{
  "commits": {
    "320081@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/3d43be18ce5ee6b92ba9151b63591125?d=identicon\u0026s=64",
      "cl": "320081@main",
      "clUrl": "https://commits.webkit.org/320081@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322677\n\nReviewed by Chris Dumez.\n\nSeveral HTMLVideoElement accessors called player() two-to-four times, each\nprotect(player()) constructing a fresh RefPtr (ref/deref churn) on hot paths.\nCache one RefPtr player = this-\u003eplayer() per function and reuse it. This also\nnormalizes webkitDecodedFrameCount()/webkitDroppedFrameCount(), which\npreviously dereferenced the raw pointer without protecting it.\n\nNo change in behavior.\n\n* Source/WebCore/html/HTMLVideoElement.cpp:\n(WebCore::HTMLVideoElement::supportsAcceleratedRendering const):\n(WebCore::HTMLVideoElement::supportsFullscreen const):\n(WebCore::HTMLVideoElement::videoWidth const):\n(WebCore::HTMLVideoElement::videoHeight const):\n(WebCore::HTMLVideoElement::webkitDecodedFrameCount const):\n(WebCore::HTMLVideoElement::webkitDroppedFrameCount const):\n\nCanonical link: https://commits.webkit.org/320081@main",
      "email": "ahmad.saleem792@gmail.com",
      "hash": "1458014dcd4499f3fbf200aa18c711c7f8d5fc70",
      "subject": "HTMLVideoElement::player() is called and protected redundantly in several accessors"
    },
    "320082@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/3d43be18ce5ee6b92ba9151b63591125?d=identicon\u0026s=64",
      "cl": "320082@main",
      "clUrl": "https://commits.webkit.org/320082@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322678\n\nReviewed by Chris Dumez.\n\nisSafeToLoadURL() called isIPAddressDisallowed(url) once in the guard\ncondition and again when selecting the error message to log. That\nfunction parses the URL host via IPAddress::fromString() on each call,\nso hoist the result into a local bool and reuse it.\n\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::isSafeToLoadURL const):\n\nCanonical link: https://commits.webkit.org/320082@main",
      "email": "ahmad.saleem792@gmail.com",
      "hash": "77a6c78d0dcecbc33602cfcd69f2469fb89185b7",
      "subject": "HTMLMediaElement::isSafeToLoadURL() computes isIPAddressDisallowed() twice"
    },
    "320083@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "320083@main",
      "clUrl": "https://commits.webkit.org/320083@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322771\nrdar://186034745\n\nReviewed by Yijia Huang.\n\nReading and updating ArrayProfile is fine to be racy as it is just a\nsource of prediction and we are not reading complicated data from the\nstored Structure. They can be read freely from the concurrent compiler\nunlike reading butterfly etc. This means that we do not need to have a\nlock around ArrayProfile. As sizeof(ArrayProfile) is just 16 bytes, in\nDFG compiler, unless we would like to update the data, we just copy the\nentire 16 bytes and read the content.\n\n* Source/JavaScriptCore/bytecode/ArrayProfile.h:\n(JSC::ArrayProfile::mayBeLargeTypedArray const):\n(JSC::ArrayProfile::mayBeResizableOrGrowableSharedTypedArray const):\n(JSC::ArrayProfile::observedArrayModes const):\n(JSC::ArrayProfile::mayInterceptIndexedAccesses const):\n(JSC::ArrayProfile::mayStoreToHole const):\n(JSC::ArrayProfile::outOfBounds const):\n(JSC::ArrayProfile::usesOriginalArrayStructures const):\n(JSC::ArrayProfile::mayBeRegExpMatchesArray const):\n* Source/JavaScriptCore/bytecode/CodeBlock.cpp:\n(JSC::CodeBlock::getArrayProfile):\n* Source/JavaScriptCore/bytecode/CodeBlock.h:\n* Source/JavaScriptCore/dfg/DFGArrayMode.cpp:\n(JSC::DFG::ArrayMode::fromObserved):\n* Source/JavaScriptCore/dfg/DFGArrayMode.h:\n(JSC::DFG::ArrayMode::speculationFromProfile):\n(JSC::DFG::ArrayMode::withSpeculationFromProfile const):\n(JSC::DFG::ArrayMode::withProfile const):\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::ByteCodeParser::getArrayMode):\n(JSC::DFG::ByteCodeParser::profiledArrayMayBeRegExpMatchesArray):\n* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:\n(JSC::DFG::FixupPhase::fixupNode):\n(JSC::DFG::FixupPhase::attemptToMakeGetArrayLength):\n* Source/JavaScriptCore/dfg/DFGOSRExit.cpp:\n(JSC::DFG::OSRExit::compileExit):\n* Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp:\n(JSC::FTL::compileStub):\n\nCanonical link: https://commits.webkit.org/320083@main",
      "email": "ysuzuki@apple.com",
      "hash": "1e5465e49a028df7828885037fd0652891f20e00",
      "subject": "[JSC] ArrayProfile read / update does not need a lock"
    },
    "320084@main": {
      "author": "Phinehas Fuachie",
      "avatar": "https://www.gravatar.com/avatar/900d85de8c325e38975f39115c36bb75?d=identicon\u0026s=64",
      "cl": "320084@main",
      "clUrl": "https://commits.webkit.org/320084@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322768\nrdar://174807377\n\nReviewed by Jer Noble.\n\nEntering element fullscreen resets the scroll view's content offset, which scrolls the page to the\ntop and dispatches a scroll event once the deferred events are flushed. The offset is restored on\nexit, so the page is told it scrolled somewhere it was never meant to stay.\n\nSites that virtualize a list on scroll position re-window it in response, unmounting rows away from\nthe viewport. If the fullscreen element is in one of those rows it gets removed, which destroys a\nfullscreen iframe's frame and exits fullscreen. On bing.com/videos every video below the fold exits\nfullscreen right after entering.\n\nThe fullscreen presentation does not depend on the offset, so leave it alone: make the saved offset\noptional so a default-constructed WKWebViewState no longer applies one, and stop explicitly\nresetting it on entry. Exiting still restores the offset saved by store().\n\n* Source/WebKit/UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm:\n(WebKit::WKWebViewState::applyTo):\n(-[WKFullScreenWindowController _enterFullScreen:windowScene:completionHandler:]):\n\nCanonical link: https://commits.webkit.org/320084@main",
      "email": "pfuachie2@apple.com",
      "hash": "a346ccb94edad6d8d4cae280e93c4dcdaac7dcc9",
      "subject": "All subsequent videos played after the first one auto exit fullscreen back to inline"
    },
    "320085@main": {
      "author": "Brian Weinstein",
      "avatar": "https://www.gravatar.com/avatar/2892a9aaa68f537ee65c6f95ef0768a6?d=identicon\u0026s=64",
      "cl": "320085@main",
      "clUrl": "https://commits.webkit.org/320085@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322752\nrdar://184269255\n\nReviewed by Kiara Rose.\n\nWhile we're here, fix an issue hit by the ios-safer-cpp bot and use dynamic_objc_cast.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WTF/wtf/PlatformEnableCocoa.h:\n* Source/WebKit/UIProcess/Extensions/Cocoa/API/WebExtensionContextAPIOffscreenCocoa.mm:\n(WebKit::windowScene):\n\nCanonical link: https://commits.webkit.org/320085@main",
