{ "commits": { "320275@main": { "author": "Qianlang Chen", "avatar": "https://www.gravatar.com/avatar/0fd54e904334f604739d0205aa6e2130?d=identicon\u0026s=64", "cl": "320275@main", "clUrl": "https://commits.webkit.org/320275@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320937\nrdar://183968497\n\nReviewed by BJ Burg.\n\nConsole, Debugger, and Worker let their frame agent shadow the page one\nthrough a shared InstrumentingAgents slot. CSS has a slot for each and\ninstrumentation dispatches to both, so with frame targets on every\ninspection each style sheet is announced twice and the frontend tracks\ntwo objects for it.\n\nThe page-level agent stays the source for the documents it already\ncovers, and the frame agent stays silent for those: per-node CSS\ncommands are routed by the DOM node's owning target, so local content\nkeeps coming from the page target until local DOM does too. Whether a\npage-level CSS agent is live in this process is asked of it directly,\nthrough the frame's fallback to the page's InstrumentingAgents. A\ncross-origin frame's process has none, so those frames report as before.\n\nOnly the dispatch is suppressed; the agent's bookkeeping still runs, so\nit can serve commands for style sheets it does not announce. The gate\nsits in setActiveStyleSheetsForDocument, which every announcement funnels\nthrough, including the initial batch from enable().\n\nThese tests now pass under Site Isolation:\n- inspector/css/add-rule.html\n- inspector/css/createStyleSheet.html\n- inspector/css/getAllStyleSheets.html\n- inspector/css/manager-preferredInspectorStyleSheetForFrame.html\n- inspector/css/stylesheet-events-imports.html\n- inspector/css/stylesheet-events-inspector-stylesheet.html\n- inspector/css/stylesheet-events-multiple-documents.html\n\n* Source/WebCore/inspector/agents/frame/FrameCSSAgent.cpp:\n(WebCore::FrameCSSAgent::mediaQueryResultChanged):\n(WebCore::FrameCSSAgent::documentIsReportedByPageCSSAgent const):\n(WebCore::FrameCSSAgent::setActiveStyleSheetsForDocument):\n* Source/WebCore/inspector/agents/frame/FrameCSSAgent.h:\n\nCanonical link: https://commits.webkit.org/320275@main", "email": "qianlangchen@apple.com", "hash": "1acebeac3a44f0f371e40f0f61809948dc92140d", "subject": "[Site Isolation] Web Inspector: CSS style sheets are double-reported with frame targets enabled" }, "320276@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "320276@main", "clUrl": "https://commits.webkit.org/320276@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323131\nrdar://186393610\n\nReviewed by Keith Miller.\n\n320236@main allows having accessors in [[Prototype]] chain. But\nObject.freeze is not invalidating megamorphic IC when it is\nmayBePrototype(). It needs to bump the epoch since it is changing\nnon read-only properties to read-only, which changes [[Put]] operation\nresults (setting successfully or throwing an error).\n\nTest: JSTests/stress/megamorphic-store-frozen-prototype.js\n\n* JSTests/stress/megamorphic-store-frozen-prototype.js: Added.\n(shouldBe):\n(makeShape):\n(warmUp):\n(Object.freeze.put):\n(Object.freeze):\n(shouldBe.const.proto.get other):\n(shouldBe.put):\n* Source/JavaScriptCore/runtime/JSObject.cpp:\n(JSC::JSObject::freeze):\n\nCanonical link: https://commits.webkit.org/320276@main", "email": "ysuzuki@apple.com", "hash": "74d9ff91dbb7cac871307142a032f8cbefa72046", "subject": "[JSC] Object.freeze should bump megamorphic IC epoch" }, "320277@main": { "author": "Alex Christensen", "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64", "cl": "320277@main", "clUrl": "https://commits.webkit.org/320277@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322529\nrdar://185826961\n\nReviewed by Ben Nham.\n\nAnd https://bugs.webkit.org/show_bug.cgi?id=321395\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/ServiceWorkerBasic.mm:\n((ServiceWorkers, ServerTrustWithoutNetworkLoadInFrame)):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebViewServerTrustKVC.mm:\n(TEST(WKWebView, ServerTrustAfterTwoProcessSwaps)):\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/320277@main", "email": "achristensen@apple.com", "hash": "bee6ed0885f76e0e47d9760ddd2fc07d379dfc91", "subject": "Add unit test for https://bugs.webkit.org/show_bug.cgi?id=322485" }, "320278@main": { "author": "Marta Darbinyan", "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64", "cl": "320278@main", "clUrl": "https://commits.webkit.org/320278@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323143\nrdar://186402508\n\nUnreviewed test gardening\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/320278@main", "email": "darbinyan@apple.com", "hash": "0c20512cf9aa277412565650553bd8612856b480", "subject": "[Gardening]: REGRESSION(319181@main?): [iOS] TestWebKitAPI.WebAuthenticationPanel.LAMakeCredentialAllowLocalAuthenticator is a flaky timeout" }, "320279@main": { "author": "Sihui Liu", "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64", "cl": "320279@main", "clUrl": "https://commits.webkit.org/320279@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=304623\nrdar://167055660\n\nReviewed by Brent Fulgham and Per Arne Vollan.\n\nTo help understand why sometimes database file is gone.\n\n* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp:\n(WebKit::NetworkStorageManager::performEvictionForOrigin):\n(WebKit::NetworkStorageManager::performQuotaBasedEviction):\n(WebKit::NetworkStorageManager::donePrepareForTimeBasedEviction):\n* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.h:\n* Source/WebKit/NetworkProcess/storage/OriginStorageManager.cpp:\n(WebKit::OriginStorageManager::StorageBucket::deleteLocalStorageData):\n* Source/WebKit/NetworkProcess/storage/SQLiteStorageArea.cpp:\n(WebKit::SQLiteStorageArea::~SQLiteStorageArea):\n(WebKit::SQLiteStorageArea::clear):\n\nCanonical link: https://commits.webkit.org/320279@main", "email": "sihui_liu@apple.com", "hash": "6edc69af3dab35d9185b412f030a8685bca876ec", "subject": "Add logging when LocalStorage database file gets deleted" }, "320280@main": { "author": "Qianlang Chen", "avatar": "https://www.gravatar.com/avatar/0fd54e904334f604739d0205aa6e2130?d=identicon\u0026s=64", "cl": "320280@main", "clUrl": "https://commits.webkit.org/320280@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322796\nrdar://184278903\n\nReviewed by BJ Burg.\n\nOriginal patch by Alexey Proskuryakov \u003cap@apple.com\u003e; reworked to\nincorporate review feedback.\n\nA DOM node id is only unique within the agent that issued it, so\nWI.DOMManager._idToDOMNode keys frame-target nodes by their owning\ntarget, as the frame-target event handlers already do.\npushNodeToFrontend did not: it returned the raw id from the frame\ntarget's DOM.requestNode reply, and callers pass that to nodeForId, a\nlookup by scoped key. That either found nothing or found an unrelated\npage-target node with the same integer, which is no accident: the main\nframe has a frame target of its own, so its DOM is bound in both id\nspaces, each numbering from 1. Scope the id inside pushNodeToFrontend\nrather than at its call sites, so a future caller cannot repeat this.\n\nFormattedValue.createElementForNode now tests the resolved node rather\nthan the id. An id that does not resolve to a node is exactly the case\nthe fallback description text exists for, whereas testing only that the\nid was non-zero let the code go on to build a tree outline around null,\nwhich threw on treeOutline.children[0] and left the console entry blank.\n\nAs a drive-by, building the scoped key was open-coded in many places\nin the file. Add DOMManager.keyForNodeId to make the code more\nmaintainable.\n\nTest: inspector/dom/push-node-to-frontend-frame-target-id-space.html\n\n* Source/WebInspectorUI/UserInterface/Controllers/DOMManager.js:\n(WI.DOMManager.prototype._initializeFrameTarget):\n(WI.DOMManager.prototype.pushNodeToFrontend):\n(WI.DOMManager.prototype._cleanupFrameTarget):\n(WI.DOMManager.prototype.nodeForIdInFrameTarget):\n(WI.DOMManager.prototype._frameTargetSetChildNodes):\n(WI.DOMManager.prototype._frameTargetAttributeModified):\n(WI.DOMManager.prototype._frameTargetAttributeRemoved):\n(WI.DOMManager.prototype._loadFrameTargetNodeAttributes):\n(WI.DOMManager.prototype._frameTargetCharacterDataModified):\n(WI.DOMManager.prototype._frameTargetChildNodeCountUpdated):\n(WI.DOMManager.prototype._frameTargetChildNodeInserted):\n(WI.DOMManager.prototype._frameTargetChildNodeRemoved):\n(WI.DOMManager.prototype._frameTargetShadowRootPushed):\n(WI.DOMManager.prototype._frameTargetShadowRootPopped):\n(WI.DOMManager.prototype._frameTargetWillDestroyDOMNode):\n(WI.DOMManager.prototype._frameTargetCustomElementStateChanged):\n(WI.DOMManager.prototype._frameTargetPseudoElementAdded):\n(WI.DOMManager.prototype._frameTargetPseudoElementRemoved):\n(WI.DOMManager.keyForNodeId):\n* Source/WebInspectorUI/UserInterface/Views/FormattedValue.js:\n(WI.FormattedValue.createElementForNode):\n* LayoutTests/http/tests/site-isolation/inspector/dom/push-node-to-frontend-frame-target-id-space-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/dom/push-node-to-frontend-frame-target-id-space.html: Added.