{
  "commits": {
    "320107@main": {
      "author": "Patrick Griffis",
      "avatar": "https://www.gravatar.com/avatar/2233c3a857004b126158572af9fe36f7?d=identicon\u0026s=64",
      "cl": "320107@main",
      "clUrl": "https://commits.webkit.org/320107@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322655\n\nReviewed by Philippe Normand.\n\nThe Thunder parser's inner parsebin sorted its autoplug candidates by\nrank alone so a decoder (dav1ddec) could outrank a parser (av1parse).\nIn this case it was causing a \"better\" decoder (vaav1dec) to be skipped\nand fall back to software decoding.\n\nSort parsers before decoders, matching gst-plugins-base's own parsebin.\n\n* Source/WebCore/platform/graphics/gstreamer/eme/WebKitThunderParser.cpp:\n(compareParserAndDecoderFactories):\n(webkitMediaThunderParserConstructed):\n\nCanonical link: https://commits.webkit.org/320107@main",
      "email": "pgriffis@igalia.com",
      "hash": "bfd4410656a44ed520899a1628980fe7275d3d61",
      "subject": "[GStreamer] Auto-plug parsers before decoders in the Thunder parser"
    },
    "320108@main": {
      "author": "Dewei Zhu",
      "avatar": "https://www.gravatar.com/avatar/4988258e20a8ef29c6cc3622776943b4?d=identicon\u0026s=64",
      "cl": "320108@main",
      "clUrl": "https://commits.webkit.org/320108@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322914\nrdar://186179555\n\nReviewed by Mark Lam.\n\nSkip PGO profiling for JavaScriptCoreTools to fix PGO instrument binary build.\n\n* Source/JavaScriptCore/Configurations/libJavaScriptCoreTools.xcconfig:\n\nCanonical link: https://commits.webkit.org/320108@main",
      "email": "dewei_zhu@apple.com",
      "hash": "382a689967f2ad2a8935acf90464a58ba05c3bee",
      "subject": "Skip PGO profiling for JavaScriptCoreTools."
    },
    "320109@main": {
      "author": "Fujii Hironori",
      "avatar": "https://www.gravatar.com/avatar/ef99cb23f5e5d27977968ca097d9a85f?d=identicon\u0026s=64",
      "cl": "320109@main",
      "clUrl": "https://commits.webkit.org/320109@main",
      "description": "Unreviewed.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/gtk/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320109@main",
      "email": "fujii@igalia.com",
      "hash": "faa08bc4cb8595c60c7290eeddd0b5dbe83195b6",
      "subject": "[GLib] layout test gardening 2026-08-30"
    },
    "320110@main": {
      "author": "Sam Weinig",
      "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64",
      "cl": "320110@main",
      "clUrl": "https://commits.webkit.org/320110@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322907\n\nReviewed by Tim Nguyen.\n\nRemove unused tryResolved() from CSS::CustomIdent. It was remnant from when the\nident() function was not a substitution function.\n\n* Source/WebCore/css/values/primitives/CSSCustomIdent.h:\n(WebCore::CSS::CustomIdent::tryResolved const): Deleted.\n\nCanonical link: https://commits.webkit.org/320110@main",
      "email": "sam@webkit.org",
      "hash": "61474c0d29972a80b7d7528c236ae79bc04bb0a5",
      "subject": "Remove unused tryResolved() from CSS::CustomIdent"
    },
    "320111@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "320111@main",
      "clUrl": "https://commits.webkit.org/320111@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322887\n\nReviewed by Yusuke Suzuki.\n\nModule-scoped function declarations are instantiated when the module is\nlinked: CyclicModuleRecord::initializeEnvironment links each\nUnlinkedFunctionExecutable into a FunctionExecutable, wraps it in a\nJSFunction and stores it in the module environment. When the module is\nlater evaluated, CodeBlock::finishCreation links every functionDecl of\nthe module program again and keeps the second FunctionExecutable in\nm_functionDecls, even though no op_new_func in the module body ever\nreads it. Every heap-allocated function declaration in a module thus\ncosts two FunctionExecutables, one of which is dead on arrival.\n\nWhen linking a ModuleCode CodeBlock, look the declaration up in the\nmodule environment first. If the slot still holds a JSFunction whose\nexecutable was linked from the same UnlinkedFunctionExecutable for this\nmodule, reuse that executable; otherwise (stack-allocated declarations,\nblock-scoped declarations that shadow a module-level name, bindings\nreassigned before evaluation) link a new one as before.\n\nLoading 1000 synthetic modules with 17 module-scoped function\ndeclarations each, a heap snapshot after evaluation shows\nFunctionExecutable 47,060 -\u003e 30,060 (6.02 MB -\u003e 3.85 MB), and the\nnumber of FunctionExecutables sharing an UnlinkedFunctionExecutable\ndrops from 17,000 to 0. Peak RSS goes from 92.0 MB to 89.9 MB, and\nparse + link + evaluate time for the same modules did not change\n(92-97 ms before, 92-95 ms after).\n\nTests: JSTests/modules/module-function-declaration-executable-reuse-jettison.js\n       JSTests/modules/module-function-declaration-executable-reuse-jettison/a.js\n       JSTests/modules/module-function-declaration-executable-reuse.js\n       JSTests/modules/module-function-declaration-executable-reuse/a.js\n       JSTests/modules/module-function-declaration-executable-reuse/b.js\n       JSTests/modules/module-function-declaration-executable-reuse/same-1.js\n       JSTests/modules/module-function-declaration-executable-reuse/same-2.js\n       JSTests/modules/module-function-declaration-executable-reuse/same-setter.js\n\n* JSTests/modules/module-function-declaration-executable-reuse-jettison.js: Added.