      "email": "bweinstein@apple.com",
      "hash": "37082295192386f21f8e17f4e8295e18f61c1da3",
      "subject": "Enable the offscreen web extension API"
    },
    "320086@main": {
      "author": "Shu-yu Guo",
      "avatar": "https://www.gravatar.com/avatar/3884544eb9e557e2ec917d32c6e12720?d=identicon\u0026s=64",
      "cl": "320086@main",
      "clUrl": "https://commits.webkit.org/320086@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322037\nrdar://185814135\n\nReviewed by Yusuke Suzuki.\n\nThis PR fixes two bugs with dotAll mode (/s).\n\nOne, lastIndex wasn't being respected in the JIT and was always considered\nzero.\n\nTwo, ^.* was incorrectly handled in dotAll mode when the pattern was also in\nmultiline mode (/m). In that case, we still optimized ^.*\u003cexpression\u003e to a\nDotStarEnclosure, which would produce wrong results in multiline as ^ needs to\ncheck every line. DotStarEnclosure matches \u003cexpression\u003e and tries to walk\nbackwards and \"expand\" the .*. This optimization is wrong for the following\nexample:\n\n  const re = /^.*X.*/gms;\n  re.lastIndex = 1;\n  re.exec(\"aXb\\ncXd\");\n\n\"aXb\\ncXd\" has \\n at index 3, so under m the ^ positions are 0 and 4. The\nsearch starts at 1, so 0 is out of reach and 4 is the only candidate. From 4,\n.*X.* matches \"cXd\". DotAllEnclosure is wrong in this case because it can't\never match something at position 4 by expanding leftward from the X at index 1.\n\nTest: JSTests/stress/regexp-dot-star-enclosure-dot-all-last-index.js\n\n* JSTests/stress/regexp-dot-star-enclosure-dot-all-last-index.js: Added.\n(shouldBe):\n(check):\n(step):\n* Source/JavaScriptCore/yarr/YarrInterpreter.cpp:\n(JSC::Yarr::Interpreter::matchDotStarEnclosure):\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n* Source/JavaScriptCore/yarr/YarrPattern.cpp:\n(JSC::Yarr::YarrPatternConstructor::optimizeDotStarWrappedExpressions):\n\nCanonical link: https://commits.webkit.org/320086@main",
      "email": "syg@apple.com",
      "hash": "1c9b16dd56d5e2d6865ef612bf2323cb0c9c9920",
      "subject": "[YARR] Fix lastIndex and ^ handling in dotAll mode"
    },
    "320087@main": {
      "author": "Issac Roy",
      "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64",
      "cl": "320087@main",
      "clUrl": "https://commits.webkit.org/320087@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322866\nrdar://186115028\n\nReviewed by Aakash Jain.\n\nEWS computes a flakiness verdict for every layout-test failure it cannot\nexplain as a pre-existing failure, then throws it away:\n`SHOULD_IGNORE_FLAKY_TESTS` is `False`, so a convicted test stays in\n`failing_tests_filtered` and still blames the pull request. A recent\n48-hour window produced 1292 such convictions across 4737 builds.\n\nAct on them. `INCLUDED_FLAKY_VERDICTS` names the verdicts a queue ignores\na failure for, one entry per verdict rather than one boolean for all\nthree, so a verdict can be withdrawn from production without reverting\nthe read path. All three are included. The results-db log reports\n`Ignored` and `Would have ignored` separately and counts the tests each\napplied to, not every conviction.\n\n`AUTHORS_FOR_DIRTY_TREE_FLAKE` rises from 1 to 2. A build's first run\nreports its own flakes before its re-run reads them back, so a\n`DirtyTree` conviction could rest on one author's stack of pull requests\nexcusing its own regression. Requiring a second author makes the evidence\nindependent of the change under test.\n\n* Tools/CISupport/ews-build/results_db.py:\n(ResultsDatabase):\n(ResultsDatabase._is_intra_build_flake):\n(ResultsDatabase._is_inter_build_flake):\n* Tools/CISupport/ews-build/steps.py:\n(RunWebKitTests):\n(RunWebKitTests.filter_failures_using_results_db):\n* Tools/CISupport/ews-build/steps_unittest.py:\n(TestFilterLayoutTestFailuresUsingResultsDB.test_a_verdict_in_the_included_set_removes_the_failure):\n(TestFilterLayoutTestFailuresUsingResultsDB):\n(TestFilterLayoutTestFailuresUsingResultsDB.test_a_verdict_outside_the_included_set_is_recorded_without_ignoring_the_failure):\n(TestFilterLayoutTestFailuresUsingResultsDB.test_the_ignore_message_covers_both_categories):\n(TestFilterLayoutTestFailuresUsingResultsDB.test_a_flaky_verdict_is_recorded_without_ignoring_the_failure): Deleted.\n\nCanonical link: https://commits.webkit.org/320087@main",
      "email": "issacroy05@gmail.com",
      "hash": "651c2a2cdcac1fb8bde41eb878db83fbf0525f31",
      "subject": "[EWS] Activate flaky test verdicts"
    },
    "320088@main": {
      "author": "Tim Nguyen",
      "avatar": "https://www.gravatar.com/avatar/208c05ac2decdf818a4a08ada568328e?d=identicon\u0026s=64",
      "cl": "320088@main",
      "clUrl": "https://commits.webkit.org/320088@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322843\nrdar://186085377\n\nReviewed by Alan Baradlay.\n\nStop checking explicitly for ellipsis text-overflow, and instead check for non-clip text-overflow.\n\nTransfer non-clip text-overflow value into the inner text element.\n\nTests: imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input-notref.html\n       imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input-expected-mismatch.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input-notref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/text-overflow-string-in-input.html: Added.\n* Source/WebCore/html/HTMLInputElement.cpp:\n(WebCore::HTMLInputElement::shouldTruncateText const):\n(WebCore::HTMLInputElement::invalidateStyleOnFocusChangeIfNeeded):\n(WebCore::HTMLInputElement::createInnerTextStyle):\n\nCanonical link: https://commits.webkit.org/320088@main",
      "email": "ntim@apple.com",
      "hash": "24a47dd197933b56dd372a9c4d181515a2c60354",
      "subject": "[css-overflow-4] `text-overflow: \u003cstring\u003e` should work on `\u003cinput\u003e`"
    },
    "320090@main": {
      "author": "Tim Nguyen",
      "avatar": "https://www.gravatar.com/avatar/208c05ac2decdf818a4a08ada568328e?d=identicon\u0026s=64",
      "cl": "320090@main",
      "clUrl": "https://commits.webkit.org/320090@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322846\nrdar://186085908\n\nReviewed by Sammy Gill.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/f01d70241ee0aebcdd2fd68ea4e9e2ff309d78ce\n\nThese directories were imported together because some text-overflow tests were moved from css-ui to css-overflow.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-overflow\n* LayoutTests/imported/w3c/web-platform-tests/css/css-ui\n\nCanonical link: https://commits.webkit.org/320090@main",