\n* Source/WebInspectorUI/UserInterface/Models/DOMNode.js:\n\nCanonical link: https://commits.webkit.org/320280@main", "email": "qianlangchen@apple.com", "hash": "e50f2af9ac990ce02be12a4c8eaddc7f22938b8b", "subject": "[Site Isolation]: Web Inspector: console.log of any DOM element shows nothing or an unrelated node (frame target node ids resolved against the page target)" }, "320282@main": { "author": "Charlie Wolfe", "avatar": "https://www.gravatar.com/avatar/857b3b5ff3394c31fa2689310a93dbab?d=identicon\u0026s=64", "cl": "320282@main", "clUrl": "https://commits.webkit.org/320282@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318244\nrdar://180785498\n\nReviewed by Matthew Finkel.\n\nThis relands the validation that was reverted in rdar://180738421. Telemetry indicates the\nLogUserInteraction MESSAGE_CHECK could rarely fail. It is unclear how this could happen, so it has\nbeen replaced with an early return and assertion to avoid crashing the WebContent process.\n\nTest: ipc/forged-resource-load-statistics-storage-access.html\n\n* LayoutTests/ipc/forged-resource-load-statistics-storage-access-expected.txt: Added.\n* LayoutTests/ipc/forged-resource-load-statistics-storage-access.html: Added.\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:\n(WebKit::NetworkConnectionToWebProcess::logUserInteraction):\n(WebKit::resourceLoadStatisticsContainsOnlyObservableFields):\n(WebKit::NetworkConnectionToWebProcess::resourceLoadStatisticsUpdated):\n(WebKit::NetworkConnectionToWebProcess::requestStorageAccessUnderOpener):\n\nOriginally-landed-as: 305413.1052@safari-7624.5-branch (8d9bf389bc0f). rdar://184744496\nCanonical link: https://commits.webkit.org/320282@main", "email": "charliew@apple.com", "hash": "f7540ca58a2d7d6f377168f36371cfb8f1ff0167", "subject": "Validate several ITP and storage access IPC messages" }, "320283@main": { "author": "Elliott Williams", "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64", "cl": "320283@main", "clUrl": "https://commits.webkit.org/320283@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322766\nrdar://186030053\n\nReviewed by Richard Robinson.\n\nReland of 320206@main which restores some exported subroutines needed by\ninternal tools.\n\nThe CMake build uses a \"Cocoa\" port for all Apple platforms. Remove the\nplatform-specific port names in webkitdirs. This cleans up the code to\nwork the same way that CMake does: Port is always \"Cocoa\" when building\nfor an Apple platform, and the requested SDK determines which platform.\n\nNo functional change, but this causes build-webkit to now pass\n-DPORT=Cocoa instead of the legacy `-DPORT=Mac` argument.\n\n* Tools/Scripts/webkitdirs.pm:\n(determineXcodeDestination):\n(argumentsForConfiguration):\n(sdkPlatformOSName):\n(determinePortName):\n(isIOSWebKit):\n(isTVOSWebKit):\n(isWatchOSWebKit):\n(isVisionOSWebKit):\n(isEmbeddedWebKit):\n(isAppleMacWebKit):\n(isMacCatalystWebKit):\n(isAppleCocoaWebKit):\n(willUseMacCatalystSDK):\n(willUseSimulatorSDK):\n(simulatorIdiom):\n(iosSimulatorDeviceByName):\n(simulatorRuntime):\n(findOrCreateSimulatorForIOSDevice):\n(willUseAppleTVDeviceSDK): Deleted.\n(willUseAppleTVSimulatorSDK): Deleted.\n(willUseWatchDeviceSDK): Deleted.\n(willUseWatchSimulatorSDK): Deleted.\n(willUseVisionDeviceSDK): Deleted.\n(willUseVisionSimulatorSDK): Deleted.\n(iosSimulatorRuntime): Deleted.\n(generateBuildSystemFromCMakeProject):\n\nCanonical link: https://commits.webkit.org/320283@main", "email": "emw@apple.com", "hash": "858d5fb94301a48d2dc229722f93bc0ebdc4c89a", "subject": "[Build] Clean up Apple platform port names in webkitdirs" }, "320284@main": { "author": "Abrar Rahman Protyasha", "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64", "cl": "320284@main", "clUrl": "https://commits.webkit.org/320284@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323159\nrdar://186410303\n\nUnreviewed build fix.\n\n320281@main reverted 320260@main, but the corresponding file entry in\nCMakeLists.txt persisted. This patch removes that entry.\n\nCanonical link: https://commits.webkit.org/320284@main", "email": "a_protyasha@apple.com", "hash": "6b97c98edb6740a79afc37a8837f65f66bb4bc72", "subject": "REGRESSION(320281@main): Broke the CMake build (Cannot find source file 'RunJavaScriptResult.swift')" }, "320285@main": { "author": "Jetzel Espinal", "avatar": "https://www.gravatar.com/avatar/2edd78d5d9f2f2e2e695465277634921?d=identicon\u0026s=64", "cl": "320285@main", "clUrl": "https://commits.webkit.org/320285@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323152\nrdar://186407831\n\nUnreviewed test gardening.\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320285@main", "email": "jespinal23@apple.com", "hash": "148c0105d1f7709ac45c6c588b14d422590cd67c", "subject": "[GARDENING][Tahoe DEBUG arm64] 11x imported/w3c/web-platform-tests/encrypted-media/drm-mp4-* (layout-tests) are constant crashes." }, "320286@main": { "author": "Qianlang Chen", "avatar": "https://www.gravatar.com/avatar/0fd54e904334f604739d0205aa6e2130?d=identicon\u0026s=64", "cl": "320286@main", "clUrl": "https://commits.webkit.org/320286@main", "description": "rdar://184286862\nhttps://bugs.webkit.org/show_bug.cgi?id=321240\n\nReviewed by BJ Burg.\n\nUnder site isolation FrameInspectorController::createLazyAgents() gives\nevery frame, including the main frame, its own FrameDebugger and\nFrameDebuggerAgent. At the same time PageDebugger::attachDebugger()\nreturns early and never calls Page::setDebugger(), so the page target\nstill registers a Debugger domain but that domain owns no scripts and\nnever pauses. Its commands either fail outright or silently do nothing.\n\nTest.js defines every bare window.*Agent global as\nWI.mainTarget._agents[domainName], and WI.mainTarget is the page target,\nso every DebuggerAgent.foo() and RuntimeAgent.foo() in a test reaches\nthe inert agent. This is the concrete failure mode of the existing\nFIXME on that block, webkit.org/b/201149.\n\nAdd InspectorTest.mainFrameTarget, which finds the frame target whose\nexecution context belongs to the main frame and falls back to\nWI.mainTarget. That fallback is what lets each test change be\nunconditional: the expression resolves to the frame target when one\nexists and to the page target otherwise, so the same test passes with\nsite isolation on and off without branching on it. It lives in Test.js\nrather than on WI.TargetManager because no production code needs to\nresolve a frame to its target yet; it should move once some does.\n\nWhere a test already holds the object whose target it needs, use that\nobject's target instead of the main-frame helper, since it states the\nintent more directly and stays correct for subframes: script.target in\nthe breakpoint dumping helpers and callFrame.target in the\nevaluateOnCallFrame tests.\n\nTwo further problems surfaced in the shared helpers once the commands\nreached the right agent. InspectorBackend.runAfterPendingDispatches()\nwaits only on WI.mainTarget's connection, so the barrier in dump.js\nfired before any frame-target response arrived and every test case\nemitted an empty body; it now waits on the script's own connection.\n\nSeparately, findScript() gave up as soon as a resource matched by URL,\neven when that resource had no associated scripts. Under site isolation\nthat state can be permanent. WI.Script resolves its resource once, in\nits constructor, by searching its parentFrame's resource collection, and\nparentFrame comes from the frame target's execution context. Debugger\nevents arrive on the frame target's connection while Network events\narrive on the UIProcess web-page target's connection, so scriptParsed\ncan be processed before the frontend can resolve the frame, in which\ncase _resolveResource() has no collection to search. Nothing calls\nWI.Script.associateWithResource() afterwards, so the script stays\nunassociated even once the resource is present. findScript() now keeps\nlooking past a matching-but-empty resource and falls back to the\ntargets' own script lists, which do not need that association. The\nassociation failure itself is a frontend bug beyond these tests and\nneeds its own investigation.\n\nNo expected results change. Every fix routes a command back to the agent\nthat used to handle it, so the output is byte-identical to the existing\nbaselines in both configurations.\n\nOf the 53 unexpected results in the inspector/debugger run with\n--site-isolation, 21 now pass. They all share one shape: a Debugger or\nRuntime command that only works when it reaches the agent owning the\nJavaScript it refers to, which until now went to the inert page-target\nagent instead. Among the progressed tests:\n\n- 13 come through breakpoint-options-utilities.js, which covers\n breakpoint conditions and actions. It creates a console saved value\n and then uses $n in a condition or an evaluate action, so the value\n has to be saved in the same target whose InjectedScript later\n evaluates it. Those are the eight non-native symbolic-breakpoint-*\n variants plus break-on-exception.html,\n break-on-uncaught-exception.html, setPauseOnAssertions.html,\n setPauseOnDebuggerStatements.html and setPauseOnMicrotasks.html.\n- 5 are the evaluateOnCallFrame-* tests, where only the paused target\n can evaluate against a call frame.