\n* JSTests/modules/module-function-declaration-executable-reuse-jettison/a.js: Added.\n(export.f):\n(export.g):\n(export.h):\n(s):\n(h):\n(Promise.resolve.then):\n(f):\n* JSTests/modules/module-function-declaration-executable-reuse.js: Added.\n* JSTests/modules/module-function-declaration-executable-reuse/a.js: Added.\n(export.f):\n(export.g):\n(export.h):\n(export.k):\n(export.setG):\n(export.setH):\n(export.setK):\n(export.gen):\n(export.async asyncFn):\n(export.async asyncGen):\n(captured):\n(export.callCaptured):\n(local):\n(f):\n* JSTests/modules/module-function-declaration-executable-reuse/b.js: Added.\n(setG):\n* JSTests/modules/module-function-declaration-executable-reuse/same-1.js: Added.\n(export.f):\n(export.setF):\n* JSTests/modules/module-function-declaration-executable-reuse/same-2.js: Added.\n(export.f):\n(export.setF):\n* JSTests/modules/module-function-declaration-executable-reuse/same-setter.js: Added.\n* Source/JavaScriptCore/bytecode/CodeBlock.cpp:\n(JSC::instantiatedModuleFunctionExecutable):\n(JSC::CodeBlock::finishCreation):\n\nCanonical link: https://commits.webkit.org/320111@main",
      "email": "sosuke@bun.sh",
      "hash": "df289ce5519a13955bd806c44904ce32cca6bcd9",
      "subject": "[JSC] Reuse `FunctionExecutables` instantiated for module function declarations"
    },
    "320112@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "320112@main",
      "clUrl": "https://commits.webkit.org/320112@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322774\nrdar://186036234\n\nReviewed by Marcus Plutowski and Dan Hecht.\n\nSystem page size is 16KB (on Darwin at least) and MarkedBlock size is\nalso 16KB. We end up having a page-fault for each MarkedBlock allocation\nand it is really costly when it is executed synchronously. On M5 device,\neach page-fault cost is 700ns.\n\nThis patch introduces WarmUpBlockProvider. This holds its own helper\nthread via AutomaticThread, and offering a pre-page-faulted warmed-up\nMarkedBlocks if possible. This manages a buffer of pre-page-faulted pages\nand provides them. If it is exhausted, thread is launched / acked and\nstart allocating a new pages and perform page-fault concurrently to the\nmutator.\n\nMemory scores (Membuster7 / PLUM4) are both neutral.\n\n* JSTests/stress/warm-up-marked-blocks-state-machine.js: Added.\n* JSTests/stress/warm-up-marked-blocks.js: Added.\n(shouldBe):\n* Source/JavaScriptCore/heap/FastMallocAlignedMemoryAllocator.cpp:\n(JSC::warmUpMarkedBlockStateForTesting):\n(JSC::setWarmUpMarkedBlockAllocationShouldFailForTesting):\n(JSC::FastMallocAlignedMemoryAllocator::tryAllocateAlignedMemory):\n* Source/JavaScriptCore/heap/FastMallocAlignedMemoryAllocator.h:\n* Source/JavaScriptCore/runtime/OptionsList.h:\n* Source/JavaScriptCore/tools/JSDollarVM.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n(JSC::JSDollarVM::finishCreation):\n\nCanonical link: https://commits.webkit.org/320112@main",
      "email": "ysuzuki@apple.com",
      "hash": "0839f9342ed5056785ce58ed9c5a0f92b323f625",
      "subject": "[JSC] Introduce JSC WarmUpThread for MarkedBlocks"
    },
    "320113@main": {
      "author": "Eric Carlson",
      "avatar": "https://www.gravatar.com/avatar/e227ff07cc6d645fc1c69fd56c2c8cb8?d=identicon\u0026s=64",
      "cl": "320113@main",
      "clUrl": "https://commits.webkit.org/320113@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322299\nrdar://185537144\n\nReviewed by Jean-Yves Avenard.\n\nThe GPU process selects the single system NowPlaying session across processes, but a\nremote-control command it receives from the system was still delivered by local\nre-selection: GPUConnectionToWebProcess sent the command to the elected web process,\nWebProcess::didReceiveRemoteCommand handed it to every page, and each\nMediaSessionManagerInterface ran its own inline loop over its sessions (first\nNowPlaying-eligible session, else the first that could receive commands). That reached\nthe right process but not necessarily the specific session the GPU elected, and it could\ndeliver spuriously to a non-elected page sharing the elected process. And when no session\nwas NowPlaying-eligible, the command was dropped entirely — unlike the non-site-isolated\npath, which falls back to the current session.\n\nMake site-isolated delivery match the non-site-isolated behavior (best eligible\nsession, else the current session):\n\n- Thread the elected session's identifier through the received-command path.\n  GPUConnectionToWebProcess::didReceiveRemoteControlCommand includes\n  GPUProcess::remoteCommandTargetSessionInProcess() in the DidReceiveRemoteCommand message,\n  threaded through GPUProcessConnection, WebProcess, and WebPage into\n  MediaSessionManagerInterface::processDidReceiveRemoteControlCommand as an optional\n  targetSession. When set, the manager delivers to the one session whose\n  mediaSessionIdentifier matches (and that can receive remote commands) rather than\n  re-selecting locally; a manager that does not own it delivers to nobody. When it is\n  not set (non-site-isolated NowPlaying) behavior is unchanged: best eligible session,\n  then the first that can receive commands. The parameter defaults to nullopt so\n  existing callers are unaffected.