      "email": "ntim@apple.com",
      "hash": "31fe3281c1d7aa94986d9da4a899729d3a457554",
      "subject": "Re-import css/css-overflow \u0026 css/css-ui WPT"
    },
    "320093@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "320093@main",
      "clUrl": "https://commits.webkit.org/320093@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322817\n\nReviewed by Mike Wyrzykowski and David Kilzer.\n\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:\n(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::resetStallForTime):\n* Source/WebCore/platform/graphics/cocoa/MediaPlayerPrivateWebM.mm:\n(WebCore::MediaPlayerPrivateWebM::setDuration):\n* Source/WebCore/workers/service/background-fetch/BackgroundFetch.h:\n* Source/WebKit/NetworkProcess/Authentication/cocoa/AuthenticationManagerCocoa.mm:\n(WebKit::AuthenticationManager::initializeConnection):\n* Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.cpp:\n(WebKit::NetworkCORSPreflightChecker::startPreflight):\n(WebKit::NetworkCORSPreflightChecker::completePreflight):\n* Source/WebKit/NetworkProcess/NetworkContentRuleListManager.cpp:\n(WebKit::NetworkContentRuleListManager::contentExtensionsBackend):\n* Source/WebKit/NetworkProcess/NetworkLoad.cpp:\n(WebKit::NetworkLoad::didReceiveResponse):\n* Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp:\n(WebKit::NetworkLoadChecker::NetworkLoadChecker):\n* Source/WebKit/NetworkProcess/cocoa/WebSocketTaskCocoa.mm:\n(WebKit::WebSocketTask::WebSocketTask):\n* Source/WebKit/NetworkProcess/storage/BackgroundFetchStoreImpl.cpp:\n(WebKit::BackgroundFetchStoreImpl::initializeFetches):\n* Source/WebKit/NetworkProcess/storage/BackgroundFetchStoreManager.cpp:\n(WebKit::BackgroundFetchStoreManager::storeFetch):\n* Source/WebKit/NetworkProcess/storage/IDBStorageRegistry.cpp:\n(WebKit::IDBStorageRegistry::removeConnectionToClient):\n* Source/WebKit/Shared/API/c/WKSharedAPICast.h:\n(WebKit::toURLRef):\n* Source/WebKit/UIProcess/API/C/WKContext.cpp:\n(WKContextSetHistoryClient):\n(WKContextSetDownloadClient):\n* Source/WebKit/UIProcess/API/C/WKPage.cpp:\n(WKPageCopySessionState):\n(WKPageSetPageUIClient):\n(WKPageSetPageNavigationClient):\n* Source/WebKit/UIProcess/Authentication/AuthenticationChallengeProxy.cpp:\n(WebKit::AuthenticationChallengeProxy::AuthenticationChallengeProxy):\n* Source/WebKit/UIProcess/Cocoa/GroupActivities/GroupActivitiesSessionNotifier.mm:\n* Source/WebKit/UIProcess/Cocoa/NavigationState.mm:\n(WebKit::tryInterceptNavigation):\n* Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm:\n(WebKit::WebPageProxy::getWebArchiveDataWithSelectedFrames):\n(WebKit::WebPageProxy::getAttributedStringsForRemoteFrames):\n* Source/WebKit/UIProcess/Cocoa/WebPasteboardProxyCocoa.mm:\n(WebKit::WebPasteboardProxy::createOneWebArchiveFromFrames):\n* Source/WebKit/UIProcess/Cocoa/WebProcessProxyCocoa.mm:\n(WebKit::WebProcessProxy::sendAudioComponentRegistrations):\n* Source/WebKit/UIProcess/Downloads/DownloadProxy.cpp:\n(WebKit::DownloadProxy::cancel):\n(WebKit::DownloadProxy::didFinish):\n(WebKit::DownloadProxy::didFail):\n* Source/WebKit/UIProcess/Inspector/Agents/InspectorBrowserAgent.cpp:\n(WebKit::InspectorBrowserAgent::InspectorBrowserAgent):\n* Source/WebKit/UIProcess/Inspector/Agents/InspectorStorageAgent.cpp:\n(WebKit::InspectorStorageAgent::InspectorStorageAgent):\n* Source/WebKit/UIProcess/WebAuthentication/AuthenticatorManager.cpp:\n(WebKit::AuthenticatorManager::clearStateAsync):\n(WebKit::AuthenticatorManager::dispatchPanelClientCall const):\n* Source/WebKit/UIProcess/WebAuthentication/AuthenticatorTransportService.cpp:\n(WebKit::AuthenticatorTransportService::startDiscovery):\n(WebKit::AuthenticatorTransportService::restartDiscovery):\n* Source/WebKit/UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm:\n(WebKit::LocalAuthenticator::continueMakeCredentialAfterUserVerification):\n* Source/WebKit/UIProcess/WebAuthentication/Mock/MockHidConnection.cpp:\n(WebKit::MockHidConnection::send):\n(WebKit::MockHidConnection::feedReports):\n(WebKit::MockHidConnection::continueFeedReports):\n* Source/WebKit/UIProcess/WebAuthentication/Mock/MockNfcService.mm:\n(WebKit::MockNfcService::receiveStartPolling):\n* Source/WebKit/UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp:\n(WebKit::CtapAuthenticator::makeCredential):\n(WebKit::CtapAuthenticator::continueSilentlyCheckCredentials):\n(WebKit::CtapAuthenticator::continueMakeCredentialAfterCheckExcludedCredentials):\n(WebKit::CtapAuthenticator::getAssertion):\n(WebKit::CtapAuthenticator::continueGetAssertionAfterCheckAllowCredentials):\n(WebKit::CtapAuthenticator::continueGetAssertionAfterResponseReceived):\n(WebKit::CtapAuthenticator::continueGetNextAssertionAfterResponseReceived):\n(WebKit::CtapAuthenticator::continueRequestPinAfterGetKeyAgreement):\n(WebKit::CtapAuthenticator::continueSetupPinAfterGetKeyAgreement):\n* Source/WebKit/UIProcess/WebAuthentication/fido/CtapHidDriver.cpp:\n(WebKit::CtapHidDriverWorker::transact):\n(WebKit::CtapHidDriverWorker::write):\n(WebKit::CtapHidDriver::transact):\n(WebKit::CtapHidDriver::continueAfterChannelAllocated):\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::didNotifyUserActivation):\n(WebKit::WebPageProxy::didHandleFirstUserGesture):\n(WebKit::WebPageProxy::didConsumeUserActivation):\n* Source/WebKit/UIProcess/WebPageProxyMessageReceiverRegistration.cpp:\n(WebKit::WebPageProxyMessageReceiverRegistration::transferMessageReceivingFrom):\n* Source/WebKit/UIProcess/WebPageProxyMessageReceiverRegistration.h:\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::shouldSendPendingMessage):\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(-[WKDOMPasteMenuDelegate menuDidClose:]):\n(WebKit::WebViewImpl::validateUserInterfaceItem):\n(WebKit::WebViewImpl::requestCandidatesForSelectionIfNeeded):\n(WebKit::WebViewImpl::firstRectForCharacterRange):\n(WebKit::WebViewImpl::showInlinePredictionsForCandidate):\n(WebKit::WebViewImpl::showInlinePredictionsForCandidates):\n(WebKit::WebViewImpl::createFlagsChangedEventMonitor):\n* Source/WebKit/WebProcess/FileAPI/BlobRegistryProxy.cpp:\n(WebKit::BlobRegistryProxy::registerInternalFileBlobURL):\n(WebKit::BlobRegistryProxy::registerInternalBlobURL):\n(WebKit::BlobRegistryProxy::registerBlobURL):\n(WebKit::BlobRegistryProxy::registerInternalBlobURLOptionallyFileBacked):\n(WebKit::BlobRegistryProxy::unregisterBlobURL):\n(WebKit::BlobRegistryProxy::registerInternalBlobURLForSlice):\n(WebKit::BlobRegistryProxy::registerBlobURLHandle):\n(WebKit::BlobRegistryProxy::unregisterBlobURLHandle):\n(WebKit::BlobRegistryProxy::blobType):\n(WebKit::BlobRegistryProxy::blobSize):\n* Source/WebKit/WebProcess/FullScreen/WebFullScreenManager