feb2b77758de770b74e87c730d557ed0c8ca32a8", "subject": "[Quirks] Remove unused function declarations" }, "320071@main": { "author": "Keith Miller", "avatar": "https://www.gravatar.com/avatar/bddc1595b29098429a6ce7c8bf4aced2?d=identicon\u0026s=64", "cl": "320071@main", "clUrl": "https://commits.webkit.org/320071@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318807\nrdar://181458746\n\nReviewed by Yusuke Suzuki.\n\nThe wasm spec says that any types passing through a block signature\nhave to widen to the signature. This is critical both for correctness\nand for security. We didn't widen in most cases, this change widens\nany time we enter or exit a block via fallthroughs.\n\nIn the branch case we don't always widen. For br_table in particular, we\nhave to check against each branch target, which may have different\ntarget types but the concrete value type could be a subtype of all of\nthem. If we widened the first checked target would pass but on a second\n(or later) it might fail with the first's widened type.\n\nTests: JSTests/wasm/stress/block-param-type-widening.js\n JSTests/wasm/stress/loop-param-type-widening.js\n\nOriginally-landed-as: 305413.1112@safari-7624.5-branch (0aff244e6923). rdar://185368381\nCanonical link: https://commits.webkit.org/320071@main", "email": "keith_miller@apple.com", "hash": "9dcbd254af217b64f37947d680ce0c6eae0ab7e3", "subject": "[Wasm] Argument and Result block types should always widen" }, "320072@main": { "author": "Keith Miller", "avatar": "https://www.gravatar.com/avatar/bddc1595b29098429a6ce7c8bf4aced2?d=identicon\u0026s=64", "cl": "320072@main", "clUrl": "https://commits.webkit.org/320072@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318348\nrdar://178255543\n\nReviewed by Yusuke Suzuki.\n\nWhen a strict-mode `arguments` allocation produced by an inlined varargs call\nis eliminated to PhantomClonedArguments, OSR availability records each argument\nas a promoted heap location backed by the inlined frame's stack slots. A second\ninlined varargs call that lowers to LoadVarargs may reuse those same virtual\nregisters. If an OSR exit later materialises the first allocation it must not\ndo so from those reused slots.\n\nTwo independent invariants were violated:\n\n1. LocalOSRAvailabilityCalculator::executeNode() handles PutStack/KillStack by\n calling killHeaps() before replacing a stack operand's availability so that\n any promoted heap location flushed to that operand is invalidated. The\n LoadVarargs / ForwardVarargs case replaced the count and argument operands\n without that invalidation, leaving stale promoted recoveries pointing at the\n overwritten slots. Apply the same killHeaps() calls before each replacement.\n\n2. DFG arguments-elimination interference analysis must disqualify a candidate\n whose source-frame stack slots are clobbered while the candidate is still\n OSR-live. It establishes the candidate's live range using\n forAllKilledNodesAtNodeIndex() plus CombinedLiveness::liveAtTail.\n liveAtTail was computed only as the union of CFG successors' liveAtHead,\n each of which is pruned by bytecode liveness at the successor's first node.\n A candidate that is OSR-live at the block's terminal node but whose\n backing local is bytecode-dead at every CFG successor e.g.\n\n ```\n // block 1\n let a = ...;\n try {\n foo();\n } catch (e) {\n // block 2\n use(a);\n }\n // block 3\n ```\n\n Since DFG does not directly model exceptional control flow in the CFG\n `a` would be absent from the CFG/bytecode at block 3 and therefore absent\n from block 1's liveAtTail, so removeViaKill() would never be called on `a`.\n\nNote: For 2, we don't include the bytecodeLiveness for the tail of\nCombinedLiveness because this is both misleading with respect to how tail is\nused in the rest of the DFG. Additionally, it breaks ObjectAllocationSinking.\nObjectAllocationSinking propagates its heap by pruning at each tail with\nliveAtTail then merging into successors. Since we don't prune at the head we\ncan end up pushing phantom allocations into blocks where they don't actually\ndominate.\n\nTests: JSTests/stress/arguments-elimination-inlined-load-varargs-preserves-recoveries.js\n JSTests/stress/arguments-elimination-load-varargs-kills-promoted-recoveries.js\n\nOriginally-landed-as: 305413.1062@safari-7624.5-branch (6c004fb89bd7). rdar://185367795\nCanonical link: https://commits.webkit.org/320072@main", "email": "keith_miller@apple.com", "hash": "26aa84fcd527016df60838ccc19c722f39b6b68a", "subject": "OSR Availability Fails to Invalidate Local Recoveries Across LoadVarargs" }, "320073@main": { "author": "Kiet Ho", "avatar": "https://www.gravatar.com/avatar/d9058b37006dce1f55f91b8ccc82f9a3?d=identicon\u0026s=64", "cl": "320073@main", "clUrl": "https://commits.webkit.org/320073@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318372\nrdar://175759731\n\nReviewed by Simon Fraser.