\n\n  processDidReceiveRemoteControlCommand now returns whether a session took the command, so\n  WebProcess::didReceiveRemoteCommand can stop at the first page that claims an elected\n  session instead of fanning out to all of them. If no page claims it — the elected session\n  was destroyed or stopped accepting commands between the election and delivery, since\n  DidReceiveRemoteCommand is asynchronous, or it was elected without being command-capable\n  (nowPlayingEligibleSession() does not consult canReceiveRemoteControlCommands(), and\n  AudioContext::canReceiveRemoteControlCommands() is false outside ENABLE(DOM_AUDIO_SESSION))\n  — the pass runs again with nullopt so the command is not dropped. That retry is best\n  effort: page iteration order is not stable and each page has its own manager under site\n  isolation, so there is no cross-page current-session order to follow in the web process.\n\n- Route the command even when no session is NowPlaying-eligible. The GPU process cannot\n  know the cross-process current-session order, but the UI process does:\n  RemoteMediaSessionManagerProxy mirrors every process's session and, whenever the\n  current session changes, reports the first command-capable one to the GPU process via\n  SetNowPlayingFallbackSession. When the election has no eligible owner,\n  GPUProcess::recomputeNowPlayingOwner seats that session's connection as a command-only\n  client (becomeRemoteCommandFallbackTarget: it becomes the NowPlayingManager client so\n  commands reach it and the system command listener stays alive, but it is not shown in\n  the NowPlaying panel). The eligible owner (m_activeNowPlayingOwner: panel, audio,\n  now-playing-app registration) is kept separate from the remote-command target\n  (m_remoteCommandTarget: where a received command is delivered).\n\n  The fallback names an exact session rather than only its process. Only the UI process\n  knows the app-wide current-session order, and a process can host several pages that each\n  have their own manager, so letting the target process re-select would let a page that is\n  not the current session claim the command — the same spurious delivery this change\n  removes for the elected case. The retry above covers the cost, which is that an exact\n  identifier can go stale in flight.\n\n- GPUProcess::nowPlayingClientDidClose resigns the seat when a seated web process goes\n  away. GPUConnectionToWebProcess::didClose used to delegate resigning to a recompute, but\n  the closing connection is still in GPUProcess::m_webProcessConnections at that point and\n  gone by the time the recompute from removeGPUConnectionToWebProcess runs, so a resign\n  that looks the connection up by process identifier silently did nothing: the\n  NowPlayingManager kept a dead client, its remote-command listener stayed registered, and\n  MediaSessionManagerCocoa::clearNowPlayingInfo() was never called, leaving a stale system\n  NowPlaying panel. didClose now resigns directly, and the GPU process drops any fallback\n  or command-target state naming the closing process before recomputing so the closing\n  connection cannot be seated again as the command-only fallback.\n\n- The fallback walk skips a session whose web process is gone instead of giving up on it,\n  so a later qualifying session is still reported.\n\n- setNowPlayingFallbackSession only recomputes when there is no eligible owner. The\n  fallback is read only when the election finds no winner, and every change to the\n  candidates recomputes on its own, so an owner means a new fallback cannot change the\n  outcome.\n\n- The fallback session is seeded into a new GPU process through\n  GPUProcessCreationParameters rather than a didFinishLaunching hook, so it arrives before\n  any web process can connect and there is no \"every GPU launch resets the cache\" invariant\n  to maintain.\n\nTo let a layout test drive the whole path the way a real system command arrives,\nInternals::postSystemRemoteControlCommand injects the command at the GPU process's\nNowPlayingManager rather than calling the manager directly. It is separate from\npostRemoteControlCommand (which injects into the local manager) because the GPU\ninjection is gated on AllowTestOnlyIPC — which the existing media/remote-control-command\ntests do not enable — and because WebKitLegacy has no GPU process. It asks\nMediaStrategy::postNowPlayingRemoteControlCommandToGPUProcessForTesting to hand the command\nto the GPU process, and delivers through the local manager itself when there is none\n(WebKitLegacy and non-GPU WebKit). Internals::elementIsRemoteCommandTargetInGPUProcess\nreports whether the GPU process would route a received command to a given element's\nsession, which — unlike elementIsActiveNowPlayingSessionInGPUProcess — is also true for the\ncommand-only fallback, so a test can wait for the seat instead of re-posting the command\nuntil it lands.\n\nDrive-by: the guard on processDidReceiveRemoteControlCommand was #if ENABLE(VIDEO) ||\nENABLE(audio); ENABLE(audio) is always false, so it now reads ENABLE(WEB_AUDIO). This makes the\nfunction dispatch commands to WebAudio sessions in a VIDEO-off/WEB_AUDIO-on build.\n\n* LayoutTests/http/tests/site-isolation/now-playing-elected-across-frames.html:\n* LayoutTests/http/tests/site-isolation/now-playing-reelects-on-resize.html:\n* LayoutTests/http/tests/site-isolation/now-playing-remote-command-no-owner.html: Added.