{
  "commits": {
    "320190@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "320190@main",
      "clUrl": "https://commits.webkit.org/320190@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322991\n\nReviewed by Sihui Liu and Basuke Suzuki.\n\nRedirect the console message to stderr since enabling site isolation results in\nmore security warnings to be emitted in console.\n\nNote that the console log has been ignored in non-site-isolation mode with\nTestExpectations. This PR just codifies it to the test itself.\n\n* LayoutTests/http/tests/navigation/page-cache-xhr-in-loading-iframe.html:\n\nCanonical link: https://commits.webkit.org/320190@main",
      "email": "rniwa@webkit.org",
      "hash": "ff01005e0c018023d5f372e3e2e466ff4f871bc8",
      "subject": "[Site Isolation] http/tests/navigation/page-cache-xhr-in-loading-iframe.html fails"
    },
    "320191@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "320191@main",
      "clUrl": "https://commits.webkit.org/320191@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322994\n\nReviewed by Simon Fraser.\n\nTolerant some anti-aliasing differences.\n\n* LayoutTests/fast/selectors/text-field-selection-window-inactive-stroke-color.html:\n\nCanonical link: https://commits.webkit.org/320191@main",
      "email": "rniwa@webkit.org",
      "hash": "cc58060ae4ffc1f233882b8c497fe69b8140f52a",
      "subject": "[Site Isolation] fast/selectors/text-field-selection-window-inactive-stroke-color.html fails"
    },
    "320192@main": {
      "author": "Cameron McCormack",
      "avatar": "https://www.gravatar.com/avatar/b2bb1b369be938a743e50f595bfa0798?d=identicon\u0026s=64",
      "cl": "320192@main",
      "clUrl": "https://commits.webkit.org/320192@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322958\nrdar://186229626\n\nReviewed by Dan Glastonbury.\n\nThat is the correct error value to check for.\n\n* LayoutTests/fast/canvas/webgl/webgl-compressed-texture-size-limit-expected.txt:\n* LayoutTests/fast/canvas/webgl/webgl-compressed-texture-size-limit.html:\n* LayoutTests/platform/mac/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320192@main",
      "email": "heycam@apple.com",
      "hash": "76c4d04808578cda9425ec80246098d32a7be83c",
      "subject": "Expect INVALID_VALUE for out-of-bounds compressed texture dimensions"
    },
    "320193@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "320193@main",
      "clUrl": "https://commits.webkit.org/320193@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322993\n\nReviewed by Simon Fraser.\n\nIncrease the tolerance for the total number of pixel differences.\n\n* LayoutTests/fast/selectors/text-field-selection-stroke-color.html:\n\nCanonical link: https://commits.webkit.org/320193@main",
      "email": "rniwa@webkit.org",
      "hash": "deb2938e4e89e8e70224bc029c0b383513a21a78",
      "subject": "[Site Isolation] fast/selectors/text-field-selection-stroke-color.html fails"
    },
    "320195@main": {
      "author": "Michael Catanzaro",
      "avatar": "https://www.gravatar.com/avatar/213b4484d2078dbdd03dcd3256564c2c?d=identicon\u0026s=64",
      "cl": "320195@main",
      "clUrl": "https://commits.webkit.org/320195@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323028\n\nReviewed by Tim Nguyen.\n\n* Source/ThirdParty/pdfjs/PdfJSFiles.cmake:\n* Source/ThirdParty/pdfjs/README.webkit:\n* Source/ThirdParty/pdfjs/build/pdf.mjs:\n* Source/ThirdParty/pdfjs/build/pdf.sandbox.mjs:\n* Source/ThirdParty/pdfjs/build/pdf.worker.mjs:\n* Source/ThirdParty/pdfjs/web/debugger.mjs:\n* Source/ThirdParty/pdfjs/web/images/toolbarButton-menuArrowNova.svg: Added.\n* Source/ThirdParty/pdfjs/web/locale/ar/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/bg/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/bqi/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/ca/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/de/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/en-CA/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/en-US/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/es-AR/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/es-ES/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/es-MX/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/eu/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/fr/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/fy-NL/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/gn/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/hy-AM/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/it/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/ja/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/lv/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/pa-IN/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/sk/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/sl/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/vi/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/locale/zh-CN/viewer.ftl:\n* Source/ThirdParty/pdfjs/web/standard_fonts/LICENSE_LIBERATION:\n* Source/ThirdParty/pdfjs/web/viewer.css:\n(:root):\n(@media screen and (forced-colors: active) --button-primary-bg-color:var():\n(.primaryButton,):\n(\u003e span):\n(\u0026:disabled):\n(.primaryButton):\n(\u0026:active):\n(.secondaryButton):\n(.messageBar):\n(display:flex;):\n(#editorUndoBar):\n(#editorUndoBarUndoButton):\n(.dialog):\n(font:message-box;):\n(input:is([type=\"checkbox\"], [type=\"radio\"])):\n(.radio):\n(button:not(:is(.toggle-button, .closeButton, .clearInputButton))):\n(textarea):\n(.toggle-button):\n(@media (forced-colors) .toggle-button):\n(@media (forced-colors) .toggle-button[aria-pressed=\"true\"]:enabled::after):\n(.signatureDialog):\n(.inputWithClearButton):\n(#addSignatureDialog):\n(#clearSignatureButton):\n(:is(.annotationLayer, .annotationEditorLayer)):\n(#editorCommentsSidebar,):\n(@media screen and (forced-colors: active) :root):\n(\u0026.selectedEditor):\n(.annotationEditorLayer):\n(.tooltip):\n(.colorPicker):\n(.popupMenu):\n(\u003e button):\n(.treeItem):\n(#viewsManager):\n(.viewsManagerButton):\n(\u0026.viewsCloseButton):\n(#viewsManagerHeader):\n(#viewsManagerTitle):\n(\u0026::after):\n(\u003e .thumbnailImageContainer):\n(.sidebar):\n(.newBadge):\n(\u0026:focus-visible):\n(.pdfSidebarNotification::after):\n(dialog):\n(dialog .buttonRow):\n(\u0026[data-status=\"notFound\"]):\n(.toolbarLabel):\n(.toolbarHorizontalGroup):\n(@media screen and (forced-colors: active) --dialog-bg-color:Canvas;): Deleted.\n(@media screen and (forced-colors: active) font:message-box;): Deleted.\n(@media screen and (forced-colors: active) .title): Deleted.\n(\u0026:checked): Deleted.\n(\u0026.secondaryButton): Deleted.\n(\u0026.primaryButton): Deleted.\n(@media screen and (forced-colors: active) --secondary-color:ButtonText;): Deleted.\n(@media screen and (forced-colors: active) #addSignatureDialogLabel): Deleted.\n(@media screen and (forced-colors: active) \u0026.waiting::after): Deleted.\n(@media screen and (forced-colors: active) .mainContainer): Deleted.\n(@media screen and (forced-colors: active) \u0026:focus-visible): Deleted.\n(@media screen and (forced-colors: active) \u0026[aria-selected=\"true\"]): Deleted.\n(.dialogButton): Deleted.\n(.dialogButton:is(:hover, :focus-visible)): Deleted.\n(.dialogButton:is(:hover, :focus-visible) \u003e span): Deleted.\n* Source/ThirdParty/pdfjs/web/viewer.html:\n* Source/ThirdParty/pdfjs/web/viewer.mjs:\n* Source/ThirdParty/pdfjs/web/wasm/LICENSE_PDFJS_QCMS:\n\nCanonical link: https://commits.webkit.org/320195@main",
      "email": "mcatanzaro@gnome.org",
      "hash": "ea578fc80316461dbb5622a461717a25cfecb567",
      "subject": "Update to PDF.js v6.3.289"
    },
    "320196@main": {
      "author": "Sihui Liu",
      "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64",
      "cl": "320196@main",
      "clUrl": "https://commits.webkit.org/320196@main",
      "description": "rdar://186124519\n\nReviewed by Per Arne Vollan.\n\nFindController only counts matches when the find was requested with ShowOverlay, ShowHighlight or DetermineMatchIndex,\nbecause those options have to visit every match anyway. Otherwise the find is incremental - it stops at the first match\nafter the current selection - and updateFindUIAfterIncrementalFind reports 1 to mean \"found something\".\n\nUnder Site Isolation isolation, WebPageProxy::findString fans the find out to every process and\nFindStringCallbackAggregator sums the replies, so without a counting option it sums those placeholders and reports the\nnumber of processes that found the string. On a page with a matching main frame and two matching cross-site iframes the\nreported count was 3 with full isolation and 2 with shared process mode, where both iframes are in one process and its\nsingle reply covers both matches. The same page reports 1 without Site Isolation. This is not reachable through public\nAPI: WKFindResult only exposes matchFound.\n\nSum the per-process counts only when a counting option was requested, so the value no longer depends on how the page's\nframes are distributed across processes. Nothing changes for clients that do ask for a count, since each process counts\nthe matches in its own local frames and every frame belongs to exactly one process. SiteIsolation.FindStringMatchCount\nasserted 3, which only held because the three matching documents happened to be in three processes; it now pins\nSiteIsolationSharedProcessEnabled off and SiteIsolation.FindStringMatchCountWithSharedProcess pins it on, so both\nprocess models are covered whatever the default becomes, and both assert the same numbers.\n\n* Source/WebKit/Shared/WebFindOptions.h:\n(WebKit::willFindAllMatches):\n* Source/WebKit/UIProcess/FindStringCallbackAggregator.cpp:\n(WebKit::FindStringCallbackAggregator::~FindStringCallbackAggregator):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::checkFindStringMatchCount):\n(TestWebKitAPI::findStringMatchCountServer):\n(TestWebKitAPI::TEST(SiteIsolation, FindStringMatchCount)):\n(TestWebKitAPI::TEST(SiteIsolation, FindStringMatchCountWithSharedProcess)):\n\nCanonical link: https://commits.webkit.org/320196@main",
      "email": "sihui_liu@apple.com",
      "hash": "8b41c4e1111a3394a97dd2ba6f079c2ece2c7dcd",
      "subject": "[Site Isolation] Find in page reports the number of Web processes that found the string as the match count"
    },
    "320197@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "320197@main",
      "clUrl": "https://commits.webkit.org/320197@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322929\nrdar://186190599\n\nReviewed by Justin Michaud.\n\nThis patch removes JSValueRegs and related operations / classes.\nThis was introduced just for 32bit since 32bit represents JSValue in two\nregisters. Given that 32bit JIT is dropped, we can drop this abstraction\nand it makes 64bit JIT code significantly simplified.\n\nWe have several follow-up changes: BaselineJITRegisters should use more\ndense set of registers as we no longer need to skip regT1 / regT3 etc.\n\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/Sources.txt:\n* Source/JavaScriptCore/b3/B3ValueRep.h:\n(JSC::B3::ValueRep::ValueRep):\n* Source/JavaScriptCore/bytecode/AccessCase.cpp:\n(JSC::AccessCase::createTransition):\n* Source/JavaScriptCore/bytecode/ArithProfile.cpp:\n(JSC::ArithProfile\u003cBitfieldType\u003e::emitObserveResult):\n* Source/JavaScriptCore/bytecode/ArithProfile.h:\n* Source/JavaScriptCore/bytecode/InlineAccess.cpp:\n(JSC::InlineAccess::dumpCacheSizesAndCrash):\n(JSC::InlineAccess::generateSelfPropertyAccess):\n(JSC::InlineAccess::generateSelfPropertyReplace):\n(JSC::InlineAccess::generateArrayLength):\n(JSC::InlineAccess::generateStringLength):\n(JSC::InlineAccess::generateSelfInAccess):\n* Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp:\n(JSC::InlineCacheCompiler::emitDataICCheckUid):\n(JSC::getByIdSlowPathCodeGenerator):\n(JSC::getByIdWithThisSlowPathCodeGenerator):\n(JSC::getByValSlowPathCodeGenerator):\n(JSC::getPrivateNameSlowPathCodeGenerator):\n(JSC::getByValWithThisSlowPathCodeGenerator):\n(JSC::putByIdSlowPathCodeGenerator):\n(JSC::putByValSlowPathCodeGenerator):\n(JSC::instanceOfSlowPathCodeGenerator):\n(JSC::delByIdSlowPathCodeGenerator):\n(JSC::delByValSlowPathCodeGenerator):\n(JSC::InlineCacheCompiler::generateWithGuard):\n(JSC::InlineCacheCompiler::generateAccessCase):\n(JSC::InlineCacheCompiler::emitDOMJITGetter):\n(JSC::InlineCacheCompiler::emitModuleNamespaceLoad):\n(JSC::InlineCacheCompiler::emitProxyObjectAccess):\n(JSC::InlineCacheCompiler::emitIntrinsicGetter):\n(JSC::loadHandlerImpl):\n(JSC::getByIdLoadHandlerImpl):\n(JSC::getByIdMissHandler):\n(JSC::customGetterHandlerImpl):\n(JSC::getByIdCustomHandlerImpl):\n(JSC::getterCallFromGetterSetterImpl):\n(JSC::getterHandlerImpl):\n(JSC::getByIdGetterHandler):\n(JSC::getByIdMegamorphicGetterHandler):\n(JSC::getByIdProxyObjectLoadHandler):\n(JSC::getByIdModuleNamespaceLoadHandler):\n(JSC::putByIdReplaceHandler):\n(JSC::transitionHandlerImpl):\n(JSC::putByIdTransitionHandlerImpl):\n(JSC::putByIdTransitionReallocatingOutOfLineHandler):\n(JSC::customSetterHandlerImpl):\n(JSC::putByIdCustomHandlerImpl):\n(JSC::setterHandlerImpl):\n(JSC::putByIdSetterHandlerImpl):\n(JSC::inByIdInHandlerImpl):\n(JSC::deleteByIdDeleteHandler):\n(JSC::deleteByIdIgnoreHandlerImpl):\n(JSC::instanceOfHandlerImpl):\n(JSC::getByValLoadHandlerImpl):\n(JSC::getByValMissHandlerImpl):\n(JSC::emitNonStringPrimitiveKeyCheck):\n(JSC::getByValNonStringPrimitiveKeyLoadHandlerImpl):\n(JSC::getByValNonStringPrimitiveKeyMissHandlerImpl):\n(JSC::putByValNonStringPrimitiveKeyReplaceHandlerImpl):\n(JSC::putByValNonStringPrimitiveKeyTransitionHandlerImpl):\n(JSC::putByValNonStringPrimitiveKeyTransitionOutOfLineHandlerImpl):\n(JSC::getByValCustomHandlerImpl):\n(JSC::getByValGetterHandlerImpl):\n(JSC::putByValReplaceHandlerImpl):\n(JSC::putByValTransitionHandlerImpl):\n(JSC::putByValTransitionOutOfLineHandlerImpl):\n(JSC::putByValCustomHandlerImpl):\n(JSC::putByValSetterHandlerImpl):\n(JSC::inByValInHandlerImpl):\n(JSC::deleteByValDeleteHandlerImpl):\n(JSC::deleteByValIgnoreHandlerImpl):\n(JSC::checkPrivateBrandHandler):\n(JSC::setPrivateBrandHandler):\n(JSC::InlineCacheCompiler::compileGetByDOMJITHandler):\n* Source/JavaScriptCore/bytecode/InlineCacheCompiler.h:\n* Source/JavaScriptCore/bytecode/MethodOfGettingAValueProfile.cpp:\n(JSC::MethodOfGettingAValueProfile::emitReportValue const):\n* Source/JavaScriptCore/bytecode/MethodOfGettingAValueProfile.h:\n* Source/JavaScriptCore/bytecode/PropertyInlineCache.cpp:\n(JSC::PropertyInlineCache::registers const):\n* Source/JavaScriptCore/bytecode/PropertyInlineCache.h:\n(JSC::PropertyInlineCache::valueRegs const): Deleted.\n(JSC::PropertyInlineCache::propertyRegs const): Deleted.\n(JSC::PropertyInlineCache::baseRegs const): Deleted.\n* Source/JavaScriptCore/bytecode/ValueRecovery.h:\n(JSC::ValueRecovery::isInRegisters const):\n(JSC::ValueRecovery::gpr const):\n(JSC::ValueRecovery::isInJSValueRegs const): Deleted.\n* Source/JavaScriptCore/dfg/DFGArrayifySlowPathGenerator.h:\n* Source/JavaScriptCore/dfg/DFGGenerationInfo.h:\n(JSC::DFG::GenerationInfo::fpr):\n(JSC::DFG::GenerationInfo::jsValueRegs): Deleted.\n* Source/JavaScriptCore/dfg/DFGLazyJSValue.cpp:\n(JSC::DFG::LazyJSValue::emit const):\n* Source/JavaScriptCore/dfg/DFGLazyJSValue.h:\n* Source/JavaScriptCore/dfg/DFGOSRExit.cpp:\n(JSC::DFG::OSRExit::emitRestoreArguments):\n(JSC::DFG::OSRExit::compileExit):\n* Source/JavaScriptCore/dfg/DFGSaneStringGetByValSlowPathGenerator.h:\n* Source/JavaScriptCore/dfg/DFGSlowPathGenerator.h:\n(JSC::DFG::CallSlowPathGenerator::CallSlowPathGenerator):\n(JSC::DFG::CallSlowPathGenerator::tearDown):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n(JSC::DFG::SpeculativeJIT::compileInvalidationPoint):\n(JSC::DFG::SpeculativeJIT::terminateSpeculativeExecution):\n(JSC::DFG::SpeculativeJIT::compilePushWithScope):\n(JSC::DFG::SpeculativeJIT::compileStringCodePointAt):\n(JSC::DFG::SpeculativeJIT::compileLoopHint):\n(JSC::DFG::SpeculativeJIT::compileContiguousPutByVal):\n(JSC::DFG::SpeculativeJIT::compileDoublePutByVal):\n(JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):\n(JSC::DFG::SpeculativeJIT::compileGetByValOnString):\n(JSC::DFG::SpeculativeJIT::compileStringFromCharCodeOrCodePoint):\n(JSC::DFG::SpeculativeJIT::checkGeneratedTypeForToInt32):\n(JSC::DFG::SpeculativeJIT::compileValueToInt32):\n(JSC::DFG::SpeculativeJIT::compileUInt32ToNumber):\n(JSC::DFG::SpeculativeJIT::compileDoubleAsInt32):\n(JSC::DFG::SpeculativeJIT::compileDoubleRep):\n(JSC::DFG::SpeculativeJIT::compileValueRep):\n(JSC::DFG::SpeculativeJIT::setIntTypedArrayLoadResult):\n(JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):\n(JSC::DFG::SpeculativeJIT::getIntTypedArrayStoreOperand):\n(JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):\n(JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithString):\n(JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithSymbol):\n(JSC::DFG::SpeculativeJIT::compileGetPrivateName):\n(JSC::DFG::SpeculativeJIT::compilePutByValForCellWithString):\n(JSC::DFG::SpeculativeJIT::compilePutByValForCellWithSymbol):\n(JSC::DFG::SpeculativeJIT::compileCheckTypeInfoFlags):\n(JSC::DFG::SpeculativeJIT::compileParseInt):\n(JSC::DFG::SpeculativeJIT::compileOverridesHasInstance):\n(JSC::DFG::SpeculativeJIT::compileValueBitNot):\n(JSC::DFG::SpeculativeJIT::emitUntypedOrAnyBigIntBitOp):\n(JSC::DFG::SpeculativeJIT::compileValueBitwiseOp):\n(JSC::DFG::SpeculativeJIT::emitUntypedOrBigIntRightShiftBitOp):\n(JSC::DFG::SpeculativeJIT::compileValueLShiftOp):\n(JSC::DFG::SpeculativeJIT::compileValueBitRShift):\n(JSC::DFG::SpeculativeJIT::compileValueAdd):\n(JSC::DFG::SpeculativeJIT::compileValueSub):\n(JSC::DFG::SpeculativeJIT::compileMathIC):\n(JSC::DFG::SpeculativeJIT::compileInstanceOfCustom):\n(JSC::DFG::SpeculativeJIT::compileIsCellWithType):\n(JSC::DFG::SpeculativeJIT::compileArrayIsArray):\n(JSC::DFG::SpeculativeJIT::compileToObjectOrCallObjectConstructor):\n(JSC::DFG::SpeculativeJIT::compileOpenAsyncFromSyncIterator):\n(JSC::DFG::SpeculativeJIT::compileArithAdd):\n(JSC::DFG::SpeculativeJIT::compileArithAbs):\n(JSC::DFG::SpeculativeJIT::compileArithClz32):\n(JSC::DFG::SpeculativeJIT::compileArithDoubleUnaryOp):\n(JSC::DFG::SpeculativeJIT::compileArithSub):\n(JSC::DFG::SpeculativeJIT::compileIncOrDec):\n(JSC::DFG::SpeculativeJIT::compileArithNegate):\n(JSC::DFG::SpeculativeJIT::compileValueMul):\n(JSC::DFG::SpeculativeJIT::compileArithMul):\n(JSC::DFG::SpeculativeJIT::compileValueDiv):\n(JSC::DFG::SpeculativeJIT::compileArithDiv):\n(JSC::DFG::SpeculativeJIT::compileArithFRound):\n(JSC::DFG::SpeculativeJIT::compileArithF16Round):\n(JSC::DFG::SpeculativeJIT::compileValueMod):\n(JSC::DFG::SpeculativeJIT::compileArithMod):\n(JSC::DFG::SpeculativeJIT::compileArithRounding):\n(JSC::DFG::SpeculativeJIT::compileArithSqrt):\n(JSC::DFG::SpeculativeJIT::compileValuePow):\n(JSC::DFG::SpeculativeJIT::emitBitwiseJSValueEquality):\n(JSC::DFG::SpeculativeJIT::emitBranchOnBitwiseJSValueEquality):\n(JSC::DFG::SpeculativeJIT::compileNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality):\n(JSC::DFG::SpeculativeJIT::compilePeepHoleNotDoubleNeitherDoubleNorHeapBigIntNorStringStrictEquality):\n(JSC::DFG::SpeculativeJIT::compileStringToUntypedEquality):\n(JSC::DFG::SpeculativeJIT::compileStringIdentToNotStringVarEquality):\n(JSC::DFG::SpeculativeJIT::compileSameValue):\n(JSC::DFG::SpeculativeJIT::compileToBooleanStringOrOther):\n(JSC::DFG::SpeculativeJIT::emitStringOrOtherBranch):\n(JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):\n(JSC::DFG::SpeculativeJIT::compileGetByValOnDirectArguments):\n(JSC::DFG::SpeculativeJIT::compileGetByValOnScopedArguments):\n(JSC::DFG::SpeculativeJIT::compileGetArrayLength):\n(JSC::DFG::SpeculativeJIT::compileSetFunctionName):\n(JSC::DFG::SpeculativeJIT::compileEnqueueAsyncGeneratorDriver):\n(JSC::DFG::SpeculativeJIT::compileVarargsLength):\n(JSC::DFG::SpeculativeJIT::compileLoadVarargs):\n(JSC::DFG::SpeculativeJIT::compileForwardVarargs):\n(JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):\n(JSC::DFG::SpeculativeJIT::compileGetFromArguments):\n(JSC::DFG::SpeculativeJIT::compilePutToArguments):\n(JSC::DFG::SpeculativeJIT::compileGetArgument):\n(JSC::DFG::SpeculativeJIT::compileSpread):\n(JSC::DFG::SpeculativeJIT::compileNewArray):\n(JSC::DFG::SpeculativeJIT::compileNewArrayWithSpread):\n(JSC::DFG::SpeculativeJIT::compileArraySlice):\n(JSC::DFG::SpeculativeJIT::compileArrayConcatAppendOne):\n(JSC::DFG::SpeculativeJIT::compileArrayJoin):\n(JSC::DFG::SpeculativeJIT::compileArraySplice):\n(JSC::DFG::SpeculativeJIT::compileArrayIndexOfOrArrayIncludes):\n(JSC::DFG::SpeculativeJIT::compileArrayPush):\n(JSC::DFG::SpeculativeJIT::compileIsObject):\n(JSC::DFG::SpeculativeJIT::compileTypeOfIsObject):\n(JSC::DFG::SpeculativeJIT::compileIsCallable):\n(JSC::DFG::SpeculativeJIT::compileIsConstructor):\n(JSC::DFG::SpeculativeJIT::compileTypeOf):\n(JSC::DFG::SpeculativeJIT::compileCheckIsConstant):\n(JSC::DFG::SpeculativeJIT::compileCheckNotEmpty):\n(JSC::DFG::SpeculativeJIT::compileCheckStructure):\n(JSC::DFG::SpeculativeJIT::compileCallDOM):\n(JSC::DFG::SpeculativeJIT::compileCallDOMGetter):\n(JSC::DFG::SpeculativeJIT::compileCallCustomAccessorGetter):\n(JSC::DFG::SpeculativeJIT::compileCallCustomAccessorSetter):\n(JSC::DFG::SpeculativeJIT::compileToStringOrCallStringConstructorOrStringValueOf):\n(JSC::DFG::SpeculativeJIT::compileNewSymbol):\n(JSC::DFG::SpeculativeJIT::compileNewRegExpUntyped):\n(JSC::DFG::SpeculativeJIT::compileNewRegExp):\n(JSC::DFG::SpeculativeJIT::speculateNumber):\n(JSC::DFG::SpeculativeJIT::speculateRealNumber):\n(JSC::DFG::SpeculativeJIT::speculateDoubleRepReal):\n(JSC::DFG::SpeculativeJIT::speculateCellOrOther):\n(JSC::DFG::SpeculativeJIT::speculateObjectOrOther):\n(JSC::DFG::SpeculativeJIT::speculateStringOrOther):\n(JSC::DFG::SpeculativeJIT::speculateNotStringVar):\n(JSC::DFG::SpeculativeJIT::speculateNotSymbol):\n(JSC::DFG::SpeculativeJIT::speculateNotCell):\n(JSC::DFG::SpeculativeJIT::speculateNotCellNorBigInt):\n(JSC::DFG::SpeculativeJIT::speculateNotDouble):\n(JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigInt):\n(JSC::DFG::SpeculativeJIT::speculateNeitherDoubleNorHeapBigIntNorString):\n(JSC::DFG::SpeculativeJIT::speculateOther):\n(JSC::DFG::SpeculativeJIT::speculateMisc):\n(JSC::DFG::SpeculativeJIT::emitSwitchImm):\n(JSC::DFG::SpeculativeJIT::emitSwitchChar):\n(JSC::DFG::SpeculativeJIT::emitSwitchString):\n(JSC::DFG::SpeculativeJIT::compileResolveScopeForHoistingFuncDeclInEval):\n(JSC::DFG::SpeculativeJIT::compileGetGlobalVariable):\n(JSC::DFG::SpeculativeJIT::compilePutGlobalVariable):\n(JSC::DFG::SpeculativeJIT::compileGetDynamicVar):\n(JSC::DFG::SpeculativeJIT::compilePutDynamicVar):\n(JSC::DFG::SpeculativeJIT::compileGetClosureVar):\n(JSC::DFG::SpeculativeJIT::compilePutClosureVar):\n(JSC::DFG::SpeculativeJIT::compileGetInternalField):\n(JSC::DFG::SpeculativeJIT::compilePutInternalField):\n(JSC::DFG::SpeculativeJIT::compilePutAccessorByVal):\n(JSC::DFG::SpeculativeJIT::compileGetRegExpObjectLastIndex):\n(JSC::DFG::SpeculativeJIT::compileSetRegExpObjectLastIndex):\n(JSC::DFG::SpeculativeJIT::compileRegExpExec):\n(JSC::DFG::SpeculativeJIT::compileRegExpTest):\n(JSC::DFG::SpeculativeJIT::tryEmitRegExpTestFirstCharacterFilter):\n(JSC::DFG::SpeculativeJIT::compileStringReplace):\n(JSC::DFG::SpeculativeJIT::compileStringReplaceString):\n(JSC::DFG::SpeculativeJIT::compileRegExpExecNonGlobalOrSticky):\n(JSC::DFG::SpeculativeJIT::compileRegExpExecSticky):\n(JSC::DFG::SpeculativeJIT::compileRegExpMatchFastGlobal):\n(JSC::DFG::SpeculativeJIT::compileRegExpMatchFast):\n(JSC::DFG::SpeculativeJIT::compileRegExpSplitFast):\n(JSC::DFG::SpeculativeJIT::compileRegExpSearch):\n(JSC::DFG::SpeculativeJIT::compileLazyJSConstant):\n(JSC::DFG::SpeculativeJIT::compileMaterializeNewObject):\n(JSC::DFG::SpeculativeJIT::compileDefineDataProperty):\n(JSC::DFG::SpeculativeJIT::compileDefineAccessorProperty):\n(JSC::DFG::SpeculativeJIT::compileObjectDefineProperty):\n(JSC::DFG::SpeculativeJIT::compileObjectDefinePropertyFromFields):\n(JSC::DFG::SpeculativeJIT::compileNormalizeMapKey):\n(JSC::DFG::SpeculativeJIT::compileLoadMapValue):\n(JSC::DFG::SpeculativeJIT::loadMapEntryData):\n(JSC::DFG::SpeculativeJIT::compileMapIteratorKey):\n(JSC::DFG::SpeculativeJIT::compileMapIteratorValue):\n(JSC::DFG::SpeculativeJIT::compileMapIterationNext):\n(JSC::DFG::SpeculativeJIT::compileMapIterationEntry):\n(JSC::DFG::SpeculativeJIT::compileMapIterationEntryData):\n(JSC::DFG::SpeculativeJIT::compileExtractValueFromWeakMapGet):\n(JSC::DFG::SpeculativeJIT::compileThrow):\n(JSC::DFG::SpeculativeJIT::compileEnumeratorNextUpdateIndexAndMode):\n(JSC::DFG::SpeculativeJIT::compileEnumeratorHasProperty):\n(JSC::DFG::SpeculativeJIT::compilePutByIdWithThis):\n(JSC::DFG::SpeculativeJIT::compileGetByOffset):\n(JSC::DFG::SpeculativeJIT::compilePutByOffset):\n(JSC::DFG::SpeculativeJIT::compileMatchStructure):\n(JSC::DFG::SpeculativeJIT::compileGetPropertyEnumerator):\n(JSC::DFG::SpeculativeJIT::compileStrCat):\n(JSC::DFG::SpeculativeJIT::compileNewButterflyWithSize):\n(JSC::DFG::SpeculativeJIT::compilePutCellButterflySlot):\n(JSC::DFG::SpeculativeJIT::compileArraySortCommit):\n(JSC::DFG::SpeculativeJIT::compileNewArrayWithSpecies):\n(JSC::DFG::SpeculativeJIT::compileNewArrayWithSizeAndStructure):\n(JSC::DFG::SpeculativeJIT::compileNewTypedArray):\n(JSC::DFG::SpeculativeJIT::compileNewTypedArrayBuffer):\n(JSC::DFG::SpeculativeJIT::compileToThis):\n(JSC::DFG::SpeculativeJIT::compileOwnPropertyKeysVariant):\n(JSC::DFG::SpeculativeJIT::compileObjectAssign):\n(JSC::DFG::SpeculativeJIT::compileObjectCreate):\n(JSC::DFG::SpeculativeJIT::compileObjectToString):\n(JSC::DFG::SpeculativeJIT::compileToPrimitive):\n(JSC::DFG::SpeculativeJIT::compileToPropertyKey):\n(JSC::DFG::SpeculativeJIT::compileToPropertyKeyOrNumber):\n(JSC::DFG::SpeculativeJIT::compileToNumeric):\n(JSC::DFG::SpeculativeJIT::compileCallNumberConstructor):\n(JSC::DFG::SpeculativeJIT::compileLogShadowChickenTail):\n(JSC::DFG::SpeculativeJIT::compileSetAdd):\n(JSC::DFG::SpeculativeJIT::compileMapSet):\n(JSC::DFG::SpeculativeJIT::compileMapOrSetDelete):\n(JSC::DFG::SpeculativeJIT::compileWeakMapGet):\n(JSC::DFG::SpeculativeJIT::compileWeakMapSet):\n(JSC::DFG::SpeculativeJIT::compileGetPrototypeOf):\n(JSC::DFG::SpeculativeJIT::compileIdentity):\n(JSC::DFG::SpeculativeJIT::compileBitwiseStrictEq):\n(JSC::DFG::SpeculativeJIT::emitInitializeButterfly):\n(JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):\n(JSC::DFG::SpeculativeJIT::compileHasIndexedProperty):\n(JSC::DFG::SpeculativeJIT::compileExtractCatchLocal):\n(JSC::DFG::SpeculativeJIT::compileProfileType):\n(JSC::DFG::SpeculativeJIT::genericJSValueNonPeepholeCompare):\n(JSC::DFG::SpeculativeJIT::genericJSValuePeepholeBranch):\n(JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal):\n(JSC::DFG::SpeculativeJIT::compileStringSplit):\n(JSC::DFG::SpeculativeJIT::compileStringMatch):\n(JSC::DFG::SpeculativeJIT::compileStringSearch):\n(JSC::DFG::SpeculativeJIT::compileGlobalIsNaN):\n(JSC::DFG::SpeculativeJIT::compileNumberIsNaN):\n(JSC::DFG::SpeculativeJIT::compileGlobalIsFinite):\n(JSC::DFG::SpeculativeJIT::compileNumberIsFinite):\n(JSC::DFG::SpeculativeJIT::compileNumberIsSafeInteger):\n(JSC::DFG::SpeculativeJIT::compileToIntegerOrInfinity):\n(JSC::DFG::SpeculativeJIT::compileToLength):\n(JSC::DFG::SpeculativeJIT::compileResolvePromiseFirstResolving):\n(JSC::DFG::SpeculativeJIT::compileRejectPromiseFirstResolving):\n(JSC::DFG::SpeculativeJIT::compileFulfillPromiseFirstResolving):\n(JSC::DFG::SpeculativeJIT::compileNewRejectedPromise):\n(JSC::DFG::SpeculativeJIT::compilePromiseResolve):\n(JSC::DFG::SpeculativeJIT::compilePromiseReject):\n(JSC::DFG::SpeculativeJIT::compilePromiseThen):\n(JSC::DFG::SpeculativeJIT::compilePerformPromiseThen):\n(JSC::DFG::SpeculativeJIT::appendExceptionHandlingOSRExit):\n(JSC::DFG::JSValueRegsTemporary::JSValueRegsTemporary): Deleted.