\n- 3 install a breakpoint and so need the agent that owns the script:\n breakpoints/resolved-dump-all-pause-locations.html,\n breakpoints/resolved-dump-all-inline-script-pause-locations.html and\n stepping/stepping-pause-in-inner-step-to-parent.html, the only\n stepping test that needs a real breakpoint rather than a debugger\n statement.\n\n* LayoutTests/inspector/debugger/breakpoints/resources/dump.js:\n(TestPage.registerInitializer.addDumpAllPauseLocationsTestCaseForScript):\n(TestPage.registerInitializer):\n* LayoutTests/inspector/debugger/evaluateOnCallFrame-CommandLineAPI.html:\n* LayoutTests/inspector/debugger/evaluateOnCallFrame-emulateUserGesture-hasTransientActivation.html:\n* LayoutTests/inspector/debugger/evaluateOnCallFrame-emulateUserGesture-userIsInteracting.html:\n* LayoutTests/inspector/debugger/evaluateOnCallFrame-emulateUserGesture.html:\n* LayoutTests/inspector/debugger/evaluateOnCallFrame-exception.html:\n* LayoutTests/inspector/debugger/resources/breakpoint-options-utilities.js:\n(TestPage.registerInitializer.async suite):\n(TestPage.registerInitializer):\n* LayoutTests/inspector/debugger/resources/log-pause-location.js:\n(TestPage.registerInitializer.window.findScript):\n(TestPage.registerInitializer.window.setBreakpointsOnLinesWithBreakpointComment):\n* Source/WebInspectorUI/UserInterface/Test/Test.js:\n\nCanonical link: https://commits.webkit.org/320286@main", "email": "qianlangchen@apple.com", "hash": "0451b66aa498db7ed3be21309c90bc8bbb6391d2", "subject": "[Site Isolation] Web Inspector: inspector/debugger tests use the inert page-target" }, "320287@main": { "author": "Simon Fraser", "avatar": "https://www.gravatar.com/avatar/3763324aa0cdfa93be751c6081b8006a?d=identicon\u0026s=64", "cl": "320287@main", "clUrl": "https://commits.webkit.org/320287@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322658\nrdar://185931169\n\nReviewed by Tim Nguyen.\n\nWith larger border thickness and border-radius, adjacent corners of the inner border edge can intesect,\ncausing bad rendering with overlapping and holes.\n\nFix by implementing logic to intersect bezier paths, but we only need to support the simple, monotonic curves\nthat are used by corner-shape. `addSuperellipseCornerCurves` calls functions in CornerShapeUtilities to do this.\nThe intersection logic uses a recursive function (`appendCurveCrossings()`) with a depth limit.\n\nEven non-adjacent corners can intersect (see inner-corner-intersection003.html), which `addSuperellipseCornerCurves()`\nhandles.\n\nAdd API tests for the Bezier functions. BezierUtilitiesTests.cpp wasn't being compiled at all, so add it\nto the target.\n\nBased on work by Lilly Le (@cupidsity).\n\nTests: Tools/TestWebKitAPI/Tests/WebCore/BezierUtilitiesTests.cpp\n imported/w3c/web-platform-tests/css/css-borders/corner-shape/inner-corner-intersection001-ref.html\n imported/w3c/web-platform-tests/css/css-borders/corner-shape/inner-corner-intersection001.html\n imported/w3c/web-platform-tests/css/css-borders/corner-shape/inner-corner-intersection002-ref.html\n imported/w3c/web-platform-tests/css/css-borders/corner-shape/inner-corner-intersection002.html\n imported/w3c/web-platform-tests/css/css-borders/corner-shape/inner-corner-intersection003-ref.html\n imported/w3c/web-platform-tests/css/css-borders/corner-shape/inner-corner-intersection003.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/inner-corner-intersection001-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/inner-corner-intersection001-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/inner-corner-intersection001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/inner-corner-intersection002-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/inner-corner-intersection002-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/inner-corner-intersection002.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/inner-corner-intersection003-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/inner-corner-intersection003-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/inner-corner-intersection003.html: Added.\n* Source/WebCore/platform/graphics/BezierUtilities.cpp:\n(WebCore::trimBezierToRect):\n(WebCore::findMonotonicBezierCurvesIntersection):\n(WebCore::trimMonotonicBezierCurvesAtIntersection):\n* Source/WebCore/platform/graphics/BezierUtilities.h:\n(WebCore::BezierCurvesIntersection::isTailToHead const):\n* Source/WebCore/platform/graphics/CornerShapeUtilities.cpp:\n(WebCore::borderContourPath):\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj: Add BezierUtilitiesTests.cpp to the target; it wasn't compiled before.\n* Tools/TestWebKitAPI/Tests/WebCore/BezierUtilitiesTests.cpp:\n(TestWebKitAPI::trimAtIntersection):\n(TestWebKitAPI::TEST(BezierUtilities, TrimMonotonicCurvesLeavesSeparatedRunsAlone)):\n(TestWebKitAPI::TEST(BezierUtilities, TrimMonotonicCurvesMeetsStraightRunsAtTheirIntersection)):\n(TestWebKitAPI::TEST(BezierUtilities, TrimMonotonicCurvesFindsIntersectionAwayFromMidParameter)):\n(TestWebKitAPI::TEST(BezierUtilities, TrimMonotonicCurvesLeavesParallelRunsAlone)):\n(TestWebKitAPI::TEST(BezierUtilities, TrimMonotonicCurvesKeepsEarlierSegmentsWhole)):\n(TestWebKitAPI::TEST(BezierUtilities, TrimMonotonicCurvesLeavesRunsMeetingAtAPointAlone)):\n(TestWebKitAPI::TEST(BezierUtilities, TrimMonotonicCurvesMeetsCurvedRunsAtOnePoint)):\n(TestWebKitAPI::TEST(BezierUtilities, TrimMonotonicCurvesHandlesEmptyRuns)):\n(TestWebKitAPI::TEST(BezierUtilities, FindMonotonicCurvesReportsWhereTheIntersectionSits)):\n(TestWebKitAPI::TEST(BezierUtilities, FindMonotonicCurvesRejectsTheReversedOrdering)):\n(TestWebKitAPI::TEST(BezierUtilities, FindMonotonicCurvesDoesNotModifyTheRuns)):\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-bevel-overflow.html:\n\nCanonical link: https://commits.webkit.org/320287@main", "email": "simon.fraser@apple.com", "hash": "49ccbd38ad53774502fcb0ff8d42828e2d569d45", "subject": "[corner-shape] Incorrect rendering when inner corners intersect" }, "320289@main": { "author": "Andy Estes", "avatar": "https://www.gravatar.com/avatar/643f10f01b26fd94d03482a2013b2ea0?d=identicon\u0026s=64", "cl": "320289@main", "clUrl": "https://commits.webkit.org/320289@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323118\nrdar://138912349\n\nReviewed by Jer Noble.\n\nA page can observe AirPlay device availability by listening for\nwebkitplaybacktargetavailabilitychanged, or through remote.watchAvailability(), and our built-in\nmedia controls use these mechanisms to decide whether to show an AirPlay button. On macOS\nWebPageProxy is ultimately responsible for observing playback target availability, and when an\nAirPlay button is clicked, is responsible for presenting the target picker. However, it would\nalways send messages (e.g., changes in availability, route selection) to the main frame WebContent\nprocess. If the observing page were in a Site Isolated process it would never receive these\nmessages.\n\nFixing this bug (by teaching WebPageProxy to send playback target messages to the correct\nWebContent process) uncovered two additional bugs:\n1. WebChromeClient::showPlaybackTargetPicker returned early when there was no local main frame\n view.\n2. Mouse events were in the wrong coordinate space when passed from a Site Isolated WebContent\n process to the UI process, resulting in the target picker appearing at the wrong location.\n\nAddressed these issues by removing the early return and passing a frameID to the UI process\ninstead, which can then convert the mouse event coordinates to main frame coordinates before\npresenting the target picker.\n\nTests: http/tests/media/airplay-picker-rect-in-cross-origin-iframe.html\n http/tests/media/airplay-select-target-in-cross-origin-iframe.html\n http/tests/media/airplay-target-availability-in-cross-origin-iframe.html\n\n* LayoutTests/http/tests/media/airplay-picker-rect-in-cross-origin-iframe-expected.txt: Added.\n* LayoutTests/http/tests/media/airplay-picker-rect-in-cross-origin-iframe.html: Added.\n* LayoutTests/http/tests/media/airplay-select-target-in-cross-origin-iframe-expected.txt: Added.\n* LayoutTests/http/tests/media/airplay-select-target-in-cross-origin-iframe.html: Added.\n* LayoutTests/http/tests/media/airplay-target-availability-in-cross-origin-iframe-expected.txt: Added.\n* LayoutTests/http/tests/media/airplay-target-availability-in-cross-origin-iframe.html: Added.\n* LayoutTests/http/tests/media/resources/airplay-picker-rect-in-cross-origin-iframe-frame.html: Added.\n* LayoutTests/http/tests/media/resources/airplay-select-target-in-cross-origin-iframe-frame.html: Added.\n* LayoutTests/http/tests/media/resources/airplay-target-availability-in-cross-origin-iframe-frame.html: Added.