\n* LayoutTests/http/tests/site-isolation/now-playing-remote-command-no-owner-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/now-playing-remote-command-routing.html: Added.\n* LayoutTests/http/tests/site-isolation/now-playing-remote-command-routing-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/resources/now-playing-test-helpers.js: Added.\n(waitForSubframeMessage.):\n(waitForSubframeMessage):\n(subframeIsActiveNowPlaying):\n(subframeIsPaused):\n* LayoutTests/http/tests/site-isolation/resources/now-playing-frame.html:\n* LayoutTests/media/utilities.js:\n(async waitUntil):\n* Source/WebCore/platform/MediaSessionIdentifier.h:\n* Source/WebCore/platform/MediaStrategy.cpp:\n(WebCore::MediaStrategy::isRemoteCommandTargetSessionInGPUProcessForTesting):\n* Source/WebCore/platform/MediaStrategy.h:\n(WebCore::MediaStrategy::postNowPlayingRemoteControlCommandToGPUProcessForTesting):\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.cpp:\n(WebCore::MediaSessionManagerInterface::processDidReceiveRemoteControlCommand):\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.h:\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::remoteControlCommandForString):\n(WebCore::Internals::postRemoteControlCommand):\n(WebCore::Internals::postSystemRemoteControlCommand):\n(WebCore::Internals::elementIsRemoteCommandTargetInGPUProcess):\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\n* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.cpp:\n(WebKit::GPUConnectionToWebProcess::setNowPlayingInfoForPage):\n(WebKit::GPUConnectionToWebProcess::becomeRemoteCommandFallbackTarget):\n(WebKit::GPUConnectionToWebProcess::resignNowPlayingManagerClient):\n(WebKit::GPUConnectionToWebProcess::nowPlayingClientDidClose):\n(WebKit::GPUConnectionToWebProcess::isRemoteCommandTargetSessionForTesting):\n(WebKit::GPUConnectionToWebProcess::postNowPlayingRemoteControlCommandForTesting):\n(WebKit::GPUConnectionToWebProcess::didReceiveRemoteControlCommand):\n(WebKit::GPUConnectionToWebProcess::didClose):\n(WebKit::GPUConnectionToWebProcess::clearNowPlayingInfoForPage):\n(WebKit::GPUConnectionToWebProcess::becomeNowPlayingOwner):\n(WebKit::GPUConnectionToWebProcess::updateSupportedRemoteCommands):\n(WebKit::GPUConnectionToWebProcess::resignNowPlayingOwner): Deleted.\n* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.h:\n* Source/WebKit/GPUProcess/GPUConnectionToWebProcess.messages.in:\n* Source/WebKit/GPUProcess/GPUProcess.cpp:\n(WebKit::GPUProcess::initializeGPUProcess):\n(WebKit::GPUProcess::recomputeNowPlayingOwner):\n(WebKit::GPUProcess::setNowPlayingFallbackSession):\n(WebKit::GPUProcess::nowPlayingClientDidClose):\n(WebKit::GPUProcess::remoteCommandTargetSessionInProcess const):\n* Source/WebKit/GPUProcess/GPUProcess.h:\n* Source/WebKit/GPUProcess/GPUProcess.messages.in:\n* Source/WebKit/GPUProcess/GPUProcessCreationParameters.h:\n* Source/WebKit/GPUProcess/GPUProcessCreationParameters.serialization.in:\n* Source/WebKit/Scripts/webkit/messages.py:\n(types_that_cannot_be_forward_declared):\n(headers_for_type):\n* Source/WebKit/Shared/ProcessQualified.serialization.in:\n* Source/WebKit/UIProcess/GPU/GPUProcessProxy.cpp:\n(WebKit::GPUProcessProxy::GPUProcessProxy):\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.cpp:\n(WebKit::RemoteMediaSessionManagerProxy::addMediaSession):\n(WebKit::RemoteMediaSessionManagerProxy::removeMediaSession):\n(WebKit::RemoteMediaSessionManagerProxy::webProcessWillShutDown):\n(WebKit::RemoteMediaSessionManagerProxy::updateMediaSessionStates):\n(WebKit::RemoteMediaSessionManagerProxy::mediaSessionStateChanged):\n(WebKit::RemoteMediaSessionManagerProxy::setCurrentSession):\n(WebKit::RemoteMediaSessionManagerProxy::computeNowPlayingFallbackSession const):\n(WebKit::RemoteMediaSessionManagerProxy::updateNowPlayingFallbackSession):\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.h:\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionProxy.cpp:\n(WebKit::RemoteMediaSessionProxy::qualifiedSessionIdentifier const):\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionProxy.h:\n* Source/WebKit/WebProcess/GPU/GPUProcessConnection.cpp:\n(WebKit::GPUProcessConnection::didReceiveRemoteCommand):\n* Source/WebKit/WebProcess/GPU/GPUProcessConnection.h:\n* Source/WebKit/WebProcess/GPU/GPUProcessConnection.messages.in:\n* Source/WebKit/WebProcess/GPU/media/WebMediaStrategy.cpp:\n(WebKit::WebMediaStrategy::isRemoteCommandTargetSessionInGPUProcessForTesting):\n(WebKit::WebMediaStrategy::postNowPlayingRemoteControlCommandToGPUProcessForTesting):\n* Source/WebKit/WebProcess/GPU/media/WebMediaStrategy.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::didReceiveRemoteCommand):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Source/WebKit/WebProcess/WebProcess.cpp:\n(WebKit::WebProcess::didReceiveRemoteCommand):\n* Source/WebKit/WebProcess/WebProcess.h:\n\nCanonical link: https://commits.webkit.org/320113@main",
      "email": "eric.carlson@apple.com",
      "hash": "1392437bb060048807e94d171c0fdf45e7d27301",
      "subject": "[Site Isolation] Deliver a received remote-control command to the same session with and without site isolation"
    },
    "320114@main": {
      "author": "Jean-Yves Avenard",
      "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64",