\n(JSC::DFG::JSValueRegsTemporary::regs): Deleted.\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:\n(JSC::DFG::SpeculativeJIT::silentSpillAllRegistersImpl):\n(JSC::DFG::SpeculativeJIT::silentSpillAllRegisters):\n(JSC::DFG::SpeculativeJIT::jsValueResult):\n(JSC::DFG::SpeculativeJIT::tryHandleOrGetExceptionUnderSilentSpill):\n(JSC::DFG::JSValueOperand::gpr):\n(JSC::DFG::JSValueOperand::regs): Deleted.\n(JSC::DFG::JSValueOperand::jsValueRegs): Deleted.\n(JSC::DFG::JSValueRegsTemporary::operator bool): Deleted.\n(JSC::DFG::JSValueRegsTemporary::JSValueRegsTemporary): Deleted.\n(JSC::DFG::JSValueRegsFlushedCallResult::JSValueRegsFlushedCallResult): Deleted.\n(JSC::DFG::JSValueRegsFlushedCallResult::regs): Deleted.\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:\n(JSC::DFG::SpeculativeJIT::cachedGetById):\n(JSC::DFG::SpeculativeJIT::cachedGetByIdWithThis):\n(JSC::DFG::SpeculativeJIT::nonSpeculativeNonPeepholeCompareNullOrUndefined):\n(JSC::DFG::SpeculativeJIT::nonSpeculativePeepholeBranchNullOrUndefined):\n(JSC::DFG::SpeculativeJIT::compileNeitherDoubleNorHeapBigIntToNotDoubleStrictEquality):\n(JSC::DFG::SpeculativeJIT::genericJSValueNonPeepholeStrictEq):\n(JSC::DFG::SpeculativeJIT::emitCall):\n(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):\n(JSC::DFG::SpeculativeJIT::fillSpeculateInt52):\n(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):\n(JSC::DFG::SpeculativeJIT::fillSpeculateCell):\n(JSC::DFG::SpeculativeJIT::fillSpeculateBoolean):\n(JSC::DFG::SpeculativeJIT::speculateAnyBigInt):\n(JSC::DFG::SpeculativeJIT::fillSpeculateBigInt32):\n(JSC::DFG::SpeculativeJIT::compileRegExpStringIteratorNext):\n(JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):\n(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):\n(JSC::DFG::SpeculativeJIT::compileToBooleanObjectOrOther):\n(JSC::DFG::SpeculativeJIT::compileToBoolean):\n(JSC::DFG::SpeculativeJIT::emitObjectOrOtherBranch):\n(JSC::DFG::SpeculativeJIT::emitUntypedBranch):\n(JSC::DFG::SpeculativeJIT::emitBranch):\n(JSC::DFG::SpeculativeJIT::compileMapGetImpl):\n(JSC::DFG::SpeculativeJIT::compileGetByVal):\n(JSC::DFG::SpeculativeJIT::compile):\n(JSC::DFG::SpeculativeJIT::convertAnyInt):\n(JSC::DFG::SpeculativeJIT::speculateInt32):\n(JSC::DFG::SpeculativeJIT::speculateDoubleRepAnyInt):\n(JSC::DFG::SpeculativeJIT::compileDateGet):\n(JSC::DFG::SpeculativeJIT::compileGetByValWithThis):\n(JSC::DFG::SpeculativeJIT::compileGetById):\n(JSC::DFG::SpeculativeJIT::compileDeleteById):\n(JSC::DFG::SpeculativeJIT::compileDeleteByVal):\n(JSC::DFG::SpeculativeJIT::compileInById):\n(JSC::DFG::SpeculativeJIT::compileInByVal):\n(JSC::DFG::SpeculativeJIT::compileHasPrivate):\n(JSC::DFG::SpeculativeJIT::compilePutByVal):\n(JSC::DFG::SpeculativeJIT::compileGetPrivateNameByVal):\n(JSC::DFG::SpeculativeJIT::compileGetPrivateNameById):\n(JSC::DFG::SpeculativeJIT::compilePutPrivateName):\n(JSC::DFG::SpeculativeJIT::compileCheckPrivateBrand):\n(JSC::DFG::SpeculativeJIT::compileSetPrivateBrand):\n(JSC::DFG::SpeculativeJIT::compileInstanceOf):\n(JSC::DFG::SpeculativeJIT::compileInstanceOfMegamorphic):\n(JSC::DFG::SpeculativeJIT::cachedPutById):\n(JSC::DFG::SpeculativeJIT::compilePutPrivateNameById):\n(JSC::DFG::SpeculativeJIT::compilePutById):\n(JSC::DFG::SpeculativeJIT::compilePutByIdDirect):\n(JSC::DFG::SpeculativeJIT::compileGetByIdWithThisMegamorphic):\n(JSC::DFG::SpeculativeJIT::compileGetByValWithThisMegamorphic):\n(JSC::DFG::SpeculativeJIT::compileFunctionBind):\n(JSC::DFG::SpeculativeJIT::compileNewBoundFunction):\n(JSC::DFG::SpeculativeJIT::compileEnumeratorPutByVal):\n(JSC::DFG::SpeculativeJIT::compilePutByIdMegamorphic):\n(JSC::DFG::SpeculativeJIT::compilePutByValMegamorphic):\n(JSC::DFG::SpeculativeJIT::compileCreateClonedArguments):\n(JSC::DFG::SpeculativeJIT::unboxRealNumberDouble):\n(JSC::DFG::SpeculativeJIT::compileMapStorage):\n(JSC::DFG::SpeculativeJIT::compileMapIteratorNext):\n(JSC::DFG::SpeculativeJIT::compileNewResolvedPromise):\n(JSC::DFG::SpeculativeJIT::compileArrayUnshift):\n(JSC::DFG::SpeculativeJIT::compileMultiGetByVal):\n(JSC::DFG::SpeculativeJIT::compileMultiPutByVal):\n* Source/JavaScriptCore/dfg/DFGThunks.cpp:\n(JSC::DFG::osrEntryThunkGenerator):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileLazyJSConstant):\n(JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC):\n(JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):\n(JSC::FTL::DFG::LowerDFGToB3::compileGetByValWithThis):\n(JSC::FTL::DFG::LowerDFGToB3::getPrivateName):\n(JSC::FTL::DFG::LowerDFGToB3::compilePrivateBrandAccess):\n(JSC::FTL::DFG::LowerDFGToB3::compilePutPrivateName):\n(JSC::FTL::DFG::LowerDFGToB3::cachedPutById):\n(JSC::FTL::DFG::LowerDFGToB3::compileGetByValImpl):\n(JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):\n(JSC::FTL::DFG::LowerDFGToB3::compileDelBy):\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n* Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp:\n(JSC::FTL::compileStub):\n* Source/JavaScriptCore/ftl/FTLSnippetParams.cpp:\n(JSC::FTL::dispatch):\n* Source/JavaScriptCore/jit/AssemblyHelpers.cpp:\n(JSC::AssemblyHelpers::loadProperty):\n(JSC::AssemblyHelpers::storeProperty):\n(JSC::AssemblyHelpers::loadMegamorphicProperty):\n(JSC::AssemblyHelpers::loadMegamorphicGetterSetter):\n(JSC::AssemblyHelpers::storeMegamorphicProperty):\n(JSC::AssemblyHelpers::hasMegamorphicProperty):\n(JSC::AssemblyHelpers::emitLoadPrototype):\n(JSC::AssemblyHelpers::emitConvertValueToBoolean):\n(JSC::AssemblyHelpers::branchIfValue):\n* Source/JavaScriptCore/jit/AssemblyHelpers.h:\n(JSC::AssemblyHelpers::storeValue):\n(JSC::AssemblyHelpers::loadValue):\n(JSC::AssemblyHelpers::moveValue):\n(JSC::AssemblyHelpers::moveTrustedValue):\n(JSC::AssemblyHelpers::branchIfNotEqual):\n(JSC::AssemblyHelpers::branchIfEqual):\n(JSC::AssemblyHelpers::branchIfCell):\n(JSC::AssemblyHelpers::branchIfOther):\n(JSC::AssemblyHelpers::branchIfNotOther):\n(JSC::AssemblyHelpers::branchIfNotDoubleKnownNotInt32):\n(JSC::AssemblyHelpers::branchIfNotBigInt32):\n(JSC::AssemblyHelpers::isUndefined):\n(JSC::AssemblyHelpers::isNull):\n(JSC::AssemblyHelpers::isNotNull):\n(JSC::AssemblyHelpers::emitTurnUndefinedIntoNull):\n(JSC::AssemblyHelpers::unboxDouble):\n(JSC::AssemblyHelpers::unboxDoubleNonDestructive):\n(JSC::AssemblyHelpers::boxBoolean):\n(JSC::AssemblyHelpers::boxInt32):\n(JSC::AssemblyHelpers::emitTypeOf):\n(JSC::AssemblyHelpers::branchIfTruthy):\n(JSC::AssemblyHelpers::branchIfFalsey):\n(JSC::AssemblyHelpers::moveValueRegs): Deleted.\n(JSC::AssemblyHelpers::boxBooleanPayload): Deleted.\n(JSC::AssemblyHelpers::boxCell):\n* Source/JavaScriptCore/jit/BaselineJITRegisters.h:\n* Source/JavaScriptCore/jit/CCallHelpers.cpp:\n(JSC::CCallHelpers::logShadowChickenTailPacketImpl):\n(JSC::CCallHelpers::logShadowChickenTailPacket):\n* Source/JavaScriptCore/jit/CCallHelpers.h:\n(JSC::CCallHelpers::shuffleJSRs): Deleted.\n* Source/JavaScriptCore/jit/CachedRecovery.h:\n(JSC::CachedRecovery::setWantedGPR):\n(JSC::CachedRecovery::setWantedFPR):\n(JSC::CachedRecovery::wantedGPR const):\n(JSC::CachedRecovery::setWantedJSValueRegs): Deleted.\n(JSC::CachedRecovery::wantedJSValueRegs const): Deleted.\n* Source/JavaScriptCore/jit/CallFrameShuffleData.cpp:\n(JSC::CallFrameShuffleData::createForBaselineOrLLIntTailCall):\n* Source/JavaScriptCore/jit/CallFrameShuffler.cpp:\n(JSC::m_numParameters):\n(JSC::CallFrameShuffler::tryWrites):\n(JSC::CallFrameShuffler::performSafeWrites):\n(JSC::CallFrameShuffler::prepareAny):\n* Source/JavaScriptCore/jit/CallFrameShuffler.h:\n(JSC::CallFrameShuffler::setCalleeGPR):\n(JSC::CallFrameShuffler::getNew const):\n(JSC::CallFrameShuffler::addNew):\n(JSC::CallFrameShuffler::setCalleeJSValueRegs): Deleted.\n* Source/JavaScriptCore/jit/CallFrameShuffler64.cpp:\n(JSC::CallFrameShuffler::emitBox):\n(JSC::CallFrameShuffler::emitLoad):\n(JSC::CallFrameShuffler::emitDisplace):\n* Source/JavaScriptCore/jit/GPRInfo.cpp: Removed.\n* Source/JavaScriptCore/jit/GPRInfo.h:\n(JSC::JSValueSource::unboxedCell):\n(JSC::PreferredArgumentImpl::pickGPR):\n(JSC::PreferredArgumentImpl::preferredArgumentGPR):\n(JSC::JSValueRegs::JSValueRegs): Deleted.\n(JSC::JSValueRegs::operator! const): Deleted.\n(JSC::JSValueRegs::operator bool const): Deleted.\n(JSC::JSValueRegs::gpr const): Deleted.\n(JSC::JSValueRegs::payloadGPR const): Deleted.\n(JSC::JSValueRegs::uses const): Deleted.\n(JSC::JSValueRegs::overlaps const): Deleted.\n(JSC::JSValueSource::payloadGPR const): Deleted.\n(JSC::JSValueSource::regs const): Deleted.\n(JSC::extractResult):\n(JSC::PreferredArgumentImpl::pickJSR): Deleted.\n(JSC::PreferredArgumentImpl::preferredArgumentJSR): Deleted.\n(JSC::preferredArgumentJSR): Deleted.\n* Source/JavaScriptCore/jit/JIT.cpp:\n(JSC::JIT::compileAndLinkWithoutFinalizing):\n* Source/JavaScriptCore/jit/JIT.h:\n(JSC::JIT::emitValueProfilingSiteIfProfiledOpcode):\n(JSC::JIT::callOperationWithResult):\n* Source/JavaScriptCore/jit/JITAddGenerator.cpp:\n(JSC::JITAddGenerator::generateInline):\n(JSC::JITAddGenerator::generateFastPath):\n* Source/JavaScriptCore/jit/JITAddGenerator.h:\n(JSC::JITAddGenerator::JITAddGenerator):\n* Source/JavaScriptCore/jit/JITArithmetic.cpp:\n(JSC::JIT::emit_op_unsigned):\n(JSC::JIT::emit_compare):\n(JSC::JIT::emit_compareAndJump):\n(JSC::JIT::emit_compareImpl):\n(JSC::JIT::emit_compareUnsignedImpl):\n(JSC::JIT::emit_compareSlow):\n(JSC::JIT::emit_compareSlowImpl):\n(JSC::JIT::emit_op_inc):\n(JSC::JIT::emit_op_dec):\n(JSC::JIT::emit_op_mod):\n(JSC::JIT::emit_op_pow):\n(JSC::JIT::emitBitBinaryOpFastPath):\n(JSC::JIT::emit_op_bitnot):\n(JSC::JIT::emitRightShiftFastPath):\n(JSC::JIT::emitMathICFast):\n(JSC::JIT::emitMathICSlow):\n(JSC::JIT::emit_op_div):\n* Source/JavaScriptCore/jit/JITBitAndGenerator.cpp:\n(JSC::JITBitAndGenerator::generateFastPath):\n* Source/JavaScriptCore/jit/JITBitAndGenerator.h:\n(JSC::JITBitAndGenerator::JITBitAndGenerator):\n* Source/JavaScriptCore/jit/JITBitBinaryOpGenerator.h:\n(JSC::JITBitBinaryOpGenerator::JITBitBinaryOpGenerator):\n* Source/JavaScriptCore/jit/JITBitOrGenerator.cpp:\n(JSC::JITBitOrGenerator::generateFastPath):\n* Source/JavaScriptCore/jit/JITBitOrGenerator.h:\n(JSC::JITBitOrGenerator::JITBitOrGenerator):\n* Source/JavaScriptCore/jit/JITBitXorGenerator.cpp:\n(JSC::JITBitXorGenerator::generateFastPath):\n* Source/JavaScriptCore/jit/JITBitXorGenerator.h:\n(JSC::JITBitXorGenerator::JITBitXorGenerator):\n* Source/JavaScriptCore/jit/JITCall.cpp:\n(JSC::JIT::emit_op_ret):\n(JSC::JIT::emitPutCallResult):\n(JSC::JIT::compileSetupFrame):\n(JSC::JIT::compileCallDirectEval):\n(JSC::JIT::compileCallDirectEvalSlowCase):\n(JSC::JIT::compileTailCall):\n(JSC::JIT::compileOpCall):\n(JSC::JIT::emitIteratorOpenGeneric):\n(JSC::JIT::emitSlowIteratorOpenGeneric):\n(JSC::JIT::emit_op_iterator_next):\n(JSC::JIT::emitSlow_op_iterator_next):\n(JSC::JIT::emit_op_async_iterator_next):\n(JSC::JIT::emit_op_instanceof):\n(JSC::JIT::emitSlow_op_instanceof):\n* Source/JavaScriptCore/jit/JITDivGenerator.cpp:\n(JSC::JITDivGenerator::loadOperand):\n(JSC::JITDivGenerator::generateFastPath):\n* Source/JavaScriptCore/jit/JITDivGenerator.h:\n(JSC::JITDivGenerator::JITDivGenerator):\n* Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp:\n(JSC::JITByIdGenerator::JITByIdGenerator):\n(JSC::JITGetByIdGenerator::JITGetByIdGenerator):\n(JSC::generateGetByIdInlineAccessBaselineDataIC):\n(JSC::JITGetByIdGenerator::generateDataICFastPath):\n(JSC::JITGetByIdWithThisGenerator::JITGetByIdWithThisGenerator):\n(JSC::JITGetByIdWithThisGenerator::generateDataICFastPath):\n(JSC::JITPutByIdGenerator::JITPutByIdGenerator):\n(JSC::generatePutByIdInlineAccessBaselineDataIC):\n(JSC::JITPutByIdGenerator::generateDataICFastPath):\n(JSC::JITDelByValGenerator::JITDelByValGenerator):\n(JSC::JITDelByIdGenerator::JITDelByIdGenerator):\n(JSC::JITInByValGenerator::JITInByValGenerator):\n(JSC::JITInByIdGenerator::JITInByIdGenerator):\n(JSC::generateInByIdInlineAccessBaselineDataIC):\n(JSC::JITInByIdGenerator::generateDataICFastPath):\n(JSC::JITGetByValGenerator::JITGetByValGenerator):\n(JSC::JITGetByValWithThisGenerator::JITGetByValWithThisGenerator):\n(JSC::JITPutByValGenerator::JITPutByValGenerator):\n(JSC::JITPrivateBrandAccessGenerator::JITPrivateBrandAccessGenerator):\n* Source/JavaScriptCore/jit/JITInlineCacheGenerator.h:\n(JSC::JITByIdGenerator::setUpPropertyInlineCacheImpl):\n(JSC::JITInByValGenerator::setUpPropertyInlineCache):\n* Source/JavaScriptCore/jit/JITInlines.h:\n(JSC::JIT::appendCallSetJSValueResult):\n(JSC::JIT::appendCallWithExceptionCheckSetJSValueResult):\n(JSC::JIT::appendCallWithExceptionCheckSetJSValueResultWithProfile):\n(JSC::JIT::emitValueProfilingSite):\n(JSC::JIT::emitGetVirtualRegister):\n(JSC::JIT::emitPutVirtualRegister):\n(JSC::JIT::emitJumpIfNotInt):\n(JSC::JIT::emitJumpSlowCaseIfNotInt):\n(JSC::JIT::emitJumpSlowCaseIfNotJSCell):\n(JSC::JIT::loadCodeBlockConstant):\n(JSC::JIT::loadCodeBlockConstantPayload): Deleted.\n* Source/JavaScriptCore/jit/JITLeftShiftGenerator.cpp:\n(JSC::JITLeftShiftGenerator::generateFastPath):\n* Source/JavaScriptCore/jit/JITLeftShiftGenerator.h:\n(JSC::JITLeftShiftGenerator::JITLeftShiftGenerator):\n* Source/JavaScriptCore/jit/JITMulGenerator.cpp:\n(JSC::JITMulGenerator::generateInline):\n(JSC::JITMulGenerator::generateFastPath):\n* Source/JavaScriptCore/jit/JITMulGenerator.h:\n(JSC::JITMulGenerator::JITMulGenerator):\n* Source/JavaScriptCore/jit/JITNegGenerator.cpp:\n(JSC::JITNegGenerator::generateInline):\n(JSC::JITNegGenerator::generateFastPath):\n* Source/JavaScriptCore/jit/JITNegGenerator.h:\n(JSC::JITNegGenerator::JITNegGenerator):\n* Source/JavaScriptCore/jit/JITOpcodes.cpp:\n(JSC::JIT::emit_op_mov):\n(JSC::JIT::emit_op_new_object):\n(JSC::JIT::emitSlow_op_new_object):\n(JSC::JIT::emit_op_is_empty):\n(JSC::JIT::emit_op_typeof_is_undefined):\n(JSC::JIT::emit_op_typeof_is_function):\n(JSC::JIT::emit_op_is_undefined_or_null):\n(JSC::JIT::emit_op_is_boolean):\n(JSC::JIT::emit_op_is_number):\n(JSC::JIT::emit_op_is_big_int):\n(JSC::JIT::emit_op_is_cell_with_type):\n(JSC::JIT::emit_op_is_object):\n(JSC::JIT::emit_op_has_structure_with_flags):\n(JSC::JIT::emit_op_to_primitive):\n(JSC::JIT::emit_op_to_property_key):\n(JSC::JIT::emit_op_to_property_key_or_number):\n(JSC::JIT::emit_op_set_function_name):\n(JSC::JIT::emit_op_not):\n(JSC::JIT::emit_op_jfalse):\n(JSC::JIT::valueIsFalseyGenerator):\n(JSC::JIT::emit_op_jeq_null):\n(JSC::JIT::emit_op_jneq_null):\n(JSC::JIT::emit_op_jundefined_or_null):\n(JSC::JIT::emit_op_jnundefined_or_null):\n(JSC::JIT::emit_op_jeq_ptr):\n(JSC::JIT::emit_op_jneq_ptr):\n(JSC::JIT::emit_op_eq):\n(JSC::JIT::emit_op_jtrue):\n(JSC::JIT::valueIsTruthyGenerator):\n(JSC::JIT::emit_op_neq):\n(JSC::JIT::emit_op_throw):\n(JSC::JIT::op_throw_handlerGenerator):\n(JSC::JIT::compileOpStrictEq):\n(JSC::JIT::emit_op_to_number):\n(JSC::JIT::emit_op_to_numeric):\n(JSC::JIT::emit_op_to_string):\n(JSC::JIT::emit_op_to_object):\n(JSC::JIT::emit_op_catch):\n(JSC::JIT::emit_op_get_parent_scope):\n(JSC::JIT::emit_op_switch_imm):\n(JSC::JIT::emit_op_switch_char):\n(JSC::JIT::emit_op_switch_string):\n(JSC::JIT::emit_op_eq_null):\n(JSC::JIT::emit_op_neq_null):\n(JSC::JIT::emitGetScope):\n(JSC::JIT::emit_op_enter):\n(JSC::JIT::emit_op_to_this):\n(JSC::JIT::emit_op_create_this):\n(JSC::JIT::emitSlow_op_eq):\n(JSC::JIT::emitSlow_op_neq):\n(JSC::JIT::emit_op_debug):\n(JSC::JIT::emit_op_loop_hint):\n(JSC::JIT::emit_op_new_reg_exp):\n(JSC::JIT::emit_op_new_array_with_size):\n(JSC::JIT::emit_op_profile_type):\n(JSC::JIT::emit_op_log_shadow_chicken_tail):\n(JSC::JIT::emit_op_argument_count):\n(JSC::JIT::emit_op_get_argument):\n(JSC::JIT::emit_op_get_prototype_of):\n* Source/JavaScriptCore/jit/JITPropertyAccess.cpp:\n(JSC::JIT::emit_op_get_by_val):\n(JSC::JIT::emit_op_get_private_name):\n(JSC::JIT::emit_op_set_private_brand):\n(JSC::JIT::emit_op_check_private_brand):\n(JSC::JIT::emit_op_put_by_val):\n(JSC::JIT::emit_op_put_private_name):\n(JSC::JIT::emit_op_put_getter_by_val):\n(JSC::JIT::emit_op_put_setter_by_val):\n(JSC::JIT::emit_op_del_by_id):\n(JSC::JIT::emit_op_del_by_val):\n(JSC::JIT::emit_op_get_by_id_direct):\n(JSC::JIT::emit_op_get_by_id):\n(JSC::JIT::emit_op_get_length):\n(JSC::JIT::emit_op_get_by_id_with_this):\n(JSC::JIT::emit_op_put_by_id):\n(JSC::JIT::emit_op_in_by_id):\n(JSC::JIT::emit_op_in_by_val):\n(JSC::JIT::emitHasPrivate):\n(JSC::JIT::emit_op_resolve_scope):\n(JSC::JIT::emit_op_get_from_scope):\n(JSC::JIT::generateOpGetFromScopeThunk):\n(JSC::JIT::emit_op_put_to_scope):\n(JSC::JIT::emit_op_get_from_arguments):\n(JSC::JIT::emit_op_put_to_arguments):\n(JSC::JIT::emit_op_get_internal_field):\n(JSC::JIT::emit_op_put_internal_field):\n(JSC::JIT::emit_op_get_by_val_with_this):\n(JSC::JIT::emit_op_enumerator_get_by_val):\n(JSC::JIT::emit_op_enumerator_put_by_val):\n(JSC::JIT::emitWriteBarrier):\n* Source/JavaScriptCore/jit/JITRightShiftGenerator.cpp:\n(JSC::JITRightShiftGenerator::generateFastPath):\n* Source/JavaScriptCore/jit/JITRightShiftGenerator.h:\n(JSC::JITRightShiftGenerator::JITRightShiftGenerator):\n* Source/JavaScriptCore/jit/JITSubGenerator.cpp:\n(JSC::JITSubGenerator::generateInline):\n(JSC::JITSubGenerator::generateFastPath):\n* Source/JavaScriptCore/jit/JITSubGenerator.h:\n(JSC::JITSubGenerator::JITSubGenerator):\n* Source/JavaScriptCore/jit/JSInterfaceJIT.h:\n(JSC::JSInterfaceJIT::emitLoadJSValue):\n* Source/JavaScriptCore/jit/RegisterSet.h:\n* Source/JavaScriptCore/jit/ScratchRegisterAllocator.cpp:\n* Source/JavaScriptCore/jit/ScratchRegisterAllocator.h:\n* Source/JavaScriptCore/jit/SnippetParams.h:\n(JSC::SnippetParams::Value::isFPR const):\n(JSC::SnippetParams::Value::fpr const):\n(JSC::SnippetParams::Value::isJSValueRegs const): Deleted.\n(JSC::SnippetParams::Value::jsValueRegs const): Deleted.\n* Source/JavaScriptCore/jit/SnippetReg.h:\n(JSC::SnippetReg::isFPR const):\n(JSC::SnippetReg::fpr const):\n(JSC::SnippetReg::isJSValueRegs const): Deleted.\n(JSC::SnippetReg::jsValueRegs const): Deleted.\n* Source/JavaScriptCore/jit/SnippetSlowPathCalls.h:\n* Source/JavaScriptCore/jit/SpecializedThunkJIT.h:\n(JSC::SpecializedThunkJIT::loadJSArgument):\n(JSC::SpecializedThunkJIT::returnJSValue):\n* Source/JavaScriptCore/jit/ThunkGenerators.cpp:\n(JSC::globalIsNaNThunkGenerator):\n(JSC::numberIsNaNThunkGenerator):\n(JSC::globalIsFiniteThunkGenerator):\n(JSC::numberIsFiniteThunkGenerator):\n(JSC::numberIsSafeIntegerThunkGenerator):\n(JSC::numberConstructorCallThunkGenerator):\n(JSC::stringConstructorCallThunkGenerator):\n(JSC::boundFunctionCallGenerator):\n(JSC::remoteFunctionCallGenerator):\n(JSC::toIntegerOrInfinityThunkGenerator):\n(JSC::toLengthThunkGenerator):\n(JSC::maxThunkGenerator):\n(JSC::minThunkGenerator):\n(JSC::objectIsThunkGenerator):\n* Source/JavaScriptCore/llint/LLIntThunks.cpp:\n(JSC::LLInt::getHostCallReturnValueThunk):\n* Source/JavaScriptCore/lol/LOLJIT.cpp:\n(JSC::LOL::LOLJIT::compileAndLinkWithoutFinalizing):\n(JSC::LOL::LOLJIT::emit_op_mov):\n(JSC::LOL::LOLJIT::emit_op_ret):\n(JSC::LOL::LOLJIT::emit_op_eq):\n(JSC::LOL::LOLJIT::emitSlow_op_eq):\n(JSC::LOL::LOLJIT::emit_op_neq):\n(JSC::LOL::LOLJIT::emitSlow_op_neq):\n(JSC::LOL::LOLJIT::emitCompare):\n(JSC::LOL::LOLJIT::emitCompareImpl):\n(JSC::LOL::LOLJIT::emitCompareSlow):\n(JSC::LOL::LOLJIT::emitCompareSlowImpl):\n(JSC::LOL::LOLJIT::emitCompareAndJump):\n(JSC::LOL::LOLJIT::emitCompareAndJumpSlow):\n(JSC::LOL::LOLJIT::emitStrictEqJumpImpl):\n(JSC::LOL::LOLJIT::emitStrictEqJumpSlowImpl):\n(JSC::LOL::LOLJIT::emitCompareUnsignedAndJumpImpl):\n(JSC::LOL::LOLJIT::emit_op_to_number):\n(JSC::LOL::LOLJIT::emit_op_to_string):\n(JSC::LOL::LOLJIT::emit_op_to_numeric):\n(JSC::LOL::LOLJIT::emit_op_to_object):\n(JSC::LOL::LOLJIT::emit_op_to_property_key):\n(JSC::LOL::LOLJIT::emit_op_to_property_key_or_number):\n(JSC::LOL::LOLJIT::emit_op_to_primitive):\n(JSC::LOL::LOLJIT::emit_op_create_lexical_environment):\n(JSC::LOL::LOLJIT::emit_op_create_scoped_arguments):\n(JSC::LOL::LOLJIT::emit_op_new_array_with_size):\n(JSC::LOL::LOLJIT::emitNewFuncCommon):\n(JSC::LOL::LOLJIT::emitNewFuncExprCommon):\n(JSC::LOL::LOLJIT::emit_op_new_object):\n(JSC::LOL::LOLJIT::emitSlow_op_new_object):\n(JSC::LOL::LOLJIT::emit_op_new_reg_exp):\n(JSC::LOL::LOLJIT::emit_op_to_this):\n(JSC::LOL::LOLJIT::emit_op_create_this):\n(JSC::LOL::LOLJIT::emit_op_is_empty):\n(JSC::LOL::LOLJIT::emit_op_typeof_is_undefined):\n(JSC::LOL::LOLJIT::emit_op_typeof_is_function):\n(JSC::LOL::LOLJIT::emit_op_is_undefined_or_null):\n(JSC::LOL::LOLJIT::emit_op_is_boolean):\n(JSC::LOL::LOLJIT::emit_op_is_number):\n(JSC::LOL::LOLJIT::emit_op_is_big_int):\n(JSC::LOL::LOLJIT::emit_op_is_object):\n(JSC::LOL::LOLJIT::emit_op_is_cell_with_type):\n(JSC::LOL::LOLJIT::emit_op_has_structure_with_flags):\n(JSC::LOL::LOLJIT::emit_op_get_prototype_of):\n(JSC::LOL::LOLJIT::emit_op_jeq):\n(JSC::LOL::LOLJIT::emitSlow_op_jeq):\n(JSC::LOL::LOLJIT::emit_op_jneq):\n(JSC::LOL::LOLJIT::emitSlow_op_jneq):\n(JSC::LOL::LOLJIT::emit_op_jtrue):\n(JSC::LOL::LOLJIT::emit_op_jfalse):\n(JSC::LOL::LOLJIT::emit_op_jeq_null):\n(JSC::LOL::LOLJIT::emit_op_jneq_null):\n(JSC::LOL::LOLJIT::emit_op_jundefined_or_null):\n(JSC::LOL::LOLJIT::emit_op_jnundefined_or_null):\n(JSC::LOL::LOLJIT::emit_op_jeq_ptr):\n(JSC::LOL::LOLJIT::emit_op_jneq_ptr):\n(JSC::LOL::LOLJIT::emit_op_throw):\n(JSC::LOL::LOLJIT::emit_op_switch_imm):\n(JSC::LOL::LOLJIT::emit_op_switch_char):\n(JSC::LOL::LOLJIT::emit_op_switch_string):\n(JSC::LOL::LOLJIT::emitRightShiftFastPath):\n(JSC::LOL::LOLJIT::emit_op_lshift):\n(JSC::LOL::LOLJIT::emitBitBinaryOpFastPath):\n(JSC::LOL::LOLJIT::emitMathICFast):\n(JSC::LOL::LOLJIT::emitMathICSlow):\n(JSC::LOL::LOLJIT::emit_op_mod):\n(JSC::LOL::LOLJIT::emit_op_div):\n(JSC::LOL::LOLJIT::emit_op_bitnot):\n(JSC::LOL::LOLJIT::emit_op_inc):\n(JSC::LOL::LOLJIT::emit_op_dec):\n(JSC::LOL::LOLJIT::emit_op_argument_count):\n(JSC::LOL::LOLJIT::emit_op_get_argument):\n(JSC::LOL::LOLJIT::emit_op_get_from_scope):\n(JSC::LOL::LOLJIT::emitSlow_op_get_from_scope):\n(JSC::LOL::LOLJIT::generateOpGetFromScopeThunk):\n(JSC::LOL::LOLJIT::emit_op_put_to_scope):\n(JSC::LOL::LOLJIT::emitSlow_op_put_to_scope):\n(JSC::LOL::LOLJIT::emit_op_resolve_scope):\n(JSC::LOL::LOLJIT::emitSlow_op_resolve_scope):\n* Source/JavaScriptCore/lol/LOLJIT.h:\n(JSC::LOL::LOLJIT::silentSpill):\n(JSC::LOL::LOLJIT::silentFill):\n(JSC::LOL::LOLJIT::emitWriteBarrier):\n(): Deleted.\n* Source/JavaScriptCore/lol/LOLRegisterAllocator.h:\n(JSC::LOL::RegisterAllocator::releaseScratches):\n(JSC::LOL::RegisterAllocator::AllocationHint::AllocationHint):\n(JSC::LOL::RegisterAllocator::allocateImpl):\n(JSC::LOL::RegisterAllocator::flush):\n(JSC::LOL::RegisterAllocator\u003cBackend\u003e::allocate):\n(JSC::LOL::Location::gpr const): Deleted.\n* Source/JavaScriptCore/tools/JSDollarVM.cpp:\n* Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp:\n(JSC::Wasm::BBQJITImpl::Location::fromArgumentLocation):\n* Source/JavaScriptCore/wasm/WasmCallingConvention.cpp:\n(JSC::Wasm::jsCallingConvention):\n(JSC::Wasm::wasmCallingConvention):\n* Source/JavaScriptCore/wasm/WasmCallingConvention.h:\n(JSC::Wasm::CallInformation::computeResultsOffsetList):\n(JSC::Wasm::WasmCallingConvention::WasmCallingConvention):\n(JSC::Wasm::WasmCallingConvention::marshallLocation const):\n(JSC::Wasm::JSCallingConvention::JSCallingConvention):\n(JSC::Wasm::JSCallingConvention::marshallLocation const):\n(JSC::Wasm::JSCallingConvention::callInformationFor const):\n* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:\n(JSC::Wasm::OMGIRGenerator::addArguments):\n(JSC::Wasm::prepareForTailCallImpl):\n* Source/JavaScriptCore/wasm/WasmOperations.cpp:\n(JSC::Wasm::JSC_DEFINE_JIT_OPERATION):\n* Source/JavaScriptCore/wasm/WasmThunks.cpp:\n(JSC::Wasm::materializeBaselineDataGenerator):\n(JSC::Wasm::callPolymorphicCalleeGenerator):\n* Source/JavaScriptCore/wasm/WasmTypeDefinition.cpp:\n(JSC::Wasm::RTT::ensureArgumINTBytecode const):\n(JSC::Wasm::RTT::ensureUINTBytecode const):\n(JSC::Wasm::buildCallArgumentBytecode):\n(JSC::Wasm::buildCallResultBytecode):\n* Source/JavaScriptCore/wasm/WasmValueLocation.cpp:\n(JSC::Wasm::ValueLocation::dump const):\n* Source/JavaScriptCore/wasm/WasmValueLocation.h:\n(JSC::Wasm::ValueLocation::ValueLocation):\n(JSC::Wasm::ValueLocation::gpr const):\n(JSC::Wasm::ValueLocation::jsr const): Deleted.\n* Source/JavaScriptCore/wasm/js/JSToWasm.cpp:\n(JSC::Wasm::marshallJSResult):\n(JSC::Wasm::RTT::jsToWasmICEntrypoint const):\n* Source/JavaScriptCore/wasm/js/WasmToJS.cpp:\n(JSC::Wasm::wasmToJS):\n* Source/WebCore/domjit/DOMJITHelpers.cpp:\n* Source/WebCore/domjit/DOMJITHelpers.h:\n(WebCore::DOMJIT::toWrapper):\n* Source/WebCore/domjit/JSDocumentDOMJIT.cpp:\n(WebCore::compileDocumentDocumentElementAttribute):\n(WebCore::compileDocumentBodyAttribute):\n* Source/WebCore/domjit/JSNodeDOMJIT.cpp:\n(WebCore::createCallDOMGetterForOffsetAccess):\n(WebCore::compileNodeNodeTypeAttribute):\n(WebCore::compileNodeOwnerDocumentAttribute):\n\nCanonical link: https://commits.webkit.org/320197@main",