\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/ios/TestExpectations:\n* Source/WebCore/Modules/airplay/WebMediaSessionManager.h:\n* Source/WebCore/Modules/airplay/WebMediaSessionManager.mm:\n(WebCore::WebMediaSessionManager::mockMediaPlaybackTargetPickerRect):\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::showPlaybackTargetPicker):\n* Source/WebCore/page/ChromeClient.h:\n(WebCore::ChromeClient::showPlaybackTargetPicker):\n(WebCore::ChromeClient::mockMediaPlaybackTargetPickerRect):\n* Source/WebCore/page/Page.cpp:\n(WebCore::Page::showPlaybackTargetPicker):\n(WebCore::Page::mockMediaPlaybackTargetPickerRect):\n* Source/WebCore/page/Page.h:\n* Source/WebCore/platform/mock/MediaPlaybackTargetPickerMock.cpp:\n(WebCore::MediaPlaybackTargetPickerMock::showPlaybackTargetPicker):\n* Source/WebCore/platform/mock/MediaPlaybackTargetPickerMock.h:\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::mockMediaPlaybackTargetPickerRect):\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::showPlaybackTargetPicker):\n(WebKit::WebPageProxy::mockMediaPlaybackTargetPickerRect):\n(WebKit::sendToPlaybackTargetClientProcess):\n(WebKit::WebPageProxy::Internals::setPlaybackTarget):\n(WebKit::WebPageProxy::Internals::externalOutputDeviceAvailableDidChange):\n(WebKit::WebPageProxy::Internals::setShouldPlayToPlaybackTarget):\n(WebKit::WebPageProxy::Internals::playbackTargetPickerWasDismissed):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.messages.in:\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:\n(WebKit::WebChromeClient::showPlaybackTargetPicker):\n(WebKit::WebChromeClient::mockMediaPlaybackTargetPickerRect):\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h:\n* Source/WebKitLegacy/mac/WebCoreSupport/WebChromeClient.h:\n* Source/WebKitLegacy/mac/WebCoreSupport/WebChromeClient.mm:\n(WebChromeClient::showPlaybackTargetPicker):\n\nCanonical link: https://commits.webkit.org/320289@main", "email": "aestes@apple.com", "hash": "0c1ebfc04931c043f873caf92a7af3ca0e4b02ba", "subject": "[macOS] AirPlay target pickers are non-functional in Site Isolated frames" }, "320290@main": { "author": "Dominic Mazzoni", "avatar": "https://www.gravatar.com/avatar/f76643c44a7ee3be45148e66d97ed8e4?d=identicon\u0026s=64", "cl": "320290@main", "clUrl": "https://commits.webkit.org/320290@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322998\nrdar://186015032\n\nReviewed by Tyler Wilcock.\n\naccessibleNameForNode() always passed DescendIntoContainers::No to\ntextUnderElement(), so list, table, tree and canvas children were skipped.\nThat heuristic exists so that a focusable container does not take its entire inner\ntext as its own name, which is the right behavior when deriving a name\nfrom content in the ordinary way. It is not right when the traversal\nis an aria-labelledby or aria-describedby recursion: the ACCNAME spec\nrequires the text of the whole referenced subtree is included.\n\nTests: accessibility/aria-labelledby-describedby-with-list.html\n accessibility/isolated-tree/aria-labelledby-describedby-with-list.html\n\n* LayoutTests/accessibility/aria-labelledby-describedby-with-list-expected.txt: Added.\n* LayoutTests/accessibility/aria-labelledby-describedby-with-list.html: Added.\n* LayoutTests/accessibility/isolated-tree/aria-labelledby-describedby-with-list-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/aria-labelledby-describedby-with-list.html: Added.\n* Source/WebCore/accessibility/AccessibilityNodeObject.cpp:\n(WebCore::accessibleNameForNode):\n(WebCore::AccessibilityNodeObject::textForLabelElements const):\n(WebCore::AccessibilityNodeObject::labelText const):\n(WebCore::AccessibilityNodeObject::descriptionForElements const):\n* Source/WebCore/accessibility/AccessibilityNodeObject.h:\n\nCanonical link: https://commits.webkit.org/320290@main", "email": "dm_mazzoni@apple.com", "hash": "bb09e1b5e8a67c3900c94694b1cb1bca887dbd91", "subject": "AX: VoiceOver ignores list content inside elements referenced by aria-describedby" }, "320291@main": { "author": "Qianlang Chen", "avatar": "https://www.gravatar.com/avatar/0fd54e904334f604739d0205aa6e2130?d=identicon\u0026s=64", "cl": "320291@main", "clUrl": "https://commits.webkit.org/320291@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321820\nrdar://184961104\n\nReviewed by BJ Burg and Devin Rousso.\n\nThe thunk installed for a symbolic breakpoint on a native function is\ntracked process-wide in replacedThunks(), but the symbols an agent will\nbreak on, SymbolicBreakpoint::knownMatchingSymbols, are per-agent and\nonly SymbolicBreakpoint::matches() fills them. addSymbolicBreakpoint()\nbumped the reference count of an already-installed thunk without\nevaluating the symbol, so the second agent to set the same breakpoint\nlearned nothing and never paused. That is the normal case now: the page\ntarget installs every thunk before the frame agent that owns the frame's\nJavaScript, which is the one the thunk dispatches to, ever asks.\nEvaluate the symbol on those paths too. Counting only matches also makes\nmatchCount symmetric with the paths that decrement it, which have always\nrequired a match. Fix this in the agent rather than in the frontend,\nbecause two frame agents in one process will contend the same way once\nthe page target is gone.\n\nNative constructors are InternalFunctions and take a second path, with\ntwo more bugs on it. internalFunctionWithDebuggerHook() notified every\ndebugger in the VM instead of the callee realm's, so breakpoint actions\nran once per agent; dispatch to globalObject-\u003edebugger(), matching\noperationDebuggerWillCallNativeExecutable(). And\nclearInspectorBreakpointState() had its VM check inverted there, so an\nagent released other VMs' entries instead of its own.\n\nThese Debugger domain tests now progress, each in its four exact/regex\nand case-sensitive/insensitive variants:\n- 12 that break through the native executable thunk:\n symbolic-breakpoint-call-native-dom,\n symbolic-breakpoint-call-native-js and\n symbolic-breakpoint-intrinsic-js.\n- 8 that break through the InternalFunction hook and so need both the\n symbol evaluation and the dispatch fix:\n symbolic-breakpoint-construct-native-dom and\n symbolic-breakpoint-construct-native-js.\n\n* LayoutTests/http/tests/site-isolation/inspector/debugger/resources/symbolic-breakpoint-native-frame.html: Added.\n* LayoutTests/http/tests/site-isolation/inspector/debugger/symbolic-breakpoint-native-across-frame-targets-expected.txt: Added.\n* LayoutTests/http/tests/site-isolation/inspector/debugger/symbolic-breakpoint-native-across-frame-targets.html: Added.\n* Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.cpp:\n(Inspector::internalFunctionWithDebuggerHook):\n(Inspector::InspectorDebuggerAgent::addSymbolicBreakpoint):\n(Inspector::InspectorDebuggerAgent::clearInspectorBreakpointState):\n\nCanonical link: https://commits.webkit.org/320291@main", "email": "qianlangchen@apple.com", "hash": "219e93dc77b96cb3d375ed8193f920a8d9e2f00a", "subject": "[Site Isolation] Web Inspector: Symbolic breakpoints on native functions never pause the frame target" }, "320292@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "320292@main", "clUrl": "https://commits.webkit.org/320292@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323082\nrdar://185796614\n\nReviewed by Per Arne Vollan.\n\nA single navigation re-parses, re-serializes and form-decodes its URL roughly a\ndozen times between WebCore, WebKit and CFNetwork. Almost all of it is\nredundant. This is invisible for ordinary URLs and pathological for long ones.\n\nHang reports show MobileSafari's main thread spending 2-3.6 seconds entirely\non-CPU decoding a single DecidePolicyForNavigationActionAsync message, and the\nWebContent process spending the same interval producing it. Nothing is blocked;\nthe time goes into converting one navigation URL -- whose query string is\nmegabytes long -- back and forth between WTF::URL and NSURL/CFURL.\n\nQuirks::needsConsistentQueryParameterFilteringQuirk (added in 306714@main) built\na case-folded copy of the entire URL and re-parsed it, purely to compare a host\nand a registrable domain -- two O(URL length) passes plus two allocations, on\nevery navigation, since the outer setting defaults to true. Compare\ncase-insensitively against the original URL instead. Note that URLParser only\nASCII-lowercases hosts for special schemes; opaque hosts keep their case, so\nthese comparisons must be case-insensitive rather than assuming a lowercase\nhost. The remaining fold-case, which feeds a WebKitAdditions function whose\ninput contract we should not change, moves behind the internal setting that\ngates it (default off), so it is not evaluated in shipping configurations.\n\nWebPage::applyLinkDecorationFilteringWithResult consulted that quirk twice\nbefore checking whether the URL even has a query. Hoist the hasQuery() early\nreturn above it; both branches return the same value.\n\nThe same function also reported DidFilterLinkDecoration::Yes whenever filtering\nmerely ran, including when it removed nothing. That flag's sole consumer is\nResourceLoadStatisticsStore::logCrossSiteLoadWithLinkDecoration, which reads it\nas \"a known tracking parameter was removed\" and relaxes the destination's\nstorage removal frequency from Short to Long when it is set. Reporting Yes for a\nno-op filtering pass therefore weakened storage removal for cross-site\nnavigations from prevalent domains. Return No when nothing was removed. This\nalso stops PolicyChecker::checkNavigationPolicy (which gained this call in\n307522@main) from calling setURL() with an unchanged URL on every navigation.\n\nResourceRequestBase::setURL cleared m_platformRequestUpdated unconditionally,\ndiscarding the cached NSURLRequest even when setting an identical URL. Add the\nsame no-op guard the other setters in that file already use.