      "cl": "320114@main",
      "clUrl": "https://commits.webkit.org/320114@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322886\nrdar://186133638\n\nReviewed by Eric Carlson.\n\nIn 320050@main, VideoInfo::fieldCount was made to mimic kCVImageBufferFieldCountKey.\nHowever, this value can only ever have a value of 1 or 2 or not be set.\n\nWe make it an enum which ease the IPC serialization value checks.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/cocoa/CoreMediaUtilities.mm\n\n* Source/WebCore/platform/TrackInfo.h:\n(WebCore::VideoInfo::fieldCount const):\n* Source/WebCore/platform/graphics/avfoundation/FormatDescriptionUtilities.cpp:\n(WebCore::fieldCountFromFormatDescription):\n* Source/WebCore/platform/graphics/avfoundation/FormatDescriptionUtilities.h:\n* Source/WebCore/platform/graphics/cocoa/CMUtilities.mm:\n(WebCore::createFormatDescriptionFromTrackInfo):\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/CoreMediaUtilities.mm:\n(TestWebKitAPI::TEST(CMUtilities, FieldCountAndDetailRoundTrip)):\n\nCanonical link: https://commits.webkit.org/320114@main",
      "email": "jya@apple.com",
      "hash": "5e2ef4f0b30f3e1c697526da3ed43425770ea95a",
      "subject": "VideoInfo::fieldCount should be an enum."
    },
    "320115@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "320115@main",
      "clUrl": "https://commits.webkit.org/320115@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322875\nrdar://186102748\n\nReviewed by Antti Koivisto.\n\n316706@main dropped the BaselineGroup::computeSize() \u003e 1 guard from baselineOffsetForGridItem() on the assumption\nthat a single participant's max ascent is its own ascent, so that the offset is already zero.\nThat only holds while the ascent is stable: it is collected in computeBaselineAlignmentContext()\nand computed again when the offset is queried. An item whose used size is only resolved after track sizing\n(e.g. a replaced item with a percentage max-width) reports a smaller ascent by then, and the stale, larger max ascent turns into\na baseline offset that pushes the single item away from the start of its grid area.\n\nTrack the number of alignment subjects next to the max ascent in GridBaselineAlignment's per-context state and restore the guard (similar to what we had before 316706@main).\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-align-baseline-single-item-001-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-align-baseline-single-item-001.html: Added.\n* Source/WebCore/rendering/GridBaselineAlignment.cpp:\n(WebCore::GridBaselineAlignment::updateBaselineAlignmentContext):\n(WebCore::GridBaselineAlignment::baselineOffsetForGridItem const):\n* Source/WebCore/rendering/GridBaselineAlignment.h:\n\nCanonical link: https://commits.webkit.org/320115@main",
      "email": "zalan@apple.com",
      "hash": "04390f8f4dde2cbb5a70d9d04ed5ffc4bb360f14",
      "subject": "REGRESSION(316706@main) tess.oconnor.cx: lots of spacing between image and content towards bottom of page"
    },
    "320116@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "320116@main",
      "clUrl": "https://commits.webkit.org/320116@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322772\n\u003crdar://problem/186035576\u003e\n\nReviewed by Antti Koivisto.\n\nThis is a preparation for repainting an ink overflow only style change (a link picking up an underline on hover, say)\nwithout running inline layout and repainting a block wide band, which is webkit.org/b/322481.\n\nInk overflow is built in two places today. InlineDisplayContentBuilder inflates each display box as it appends it\nand does so by inflating whatever the box already has. That makes the computation a one-shot part of building display\ncontent: it cannot be re-run on live content without double counting, and it can never shrink.\n\nEverything in that list except glyph overflow is derived from style and box geometry, neither of which\nneeds inline layout to produce. Only glyph overflow is measured, and it arrives on Line::Run, which is\ngone once layout is done. So cache that one value on the display box and move the rest out to\nInlineContentBuilder, next to the line and block level overflow it already aggregates. The pass now\nsets ink overflow from the box's visual rect rather than inflating it, which makes it correct to run at\nany point after the boxes are positioned, not just while they are being appended.\n\nNo behavior change.\n\n* Source/WebCore/layout/formattingContexts/inline/InlineLayoutState.h: Carry whether anything on the\n(WebCore::Layout::InlineLayoutState::setContentMayHaveInkOverflow):\n(WebCore::Layout::InlineLayoutState::contentMayHaveInkOverflow const):\ncontent can produce ink overflow, so the integration pass keeps the early out the two collecting passes\nused to have.\n* Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayBox.h: Cache the measured glyph\n(WebCore::InlineDisplay::Box::setInkOverflow):\n(WebCore::InlineDisplay::Box::glyphOverflow const):\n(WebCore::InlineDisplay::Box::setGlyphOverflow):\n(WebCore::InlineDisplay::Box::adjustInkOverflow): Deleted.\noverflow. It fits in the padding after the existing flags, so InlineDisplay::Box does not grow.