      "email": "ysuzuki@apple.com",
      "hash": "471af61580477c3a63158140e15543d5c6d9e2e8",
      "subject": "[JSC] Remove JSValueRegs"
    },
    "320198@main": {
      "author": "Brian Weinstein",
      "avatar": "https://www.gravatar.com/avatar/2892a9aaa68f537ee65c6f95ef0768a6?d=identicon\u0026s=64",
      "cl": "320198@main",
      "clUrl": "https://commits.webkit.org/320198@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322881\nrdar://186116488\n\nReviewed by Timothy Hatcher.\n\nWhen an extension service worker is reloaded, it loses track of the client registrations. Make\nsure that the service worker has the correct knowledge of its registrations when it\nhas been unloaded and reloaded.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIOffscreen.mm\n\n* Source/WebCore/workers/service/server/SWServer.cpp:\n(WebCore::SWServer::didReconnectServiceWorkerPage): Remove the previous identifier from the map,\nadd the new one.\n(WebCore::SWServer::unregisterServiceWorkerClientInternal): Add a branch if the registration has any clients.\nIf so, clear the service worker page identifier and terminate the workers, instead of clearing the registration\nentirely.\n* Source/WebCore/workers/service/server/SWServer.h:\n* Source/WebCore/workers/service/server/SWServerJobQueue.cpp:\n(WebCore::SWServerJobQueue::runRegisterJob): Restore existing service worker connections.\n* Source/WebCore/workers/service/server/SWServerRegistration.cpp:\n(WebCore::SWServerRegistration::clear): Call terminateWorkersForServiceWorkerPageDisconnect (pulled into a helper method).\n(WebCore::SWServerRegistration::terminateWorkersForServiceWorkerPageDisconnect): Move some code that used to be in\nSWServerRegistration::clear into its own method.\n* Source/WebCore/workers/service/server/SWServerRegistration.h:\n(WebCore::SWServerRegistration::setServiceWorkerPageIdentifier):\n* Source/WebKit/UIProcess/API/Cocoa/WKWebExtensionContext.mm:\n(-[WKWebExtensionContext _reloadBackgroundContentForTesting]): Call into the WebExtensionContext C++ object.\n* Source/WebKit/UIProcess/API/Cocoa/WKWebExtensionContextPrivate.h:\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionContextCocoa.mm:\n(WebKit::WebExtensionContext::reloadBackgroundContentForTesting): Unload and load the background web view.\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIOffscreen.mm:\n(TestWebKitAPI::TEST_F(WKWebExtensionAPIOffscreen, OffscreenDocumentVisibleToClientsMatchAllAfterBackgroundContentReloads)): This\ntest creates an offscreen web view, and makes sure that it is still a client after the service worker is unloaded and reloaded.\n\nCanonical link: https://commits.webkit.org/320198@main",
      "email": "bweinstein@apple.com",
      "hash": "4ce58a7ff78ce27cf6646691c6ddfb966b22b51c",
      "subject": "Extension service worker loses clients when it is unloaded and reloaded"
    },
    "320199@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/3d43be18ce5ee6b92ba9151b63591125?d=identicon\u0026s=64",
      "cl": "320199@main",
      "clUrl": "https://commits.webkit.org/320199@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322922\nrdar://185452156\n\nReviewed by Simon Fraser.\n\nThis patch aligns WebKit with Gecko / Firefox and Blink / Chromium.\n\nA SMIL \u003canimate\u003e on a presentation attribute (e.g. fill) applies its value\nthrough the element's animated SMIL style block, which the cascade injects at\ninline-style priority and thus outranks the attribute (the base value). That\nvalue is released only by SVGAttributeAnimator::removeAnimatedStyleProperty(),\nvia the animator's stop() during teardown.\n\nThat method early-returned when the target was disconnected -- but teardown\nfires exactly when the element leaves the document, so the guard tripped, the\nproperty was left in animatedSMILStyleProperties, and it re-applied on every\nlater style resolution. A reinserted (e.g. pooled and reused) element then\npainted the frozen animated value permanently.\n\nDrop the guard from the removal path so the value is released regardless of\nconnection state. This is safe: invalidateStyle() is already a no-op on a\ndisconnected element, and reinsertion triggers a fresh style resolution that no\nlonger sees the property. The apply paths keep their guard.\n\nTest: imported/w3c/web-platform-tests/svg/animations/smil-detach-releases-animated-presentation-attribute.html\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/smil-detach-releases-animated-presentation-attribute-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/animations/smil-detach-releases-animated-presentation-attribute.html: Added.\n* Source/WebCore/svg/properties/SVGAttributeAnimator.cpp:\n(WebCore::SVGAttributeAnimator::removeAnimatedStyleProperty):\n\nCanonical link: https://commits.webkit.org/320199@main",
      "email": "ahmad.saleem792@gmail.com",
      "hash": "d6e2e670e84753c4fd93a700868105d80be12567",
      "subject": "SMIL animation of a presentation attribute is never released when the element is detached mid-animation"
    },
    "320200@main": {
      "author": "Kiet Ho",
      "avatar": "https://www.gravatar.com/avatar/d9058b37006dce1f55f91b8ccc82f9a3?d=identicon\u0026s=64",
      "cl": "320200@main",
      "clUrl": "https://commits.webkit.org/320200@main",
      "description": "rdar://185139910\nhttps://bugs.webkit.org/show_bug.cgi?id=321956\n\nReviewed by Sam Weinig.\n\nThe ColorPropertyTraits implementation for accent-color calls\nStyle::AccentColor::colorOrCurrentColor, which computes accent-color: auto\nto currentColor, which then resolves to the element's current color. But\naccording to the spec, accent-color: auto should resolve to an \"UA-chosen\ncolor, which should match the accent color of the platform, if any.\" [1]\nHence a more sensible default would be to resolve to AccentColor, which\nRenderTheme would resolve to a fixed color.\n\nFix this by renaming colorOrCurrentColor to colorOrDefaultColor, and\nchanging it to return AccentColor when accent-color is auto.\n\nNo tests because nothing exercised this path yet.\n\n[1]: https://drafts.csswg.org/css-ui/#valdef-accent-color-auto\n\n* Source/WebCore/style/computed/StyleComputedStyleProperties+GettersCustomInlines.h:\n(WebCore::Style::ColorPropertyTraits\u003cPropertyNameConstant\u003cCSSPropertyAccentColor\u003e\u003e::color):\n* Source/WebCore/style/values/ui/StyleAccentColor.cpp:\n(WebCore::Style::AccentColor::colorOrDefaultColor const):\n(WebCore::Style::AccentColor::colorOrCurrentColor const): Deleted.\n* Source/WebCore/style/values/ui/StyleAccentColor.h:\n\nCanonical link: https://commits.webkit.org/320200@main",
      "email": "kiet.ho@apple.com",
      "hash": "5de207b95f0aa705fa0c654f455c7da6925d5bb2",
      "subject": "accent-color: auto shouldn't resolve to currentColor"
    },
    "320201@main": {
      "author": "Roy Reapor",
      "avatar": "https://www.gravatar.com/avatar/bcb83d9f4fea3f6823d1b8f01e888053?d=identicon\u0026s=64",
      "cl": "320201@main",
      "clUrl": "https://commits.webkit.org/320201@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323035\nrdar://186302701\n\nReviewed by Jonathan Bedard.\n\nThis is needed to support an Apple build system. See also rdar://186211985.\n\n* .submitproject:\n\nCanonical link: https://commits.webkit.org/320201@main",
      "email": "rreapor@apple.com",
      "hash": "8f6bbf45d168bc2f4dff1022643823ab3a9da08a",
      "subject": "Define a new filter rule in `.submitproject` so we can build using an Apple Internal system"
    },
    "320202@main": {
      "author": "Cameron McCormack",
      "avatar": "https://www.gravatar.com/avatar/b2bb1b369be938a743e50f595bfa0798?d=identicon\u0026s=64",
      "cl": "320202@main",
      "clUrl": "https://commits.webkit.org/320202@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322961\nrdar://186229685\n\nReviewed by Said Abou-Hallawa.\n\nCanvasBase::makeRenderingResultsAvailable fabricates a transparent black bitmap\nonly when a canvas has no rendering context. A placeholder canvas has an internal\nPlaceholderRenderingContext, so it took the context path instead, and that\nreturned nullptr until the OffscreenCanvas pushed its first frame. ImageBitmap\nturned the null into \"Cannot create ImageBitmap from canvas that can't be\nrendered\", which rejected the promise and timed out two subtests.\n\nHTML's usability check makes an HTMLCanvasElement source bad only when a\ndimension is zero, so a sized placeholder with no pushed frame is good and must\nproduce a transparent black bitmap. PlaceholderRenderingContext already reports\nisSurfaceBufferTransparentBlack() when it has no buffer, so the class modelled\nthis correctly for painting and simply did not apply it when asked for a buffer.\ncreatePattern, toDataURL, toBlob and toVideoFrame reach the same path.\n\n* LayoutTests/TestExpectations:\n* Source/WebCore/html/CanvasBase.cpp:\n(WebCore::CanvasBase::makeRenderingResultsAvailable):\n(WebCore::CanvasBase::createTransparentBlackImageBuffer const):\n* Source/WebCore/html/CanvasBase.h:\n* Source/WebCore/html/canvas/PlaceholderRenderingContext.cpp:\n(WebCore::PlaceholderRenderingContext::surfaceBufferToImageBuffer):\n\nCanonical link: https://commits.webkit.org/320202@main",
      "email": "heycam@apple.com",
      "hash": "a8a0b96619f38d1a9cb165fd57e25c27cee2ef7b",
      "subject": "Return transparent black for a placeholder canvas that has no pushed frame"
    },
    "320203@main": {
      "author": "Tim Horton",
      "avatar": "https://www.gravatar.com/avatar/a04261df168177f0d816f3c7276f6183?d=identicon\u0026s=64",
      "cl": "320203@main",
      "clUrl": "https://commits.webkit.org/320203@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322872\nrdar://185015708\n\nReviewed by Aditya Keerthi and Abrar Rahman Protyasha.\n\n* Source/WebKit/UIProcess/ios/forms/WKFormSelectPicker.mm:\n(-[WKSelectPicker controlUpdateEditing]):\n(-[WKSelectPicker actionForOptionItem:withIndex:]):\n(-[WKSelectPicker contextMenuInteraction:configurationForMenuAtLocation:]):\n(-[WKSelectPicker contextMenuInteraction:willDisplayMenuForConfiguration:animator:]):\nHold weak references to self for select picker blocks to avoid cycles.\n\nCanonical link: https://commits.webkit.org/320203@main",
      "email": "thorton@apple.com",
      "hash": "eb4a25a501dd927855367ac278c90b52ddae35ed",
      "subject": "Retain cycle results in leak of WKSelectPicker actions"
    },
    "320204@main": {
      "author": "Tim Horton",
      "avatar": "https://www.gravatar.com/avatar/a04261df168177f0d816f3c7276f6183?d=identicon\u0026s=64",
      "cl": "320204@main",
      "clUrl": "https://commits.webkit.org/320204@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323027\nrdar://143715630\n\nReviewed by Wenson Hsieh.\n\n* Source/WebCore/page/QuirkNames.h:\n* Source/WebCore/page/QuirkTable.cpp:\n* Source/WebCore/page/Quirks.cpp:\n* Source/WebCore/page/Quirks.h:\n* Source/WebCore/style/StyleAdjuster.cpp:\n(WebCore::Style::Adjuster::adjustForSiteSpecificQuirks const):\nAdd a quirk to reinstate scrolling and remove the large minimum layout size.\n\nCanonical link: https://commits.webkit.org/320204@main",
      "email": "thorton@apple.com",
      "hash": "793c0df91fd98320cf47879260ab52b1fcf77b45",
      "subject": "[Quirk] WebEx UI doesn't always fit on screen, and scrolling is disabled so you can't recover"
    },
    "320205@main": {
      "author": "Lauro Moura",
      "avatar": "https://www.gravatar.com/avatar/6157f52d61e04c2c63fe7ff668ba69b3?d=identicon\u0026s=64",
      "cl": "320205@main",
      "clUrl": "https://commits.webkit.org/320205@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322845\n\nReviewed by Justin Michaud.\n\nWhen stripping the prefixed error messages that arrive from the\nWebAutomationSessionProxy, we should use `String::substring(size)` to\ntake the rest of the string after `size` chars, instead of\nString::right(size), wich returns the `size` rightmost characters.\n\nThis can be seen in the test\nimported/w3c/webdriver/tests/bidi/session/unsubscribe/invalid.py::test_params_event_value_valid_and_invalid_event_name,\nwhich is currently reporting the exception message `entifier \"text1\"`\n\n* Source/WebKit/UIProcess/Automation/BidiScriptAgent.cpp:\n(WebKit::BidiScriptAgent::callFunction):\n\nCanonical link: https://commits.webkit.org/320205@main",
      "email": "lmoura@igalia.com",
      "hash": "3eec920a914fe072b02b51333ec4bd9dd1aaa472",
      "subject": "[WebDriver][BiDi] Fix script.call_function trimming of error messages"
    },
    "320206@main": {
      "author": "Elliott Williams",
      "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64",
      "cl": "320206@main",
      "clUrl": "https://commits.webkit.org/320206@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322766\nrdar://186030053\n\nReviewed by Richard Robinson.\n\nThe CMake build uses a \"Cocoa\" port for all Apple platforms. Remove the\nplatform-specific port names in webkitdirs. This cleans up the code to\nwork the same way that CMake does: Port is always \"Cocoa\" when building\nfor an Apple platform, and the requested SDK determines which platform.\n\nNo functional change, but this causes build-webkit to now pass\n-DPORT=Cocoa instead of the legacy `-DPORT=Mac` argument.\n\n* Tools/Scripts/webkitdirs.pm:\n(determineXcodeDestination):\n(argumentsForConfiguration):\n(sdkPlatformOSName):\n(determinePortName):\n(isIOSWebKit):\n(isTVOSWebKit):\n(isWatchOSWebKit):\n(isVisionOSWebKit):\n(isEmbeddedWebKit):\n(isAppleMacWebKit):\n(isMacCatalystWebKit):\n(isAppleCocoaWebKit):\n(willUseMacCatalystSDK):\n(willUseSimulatorSDK):\n(simulatorIdiom):\n(iosSimulatorDeviceByName):\n(simulatorRuntime):\n(findOrCreateSimulatorForIOSDevice):\n(willUseAppleTVDeviceSDK): Deleted.\n(willUseAppleTVSimulatorSDK): Deleted.\n(willUseWatchDeviceSDK): Deleted.\n(willUseWatchSimulatorSDK): Deleted.\n(willUseVisionDeviceSDK): Deleted.\n(willUseVisionSimulatorSDK): Deleted.\n(iosSimulatorRuntime): Deleted.\n\nCanonical link: https://commits.webkit.org/320206@main",
      "email": "emw@apple.com",
      "hash": "7abb8a36f4ff27aea6d492f66f5e149855d96c94",
      "subject": "[Build] Clean up Apple platform port names in webkitdirs"
    },
    "320207@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "320207@main",
      "clUrl": "https://commits.webkit.org/320207@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=139117\nrdar://19103270\n\nReviewed by Said Abou-Hallawa.\n\nThis patch aligns WebKit with Gecko / Firefox.\n\nPer SVG 2 §5.6.1, conditional processing attributes (systemLanguage,\nrequiredExtensions) \"only affect the direct rendering of elements and do not\nprevent elements from being successfully referenced by other elements\", and\n\"conditional processing will have no effect on never-rendered elements\".\n(https://w3c.github.io/svgwg/svg2-draft/struct.html#ConditionalProcessingOverview)\n\nclipPath, mask and pattern are never-rendered resource elements, only\nreferenced via url(). A conditional processing attribute placed on the\nresource element itself must therefore be ignored. But SVGClipPathElement,\nSVGMaskElement and SVGPatternElement overrode isValid() to return\nSVGTests::isValid(), which SVGElement::childShouldCreateRenderer() consults, so\na failing systemLanguage on the resource element suppressed its renderer and\nthe reference silently failed. (filter and gradients lack SVGTests, so they\nwere already correct.)\n\nRemove the override so these elements fall back to SVGElement::isValid()\n(always true) and stay referenceable. SVGTests is retained so the DOM\nattributes are still exposed, just not used for rendering.\n\nThis does not change how conditional processing applies to the resource's\n*children*: the attribute is ignored on the container but still honored on the\ncontent elements inside it, per the spec's note that \"conditional processing\nof child content of a never-rendered container [...] will affect whether that\nchild content contributes to the graphical effect\". For example:\n\n    \u003cpattern systemLanguage=\"foo\"\u003e\n      \u003crect systemLanguage=\"bar\"/\u003e\n    \u003c/pattern\u003e\n\nsystemLanguage on \u003cpattern\u003e is now ignored (the pattern is still\nreferenceable), while systemLanguage on the child \u003crect\u003e is still honored,\nbecause child graphics elements keep their own isValid() overrides that\nchildShouldCreateRenderer() continues to gate.\n\n* LayoutTests/TestExpectations: Unskip the now-passing test.\n* Source/WebCore/svg/SVGClipPathElement.h:\n* Source/WebCore/svg/SVGMaskElement.h:\n* Source/WebCore/svg/SVGPatternElement.h:\nRemove the isValid() override that consulted SVGTests::isValid().\n\nCanonical link: https://commits.webkit.org/320207@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "491091b849b28fd0ed7d566ff7946475b50d5eb1",
      "subject": "SVG conditional processing attributes on clipPath, mask and pattern wrongly prevent the resource from being referenced"
    },
    "320208@main": {
      "author": "Patrick Griffis",
      "avatar": "https://www.gravatar.com/avatar/2233c3a857004b126158572af9fe36f7?d=identicon\u0026s=64",
      "cl": "320208@main",
      "clUrl": "https://commits.webkit.org/320208@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323051\n\nUnreviewed gardening.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/gtk/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320208@main",
      "email": "pgriffis@igalia.com",
      "hash": "652289248e472b202e1117f1705a30798e381846",
      "subject": "[GTK][WPE] Gardening of tests - 2026-08-31 (2)"
    },
    "320209@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "320209@main",
      "clUrl": "https://commits.webkit.org/320209@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323039\nrdar://186305732\n\nReviewed by Keith Miller.\n\nSnippetReg is no longer necessary as we can just use JSC::Reg. Remove it.\n\n* Source/JavaScriptCore/CMakeLists.txt:\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp:\n(JSC::InlineCacheCompiler::emitDOMJITGetter):\n* Source/JavaScriptCore/jit/SnippetParams.h:\n(JSC::SnippetParams::Value::Value):\n(JSC::SnippetParams::Value::reg const):\n* Source/JavaScriptCore/jit/SnippetReg.h: Removed.\n\nCanonical link: https://commits.webkit.org/320209@main",
      "email": "ysuzuki@apple.com",
      "hash": "60b838f03ced60d24db49a82b76634d96bd93a5c",
      "subject": "[JSC] Remove SnippetReg"
    },
    "320210@main": {
      "author": "Cameron McCormack",
      "avatar": "https://www.gravatar.com/avatar/b2bb1b369be938a743e50f595bfa0798?d=identicon\u0026s=64",
      "cl": "320210@main",
      "clUrl": "https://commits.webkit.org/320210@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322959\nrdar://186229838\n\nReviewed by Dan Glastonbury.\n\nTwo independent problems.\n\n279786@main added a `if (window.internals)` guard to eight sibling tests and\n`if (window.internal)` to this one, so setWebGLErrorsToConsoleEnabled(false)\nnever ran and thirty console messages leaked into the output.\n\nTwo cases also read an RGB8 color buffer with RGB/UNSIGNED_BYTE. readPixels\naccepts the pair implied by the buffer's component type, which is\nRGBA/UNSIGNED_BYTE here, or the implementation-dependent pair reported by\nIMPLEMENTATION_COLOR_READ_FORMAT and _TYPE. Metal has no 24-bit color format so\nRGB8 is backed by RGBA8 and ANGLE reports RGBA, making RGB/UNSIGNED_BYTE invalid.\nThe Vulkan backend behaves the same way, and the upstream conformance test reads\nan RGB8 framebuffer as RGBA/UNSIGNED_BYTE. These cases have failed since macOS\nmoved to ANGLE-on-Metal.\n\nNo baseline change is needed: with both fixed, the output matches the existing\nexpectation again.\n\n* LayoutTests/fast/canvas/webgl/webgl2-texture-upload-enums.html:\n* LayoutTests/platform/mac/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320210@main",
      "email": "heycam@apple.com",
      "hash": "091cad83074b8af99d15f8c29336fc760ffff24f",
      "subject": "Read RGB8 color buffers as RGBA and restore console suppression in webgl2-texture-upload-enums.html"
    },
    "320211@main": {
      "author": "Cameron McCormack",
      "avatar": "https://www.gravatar.com/avatar/b2bb1b369be938a743e50f595bfa0798?d=identicon\u0026s=64",
      "cl": "320211@main",
      "clUrl": "https://commits.webkit.org/320211@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=174066\nrdar://33122044\n\nReviewed by Devin Rousso.\n\n318567@main changed how we represented objects in this output.\n\n* LayoutTests/inspector/canvas/recording-webgl2-snapshots-expected.txt:\n* LayoutTests/platform/mac/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320211@main",
      "email": "heycam@apple.com",
      "hash": "9c6c6381d526abd9e468ce186332427caeddf981",
      "subject": "Web Inspector: rebaseline recording-webgl2-snapshots for per-type recorded object identifiers"
    },
    "320212@main": {
      "author": "Cameron McCormack",
      "avatar": "https://www.gravatar.com/avatar/b2bb1b369be938a743e50f595bfa0798?d=identicon\u0026s=64",
      "cl": "320212@main",
      "clUrl": "https://commits.webkit.org/320212@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322956\nrdar://186229621\n\nReviewed by Dan Glastonbury.\n\nThe test passes corectly now.\n\n* LayoutTests/platform/mac/TestExpectations:\n* LayoutTests/platform/mac/fast/canvas/webgl/oes-element-index-uint-expected.txt: Removed.\n\nCanonical link: https://commits.webkit.org/320212@main",
      "email": "heycam@apple.com",
      "hash": "074cdd3c03279fc3aa1bc853a2d89c04b6f321c8",
      "subject": "Remove the stale platform/mac baseline for oes-element-index-uint.html"
    },
    "320215@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "320215@main",
      "clUrl": "https://commits.webkit.org/320215@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322948\n\nReviewed by Keith Miller.\n\nThe third argument of the WebAssembly.Exception constructor is a WebIDL\ndictionary, so null must be treated like undefined and any other\nnon-object must be a TypeError. The constructor only skipped undefined,\nso null threw while reading traceStack and a number or string was read\nas an object.\n\nTreat undefined and null as the empty dictionary and throw for other\nnon-objects.\n\nTest: JSTests/wasm/stress/exception-constructor-options-argument.js\n\n* JSTests/wasm/stress/exception-constructor-options-argument.js: Added.\n(testUndefinedAndNull):\n(testNonObjects):\n* Source/JavaScriptCore/wasm/js/WebAssemblyExceptionConstructor.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n\nCanonical link: https://commits.webkit.org/320215@main",
      "email": "sosuke@bun.sh",
      "hash": "5faef46275e1a37fc9924d252f3cd9e59fa8a7b4",
      "subject": "[JSC] `WebAssembly.Exception` rejects null options and accepts non-object options"
    },
    "320216@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "320216@main",
      "clUrl": "https://commits.webkit.org/320216@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322962\n\nReviewed by Yusuke Suzuki.\n\nClassSetParserDelegate holds back the previous character in m_character\nuntil it knows whether it starts a range; m_character is only meaningful\nwhile the state says a character is pending. After a nested class or a\n\\q{} string disjunction nothing is pending, but atomPatternCharacter()\nstill emitted m_character before holding back the new one. When no\ncharacter had been seen yet that emitted its initial value, so\n/^[\\q{ab}c]$/v and /^[[\\p{L}]a]$/v matched U+0000; otherwise it\nre-emitted a character the class already had.\n\nTest: JSTests/stress/regexp-v-flag-character-after-set-operand.js\n\n* JSTests/stress/regexp-v-flag-character-after-set-operand.js: Added.\n(shouldBe):\n* Source/JavaScriptCore/yarr/YarrParser.h:\n(JSC::Yarr::Parser::ClassSetParserDelegate::atomPatternCharacter):\n\nCanonical link: https://commits.webkit.org/320216@main",
      "email": "sosuke@bun.sh",
      "hash": "38281d033aee844d56610d9e9b1ea23894f310be",
      "subject": "[YARR] A character following a class set operand in a `/v` class adds `U+0000`"
    },
    "320217@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "320217@main",
      "clUrl": "https://commits.webkit.org/320217@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322923\n\nReviewed by Yusuke Suzuki.\n\nround() re-interprets the rounded wall-clock time through\nInterpretISODateTimeOffset with the receiver's current offset, and the\nspec passes match-exactly there: the offset came from the time zone, not\nfrom a string that only carries minutes. JSC passed match-minutes, so\ninside a sub-minute fold (Pacific/Niue moved from LMT -11:19:40 to -11:20\nin 1952) a candidate whose offset merely rounds to the current one is\naccepted first, and rounding a time in the second occurrence slid 20\nseconds back into the first.\n\nPass match-exactly like with() and the property-bag path already do.\n\nTest: JSTests/stress/temporal-zoned-date-time-round-sub-minute-offset-fold.js\n\n* JSTests/stress/temporal-zoned-date-time-round-sub-minute-offset-fold.js: Added.\n(shouldBe):\n(throw.new.Error):\n* Source/JavaScriptCore/runtime/TemporalZonedDateTimePrototype.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n\nCanonical link: https://commits.webkit.org/320217@main",
      "email": "sosuke@bun.sh",
      "hash": "56241cc1137f1aa6923b80e59522406084e20637",
      "subject": "[JSC] `Temporal.ZonedDateTime.prototype.round` resolves the rounded wall-clock time with a minute-rounded offset"
    },
    "320218@main": {
      "author": "Sergey Rubanov",
      "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64",
      "cl": "320218@main",
      "clUrl": "https://commits.webkit.org/320218@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322500\n\nReviewed by Yusuke Suzuki.\n\nA constant non-cell (jsNull) cannot be a remembered-set source. Skip the\nwrite barrier for that store on a ref field or array element in OMG and\nBBQ.\n\n* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:\n* Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp:\n\nCanonical link: https://commits.webkit.org/320218@main",
      "email": "chi187@gmail.com",
      "hash": "a8e5a7cbc6ada06d0f1b685067cf9d335ccec74a",
      "subject": "[JSC][Wasm] Elide write barrier when storing a constant non-cell"
    },
    "320219@main": {
      "author": "Cameron McCormack",