.cpp:\n(WebKit::WebFullScreenManager::setPIPStandbyElement):\n* Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBackend.cpp:\n(WebKit::ImageBufferShareableMappedIOSurfaceBackend::create):\n* Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBitmapBackend.h:\n* Source/WebKit/WebProcess/GPU/media/AudioVideoRendererRemote.cpp:\n(WebKit::AudioVideoRendererRemote::prepareToSeek):\n(WebKit::AudioVideoRendererRemote::finishSeek):\n(WebKit::AudioVideoRendererRemote::notifyTimeReachedAndStall):\n* Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp:\n(WebKit::MediaPlayerPrivateRemote::load):\n(WebKit::MediaPlayerPrivateRemote::networkStateChanged):\n(WebKit::MediaPlayerPrivateRemote::setReadyState):\n(WebKit::MediaPlayerPrivateRemote::volumeChanged):\n(WebKit::MediaPlayerPrivateRemote::muteChanged):\n(WebKit::MediaPlayerPrivateRemote::timeChanged):\n(WebKit::MediaPlayerPrivateRemote::durationChanged):\n(WebKit::MediaPlayerPrivateRemote::rateChanged):\n(WebKit::MediaPlayerPrivateRemote::playbackStateChanged):\n(WebKit::MediaPlayerPrivateRemote::engineFailedToLoad):\n(WebKit::MediaPlayerPrivateRemote::characteristicChanged):\n(WebKit::MediaPlayerPrivateRemote::sizeChanged):\n(WebKit::MediaPlayerPrivateRemote::currentTimeChanged):\n(WebKit::MediaPlayerPrivateRemote::firstVideoFrameAvailable):\n(WebKit::MediaPlayerPrivateRemote::renderingModeChanged):\n(WebKit::MediaPlayerPrivateRemote::acceleratedRenderingStateChanged):\n(WebKit::MediaPlayerPrivateRemote::addRemoteAudioTrack):\n(WebKit::MediaPlayerPrivateRemote::removeRemoteAudioTrack):\n(WebKit::MediaPlayerPrivateRemote::addRemoteTextTrack):\n(WebKit::MediaPlayerPrivateRemote::removeRemoteTextTrack):\n(WebKit::MediaPlayerPrivateRemote::addRemoteVideoTrack):\n(WebKit::MediaPlayerPrivateRemote::removeRemoteVideoTrack):\n(WebKit::MediaPlayerPrivateRemote::currentPlaybackTargetIsWirelessChanged):\n(WebKit::MediaPlayerPrivateRemote::mediaPlayerKeyNeeded):\n(WebKit::MediaPlayerPrivateRemote::waitingForKeyChanged):\n(WebKit::MediaPlayerPrivateRemote::initializationDataEncountered):\n(WebKit::MediaPlayerPrivateRemote::reportGPUMemoryFootprint):\n(WebKit::MediaPlayerPrivateRemote::resourceNotSupported):\n(WebKit::MediaPlayerPrivateRemote::getRawCookies const):\n(WebKit::MediaPlayerPrivateRemote::prefersSpatialAudioExperienceChanged):\n(WebKit::MediaPlayerPrivateRemote::soundStageSizeDidChange):\n(WebKit::MediaPlayerPrivateRemote::audioOutputDeviceChanged):\n(WebKit::MediaPlayerPrivateRemote::sceneIdentifierDidChange):\n* Source/WebKit/WebProcess/GPU/webrtc/AudioMediaStreamTrackRendererInternalUnitManager.cpp:\n(WebKit::AudioMediaStreamTrackRendererInternalUnitManagerProxy::~AudioMediaStreamTrackRendererInternalUnitManagerProxy):\n(WebKit::AudioMediaStreamTrackRendererInternalUnitManagerProxy::createRemoteUnit):\n(WebKit::AudioMediaStreamTrackRendererInternalUnitManagerProxy::start):\n(WebKit::AudioMediaStreamTrackRendererInternalUnitManagerProxy::stop):\n(WebKit::AudioMediaStreamTrackRendererInternalUnitManagerProxy::setLastDeviceUsed):\n(WebKit::AudioMediaStreamTrackRendererInternalUnitManagerProxy::deleteUnitForTesting):\n* Source/WebKit/WebProcess/GPU/webrtc/LibWebRTCCodecs.cpp:\n(WebKit::createRemoteDecoder):\n(WebKit::createRemoteEncoder):\n* Source/WebKit/WebProcess/InjectedBundle/InjectedBundle.cpp:\n(WebKit::InjectedBundle::addOriginAccessAllowListEntry):\n(WebKit::InjectedBundle::removeOriginAccessAllowListEntry):\n(WebKit::InjectedBundle::resetOriginAccessAllowLists):\n* Source/WebKit/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.cpp:\n(WebKit::InjectedBundlePageLoaderClient::willLoadDataRequest):\n(WebKit::InjectedBundlePageLoaderClient::willPerformClientRedirectForFrame):\n* Source/WebKit/WebProcess/InjectedBundle/mac/InjectedBundleMac.mm:\n(WebKit::InjectedBundle::initialize):\n* Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp:\n(WebKit::WebLoaderStrategy::scheduleLoadFromNetworkProcess):\n(WebKit::WebLoaderStrategy::loadResourceSynchronously):\n(WebKit::WebLoaderStrategy::startPingLoad):\n(WebKit::WebLoaderStrategy::preconnectTo):\n(WebKit::WebLoaderStrategy::isResourceLoadFinished):\n(WebKit::WebLoaderStrategy::setCaptureExtraNetworkLoadMetricsEnabled):\n(WebKit::WebLoaderStrategy::responseFromResourceLoadIdentifier):\n(WebKit::WebLoaderStrategy::intermediateLoadInformationFromResourceLoadIdentifier):\n(WebKit::WebLoaderStrategy::networkMetricsFromResourceLoadIdentifier):\n* Source/WebKit/WebProcess/Network/WebSocketProvider.cpp:\n(WebKit::WebSocketProvider::countWebSocketChannelsForTesting):\n* Source/WebKit/WebProcess/Network/webrtc/LibWebRTCNetworkManager.cpp:\n(WebKit::LibWebRTCNetworkManager::networksChanged):\n* Source/WebKit/WebProcess/Network/webrtc/RTCDataChannelRemoteManager.cpp:\n(WebKit::RTCDataChannelRemoteManager::postTaskToHandler):\n* Source/WebKit/WebProcess/Network/webrtc/WebRTCMonitor.cpp:\n(WebKit::WebRTCMonitor::startUpdating):\n(WebKit::WebRTCMonitor::stopUpdating):\n* Source/WebKit/WebProcess/Storage/WebSWClientConnection.cpp:\n(WebKit::WebSWClientConnection::addRoutes):\n* Source/WebKit/WebProcess/WebCoreSupport/ShareableBitmapUtilities.cpp:\n(WebKit::createShareableBitmap):\n(WebKit::createShareableBitmapAsync):\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:\n(WebKit::WebChromeClient::testProcessIncomingSyncMessagesWhenWaitingForSyncReply):\n(WebKit::WebChromeClient::registerBlobPathForTesting):\n* Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp:\n(WebKit::WebLocalFrameLoaderClient::loadStorageAccessQuirksIfNeeded):\n(WebKit::WebLocalFrameLoaderClient::sendH2Ping):\n(WebKit::WebLocalFrameLoaderClient::didExceedNetworkUsageThreshold):\n(WebKit::WebLocalFrameLoaderClient::removeStorageAccess):\n* Source/WebKit/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp:\n(WebKit::WebPlatformStrategies::windowSubscribeToPushService):\n(WebKit::WebPlatformStrategies::windowUnsubscribeFromPushService):\n(WebKit::WebPlatformStrategies::windowGetPushSubscription):\n(WebKit::WebPlatformStrategies::windowGetPushPermissionState):\n* Source/WebKit/WebProcess/WebPage/WebCookieCache.cpp:\n(WebKit::WebCookieCache::cookiesForDOM):\n* Source/WebKit/WebProcess/WebPage/WebCookieJar.cpp:\n(WebKit::WebCookieJar::cookies const):\n(WebKit::WebCookieJar::setCookies):\n(WebKit::WebCookieJar::remoteCookiesEnabledSync const):\n(WebKit::WebCookieJar::remoteCookiesEnabled const):\n(WebKit::WebCookieJar::cookieRequestHeaderFieldValueDigest const):\n(WebKit::WebCookieJar::getRawCookies const):\n(WebKit::WebCookieJar::setRawCookie):\n(WebKit::WebCookieJar::deleteCookie):\n(WebKit::WebCookieJar::getCookiesAsync const):\n(WebKit::WebCookieJar::setCookieAsync const):\n(WebKit::WebCookieJar::addChangeListenerWithAccess):\n(WebKit::WebCookieJar::removeChangeListener):\n* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:\n(WebKit::WebFrame::startDownload):\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::loadAndDecodeImage):\n(WebKit::WebPage::hasStorageAccess):\n(WebKit::WebPage::requestStorageAccess):\n(WebKit::WebPage::setLoginStatus):\n(WebKit::WebPage::isLoggedIn):\n(WebKit::WebPage::useRedirectionForCurrentNavigation):\n* Source/WebKit/WebProcess/WebStorage/StorageAreaMap.cpp:\n(WebKit::StorageAreaMap::removeItem):\n(WebKit::StorageAreaMap::clear):\n\nCanonical link: https://commits.webkit.org/320093@main",