\n\nCanvasRenderingContext2D::fontProxy() returns the pointer to State::font\n(a FontProxy) of the top State in the state stack. State stores the\nFontProxy by value, so the FontProxy goes away when the State is deallocated.\nThis could happen when the state stack (a Vector\u003cState, 1\u003e) grows beyond\nthe storage buffer: a new buffer is created, existing State objects are\ncopied/moved to the new buffer and the old copies deallocated. Hence,\npointers returned by fontProxy() aren't safe to be re-used, because\nbetween the time when the pointer is obtained and when it's used, some\noperations might've manipulated the state stack and caused the FontProxy\nto go away.\n\nCanvasRenderingContext2DBase::drawTextUnchecked is one place where it happens:\nit (1) holds on to the font cascade from the FontProxy returned by fontProxy(),\n(2) creates a CanvasFilterContextSwitcher, whose constructor calls save() which\nmanipulates the state stack, then (3) uses the saved font cascade from the\nFontProxy which might have been deallocated:\n\nvoid CanvasRenderingContext2DBase::drawTextUnchecked(...)\n{\n auto\u0026 fontCascade = this-\u003efontProxy()-\u003efontCascade(); \u003c-- (1)\n\n [...]\n auto targetSwitcher = CanvasFilterContextSwitcher::create(*this, textRect); \u003c-- (2)\n\n [...]\n auto drawText = [\u0026](...) {\n [...]\n fontCascade.drawGlyphBuffer(...); \u003c-- (3)\n\n(actually, 317546@main indirectly fixes this by avoiding saving state when\ncreating CanvasFilterContextSwitcher. But as explained above, re-using fontCascade\nis unsafe, so this patch still has merits, even though it's not fixing anything)\n\nFix this by not holding onto pointers returned by fontProxy(). Instead, whenever\nthe FontProxy is needed, call fontProxy() so we're guaranteed to have a pointer\nto a live FontProxy. Additionally, FontCascade can be made CheckedPtr, so wrap\nit in CheckedPtr/CheckedRef whenever possible.\n\nFuture patches could improve on this by making FontProxy ref-counted, so the\npointer returned by fontProxy() is guaranteed to be alive no matter how the\nState object storing it is copied/moved around.\n\nTest: fast/canvas/canvas-filter-fillText-crash.html\n\n* LayoutTests/fast/canvas/canvas-filter-fillText-crash-expected.txt: Added.\n* LayoutTests/fast/canvas/canvas-filter-fillText-crash.html: Added.\n* Source/WebCore/SaferCPPExpectations/UncheckedLocalVarsCheckerExpectations:\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:\n(WebCore::CanvasRenderingContext2DBase::drawTextUnchecked):\n\nOriginally-landed-as: 305413.1097@safari-7624.5-branch (1d58c6a24867). rdar://175759731\nCanonical link: https://commits.webkit.org/320073@main", "email": "kiet.ho@apple.com", "hash": "f0d5be8210e3d8c5ac5fd6c86e86195b64cf7bb9", "subject": "CanvasRenderingContext2DBase::drawTextUnchecked: don't re-use pointer returned by fontProxy()" }, "320074@main": { "author": "Jessica Lee", "avatar": "https://www.gravatar.com/avatar/fc717c99321d09f31fb9187418a8ffc5?d=identicon\u0026s=64", "cl": "320074@main", "clUrl": "https://commits.webkit.org/320074@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322764\nrdar://179995976\n\nReviewed by Sihui Liu and Per Arne Vollan.\n\nThese macros are no longer needed.\n\nThere is a previous behavior change for WebParentalControlsURLFilter::requestPermissionForURL as we no longer fall\nback to using the legacy flow of requestPermissionForURL if the BrowserEngineKit API requestPermissionForURL\nis unavailable as we did with the macro. This was deemed acceptable as this filtering flow is only available\non iOS27 and all macOS/iOS27 platforms should have the latest BrowserEngineKit API's.\n\nNo new tests needed.\n\n* Source/WebKit/Shared/ios/WebParentalControlsURLFilter.mm:\n(WebKit::WebParentalControlsURLFilter::isURLAllowedImpl):\n(WebKit::WebParentalControlsURLFilter::requestPermissionForURL):\n\nCanonical link: https://commits.webkit.org/320074@main", "email": "jlee53@apple.com", "hash": "dd8d64894febdb0f0eab97e19fc951317f23b4cc", "subject": "Remove MAYBE_EVALUATE_URL_WITH_TRANSITIVE_TRUST and MAYBE_REQUEST_PERMISSION_ASK_TO macros" }, "320075@main": { "author": "Sean Patterson", "avatar": "https://www.gravatar.com/avatar/b19318d92b64ac7809b78670c03b0f1e?d=identicon\u0026s=64", "cl": "320075@main", "clUrl": "https://commits.webkit.org/320075@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322511\n\nReviewed by Tim Nguyen.\n\nRe-import LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing with\nTools/Scripts/import-w3c-tests, and rebaseline.