\n\nWebPage::platformCanHandleRequest materialized an NSURLRequest solely to ask\n[NSURLConnection canHandleRequest:] a question that is answered by the scheme.\nCFNetwork's built-in protocols always handle http(s)/file/data/about, and a\ncustom NSURLProtocol can only add handling via +canInitWithRequest:, never\nremove it, so the answer for those schemes is true regardless of what is\nregistered. Return early for them.\n\nThat last change has a second effect worth calling out. nsURLRequest() is const\nbut caches into a mutable member, so calling it permanently attaches an\nNSURLRequest to the request -- and encodingRequiresPlatformData() keys off\nexactly that to choose between serializing a plain RequestData and the far more\nexpensive CoreIPCNSURLRequest path. Since platformCanHandleRequest was the only\ncaller of nsURLRequest() in the WebProcess, it was single-handedly forcing every\nGET navigation onto the platform path. Verified with MiniBrowser against a local\nhttp page with a long query: with the early return the navigation request\nserializes 0 times via the platform path, without it 2 times.\n\nFinally, URLParser::formURLDecode made four full allocating copies of its input\n(replace '+', UTF-8 convert, percent-decode, UTF-16 convert) with no\ncontent-dependent fast path, and removeQueryParameters calls it on the value of\nevery query parameter. Add a fast path for ASCII input containing no '%', which\ndecodes to itself. The ASCII restriction matters: the UTF-8 round trip is what\nrejects unpaired surrogates.\n\n* Source/WTF/wtf/URLParser.cpp:\n(WTF::URLParser::formURLDecode):\n* Source/WebCore/page/Quirks.cpp:\n(WebCore::Quirks::needsConsistentQueryParameterFilteringQuirk):\n* Source/WebCore/platform/network/ResourceRequestBase.cpp:\n(WebCore::ResourceRequestBase::setURL):\n* Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm:\n(WebKit::WebPage::applyLinkDecorationFilteringWithResult):\n* Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm:\n(WebKit::WebPage::platformCanHandleRequest):\n* Source/WebKit/WebProcess/WebPage/mac/WebPageMac.mm:\n(WebKit::WebPage::platformCanHandleRequest):\n\nCanonical link: https://commits.webkit.org/320292@main", "email": "cdumez@apple.com", "hash": "b48581fbde83d2d64cdb46b2d7b8720deaabd336", "subject": "Avoid redundant URL parsing and decoding on the navigation path" }, "320293@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "320293@main", "clUrl": "https://commits.webkit.org/320293@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323033\nrdar://186301688\n\nReviewed by Yijia Huang.\n\nPreviously 8bit strings are scanned in DFG / FTL in toLowerCase /\ntoUpperCase to skip calling C function when we do not need to convert\nthe input. This patch extends it to 16-bit strings as it is frequently\nhappening that 16-bit strings sliced from substring is actually not\nincluding 16-bit characters.\n\nTests: JSTests/stress/to-lower-case-16-bit-ascii-fast-path.js\n JSTests/stress/to-upper-case-16-bit-ascii-fast-path.js\n\n* JSTests/stress/to-lower-case-16-bit-ascii-fast-path.js: Added.\n(shouldBe):\n(toLowerCase):\n(lowercasesToItself):\n(wide):\n(toLowerCaseRope):\n* JSTests/stress/to-upper-case-16-bit-ascii-fast-path.js: Added.\n(shouldBe):\n(toUpperCase):\n(uppercasesToItself):\n(wide):\n(toUpperCaseRope):\n* Source/JavaScriptCore/dfg/DFGOperations.cpp:\n(JSC::DFG::JSC_DEFINE_JIT_OPERATION):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n(JSC::DFG::SpeculativeJIT::compileToUpperCase):\n(JSC::DFG::SpeculativeJIT::compileToLowerCase):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n* Source/WTF/wtf/text/StringImpl.cpp:\n(WTF::StringImpl::convertToLowercaseWithoutLocale):\n(WTF::StringImpl::convertToLowercaseWithoutLocaleStartingAtFailingIndex16Bit):\n(WTF::StringImpl::convertToUppercaseWithoutLocaleUpconvert):\n(WTF::StringImpl::convertToUppercaseWithoutLocaleStartingAtFailingIndex16Bit):\n(WTF::StringImpl::convertToUppercaseWithoutLocale16Bit):\n* Source/WTF/wtf/text/StringImpl.h:\n* Source/WTF/wtf/text/WTFString.cpp:\n(WTF::String::convertToLowercaseWithoutLocaleStartingAtFailingIndex16Bit const):\n(WTF::String::convertToUppercaseWithoutLocaleStartingAtFailingIndex16Bit const):\n* Source/WTF/wtf/text/WTFString.h:\n\nCanonical link: https://commits.webkit.org/320293@main", "email": "ysuzuki@apple.com", "hash": "d2c0435c584344707ac602307f2136de2b1ed3a4", "subject": "[JSC] Scan toLowerCase / toUpperCase strings in DFG / FTL inline" }, "320294@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "320294@main", "clUrl": "https://commits.webkit.org/320294@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323068\nrdar://186329487\n\nReviewed by Mark Lam.\n\nNow JSValueRegs is removed, we can clean up a bit more,\n\n1. Remove CCallHelpers::CellValue. This existed only for 32bit.\n2. Remove StaticScratchRegisterAllocator::countRegisters JSValueRegs handling\n3. Remove JSValueSource::unboxedCell\n4. Remoev unboxDoubleNonDestructive\n\n* Source/JavaScriptCore/bytecode/InlineCacheCompiler.cpp:\n(JSC::InlineCacheCompiler::generateAccessCase):\n(JSC::InlineCacheCompiler::emitProxyObjectAccess):\n(JSC::customGetterHandlerImpl):\n(JSC::getterCallFromGetterSetterImpl):\n(JSC::getByIdProxyObjectLoadHandler):\n(JSC::customSetterHandlerImpl):\n(JSC::setterHandlerImpl):\n* Source/JavaScriptCore/dfg/DFGArrayifySlowPathGenerator.h:\n* Source/JavaScriptCore/dfg/DFGOSRExit.cpp:\n(JSC::DFG::OSRExit::emitRestoreArguments):\n* Source/JavaScriptCore/dfg/DFGOSRExitCompilerCommon.cpp:\n(JSC::DFG::reifyInlinedCallFrames):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n(JSC::DFG::SpeculativeJIT::checkArray):\n(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectEquality):\n(JSC::DFG::SpeculativeJIT::compileCheckDetached):\n(JSC::DFG::SpeculativeJIT::jumpForTypedArrayOutOfBounds):\n(JSC::DFG::SpeculativeJIT::compileObjectEquality):\n(JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):\n(JSC::DFG::SpeculativeJIT::compileGetArrayLength):\n(JSC::DFG::SpeculativeJIT::compileDataViewGetByteLength):\n(JSC::DFG::SpeculativeJIT::compileNewArrayWithSpread):\n(JSC::DFG::SpeculativeJIT::emitStructureCheck):\n(JSC::DFG::SpeculativeJIT::compileCheckIsConstant):\n(JSC::DFG::SpeculativeJIT::compileCallDOMGetter):\n(JSC::DFG::SpeculativeJIT::compileCheckJSCast):\n(JSC::DFG::SpeculativeJIT::compileToStringOrCallStringConstructorOrStringValueOf):\n(JSC::DFG::SpeculativeJIT::compileNewStringObject):\n(JSC::DFG::SpeculativeJIT::speculateCellTypeWithoutTypeFiltering):\n(JSC::DFG::SpeculativeJIT::speculateCellType):\n(JSC::DFG::SpeculativeJIT::speculateObject):\n(JSC::DFG::SpeculativeJIT::speculateString):\n(JSC::DFG::SpeculativeJIT::speculateStringIdentAndLoadStorage):\n(JSC::DFG::SpeculativeJIT::speculateStringObject):\n(JSC::DFG::SpeculativeJIT::speculateStringOrStringObject):\n(JSC::DFG::SpeculativeJIT::speculateNotSymbol):\n(JSC::DFG::SpeculativeJIT::speculateSymbol):\n(JSC::DFG::SpeculativeJIT::speculateHeapBigInt):\n(JSC::DFG::SpeculativeJIT::compileStringReplace):\n(JSC::DFG::SpeculativeJIT::compileEnumeratorHasProperty):\n(JSC::DFG::SpeculativeJIT::compileSetCallee):\n(JSC::DFG::SpeculativeJIT::compileEnumeratorGetByVal):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:\n(JSC::DFG::SpeculativeJIT::compileObjectStrictEquality):\n(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectStrictEquality):\n(JSC::DFG::SpeculativeJIT::compileObjectToObjectOrOtherEquality):\n(JSC::DFG::SpeculativeJIT::compilePeepHoleObjectToObjectOrOtherEquality):\n(JSC::DFG::SpeculativeJIT::compileDataViewGetByteLengthAsInt52):\n(JSC::DFG::SpeculativeJIT::compileGetTypedArrayLengthAsInt52):\n(JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffsetAsInt52):\n(JSC::DFG::SpeculativeJIT::compile):\n(JSC::DFG::SpeculativeJIT::compilePutPrivateName):\n(JSC::DFG::SpeculativeJIT::compileEnumeratorPutByVal):\n(JSC::DFG::SpeculativeJIT::compileMultiGetByVal):\n(JSC::DFG::SpeculativeJIT::compileMultiPutByVal):\n* Source/JavaScriptCore/jit/AssemblyHelpers.h:\n(JSC::AssemblyHelpers::emitPutCellToCallFrameHeader):\n(JSC::AssemblyHelpers::storeCell): Deleted.\n(JSC::AssemblyHelpers::loadCell): Deleted.\n(JSC::AssemblyHelpers::unboxDoubleNonDestructive): Deleted.\n* Source/JavaScriptCore/jit/BaselineJITRegisters.h:\n* Source/JavaScriptCore/jit/CCallHelpers.h:\n(JSC::CCallHelpers::CellValue::CellValue): Deleted.\n(JSC::CCallHelpers::CellValue::gpr const): Deleted.\n* Source/JavaScriptCore/jit/GPRInfo.h:\n(JSC::JSValueSource::unboxedCell): Deleted.\n(JSC::StaticScratchRegisterAllocator::countRegisters): Deleted.