      "email": "cdumez@apple.com",
      "hash": "fcd8c65d09cee34b7ca85cd928b00dff0a722014",
      "subject": "[SaferCPP] Address more warnings in Source/WebKit found by the latest version of the static analyzer"
    },
    "320094@main": {
      "author": "Sam Weinig",
      "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64",
      "cl": "320094@main",
      "clUrl": "https://commits.webkit.org/320094@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322730\n\nReviewed by Darin Adler.\n\nMakes CSSTokenizer and CSSTokenizerInputStream operate on StringView rather\nthan String and StringImpl.\n\nBiggest change is in CSSTokenizer::preprocessString where we now check the\nstring for null characters and unpair surrogates before allocating a\nreplacement, making sure to do the minimum required based on character type.\n\n* Source/WebCore/css/parser/CSSCustomPropertySyntax.cpp:\n* Source/WebCore/css/parser/CSSParser.h:\n* Source/WebCore/css/parser/CSSTokenizer.cpp:\n* Source/WebCore/css/parser/CSSTokenizer.h:\n* Source/WebCore/css/parser/CSSTokenizerInputStream.cpp:\n* Source/WebCore/css/parser/CSSTokenizerInputStream.h:\n* Source/WebCore/css/typedom/CSSUnparsedValue.cpp:\n* Source/WebCore/style/StyleCustomProperty.cpp:\n* Source/WebCore/svg/SVGLengthValue.cpp:\n\nCanonical link: https://commits.webkit.org/320094@main",
      "email": "sam@webkit.org",
      "hash": "66e2e265cfeecef8ddee8ba16e16acbf35644a7b",
      "subject": "Make CSSTokenizer work efficiently with StringViews"
    },
    "320095@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "320095@main",
      "clUrl": "https://commits.webkit.org/320095@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322869\n\nUnreviewed. Update safer C++ expectations.\n\n* Source/JavaScriptCore/SaferCPPExpectations/UncountedLambdaCapturesCheckerExpectations:\n\nCanonical link: https://commits.webkit.org/320095@main",
      "email": "rniwa@webkit.org",
      "hash": "87a413dfec8848c3ab69c5e9e94440d7815bb849",
      "subject": "Update safer C++ expectations (2026-08-28)"
    },
    "320096@main": {
      "author": "Robert Jenner",
      "avatar": "https://www.gravatar.com/avatar/05a1bd874251a1f64c7b6a0ed8120640?d=identicon\u0026s=64",
      "cl": "320096@main",
      "clUrl": "https://commits.webkit.org/320096@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318487\nrdar://174662710\n\nReviewed by Simon Fraser.\n\nm_momentumEventDispatcher can be accessed from two threads, which could lead to\na race condition:\n* On the scrolling thread, RemoteLayerTreeEventDispatcher::didRefreshDisplay\n  gets called. It grabs the pointer of m_momentumEventDispatcher to call into it\n* Just before m_momentumEventDispatcher-\u003edisplayDidRefresh is called,\n  the scrolling thread gets pre-empted for the main thread. It calls\n  RemoteLayerTreeEventDispatcher::invalidate, which sets m_momentumEventDispatcher\n  to nullptr, freeing the object\n* Then the scrolling thread resumes execution at\n  RemoteLayerTreeEventDispatcher::didRefreshDisplay, which calls\n  calls m_momentumEventDispatcher-\u003edisplayDidRefresh on the freed object\n\nNote the race window is *very* small - didRefreshDisplay needs to be preempted\nat the exact instruction that calls m_momentumEventDispatcher-\u003edisplayDidRefresh.\n\n263321@main tweaked the order of operations to avoid needing a lock and null\ncheck around m_momentumEventDispatcher:\n\n\u003e Rather than adding a lock to use around accesses to m_momentumEventDispatcher\n\u003e and adding null checks, fix the teardown order to ensure that m_momentumEventDispatcher\n\u003e is always non-null in the scrolling thread code.\n\nBut it's almost too easy to accidentally change the order of operations, so this\npatch properly fixes it by guarding m_momentumEventDispatcher with a lock. Any\noperations involving it needs to acquire the lock first.\n\nNo tests - tiny race window makes it almost impossible to write a test that\nreliably triggers the race condition.\n\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.h:\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.mm:\n(WebKit::RemoteLayerTreeEventDispatcher::invalidate):\n(WebKit::RemoteLayerTreeEventDispatcher::cacheWheelEventScrollingAccelerationCurve):\n(WebKit::RemoteLayerTreeEventDispatcher::scrollingThreadHandleWheelEvent):\n(WebKit::RemoteLayerTreeEventDispatcher::didRefreshDisplay):\n(WebKit::RemoteLayerTreeEventDispatcher::windowScreenDidChange):\n(WebKit::RemoteLayerTreeEventDispatcher::stopDisplayDidRefreshCallbacks):\n(WebKit::RemoteLayerTreeEventDispatcher::flushMomentumEventLoggingSoon):\n\nOriginally-landed-as: 305413.1103@safari-7624.5-branch (d586a22ef92e). rdar://185367169\nCanonical link: https://commits.webkit.org/320096@main",
      "email": "jenner@apple.com",
      "hash": "e25bd0f0ddc7f8c84f3c1074a89ab1bfaf27e3e5",
      "subject": "RemoteLayerTreeEventDispatcher: add lock to guard access to m_momentumEventDispatcher"
    },
    "320097@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "320097@main",
      "clUrl": "https://commits.webkit.org/320097@main",
      "description": "rdar://183949932\n\nReviewed by Charlie Wolfe.\n\nThe UI process crashes on the CVDisplayLink thread in when calling\ndisplayLinkFired() on a DisplayLink::Client that was freed while still\nregistered. Two independent teardown paths can leave a client registered\nat destruction. These are:\n\n1. A client would not be removed if existingDisplayLink() returned null,\n  this was fixed in 314099@main.\n\n2. More importantly, 316606.145@safari-7625-branch dropped the if (mED)\n  guard around startOrStopDisplayLink() when stopping the\n  displayDidRefresh callbacks. That method is re-entered during teardown\n  since invalidate() destroys mED and its destructor calls back through\n  into stopDisplayDidRefreshCallbacks(). Without the guard,\n  startOrStopDisplayLink() re-adds the DisplayLink client that\n  invalidate() just removed via removeDisplayLinkClient(). The client is\n  then freed, so the next display refresh invokes displayLinkFired() on\n  a freed client, producing a UAF.\n\nIn this patch, we fix the latter by re-introducing the if (mED) guard\ndropped in the regressing commit.\n\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.mm:\n(WebKit::RemoteLayerTreeEventDispatcher::stopDisplayDidRefreshCallbacks):\n\nOriginally-landed-as: 7a268c48ba0a. rdar://185365990\nCanonical link: https://commits.webkit.org/320097@main",