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/c782dc74987a77da4e881042fa919bf7f03d21cd\n\n319770@main refreshed the three alignment-baseline tests in this directory; the rest\nof it was still stale. Five files change here, and the new assertions record two\nexisting feature gaps rather than any change in behaviour:\n\n- baseline-shift-valid.html and baseline-shift-computed.html gained top, center and\n bottom, which moved onto baseline-shift in w3c/csswg-drafts#5180. WebKit does not\n support them: 6 new expected FAILs, tracked by bug 322465.\n- vertical-align-valid.html and vertical-align-computed.html were rewritten for the\n css-inline-3 shorthand grammar. WebKit implements only the CSS 2 grammar, so the\n shorthand forms, the baseline-source and alignment-baseline components reached\n through it, and canonical multi-value serialization all fail: 29 new expected\n FAILs, tracked by bug 322464.\n\nTwo subtests newly pass: vertical-align-invalid.html now asserts that\nvertical-align: auto is invalid, which WebKit correctly rejects, and\nvertical-align-valid.html adds 0.5em, which WebKit accepts.\n\nOne subtest goes from PASS to FAIL: vertical-align: 0. That is an assertion change,\nnot a regression -- under the shorthand grammar 0 is equivalent to baseline and\nupstream now requires it to serialize canonically as \"baseline\", where WebKit\nserializes \"0px\". No expected FAIL lines are removed, and no subtest regresses for\nany other reason.\n\nThe wider css/css-inline tree is deliberately out of scope: it holds 204 reftests,\nwhose resync belongs in its own change.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/baseline-shift-computed-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/baseline-shift-valid-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-computed-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-invalid-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-inline/parsing/vertical-align-valid-expected.txt:\n\nCanonical link: https://commits.webkit.org/320075@main", "email": "sean_patterson@apple.com", "hash": "1a0fe8e3886c356284628feb8e172fb91efa3052", "subject": "Resync `css/css-inline/parsing` from WPT Upstream" }, "320076@main": { "author": "Yoav Weiss", "avatar": "https://www.gravatar.com/avatar/228600d5a1cfae576e64ee92e46f6a1e?d=identicon\u0026s=64", "cl": "320076@main", "clUrl": "https://commits.webkit.org/320076@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322828\n\nReviewed by Alex Christensen.\n\nThe EarlyHintsResourceLoader doesn't add a ton of value. This PR folds its functionality into NetworkResourceLoader.\n\nNo new tests, as this is a refactoring-only PR.\n\n* Source/WebKit/NetworkProcess/EarlyHintsResourceLoader.cpp: Removed.\n* Source/WebKit/NetworkProcess/EarlyHintsResourceLoader.h: Removed.\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:\n(WebKit::NetworkResourceLoader::didReceiveInformationalResponse): Call handleEarlyHintsResponse.\n(WebKit::NetworkResourceLoader::handleEarlyHintsResponse): Process EarlyHint Link headers.\n(WebKit::NetworkResourceLoader::constructPreconnectRequest): Create a ResourceRequest for preconnect purposes.\n(WebKit::NetworkResourceLoader::startPreconnectTask): Kick off a preconnect.\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.h:\n* Source/WebKit/Sources.txt:\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Source/WebKit/NetworkProcess/NetworkLoad.cpp: Address safer C++ issues.\n(WebKit::NetworkLoad::~NetworkLoad):\n(WebKit::NetworkLoad::setPendingDownloadID):\n(WebKit::NetworkLoad::setPendingDownload):\n(WebKit::NetworkLoad::attributedBundleIdentifier):\n(WebKit::NetworkLoad::bytesTransferredOverNetwork const):\n\nCanonical link: https://commits.webkit.org/320076@main", "email": "yoav.weiss@shopify.com", "hash": "33a2d0520bab9ffc18aeebe94dfc166b2da966ff", "subject": "Fold EarlyHintsResourceLoader into NetworkResourceLoader." }, "320077@main": { "author": "Ian Gower", "avatar": "https://www.gravatar.com/avatar/cc2e677bc728b92e5463660d8b8d9ed8?d=identicon\u0026s=64", "cl": "320077@main", "clUrl": "https://commits.webkit.org/320077@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322661\nrdar://185933660\n\nReviewed by Chris Dumez.\n\nPart of the Local Network Access implementation, https://wicg.github.io/local-network-access/ - the\ncheck compares the address space a connection resolved to against the client's, so that space has to\nsurvive being written to the network cache.\n\nResourceResponse carries the address space the connection resolved to, but it was dropped on the way\nto disk: neither persistence coder encoded it, and the ResourceResponseData decoder hardcoded\nIPAddressSpace::Unknown. A response read back from the network cache therefore lost the space its\nconnection had originally resolved to.