\n* Source/JavaScriptCore/jit/JITAddGenerator.cpp:\n(JSC::JITAddGenerator::generateFastPath):\n* Source/JavaScriptCore/jit/JITDivGenerator.cpp:\n(JSC::JITDivGenerator::loadOperand):\n* Source/JavaScriptCore/jit/JITMulGenerator.cpp:\n(JSC::JITMulGenerator::generateInline):\n(JSC::JITMulGenerator::generateFastPath):\n* Source/JavaScriptCore/jit/JITOpcodes.cpp:\n(JSC::JIT::valueIsFalseyGenerator):\n(JSC::JIT::emit_op_jtrue):\n(JSC::JIT::valueIsTruthyGenerator):\n* Source/JavaScriptCore/jit/JITRightShiftGenerator.cpp:\n(JSC::JITRightShiftGenerator::generateFastPath):\n* Source/JavaScriptCore/jit/JITSubGenerator.cpp:\n(JSC::JITSubGenerator::generateInline):\n(JSC::JITSubGenerator::generateFastPath):\n* Source/JavaScriptCore/jit/ThunkGenerators.cpp:\n(JSC::boundFunctionCallGenerator):\n(JSC::remoteFunctionCallGenerator):\n(JSC::maxThunkGenerator):\n(JSC::minThunkGenerator):\n* Source/JavaScriptCore/wasm/js/WasmToJS.cpp:\n(JSC::Wasm::wasmToJS):\n\nCanonical link: https://commits.webkit.org/320294@main", "email": "ysuzuki@apple.com", "hash": "2e70118515f795b836fbaccf366370370394da47", "subject": "[JSC] Clean up after JSValueRegs removal" }, "320295@main": { "author": "Lauro Moura", "avatar": "https://www.gravatar.com/avatar/6157f52d61e04c2c63fe7ff668ba69b3?d=identicon\u0026s=64", "cl": "320295@main", "clUrl": "https://commits.webkit.org/320295@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321481\n\nUnreviewed test gardening.\n\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320295@main", "email": "lmoura@igalia.com", "hash": "3798e6ce030c041c551bbaf6884c6b3615ccf80d", "subject": "[WPE][arm64] Tests expected to crash intermittently time out instead on the ARM64 bot" }, "320296@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/3d43be18ce5ee6b92ba9151b63591125?d=identicon\u0026s=64", "cl": "320296@main", "clUrl": "https://commits.webkit.org/320296@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322773\n\nReviewed by Dan Glastonbury.\n\nupdateDebugIndicators() called m_layer-\u003esetNeedsDisplay() unconditionally. That\nruns whenever DebugIndicatorsChanged is committed, and DebugIndicatorsChanged is\nOR-ed into ordinary, non-debug property setters (setMasksToBounds,\nsetDrawsContent, setDrawsHDRContent, setBackdropFilters). As a result, toggling\ne.g. overflow:hidden on a content-drawing, backing-store-attached layer forced a\nfull backing-store re-rasterization (plus a buffer swap, and IPC re-transmission\nof the buffer on the Remote layer tree backend) even when no debug indicator was\nenabled -- pure waste, since masksToBounds/backdrop/clipping are compositor\nproperties CA applies without repainting any pixels.\n\nThe only reason for the repaint is to refresh the repaint counter, which is drawn\ninto the layer's own backing store during content paint (PlatformCALayer::\ndrawLayerContents -\u003e drawRepaintIndicator, gated on isShowingRepaintCounter()).\nDebug borders and frame-process borders are CA properties / separate indicator\nlayers and never repaint pixels.\n\nGate the setNeedsDisplay() in updateDebugIndicators() on isShowingRepaintCounter().\nThe rest of updateDebugIndicators() (updateFrameProcessIndicators() and the\nsetLayerDebugBorder() recolor, which depends on masksToBounds/drawsContent) still\nruns unconditionally. To handle disabling the counter -- at which point\nisShowingRepaintCounter() is already false, so updateDebugIndicators() would not\nclear the last-drawn counter -- setShowRepaintCounter() now forces one repaint on\nboth transitions.\n\n* Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp:\n(WebCore::GraphicsLayerCA::updateDebugIndicators):\n(WebCore::GraphicsLayerCA::setShowRepaintCounter):\n\nCanonical link: https://commits.webkit.org/320296@main", "email": "ahmad.saleem792@gmail.com", "hash": "8445610f3e92053c4f6c778e8faf3fdac3998f68", "subject": "GraphicsLayerCA::updateDebugIndicators() forces a full-layer repaint on ordinary property changes" }, "320297@main": { "author": "Ben Nham", "avatar": "https://www.gravatar.com/avatar/dc0914eabf69047ee3397794c2d17bf7?d=identicon\u0026s=64", "cl": "320297@main", "clUrl": "https://commits.webkit.org/320297@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322868\nrdar://186115818\n\nReviewed by Sihui Liu and Per Arne Vollan.\n\nBrowsingContextGroup returns potentially terminated processes in both sharedProcessForSite and\nprocessForSite. Fix this by not handing back terminated processes.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n\n* Source/WebKit/UIProcess/BrowsingContextGroup.cpp:\n(WebKit::BrowsingContextGroup::sharedProcessForSite):\n(WebKit::BrowsingContextGroup::ensureProcessForSite):\n(WebKit::BrowsingContextGroup::liveSharedProcess):\n(WebKit::BrowsingContextGroup::clearSharedProcess):\n(WebKit::BrowsingContextGroup::processForSite):\n(WebKit::BrowsingContextGroup::processDidTerminate):\n(WebKit::BrowsingContextGroup::removeFrameProcess):\n* Source/WebKit/UIProcess/BrowsingContextGroup.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::resetStateAfterProcessExited):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::(SiteIsolation, SharedProcessNotReusedAfterCrash)):\n(TestWebKitAPI::(SiteIsolation, SharedProcessMainFrameNotReusedAfterCrash)):\n(TestWebKitAPI::(SiteIsolation, SharedProcessShutsDownWhenLastRemoteFrameIsRemoved)):\n\nCanonical link: https://commits.webkit.org/320297@main", "email": "nham@apple.com", "hash": "bd4ce6001e93131ec13bdeb5434ae4deab2c2718", "subject": "[Site Isolation] Don't use crashed processes in BrowsingContextGroup" }, "320298@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "320298@main", "clUrl": "https://commits.webkit.org/320298@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323088\n\nReviewed by Ryosuke Niwa.\n\n* Source/WebCore/html/BaseButtonInputType.cpp:\n(WebCore::BaseButtonInputType::createInputRenderer):\n* Source/WebCore/html/FileInputType.cpp:\n(WebCore::FileInputType::createInputRenderer):\n* Source/WebCore/html/HTMLFrameElement.cpp:\n(WebCore::HTMLFrameElement::createElementRenderer):\n* Source/WebCore/html/ImageInputType.cpp:\n(WebCore::ImageInputType::createInputRenderer):\n* Source/WebCore/html/InputType.cpp:\n(WebCore::InputType::createInputRenderer):\n* Source/WebCore/html/RangeInputType.cpp:\n(WebCore::RangeInputType::createInputRenderer):\n* Source/WebCore/html/SearchInputType.cpp:\n(WebCore::SearchInputType::createInputRenderer):\n* Source/WebCore/html/TextFieldInputType.cpp:\n(WebCore::TextFieldInputType::createInputRenderer):\n\nCanonical link: https://commits.webkit.org/320298@main", "email": "cdumez@apple.com", "hash": "5af7b362c337772f8fd5d92ea4ef5e2dfc6c3dff", "subject": "[Safer CPP] Drop some suppression macros now that https://github.com/llvm/llvm-project/pull/142471 is fixed" }, "320299@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "320299@main", "clUrl": "https://commits.webkit.org/320299@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323087\n\nReviewed by Ryosuke Niwa.\n\n* Source/WTF/wtf/cocoa/SoftLinking.h:\n* Source/WebCore/Modules/ShapeDetection/Implementation/Cocoa/VisionUtilities.mm:\n(WebCore::ShapeDetection::configureRequestToUseCPUOrGPU):\n* Source/WebCore/Modules/applepay/PaymentInstallmentConfiguration.mm:\n(WebCore::makeVectorElement):\n* Source/WebCore/Modules/applepay/cocoa/PaymentSummaryItemsCocoa.mm:\n(WebCore::platformRecurringSummaryItem):\n(WebCore::platformDeferredSummaryItem):\n(WebCore::platformAutomaticReloadSummaryItem):\n(WebCore::platformDisbursementSummaryItem):\n(WebCore::platformInstantFundsOutFeeSummaryItem):\n(WebCore::platformSummaryItem):\n* Source/WebCore/platform/audio/cocoa/AudioSessionCocoa.mm:\n(WebCore::AudioSessionCocoa::setEligibleForSmartRoutingInternal):\n(WebCore::AudioSessionCocoa::tryToSetActiveInternal):\n\nCanonical link: https://commits.webkit.org/320299@main", "email": "cdumez@apple.com", "hash": "d11e9e17a1e181a8ad70653207a87e64c1bdd132", "subject": "[Safer CPP] Drop some suppression macros now that rdar://160259918 has been fixed in the static analyzer" }, "320300@main": { "author": "Ben Nham", "avatar": "https://www.gravatar.com/avatar/dc0914eabf69047ee3397794c2d17bf7?d=identicon\u0026s=64", "cl": "320300@main", "clUrl": "https://commits.webkit.org/320300@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323075\nrdar://problem/186332884\n\nReviewed by Kiet Ho.\n\nCurrently, a document with any remote frames will send a UpdateRemoteIntersectionObservers IPC to\nall other processes that render the webpage when updating local IntersectionObserver state. This is\nbasically a contentless message that tells all other processes to run\nWebPage::updateRemoteIntersectionObservers.\n\nThis isn't necessary because it happens as part of the rendering update, and we already send another\nIPC unconditionally as part of each rendering update (the FrameGeometry IPC). Instead of the\nUpdateRemoteIntersectionObservers IPC, just call updateRemoteIntersectionObservers() as part of\nhandling the FrameGeometry IPC in the remote process.\n\n* LayoutTests/http/tests/site-isolation/only-broadcast-frame-geometry-if-remote-frame-exists.html:\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::updateIntersectionObservers):\n* Source/WebCore/dom/Document.h:\n* Source/WebCore/page/ChromeClient.h:\n(WebCore::ChromeClient::updateRemoteIntersectionObserversInOtherWebProcesses): Deleted.\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::updateRemoteIntersectionObserversInOtherWebProcesses): Deleted.\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.messages.in:\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:\n(WebKit::WebChromeClient::updateRemoteIntersectionObserversInOtherWebProcesses): Deleted.