      "avatar": "https://www.gravatar.com/avatar/b2bb1b369be938a743e50f595bfa0798?d=identicon\u0026s=64",
      "cl": "320219@main",
      "clUrl": "https://commits.webkit.org/320219@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322960\nrdar://186229843\n\nReviewed by Jean-Yves Avenard.\n\nMediaRecorderPrivateEncoder::flushToEndSegment holds back the last video keyframe\nso it can start the next segment, because MP4 requires segments to begin with\none. When that keyframe is the only thing in the queue, which is what a source\nproducing a single frame gives, nothing is muxed: m_interleavedFrames stays\nempty, the write condition fails, fetchData returns a zero-byte buffer, and\nMediaRecorder::requestDataInternal suppresses dataavailable for an empty buffer.\nThe timeslice timer restarts and repeats that indefinitely.\n\nThe intermittency comes from partiallyFlushEncodedQueues, which muxes without the\nhold-back but bails while a flush is pending. VideoToolbox emits the single\ncompressed frame around a second after submission, so whether it lands before or\ninside the timeslice flush decides the outcome.\n\nLet the keyframe start the current segment when holding it back would mux nothing\nat all: empty pending segment, empty encoded-audio queue, and the keyframe at the\nhead of the video queue. WebM is unaffected because it does not require segments\nto start with a keyframe, and the audio-queue condition leaves the interleaving\npath alone.\n\nThe defect is wider than this test: any canvas recorded at roughly one frame or\nfewer per timeslice emits no data until stop(). A regression test covering that\ndirectly is added, using captureStream(0) so the frame count is exact and\nspecified.\n\nTest: http/wpt/mediarecorder/MediaRecorder-single-frame-timeslice.html\n\n* LayoutTests/http/wpt/mediarecorder/MediaRecorder-single-frame-timeslice-expected.txt: Added.\n* LayoutTests/http/wpt/mediarecorder/MediaRecorder-single-frame-timeslice.html: Added.\n* LayoutTests/platform/mac-wk2/TestExpectations:\n* Source/WebCore/platform/mediarecorder/MediaRecorderPrivateEncoder.cpp:\n(WebCore::MediaRecorderPrivateEncoder::flushToEndSegment):\n* LayoutTests/platform/glib/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320219@main",
      "email": "heycam@apple.com",
      "hash": "c5cf5b7adef53ed9941565a6b1086dc601a8517a",
      "subject": "Let a lone video keyframe start a MediaRecorder segment rather than holding it back indefinitely."
    },
    "320220@main": {
      "author": "David Kilzer",
      "avatar": "https://www.gravatar.com/avatar/e228ffc7a792e70bf2d160563c18dcc6?d=identicon\u0026s=64",
      "cl": "320220@main",
      "clUrl": "https://commits.webkit.org/320220@main",
      "description": "\u003chttps://bugs.webkit.org/show_bug.cgi?id=323013\u003e\n\u003crdar://186279308\u003e\n\nReviewed by Elliott Williams and Keith Miller.\n\nThe CMake build enables -Wthread-safety globally on Cocoa ports\n(320158@main), so third-party targets such as ANGLE and gtest are built\nwith it as a superset. The Xcode build set -Wthread-safety per project,\nwhich left those third-party targets uncovered and duplicated the flag\nacross a dozen configuration files.\n\nAdd -Wthread-safety to WK_COMMON_WARNING_CFLAGS in CommonBase.xcconfig,\nwhich every target that includes CommonBase inherits, and drop the\nnow-redundant per-project copies. This matches the CMake build's global\nflag and extends coverage to ANGLE and gtest.\n\n-Wthread-safety diagnoses any code that manipulates a thread-safety\ncapability, including the annotated libc++ std::mutex that ANGLE's mutex\nwrappers hold. Add three macros to angleutils.h: ANGLE_ACQUIRE_CAPABILITY\nand ANGLE_RELEASE_CAPABILITY for functions that unconditionally acquire\nor release a mutex, and ANGLE_NO_THREAD_SAFETY_ANALYSIS for functions\nwhose conditional, recursive, or root-delegating locking the analysis\ncannot model.\n\nAnnotate angle::priv::MutexOnStd's forwarding lock() and unlock() with\nthe acquire/release attributes. egl::priv::GlobalMutex uses\nANGLE_NO_THREAD_SAFETY_ANALYSIS on every variant: its recursive variant\nlocks conditionally, and its three build-time variants must present one\ninterface. ContextMutex's tryLockImpl(), lockImpl(), and unlockImpl(),\nwhich unlock and re-lock the stable-root mutex, and ErrorSet's\ngetLockIfNotAlready(), which transfers ownership into a returned\nstd::unique_lock, use it for the same reason. This mirrors\nWTF::RecursiveLockAdapter, which opts the same conditional-locking shapes\nout of the analysis. gtest has no such code and is unaffected. dav1d\nkeeps its own copy because it does not include CommonBase.xcconfig.\n\nNo new tests since no change in behavior.\n\n* Configurations/CommonBase.xcconfig:\n* Source/JavaScriptCore/Configurations/Base.xcconfig:\n* Source/ThirdParty/ANGLE/src/common/SimpleMutex.h:\n* Source/ThirdParty/ANGLE/src/common/angleutils.h:\n* Source/ThirdParty/ANGLE/src/libANGLE/Context.cpp:\n* Source/ThirdParty/ANGLE/src/libANGLE/ContextMutex.cpp:\n* Source/ThirdParty/ANGLE/src/libANGLE/GlobalMutex.cpp:\n* Source/ThirdParty/gmock/Configurations/Base.xcconfig:\n* Source/ThirdParty/libwebrtc/Configurations/Base.xcconfig:\n* Source/WTF/Configurations/Base.xcconfig:\n* Source/WebCore/Configurations/Base.xcconfig:\n* Source/WebCore/PAL/Configurations/Base.xcconfig:\n* Source/WebGPU/Configurations/Base.xcconfig:\n* Source/WebInspectorUI/Configurations/Base.xcconfig:\n* Source/WebKit/Configurations/Base.xcconfig:\n* Source/WebKitLegacy/mac/Configurations/Base.xcconfig:\n* Source/bmalloc/Configurations/Base.xcconfig:\n\nCanonical link: https://commits.webkit.org/320220@main",
      "email": "ddkilzer@apple.com",
      "hash": "d4fbad5cfc5da35ff3d3f86834eb4f8089984585",
      "subject": "[Cocoa] Apply -Wthread-safety to all Xcode targets via CommonBase.xcconfig"
    },
    "320221@main": {
      "author": "Cameron McCormack",
      "avatar": "https://www.gravatar.com/avatar/b2bb1b369be938a743e50f595bfa0798?d=identicon\u0026s=64",
      "cl": "320221@main",
      "clUrl": "https://commits.webkit.org/320221@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=177388\n\nReviewed by Devin Rousso.\n\nUse the same canvas for programs rather than a unique canvas per program, since\nthat is what the subtests listen for.\n\nEnsure the page-created program is removed deterministically before subsequent\ntests run, otherwise its removal is subject to GC and its removal event can\narrive at unpredictable times, interfering with later tests.\n\n* LayoutTests/inspector/canvas/resources/shaderProgram-utilities-webgl.js:\n(createProgram):\n* LayoutTests/platform/mac-wk2/TestExpectations:\n* LayoutTests/platform/mac/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320221@main",
      "email": "heycam@apple.com",
      "hash": "2f14b2f3d23ace440683481462c0750e29f6aa6e",
      "subject": "Web Inspector: make the shaderProgram test helper reuse its canvas across createProgram() calls"
    },
    "320222@main": {
      "author": "André A. Gomes",
      "avatar": "https://www.gravatar.com/avatar/f773eb55ff7fb7f74400f6fdc9301048?d=identicon\u0026s=64",
      "cl": "320222@main",
      "clUrl": "https://commits.webkit.org/320222@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322997\n\nReviewed by Patrick Griffis.\n\n* Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp:\n* Source/WebKit/UIProcess/API/glib/WebKitWebView.h.in:\n\nCanonical link: https://commits.webkit.org/320222@main",
      "email": "andremegafone@gmail.com",
      "hash": "1e92f67ec44bca664dba2e3740817b7119bf9e2d",
      "subject": "[GTK] Fix documentation of webkit_web_view_call_async_javascript_function"
    },
    "320223@main": {
      "author": "Antoine Quint",
      "avatar": "https://www.gravatar.com/avatar/9b3ef1e754f8d994f21ff67c660cbbe6?d=identicon\u0026s=64",
      "cl": "320223@main",
      "clUrl": "https://commits.webkit.org/320223@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322996\nrdar://186265325\n\nReviewed by Anne van Kesteren.\n\nPrioritize attachment to a style-originated timeline established by an ancestor over others visible\nthanks to `timeline-scope` per https://drafts.csswg.org/scroll-animations-1/#timeline-scope.\n\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/timeline-scope-expected.txt:\n* Source/WebCore/animation/StyleOriginatedTimelinesController.cpp:\n(WebCore::StyleOriginatedTimelinesController::determineTreeOrder):\n\nCanonical link: https://commits.webkit.org/320223@main",
      "email": "graouts@webkit.org",
      "hash": "ccdc614afeb0843862688d6af4da4ca22982ed25",
      "subject": "[scroll-animations] prioritize timelines established by an ancestor over others visible thanks to `timeline-scope`"
    },
    "320224@main": {
      "author": "Cameron McCormack",
      "avatar": "https://www.gravatar.com/avatar/b2bb1b369be938a743e50f595bfa0798?d=identicon\u0026s=64",
      "cl": "320224@main",
      "clUrl": "https://commits.webkit.org/320224@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323074\nrdar://problem/186332321\n\nUnreviewed gardening.\n\nCanonical link: https://commits.webkit.org/320224@main",
      "email": "heycam@apple.com",
      "hash": "2ebfc654e3f3bd43496985a190e94458f2271eae",
      "subject": "html/canvas/offscreen/manual/the-offscreen-canvas/offscreencanvas.resize.html WPT fails on glib"
    },
    "320225@main": {
      "author": "Suraj Thanugundla",
      "avatar": "https://www.gravatar.com/avatar/5f5ab8a9e6d06403d932003de0835ada?d=identicon\u0026s=64",
      "cl": "320225@main",
      "clUrl": "https://commits.webkit.org/320225@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322855\n\nReviewed by Tim Nguyen.\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/7e755825e0b5c6f631cb862afd5fc451e6825441\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/attr-all-types-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/attr-all-types.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/attr-number-invalidation-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/attr-number-invalidation.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/attr-percent-invalidation-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/attr-percent-invalidation.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-item-computed-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-item-computed.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/w3c-import.log:\n\nCanonical link: https://commits.webkit.org/320225@main",
      "email": "contact@surajt.com",
      "hash": "27cec08a2200c73ad34f05596a4745afb4b23ba9",
      "subject": "Re-import css/css-values WPT"
    },
    "320226@main": {
      "author": "Karl Dubost",
      "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64",
      "cl": "320226@main",
      "clUrl": "https://commits.webkit.org/320226@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=303073\nrdar://165378154\n\nReviewed by Said Abou-Hallawa.\n\nRemoving an SVG number attribute, or setting it to something that is not a\nnumber, left the DOM property reporting 0 or the previous value instead of the\nvalue the attribute starts life with.\n\n    let e = document.createElementNS(svgNS, 'feFuncA');\n    e.setAttribute('slope', '42');    // baseVal is 42\n    e.removeAttribute('slope');       // baseVal is 0, expected 1\n\nString::toFloat() cannot report failure, so most attributes landed on 0. The five\n\u003cnumber-optional-number\u003e attributes wrote only when parsing succeeded, so a bad\nvalue wrote nothing and the old value stayed. SVG 2 says an attribute that fails\nto parse is assumed to have been specified as its initial value.\nhttps://w3c.github.io/svgwg/svg2-draft/types.html#syntax\n\nFix by letting the property notice the failure instead of the caller.\nsetBaseValInternal() now takes an optional, and when it is empty the property asks\nits owner's registry to put the initial value back. The initial value is stored on\nthe accessor, which exists once per attribute rather than once per element, so no\nelement grows by a byte. The registry finds the right accessor by identity, using\nthe same matches() call animatedPropertyAttributeName() already uses, so a caller\ndoes not have to name itself. Parsing an attribute is now one line:\n\n    m_dx-\u003esetBaseValInternal(parseNumber(newValue));\n\nThe five \u003cnumber-optional-number\u003e attributes keep an explicit if/else, because one\ncontent attribute drives two properties and each half needs its own parsed value,\nso there is nothing for a single call to return. Their failure branch resets both\nhalves rather than one: a pair accessor matches either half and would restore both\nfrom a single call, but saying it once per property keeps each line true on its own\nand survives the pair being split into two accessors later. The cost is one\nredundant reset on a path that only runs when parsing failed.\n\nparseNumber() also skips whitespace around the value now, as SVG 2 requires and\nboth other engines do. Without it slope=\" 5 \" would have regressed.\n\nTests: imported/w3c/web-platform-tests/svg/types/scripted/SVGAnimatedNumber-invalid-values.html\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGAnimatedNumber-initial-values-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGAnimatedNumber-invalid-values-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGAnimatedNumber-invalid-values.html: Added.\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/svg/SVGComponentTransferFunctionElement.cpp:\n(WebCore::SVGComponentTransferFunctionElement::SVGComponentTransferFunctionElement):\n(WebCore::SVGComponentTransferFunctionElement::attributeChanged):\n* Source/WebCore/svg/SVGComponentTransferFunctionElement.h:\n* Source/WebCore/svg/SVGFECompositeElement.cpp:\n(WebCore::SVGFECompositeElement::attributeChanged):\n* Source/WebCore/svg/SVGFEConvolveMatrixElement.cpp:\n(WebCore::SVGFEConvolveMatrixElement::attributeChanged):\n* Source/WebCore/svg/SVGFEDiffuseLightingElement.cpp:\n(WebCore::SVGFEDiffuseLightingElement::SVGFEDiffuseLightingElement):\n(WebCore::SVGFEDiffuseLightingElement::attributeChanged):\n* Source/WebCore/svg/SVGFEDiffuseLightingElement.h:\n* Source/WebCore/svg/SVGFEDisplacementMapElement.cpp:\n(WebCore::SVGFEDisplacementMapElement::attributeChanged):\n* Source/WebCore/svg/SVGFEDropShadowElement.cpp:\n(WebCore::SVGFEDropShadowElement::SVGFEDropShadowElement):\n(WebCore::SVGFEDropShadowElement::attributeChanged):\n* Source/WebCore/svg/SVGFEDropShadowElement.h:\n* Source/WebCore/svg/SVGFEGaussianBlurElement.cpp:\n(WebCore::SVGFEGaussianBlurElement::attributeChanged):\n* Source/WebCore/svg/SVGFELightElement.cpp:\n(WebCore::SVGFELightElement::SVGFELightElement):\n(WebCore::SVGFELightElement::attributeChanged):\n* Source/WebCore/svg/SVGFELightElement.h:\n* Source/WebCore/svg/SVGFEMorphologyElement.cpp:\n(WebCore::SVGFEMorphologyElement::attributeChanged):\n* Source/WebCore/svg/SVGFEOffsetElement.cpp:\n(WebCore::SVGFEOffsetElement::attributeChanged):\n* Source/WebCore/svg/SVGFESpecularLightingElement.cpp:\n(WebCore::SVGFESpecularLightingElement::SVGFESpecularLightingElement):\n(WebCore::SVGFESpecularLightingElement::attributeChanged):\n* Source/WebCore/svg/SVGFESpecularLightingElement.h:\n* Source/WebCore/svg/SVGFETurbulenceElement.cpp:\n(WebCore::SVGFETurbulenceElement::SVGFETurbulenceElement):\n(WebCore::SVGFETurbulenceElement::attributeChanged):\n* Source/WebCore/svg/SVGGeometryElement.cpp:\n(WebCore::SVGGeometryElement::attributeChanged):\n* Source/WebCore/svg/SVGParserUtilities.cpp:\n(WebCore::parseNumber):\n(WebCore::parseNumberOptionalNumber):\n* Source/WebCore/svg/SVGStopElement.cpp:\n(WebCore::SVGStopElement::attributeChanged):\n* Source/WebCore/svg/properties/SVGAnimatedPrimitiveProperty.h:\n(WebCore::SVGAnimatedPrimitiveProperty::setBaseValInternal):\n* Source/WebCore/svg/properties/SVGAnimatedPrimitivePropertyAccessor.h: Added.\n(WebCore::SVGAnimatedPrimitivePropertyAccessor::SVGAnimatedPrimitivePropertyAccessor):\n(WebCore::SVGAnimatedPrimitivePropertyAccessor::resetBaseVal):\n(WebCore::SVGAnimatedPrimitivePropertyAccessor::singleton):\n* Source/WebCore/svg/properties/SVGAnimatedPropertyAccessorImpl.h:\n* Source/WebCore/svg/properties/SVGAnimatedPropertyBase.cpp:\n(WebCore::SVGAnimatedPropertyBase::resetBaseValToInitialValue):\n  Out of line for the same reason commitPropertyChange() is: SVGElement is\n  incomplete in the header.\n* Source/WebCore/svg/properties/SVGAnimatedPropertyBase.h:\n* Source/WebCore/svg/properties/SVGAnimatedPropertyPairAccessor.h:\n(WebCore::SVGAnimatedPropertyPairAccessor::SVGAnimatedPropertyPairAccessor):\n(WebCore::SVGAnimatedPropertyPairAccessor::singleton):\n(WebCore::SVGAnimatedPropertyPairAccessor::resetBaseVal):\n* Source/WebCore/svg/properties/SVGAnimatedPropertyPairAccessorImpl.h:\n* Source/WebCore/svg/properties/SVGMemberAccessor.h:\n(WebCore::SVGMemberAccessor::resetBaseVal):\n  Asserting rather than doing nothing, so that asking to reset an attribute family\n  that has no initial value yet does not fail the same way the bug being fixed does.\n* Source/WebCore/svg/properties/SVGPropertyOwnerRegistry.h:\n(WebCore::SVGPropertyOwnerRegistry::registerProperty):\n(WebCore::SVGPropertyOwnerRegistry::resetAnimatedPropertyBaseVal):\n* Source/WebCore/svg/properties/SVGPropertyRegistry.h:\n\nCanonical link: https://commits.webkit.org/320226@main",
      "email": "karlcow@apple.com",
      "hash": "201fa368edc55f7bbb649ec457fc491534e21353",
      "subject": "SVG number attributes should revert to their initial value when removed or invalid"
    },
    "320227@main": {
      "author": "Antoine Quint",
      "avatar": "https://www.gravatar.com/avatar/9b3ef1e754f8d994f21ff67c660cbbe6?d=identicon\u0026s=64",
      "cl": "320227@main",
      "clUrl": "https://commits.webkit.org/320227@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323071\nrdar://186330965\n\nReviewed by Anne van Kesteren.\n\nWhen dealing with an animation target with an ancestor that has a `timeline-scope` property set,\nwe would previously return a null timeline if we failed to find a timeline matching the provided\nname. However, now that style-originated timelines match globally and not just within the ancestor\nchain [0], we should treat such cases as yielding an inactive (or deferred as it's sometimes called)\ntimeline.\n\nThis fixes the failures in the WPT test `scroll-animations/css/timeline-scope-all.html` introduced\nby the WPT changes in https://github.com/web-platform-tests/wpt/pull/61776.\n\n[0] https://github.com/w3c/csswg-drafts/pull/13624\n\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/timeline-scope-all-expected.txt:\n* Source/WebCore/animation/StyleOriginatedTimelinesController.cpp:\n(WebCore::StyleOriginatedTimelinesController::determineTreeOrder):\n\nCanonical link: https://commits.webkit.org/320227@main",
      "email": "graouts@webkit.org",
      "hash": "8c1a483a7d847d462954a51fd3cf92168f1da673",
      "subject": "[scroll-animations] style-originated timelines defined outside of `timeline-scope` hierarchy should yield an inactive timeline"
    },
    "320228@main": {
      "author": "Antti Koivisto",
      "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64",
      "cl": "320228@main",
      "clUrl": "https://commits.webkit.org/320228@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321426\nrdar://184495338\n\nReviewed by Sam Weinig.\n\nNormally currentcolor in `color` property resolves against the inherited parent style and can be fully resolved\nduring style building. However highlight pseudo-elements have special behavior where the inheritance\nchain goes via the parent element's highlight style but currentcolor is resolved against the\noriginating element. To do this correctly we need to keep around unresolved (StyleColor) version of\nthe color property value we normally don't need. This field can also later be used to resolve currentcolor\nagainst the lower highlight layer at paint time.\n\nhttps://drafts.csswg.org/css-pseudo-4/#highlight-cascade\n\nTo avoid complicating the regular paths this patch adds colorForHighlight as a separate rare data field.\n\nTest: imported/w3c/web-platform-tests/css/css-pseudo/highlight-cascade/highlight-cascade-currentcolor-color-mix.html\n* LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo/highlight-cascade/highlight-cascade-currentcolor-color-mix-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-pseudo/highlight-cascade/highlight-cascade-currentcolor-color-mix.html: Added.\n* Source/WebCore/style/StyleBuilderCustom.h:\n(WebCore::Style::BuilderCustom::applyHighlightInitialColor):\n(WebCore::Style::BuilderCustom::applyHighlightValueColor):\nKeep the unresolved value alongside the resolved one.\n\n(WebCore::Style::BuilderCustom::applyHighlightInheritColor):\nResolve the inherited value against the originating element and pass it on unresolved. Previously\nthis took the parent highlight color wholesale unless the bit said it was the bare keyword.\n\n* Source/WebCore/style/computed/StyleComputedStyleBase+GettersInlines.h:\n(WebCore::Style::ComputedStyleBase::colorForHighlight const):\n(WebCore::Style::ComputedStyleBase::colorIsCurrentColorForHighlight const): Deleted.\n* Source/WebCore/style/computed/StyleComputedStyleBase+SettersInlines.h:\n(WebCore::Style::ComputedStyleBase::setColorForHighlight):\n(WebCore::Style::ComputedStyleBase::setColorIsCurrentColorForHighlight): Deleted.\n* Source/WebCore/style/computed/StyleComputedStyleBase.h:\n* Source/WebCore/style/computed/data/StyleInheritedData.cpp:\n(WebCore::Style::InheritedData::InheritedData):\n(WebCore::Style::InheritedData::dumpDifferences const):\n\n(WebCore::Style::InheritedData::fastPathInheritedEqual const):\n(WebCore::Style::InheritedData::fastPathInheritFrom):\nThe bit needed handling here because it sat next to the fast-path-inherited color. Rare data is\nnot part of the fast path, so the replacement field needs none.\n\n* Source/WebCore/style/computed/data/StyleInheritedData.h:\n* Source/WebCore/style/computed/data/StyleInheritedRareData.cpp:\n(WebCore::Style::InheritedRareData::InheritedRareData):\n(WebCore::Style::InheritedRareData::operator== const):\n(WebCore::Style::InheritedRareData::dumpDifferences const):\n* Source/WebCore/style/computed/data/StyleInheritedRareData.h:\n\nCanonical link: https://commits.webkit.org/320228@main",
      "email": "antti@apple.com",
      "hash": "73a19c0d770b4597e51c8aad5a57efab8bf9eea1",
      "subject": "Highlight color should inherit as StyleColor"
    },
    "320229@main": {
      "author": "Carlos Alberto Lopez Perez",
      "avatar": "https://www.gravatar.com/avatar/05326c1dbe06f486e884975e73f25179?d=identicon\u0026s=64",
      "cl": "320229@main",
      "clUrl": "https://commits.webkit.org/320229@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322204\n\nReviewed by Nikolas Zimmermann.\n\nThe WebKit CMake build uses a generated Swift stub to make Ninja run\nswiftc when an imported C++ header changes. However, swiftc's incremental\nbuild information does not track the headers listed in the module map,\nand the module map itself does not change when the contents of one of\nthose headers change, so swiftc cannot connect the header change to the\nSwift sources that use its declarations. It can therefore skip those\nsources and leave their old object files in place. Those objects may\ncontain member offsets from the previous C++ headers and are then linked\nwith newly compiled C++ objects that use the new layout, producing an\nABI-mismatched library.\n\nThis can lead to crashes or other issues. This has been observed on the\nGTK and WPE bots (see the linked bug report for more details).\n\nFix this by using whole-module compilation for targets using Swift/C++\ninteroperability. This ensures that every Swift source is rebuilt against\nthe current C++ headers when the existing stub is updated.\n\n* Source/cmake/WebKitMacros.cmake:\n\nCanonical link: https://commits.webkit.org/320229@main",
      "email": "clopez@igalia.com",
      "hash": "4be1e09903a06e796d01b5b9fb0096deee3f322d",
      "subject": "[CMake][Swift] Incremental builds can retain stale Swift objects after imported C++ headers change"
    },
    "320230@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "320230@main",