\n\nBoth coders now encode and decode it, and EnumTraitsForPersistence is declared for IPAddressSpace so\nthe enum can be persisted at all. The cache version is bumped, since existing entries were written\nwithout the field and cannot be read back with it.\n\nCache::update() takes the space from the validating response rather than keeping the stored one. The\nbody is reused on a 304, but the resource is being served now from the validating connection, and a\nhost that has since moved to a local address must not be reachable on the address space it used to\nhave.\n\nTwo tests cover the coders separately, across all four enum values. Reverting either coder fails only\nits own test.\n\n* Source/WebCore/platform/WebCorePersistentCoders.cpp:\n(WTF::Persistence::Coder\u003cWebCore::ResourceResponse\u003e::encodeForPersistence):\n(WTF::Persistence::Coder\u003cWebCore::ResourceResponse\u003e::decodeForPersistence):\n* Source/WebCore/platform/network/ResourceResponseBase.cpp:\n(WTF::Persistence::Coder\u003cWebCore::ResourceResponseData\u003e::encodeForPersistence):\n(WTF::Persistence::Coder\u003cWebCore::ResourceResponseData\u003e::decodeForPersistence):\n* Source/WebCore/platform/network/ResourceResponseBase.h:\n* Source/WebKit/NetworkProcess/cache/NetworkCache.cpp:\n(WebKit::NetworkCache::Cache::update):\n* Source/WebKit/NetworkProcess/cache/NetworkCacheStorage.h:\n* Tools/TestWebKitAPI/Tests/WebCore/IPAddressSpaceTests.cpp:\n\nCanonical link: https://commits.webkit.org/320077@main", "email": "i_gower@apple.com", "hash": "bc7a9e0619dd06c2f3332aaf5ca1ea1e612640d2", "subject": "Persist the resolved IP address space with a cached response" }, "320078@main": { "author": "Sam Weinig", "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64", "cl": "320078@main", "clUrl": "https://commits.webkit.org/320078@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322599\n\nReviewed by Darin Adler and Taher Ali.\n\nUnify naming of zoom applying/unapplying functions to:\n - applyingZoom\u003cT\u003e(...)\n - unapplyingZoom\u003cT\u003e(...)\n\nMaking the type required makes it more clear at call sites\nwhat conversions are happening. The previous behavior of\ntruncating to int when using the base function was unclear.\n\n* Source/WebCore/css/query/ContainerQueryFeatures.cpp:\n* Source/WebCore/css/query/MediaQueryFeatures.cpp:\n* Source/WebCore/dom/Document.cpp:\n* Source/WebCore/dom/Element.cpp:\n* Source/WebCore/dom/ImageOverlay.cpp:\n* Source/WebCore/dom/ViewTransition.cpp:\n* Source/WebCore/html/HTMLImageElement.cpp:\n* Source/WebCore/html/ImageInputType.cpp:\n* Source/WebCore/inspector/InspectorOverlay.cpp:\n* Source/WebCore/page/ResizeObservation.cpp:\n* Source/WebCore/style/StyleExtractor.cpp:\n* Source/WebCore/style/values/viewport/StyleZoomPrimitives.h:\n* Source/WebCore/style/values/viewport/StyleZoomPrimitivesInlines.h:\n\nCanonical link: https://commits.webkit.org/320078@main", "email": "sam@webkit.org", "hash": "084154b27a5c5184b5cb401c9b6916d71a4d120d", "subject": "Unify naming of zoom applying/unapplying functions" }, "320079@main": { "author": "Cole Carley", "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64", "cl": "320079@main", "clUrl": "https://commits.webkit.org/320079@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322857\nrdar://186099985\n\nReviewed by Brent Fulgham.\n\nQuirkMatch is almost a generic URL matcher, but it has ties to the\nway we want to match for site specific Quirks. This refactor\nsevers those ties, which results in a flexible new URLMatch class.\n\nThe refactor also simplified the implementation of the URLMatch\nclass. The site specific Quirk matching logic is now held in a\nsmall wrapper class called QuirkURLMatch.\n\nThis patch was motivated by the inability to use the old QuirkMatch\nclass with just a singular URL, which is needed for the static\nQuirks declared in Quirks.h.\n\nTests: Tools/TestWebKitAPI/Tests/WebCore/Quirks.cpp\n Tools/TestWebKitAPI/Tests/WebCore/URLMatch.cpp\n\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/page/QuirkTable.cpp:\n(WebCore::QuirkURLMatch::matches const):\n(WebCore::resolveSiteSpecificQuirks):\n* Source/WebCore/page/QuirkTable.h:\n(WebCore::QuirkURLMatch::QuirkURLMatch):\n(WebCore::QuirkURLMatch::embeddedDocument):\n(WebCore::QuirkURLMatch::embeddedDocumentInTopMatch):\n* Source/WebCore/page/Quirks.cpp:\n* Source/WebCore/page/URLMatch.cpp: Renamed from Source/WebCore/page/QuirkMatch.cpp.\n(WebCore::URLMatchContext::registrableDomain const):\n(WebCore::URLMatchContext::domainWithoutPublicSuffix const):\n(WebCore::evaluateURLEnvironment):\n(WebCore::URLMatch::RefinementSet::matchesPathPattern const):\n(WebCore::URLMatch::RefinementSet::matches const):\n(WebCore::URLMatch::matchesURL const):\n(WebCore::URLMatch::matches const):\n* Source/WebCore/page/URLMatch.h: Renamed from Source/WebCore/page/QuirkMatch.h.