\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::frameTreeSyncDataChangedInAnotherProcess):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Source/WebKit/WebProcess/WebPage/WebPage.messages.in:\n\nCanonical link: https://commits.webkit.org/320300@main", "email": "nham@apple.com", "hash": "12f4cb070f42ac1bdd21e1454346a451e61cd726", "subject": "[Site Isolation] Remove UpdateRemoteIntersectionObservers IPC" }, "320301@main": { "author": "Richard Robinson", "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64", "cl": "320301@main", "clUrl": "https://commits.webkit.org/320301@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323178\nrdar://186421605\n\nUnreviewed re-land of 320260@main.\n\n* Source/WebKit/Modules/Internal/module.modulemap:\n* Source/WebKit/Shared/Foundation+Extras.swift:\n(CopyableBox.value):\n(CopyableBox.take):\n* Source/WebKit/Shared/JavaScriptEvaluationResultCxxInteropSupport.h: Added.\n(WebKit::CxxInteropSupport::takeValue):\n* Source/WebKit/Shared/RunJavaScriptParameters.h:\n* Source/WebKit/Shared/RunJavaScriptResult.swift: Copied from Source/WebKit/UIProcess/WebPageProxy.swift.\n(WebKit.__take(_:)):\n* Source/WebKit/UIProcess/WebPageProxy.swift:\n(WebKit.editorStateCopy): Deleted.\n(WebKit.editorState): Deleted.\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/320301@main", "email": "richard_robinson2@apple.com", "hash": "f374cf141b9e55fa004c7afb32953b5bbe24a240", "subject": "Re-land [NewCodable] Make it possible to call WebPageProxy.runJavaScriptInMainFrame from Swift" }, "320302@main": { "author": "Cole Carley", "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64", "cl": "320302@main", "clUrl": "https://commits.webkit.org/320302@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323133\nrdar://186380101\n\nReviewed by Brent Fulgham.\n\n319533@main broke TestWebKitAPI.PrivateClickMeasurement.SKAdNetwork.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/EventAttribution.mm\n\n* Source/WebCore/page/Quirks.cpp:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/EventAttribution.mm:\n(TestWebKitAPI::setupSKAdNetworkTest):\n\nCanonical link: https://commits.webkit.org/320302@main", "email": "ccarley2@apple.com", "hash": "2181b343f4d6bfd7f0bd56302c9dcf2b4369324a", "subject": "REGRESSION(319533@main): Broke TestWebKitAPI.PrivateClickMeasurement.SKAdNetwork" }, "320303@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "320303@main", "clUrl": "https://commits.webkit.org/320303@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323169\n\nReviewed by Yusuke Suzuki.\n\nEvery DFG OSR entry point keeps a FixedOperands\u003cAbstractValue\u003e with the\nexpected value of each argument and local, 32 bytes per operand, for as long\nas the DFG code lives, although it is only read when the baseline JIT tries to\nenter the loop. On JetStream3 that is 972k AbstractValues over the run, 31 MB,\nand 90% of them are BytecodeTop.\n\nThis patch stores the expected values of an entry as a byte stream\n(OSREntryExpectedValues; the format is in the comment above the class) that\nrun-length encodes BytecodeTop and writes the array modes, structures and\nconstant of the other values only when they are not the trivial ones, and\ndecodes it back into a FixedOperands\u003cAbstractValue\u003e in prepareOSREntry. The\nsame JetStream3 run goes from 31.1 MB to 0.76 MB (0.8 bytes per operand).\n\n* Source/JavaScriptCore/dfg/DFGJITCode.cpp:\n(JSC::DFG::JITCode::validateReferences):\n* Source/JavaScriptCore/dfg/DFGJITCompiler.cpp:\n(JSC::DFG::JITCompiler::noticeOSREntry):\n* Source/JavaScriptCore/dfg/DFGOSREntry.cpp:\n(JSC::DFG::OSREntryExpectedValues::OSREntryExpectedValues):\n(JSC::DFG::OSREntryExpectedValues::decode const):\n(JSC::DFG::OSREntryExpectedValues::validateReferences const):\n(JSC::DFG::OSREntryData::dumpInContext const):\n(JSC::DFG::prepareOSREntry):\n* Source/JavaScriptCore/dfg/DFGOSREntry.h:\n* Source/JavaScriptCore/dfg/DFGRegisteredStructure.h:\n\nCanonical link: https://commits.webkit.org/320303@main", "email": "sosuke@bun.sh", "hash": "472f03956a363f00072e5f4aaea86e6f6d5c6b3c", "subject": "[JSC] Store DFG OSR entry expected values as a byte stream" }, "320304@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "320304@main", "clUrl": "https://commits.webkit.org/320304@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323060\nrdar://177769847\n\nReviewed by Ben Nham.\n\nNetworkConnectionToWebProcess::setRawCookie validated cookie.domain and\nurl against firstParty:\n```\nMESSAGE_CHECK(RegistrableDomain::uncheckedCreateFromHost(cookie.domain).matches(firstParty));\nMESSAGE_CHECK(RegistrableDomain(url).matches(firstParty));\n```\n\nThis is too strict. WebCookieJar::setRawCookie passes\ndocument.firstPartyForCookies() as firstParty (the top-level page's URL)\nand document.cookieURL() as url (the document's own URL). For a\nthird-party iframe these legitimately differ, so the checks terminate\nthe WebProcess whenever Web Inspector or internals.setCookie is used in\na cross-site iframe.\n\nReplace the two checks with an integrity check that cookie.domain's\nregistrable domain matches url, mirroring the existing posture of\nsetCookieFromDOMAsync which validates firstParty only and trusts the\nurl/cookie pair. The new check still rejects a mismatched\ncookie.domain/url pair (the most useful invariant) without coupling\neither to the unrelated top-level firstParty.\n\nTests: http/tests/cookies/set-raw-cookie-in-third-party-iframe.html\n ipc/set-raw-cookie-empty-commenturl-crash.html\n ipc/set-raw-cookie-firstparty-message-check.html\n\n* LayoutTests/http/tests/cookies/resources/set-raw-cookie-in-third-party-iframe-frame.html: Added.\n* LayoutTests/http/tests/cookies/set-raw-cookie-in-third-party-iframe-expected.txt: Added.\n* LayoutTests/http/tests/cookies/set-raw-cookie-in-third-party-iframe.html: Added.\nAdd test coverage for the overly strict checks.\n\n* LayoutTests/ipc/set-raw-cookie-empty-commenturl-crash-expected.txt: Added.\n* LayoutTests/ipc/set-raw-cookie-empty-commenturl-crash.html: Added.\n* LayoutTests/ipc/set-raw-cookie-firstparty-message-check-expected.txt: Added.\n* LayoutTests/ipc/set-raw-cookie-firstparty-message-check.html: Added.\nAdd test coverage for what 314177@main was trying to fix, to make sure\nthat we don't regress it.\n\n* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:\n(WebKit::NetworkConnectionToWebProcess::setRawCookie):\n\nCanonical link: https://commits.webkit.org/320304@main", "email": "cdumez@apple.com", "hash": "d4867a890432d2368c2cd6a4bc1516da4d0f4c7b", "subject": "Regression(314177@main) SetRawCookie's MESSAGE_CHECKs reject legitimate cookie writes from third-party iframes" }, "320305@main": { "author": "Tyler Wilcock", "avatar": "https://www.gravatar.com/avatar/9545082e6bed96158a9f52dac6e4b869?d=identicon\u0026s=64", "cl": "320305@main", "clUrl": "https://commits.webkit.org/320305@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322443\nrdar://185725696\n\nReviewed by Dominic Mazzoni.\n\nAccessibilityRenderObject::textRuns gives a RenderLineBreak a \"\\n\" run whose lineID is\n(containingBlock, box-\u003elineIndex()). This is the same lineID as the text before it, because a br\nsits on the line it breaks. The position just past that newline is therefore another end of\nthe line the br ended, not the end of the line after it.\n\nThe line walk backing AXTextMarkerRangeForLine advanced with nextLineEnd and stopped only\nonce the marker didn't move at all, so it reported such a line twice: once without its\ntrailing break, then again with it. For \u003cp\u003eAlpha\u003cbr\u003eBravo\u003c/p\u003e that exposed three lines —\n\"Alpha\", \"Alpha\\n\", \"Bravo\" — where the live tree exposes two, shifting every later line\nindex by one.\n\nLanding past the \u003cbr\u003e's newline is nextLineEnd's correct, live-matching behavior, specified\nby accessibility/mac/line-boundary-at-br.html, so this fixes the line enumeration built on\ntop of it rather than nextLineEnd itself. nextLineRange now keeps advancing while the line\nend it finds still carries the line ID it started from.\n\nAXLineForTextMarker counts lines with its own walk and had the same off-by-one, which would\nhave left the two attributes disagreeing about a \u003cbr\u003e. Its fast path (same containing block,\nsubtract line indices) was already correct, so only a marker in a later block was affected.\nIt now counts a line only when the line ID changes.\n\n* LayoutTests/accessibility/isolated-tree/mac/line-ranges-at-br-not-duplicated-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/line-ranges-at-br-not-duplicated.html: Added.\n* LayoutTests/accessibility/mac/line-ranges-at-br-not-duplicated-expected.txt: Added.\n* LayoutTests/accessibility/mac/line-ranges-at-br-not-duplicated.html: Added.\n* Source/WebCore/accessibility/AXTextMarker.cpp:\n(WebCore::AXTextMarker::lineIndex const):\n(WebCore::nextLineRange):\n\nCanonical link: https://commits.webkit.org/320305@main", "email": "tyler_w@apple.com", "hash": "61bc74179682cf9d197ea60c474513550869b52a", "subject": "AX: In isolated tree mode, AXStringForTextMarkerRange reports an unexpected extra newline for a br element" }, "320306@main": { "author": "Tyler Wilcock", "avatar": "https://www.gravatar.com/avatar/9545082e6bed96158a9f52dac6e4b869?d=identicon\u0026s=64", "cl": "320306@main", "clUrl": "https://commits.webkit.org/320306@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323128\nrdar://186390534\n\nReviewed by Dominic Mazzoni.