      "email": "a_protyasha@apple.com",
      "hash": "b0d927d67567bd5d7c7da14695ced80ad287c3e9",
      "subject": "REGRESSION(316606.145@safari-7625-branch): UI process crash under DisplayLink callbacks for RemoteLayerTree DisplayLink clients"
    },
    "320098@main": {
      "author": "Fujii Hironori",
      "avatar": "https://www.gravatar.com/avatar/ef99cb23f5e5d27977968ca097d9a85f?d=identicon\u0026s=64",
      "cl": "320098@main",
      "clUrl": "https://commits.webkit.org/320098@main",
      "description": "Unreviewed.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/gtk/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320098@main",
      "email": "fujii@igalia.com",
      "hash": "f014a045b148c79432826a8c9fedd9f2e29f00e9",
      "subject": "[GLib] layout test gardening 2026-08-29"
    },
    "320099@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "320099@main",
      "clUrl": "https://commits.webkit.org/320099@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322889\n\nReviewed by Yusuke Suzuki.\n\nDFGStrengthReductionPhase folds String.prototype.replace with a constant\nstring, RegExp and replacement by replaying the match loop at compile\ntime. After an empty match it advanced by one code unit regardless of\nthe /u and /v flags, while replaceUsingRegExpSearch advances past a\nsurrogate pair, so \"a\\u{1F600}b\".replace(/(?:)/gu, \"-\") changed its\nresult once the function reached the DFG.\n\nAdvance past a lead/trail pair after an empty match when the RegExp is\nunicode, the same way the runtime does.\n\nTest: JSTests/stress/dfg-string-replace-regexp-unicode-empty-match-surrogate-pair.js\n\n* JSTests/stress/dfg-string-replace-regexp-unicode-empty-match-surrogate-pair.js: Added.\n(shouldBe):\n(replaceUnicodeSets):\n(replaceAllUnicode):\n(replaceLoneLead):\n(replaceNonUnicode):\n* Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp:\n(JSC::DFG::StrengthReductionPhase::handleNode):\n\nCanonical link: https://commits.webkit.org/320099@main",
      "email": "sosuke@bun.sh",
      "hash": "d545f589c8b77bfa599eed91f845687ed97c2e2b",
      "subject": "[JSC] DFG `StringReplace` constant folding steps into a surrogate pair after an empty match for unicode RegExps"
    },
    "320100@main": {
      "author": "Diego Pino Garcia",
      "avatar": "https://www.gravatar.com/avatar/e8cce88637f1a6e79155e8371e24b2e8?d=identicon\u0026s=64",
      "cl": "320100@main",
      "clUrl": "https://commits.webkit.org/320100@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=206001\n\nReviewed by Carlos Garcia Campos.\n\nFollow-up to 320028@main.\n\nResolve the CSS 'ch' unit from the '0' glyph's vertical advance only when the\nfont has vertical metrics (i.e vmtx table).\n\n'ch-unit-017.html' keeps passing because its @font-face features vertical metrics.\nThis change also allows to restore five tests that were passing before 320028@main.\n\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebCore/platform/graphics/Font.cpp:\n(WebCore::Font::platformGlyphInit):\n(WebCore::Font::setZeroWidth):\n* Source/WebCore/platform/graphics/Font.h:\n\nCanonical link: https://commits.webkit.org/320100@main",
      "email": "dpino@igalia.com",
      "hash": "038b868712bd44248b9c4d87d55ced4aa25dc940",
      "subject": "REGRESSION(320028@main): [GLIB] Apply advance height only if font has a vmtx table"
    },
    "320101@main": {
      "author": "Claudio Saavedra",
      "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64",
      "cl": "320101@main",
      "clUrl": "https://commits.webkit.org/320101@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322838\n\nReviewed by Justin Michaud.\n\nSeveral ipc/ tests were skipped because their payload hardcoded Cocoa's\nCGColorSpace serialization. On Skia, DestinationColorSpace is serialized as\nthe bytes SkColorSpace::serialize() writes, which coreipc.js had no way to\nproduce.\n\nAdd IPC.serializedSRGBColorSpace() to the testing API, returning those bytes\nfrom the serializer itself. coreipc.js gains an sRGBColorSpace() helper that\nproduces the CG variant or the Skia bytes as the running build requires.\nserializeTemplate() no longer throws for sk_sp\u003cSkColorSpace\u003e, a wrapper the\ngenerator registers as an ordinary type but spells as a template; it is now\nserialized through the normal type path.\n\nUnskip the eight tests that then pass.\n\n* LayoutTests/ipc/coreipc.js:\n(export.sRGBColorSpace):\n(export.ArgumentSerializer):\n* LayoutTests/ipc/decode-feConvolveMatrix-kernelSize-overflow.html:\n* LayoutTests/ipc/empty-svgfilterrenderer-expression-crash.html:\n* LayoutTests/ipc/fecolormatrix-type-values-mismatch-crash.html:\n* LayoutTests/ipc/insufficient-svgfilter-inputs-crash.html:\n* LayoutTests/ipc/invalid-feConvolveMatrix-crash.html:\n* LayoutTests/ipc/invalid-svgfilter-expression-crash.html:\n* LayoutTests/ipc/nested-display-list-draw-control-part-crash.html:\n* LayoutTests/ipc/restore-empty-stack-crash.html:\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebKit/WebProcess/WebPage/IPCTestingAPI.cpp:\n(WebKit::IPCTestingAPI::JSIPC::staticFunctions):\n(WebKit::IPCTestingAPI::JSIPC::serializedSRGBColorSpace):\n\nCanonical link: https://commits.webkit.org/320101@main",
      "email": "csaavedra@igalia.com",
      "hash": "e846671b92776907f755ea380268f08d037a3bb6",
      "subject": "[GLIB] Unskip the IPC colorspace tests on the GLib ports"
    },
    "320102@main": {
      "author": "Justin Michaud",
      "avatar": "https://www.gravatar.com/avatar/36e0433ee725a08f7e1122a6bc584b57?d=identicon\u0026s=64",
      "cl": "320102@main",