      "clUrl": "https://commits.webkit.org/320230@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322968\n\nReviewed by Simon Fraser.\n\nimported/w3c/web-platform-tests/dom/events/scrolling/save-iframe-scroll-offset-when-display-none.html\nintermittently hit an assertion in the UI process under site isolation.\n\nimported/w3c/web-platform-tests/dom/events/scrolling/save-iframe-scroll-offset-when-display-none.html\nintermittently hit an assertion in the UI process under site isolation.\n\nThe iframe's ScrollingTreeFrameScrollingNodeMac had a default-constructed\nm_scrolledContentsLayer, i.e. its layer had never been set.\n\nSetting the iframe to display:none destroys the parent's RenderIFrame, so the\nparent's ScrollingStateFrameHostingNode goes away. On the next commit the UI\nprocess sees that node as unvisited and destroys it, and willBeDestroyed()\ncalls removeHostedChildren(). Since updateTreeFromStateNodeRecursive() leaves\ncommitState.frameHostingNode set for the whole hosted recursion, every node of\nthe hosted subtree is registered as a hosted child, so that removes the\niframe's entire subtree from m_nodeMap.\n\nNothing tells the iframe's process about this; its ScrollingStateTree is\nuntouched. When the iframe is shown again and that process commits,\nScrollingStateTree::commit() clones the full node structure but the transaction\nonly encodes properties flagged as changed (the OptionalTupleBit entries in\nRemoteScrollingCoordinatorTransaction.serialization.in).\nupdateTreeFromStateNodeRecursive() misses in m_nodeMap and creates fresh nodes,\nand commitStateBeforeChildren() only assigns members whose properties changed,\nso the layers stay unset and applyLayerPositions() dereferences one.\n\nWhether this reproduces depends on whether the hosted process happens to\nrebuild its scrolling state root - which marks every property changed - in the\nsame commit that reattaches the subtree, hence the intermittency.\n\nFix this by making the two sides resync rather than by changing what the UI\nprocess keeps. removeHostedChildren() is the one place where the UI process\ndiscards state that the hosted process still believes in, reached from\nwillBeDestroyed(), from setLayerHostingContextIdentifier() on a context change,\nand from the empty-commit path in commitTreeStateInternal(). It now notifies\nthrough a new ScrollingTree::hostedSubtreeNeedsFullCommit(FrameIdentifier).\nRemoteScrollingTree forwards that to RemoteScrollingCoordinatorProxy, which\nreuses the existing WebPageProxy::sendToProcessContainingFrame(), so no new\nhosting-context-to-process map is needed. In the hosted process,\nRemoteScrollingCoordinator::requestFullScrollingTreeCommit() calls\nAsyncScrollingCoordinator::setAllScrollingStatePropertiesChangedForRootFrameID(),\nwhich marks every applicable property of every node in that frame's state tree\nas changed and schedules a commit. The next transaction is then self-contained,\nso the recreated nodes get their layers.\n\nRemoval semantics are deliberately unchanged, so removeFromActiveNodes() still\nruns for every removed node and 319425@main's fix for stale active nodes in\nestablishLayerTreeScrollingRelations() still holds. An earlier attempt that\ndetached the subtree instead of removing it regressed\nhttp/tests/site-isolation/scrolling/remove-iframe-with-active-scroll-proxy.html\nfor exactly that reason, and would also have kept the iframe's CALayers alive\nfor the life of the page.\n\nNotes on the details:\n\n- The message carries a FrameIdentifier because AsyncScrollingCoordinator keeps\n  one ScrollingStateTree per root frame in m_scrollingStateTrees and a process\n  can host several (see http/tests/site-isolation/scrolling/multiple-root-frames.html).\n  Addressing only the process would be ambiguous.\n\n- The frame identifier is read from any hosted child, since they all come from\n  the same hosted commit and therefore share commitState.frameId. It is captured\n  before the removal loop because removeNode() drops the entries.\n\n- Nested cross-process iframes fall out naturally: removing frame A's subtree\n  destroys the nested FrameHosting node for B, whose own removeHostedChildren()\n  notifies B.\n\n- setAllPropertiesChanged() also walks m_unparentedNodes, since insertNode()\n  only marks the nodes it actually reparents.\n\n- The dirty-bit walk this reuses was named after its only caller, so it is\n  renamed for its second one: nodeWasReattachedRecursive() becomes\n  setAllPropertiesChangedRecursive(), and the node-level\n  setPropertyChangesAfterReattach() becomes setAllApplicablePropertiesChanged(),\n  which is what it does. The \"the ScrollingTree recreates the node from scratch\"\n  comment moves to the reattach call site in insertNode(), since it explains\n  that caller rather than the walk itself.\n\nOne ordering gap remains: if the hosted process already had an incremental\ncommit in flight when the request was sent, that stale commit lands first and\nbriefly recreates layer-less nodes. Closing that requires a \"this is a full\ncommit\" bit on RemoteScrollingCoordinatorTransaction so the UI process can skip\nhosted commits until the full one arrives, which is left for a follow-up.\n\nTest: imported/w3c/web-platform-tests/dom/events/scrolling/save-iframe-scroll-offset-when-display-none.html\n\n* Source/WebCore/page/scrolling/AsyncScrollingCoordinator.cpp:\n(WebCore::AsyncScrollingCoordinator::setAllScrollingStatePropertiesChangedForRootFrameID):\n* Source/WebCore/page/scrolling/AsyncScrollingCoordinator.h:\n* Source/WebCore/page/scrolling/ScrollingStateNode.cpp:\n(WebCore::ScrollingStateNode::setAllApplicablePropertiesChanged):\n(WebCore::ScrollingStateNode::setPropertyChangesAfterReattach): Deleted.\n* Source/WebCore/page/scrolling/ScrollingStateNode.h:\n* Source/WebCore/page/scrolling/ScrollingStateTree.cpp:\n(WebCore::setAllPropertiesChangedRecursive):\n(WebCore::ScrollingStateTree::insertNode):\n(WebCore::ScrollingStateTree::setAllPropertiesChanged):\n(WebCore::nodeWasReattachedRecursive): Deleted.\n* Source/WebCore/page/scrolling/ScrollingStateTree.h:\n* Source/WebCore/page/scrolling/ScrollingTree.h:\n(WebCore::ScrollingTree::hostedSubtreeNeedsFullCommit):\n* Source/WebCore/page/scrolling/ScrollingTreeFrameHostingNode.cpp:\n(WebCore::ScrollingTreeFrameHostingNode::removeHostedChildren):\n* Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.cpp:\n(WebKit::RemoteScrollingCoordinatorProxy::requestFullScrollingTreeCommitForFrame):\n* Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.h:\n* Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingTree.cpp:\n(WebKit::RemoteScrollingTree::hostedSubtreeNeedsFullCommit):\n* Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingTree.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n* Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteScrollingCoordinator.h:\n* Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteScrollingCoordinator.messages.in:\n* Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteScrollingCoordinator.mm:\n(WebKit::RemoteScrollingCoordinator::requestFullScrollingTreeCommit):\n\nCanonical link: https://commits.webkit.org/320230@main",
      "email": "rniwa@webkit.org",
      "hash": "3d130b4a9d6acef3b925d9ec46abfb4352ecf7ff",
      "subject": "[Site Isolation] imported/w3c/web-platform-tests/dom/events/scrolling/save-iframe-scroll-offset-when-display-none.html fails"
    },
    "320231@main": {
      "author": "Antoine Quint",
      "avatar": "https://www.gravatar.com/avatar/9b3ef1e754f8d994f21ff67c660cbbe6?d=identicon\u0026s=64",
      "cl": "320231@main",
      "clUrl": "https://commits.webkit.org/320231@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323073\nrdar://186331685\n\nReviewed by Anne van Kesteren.\n\nBecause style-originated timeline would only match within an animation's target ancestor chain,\nor in the subtree of an element with a `timeline-scope` property, we would only consider the hierarchy\nof the element that had its `timeline-scope` change. Now that style-originated timelines match\nglobally [0] we must update any animation for a name contained in the `timeline-scope` property\nthat changed.\n\nThis fixes the final failure in the WPT test `scroll-animations/css/timeline-scope.html` introduced\nby the WPT changes in https://github.com/web-platform-tests/wpt/pull/61776.\n\n[0] https://github.com/w3c/csswg-drafts/pull/13624\n\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/timeline-scope-expected.txt:\n* Source/WebCore/animation/StyleOriginatedTimelinesController.cpp:\n(WebCore::StyleOriginatedTimelinesController::updateTimelinesForTimelineScope):\n(WebCore::StyleOriginatedTimelinesController::updateNamedTimelineMapForTimelineScope):\n(WebCore::updateTimelinesForTimelineScope): Deleted.\n* Source/WebCore/animation/StyleOriginatedTimelinesController.h:\n\nCanonical link: https://commits.webkit.org/320231@main",
      "email": "graouts@webkit.org",
      "hash": "7e80c02cd2997f2a81f9efa62913cf47e78e07ad",
      "subject": "[scroll-animations] changed `timeline-scope` values should update timelines for animations globally"
    },
    "320232@main": {
      "author": "Cameron McCormack",
      "avatar": "https://www.gravatar.com/avatar/b2bb1b369be938a743e50f595bfa0798?d=identicon\u0026s=64",
      "cl": "320232@main",
      "clUrl": "https://commits.webkit.org/320232@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323066\nrdar://problem/186329387\n\nReviewed by Dan Glastonbury.\n\nIt's passing consistently on Macs in CI.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/platform/win/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320232@main",
      "email": "heycam@apple.com",
      "hash": "ac56e6d6ca57bcd3368ce0b8e98c2f58cf23f476",
      "subject": "Re-enable webgl/1.0.x/conformance/textures/misc/tex-video-using-tex-unit-non-zero.html"
    },
    "320233@main": {
      "author": "Carlos Garcia Campos",
      "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64",
      "cl": "320233@main",
      "clUrl": "https://commits.webkit.org/320233@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322986\n\nReviewed by Nikolas Zimmermann.\n\nWe are currently assuming that texture is always premultiplied. Use\nkUnpremul_SkAlphaType when TextureMapperFlags::ShouldPremultiply is\npresent.\n\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferRGB.cpp:\n(WebCore::CoordinatedPlatformLayerBufferRGB::skiaImage):\n* LayoutTests/media/content/video-with-alpha-red.webm: Added.\n* LayoutTests/media/video-with-alpha-premultiplied-expected.html: Added.\n* LayoutTests/media/video-with-alpha-premultiplied.html: Added.\n* LayoutTests/TestExpectations:\n* LayoutTests/platform/glib/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320233@main",
      "email": "cgarcia@igalia.com",
      "hash": "60cae7a061f93b37e4db9de1c14c0f07397c1e77",
      "subject": "[GTK][WPE] Skia compositor: CoordinatedPlatformLayerBufferRGB should handle TextureMapperFlags::ShouldPremultiply"
    },
    "320234@main": {
      "author": "Adrian Taylor",
      "avatar": "https://www.gravatar.com/avatar/d2acb8ad2e2670ff74ae0d65fb27014c?d=identicon\u0026s=64",
      "cl": "320234@main",
      "clUrl": "https://commits.webkit.org/320234@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322837\nrdar://186078499\n\nReviewed by Zak Ridouh.\n\nA privileged process cannot trust a web origin, site, registrable domain or URL\nthat a web content process supplied over IPC. Today that is enforced by\nhand-written MESSAGE_CHECKs, which are only present on the code paths somebody\nguarded. This adds the type that will let the compiler enforce it instead.\n\nThis is PR one of a fairly long series that will enforce this invariant.\nBeing raised in series for ease of review.\n\nIPC::Untrusted\u003cT\u003e holds a T and exposes no accessor. The only ways to reach the\nvalue are validate(), which runs a pre-declared validation procedure,\nunsafeExtractWithoutValidation(), which must name an UnvalidatedReason, and its\nArgumentCoder, which forwards it. No procedures exist yet; this is just the\nprimitive.\n\nDesign points that are not obvious from the code:\n\n- Failure is (wrapped) expected\u003cT, ValidationFailure\u003e rather than\n  std::optional\u003cT\u003e because the existing checks are three-way, not two-way.\n  WebProcessProxy::allowsFirstPartyAccess already distinguishes an expected\n  race (ignore the message) from an impossible claim (terminate the connection).\n  Using a bool would either terminate processes during normal navigation races\n  or silently drop real attacks. valueMayBeLegitimate() is what stops the\n  distinction being collapsed again at the point of use: a receiver asserts it\n  rather than the validation result, so an Ignore drops the message while only a\n  Terminate marks the message invalid and takes the sender down.\n\n- A validator opts in by specializing IsValidationProcedureFor, once per type.\n  A concept alone would let any type with a validateUntrusted() member serve as\n  a validator, which would make \"the set of ways to recover a trusted value\"\n  unbounded. The trait makes that set explicit and enumerable; a later commit\n  confines the specializations to a small list of headers.\n\n- UnvalidatedReason is deliberately an enum rather than a free-text comment, so\n  the residual risk carried by the tree can be counted with grep rather than\n  estimated.\n\n- An authority states its procedure as a check on one value -\n  checkUntrusted(const T\u0026) returning an optional failure - and CanValidateUntrusted\n  derives the rest: the value-returning validateUntrusted, and the lift over\n  optionals and iterables. A check rather than a transform means nothing has\n  to be copied to be checked, so an authority can be applied to a non-copyable\n  WebCore::SecurityOrigin and to a value it does not own.\n\n  Dispatch goes through checkAnyUntrusted rather than naming the lifts\n  checkUntrusted, so the mixin's own overloads are never hidden by the derived\n  class's and the lookup order is explicit: the authority's own procedure first,\n  then the container lifts. A derived authority never declares validateUntrusted,\n  so it never needs a using-declaration to republish the base's overloads.\n\n- The wrapper has no default constructor. Swift/C++ interop instantiates the\n  class template when a WebKit header reaches the Swift importer, and a default\n  member initializer would then require T to be default-constructible, which\n  WebCore::Site is not.\n\nAlternative considered: attaching the untrustedness to the value types\nthemselves (a WebCore::UntrustedSecurityOriginData, say). That was rejected\nbecause it would spread across WebCore, and because the same origin type is\ntrusted or not depending only on which side of the IPC boundary it came from,\nwhich is a property of the transport rather than of the value.\n\n* Source/WebKit/Platform/IPC/JSIPCBinding.h:\n(IPC::jsValueForDecodedArgumentValue):\n* Source/WebKit/Platform/IPC/Untrusted.h: Added.\n(IPC::Validated::hasValue const):\n(IPC::Validated::operator bool const):\n(IPC::Validated::error const):\n(IPC::Validated::operator*):\n(IPC::Validated::operator* const):\n(IPC::Validated::Validated):\n(IPC::valueMayBeLegitimate):\n(IPC::requires):\n(IPC::Untrusted::Untrusted):\n(IPC::Untrusted::validate):\n(IPC::Untrusted::unsafeExtractWithoutValidation):\n(IPC::ArgumentCoder\u003cUntrusted\u003cT\u003e\u003e::encode):\n(IPC::ArgumentCoder\u003cUntrusted\u003cT\u003e\u003e::decode):\n(IPC::CanValidateUntrusted::validateUntrusted const):\n(IPC::CanValidateUntrusted::checkAnyUntrusted const):\n(IPC::Validated::operator-\u003e):\n(IPC::Validated::operator-\u003e const):\n\nCanonical link: https://commits.webkit.org/320234@main",
      "email": "adrian_taylor@apple.com",
      "hash": "bafcdb281b02e381096bf71aa9345a8d7082c8da",
      "subject": "[IPC] Add IPC::Untrusted\u003cT\u003e, a wrapper for values a privileged process must not trust"
    },
    "320235@main": {
      "author": "Anne van Kesteren",
      "avatar": "https://www.gravatar.com/avatar/09bb44ac3625a121017cd98d0a7dc52c?d=identicon\u0026s=64",
      "cl": "320235@main",
      "clUrl": "https://commits.webkit.org/320235@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322988\n\nReviewed by Tim Nguyen.\n\nThis was standardized except for it also needing to impact\nElementInternals. That's now covered here:\n\n    https://github.com/whatwg/html/pull/12870\n\nTest: imported/w3c/web-platform-tests/custom-elements/form-associated/ElementInternals-setValidity-normalize-newlines.html\n\nweb-platform-tests changes: https://github.com/web-platform-tests/wpt/pull/62327\n\nCanonical link: https://commits.webkit.org/320235@main",
      "email": "annevk@annevk.nl",
      "hash": "7094241f824bee3109640a3907d7a6f2b67eab67",
      "subject": "Make FormListedElement::setCustomValidity simplify newlines"
    },
    "320236@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "320236@main",
      "clUrl": "https://commits.webkit.org/320236@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322708\n\nReviewed by Yusuke Suzuki.\n\ncanUseMegamorphicPutFastPath rejects a prototype chain if any Structure on\nit has hasReadOnlyOrGetterSetterPropertiesExcludingProto. That flag covers\nevery property of the object, so one getter on a class prototype keeps\nstores of every other name to its instances out of the megamorphic store\ncache. In JetStream3, `node.pos = ...` in TypeScript (Identifier.prototype\nhas `get text()`) and `node.lastEach = ...` in postcss (Rule.prototype has\n`get selectors()`) gave up after 8 structures this way, 1.1M calls of\noperationPutByIdStrictGaveUp between them.\n\nWhat [[Set]] actually depends on is whether the stored name meets a setter\nor a read-only property on the chain, and JSObject::putInline already\nresolves that: the slot it fills is cacheable only when the store landed\nas a plain data property on the receiver. So the megamorphic slow paths\nnow call putInline and record the entry when the slot is cacheable, and\nthe chain walk keeps only what the cache epoch cannot express:\noverridesPut, overridesGetPrototype and polyProto.\n\nThe hit path is unchanged. A miss now walks the chain twice, 3 ns to 6 ns\nmore on a 25 ns path.\n\nRunning JetStream3 locally with --useICStats=1, put_by_id gave-up calls go\nfrom 1.24M to 29K over the whole suite and put_by_val from 692K to 632K,\nand no benchmark reports more gave-ups than before, so no newly folded\nsite is thrashing the cache. Local scores did not show a difference, but\nthe gave-up path for an existing property is only about 12 ns, so the\nchange is expected to be within noise there either way.\n\nTest: JSTests/stress/megamorphic-store-unrelated-accessor.js\n\n* JSTests/stress/megamorphic-store-unrelated-accessor.js: Added.\n(shouldBe):\n(makeShape):\n(const.proto.get other):\n(put):\n(shouldBe.Object.getOwnPropertyDescriptor):\n(const.plain.get other):\n(const.withSetter.get other):\n(const.withSetter.set x):\n(const.withReadOnly.get other):\n(shouldBe.Object.getOwnPropertyDescriptor.get put):\n(set for):\n(shouldBe.const.proto.get other):\n(shouldBe.put):\n* Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp:\n(JSC::canUseMegamorphicPutFastPath): Deleted.\n* Source/JavaScriptCore/bytecode/InlineCacheCompiler.h:\n(JSC::canUseMegamorphicPutFastPath):\n* Source/JavaScriptCore/jit/JITOperations.cpp:\n(JSC::putMegamorphic):\n(JSC::putByIdMegamorphic):\n(JSC::putByValMegamorphic):\n\nCanonical link: https://commits.webkit.org/320236@main",
      "email": "sosuke@bun.sh",
      "hash": "3b6fd3f42e2bcfd7f2107b036ab41ea55f2a4d94",
      "subject": "[JSC] One accessor on a prototype disables the megamorphic store cache"
    },
    "320237@main": {
      "author": "Jean-Yves Avenard",
      "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64",
      "cl": "320237@main",
      "clUrl": "https://commits.webkit.org/320237@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322473\nrdar://185760184\n\nReviewed by Elliott Williams.\n\nThere were a few issues preventing to build Safari against WebKit built via cmake\nas well as problems preventing it to run. Related yet, separate issues.\n\nBuilding everything above WebKit against a cmake-built WebKit hit seventeen build\nfailures across macOS, iOS and the platforms the cmake build had never targeted at\nall, and left four differences from the Xcode build that only showed up at runtime.\n\nBuild failures:\n\n1) forward-headers-cmake.pl only rewrote `\u003cWebKitLegacy` into `\u003cWebKit`, so the\n    forwarded public header WebKit.framework/Headers/WebScriptObject.h still\n    imported `\u003cWebCore/WebKitAvailability.h\u003e` and still used bare WEBCORE_EXPORT.\n    WebKitAvailability.h is a WebCore private header, and WebCore_Private covers\n    those with a submodule that requires C++, so importing WebKit from any plain\n    Objective-C file failed to build the WebKit module.\n\n2) WebKitLegacy.framework/PrivateHeaders was empty on macOS, because only the\n    iOS branch staged those headers. Anything importing `\u003cWebKitLegacy/X.h\u003e`\n    failed to find it.\n\n3) WebKit.apinotes was not installed on macOS, so Swift saw un-renamed API:\n    WKContentMode did not appear as WKWebpagePreferences.ContentMode, and\n    WKErrorCode's NSErrorDomain pairing did not synthesize WKError.\n\n4) The WebPage Swift API was listed only in the iOS branch and macOS did not\n    pass -DENABLE_SWIFTUI, so those files compiled to nothing and the SDK's\n    _WebKit_SwiftUI interface failed with `cannot find type 'WebKit::WebPage'`.\n\n5) The Swift argument generator preprocessed wtf/Platform.h without an\n    -iframework for the SDK's PrivateFrameworks, so `__has_include` probes were\n    false and six HAVE_ macros the C++ compiles had never reached Swift.\n\n6) WKScrollGeometryAdapter's macOS `contentInsets: NSEdgeInsets` lacked the\n    @_expose(!Cxx) its iOS UIEdgeInsets branch carries, so NSEdgeInsets reached\n    the C++ interop section of WebKit-Swift-Generated.h, which the plain C++\n    translation units of the WebKit_SwiftInterop subtarget cannot name.\n\n7) JavaScriptCore's code generation scripts, Automation.json and its atoms were\n    never staged into the frameworks' PrivateHeaders, so Safari's WebDriver\n    derived sources had no rule to make WDProtocol.h.\n\n8) buildCMakeProjectOrExit() compared wrapperPrefixIfNeeded() and\n    jhbuildWrapperPrefix() with numeric ==, and both return lists. On Cocoa the\n    wrapper is \"xcrun\", which warned before evaluating false.\n\n9) build-webkit named the CMake tree cmake-mac whatever the platform, appending the\n    SDK to the configuration, so an iOS build resolved to a directory no CMake build\n    ever created. The tree is named after the platform now, matching the presets.\n\n10) WebKitLegacy's iOS-family section linked SecurityInterface, which only ships in\n    the macOS SDK. Its one user is a file the iOS build does not compile.\n\n11) The iOS family adds the SDK's framework directories as global link options, which\n    CMake emits ahead of a target's own, so _WebKit_SwiftUI bound to the SDK's WebKit\n    stub and failed on the @_spi(CrossImportOverlay) symbols. The build directory now\n    comes first.\n\n12) The swiftc -print-target-info probe named no target, so an iOS build took the\n    macOS Swift runtime directory and linked iOS binaries with -L and -rpath pointing\n    at it. The probe now passes -target.\n\n13) HTMLModelElement.cpp default-constructs AddEventListenerOptions, whose RefPtr\n    \u003cAbortSignal\u003e destructor needs the complete type that only a forward declaration\n    provided.\n\n14) wrapperPrefixIfNeeded() prefixed cmake with a bare xcrun, which exports SDKROOT\n    for the default macOS SDK, so tools taking their sysroot from the environment\n    built an iOS target against macOS headers. The prefix names the selected SDK.\n\n15) WebKitXcodeSDK.cmake classified three SDKs and stopped with a fatal error on the\n    rest, so tvOS, watchOS and visionOS could not be configured at all, though Xcode\n    lists all nine in SUPPORTED_PLATFORMS. Each SDK is a row of a table now, and the\n    platform booleans, triple spellings and deployment-target flag follow from it.\n\n16) The ios device presets did not use ninja-wrapper, which the mac and ios-sim\n    presets already had. Nothing it does is specific to a simulator.\n\n17) Every Apple preset repeated the generator, port, make program and ccache\n    environment, with only the SDK actually varying. Hidden cocoa and cocoa-embedded\n    presets carry what they share.\n\nRuntime failures:\n\n1) The macOS frameworks kept CMake's default @rpath install names, so binaries\n    linked against them recorded @rpath/WebKit.framework/Versions/A/WebKit rather\n    than the system path. dyld then loaded that WebKit next to the shared cache\n    copy instead of replacing it, and LinkPresentation kept its WKContentWorld\n    class reference pointing into a WebKit that was never loaded, aborting with\n    `no class for metaclass` when it sent +worldWithName:.\n\n2) _WebKit_SwiftUI was built only for the iOS family, so clients importing both\n    WebKit and SwiftUI resolved the SDK's overlay against a locally built WebKit.\n\n3) The overlay framework had no top-level Modules symlink, so the Swift importer\n    could not see its module and clients compiled against the SDK's interface\n    while linking the local binary.\n\n4) WKWebView+RefreshControl.swift, WKUserContentController.swift and\n    WKWebsiteDataStore+SwiftOverlay.swift are in WebKit.xcodeproj but were built\n    by no cmake target, so WKWebView lacked the _WKRefreshControlHosting\n    conformance and the module lacked their members.\n\nTo compile and run SwiftBrowser from the command line you can do:\n```\nxcodebuild -project Tools/SwiftBrowser/SwiftBrowser.xcodeproj -scheme SwiftBrowser -configuration Release \\\n  SYMROOT=$PWD/WebKitBuild/cmake-mac OBJROOT=$PWD/WebKitBuild/cmake-mac \\\n  \u0026\u0026 run-swiftbrowser --cmake --release\n```\n\n* CMakeLists.txt:\n* CMakePresets.json:\n* Source/JavaScriptCore/CMakeLists.txt:\n* Source/JavaScriptCore/PlatformCocoa.cmake:\n* Source/ThirdParty/ANGLE/CMakeLists.txt:\n* Source/WebCore/Modules/model-element/HTMLModelElement.cpp:\n* Source/WebCore/PlatformCocoa.cmake:\n* Source/WebGPU/WGSL/CMakeLists.txt:\n* Source/WebGPU/WebGPU/CMakeLists.txt:\n* Source/WebKit/Headers.cmake:\n* Source/WebKit/PlatformCocoa.cmake:\n* Source/WebKit/UIProcess/Cocoa/WKScrollGeometryAdapter.swift:\n* Source/WebKitLegacy/PlatformCocoa.cmake:\n* Source/WebKitLegacy/scripts/forward-headers-cmake.pl:\n* Source/cmake/OptionsCocoa.cmake:\n* Source/cmake/WebKitFS.cmake:\n* Source/cmake/WebKitMacros.cmake:\n(_webkit_generate_platform_swift_args): Preprocess Platform.h with the SDK's\nprivate framework search path so Swift sees the same HAVE_ macros as C++.\n* Source/cmake/WebKitXcodeSDK.cmake:\n* Tools/CMakeLists.txt:\n* Tools/Scripts/webkitdirs.pm:\n(buildCMakeProjectOrExit): Compare the wrapper prefixes as lists.\n* Tools/TestWebKitAPI/CMakeLists.txt:\n* Tools/TestWebKitAPI/PlatformCocoa.cmake:\n* Tools/WebKitTestRunner/CMakeLists.txt:\n* Tools/WebKitTestRunner/PlatformCocoa.cmake:\n\nCanonical link: https://commits.webkit.org/320237@main",
      "email": "jya@apple.com",
      "hash": "5a8380c642d16ec8cc8d08de37aea2d62747cebe",
      "subject": "Safari and Swift Browser can't be built against WebKit built with CMake"
    },
    "320238@main": {
      "author": "Antoine Quint",
      "avatar": "https://www.gravatar.com/avatar/9b3ef1e754f8d994f21ff67c660cbbe6?d=identicon\u0026s=64",
      "cl": "320238@main",
      "clUrl": "https://commits.webkit.org/320238@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322936\nrdar://186339093\n\nReviewed by Anne van Kesteren.\n\nEnsure we reset the pending start time when calling `WebAnimation::play()` since a previous call\nto `WebAnimation::pause()` would have recorded one that would be stale and yield an incorrect\nupdated start time when the pending play task is run.\n\n* LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/playing-an-animation-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/playing-an-animation.html:\n* Source/WebCore/animation/WebAnimation.cpp:\n(WebCore::WebAnimation::play):\n\nCanonical link: https://commits.webkit.org/320238@main",
      "email": "graouts@webkit.org",
      "hash": "1aa3db9eb328a98f42496707ecf28d4a850ebf7f",