\n(WebCore::URLMatchContext::URLMatchContext):\n(WebCore::URLPatternList::URLPatternList):\n(WebCore::URLPatternList::isEmpty const):\n(WebCore::URLPatternList::contains const):\n(WebCore::URLPatternList::containsMatching const):\n(WebCore::URLRefinement::pathContains):\n(WebCore::URLRefinement::pathStartsWith):\n(WebCore::URLRefinement::pathOrFragmentContains):\n(WebCore::URLRefinement::hostIs):\n(WebCore::URLRefinement::smallScreen):\n(WebCore::URLRefinement::tubularApp):\n(WebCore::URLRefinement::lensApp):\n(WebCore::URLMatch::domain):\n(WebCore::URLMatch::host):\n(WebCore::URLMatch::hostOrSubdomainOf):\n(WebCore::URLMatch::anyTopLevelDomain):\n(WebCore::URLMatch::anyURL):\n(WebCore::URLMatch::when):\n(WebCore::URLMatch::exceptWhen):\n(WebCore::URLMatch::setPathPattern):\n(WebCore::URLMatch::applyRefinement):\n(WebCore::URLMatch::URLMatch):\n* Tools/TestWebKitAPI/CMakeLists.txt:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebCore/QuirkMatch.cpp: Removed.\n* Tools/TestWebKitAPI/Tests/WebCore/Quirks.cpp:\n(TestWebKitAPI::resolveQuirksForTopURL):\n(TestWebKitAPI::resolveQuirksForEmbeddedDocument):\n(TestWebKitAPI::matchesTopURL):\n(TestWebKitAPI::matchesEmbeddedDocument):\n(TestWebKitAPI::TEST_F(QuirksTest, TopURLMatchIgnoresTheDocumentURL)):\n(TestWebKitAPI::TEST_F(QuirksTest, EmbeddedDocumentMatchesTheDocumentURLNotTheTopURL)):\n(TestWebKitAPI::TEST_F(QuirksTest, EmbeddedDocumentInTopMatchRequiresBothURLsToMatch)):\n(TestWebKitAPI::TEST_F(QuirksTest, EmbeddedMatchesNeverApplyToTheTopDocument)):\n(TestWebKitAPI::TEST_F(QuirksTest, EmbeddedQuirksResolveFromTheDocumentURL)):\n* Tools/TestWebKitAPI/Tests/WebCore/URLMatch.cpp: Added.\n(TestWebKitAPI::matchesURL):\n(TestWebKitAPI::TEST(URLMatchTest, DomainMatchesRegistrableDomain)):\n(TestWebKitAPI::TEST(URLMatchTest, DomainUnderstandsMultiLabelPublicSuffixes)):\n(TestWebKitAPI::TEST(URLMatchTest, DomainsMatchesAnyPatternInTheList)):\n(TestWebKitAPI::TEST(URLMatchTest, HostMatchesExactHostOnly)):\n(TestWebKitAPI::TEST(URLMatchTest, HostOrSubdomainOfRespectsLabelBoundaries)):\n(TestWebKitAPI::TEST(URLMatchTest, HostOrSubdomainOfCoversShardedHosts)):\n(TestWebKitAPI::TEST(URLMatchTest, AnyTopLevelDomainMatchesEveryPublicSuffix)):\n(TestWebKitAPI::TEST(URLMatchTest, PathContainsMatchesAnywhereInThePath)):\n(TestWebKitAPI::TEST(URLMatchTest, PathStartsWithIsAnchored)):\n(TestWebKitAPI::TEST(URLMatchTest, PathOrFragmentContainsSearchesBoth)):\n(TestWebKitAPI::TEST(URLMatchTest, EnvironmentIsANDedWithTheSiteMatch)):\n(TestWebKitAPI::TEST(URLMatchTest, AnyURLMatchesEverySiteWithoutFurtherRefinement)):\n(TestWebKitAPI::TEST(URLMatchTest, ExceptWhenCarvesOutPagesOfAMatchedSite)):\n(TestWebKitAPI::TEST(URLMatchTest, ExceptWhenCarvesOutHostsOfAMatchedSite)):\n(TestWebKitAPI::TEST(URLMatchTest, ExceptWhenCarvesOutASingleHost)):\n(TestWebKitAPI::TEST(URLMatchTest, HostIsNarrowsAMatchToOneHost)):\n(TestWebKitAPI::TEST(URLMatchTest, ExceptWhenAndTheMatchKeepSeparateRefinements)):\n(TestWebKitAPI::TEST(URLMatchTest, EnvironmentStacksWithAPathRefinement)):\n(TestWebKitAPI::TEST(URLMatchTest, HostsWithoutAPublicSuffixFallBackToTheHost)):\n(TestWebKitAPI::TEST(URLMatchTest, URLsWithoutAHostMatchNothing)):\n(TestWebKitAPI::TEST(URLMatchTest, ContextDerivesValuesFromItsURL)):\n(TestWebKitAPI::TEST(URLMatchTest, ContextCachesDerivedValues)):\n\nCanonical link: https://commits.webkit.org/320079@main", "email": "ccarley2@apple.com", "hash": "937b1dde4169fcf3e7d28b7f22884c6f30092640", "subject": "[Quirks] Make QuirkMatch a generic URL matcher" }, "320080@main": { "author": "Brent Fulgham", "avatar": "https://www.gravatar.com/avatar/c6989a65afef0d015b55c65406e37ccc?d=identicon\u0026s=64", "cl": "320080@main", "clUrl": "https://commits.webkit.org/320080@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322854\nrdar://186097567\n\nUnreviewed re-sync with WPT after landing upstream fix.\n\nI forgot to push a local fix upstream:\n https://github.com/web-platform-tests/wpt/commit/aa609de82b6914e5308cb01b2fc0828b23bc2336\n\nThat has now been corrected, so resyncing locally:\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/073a34f030ad68af980d7a627e829900b003961b\n\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-open-movebefore-setup-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-open-movebefore-setup.