      "clUrl": "https://commits.webkit.org/320102@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321756\n\nReviewed by Claudio Saavedra.\n\nAdd some helpers to test the various image decoders.\n\nFix:\n- PNGImageDecoder::readChunks() stored the acTL frame count before validating\n  it, so a malformed APNG could advertise up to 2^32 - 1 frames through\n  frameCount() while the frame buffer cache held a single entry.\n\n- PNGImageDecoder::initFrameBuffer() and frameComplete(), and the same\n  compositing logic in GIFImageDecoder::frameComplete(), read the previous\n  frame's backing store; a frame evicted from the frame cache has none, so\n  null-check it first.\n\n- JPEGXLImageDecoder::clearDecodedPixelDataIfNeeded() built an end iterator\n  from clearBeforeFrame without clamping it to the cache size.\n\n- WEBPImageDecoder::frameBufferAtIndex() blindly indexed the cache after\n  decode(), but decode() leaves the cache untouched when it bails out early.\n\n- ICOImageDecoder::decodeAtIndex() dereferenced the embedded PNG sub-decoder's\n  firstFrameBuffer(), which can be null\n\n* LayoutTests/fast/images/animated-image-mp4-crash.html:\n* LayoutTests/fast/images/apng-acTL-frame-count-overflow-expected.txt: Added.\n* LayoutTests/fast/images/apng-acTL-frame-count-overflow.html: Added.\n* LayoutTests/fast/images/apng-acTL-zero-frame-count-expected.txt: Added.\n* LayoutTests/fast/images/apng-acTL-zero-frame-count.html: Added.\n* LayoutTests/fast/images/apng-decode-after-frame-cache-eviction-expected.txt: Added.\n* LayoutTests/fast/images/apng-decode-after-frame-cache-eviction.html: Added.\n* LayoutTests/fast/images/resources/apng-acTL-frame-count-overflow.png: Added.\n* LayoutTests/fast/images/resources/apng-acTL-zero-frame-count.png: Added.\n* LayoutTests/fast/images/resources/apng-frame-cache-eviction.png: Added.\n* LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash-expected.txt: Added.\n* LayoutTests/http/tests/images/ico-png-subimage-partial-load-crash.html: Added.\n* LayoutTests/http/tests/images/resources/ico-png-subimage.ico: Added.\n* Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp:\n(WebCore::GIFImageDecoder::frameComplete):\n* Source/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp:\n(WebCore::ICOImageDecoder::decodeAtIndex):\n* Source/WebCore/platform/image-decoders/jpegxl/JPEGXLImageDecoder.cpp:\n(WebCore::JPEGXLImageDecoder::clearDecodedPixelDataIfNeeded):\n* Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp:\n(WebCore::PNGImageDecoder::frameBufferAtIndex):\n(WebCore::PNGImageDecoder::readChunks):\n(WebCore::PNGImageDecoder::initFrameBuffer):\n(WebCore::PNGImageDecoder::frameComplete):\n* Source/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp:\n(WebCore::WEBPImageDecoder::frameBufferAtIndex):\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::forceDecodeImageFrameAtIndex):\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\n* Tools/TestWebKitAPI/PlatformGTK.cmake:\n* Tools/TestWebKitAPI/PlatformWPE.cmake:\n* Tools/TestWebKitAPI/Tests/WebCore/ImageDecoderTests.cpp: Added.\n(TestWebKitAPI::append32):\n(TestWebKitAPI::crc32For):\n(TestWebKitAPI::appendChunk):\n(TestWebKitAPI::redScanlines):\n(TestWebKitAPI::storedZlibStream):\n(TestWebKitAPI::makeAnimatedPNG):\n(TestWebKitAPI::makeTwoFrameAPNG):\n(TestWebKitAPI::createDecoder):\n(TestWebKitAPI::TEST(ImageDecoder, APNGRejectedFrameCountIsNotReported)):\n(TestWebKitAPI::TEST(ImageDecoder, APNGZeroFrameCountStillDecodesDefaultImage)):\n(TestWebKitAPI::TEST(ImageDecoder, APNGValidFrameCountIsReported)):\n(TestWebKitAPI::TEST(ImageDecoder, ClearFrameBufferCacheThenDecodeAgain)):\n(TestWebKitAPI::TEST(ImageDecoder, FrameIndexPastEndIsHandled)):\n(TestWebKitAPI::TEST(ImageDecoder, PartialDataThenFullData)):\n(TestWebKitAPI::makeICOWithPNGSubImage):\n(TestWebKitAPI::TEST(ImageDecoder, ICOWithPartiallyReceivedPNGSubImage)):\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/mac/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320102@main",
      "email": "jmichaud@igalia.com",
      "hash": "24545f4fcbd7c5ed088348ec64e7e039da43eb00",
      "subject": "[non-cocoa][fuzz] Frame cache evicted or unparsed frames dereferenced"
    },
    "320103@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "320103@main",
      "clUrl": "https://commits.webkit.org/320103@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322610\nrdar://185914243\n\nReviewed by Sam Weinig.\n\nDrop the StringView::trim(). Leading whitespace is skipped with\nCSSParserTokenRange::consumeWhitespace() and each consumer already ends with\nconsumeIncludingWhitespace(), so the trailing run is gone before atEnd() is\nchecked. The tokenizer treats exactly space, tab, LF, FF and CR as whitespace,\nmatching isASCIIWhitespace(), so accepted inputs do not change. All-whitespace\ninput now leaves the range empty, so MetaConsumer::consume() fails and we return\nSyntaxError as before.\n\n* Source/WebCore/svg/SVGLengthValue.cpp:\n(WebCore::SVGLengthValue::setValueAsString):\n\nCanonical link: https://commits.webkit.org/320103@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "be31a7f8da426370970e1acc2b3df5a628a5e567",
      "subject": "Simplify SVGLengthValue::setValueAsString() whitespace handling"
    },
    "320104@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "320104@main",
      "clUrl": "https://commits.webkit.org/320104@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322899\nrdar://186150753\n\nReviewed by Keith Miller.\n\niterator_next fast path's result needs to be stored to getValue\ncheckpoint's ValueProfile.\n\nTest: JSTests/stress/for-of-mixed-element-types-value-profile.js\n\n* JSTests/stress/for-of-mixed-element-types-value-profile.js: Added.\n(events):\n(walk):\n* Source/JavaScriptCore/jit/JITCall.cpp:\n(JSC::JIT::emit_op_iterator_next):\n\nCanonical link: https://commits.webkit.org/320104@main",
      "email": "ysuzuki@apple.com",
      "hash": "26f0db0fe1756a9579a48c146dfc3f140bbfc193",
      "subject": "[JSC] incorrect ValueProfile is used in BaselineJIT iterator_next"
    },
    "320105@main": {
      "author": "Mike Wyrzykowski",
      "avatar": "https://www.gravatar.com/avatar/4b1bc9e238714f95e22d5d2454c07066?d=identicon\u0026s=64",
      "cl": "320105@main",
      "clUrl": "https://commits.webkit.org/320105@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313946\nrdar://174681215\n\nReviewed by Dan Glastonbury.\n\nTrack highest validated indices and not simply the maximum indices\npast to writeBuffer on an index buffer. Otherwise a writeBuffer(0xFF) call\nwill allow an OOB read for any future write calls.\n\n* Source/WebGPU/WebGPU/Buffer.h:\n* Source/WebGPU/WebGPU/Buffer.mm:\n(WebGPU::Buffer::drawIndexedValidated):\n(WebGPU::Buffer::needsIndexValidation):\n(WebGPU::Buffer::indirectBufferInvalidated):\n\nTest:\n* LayoutTests/fast/webgpu/index-buffer-cache-invalidation-expected.txt: Added.\n* LayoutTests/fast/webgpu/index-buffer-cache-invalidation.html: Added.\n\nOriginally-landed-as: 305413.1117@safari-7624.5-branch (f6253b9a6a94). rdar://185368400\nCanonical link: https://commits.webkit.org/320105@main",
      "email": "mwyrzykowski@apple.com",
      "hash": "ff78e4fceef7783f665b130f1c01766da3a2c137",
      "subject": "Cache invalidation bypass via monotonic max-index tracking leads to GPU OOB read"
    },
    "320106@main": {
      "author": "Lauro Moura",
      "avatar": "https://www.gravatar.com/avatar/6157f52d61e04c2c63fe7ff668ba69b3?d=identicon\u0026s=64",
      "cl": "320106@main",