      "subject": "REGRESSION(294049@main): paused and seeked animation finishes when resumed after a rate-adjusted animation"
    },
    "320239@main": {
      "author": "Jean-Yves Avenard",
      "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64",
      "cl": "320239@main",
      "clUrl": "https://commits.webkit.org/320239@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323103\nrdar://186356290\n\nUnreviewed build fixes.\n\nFew missing headers and ENABLE_WEBXR_LAYERS was not set.\n\n* Source/WebCore/PAL/pal/PlatformCocoa.cmake:\n* Source/WebCore/PlatformCocoa.cmake:\n* Source/WebKit/Headers.cmake:\n* Source/WebKit/PlatformCocoa.cmake:\n* Source/WebKit/UIProcess/API/ios/WKWebViewIOS.mm:\n* Source/cmake/OptionsCocoa.cmake:\n\nCanonical link: https://commits.webkit.org/320239@main",
      "email": "jya@apple.com",
      "hash": "e17d0d0c486c9cffe649137ab903723cedb6919b",
      "subject": "[cmake] visionOS failed to build"
    },
    "320240@main": {
      "author": "Kimmo Kinnunen",
      "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64",
      "cl": "320240@main",
      "clUrl": "https://commits.webkit.org/320240@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322831\nrdar://problem/186078129\n\nReviewed by Dan Glastonbury.\n\nRename a WebGL specific PixelBuffer to NativeImage constructor as\nNativeImage::create(). This will be used in non-WebGL code, canvas\nnoise injection for example.\n\n* Source/WebCore/platform/graphics/GraphicsContextGL.h:\n* Source/WebCore/platform/graphics/NativeImage.h:\n* Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.cpp:\n(WebCore::GraphicsContextGLANGLE::readPixelsForPaintResults):\n(WebCore::GraphicsContextGLANGLE::copyNativeImage):\n* Source/WebCore/platform/graphics/cairo/GraphicsContextGLCairo.cpp:\n(WebCore::GraphicsContextGL::createNativeImageFromPixelBuffer): Deleted.\n* Source/WebCore/platform/graphics/cairo/NativeImageCairo.cpp:\n(WebCore::NativeImage::create):\n* Source/WebCore/platform/graphics/cg/GraphicsContextGLCG.cpp:\n(WebCore::GraphicsContextGL::createNativeImageFromPixelBuffer): Deleted.\n* Source/WebCore/platform/graphics/cg/NativeImageCG.cpp:\n(WebCore::NativeImage::create):\n* Source/WebCore/platform/graphics/skia/GraphicsContextGLSkia.cpp:\n(WebCore::GraphicsContextGL::createNativeImageFromPixelBuffer): Deleted.\n* Source/WebCore/platform/graphics/skia/NativeImageSkia.cpp:\n(WebCore::NativeImage::createTransient):\n(WebCore::NativeImage::create):\n\nCanonical link: https://commits.webkit.org/320240@main",
      "email": "kkinnunen@apple.com",
      "hash": "d730f4ad0ffd6a162b7c28f83af53e71b18d1266",
      "subject": "NativeImage should be constructible from PixelBuffer"
    },
    "320241@main": {
      "author": "Aakash Jain",
      "avatar": "https://www.gravatar.com/avatar/e82e0cafeeac3a35b7e74206ebe4c536?d=identicon\u0026s=64",
      "cl": "320241@main",
      "clUrl": "https://commits.webkit.org/320241@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=201924\nrdar://problem/27768813\n\nReviewed by Ryan Haddad.\n\nConfigure Buildbot 4's OldBuildCanceller service on the EWS back-end master,\nscoped to pull-request source stamps. Pushing a new commit to a pull request now\ncancels the builds still running or queued for the commit it replaces, instead of\nletting them finish and report results for a commit nobody is looking at anymore.\n\nQueues started directly by a pull-request event are cancelled immediately. A\ntriggered tester queue is cancelled once the build queue feeding it requests its\nreplacement.\n\n* Tools/CISupport/ews-build/master.cfg:\n\nCanonical link: https://commits.webkit.org/320241@main",
      "email": "aakash_jain@apple.com",
      "hash": "d605b748cde6fdbc4ce5e39f690df9a6439166d6",
      "subject": "EWS should terminate an ongoing job as soon as a hash becomes obsolete"
    },
    "320242@main": {
      "author": "Zak Ridouh",
      "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64",
      "cl": "320242@main",
      "clUrl": "https://commits.webkit.org/320242@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=320041\nrdar://182974019\n\nReviewed by Alex Christensen.\n\n-[WKContentView rectToRevealWhenZoomingToFocusedElement] builds the rect that\n-[WKContentView _zoomToRevealFocusedElement] reveals out of two pieces of\nfocused element state, and under site isolation only one of them is in\nmain-frame coordinates.\n\nThe selection half is already correct: 318296@main moved the conversion of the\neditor state's selection geometry into the web process, so both\nselectionBoundingRectInRootViewCoordinates() and interactionRect (converted in\nconvertFocusedElementInformationRectsToMainFrameCoordinates()) are in main-frame\ncoordinates, and intersecting them anchors the reveal at the right place. No\ntest covered the reveal rect itself, so add one.\n\nlastInteractionLocation is not converted. It is the tap location as delivered to\nthe frame's own process, so for a cross-origin iframe it is in that subframe's\nroot-view coordinates while interactionRect is in main-frame coordinates.\nComparing the two mixes coordinate spaces: for an element that cannot contain a\ntext selection (a \u003cselect\u003e, a date input) inside an offset iframe the\ncontainment check fails and the reveal loses the tapped point entirely, and it\ncan also succeed spuriously and reveal a 1x1 rect at the wrong location.\n\nConvert lastInteractionLocation together with the other focused element rects,\nin the same round trip, so both sides of the comparison are in the same space.\nA focused element in the main frame converts nothing, as before.\n\nThe new API test covers the selection path. Exercising the tapped-point path\nwould need a synthetic tap, which TestWebKitAPI has no infrastructure for.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n\n* Source/WebKit/UIProcess/API/ios/WKWebViewPrivateForTestingIOS.h:\n* Source/WebKit/UIProcess/API/ios/WKWebViewTestingIOS.mm:\n(-[WKWebView _rectToRevealWhenZoomingToFocusedElementForTesting]):\n* Source/WebKit/UIProcess/ios/WKContentViewInteraction.h:\n* Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm:\n(WebKit::WebPageProxy::convertFocusedElementInformationRectsToMainFrameCoordinates):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, ZoomToRevealFocusedElementRectIsInMainFrameCoordinates)):\n\nCanonical link: https://commits.webkit.org/320242@main",
      "email": "zakr@apple.com",
      "hash": "9543685f56f59082e6ba15377fc41158d63b3694",
      "subject": "[Site Isolation] Zoom-to-reveal mispositions the focused element when the selection is in a cross-origin iframe"
    },
    "320243@main": {
      "author": "Zak Ridouh",
      "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64",
      "cl": "320243@main",
      "clUrl": "https://commits.webkit.org/320243@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322622\nrdar://185923994\n\nReviewed by Elliott Williams.\n\nWebCore force-loads libPAL.a and re-exports it, so listing the static PAL\ntarget in WebKitLegacy_PRIVATE_LIBRARIES gave WebKitLegacy.framework a\nsecond copy of every PAL object it referenced thus duplicating PAL's state,\nnot just its code, including soft-link class singletons and isoheap\ns_heapRef/s_heapSpec pairs.\n\nWebKitLegacy_FRAMEWORKS already lists PAL, which resolves to WebCore, and\nWebKit.framework relies on the same thing. Headers are unaffected:\nWebKitLegacy_PRIVATE_INCLUDE_DIRECTORIES lists PAL_FRAMEWORK_HEADERS_DIR.\nXcode's WebKitLegacy.xcconfig never linked libPAL.a either.\n\nMatches Xcode behavior, and saves ~200KB of binary size.\n\n* Source/WebKitLegacy/PlatformCocoa.cmake:\n\nCanonical link: https://commits.webkit.org/320243@main",
      "email": "zakr@apple.com",
      "hash": "1d00164ce4f40139d2e52e225aeeb8cc529bdaf6",
      "subject": "[CMake] WebKitLegacy should not link libPAL.a"
    },
    "320244@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "320244@main",
      "clUrl": "https://commits.webkit.org/320244@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322109\nrdar://185328465\n\nReviewed by Antoine Quint.\n\nViewTimeline::cacheCurrentTime() left maxScrollOffset out of the metrics it compares\nagainst the previously cached data, so a change of the scroll container's maximum\nscroll offset alone would not call sourceMetricsDidChange().\n\nThat value is what defines the \"scroll\" view progress timeline range [1], whose 100%\nis the endmost scroll position of the scroll container, ie. the scrollable overflow\nsize minus the scroll container size [2]. Growing content that follows the subject\nmoves that position while the subject's offset and size, the scroll container's size,\nthe insets and the stickiness data are all unchanged, so an animation attached to\nthat range kept using the range computed for the previous scrollable overflow until\nsome unrelated metric happened to change. Updating the timeline's ranges here is\nrequired by the event loop integration [3]:\n\nAfter step 7.14 if any timelines' named timeline ranges have changed, these\ntimelines are added to the stale timelines set. If there are any stale\ntimelines, they now update their current time and associated ranges [...]\n\nScrollTimeline::cacheCurrentTime() already compares maxScrollOffset, and the staleness\ncheck in ScrollTimeline::updateCurrentTimeIfStale() does not cover view timelines\nsince those never set m_source, so nothing else caught this.\n\nMatch Firefox and the specification by including maxScrollOffset in the comparison.\n\n[1] https://drafts.csswg.org/scroll-animations-1/#valdef-animation-timeline-range-scroll\n[2] https://drafts.csswg.org/scroll-animations-1/#scroll-timeline-progress\n[3] https://drafts.csswg.org/scroll-animations-1/#event-loop\n\nTest: imported/w3c/web-platform-tests/scroll-animations/css/view-timeline-scroll-range-source-content-resize.html\n\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/view-timeline-scroll-range-source-content-resize-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/view-timeline-scroll-range-source-content-resize.html: Added.\n* Source/WebCore/animation/ViewTimeline.cpp:\n(WebCore::ViewTimeline::cacheCurrentTime):\n\nCanonical link: https://commits.webkit.org/320244@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "fbc2ba96701566dec329231d24c888d5d1831ad3",
      "subject": "An animation attached to a view timeline's scroll range is not updated when the scroll container's scrollable overflow changes"
    },
    "320245@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "320245@main",
      "clUrl": "https://commits.webkit.org/320245@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322888\n\nReviewed by Yusuke Suzuki.\n\nAfter 319934@main (FTL::OSRExitDescriptor) and 320007@main (DFG\nVariableEventStream), the FTL still keeps an 80 byte FTL::OSRExit plus a\nheap-allocated FixedVector\u003cB3::ValueRep\u003e, 16 bytes per exit argument, for\nevery exit site, although only 0.5% of the exits are ever taken. On JetStream3\nthat is 34 MB over the run, 210 bytes per exit.\n\nThis patch stores the ValueReps of all exits of a JITCode as one byte stream\n(OSRExitValueReps; the format is in the comment above the class), keeps the\ncode refs of taken exits in a side vector instead of in every OSRExit, and\nlowers the minimum capacity of the materialization property vectors from 16\nto 4. FTL::OSRExit goes from 80 to 56 bytes, and the same JetStream3 run goes\nfrom 34.4 MB to 13.9 MB (84 bytes per exit).\n\n* Source/JavaScriptCore/ftl/FTLExitTimeObjectMaterialization.h:\n* Source/JavaScriptCore/ftl/FTLJITCode.cpp:\n(JSC::FTL::JITCode::shrinkToFit):\n(JSC::FTL::JITCode::validateReferences):\n(JSC::FTL::JITCode::liveRegistersToPreserveAtExceptionHandlingCallSite):\n(JSC::FTL::JITCode::findPC):\n* Source/JavaScriptCore/ftl/FTLJITCode.h:\n* Source/JavaScriptCore/ftl/FTLOSRExit.cpp:\n(JSC::FTL::DFG::encodeValueRep):\n(JSC::FTL::DFG::decodeValueRep):\n(JSC::FTL::OSRExitValueReps::append):\n(JSC::FTL::OSRExitValueReps::decode const):\n(JSC::FTL::OSRExitDescriptor::prepareOSRExitHandle):\n(JSC::FTL::OSRExit::OSRExit):\n(JSC::FTL::OSRExit::valueReps const):\n* Source/JavaScriptCore/ftl/FTLOSRExit.h:\n(JSC::FTL::OSRExitValueReps::shrinkToFit):\n* Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp:\n(JSC::FTL::compileStub):\n(JSC::FTL::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):\n\nCanonical link: https://commits.webkit.org/320245@main",
      "email": "sosuke@bun.sh",
      "hash": "a261c62aff59aaffd41f5b40e9c99ad863038638",
      "subject": "[JSC] Store FTL OSR exit `ValueRep`s as a byte stream and shrink `FTL::OSRExit`"
    },
    "320246@main": {
      "author": "Patrick Griffis",
      "avatar": "https://www.gravatar.com/avatar/2233c3a857004b126158572af9fe36f7?d=identicon\u0026s=64",
      "cl": "320246@main",
      "clUrl": "https://commits.webkit.org/320246@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323052\n\nReviewed by Carlos Garcia Campos.\n\nPromiseDMABufImageContext is created on the thread producing the buffer, WebGL's\nin the case of GraphicsContextGLTextureMapperGBM::prepareForDisplay(), and handed\nto Skia as the context of a promise image texture. Skia releases those contexts\nwhile flushing on the compositing thread, so the reference count is touched from\ntwo threads while being a plain RefCounted and hits an ASSERT.\n\nMake it ThreadSafeRefCounted. DMABufBuffer, which it holds, already is.\n\n* Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedPlatformLayerBufferDMABuf.cpp:\n\nCanonical link: https://commits.webkit.org/320246@main",
      "email": "pgriffis@igalia.com",
      "hash": "2a6af1e45406751495293f8ab2878dafc4506fcb",
      "subject": "[GTK][WPE] PromiseDMABufImageContext is reference counted across threads"
    },
    "320247@main": {
      "author": "Patrick Griffis",
      "avatar": "https://www.gravatar.com/avatar/2233c3a857004b126158572af9fe36f7?d=identicon\u0026s=64",
      "cl": "320247@main",
      "clUrl": "https://commits.webkit.org/320247@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323057\n\nReviewed by Michael Catanzaro and Carlos Garcia Campos.\n\nContextMenuController adds ten items to the context menu of a PDF document, and\nnone of them were mapped in WebKitContextMenuActions, so they reached the\nASSERT_NOT_REACHED() in the default branch of webkitContextMenuActionGetForContextMenuItem().\n\n* Source/WebKit/Shared/API/glib/WebKitContextMenuActions.cpp:\n(webkitContextMenuActionGetActionTag):\n(webkitContextMenuActionGetForContextMenuItem):\n(pdfContextMenuActionLabel):\n(webkitContextMenuActionGetLabel):\n* Source/WebKit/UIProcess/API/glib/WebKitContextMenuActions.h.in:\n\nCanonical link: https://commits.webkit.org/320247@main",
      "email": "pgriffis@igalia.com",
      "hash": "27a68309e6bf2766d5573648c151c8fff0bfbfe9",
      "subject": "[GLib] Expose the PDF context menu actions in the API"
    },
    "320248@main": {
      "author": "Adrian Taylor",
      "avatar": "https://www.gravatar.com/avatar/d2acb8ad2e2670ff74ae0d65fb27014c?d=identicon\u0026s=64",
      "cl": "320248@main",
      "clUrl": "https://commits.webkit.org/320248@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323100\n\nReviewed by Zak Ridouh.\n\nThis is the second in a series of commits which will eventually result in all\ncode paths provably validating origins sent from WCP to more privileged processes.\n\nAdds the procedures by which the UI process recovers a trusted origin from an\nIPC::Untrusted\u003cT\u003e. Nothing calls them yet - the burn-down is a later commit - so\nthere is no behavior change.\n\nThere is more than one because the UI process has different notions of authority and\nthey are not interchangeable:\n\n- FirstPartyAuthority answers \"is this the registrable domain of the site this\n  process is for\", which is the question site isolation can answer, and it is the\n  only question available for a bare SecurityOriginData, RegistrableDomain or Site.\n  It defers to WebProcessProxy::allowsFirstPartyAccess().\n\n- TopLevelFirstPartyAuthority asks the same question of allowsFirstPartyAccess(), but\n  without the site-isolation guard described below, for the values where that guard\n  would be wrong. See below.\n\n- CommittedClientOriginAuthority answers \"has this process committed a load for\n  this exact (top origin, client origin) pair\", deferring to\n  WebProcessProxy::hasCommittedClientOrigin(). It is strictly stronger, and it is\n  only available for ClientOrigin, which is why it cannot be merged with the others.\n\nBoth functions already existed and are already used by a handful of hand-written\nMESSAGE_CHECKs; this commit does not invent a policy, it makes the existing one\nreachable through the type.\n\nallowsFirstPartyAccess() is three-way: SilentFailure becomes\nValidationFailure::Ignore because it means the process is serving several sites\nat once, which happens legitimately as a new load starts, and terminating there\nwould kill processes during normal navigation.\n\nFirstPartyAuthority's site-isolation guard is the one piece of new logic, and it is\nthere because the value it is handed may name any origin on the page, including a\nsubframe's. Without site isolation a single process hosts a page and every cross-site\nsubframe it pulls in, while WebProcessProxy records only the main frame's site, so for\nsuch a value the comparison has no useful answer and could only produce false denials.\nFirstPartyAuthority therefore passes everything when siteIsolationEnabled is off or the\nprocess is the single web process.\n\nThat guard must not silently weaken a check that ships today, so there is a third\nprocedure. TopLevelFirstPartyAuthority asks exactly the same question with no guard,\nand is correct only for a value that is by construction the process's own top-level or\nworker origin - where WebProcessProxy's record of the main frame's site is the right\nthing to compare against with or without site isolation. The two app-badge messages,\nSetAppBadgeFromWorker and WebFrameProxy::SetAppBadge, are the existing unconditional\ncallers of allowsFirstPartyAccess(), and they use this procedure, so their behaviour is\nunchanged in every configuration. CommittedClientOriginAuthority needs no guard for the\nsame reason: hasCommittedClientOrigin() answers from what the process has actually\ncommitted, which is exact either way, so the Web Locks checks that already call it are\nunchanged too.\n\nAlternative considered for CommittedClientOriginAuthority: validating only the top\norigin, as the network process does. Rejected because storage and Web Locks\npartition on both halves of a ClientOrigin, so the top origin alone is only half of\nthe key they are keyed on.\n\nIf the WebProcessProxy has gone away by the time we do one of these queries, we\nassume that the process is already going through destruction rather than being\nmalicious. Alternative considered: hold a strong reference to the WebProcessProxy.\nWe don't want to do that because we don't want to inadvertently extend lifetimes\nvia this change.\n\nAlso documents, next to the primitive, the EXTRACT_WITH_MESSAGE_CHECK shape that\ncallers will use. It cannot live in a shared header: the macro has to expand to the\nreceiver's own MESSAGE_CHECK, whose argument order differs between translation\nunits, so each defines its own. The definitions land with their first users in a\nlater commit rather than sitting unused here.\n\n* Source/WebKit/Platform/IPC/Untrusted.h:\n* Source/WebKit/UIProcess/FirstPartyAuthority.h: Added.\n(WebKit::checkFirstPartyAccess):\n(WebKit::FirstPartyAuthority::FirstPartyAuthority):\n(WebKit::FirstPartyAuthority::checkUntrusted const):\n(WebKit::FirstPartyAuthority::checkUntrustedDomain const):\n(WebKit::TopLevelFirstPartyAuthority::TopLevelFirstPartyAuthority):\n(WebKit::TopLevelFirstPartyAuthority::checkUntrusted const):\n(WebKit::CommittedClientOriginAuthority::CommittedClientOriginAuthority):\n(WebKit::CommittedClientOriginAuthority::checkUntrusted const):\n\nCanonical link: https://commits.webkit.org/320248@main",
      "email": "adrian_taylor@apple.com",
      "hash": "aba0fcd53beabdfab961ba8ca5ee11565a9f2ca7",
      "subject": "[IPC] Add the UI process' origin validation procedures"
    },
    "320249@main": {
      "author": "Andy Estes",
      "avatar": "https://www.gravatar.com/avatar/643f10f01b26fd94d03482a2013b2ea0?d=identicon\u0026s=64",
      "cl": "320249@main",
      "clUrl": "https://commits.webkit.org/320249@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323045\nrdar://179129739\n\nReviewed by Jer Noble.\n\nContext menus are anchored in top-level page coordinates, but\nMediaControlsHost::showMediaControlsContextMenu() got the rect from\nElement::boundsInRootViewSpace(), whose walk up the frame tree uses Widget::parent(). That is null\nfor a RemoteFrameView under Site Isolation, so in the iframe's process the rect stopped at the\niframe's own local root and never picked up the iframe's position in the page.\n\nFixed by using FrameView::convertToRootViewAcrossIsolatedFrames(), which follows the frame tree\nacross process boundaries.\n\nTest: http/tests/media/media-controls-context-menu-anchor-in-iframe.html\n\n* LayoutTests/TestExpectations:\n* LayoutTests/http/tests/media/media-controls-context-menu-anchor-in-iframe-expected.txt: Added.\n* LayoutTests/http/tests/media/media-controls-context-menu-anchor-in-iframe.html: Added.\n* LayoutTests/http/tests/media/resources/media-controls-context-menu-anchor-in-iframe-frame.html: Added.\n* LayoutTests/platform/ios-wk2/TestExpectations: Added.\n* LayoutTests/platform/mac-wk2/TestExpectations:\n* Source/WebCore/Modules/mediacontrols/MediaControlsHost.cpp:\n(WebCore::contextMenuAnchorRect):\n(WebCore::MediaControlsHost::mediaControlsContextMenuAnchorRectForBindings):\n(WebCore::MediaControlsHost::showMediaControlsContextMenu):\n* Source/WebCore/Modules/mediacontrols/MediaControlsHost.h:\n* Source/WebCore/Modules/mediacontrols/MediaControlsHost.idl:\n\nCanonical link: https://commits.webkit.org/320249@main",
      "email": "aestes@apple.com",
      "hash": "99127ce297d9945557256245abee97d0d42d4ce8",
      "subject": "[iOS] Media controls context menus can appear at the wrong position with Site Isolation enabled"
    },
    "320251@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "320251@main",
      "clUrl": "https://commits.webkit.org/320251@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323085\nrdar://186339983\n\nReviewed by Marcus Plutowski and Keith Miller.\n\nAdding MonoProto condition to isHandlerPrototypeChainCacheable.\nOtherwise we may get a structure which has differnt [[Prototype]] (due\nto PolyProto). In that case, worst case is having jsNull as a JSObject*,\nso crash issue with a deterministic address. Also updating oldStructure\nby passing it to CommonSlowPaths::putDirectWithReify. This is not an\nactual issue, but it makes oldStructure more solid.\n\nTest: JSTests/stress/proxy-handler-traps-cache-poly-proto-handler.js\n\n* JSTests/stress/proxy-handler-traps-cache-poly-proto-handler.js: Added.\n(shouldBe):\n(makePolyProtoObject.foo.C):\n(makePolyProtoObject.foo):\n(return.foo):\n(shouldBe.handler):\n* Source/JavaScriptCore/jit/JITOperations.cpp:\n(JSC::directPutByValOptimize):\n* Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:\n(JSC::LLInt::LLINT_SLOW_PATH_DECL):\n* Source/JavaScriptCore/runtime/ProxyObject.cpp:\n(JSC::ProxyObject::getHandlerTrap):\n* Source/JavaScriptCore/runtime/ProxyObject.h:\n(JSC::ProxyObject::isHandlerTrapsCacheValid):\n\nCanonical link: https://commits.webkit.org/320251@main",
      "email": "ysuzuki@apple.com",
      "hash": "731652af64ff40f6fd4063d6e1969ed25b1df9c1",
      "subject": "[JSC] Fix Structure transition wrong checking issues"
    },
    "320252@main": {
      "author": "Kiet Ho",
      "avatar": "https://www.gravatar.com/avatar/d9058b37006dce1f55f91b8ccc82f9a3?d=identicon\u0026s=64",
      "cl": "320252@main",
      "clUrl": "https://commits.webkit.org/320252@main",
      "description": "rdar://186334109\nhttps://bugs.webkit.org/show_bug.cgi?id=323081\n\nReviewed by Keith Miller.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ProcessJetsamPriority.mm:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SecurityFlags.mm:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebAuthnRelatedOriginsFetch.mm:\n\nCanonical link: https://commits.webkit.org/320252@main",
      "email": "kiet.ho@apple.com",
      "hash": "ce152d77aec8d09703b8c16480f3f7a9ba6cb302",
      "subject": "[CMake] Add missing headers in TestWebKitAPI to fix build errors"
    },
    "320253@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "320253@main",
      "clUrl": "https://commits.webkit.org/320253@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322873\nrdar://problem/186118858\n\nReviewed by Elika Etemad.\n\nUnlike regular grid, where all explicitly-placed items are positioned before auto-placement\nruns, Grid Lanes places items interleaved in order. That raised the question of whether an\nexplicitly-placed item should move the auto-placement cursor along with it.\n\nThe CSSWG resolved this in\nhttps://github.com/w3c/csswg-drafts/issues/13987#issuecomment-5192487721:\n\n    RESOLVED: Remove issue, leave spec as-is (not updating auto-placement cursor with\n    explicit placement)\n\nGridLanesLayout was updating m_autoFlowNextCursor from insertIntoGridAndLayoutItem(), which\nruns for every item, so explicitly-placed items dragged the cursor along too. Move the\nupdate up into placeGridLanesItems(), which already knows whether the item resolved a\ndefinite grid-axis position, and only advance the cursor for auto-placed items.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-lanes/item-placement/flow-tolerance/column-fit-tolerance-infinite-explicit-placement-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-lanes/item-placement/flow-tolerance/column-fit-tolerance-infinite-explicit-placement-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-lanes/item-placement/flow-tolerance/column-fit-tolerance-infinite-explicit-placement.html: Added.\nAdded some new tests that make sure this behavior is correct when fit-tolerance is infinite.\n\nCanonical link: https://commits.webkit.org/320253@main",
      "email": "sammy.gill@apple.com",
      "hash": "90dfd6f5fe81463f1301a253764fc76e434fb1d7",
      "subject": "[Grid Lanes] Explicitly-placed items should not advance the auto-placement cursor."