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inert-svg-hittest-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/inert-svg-hittest.html:\n\nCanonical link: https://commits.webkit.org/320080@main", "email": "bfulgham@apple.com", "hash": "37966e503a143192cb90918fb1d8af70ef42d9a3", "subject": "[Interop 2026] Correct two Dialogs and Popover failures after WPT sync" } }, "date": "2026-08-28", "days": 1, "generatedAt": "2026-08-28T22:06:08Z", "markdown": "## Highlights\n- **Security** Fixed an out-of-bounds write in APNG ICC conversion, closing a real image decoding memory safety bug. [commit 320038@main](https://commits.webkit.org/320038@main)\n- **Security** Fixed an out-of-bounds write in WebRTC frame copying for odd-width I420 and I010 video frames. [commit 320009@main](https://commits.webkit.org/320009@main)\n- **Networking** Cached responses now persist resolved IP address space, tightening correctness for address-space aware fetch behavior. [commit 320077@main](https://commits.webkit.org/320077@main)\n- **Perf** Coalesced per-rendering-update frame geometry IPCs for Site Isolation, cutting IPC chatter on rendering updates. [commit 320043@main](https://commits.webkit.org/320043@main)\n- **Perf** Moved part of screen property collection off the main path to a background thread, reducing synchronous work. [commit 320060@main](https://commits.webkit.org/320060@main)\n- **Web Platform** Landed `text-overflow: \u003cstring\u003e`, expanding standards coverage for custom overflow markers. [commit 320023@main](https://commits.webkit.org/320023@main)\n- **Web Platform** Added percentage support for `text-decoration-inset`, improving CSS Text Decoration Level 4 compatibility. [commit 320052@main](https://commits.webkit.org/320052@main)\n- **V8** JavaScriptCore's Wasm work kept moving fast with wider block type fixes, ESM correctness, and more inlining in hot paths. [commit 320071@main](https://commits.webkit.org/320071@main)\n- **A11y** Fixed isolated tree text marker whitespace handling and text replacement indexing, improving macOS accessibility text fidelity. [commit 320019@main](https://commits.webkit.org/320019@main)\n- **UI** Fixed gesture-driven back and forward navigation regression in AppKit swipe navigation. [commit 320017@main](https://commits.webkit.org/320017@main)\n\n## What landed by area\n\n### JavaScriptCore and Wasm\n- **V8** Fixed OSR availability invalidation across `LoadVarargs`, addressing a JIT correctness hole. [commit 320072@main](https://commits.webkit.org/320072@main)\n- **V8** Wasm argument and result block types now always widen, aligning validation behavior. [commit 320071@main](https://commits.webkit.org/320071@main)\n- **V8** Added coverage for elem kind 6 initialized from `global.get` in Wasm. [commit 320062@main](https://commits.webkit.org/320062@main)\n- **V8** Stopped restoring `wasmBoundsCheckingSizeRegister` as a callee save in Wasm. [commit 320061@main](https://commits.webkit.org/320061@main)\n- **V8** Reserved `wasm:` and `wasm-js:` names now correctly throw `LinkError` in Wasm ESM. [commit 320059@main](https://commits.webkit.org/320059@main)\n- **V8** Wasm ESM mutable globals now behave as live unwrapped bindings. [commit 320058@main](https://commits.webkit.org/320058@main)\n- **V8** Empty `WebAssembly.Module` now expects `CompileError`, tightening spec conformance. [commit 320057@main](https://commits.webkit.org/320057@main)\n- **V8** Filling Wasm ref arrays now avoids per-element `set()`, improving bulk initialization cost. [commit 320056@main](https://commits.webkit.org/320056@main)\n- **V8** Added a fast path for `i31ref` in the JS-to-Wasm entry stub. [commit 320055@main](https://commits.webkit.org/320055@main)\n- **V8** Inlined `ref.func` in Wasm. [commit 320054@main](https://commits.webkit.org/320054@main)\n- **V8** Custom section name comparison in Wasm now avoids allocating a `String`. [commit 320053@main](https://commits.webkit.org/320053@main)\n- **V8** Delegate op now widens types like `End`, fixing Wasm typing behavior. [commit 320048@main](https://commits.webkit.org/320048@main)\n- **V8** Inlined BBQ `array.new_default` for `v128`. [commit 320027@main](https://commits.webkit.org/320027@main)\n- **V8** Unreachable end ops no longer widen result types in Wasm. [commit 320018@main](https://commits.webkit.org/320018@main)\n- **V8** Updated JSC profiles concurrently from GC marker threads. [commit 320012@main](https://commits.webkit.org/320012@main)\n- **V8** Stored the DFG `VariableEventStream` as a byte stream to reduce overhead. [commit 320007@main](https://commits.webkit.org/320007@main)\n- **V8** Inlined `table.size` in Wasm. [commit 320004@main](https://commits.webkit.org/320004@main)\n- **V8** Inlined `table.get` for `externref` and `anyref` in Wasm. [commit 320002@main](https://commits.webkit.org/320002@main)\n- **DevTools** Re-landed Mya and `libJavaScriptCoreTools`, bringing back the memory