\n* Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayContentBuilder.cpp: Remove\n(WebCore::Layout::InlineDisplayContentBuilder::build):\n(WebCore::Layout::InlineDisplayContentBuilder::buildTextOnlyContent):\n(WebCore::Layout::InlineDisplayContentBuilder::appendTextDisplayBox):\n(WebCore::Layout::InlineDisplayContentBuilder::appendAtomicInlineLevelDisplayBox):\n(WebCore::Layout::InlineDisplayContentBuilder::appendInlineBoxDisplayBox):\n(WebCore::Layout::InlineDisplayContentBuilder::adjustVisualGeometryForDisplayBox):\n(WebCore::Layout::computeInkOverflowForInlineLevelBox): Deleted.\n(WebCore::Layout::adjustInkOverflowForInlineBox): Deleted.\n(WebCore::Layout::InlineDisplayContentBuilder::collectInkOverflowForInlineBoxes): Deleted.\n(WebCore::Layout::logicalBottomForTextDecorationContent): Deleted.\n(WebCore::Layout::InlineDisplayContentBuilder::collectInkOverflowForTextDecorations): Deleted.\n(WebCore::Layout::isNestedInlineBoxWithDifferentFontCascadeFromParent):\ncollectInkOverflowForTextDecorations, collectInkOverflowForInlineBoxes, computeInkOverflowForInlineLevelBox\nand the per box inflation. Boxes are now appended with their visual rect as ink overflow.\n* Source/WebCore/layout/formattingContexts/inline/display/InlineDisplayContentBuilder.h:\n* Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContent.h:\n(WebCore::LayoutIntegration::InlineContent::setContentMayHaveInkOverflow):\n(WebCore::LayoutIntegration::InlineContent::contentMayHaveInkOverflow const):\n* Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.cpp: Added\n(WebCore::LayoutIntegration::InlineContentBuilder::build const):\n(WebCore::LayoutIntegration::strokeAndTextShadowInkOverflowOutsets):\n(WebCore::LayoutIntegration::logicalBottomForTextDecorationContent):\n(WebCore::LayoutIntegration::inkOverflowOutsetsForTextDecorations):\n(WebCore::LayoutIntegration::InlineContentBuilder::updateInkOverflow const):\n(WebCore::LayoutIntegration::InlineContentBuilder::updateInkOverflowForText):\n(WebCore::LayoutIntegration::InlineContentBuilder::updateInkOverflowForInlineBoxes):\n(WebCore::LayoutIntegration::InlineContentBuilder::handlePartialDisplayContentUpdate const):\nupdateInkOverflow, run per line before adjustDisplayLines aggregates line and block overflow. Note it\ngroups boxes by their line index, since the display lines do not know their box range until\nadjustDisplayLines assigns it.\n* Source/WebCore/layout/integration/inline/LayoutIntegrationInlineContentBuilder.h:\n* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp: Set the flag before build so\n(WebCore::LayoutIntegration::LineLayout::constructContent):\nthe pass can see it.\n\nCanonical link: https://commits.webkit.org/320116@main",
      "email": "zalan@apple.com",
      "hash": "96aed036df641ad9b132882fbe9ff47d1e10a521",
      "subject": "[IFC] Compute style driven ink overflow in the integration layer instead of InlineDisplayContentBuilder"
    },
    "320117@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "320117@main",
      "clUrl": "https://commits.webkit.org/320117@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322714\nrdar://problem/186101273\n\nReviewed by Antti Koivisto.\n\n  \u003cdiv id=grid style=\"display: grid; grid-template-columns: 1fr 1fr; width: 200px\"\u003e\n    \u003cdiv style=\"aspect-ratio: 1.5\"\u003e\u003c/div\u003e\n    \u003cdiv\u003e\u003c/div\u003e\n  \u003c/div\u003e\n  \u003cscript\u003egrid.style.width = \"150px\"\u003c/script\u003e\n\nAfter the shrink both 1fr columns should be 75px wide. Instead the first one\nstayed 100px and the second got the leftover 50px.\n\nGrid runs a second column sizing pass for items whose inline size depends on\ntheir block size, and it measures them with the row size installed as an\noverriding block size. The aspect ratio then transfers that row size into the\nitem's inline size, and the 100px result gets cached as the item's min-content\ncontribution. shouldInvalidateContentWidths(), which tells the next layout to\nmeasure again, only covered flex items, so the 100px stayed cached and floored\nthe flexible track. Growing the container hid this because the larger fr share\nwas already above the stale value.\n\nAdd grid items next to the flex item case, which 241542@main added for the same\nreason.\n\n* Source/WebCore/rendering/RenderBox.cpp:\n(WebCore::RenderBox::shouldInvalidateContentWidths const):\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-items/aspect-ratio-grid-item-dynamic-container-shrink-001{,-ref,-expected}.html: Added.\n\nCo-Authored-By: Claude Opus 5 (1M context) \u003cnoreply@anthropic.com\u003e\nCanonical link: https://commits.webkit.org/320117@main",
      "email": "zalan@apple.com",
      "hash": "e4856c6696f58bae6f5cf1e864d0550f9eff09f8",
      "subject": "[Grid] Grid item with an aspect ratio keeps its stale inline contribution when the grid container shrinks"
    },
    "320118@main": {
      "author": "Mike Wyrzykowski",
      "avatar": "https://www.gravatar.com/avatar/4b1bc9e238714f95e22d5d2454c07066?d=identicon\u0026s=64",
      "cl": "320118@main",
      "clUrl": "https://commits.webkit.org/320118@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317317\nrdar://179876979\n\nReviewed by Dan Glastonbury.\n\nCorrect race window where deallocated Vector or SharedMemory\ncan be written to by swapping in user memory.\n\nNo new tests as race window is incredibly small: memory\nmust be freed prior to being wired to the GPU.\n\n* Source/WebGPU/WebGPU/Queue.mm:\n(WebGPU::Queue::writeTexture):\n* Source/WebGPU/WebGPU/Queue.swift:\n* Source/WebGPU/WebGPU/RenderPipeline.mm:\n(WebGPU::Device::addPipelineLayouts):\n* Source/WebGPU/WebGPU/WebGPUExt.h:\n* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteQueue.cpp:\n(WebKit::RemoteQueue::writeBuffer):\n(WebKit::RemoteQueue::writeTexture):\n\nOriginally-landed-as: 305413.1010@safari-7624.5-branch (4a92fe2ccba1). rdar://185367080\nCanonical link: https://commits.webkit.org/320118@main",