    },
    "320255@main": {
      "author": "Anand Srinivasan",
      "avatar": "https://www.gravatar.com/avatar/84643a20c269974c2df6681742daf0a4?d=identicon\u0026s=64",
      "cl": "320255@main",
      "clUrl": "https://commits.webkit.org/320255@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317349\nrdar://178289134\n\nReviewed by Yusuke Suzuki.\n\nCurrently IPInt implementations of br_on_cast/br_on_cast_fail assume\nflags are at a fixed offset in the instruction but overlong opcodes\nare legal and IPInt may use the wrong byte to load flags. This patch\nmakes the validator cache allowNull in metadata so IPInt no longer\nloads from the instruction stream at all.\n\nTests: JSTests/wasm/stress/br-on-cast-fail-overlong-leb128.js\n       JSTests/wasm/stress/br-on-cast-overlong-leb128.js\n\n* JSTests/wasm/stress/br-on-cast-fail-overlong-leb128.js: Added.\n(uleb):\n(section):\n(str):\n* JSTests/wasm/stress/br-on-cast-overlong-leb128.js: Added.\n(uleb):\n(section):\n(str):\n* Source/JavaScriptCore/llint/InPlaceInterpreter64.asm:\n* Source/JavaScriptCore/wasm/WasmIPIntGenerator.cpp:\n(JSC::Wasm::IPIntGenerator::addRefTest):\n(JSC::Wasm::IPIntGenerator::addRefCast):\n(JSC::Wasm::IPIntGenerator::addBranchCast):\n* Source/JavaScriptCore/wasm/WasmIPIntGenerator.h:\n\nOriginally-landed-as: 305413.1025@safari-7624.5-branch (5b76326e8fc9). rdar://185367884\nCanonical link: https://commits.webkit.org/320255@main",
      "email": "anand_srinivasan@apple.com",
      "hash": "ace190337c8540fda9e61a93c1b29d1a4e619037",
      "subject": "IPInt br_on_cast/br_on_cast_fail must handle overlong LEB128 opcode"
    },
    "320256@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "320256@main",
      "clUrl": "https://commits.webkit.org/320256@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323093\n\nReviewed by Cole Carley.\n\nThis test has been failing uniquely on iPad since it was introduced,\nand most recently after 320170@main. This is because there are certain\nquirks that are enabled conditional on the screen idiom, i.e.\nShouldEnterNativeFullscreenWhenCallingElementRequestFullscreen.\n\nTo respect these differences, we introduce a platform-specific baseline.\n\n* LayoutTests/platform/ipad/fast/quirks/active-quirks-by-domain-expected.txt: Added.\n\nCanonical link: https://commits.webkit.org/320256@main",
      "email": "a_protyasha@apple.com",
      "hash": "68aa96e1c138022dc3f20aa13667e7bcbf42df88",
      "subject": "[iPad] fast/quirks/active-quirks-by-domain.html is a consistent text failure"
    },
    "320257@main": {
      "author": "Sam Weinig",
      "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64",
      "cl": "320257@main",
      "clUrl": "https://commits.webkit.org/320257@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322908\n\nReviewed by Darin Adler.\n\nPart 1 of https://bugs.webkit.org/show_bug.cgi?id=319263\n\nFontDescription and Style::ComputedStyleBase reference a font's \"computed size\",\nbut the value they currently associate with that is closer to CSS concept of a\nused style size than a computed one. It is a transformation of the computed size,\nwhich is incorrectly currently referred to as the \"specified\" size and will be\naddressed next, with zoom and preference driven minimum size clamps applied.\n\n* Source/WebCore/animation/KeyframeEffect.cpp:\n* Source/WebCore/css/CSSFontFaceSource.cpp:\n* Source/WebCore/dom/Document.cpp:\n* Source/WebCore/editing/TextIterator.cpp:\n* Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp:\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:\n* Source/WebCore/html/canvas/OffscreenCanvasRenderingContext2D.cpp:\n* Source/WebCore/inspector/InspectorOverlay.cpp:\n* Source/WebCore/inspector/InspectorOverlayLabel.cpp:\n* Source/WebCore/layout/formattingContexts/inline/InlineLevelBoxInlines.h:\n* Source/WebCore/layout/formattingContexts/inline/ruby/RubyFormattingContext.cpp:\n* Source/WebCore/loader/cache/CachedSVGFont.cpp:\n* Source/WebCore/page/DebugPageOverlays.cpp:\n* Source/WebCore/page/LocalFrameViewLayoutContext.cpp:\n* Source/WebCore/page/PrintContext.cpp:\n* Source/WebCore/platform/graphics/Font.cpp:\n* Source/WebCore/platform/graphics/FontCascade.cpp:\n* Source/WebCore/platform/graphics/FontCascade.h:\n* Source/WebCore/platform/graphics/FontCascadeCache.h:\n* Source/WebCore/platform/graphics/FontCascadeDescription.cpp:\n* Source/WebCore/platform/graphics/FontDescription.cpp:\n* Source/WebCore/platform/graphics/FontDescription.h:\n* Source/WebCore/platform/graphics/ca/FrameProcessIndicators.cpp:\n* Source/WebCore/platform/graphics/ca/PlatformCALayer.mm:\n* Source/WebCore/platform/graphics/cocoa/FontCacheCoreText.cpp:\n* Source/WebCore/platform/graphics/cocoa/FontFamilySpecificationCoreText.cpp:\n* Source/WebCore/platform/graphics/cocoa/SystemFontDatabaseCoreText.cpp:\n* Source/WebCore/platform/graphics/coretext/FontCascadeCoreText.cpp:\n* Source/WebCore/platform/graphics/coretext/FontCustomPlatformDataCoreText.cpp:\n* Source/WebCore/platform/graphics/freetype/FontCacheFreeType.cpp:\n* Source/WebCore/platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp:\n* Source/WebCore/platform/graphics/skia/FontCacheSkia.cpp:\n* Source/WebCore/platform/graphics/skia/FontCustomPlatformDataSkia.cpp:\n* Source/WebCore/platform/graphics/win/FontCacheWin.cpp:\n* Source/WebCore/platform/graphics/win/cairo/FontCacheWinCairo.cpp:\n* Source/WebCore/platform/graphics/win/cairo/FontCustomPlatformDataWinCairo.cpp:\n* Source/WebCore/platform/mock/MockRealtimeVideoSource.cpp:\n* Source/WebCore/rendering/RenderBlockFlow.cpp:\n* Source/WebCore/rendering/RenderBlockFlow.h:\n* Source/WebCore/rendering/RenderCombineText.cpp:\n* Source/WebCore/rendering/RenderElement.cpp:\n* Source/WebCore/rendering/RenderElement.h:\n* Source/WebCore/rendering/RenderEmbeddedObject.cpp:\n* Source/WebCore/rendering/RenderGrid.cpp:\n* Source/WebCore/rendering/RenderLayerBacking.cpp:\n* Source/WebCore/rendering/RenderMultiColumnSet.cpp:\n* Source/WebCore/rendering/RenderTheme.cpp:\n* Source/WebCore/rendering/TextAutoSizing.cpp:\n* Source/WebCore/rendering/TextBoxPainter.cpp:\n* Source/WebCore/rendering/cocoa/RenderThemeCocoa.mm:\n* Source/WebCore/rendering/ios/RenderThemeIOS.mm:\n* Source/WebCore/rendering/mac/RenderThemeMac.mm:\n* Source/WebCore/rendering/mathml/RenderMathMLRow.cpp:\n* Source/WebCore/rendering/svg/RenderSVGInlineText.cpp:\n* Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp:\n* Source/WebCore/style/InlineTextBoxStyle.cpp:\n* Source/WebCore/style/StyleAdjuster.cpp:\n* Source/WebCore/style/StyleBuilderState.cpp:\n* Source/WebCore/style/StyleBuilderStateInlines.h:\n* Source/WebCore/style/StyleExtractor.cpp:\n* Source/WebCore/style/StyleExtractorCustom.h:\n* Source/WebCore/style/StyleFontSizeFunctions.cpp:\n* Source/WebCore/style/StyleFontSizeFunctions.h:\n* Source/WebCore/style/StyleResolveForDocument.cpp:\n* Source/WebCore/style/StyleResolveForFont.cpp:\n* Source/WebCore/style/StyleResolver.cpp:\n* Source/WebCore/style/computed/StyleComputedStyle.cpp:\n* Source/WebCore/style/computed/StyleComputedStyleBase.cpp:\n* Source/WebCore/style/computed/StyleComputedStyleBase.h:\n* Source/WebCore/style/computed/StyleComputedStyleProperties+SettersCustomInlines.h:\n* Source/WebCore/style/values/fonts/StyleFontSizeAdjust.cpp:\n* Source/WebCore/style/values/inline/StyleLineHeight.cpp:\n* Source/WebCore/style/values/primitives/StyleLengthResolution.cpp:\n* Source/WebCore/style/values/text-decoration/StyleTextDecorationThickness.cpp:\n* Source/WebCore/style/values/text-decoration/StyleTextUnderlineOffset.cpp:\n* Source/WebKit/WebProcess/WebPage/ViewGestureGeometryCollector.cpp:\n* Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm:\n* Source/WebKitLegacy/mac/DOM/DOM.mm:\n* Tools/TestWebKitAPI/Tests/WebCore/ComplexTextController.cpp:\n* Tools/TestWebKitAPI/Tests/WebCore/FontCascade.cpp:\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/BifurcatedGraphicsContextTestsCG.cpp:\n\nCanonical link: https://commits.webkit.org/320257@main",
      "email": "sam@webkit.org",
      "hash": "f6a1d35c9ae3555b89ba2d3677b7366efedefcf1",
      "subject": "Replace references to a font's \"computedSize\" with \"usedSize\""
    },
    "320258@main": {
      "author": "Ben Nham",
      "avatar": "https://www.gravatar.com/avatar/dc0914eabf69047ee3397794c2d17bf7?d=identicon\u0026s=64",
      "cl": "320258@main",
      "clUrl": "https://commits.webkit.org/320258@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322906\nrdar://186162772\n\nReviewed by Kiet Ho and Per Arne Vollan.\n\nWith Site Isolation, we now broadcast multiple TransformationMatrix instances at frame rate to\nremote frame processes, so it makes sense to add some code to reduce the size of those matrices over\nthe wire.\n\nThis adds some specializations for common TransformationMatrix types that don't require the full 4x4\nmatrix (specifically identity, 2D transforms, 3D transforms, and affine transforms). The added\nArgumentCoder tests ensure that these matrices use fewer bytes over the wire as intended.\n\nTests: Tools/TestWebKitAPI/Tests/IPC/ArgumentCoderTests.cpp\n   Tools/TestWebKitAPI/Tests/WebCore/TransformationMatrix.cpp\n\n* Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp:\n(WebCore::TransformationMatrix::ipcData const):\n(WebCore::TransformationMatrix::fromIPCData):\n* Source/WebCore/platform/graphics/transforms/TransformationMatrix.h:\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Tools/TestWebKitAPI/Tests/IPC/ArgumentCoderTests.cpp:\n(TestWebKitAPI::testTransformationMatrixCoding):\n(TestWebKitAPI::TEST(ArgumentCoderTransformationMatrix, IdentityCostsOnlyTheVariantTag)):\n(TestWebKitAPI::TEST(ArgumentCoderTransformationMatrix, Translation2DCostsTwoDoubles)):\n(TestWebKitAPI::TEST(ArgumentCoderTransformationMatrix, Translation3DCostsThreeDoubles)):\n(TestWebKitAPI::TEST(ArgumentCoderTransformationMatrix, AffineCostsSixDoubles)):\n(TestWebKitAPI::TEST(ArgumentCoderTransformationMatrix, NonAffineCostsSixteenDoubles)):\n* Tools/TestWebKitAPI/Tests/WebCore/TransformationMatrix.cpp:\n(TestWebKitAPI::testIPCDataRoundTrip):\n(TestWebKitAPI::TEST(TransformationMatrix, IPCDataIdentity)):\n(TestWebKitAPI::TEST(TransformationMatrix, IPCDataTranslation2D)):\n(TestWebKitAPI::TEST(TransformationMatrix, IPCDataTranslation3D)):\n(TestWebKitAPI::TEST(TransformationMatrix, IPCDataAffine)):\n(TestWebKitAPI::TEST(TransformationMatrix, IPCDataFull)):\n\nCanonical link: https://commits.webkit.org/320258@main",
      "email": "nham@apple.com",
      "hash": "fd86b54293b5d6c3e9b9a07b5373afa488456f66",
      "subject": "Reduce IPC encoded size of TransformationMatrix"
    },
    "320259@main": {
      "author": "Issac Roy",
      "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64",
      "cl": "320259@main",
      "clUrl": "https://commits.webkit.org/320259@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323010\nrdar://186274279\n\nReviewed by Alan Baradlay.\n\ncss-flexbox-2 9.7 asks `flex-wrap: balance` to divide flex items into lines\nthat minimize the sum of squared free space, instead of greedily filling each\nline.\n\nNew FlexLineBreaker.{h,cpp} holds both breakers as free functions over\nstd::span\u003cconst LayoutUnit\u003e, so neither needs a FlexLayoutItem or a formatting\ncontext and both are unit-testable. greedyLineBreaks is the existing loop from\ncomputeFlexLines moved verbatim. computeFlexLines now flattens the outer\nhypothetical main sizes once, picks a breaker, and shares one loop to build\nranges and hypotheticalMainSizes.\n\nbalancedLineBreaks is a dynamic program over suffixes: minScores[start] is the\nbest total for items start..n, and bestEndForStart records where that line ends.\nThe suffix direction is what gets the tie-break right. The spec breaks ties\nfront-to-back -- most items on the first line, then the second -- so among equal\nminima the line starting at `start` must be the longest one, which the `\u003c=`\ncomparison records as the scan walks `end` upward.\n\nCosts O(n * L) for L items on the fullest line, so quadratic only when one line\ncan hold most of the items. In the case that we lack performance, a better\nsolution for such cases is LARSCH, which is O(n) but costs a few hundred lines.\n\nItem sizes are floored at 0 when building the prefix sums, per 9.7's closing\nline. greedyLineBreaks deliberately does not floor: CSS Flexbox 1 9.3 sums outer\nhypothetical main sizes as-is, and negative margins legitimately shorten a line\nthere. Squared free space reaches 2^62, so five near-empty lines can overflow a\nuint64_t sum; totalScore saturates instead, and a saturated total never compares\nbetter than a real one.\n\nTwo bounds keep the search off its worst case. lastFittingEnd[start] is one\ntwo-pointer sweep giving the last item that still fits, so the inner loop runs\nover items-per-line rather than n, making the whole thing O(n * L). And a\ncontainer that fits everything returns a single line immediately: no line of any\nsplit has a smaller error, and a split sums at least as many of them.\n\nflex-line-count is not implemented, so the 17 balance expectations that remain\nare the tests requiring it. They need a second dimension on the DP plus a\nmeasurement pass that divides the available size by the line count, and are\nleft for a follow-up.\n\nTests: imported/w3c/web-platform-tests/css/css-flexbox/balance/\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-flexbox/balance/balance-negative-margin-002-expected.txt:\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/layout/formattingContexts/flex/FlexFormattingContext.cpp:\n(WebCore::FlexFormattingContext::computeFlexLines):\n* Source/WebCore/layout/formattingContexts/flex/FlexLineBreaker.cpp: Added.\n(WebCore::greedyLineBreaks):\n(WebCore::balancedLineBreaks):\n* Source/WebCore/layout/formattingContexts/flex/FlexLineBreaker.h: Added.\n\nCanonical link: https://commits.webkit.org/320259@main",
      "email": "issacroy05@gmail.com",
      "hash": "13ce6a6997552903710c15201202a8fb7907d5df",
      "subject": "Implement the flex-wrap: balance line breaker"
    },
    "320260@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "320260@main",
      "clUrl": "https://commits.webkit.org/320260@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323061\nrdar://186324281\n\nReviewed by Abrar Rahman Protyasha.\n\nAdd a Swift interface for the `runJavaScriptInMainFrame` to abstract all the underlying\nbridging needed.\n\nThis is not yet currently testable by itself.\n\n* Source/WebKit/Modules/Internal/module.modulemap:\n* Source/WebKit/Shared/Foundation+Extras.swift:\n(CopyableBox.value):\n(CopyableBox.take):\n* Source/WebKit/Shared/JavaScriptEvaluationResultCxxInteropSupport.cpp: Copied from Source/WebKit/Shared/RunJavaScriptParameters.h.\n* Source/WebKit/Shared/JavaScriptEvaluationResultCxxInteropSupport.h: Added.\n(WebKit::JavaScriptEvaluationOwnedResult::JavaScriptEvaluationOwnedResult):\n(WebKit::JavaScriptEvaluationOwnedResult::begin const):\n(WebKit::JavaScriptEvaluationOwnedResult::end const):\n(WebKit::CxxInteropSupport::takeValue):\n* Source/WebKit/Shared/RunJavaScriptParameters.h:\n* Source/WebKit/Shared/RunJavaScriptResult.swift: Copied from Source/WebKit/UIProcess/WebPageProxy.swift.\n(WebKit.__take(_:)):\n* Source/WebKit/UIProcess/WebPageProxy.swift:\n(WebKit.editorStateCopy): Deleted.\n(WebKit.editorState): Deleted.\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/320260@main",
      "email": "richard_robinson2@apple.com",
      "hash": "6fb7e92d9fc736efdd6b49ee11a56a31a9c271d0",
      "subject": "[NewCodable] Make it possible to call `WebPageProxy.runJavaScriptInMainFrame` from Swift"
    },
    "320261@main": {
      "author": "Keith Miller",
      "avatar": "https://www.gravatar.com/avatar/bddc1595b29098429a6ce7c8bf4aced2?d=identicon\u0026s=64",
      "cl": "320261@main",
      "clUrl": "https://commits.webkit.org/320261@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323109\nrdar://186366829\n\nReviewed by Elliott Williams.\n\nRight now `-Werror` is set per-target. This is error prone (pun intended).\nAfter this change when in DEVELOPER_MODE with fatal warnings, which is\nthe default, we prepend `-Werror`. This matches the xcodebuild's use\nof `-Werror` which is set in every Base.xconfig, although, it should\nprobably move to CommonBase.xconfig.\n\nI didn't move Swift's logic for setting the flags `-Werror` since\nWebKitCompilerFlags.cmake is initialized before SWIFT_ENABLED is set\nfor a given port. If/when we require Swift for all ports we can\nreconsider moving those definitions.\n\nCanonical link: https://commits.webkit.org/320261@main",
      "email": "keith_miller@apple.com",
      "hash": "070356a60a77ee878b21ce8c9d2dda7a3d1c4257",
      "subject": "[CMake] Enable -Werror globally in DEVELOPER_MODE"
    },
    "320262@main": {
      "author": "Ben Nham",
      "avatar": "https://www.gravatar.com/avatar/dc0914eabf69047ee3397794c2d17bf7?d=identicon\u0026s=64",
      "cl": "320262@main",
      "clUrl": "https://commits.webkit.org/320262@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322880\nrdar://186126721\n\nReviewed by Elliott Williams.\n\nThis makes a couple of fixes to the CMake TestWebKitAPI build to make it more closely match the\nXcode TestWebKitAPI build:\n\n1. Give TestWebKitAPI an Info.plist. This gives it the correct bundle identifier, which makes some\nbundle ID-dependent tests pass.\n\n2. Previously the Xcode produced a TestWebKitAPI injected bundle with a non-standard `.bundle`\nexecutable suffix like this: `TestWebKitAPI.wkbundle/Contents/MacOS/TestWebKitAPI.bundle`. There\nisn't a clean way to produce an injected bundle with that name and executable name using the\nbuilt-in CMake BUNDLE target.\n\nInstead, we make both Xcode and CMake produce an injected bundle with a more standard bundle path,\nnamely `TestWebKitAPIPlugIn.wkbundle/Contents/MacOS/TestWebKitAPIPlugIn`. (I also considered\n`TestWebKitAPIBundle` and `TestWebKitAPIInjectedBundle` but both those names are used for other\nthings in the build system.) The tests now access that injected bundle URL via\n`testPlugInBundleURL()`.\n\n3. I also updated the legacy C injected bundle (InjectedBundleTestWebKitAPI) to use the appropriate\nInfo.plist.\n\nTested with TestWebKitAPI.WebKit.BundleParameters (modern bundle) and\nTestWebKitAPI.WebKit.InjectedBundleBasic (legacy C bundle).\n\n* Source/WebCore/CMakeLists.txt:\n* Source/WebCore/Configurations/WebCore.xcconfig:\n* Tools/TestWebKitAPI/Configurations/WebProcessPlugIn.xcconfig:\n* Tools/TestWebKitAPI/Helpers/PlatformUtilities.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/Bundle+Extras.swift:\n(Bundle.testPlugInURL):\n* Tools/TestWebKitAPI/Helpers/cocoa/PlatformUtilitiesCocoa.mm:\n(TestWebKitAPI::Util::testPlugInBundleURL):\n* Tools/TestWebKitAPI/Helpers/cocoa/WKWebViewConfigurationExtras.mm:\n(+[WKWebViewConfiguration _test_configurationWithTestPlugInClassName:configureJSCForTesting:]):\n* Tools/TestWebKitAPI/Helpers/cocoa/WebPageConfiguration+Extras.swift:\n* Tools/TestWebKitAPI/PlatformCocoa.cmake:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/NavigationAPI.mm:\n(TestWebKitAPI::TEST(NavigationAPI, ClearWrappersWithNavigateEventListener)):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ProcessSwapOnNavigation.mm:\n((ProcessSwap, PageOverlayLayerPersistence)):\n\nCanonical link: https://commits.webkit.org/320262@main",
      "email": "nham@apple.com",
      "hash": "bc97b29b7be431f62ff530a295ba196278f2cab3",
      "subject": "Fix injected bundle tests in TestWebKitAPI CMake build"
    },
    "320263@main": {
      "author": "Roberto Rodriguez",
      "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64",
      "cl": "320263@main",
      "clUrl": "https://commits.webkit.org/320263@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323021\nrdar://185336542\n\nReviewed by Anne van Kesteren.\n\nElement::isNonceable() implements the CSP \"is element nonceable\" algorithm\n(https://www.w3.org/TR/CSP3/#is-element-nonceable) which officially only checks for '\u003cscript'\nand '\u003cstyle' in each attribute name and value to catch injected dangling markup and prevent\nan unterminated script start tag from stealing a nonce from a legitimate element.\nThe algorithm currently doesn't check for '\u003clink' even though \u003clink\u003e is nonceable.\n\nFix by also checking for '\u003clink' in each attribute name and value. Nonces apply only to\nscript, style and link elements, so all three are now covered. Chrome has already made this\nchange and has proposed updating the CSP spec (https://github.com/w3c/webappsec-csp/pull/810).\n\nA WPT test exists for checking non-nonceable elements\n(imported/w3c/web-platform-tests/content-security-policy/script-src/non-nonceable-elements.html)\nand WebKit currently fails its '\u003clink' subtests, which this fix addresses. That test only\nchecks attribute values, so add a second similar test to cover attribute names.\n\nTest: imported/w3c/web-platform-tests/content-security-policy/script-src/non-nonceable-elements-attr-name.html\n\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/non-nonceable-elements-attr-name-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/non-nonceable-elements-attr-name.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/non-nonceable-elements-expected.txt:\n* Source/WebCore/dom/Element.cpp:\n(WebCore::Element::isNonceable const):\n\nCanonical link: https://commits.webkit.org/320263@main",
      "email": "roberto_rodriguez2@apple.com",
      "hash": "62a36ef359deece63965b787edd9ec1c9cb76381",
      "subject": "[CSP] Nonce-based CSP is bypassed by dangling markup placed before a nonced \u003clink\u003e"
    },
    "320264@main": {
      "author": "Kai Tamkun",
      "avatar": "https://www.gravatar.com/avatar/dff073cba21885df4d9f73ed3cc493c2?d=identicon\u0026s=64",
      "cl": "320264@main",
      "clUrl": "https://commits.webkit.org/320264@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316996\nrdar://177699255\n\nReviewed by Yijia Huang.\n\nThis patch fixes a mistake where firstCharacterAdditionalReadSize isn't added\nto the index register in YarrJIT during backtracking.\n\nTest: JSTests/stress/yarr-jit-non-bmp-backtrack-index-underflow.js\n\n* JSTests/stress/yarr-jit-non-bmp-backtrack-index-overflow.js: Added.\n* JSTests/stress/yarr-jit-non-bmp-backtrack-index-underflow.js: Added.\n* Source/JavaScriptCore/runtime/RegExpMatchesArray.h:\n(JSC::createRegExpMatchesArray):\n* Source/JavaScriptCore/yarr/YarrJIT.cpp:\n\nOriginally-landed-as: 305413.1108@safari-7624.5-branch (30b9a27b47e8). rdar://185367107\nCanonical link: https://commits.webkit.org/320264@main",
      "email": "k_tamkun@apple.com",
      "hash": "8f069ce3b3ce2fda5f7cd113f145ee1abb3b26e0",
      "subject": "[JSC] YarrJIT non-BMP backtrack trampoline (L\u003eF branch) does not add firstCharacterAdditionalReadSize to index, returns start \u003e end"
    },
    "320265@main": {
      "author": "Andrew Martinez",
      "avatar": "https://www.gravatar.com/avatar/d58ff221561ad2151fff7f123f9c8647?d=identicon\u0026s=64",
      "cl": "320265@main",
      "clUrl": "https://commits.webkit.org/320265@main",
      "description": "rdar://186287743\nhttps://bugs.webkit.org/show_bug.cgi?id=323026\n\nReviewed by Tim Nguyen.\n\nThe size shorthand for width/height added shipped without a\nfeature flag. The property is still being drafted (css-sizing-4, tracked by\nw3c/csswg-drafts#820), so it should be enabled in Technology Preview rather than shipped.\n\nCreated a CSSSizeShorthandEnabled setting for preview. This gates the shorthand while leaving\nthe width / height longhands and @page`page_size` descriptor the same when this flag is disabled.\nThe consumePageDescriptor special case is no longer needed after this change.\n\nAdding this flag introduced the regression that CSSParser::consumeDeclaration runs isExposed()\ncheck before `size` is remapped to internal `page_size` descriptor. So the downstream remapping never occurs,\nwhich breaks @page `size`. This logic is placed before the isExposed() guard to prevent this effect.\n\nFurthermore, edited nested-declarations as the coalescing behavior is no longer present.\nMeaning this test can be restored to it's original form. Lastly, the webkit serialization test is replaced\nwith a tentative WPT test.\n\nTests: fast/css/size-shorthand-disabled.html\n       imported/w3c/web-platform-tests/css/css-sizing/size-shorthand-serialization.tentative.html\n\n* LayoutTests/fast/css/size-shorthand-disabled-expected.txt: Added.\n* LayoutTests/fast/css/size-shorthand-disabled.html: Added.\n* LayoutTests/fast/css/size-shorthand-serialization-expected.txt: Removed.\n* LayoutTests/fast/css/size-shorthand-serialization.html: Removed.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-nesting/nested-declarations-cssom.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-sizing/size-shorthand-serialization.tentative-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-sizing/size-shorthand-serialization.tentative.html: Added.\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebCore/css/CSSProperties.json:\n* Source/WebCore/css/parser/CSSParser.cpp:\n(WebCore::CSSParser::consumeDeclaration):\n* Source/WebCore/css/parser/CSSPropertyParser.cpp:\n(WebCore::consumePageDescriptor):\n\nCanonical link: https://commits.webkit.org/320265@main",
      "email": "amartinez55@apple.com",
      "hash": "3027d46f2e7cddb537f9591127d8186dbaa720f3",
      "subject": "[css-sizing] The size shorthand needs a feature flag"
    },
    "320266@main": {
      "author": "Fady Farag",
      "avatar": "https://www.gravatar.com/avatar/0ac5127c69f90d0c57054173ae4c3108?d=identicon\u0026s=64",
      "cl": "320266@main",
      "clUrl": "https://commits.webkit.org/320266@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322779\nrdar://186041838\n\nReviewed by Keith Miller.\n\nriscLowerTest lowers every masked test-and-branch:\n\n    btpnz t0, 8, .foo\n\ninto an and into a temporary followed by a compare-and-branch on it:\n\n    and x13, x0, #8\n    cbnz x13, .foo\n\nWhen the mask is a single bit, ARM64 has an instruction for exactly this:\n\n    tbnz x0, #3, .foo\n\nOnly local-label targets are folded.\n\n* Source/JavaScriptCore/offlineasm/arm64.rb:\n* Source/JavaScriptCore/offlineasm/risc.rb:\n\nCanonical link: https://commits.webkit.org/320266@main",
      "email": "com.webkit.iidmsa@gmail.com",
      "hash": "1c91665ec948f498eab32a5662143ac9affd10f7",
      "subject": "[JSC] offlineasm: emit tbz/tbnz for single-bit test branches on ARM64"
    },
    "320267@main": {
      "author": "Keith Miller",
      "avatar": "https://www.gravatar.com/avatar/bddc1595b29098429a6ce7c8bf4aced2?d=identicon\u0026s=64",
      "cl": "320267@main",
      "clUrl": "https://commits.webkit.org/320267@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323135\nrdar://186395279\n\nReviewed by Zak Ridouh and Abrar Rahman Protyasha.\n\n* Source/WebKit/CMakeLists.txt:\n    Add missing RunJavaScriptResult.swift source to the Sources list.\n\nCanonical link: https://commits.webkit.org/320267@main",
      "email": "keith_miller@apple.com",
      "hash": "0a33da2523d85eb9e902e5a5f5c5e62d2b3579e6",
      "subject": "[CMake] Add missing RunJavaScriptResult.swift source"
    },
    "320268@main": {
      "author": "Franco Vieira de Souza",
      "avatar": "https://www.gravatar.com/avatar/14ed77684c1591a07649be8495cc0ddb?d=identicon\u0026s=64",
      "cl": "320268@main",
      "clUrl": "https://commits.webkit.org/320268@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=323112\nrdar://186371399\n\nReviewed by Zak Ridouh and Tim Nguyen.\n\nQuirk seems outdated:\n - document.querySelector('.webPlayerSDKUiContainer') returns nothing,\n   so the quirk doesn't match anything (see StyleAdjuster.cpp)\n - Cannot reproduce the behavior described on rdar://128962002 by\n   disabling site-specific quirks. (also tried with a disabled\n   \"unprefixed user select\")\n\n* LayoutTests/fast/quirks/active-quirks-by-domain-expected.txt:\n* LayoutTests/platform/mac-sequoia/fast/quirks/active-quirks-by-domain-expected.txt:\n* LayoutTests/platform/mac-tahoe/fast/quirks/active-quirks-by-domain-expected.txt:\n* Source/WebCore/page/QuirkNames.h:\n* Source/WebCore/page/QuirkTable.cpp:\n* Source/WebCore/page/Quirks.cpp:\n* Source/WebCore/page/Quirks.h:\n* Source/WebCore/style/StyleAdjuster.cpp:\n(WebCore::Style::Adjuster::adjustForSiteSpecificQuirks const):\n\nCanonical link: https://commits.webkit.org/320268@main",
      "email": "franco_vieira@apple.com",
      "hash": "2e870702ed8dede211eee49c127422f392c3148c",
      "subject": "Remove Prime Video user-select quirk"
    },
    "320269@main": {
      "author": "Qianlang Chen",
      "avatar": "https://www.gravatar.com/avatar/0fd54e904334f604739d0205aa6e2130?d=identicon\u0026s=64",
      "cl": "320269@main",
      "clUrl": "https://commits.webkit.org/320269@main",