      "clUrl": "https://commits.webkit.org/320106@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321148\n\nReviewed by Sam Sneddon and Carlos Alberto Lopez Perez.\n\nRolls back to pytest-async 0.19.0, matching the vendored version in the\nWPT tests and providing the proper `event_loop` fixture needed by\nWebDriverBiDi tests that wait for a given event.\n\nPreviously, pytest-asyncio was updated from 0.18.3 to 1.1.1 in\n315890@main, which focused on the pytest 7-\u003e8 bump for python 3.14\ncompatibility. While the pytest bump was required, the pytest-asyncio\nwas too much, introducing those breaking changes.\n\nThis commit also removes the backports.asyncio_runner dependency,\noriginally added as a follow-up fix in 317620@main, as it's not needed\nanymore (only with pytest-asyncio \u003e= 1.1.0).\n\n* Tools/Scripts/webkitpy/__init__.py:\n* WebDriverTests/TestExpectations.json:\n\nCanonical link: https://commits.webkit.org/320106@main",
      "email": "lmoura@igalia.com",
      "hash": "4307d59b79a418ef662b52b07f708039060d8a68",
      "subject": "[WebDriver][Tools] Some WPT tests depend on a deprecated event_loop fixture from pytest-asyncio"
    }
  },
  "date": "2026-08-29",
  "days": 1,
  "generatedAt": "2026-08-29T22:05:28Z",
  "markdown": "## Highlights\n- **Security** Fixed a cache invalidation bypass in monotonic max-index tracking that could lead to a GPU out-of-bounds read. [commit 320105@main](https://commits.webkit.org/320105@main)\n- **Security** Fixed a non-Cocoa fuzzing bug where evicted or unparsed frame cache entries could be dereferenced. [commit 320102@main](https://commits.webkit.org/320102@main)\n- **UI** Fixed a UI process crash under DisplayLink callbacks for RemoteLayerTree DisplayLink clients. [commit 320097@main](https://commits.webkit.org/320097@main)\n- **Rendering** Added locking in RemoteLayerTreeEventDispatcher to guard momentum event dispatcher access and reduce race risk. [commit 320096@main](https://commits.webkit.org/320096@main)\n- **Perf** Made CSSTokenizer work efficiently with StringViews, shaving overhead in CSS tokenization paths. [commit 320094@main](https://commits.webkit.org/320094@main)\n- **Web Platform** Landed `text-overflow: \u003cstring\u003e` support on `\u003cinput\u003e`, closing a visible CSS Overflow gap. [commit 320088@main](https://commits.webkit.org/320088@main)\n- **Mobile** Enabled the offscreen web extension API, expanding extension capability on supported Apple platforms. [commit 320085@main](https://commits.webkit.org/320085@main)\n- **Media** Fixed a regression where videos after the first one would auto-exit fullscreen back to inline. [commit 320084@main](https://commits.webkit.org/320084@main)\n- **V8** Fixed YARR handling of `lastIndex` and `^` in dotAll mode, tightening RegExp correctness. [commit 320086@main](https://commits.webkit.org/320086@main)\n\n## What landed by area\n\n### JavaScriptCore and RegExp\n- **V8** Fixed BaselineJIT iterator_next using an incorrect ValueProfile, improving JSC profiling correctness. [commit 320104@main](https://commits.webkit.org/320104@main)\n- **V8** Fixed DFG `StringReplace` constant folding stepping into a surrogate pair after an empty match in Unicode RegExps. [commit 320099@main](https://commits.webkit.org/320099@main)\n- **V8** Fixed YARR `lastIndex` and `^` handling in dotAll mode to match expected RegExp semantics. [commit 320086@main](https://commits.webkit.org/320086@main)\n- **Perf** Removed unnecessary locking from JSC ArrayProfile read and update paths. [commit 320083@main](https://commits.webkit.org/320083@main)\n\n### CSS and rendering\n- **Rendering** Simplified whitespace handling in `SVGLengthValue::setValueAsString()`, reducing parser complexity around SVG length input. [commit 320103@main](https://commits.webkit.org/320103@main)\n- **Perf** Optimized CSSTokenizer to work efficiently with StringViews. [commit 320094@main](https://commits.webkit.org/320094@main)\n- **Web Platform** Re-imported WPT coverage for `css/css-overflow` and `css/css-ui`. [commit 320090@main](https://commits.webkit.org/320090@main)\n- **Web Platform** Added support for `text-overflow: \u003cstring\u003e` on `\u003cinput\u003e`. [commit 320088@main](https://commits.webkit.org/320088@main)\n\n### UI process and compositing\n- **UI** Fixed a regression causing UI process crashes during DisplayLink callbacks for RemoteLayerTree DisplayLink clients. [commit 320097@main](https://commits.webkit.org/320097@main)\n- **Rendering** Added locking around `m_momentumEventDispatcher` access in `RemoteLayerTreeEventDispatcher`. [commit 320096@main](https://commits.webkit.org/320096@main)\n\n### Media\n- **Media** Fixed a fullscreen regression where every video after the first would pop back to inline playback. [commit 320084@main](https://commits.webkit.org/320084@main)\n- **Refactor** Removed duplicate `isIPAddressDisallowed()` computation in `HTMLMediaElement::isSafeToLoadURL()`. [commit 320082@main](https://commits.webkit.org/320082@main)\n- **Refactor** Cleaned up redundant `HTMLVideoElement::player()` calls and protections in several accessors. [commit 320081@main](https://commits.webkit.org/320081@main)\n\n### Platform ports and GLib\n- **Build** Unskipped IPC colorspace tests on the GLib ports. [commit 320101@main](https://commits.webkit.org/320101@main)\n- **Rendering** Fixed a GLib regression by applying advance height only when the font has a `vmtx` table. [commit 320100@main](https://commits.webkit.org/320100@main)\n- **Refactor** Landed GLib layout test gardening for 2026-08-29. [commit 320098@main](https://commits.webkit.org/320098@main)\n\n### Tooling and test infrastructure\n- **DevTools** Updated WebDriver tools tests that still depended on the deprecated `event_loop` fixture from `pytest-asyncio`. [commit 320106@main](https://commits.webkit.org/320106@main)\n- **Build** Activated flaky test verdicts in EWS, which should make signal handling in bots more actionable. [commit 320087@main](https://commits.webkit.org/320087@main)\n\n### Safer C++ and code health\n- **Build** Updated safer C++ expectations to the 2026-08-28 baseline. [commit 320095@main](https://commits.webkit.org/320095@main)\n- **Refactor** Addressed more Source/WebKit warnings found by the latest SaferCPP static analyzer. [commit 320093@main](https://commits.webkit.org/320093@main)\n\n### Extensions\n- **Mobile** Enabled the offscreen web extension API. [commit 320085@main](https://commits.webkit.org/320085@main)",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [
    {
      "name": "Unreviewed",
      "count": 3
    }
  ],
  "since": "2026-08-29",
  "totals": {
    "commits": 26,
    "features": 23,
    "rolls": 3
  },
  "until": "2026-08-29"
}