      "email": "mwyrzykowski@apple.com",
      "hash": "d4a150e51b113197eacb4580d89142a4a0f8f318",
      "subject": "Race window lead to reads from deallocated memory"
    },
    "320119@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "320119@main",
      "clUrl": "https://commits.webkit.org/320119@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322864\n\u003crdar://problem/186110844\u003e\n\nReviewed by Antti Koivisto.\n\n  \u003cdiv style=\"display: none\"\u003e\n    \u003ciframe srcdoc=\"\u003cstyle id='sheet'\u003e#container { container-type: size }\u003c/style\u003e\n                    \u003cdiv id='container'\u003e\u003cspan id='target'\u003etext\u003c/span\u003e\u003c/div\u003e\"\u003e\u003c/iframe\u003e\n  \u003c/div\u003e\n\nAfter touching the frame's stylesheet, getComputedStyle(target).color should return a color.\nInstead we end up triggering style recalc in an infinite loop until the web process crashes.\n\nA frame whose owner element does not generate a box (e.g. display: none) has no render tree, so resolveStyle()\nreturns without doing anything and the recalc the stylesheet change scheduled stays pending forever.\nElement::resolveComputedStyle() asks for a style update on reaching a size query container, and since that\nupdate reports that it resolved style, re-enters computedStyle(), which comes back to the same container and\nasks again.\n\nFix by reporting no pending recalc while the render tree is withheld (matches Firefox), the way a document in\nthe back/forward cache already does. Showing the frame again resolves the style in createRenderTree().\n\n* LayoutTests/imported/w3c/web-platform-tests/css/cssom/getComputedStyle-in-unrendered-subframe-with-query-container-crash.html: Added.\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::needsStyleRecalc const):\n(WebCore::Document::updateStyleIfNeeded): Assert what the above now guarantees, since resolving style here\n  depends on it from a distance.\n\nCanonical link: https://commits.webkit.org/320119@main",
      "email": "zalan@apple.com",
      "hash": "e903a14baabdd0c7d1c1c9df8d18c54d0ba0f1e0",
      "subject": "REGRESSION(319910@main): unifi.ui.com crashes with unbounded recursion in Element::resolveComputedStyle"
    },
    "320120@main": {
      "author": "Sam Weinig",
      "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64",
      "cl": "320120@main",
      "clUrl": "https://commits.webkit.org/320120@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322904\n\nReviewed by Darin Adler.\n\nReplaces use of `const String\u0026` for input to CSS parsing functions with StringView\nto allow callers more options for how they store the input.\n\n* Source/WebCore/css/CSSGroupingRule.cpp:\n* Source/WebCore/css/CSSStyleRule.cpp:\n* Source/WebCore/css/parser/CSSParser.cpp:\n* Source/WebCore/css/parser/CSSParser.h:\n* Source/WebCore/css/parser/CSSPropertyParser.cpp:\n* Source/WebCore/css/parser/CSSPropertyParser.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Animations.cpp:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Animations.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Color.cpp:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Color.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+ColorAdjust.cpp:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+ColorAdjust.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+ColorInlines.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Easing.cpp:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Easing.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Filter.cpp:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Filter.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Font.cpp:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Font.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Timeline.cpp:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Timeline.h:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Transform.cpp:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Transform.h:\n* Source/WebCore/css/parser/CSSSelectorParser.cpp:\n* Source/WebCore/css/parser/CSSSelectorParser.h:\n* Source/WebCore/css/parser/CSSSupportsParser.cpp:\n* Source/WebCore/css/parser/CSSSupportsParser.h:\n* Source/WebCore/css/parser/SizesAttributeParser.cpp:\n* Source/WebCore/css/parser/SizesAttributeParser.h:\n* Source/WebCore/inspector/InspectorStyleSheet.cpp:\n* Source/WebCore/svg/SVGAngleValue.cpp:\n* Source/WebCore/svg/SVGAngleValue.h:\n\nCanonical link: https://commits.webkit.org/320120@main",
      "email": "sam@webkit.org",
      "hash": "c119008088192c83b7861bcbaf24a675f9d7e837",
      "subject": "Use StringView for more CSS parsing functions now that CSSTokenizer supports it"
    },
    "320121@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "320121@main",