      "description": "rdar://185838038\nhttps://bugs.webkit.org/show_bug.cgi?id=322541\n\nReviewed by BJ Burg.\n\nRemove the storage-frontend-gate.html layout test that's currently\nfailing, as it tried to test a behavior that was not valid:\n\nIt asserted that WI.storageManager.shouldUseStorageDomain is false at\nstartup and flips to true once a cross-origin iframe becomes its own\nframe target. This is incorrect. First, Site Isolation is forced on\nfor the whole test since it's in the site-isolation/inspector/ test\nsuite, so there is no \"before Site Isolation is active\" state to\nobserve. But more importantly, under SI, the main frame also surfaces\na frame target, so the gate is already true when the frontend\nconnects. The gate is not meant to flip partway through a session due\nto a cross-origin iframe loading.\n\nWhat the test meant to verify is already covered by the adjacent\nstorage-get-cookies-cross-origin-iframe.html, which observes the correct\nbehavior of the feature rather than the frontend flag: it checks that\nStorage.getCookies sees a cookie set by script inside a cross-origin\niframe and that Page.getCookies does not.\n\n* LayoutTests/http/tests/site-isolation/inspector/storage/storage-frontend-gate-expected.txt: Removed.\n* LayoutTests/http/tests/site-isolation/inspector/storage/storage-frontend-gate.html: Removed.\n* LayoutTests/platform/mac-site-isolation/TestExpectations:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320269@main",
      "email": "qianlangchen@apple.com",
      "hash": "79d2c1780410b725f1dcaace7c5033198825a784",
      "subject": "[Site Isolation] Web Inspector: Remove the invalid storage-frontend-gate.html test"
    },
    "320270@main": {
      "author": "Justin Michaud",
      "avatar": "https://www.gravatar.com/avatar/36e0433ee725a08f7e1122a6bc584b57?d=identicon\u0026s=64",
      "cl": "320270@main",
      "clUrl": "https://commits.webkit.org/320270@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=321753\n\nReviewed by Claudio Saavedra.\n\nSimplify the lifecycle of the libpng callbacks so that we\ndon't confuse frames and read more pixels than we should.\n\nCanonical link: https://commits.webkit.org/320270@main",
      "email": "jmichaud@igalia.com",
      "hash": "56c0a88ac8c4b8b4a3da0bcd7a73d88c54420e07",
      "subject": "[non-cocoa][fuzz] OOB read in APNG with hidden default image"
    },
    "320271@main": {
      "author": "Qianlang Chen",
      "avatar": "https://www.gravatar.com/avatar/0fd54e904334f604739d0205aa6e2130?d=identicon\u0026s=64",
      "cl": "320271@main",
      "clUrl": "https://commits.webkit.org/320271@main",
      "description": "rdar://184962162\nhttps://bugs.webkit.org/show_bug.cgi?id=321822\n\nReviewed by BJ Burg.\n\ndidCommitLoadImpl notified both Page providers for the same commit: the\nin-process InspectorPageAgent and the per-frame PageAgentProxy. The\nfrontend's PageObserver is target-agnostic, so both land in the same\nframeDidNavigate, and the second report is destructive rather than\nidempotent -- the frontend treats a same-loaderId/same-url repeat as\nconfirmation that nothing changed and re-initializes the frame, which\nunconditionally clears its resources, child frames, execution contexts\nand provisional load. Worst case is nested frames, where a parent's\nduplicate arriving after its children attached detaches a live subtree.\n\nSo dispatch to the proxy or to the in-process agent, never both. Both\ngetters resolve from that one call site because didCommitLoad passes the\n*frame's* InstrumentingAgents: ensurePageInstrumentationForFrame\nregisters the proxy there, InspectorPageAgent is registered on the\npage's instance, and the getters fall back page-ward when the\nframe-level slot is unset.\n\nThe if / else if mirrors how the Runtime domain already resolves the\nsame question for didClearWindowObjectInWorld: when the frame has a\nFrameRuntimeAgent, it reports and the page-level agent is skipped.\nNetwork solved it differently, by refusing to enable the in-process\nagent at all, which Page cannot copy: InspectorPageAgent still serves\nnearly every Page command, and domContentEventFired, loadEventFired,\nloaderDetachedFromFrame, accessibilitySettingsDidChange and\ndefaultAppearanceDidChange have no proxy path. Only frameNavigated\nmoves.\n\nNot emitting the page agent's event also drops a side effect:\nbuildObjectForFrame() called frameId(), which is the only place either\nIdentifierRegistry populates its reverse map, so that call was what made\nthe frame resolvable by frameForId() / assertFrame() afterwards. The\nproxy does not replace it -- it sends the raw FrameIdentifier and the\nprotocol string is computed in the UIProcess, so nothing in the\nWebProcess would assign an id, and every page-target command taking a\nframeId (Page.getResourceContent, Page.searchInResource, and the CSS and\nDOM paths that use the registry directly) would start failing with\n\"Missing frame for given frameId\". PageAgentProxy::frameNavigated\ntherefore registers the frame itself, which keeps the coupling in the\ncode that took over the reporting duty and does not depend on the Page\nagent being enabled: the registry belongs to PageInspectorController,\nand CSS and DOM need it whether or not the Page domain is in use.\n\nTest: http/tests/site-isolation/inspector/page/frame-navigated-single-report-same-origin-iframe.html\n\nThe test counts raw Page.frameNavigated payloads at the observer,\nbecause a duplicate leaves no trace in the frame model once\nWI.Frame.initialize() has run, then checks that the frame tree, the\nchild frame's subresource, and page-target frameId resolution all\nsurvive the commits.\n\n* LayoutTests/http/tests/site-isolation/inspector/page/frame-navigated-single-report-same-origin-iframe-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/page/frame-navigated-single-report-same-origin-iframe.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/page/resources/frame-navigated-subframe-style.css: Added.\n(p):\n* LayoutTests/http/tests/site-isolation/inspector/page/resources/same-origin-frame-with-grandchild.html: Added.\n* Source/WebCore/inspector/InspectorIdentifierRegistry.h:\n(Inspector::IdentifierRegistry::registerFrame):\n* Source/WebCore/inspector/InspectorInstrumentation.cpp:\n(WebCore::InspectorInstrumentation::didCommitLoadImpl):\n* Source/WebKit/WebProcess/Inspector/PageAgentProxy.cpp:\n(WebKit::PageAgentProxy::frameNavigated):\n\nCanonical link: https://commits.webkit.org/320271@main",
      "email": "qianlangchen@apple.com",
      "hash": "42583e7e49eb6eefa2a0ead1255d01e793d0689f",
      "subject": "[Site Isolation] Web Inspector: Don't report duplicate Page.frameNavigated events per frame commit"
    },
    "320272@main": {
      "author": "Qianlang Chen",
      "avatar": "https://www.gravatar.com/avatar/0fd54e904334f604739d0205aa6e2130?d=identicon\u0026s=64",
      "cl": "320272@main",
      "clUrl": "https://commits.webkit.org/320272@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=322549\nrdar://185268264\n\nReviewed by BJ Burg.\n\nWhen the frontend attaches to an already-loaded page, the Storage tab\nlists a cookie bucket for a cross-origin iframe's host but shows no\ncookies in it. Reloading with the inspector open makes them appear.\n\nReading the cookies already works: Storage.getCookies on the UIProcess\ntarget serves the authoritative NetworkProcess store, which does include\ncookies belonging to out-of-process frames. The frontend then discarded\nthem. Instead of bucketing by cookie domain, the view re-filtered that\nlist against the URLs of the resources in its frame model, requiring\namong other things that a resource's path start with the cookie's path.\nAt attach time the only resource the frame model has for an\nout-of-process frame is the RemoteFrame stub from Page.getResourceTree,\nwhose URL is the bare security origin; its path is therefore \"/\", and\nevery cookie with a directory-scoped default path is rejected. A reload\nreplaces the stub with the real document URL, which is why reloading\nlooks like a fix.\n\nBucket by cookie domain alone on the Storage path. Re-filtering an\nauthoritative, process-independent cookie list against what one\nWebContent process happens to have loaded reintroduces the in-process\nassumption that adopting the Storage domain was meant to escape, and it\nhides cookies that genuinely exist even without site isolation. The\nlegacy Page path keeps its resource matching so that non-site-isolation\nsessions see exactly what they saw before. The visible difference is\nthat the cookie's path and Secure attributes no longer act as filters:\na cookie scoped to a path the page never loaded, or a Secure cookie on\na page loaded over http, is now listed under its host. The table has\nPath and Secure columns precisely so that scope stays visible. Buckets\nstill come only from frame hosts, so this is not yet a complete view of\nthe store.\n\nThe rule lives on WI.CookieStorageObject alongside canGetCookies and\ngetCookies, and gathers the resources the legacy path needs itself, so\nthe view no longer touches the frame model and the rule is testable\nwithout a view. For the same reason the sidebar now asks\nWI.CookieStorageObject whether cookies can be read at all rather than\ntesting for Page.getCookies: its buckets should not disappear when the\npage target stops serving cookie commands.\n\nFixing the stub is separate work that this patch does not do, and the\ncookie panel should no longer depend on it either way. The frame model\nbootstraps from a single Page.getResourceTree on the page target, which\nruns in the main frame's process and cannot describe a frame hosted\nelsewhere; the stub is the most that agent can report. The gap is that\nProxyingPageAgent on the UIProcess already assembles an aggregated tree\nspanning every process of the page, with layout test coverage, and no\nproduction code asks for it. Cookies were one consumer of the stub; the\nNetwork tab is a more visible one, where the iframe's subresources are\nmissing and its main resource has an empty display name. Tracked in\nwebkit.org/b/322556.\n\nTest: inspector/unit-tests/cookie-storage-object.html\n\nAn end-to-end \"attach after load\" test is not expressible in the layout\ntest harness, which calls testRunner.showWebInspector() once before the\nload event and offers no supported detach and reattach, so the new test\ncovers the filtering rule directly in both directions. The reported\ncase was verified by hand in MiniBrowser.\n\n* LayoutTests/inspector/unit-tests/cookie-storage-object-expected.txt: Added.\n* LayoutTests/inspector/unit-tests/cookie-storage-object.html: Added.\n* Source/WebInspectorUI/UserInterface/Controllers/DOMStorageManager.js:\n(WI.DOMStorageManager.prototype._addCookieStorageIfNeeded):\n* Source/WebInspectorUI/UserInterface/Models/CookieStorageObject.js:\n(WI.CookieStorageObject.get canGetCookies):\n(WI.CookieStorageObject.prototype.get canGetCookies):\n(WI.CookieStorageObject.prototype.getCookies):\n(WI.CookieStorageObject.prototype.filterCookiesForHost):\n(WI.CookieStorageObject.prototype._resourcesForHost):\n(WI.CookieStorageObject):\n* Source/WebInspectorUI/UserInterface/Views/CookieStorageContentView.js:\n(WI.CookieStorageContentView.prototype._reloadCookies):\n(WI.CookieStorageContentView.prototype._getCookiesForHost): Deleted.\n\nCanonical link: https://commits.webkit.org/320272@main",
      "email": "qianlangchen@apple.com",
      "hash": "644fa28b6001b27f16668c525e3b4f5216ed6cc5",
      "subject": "[Site Isolation] Web Inspector: Cross-origin cookies are missing in Storage until reloading with inspector open"
    },
    "320273@main": {
      "author": "Qianlang Chen",
      "avatar": "https://www.gravatar.com/avatar/0fd54e904334f604739d0205aa6e2130?d=identicon\u0026s=64",
      "cl": "320273@main",
      "clUrl": "https://commits.webkit.org/320273@main",
      "description": "rdar://184285425\nhttps://bugs.webkit.org/show_bug.cgi?id=321238\n\nReviewed by BJ Burg.\n\nA frame with no owner element has nothing to splice into, and the main\nframe never has one, so under Site Isolation at least one document\nalways stays pending. Once anything was pending, the frontend walked the\npage body's children looking for an owner element, which delivers nodes\nnothing asked for, along with whatever other agents attach to them.\n\nThat is observable: inspector/css/setLayoutContextTypeChangedMode.html\nfailed its first assertion under Site Isolation, because the walk\ndelivered the page's `display: grid` element and its layout flag before\nthe test queried the document. It now passes.\n\nNothing depends on the walk. It requested the body's children at the\ndefault depth of one, so it could only ever reach an iframe that is a\ndirect child of `\u003cbody\u003e`, and for that shape the retries on node arrival\nsplice the document as soon as anything expands the tree that far. The\none flow that might have relied on the walk running first, revealing a\nnode inside a cross-origin iframe, does not reach the tree at all:\nDOMObserver drops `DOM.inspect` for frame targets before any node lookup\nhappens.\n\nSo drop the walk and let the retries on node arrival be the only\nmechanism. They cannot help a document that has no owner element, nor\none whose owner element already carries a contentDocument from the page\ntarget, but neither could the walk.\n\nOne retry was missing: children arriving for a frame target's own tree\ndid not trigger one, which left a nested cross-origin iframe's document\nunspliced. Nothing changes with Site Isolation off, where no frame\ntargets are created and the pending list stays empty.\n\nThe new test covers both halves of the contract: attaching frame targets\nloads no page nodes on its own, and a pending document is spliced once\nits owner element arrives, including when that element belongs to\nanother frame target's tree.\n\nTest: http/tests/site-isolation/inspector/dom/frame-document-splicing-frame-target.html\n\n* LayoutTests/http/tests/site-isolation/inspector/dom/frame-document-splicing-frame-target-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/dom/frame-document-splicing-frame-target.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/dom/resources/splice-child-frame.html: Added.\n* Source/WebInspectorUI/UserInterface/Controllers/DOMManager.js:\n(WI.DOMManager):\n(WI.DOMManager.prototype._spliceFrameDocumentIntoPageTree):\n(WI.DOMManager.prototype._frameTargetSetChildNodes):\n(WI.DOMManager.prototype._setDocument):\n(WI.DOMManager.prototype._ensurePageBodyChildrenLoaded): Deleted.\n\nCanonical link: https://commits.webkit.org/320273@main",
      "email": "qianlangchen@apple.com",
      "hash": "ba42a3f3016687939dcd04e4de7c53d876eadab6",
      "subject": "[Site Isolation] Web Inspector: Attaching a frame target loads unrequested page DOM nodes"
    },
    "320274@main": {
      "author": "Anand Srinivasan",
      "avatar": "https://www.gravatar.com/avatar/84643a20c269974c2df6681742daf0a4?d=identicon\u0026s=64",
      "cl": "320274@main",
      "clUrl": "https://commits.webkit.org/320274@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315389\nrdar://176792415\n\nReviewed by Keith Miller.\n\nB3 ccmp chain matcher needs to roll back if a given pattern match fails\npart way through. RAII is a more principled and less error prone way to\nhandle this.\n\nTest: JSTests/stress/b3-ccmp-chain.js\n\n* JSTests/stress/b3-ccmp-chain.js: Added.\n(f):\n(f_legit_chain):\n* Source/JavaScriptCore/b3/B3LowerToAir.cpp:\n* Source/JavaScriptCore/b3/testb3.h:\n* Source/JavaScriptCore/b3/testb3_1.cpp:\n(run):\n* Source/JavaScriptCore/b3/testb3_8.cpp:\n(testCCmpChainRollback):\n\nOriginally-landed-as: 305413.1024@safari-7624.5-branch (7e01f14f8eb7). rdar://185367009\nCanonical link: https://commits.webkit.org/320274@main",
      "email": "anand_srinivasan@apple.com",
      "hash": "65ef7f38f8f9195dd239b1cd46b98e4b0a8b6a12",
      "subject": "Make B3 ccmp chain matcher use RAII"
    }
  },
  "date": "2026-09-01",
  "days": 1,
  "generatedAt": "2026-09-01T22:06:10Z",
  "markdown": "## Highlights\n- **Security** Closed a CSP bypass where dangling markup before a nonced stylesheet could smuggle execution past nonce checks. [commit 320263@main](https://commits.webkit.org/320263@main)\n- **Security** Hardened cross-process IPC with explicit UI-process origin validation for messages from less-trusted processes. [commit 320248@main](https://commits.webkit.org/320248@main)\n- **Security** Added `IPC::Untrusted\u003cT\u003e` so privileged code has to treat attacker-controlled values as untrusted by construction. [commit 320234@main](https://commits.webkit.org/320234@main)\n- **Rendering** Landed `flex-wrap: balance`, giving multi-line flex layouts a new line-breaking mode aimed at more even wrapping. [commit 320259@main](https://commits.webkit.org/320259@main)\n- **Perf** Shrunk `TransformationMatrix` IPC payloads, cutting cross-process transfer size on a hot graphics path. [commit 320258@main](https://commits.webkit.org/320258@main)\n- **V8** JavaScriptCore kept chipping away at JIT and runtime overhead with smaller FTL OSR exits, better ARM64 branch emission, and tighter megamorphic stores. [commit 320245@main](https://commits.webkit.org/320245@main)\n- **UI** Site Isolation cleanup fixed several Web Inspector correctness bugs, including duplicate frame navigation events and missing cross-origin storage state. [commit 320271@main](https://commits.webkit.org/320271@main)\n- **Media** MediaRecorder now starts a segment from a lone video keyframe instead of waiting forever for a more complete GOP. [commit 320219@main](https://commits.webkit.org/320219@main)\n- **Mobile** iOS and iPad work fixed real user-facing rough edges, including misplaced media context menus and a WebEx layout quirk that could strand content off-screen. [commit 320249@main](https://commits.webkit.org/320249@main)\n\n## What landed by area\n\n### JavaScriptCore and Wasm\n- **Perf** B3's `ccmp` chain matcher now uses RAII, tightening lifetime management in a low-level optimizer path. [commit 320274@main](https://commits.webkit.org/320274@main)\n- **Perf** `offlineasm` now emits `tbz` and `tbnz` for single-bit test branches on ARM64. [commit 320266@main](https://commits.webkit.org/320266@main)\n- **Security** Fixed a YarrJIT non-BMP backtrack trampoline bug that could compute invalid bounds. [commit 320264@main](https://commits.webkit.org/320264@main)\n- **Security** IPInt now correctly handles overlong LEB128 encodings for `br_on_cast` and `br_on_cast_fail`. [commit 320255@main](https://commits.webkit.org/320255@main)\n- **Perf** FTL OSR exit `ValueRep` data is now stored as a byte stream, shrinking `FTL::OSRExit`. [commit 320245@main](https://commits.webkit.org/320245@main)\n- **Perf** A prototype accessor no longer poisons the megamorphic store cache as broadly as before. [commit 320236@main](https://commits.webkit.org/320236@main)\n- **Perf** Wasm constant non-cell stores can now elide a write barrier. [commit 320218@main](https://commits.webkit.org/320218@main)\n- **Web Platform** `Temporal.ZonedDateTime.prototype.round` now resolves rounded wall-clock time with the correct minute-rounded offset. [commit 320217@main](https://commits.webkit.org/320217@main)\n- **Web Platform** Yarr fixed a `/v` class-set parsing bug where a following character could inject `U+0000`. [commit 320216@main](https://commits.webkit.org/320216@main)\n- **Web Platform** `WebAssembly.Exception` now rejects null options and accepts non-object options per spec. [commit 320215@main](https://commits.webkit.org/320215@main)\n- **Refactor** Removed `SnippetReg` from JSC internals. [commit 320209@main](https://commits.webkit.org/320209@main)\n- **Refactor** Removed `JSValueRegs` as part of ongoing register-model cleanup. [commit 320197@main](https://commits.webkit.org/320197@main)\n- **Security** Fixed Structure transition checking bugs in JSC object shape handling. [commit 320251@main](https://commits.webkit.org/320251@main)\n\n### CSS, layout, animation, and rendering\n- **Web Platform** The `size` shorthand is now correctly guarded by a feature flag. [commit 320265@main](https://commits.webkit.org/320265@main)\n- **Rendering** Explicitly placed Grid Lanes items no longer incorrectly advance the auto-placement cursor. [commit 320253@main](https://commits.webkit.org/320253@main)\n- **Rendering** View-timeline animations now update when scrollable overflow changes the scroll range. [commit 320244@main](https://commits.webkit.org/320244@main)\n- **Rendering** Resuming a paused, seeked animation after a rate-adjusted animation no longer spuriously finishes it. [commit 320238@main](https://commits.webkit.org/320238@main)\n- **Rendering** Changing `timeline-scope` values now updates scroll-driven timelines globally. [commit 320231@main](https://commits.webkit.org/320231@main)\n- **Rendering** Style-originated timelines outside the `timeline-scope` hierarchy now correctly become inactive. [commit 320227@main](https://commits.webkit.org/320227@main)\n- **Web Platform** SVG number attributes now revert to their initial value when removed or made invalid. [commit 320226@main](https://commits.webkit.org/320226@main)\n- **Rendering** Ancestor-established timelines now win over timelines that are only visible through `timeline-scope`. [commit 320223@main](https://commits.webkit.org/320223@main)\n- **Rendering** Highlight color now inherits as `StyleColor`, improving style resolution consistency. [commit 320228@main](https://commits.webkit.org/320228@main)\n- **Web Platform** `accent-color: auto` no longer resolves to `currentColor`. [commit 320200@main](https://commits.webkit.org/320200@main)\n- **Rendering** SVG conditional processing attributes on `clipPath`, `mask`, and `pattern` no longer wrongly block those resources from being referenced. [commit 320207@main](https://commits.webkit.org/320207@main)\n- **Rendering** SMIL presentation-attribute animation is now released when the element is detached mid-animation, fixing a leak. [commit 320199@main](https://commits.webkit.org/320199@main)\n- **Rendering** Font code now uses a font's `usedSize` terminology instead of `computedSize`, clarifying actual rendered size semantics. [commit 320257@main](https://commits.webkit.org/320257@main)\n\n### Site Isolation, Web Inspector, and process model\n- **DevTools** Attaching a frame target in Web Inspector no longer loads DOM nodes the frontend did not request. [commit 320273@main](https://commits.webkit.org/320273@main)\n- **DevTools** Cross-origin cookies now appear in Storage without needing a reload with Inspector already open. [commit 320272@main](https://commits.webkit.org/320272@main)\n- **DevTools** Inspector no longer reports duplicate `Page.frameNavigated` events for a single frame commit. [commit 320271@main](https://commits.webkit.org/320271@main)\n- **DevTools** Removed an invalid Site Isolation storage frontend test instead of carrying a bad expectation. [commit 320269@main](https://commits.webkit.org/320269@main)\n- **Mobile** Zoom-to-reveal now positions focused elements correctly when selection lives in a cross-origin iframe. [commit 320242@main](https://commits.webkit.org/320242@main)\n- **Rendering** Fixed a Site Isolation WPT around preserving iframe scroll offset when `display:none` enters the picture. [commit 320230@main](https://commits.webkit.org/320230@main)\n- **UI** Find-in-page no longer reports the number of matching Web processes as the match count. [commit 320196@main](https://commits.webkit.org/320196@main)\n- **Rendering** Fixed Site Isolation failures around text field selection stroke color rendering. [commit 320193@main](https://commits.webkit.org/320193@main)\n- **Rendering** Fixed Site Isolation failures around inactive-window text field selection stroke color rendering. [commit 320191@main](https://commits.webkit.org/320191@main)\n- **Networking** Fixed a Site Isolation page cache XHR test involving a loading iframe. [commit 320190@main](https://commits.webkit.org/320190@main)\n\n### Media, graphics, GPU, and canvas\n- **Security** Fixed an out-of-bounds read in APNG decoding when a hidden default image is present. [commit 320270@main](https://commits.webkit.org/320270@main)\n- **GPU** `NativeImage` can now be constructed directly from `PixelBuffer`. [commit 320240@main](https://commits.webkit.org/320240@main)\n- **GPU** GTK and WPE fixed `ShouldPremultiply` handling in the Skia compositor's RGB coordinated layer buffer path. [commit 320233@main](https://commits.webkit.org/320233@main)\n- **GPU** Re-enabled a WebGL texture conformance test around uploading video on a non-zero texture unit. [commit 320232@main](https://commits.webkit.org/320232@main)\n- **DevTools** Web Inspector's `shaderProgram` test helper now reuses its canvas across `createProgram()` calls. [commit 320221@main](https://commits.webkit.org/320221@main)\n- **Media** A lone video keyframe can now start a MediaRecorder segment instead of being buffered forever. [commit 320219@main](https://commits.webkit.org/320219@main)\n- **DevTools** Rebaselined WebGL2 recording snapshots for per-type recorded object identifiers. [commit 320211@main](https://commits.webkit.org/320211@main)\n- **GPU** RGB8 color buffers are now read as RGBA, and console suppression was restored in a WebGL2 texture upload test. [commit 320210@main](https://commits.webkit.org/320210@main)\n- **GPU** A placeholder canvas with no pushed frame now returns transparent black. [commit 320202@main](https://commits.webkit.org/320202@main)\n- **GPU** Out-of-bounds compressed texture dimensions now correctly raise `INVALID_VALUE`. [commit 320192@main](https://commits.webkit.org/320192@main)\n- **Media** PDF.js rolled forward to v6.3.289. [commit 320195@main](https://commits.webkit.org/320195@main)\n- **Rendering** Removed a stale mac baseline for `oes-element-index-uint.html`. [commit 320212@main](https://commits.webkit.org/320212@main)\n- **Rendering** Fixed a glib OffscreenCanvas WPT around `offscreencanvas.resize.html`. [commit 320224@main](https://commits.webkit.org/320224@main)\n\n### Platform UI, app integration, and quirks\n- **UI** Removed the Prime Video `user-select` quirk, a good sign that the site no longer needs special handling. [commit 320268@main](https://commits.webkit.org/320268@main)\n- **Mobile** iOS media control context menus no longer appear at the wrong location when Site Isolation is on. [commit 320249@main](https://commits.webkit.org/320249@main)\n- **UI** GLib now exposes PDF context menu actions through the public API. [commit 320247@main](https://commits.webkit.org/320247@main)\n- **Mobile** WebEx UI got another quirk fix so content fits on screen even when the page disables scrolling. [commit 320204@main](https://commits.webkit.org/320204@main)\n- **UI** Fixed a retain cycle leaking `WKSelectPicker` actions. [commit 320203@main](https://commits.webkit.org/320203@main)\n- **Web Platform** `setCustomValidity()` now simplifies newlines in `FormListedElement`, matching expected validation string behavior. [commit 320235@main](https://commits.webkit.org/320235@main)\n- **Privacy** Extension service workers now keep track of clients correctly across unload and reload cycles. [commit 320198@main](https://commits.webkit.org/320198@main)\n\n### Build, CMake, ports, and infrastructure\n- **Build** CMake now includes the missing `RunJavaScriptResult.swift` source. [commit 320267@main](https://commits.webkit.org/320267@main)\n- **Build** Injected bundle tests in the TestWebKitAPI CMake build are fixed again. [commit 320262@main](https://commits.webkit.org/320262@main)\n- **Build** CMake developer mode now enables `-Werror` globally. [commit 320261@main](https://commits.webkit.org/320261@main)\n- **Build** Added missing TestWebKitAPI headers to unblock build errors. [commit 320252@main](https://commits.webkit.org/320252@main)\n- **Build** `WebKitLegacy` no longer links `libPAL.a` under CMake. [commit 320243@main](https://commits.webkit.org/320243@main)\n- **Build** visionOS CMake build failures were fixed. [commit 320239@main](https://commits.webkit.org/320239@main)\n- **Build** Safari and Swift Browser can again build against a WebKit produced with CMake. [commit 320237@main](https://commits.webkit.org/320237@main)\n- **Build** Incremental Swift builds now invalidate stale objects when imported C++ headers change. [commit 320229@main](https://commits.webkit.org/320229@main)\n- **Build** Cocoa now applies `-Wthread-safety` across all Xcode targets via `CommonBase.xcconfig`. [commit 320220@main](https://commits.webkit.org/320220@main)\n- **Build** Cleaned up Apple platform port names in `webkitdirs`. [commit 320206@main](https://commits.webkit.org/320206@main)\n- **Build** Added a new `.submitproject` filter rule so builds work on an Apple Internal system. [commit 320201@main](https://commits.webkit.org/320201@main)\n- **Build** EWS now terminates obsolete jobs as soon as their hash is superseded. [commit 320241@main](https://commits.webkit.org/320241@main)\n\n### GTK, WPE, WebDriver, and API surface\n- **Refactor** GTK and WPE now reference-count `PromiseDMABufImageContext` across threads to make ownership explicit. [commit 320246@main](https://commits.webkit.org/320246@main)\n- **UI** Fixed GTK API documentation for `webkit_web_view_call_async_javascript_function`. [commit 320222@main](https://commits.webkit.org/320222@main)\n- **Build** GTK and WPE test gardening continued with another batch of expectation cleanup. [commit 320208@main](https://commits.webkit.org/320208@main)\n- **DevTools** WebDriver BiDi `script.call_function` now trims error messages correctly. [commit 320205@main](https://commits.webkit.org/320205@main)\n- **UI** NewCodable plumbing now lets Swift call `WebPageProxy.runJavaScriptInMainFrame`. [commit 320260@main](https://commits.webkit.org/320260@main)\n\n## Reverts \u0026 Reapplies\n\nNone.",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [
    {
      "name": "Unreviewed",
      "count": 5
    }
  ],
  "since": "2026-09-01",
  "totals": {
    "commits": 85,
    "features": 80,
    "rolls": 5
  },
  "until": "2026-09-01"
}