analysis tooling work. [commit 320025@main](https://commits.webkit.org/320025@main)\n\n### CSS, layout, and rendering\n- **Rendering** Synced popover-related WPT coverage for Interop 2026 work. [commit 320065@main](https://commits.webkit.org/320065@main)\n- **Rendering** Fixed `corner-shape` clipping so `backdrop-filter` respects non-rounded corner geometry. [commit 320063@main](https://commits.webkit.org/320063@main)\n- **Web Platform** Added percentage support for `text-decoration-inset`. [commit 320052@main](https://commits.webkit.org/320052@main)\n- **Rendering** Fixed negative `text-decoration-inset` clipping when decoration propagates to descendant inline boxes. [commit 320044@main](https://commits.webkit.org/320044@main)\n- **Web Platform** Scroll animation timeline names now match loosely, improving spec behavior. [commit 320040@main](https://commits.webkit.org/320040@main)\n- **Rendering** Fixed a page freeze caused by `calc(infinity * 1s)` in CSS transition duration. [commit 320034@main](https://commits.webkit.org/320034@main)\n- **Web Platform** Added support for `text-overflow: \u003cstring\u003e`. [commit 320023@main](https://commits.webkit.org/320023@main)\n- **Web Platform** Registered CSS mixin function arguments now evaluate in the calling context. [commit 320022@main](https://commits.webkit.org/320022@main)\n- **Web Platform** `:target` now keeps matching when the target element is removed and reinserted. [commit 320021@main](https://commits.webkit.org/320021@main)\n- **Rendering** Fixed `background-size: cover` painting for SVG images with extreme natural aspect ratios. [commit 320008@main](https://commits.webkit.org/320008@main)\n- **Rendering** Unified naming for zoom apply and unapply functions, a cleanup in rendering code. [commit 320078@main](https://commits.webkit.org/320078@main)\n- **Rendering** Resynced `css/css-inline/parsing` tests from upstream WPT. [commit 320075@main](https://commits.webkit.org/320075@main)\n\n### Networking, loading, and process model\n- **Networking** Persisted resolved IP address space with cached responses. [commit 320077@main](https://commits.webkit.org/320077@main)\n- **Networking** Folded `EarlyHintsResourceLoader` into `NetworkResourceLoader`, simplifying early hints loading flow. [commit 320076@main](https://commits.webkit.org/320076@main)\n- **Perf** Coalesced per-rendering-update frame geometry IPCs in Site Isolation. [commit 320043@main](https://commits.webkit.org/320043@main)\n- **Perf** Dispatch queues are now created with autorelease pools, tightening runtime memory behavior. [commit 320042@main](https://commits.webkit.org/320042@main)\n- **Networking** CFNetwork now honors `Expires` cookie dates using JS `Date.toString()` month-before-day formatting. [commit 320016@main](https://commits.webkit.org/320016@main)\n\n### Media, graphics, and GPU\n- **Media** Fixed ESPN full-screen exit behavior on iPhone where resume stopped working after video paused. [commit 320051@main](https://commits.webkit.org/320051@main)\n- **Media** Marked `media-source-video-renders.html` as a constant ImageOnly failure for tracking and triage. [commit 320050@main](https://commits.webkit.org/320050@main)\n- **Rendering** Fixed viewport clipping issues in LBSE. [commit 320045@main](https://commits.webkit.org/320045@main)\n- **Security** Fixed an out-of-bounds write in APNG ICC conversion on non-Cocoa builds. [commit 320038@main](https://commits.webkit.org/320038@main)\n- **GPU** Fixed a typo in `WGSL::Types::Primitive` and `WGSL::nameForPrimitiveKind`. [commit 320037@main](https://commits.webkit.org/320037@main)\n- **Media** Added frame cycle breakdown analysis in `webkit-sysprof`. [commit 320029@main](https://commits.webkit.org/320029@main)\n- **Rendering** Removed unused `BitmapTexture::Flags::DepthBuffer` from TextureMapper. [commit 320020@main](https://commits.webkit.org/320020@main)\n- **Security** Fixed an out-of-bounds write in WebRTC `copyVideoFrameBuffer` for odd-width formats. [commit 320009@main](https://commits.webkit.org/320009@main)\n- **GPU** Switched image pixel conversion lookup to a compile-time table and fixed `BGRX8`. [commit 320005@main](https://commits.webkit.org/320005@main)\n\n### Accessibility and UI behavior\n- **A11y** In isolated tree mode, fixed `AXStringForTextMarkerRange` unexpectedly including whitespace at soft line breaks. [commit 320019@main](https://commits.webkit.org/320019@main)\n- **UI** Fixed gesture-driven swipe back and forward navigation regression on AppKit. [commit 320017@main](https://commits.webkit.org/320017@main)\n- **A11y** Fixed `AXReplaceRangeWithText` inserting text at the wrong index. [commit 320013@main](https://commits.webkit.org/320013@main)\n- **A11y** Fixed `AXTextMarkerRangeForUIElement` so native text controls expose their value instead of a replaced object wrapper. [commit 320011@main](https://commits.webkit.org/320011@main)\n- **UI** Web events and subclasses are now always heap-allocated, tightening object lifetime assumptions. [commit 320030@main](https://commits.webkit.org/320030@main)\n\n### DOM, editing, and quirks\n- **Refactor** Made `QuirkMatch` a generic URL matcher, broadening the quirks matching utility. [commit 320079@main](https://commits.webkit.org/320079@main)\n- **Web Platform** Added new `ChildChange` types for `moveBefore`. [commit 320069@main](https://commits.webkit.org/320069@main)\n- **Refactor** Changed `movingSteps` `isSubtreeRoot` from a bool-like parameter to an enum. [commit 320068@main](https://commits.webkit.org/320068@main)\n- **Refactor** Removed unused quirks function declarations. [commit 320070@main](https://commits.webkit.org/320070@main)\n\n### Build, platform, and infrastructure\n- **Refactor** Removed `MAYBE_EVALUATE_URL_WITH_TRANSITIVE_TRUST` and `MAYBE_REQUEST_PERMISSION_ASK_TO` macros. [commit 320074@main](https://commits.webkit.org/320074@main)\n- **Perf** Moved part of `collectScreenProperties` to a background thread. [commit 320060@main](https://commits.webkit.org/320060@main)\n- **Refactor** Refactored `RunJavaScriptResult` into a standalone typed using declaration. [commit 320064@main](https://commits.webkit.org/320064@main)\n- **Build** Updated `sync-commits.py` in perf.webkit.org to support Canonical-link. [commit 320067@main](https://commits.webkit.org/320067@main)\n- **Build** Added a Swift bridging mechanism to create `std::expected` values. [commit 320032@main](https://commits.webkit.org/320032@main)\n- **Build** Added monado packages to the GLib system dependency list. [commit 320035@main](https://commits.webkit.org/320035@main)\n- **Build** Unskipped `ipc/serialized-type-info.html` on GLib. [commit 320031@main](https://commits.webkit.org/320031@main)\n- **Build** Fixed a GLib failure in `css-values/ch-unit-017.html`. [commit 320028@main](https://commits.webkit.org/320028@main)\n- **Build** Fixed compilation with `WK_WEB_EXTENSIONS_OFFSCREEN` on iOS. [commit 320015@main](https://commits.webkit.org/320015@main)\n- **Refactor** Dropped `RefCounted`'s adoption requirement assertion. [commit 320014@main](https://commits.webkit.org/320014@main)\n- **Build** Fixed `webkitbugspy` issue relation removal. [commit 320010@main](https://commits.webkit.org/320010@main)\n- **Build** `Package.is_cached()` now uses exact version matching. [commit 320006@main](https://commits.webkit.org/320006@main)\n- **Refactor** Creating or destroying a `ThreadSafeWeakPtr` is now considered no-delete. [commit 320039@main](https://commits.webkit.org/320039@main)\n- **Refactor** Destroying a `WeakPtr` is now considered no-delete. [commit 320003@main](https://commits.webkit.org/320003@main)\n- **Build** Updated safer C++ expectations. [commit 320001@main](https://commits.webkit.org/320001@main)\n- **Perf** Inlined `PAS_MTE_HANDLE` forms that resolve to `PAS_MTE_CLEAR*` in libpas. [commit 320000@main](https://commits.webkit.org/320000@main)\n- **Build** Fixed Xlib macro conflicts causing build failures. [commit 319999@main](https://commits.webkit.org/319999@main)\n- **Build** Passed the correct linker prefix on PlayStation. [commit 320036@main](https://commits.webkit.org/320036@main)\n\n### Web compatibility and site fixes\n- **UI** Fixed GitHub comment UI where emoji reactions overlapped code blocks. [commit 320066@main](https://commits.webkit.org/320066@main)\n- **Web Platform** Corrected two Dialog and Popover failures after WPT sync for Interop 2026. [commit 320080@main](https://commits.webkit.org/320080@main)\n\n### Test gardening and stability\n- **Build** Added test gardening for a constant macOS Debug subgrid crash. [commit 320047@main](https://commits.webkit.org/320047@main)\n- **Build** Added duplicate test gardening for the same constant macOS Debug subgrid crash tracking. [commit 320046@main](https://commits.webkit.org/320046@main)\n- **Build** Added gardening for a Tahoe encrypted-media crash regression. [commit 320041@main](https://commits.webkit.org/320041@main)\n- **Build** Landed GTK and WPE gardening updates for 2026-08-28. [commit 320033@main](https://commits.webkit.org/320033@main)\n\n## Reverts \u0026 Reapplies\n- **Refactor** Re-landed Mya and `libJavaScriptCoreTools` after an earlier rollback. [commit 320025@main](https://commits.webkit.org/320025@main)", "repo": "webkit", "repoDisplay": "WebKit", "rollGroups": [ { "name": "Unreviewed", "count": 2 } ], "since": "2026-08-28", "totals": { "commits": 82, "features": 80, "rolls": 2 }, "until": "2026-08-28" }