      "clUrl": "https://commits.webkit.org/320121@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322893\nrdar://186146979\n\nReviewed by Richard Robinson.\n\nwtf/Expected.h is a thin alias header that is being removed. Three code\ngeneration methods reference the alias by name, so we update both the\ngenerators and their inputs (.messages.in, .serialization.in, and\nopaque_ipc_types.tracking.in).\n\nNo new tests because this patch does not introduce a behavior change.\n\nCanonical link: https://commits.webkit.org/320121@main",
      "email": "a_protyasha@apple.com",
      "hash": "2f57270fc7c5b9d381abd48913241460a0deed4c",
      "subject": "Drop WTF::Expected alias usage in IPC and inspector code generation"
    }
  },
  "date": "2026-08-30",
  "days": 1,
  "generatedAt": "2026-08-30T22:05:22Z",
  "markdown": "## Highlights\n- **Security** Fixes a race window that could read deallocated memory, closing a real memory-safety hazard. [commit 320118@main](https://commits.webkit.org/320118@main)\n- **Rendering** Stops unbounded recursion in `Element::resolveComputedStyle`, fixing a crash regression on unifi.ui.com. [commit 320119@main](https://commits.webkit.org/320119@main)\n- **V8** Adds a JSC WarmUpThread for MarkedBlocks to reduce allocator warmup cost on hot JavaScript paths. [commit 320112@main](https://commits.webkit.org/320112@main)\n- **V8** Reuses `FunctionExecutables` for module function declarations, trimming duplicate JSC work during module setup. [commit 320111@main](https://commits.webkit.org/320111@main)\n- **Rendering** Fixes Grid aspect-ratio layout so items recompute inline contribution correctly when containers shrink. [commit 320117@main](https://commits.webkit.org/320117@main)\n- **Rendering** Moves style-driven ink overflow computation into the IFC integration layer, tightening inline layout architecture and behavior. [commit 320116@main](https://commits.webkit.org/320116@main)\n- **Rendering** Fixes a spacing regression near the bottom of tess.oconnor.cx pages involving image and content layout. [commit 320115@main](https://commits.webkit.org/320115@main)\n- **Media** Improves GStreamer pipeline setup by auto-plugging parsers before decoders in the Thunder parser. [commit 320107@main](https://commits.webkit.org/320107@main)\n\n## What landed by area\n\n### CSS and parsing\n- **Web Platform** Switches more CSS parsing code to `StringView` now that `CSSTokenizer` supports it, reducing string churn in parser hot paths. [commit 320120@main](https://commits.webkit.org/320120@main)\n- **Refactor** Removes unused `tryResolved()` from `CSS::CustomIdent`, shaving dead API from the CSS layer. [commit 320110@main](https://commits.webkit.org/320110@main)\n\n### Rendering and layout\n- **Rendering** Fixes a crash regression caused by unbounded recursion in `Element::resolveComputedStyle` on a real site. [commit 320119@main](https://commits.webkit.org/320119@main)\n- **Rendering** Fixes stale inline contribution for Grid items with aspect ratio when the grid container shrinks. [commit 320117@main](https://commits.webkit.org/320117@main)\n- **Rendering** Computes style-driven ink overflow in the IFC integration layer instead of `InlineDisplayContentBuilder`, improving layout responsibility boundaries. [commit 320116@main](https://commits.webkit.org/320116@main)\n- **Rendering** Fixes a spacing regression on tess.oconnor.cx that left excessive space between an image and following content near the bottom of the page. [commit 320115@main](https://commits.webkit.org/320115@main)\n\n### JavaScriptCore\n- **V8** Introduces a JSC WarmUpThread for MarkedBlocks, likely smoothing startup and allocation readiness in the VM. [commit 320112@main](https://commits.webkit.org/320112@main)\n- **V8** Reuses instantiated `FunctionExecutables` for module function declarations, cutting redundant work in module compilation paths. [commit 320111@main](https://commits.webkit.org/320111@main)\n- **Build** Skips PGO profiling for JavaScriptCoreTools, simplifying that toolchain path and avoiding wasted profiling work. [commit 320108@main](https://commits.webkit.org/320108@main)\n\n### IPC and inspector infrastructure\n- **Refactor** Drops `WTF::Expected` alias usage in IPC and inspector code generation, continuing cleanup in generated plumbing. [commit 320121@main](https://commits.webkit.org/320121@main)\n\n### Media and site isolation\n- **Media** Makes remote-control commands land in the same session with and without site isolation, tightening behavior consistency. [commit 320113@main](https://commits.webkit.org/320113@main)\n- **Media** Turns `VideoInfo::fieldCount` into an enum, making video metadata handling more type-safe. [commit 320114@main](https://commits.webkit.org/320114@main)\n- **Media** Auto-plugs parsers before decoders in the GStreamer Thunder parser, improving stream handling robustness. [commit 320107@main](https://commits.webkit.org/320107@main)\n\n### Security and memory safety\n- **Security** Fixes a race window that could lead to reads from deallocated memory. [commit 320118@main](https://commits.webkit.org/320118@main)\n\n### Platform and test upkeep\n- **Build** GLib layout test gardening updates expected results and keeps that bot lane green. [commit 320109@main](https://commits.webkit.org/320109@main)",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [],
  "since": "2026-08-30",
  "totals": {
    "commits": 15,
    "features": 15,
    "rolls": 0
  },
  "until": "2026-08-30"
}