\n\nThree AXNotification kinds are observable from the platform but had no test\nwaiting for them. Each new test asserts two things:\n\n 1. That the notification fires,\n 2. The state an assistive technology would query in response is already\n correct at the moment of delivery.\n\n* LayoutTests/accessibility/mac/press-did-succeed-notification.html: Added.\n* LayoutTests/accessibility/mac/press-did-succeed-notification-expected.txt: Added.\n - First test to wait for AXPressDidSucceed. Pressing a collapsed\n base-appearance select reports itself expanded at delivery.\n\n* LayoutTests/accessibility/mac/press-did-succeed-notification-collapse.html: Added.\n* LayoutTests/accessibility/mac/press-did-succeed-notification-collapse-expected.txt: Added.\n - The collapsing direction of the same invariant. Split from the test above so\n that only the direction that fails with the isolated tree is gardened (yes, this exposed a bug).\n\n* LayoutTests/accessibility/mac/label-changed-notification.html: Added.\n* LayoutTests/accessibility/mac/label-changed-notification-expected.txt: Added.\n - First test to wait for AXTitleChanged, which AXNotification::LabelChanged is\n the sole source of.\n\n* LayoutTests/accessibility/mac/autocorrection-occurred-notification.html: Added.\n* LayoutTests/accessibility/mac/autocorrection-occurred-notification-expected.txt: Added.\n - First test to wait for AXAutocorrectionOccurred.\n\n* LayoutTests/accessibility-isolated-tree/TestExpectations:\n - Garden press-did-succeed-notification-collapse.html. AXPressDidSucceed is\n posted synchronously by AccessibilityRenderObject::press(), but the isolated\n tree only learns the collapsed state from the IsExpanded update that\n ExpandedChanged queues, which lands after the notification.\n\nCanonical link: https://commits.webkit.org/320306@main", "email": "tyler_w@apple.com", "hash": "a01fa7d4f4fec6d8b5842ccfcb18d1a72a031e70", "subject": "AX: Add layout tests for the AXPressDidSucceed, AXTitleChanged, and AXAutocorrectionOccurred notifications" }, "320307@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "320307@main", "clUrl": "https://commits.webkit.org/320307@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323095\n\nReviewed by David Kilzer.\n\nalpha.webkit.RetainPtrCtorAdoptChecker flagged every adoptOSObject(dispatch_*_create())\ncall site, and each one was papered over with SUPPRESS_RETAINPTR_CTOR_ADOPT and a FIXME\npointing at rdar://160931336. The warnings turn out to be gated on ARC rather than on the\nfile extension:\n\n - Plain C++ (.cpp): warns. DISPATCH_RETURNS_RETAINED is gated on OS_OBJECT_USE_OBJC,\n which requires __OBJC__, so ns_returns_retained is not visible and the argument looks\n like +0.\n - Objective-C++ without ARC: clean. adoptOSObject() is correct and the checker agrees.\n - Objective-C++ with ARC: adopting warns. Under ARC adopt and the plain constructor are\n equivalent -- RetainTraits::retain/release are no-ops and the __strong store on m_ptr\n holds the +1 -- so the constructor is both correct and what the checker expects.\n\nEach site is therefore fixed by compiling it as Objective-C++ and then matching the\ntarget's ARC state, with no suppression left behind. This also covers\ndispatch_block_create_with_qos_class(), which is annotated ns_returns_retained in every\nmode but which the checker only accepts when the result is not adopted.\n\nWebCore compiles all of its Objective-C++ without ARC and WTF compiles all of its with\nARC, so the two frameworks are handled differently here.\n\nWhile adding the ARC guard that Source/WebKit already uses to the rest of WTF's\nObjective-C++, it caught SpanCocoa.mm, which was declared as sourcecode.cpp.cpp and so was\nbuilt with -x c++ despite its extension, while CMake built it as Objective-C++.\n\n* Source/JavaScriptCore/jsc.cpp:\n(jscmain):\njsc.cpp cannot become Objective-C++, so it now uses setDispatchQueueWithLabel() instead of\ncreating the queue itself.\n* Source/WTF/WTF.xcodeproj/project.pbxproj:\nCorrected SpanCocoa.mm to sourcecode.cpp.objcpp. The file contains no Objective-C\nconstructs, so this only changes which language the two builds agree it is.\n* Source/WTF/wtf/BlockObjCExceptions.mm:\n* Source/WTF/wtf/MemoryPressureHandler.h:\nDeclared setDispatchQueueWithLabel() so that callers in plain C++ translation units can\nget a dedicated serial queue without naming dispatch_queue_create() themselves.\n* Source/WTF/wtf/ObjCRuntimeExtras.mm:\n* Source/WTF/wtf/PlatformCocoa.cmake:\nWTF's Objective-C++ was built with ARC by Xcode (CLANG_ENABLE_OBJC_ARC in Base.xcconfig)\nbut without it by CMake, which never passed -fobjc-arc for this framework. Set the flag\ntarget-wide so the two builds agree. It has to be set before WEBKIT_ADD_PREFIX_HEADER()\nbelow, because the OBJCXX precompiled header must be built with the same flag as the\nsources that include it.\n* Source/WTF/wtf/cocoa/AuditToken.mm:\n* Source/WTF/wtf/cocoa/Entitlements.mm:\n* Source/WTF/wtf/cocoa/FileSystemCocoa.mm:\n* Source/WTF/wtf/cocoa/LanguageCocoa.mm:\n* Source/WTF/wtf/cocoa/LoggingCocoa.mm:\n* Source/WTF/wtf/cocoa/MainThreadCocoa.mm:\n* Source/WTF/wtf/cocoa/MemoryPressureHandlerCocoa.mm:\n(WTF::MemoryPressureHandler::setDispatchQueueWithLabel):\n(WTF::MemoryPressureHandler::install):\n(WTF::MemoryPressureHandler::holdOff):\nDropped the adoptOSObject() calls and added setDispatchQueueWithLabel().\n* Source/WTF/wtf/cocoa/NSURLExtras.mm:\n* Source/WTF/wtf/cocoa/RuntimeApplicationChecksCocoa.mm:\n* Source/WTF/wtf/cocoa/SchedulePairCocoa.mm:\n* Source/WTF/wtf/cocoa/SpanCocoa.mm:\n* Source/WTF/wtf/cocoa/URLCocoa.mm:\n* Source/WTF/wtf/cocoa/UUIDCocoa.mm:\n* Source/WTF/wtf/cocoa/WorkQueueCocoa.mm: Renamed from Source/WTF/wtf/cocoa/WorkQueueCocoa.cpp.\n(WTF::dispatchWorkItem):\n(WTF::WorkQueueBase::dispatch):\n(WTF::WorkQueueBase::dispatchWithQOS):\n(WTF::WorkQueueBase::dispatchAfter):\n(WTF::WorkQueueBase::dispatchSync):\n(WTF::WorkQueueBase::WorkQueueBase):\n(WTF::WorkQueueBase::platformInitialize):\n(WTF::WorkQueueBase::platformInvalidate):\n(WTF::WorkQueue::WorkQueue):\n(WTF::ConcurrentWorkQueue::apply):\nRenamed to Objective-C++ and dropped the adoptOSObject() calls. blockWithQOS no longer\nneeds an OSObjectPtr at all, since ARC owns the block.\n* Source/WTF/wtf/darwin/LibraryPathDiagnostics.mm:\n* Source/WTF/wtf/darwin/OSLogPrintStream.mm:\n* Source/WTF/wtf/mac/FileSystemMac.mm:\n* Source/WTF/wtf/text/cocoa/ASCIILiteralCocoa.mm:\n* Source/WTF/wtf/text/cocoa/ContextualizedCFString.mm:\n* Source/WTF/wtf/text/cocoa/ContextualizedNSString.mm:\n* Source/WTF/wtf/text/cocoa/StringCocoa.mm:\n* Source/WTF/wtf/text/cocoa/StringImplCocoa.mm:\n* Source/WTF/wtf/text/cocoa/StringViewCocoa.mm:\n* Source/WTF/wtf/text/cocoa/TextStreamCocoa.mm:\n* Source/WebCore/PlatformCocoa.cmake:\n* Source/WebCore/SourcesCocoa.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\nMarked PowerObserverMac.mm @nonARC, matching every other Objective-C++ file in WebCore.\n* Source/WebCore/platform/mac/PowerObserverMac.mm: Renamed from Source/WebCore/platform/mac/PowerObserverMac.cpp.\n(WebCore::PowerObserver::PowerObserver):\n(WebCore::PowerObserver::~PowerObserver):\n(WebCore::PowerObserver::didReceiveSystemPowerNotification):\nThe file was already PLATFORM(MAC)-only and already using #import, so renaming it is\nenough. It keeps adoptOSObject(), which is correct in a non-ARC Objective-C++ file.\n\nCanonical link: https://commits.webkit.org/320307@main", "email": "cdumez@apple.com", "hash": "6f9fb91d518b0f68ab13c57687c250ed2e8dc154", "subject": "Remove SUPPRESS_RETAINPTR_CTOR_ADOPT for dispatch_*_create() false positives" }, "320308@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "320308@main", "clUrl": "https://commits.webkit.org/320308@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323063\n\nReviewed by Ryosuke Niwa.\n\nDrop SUPPRESS_UNCOUNTED_LOCAL for `vm` local variables in the generated\nbindings code as it is no longer required.\n\n* Source/WebCore/bindings/scripts/*:\n\nCanonical link: https://commits.webkit.org/320308@main", "email": "cdumez@apple.com", "hash": "1be94d56c25991b423e02c14d881c82ee3042abc", "subject": "Drop SUPPRESS_UNCOUNTED_LOCAL for `vm` local variables in the generated bindings code" }, "320309@main": { "author": "Mike Wyrzykowski", "avatar": "https://www.gravatar.com/avatar/4b1bc9e238714f95e22d5d2454c07066?d=identicon\u0026s=64", "cl": "320309@main", "clUrl": "https://commits.webkit.org/320309@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323117\nrdar://186379208\n\nReviewed by Dan Glastonbury.\n\nGPUBuffer is now allowed in GPUBindingResource, but we always returned\nfalse from the GPUBuffer path. This prevented bind group reuse for\nexternal video textures.\n\nTest: fast/webgpu/bind-group-reuse-with-buffer-entry.html\n\n* LayoutTests/fast/webgpu/bind-group-reuse-with-buffer-entry-expected.txt: Added.\n* LayoutTests/fast/webgpu/bind-group-reuse-with-buffer-entry.html: Added.\n* Source/WebCore/Modules/WebGPU/GPUBindGroupEntry.h:\n(WebCore::GPUBindGroupEntry::equal):\n\nCanonical link: https://commits.webkit.org/320309@main", "email": "mwyrzykowski@apple.com", "hash": "0ad38fbf95da61a6e207e81b6d5a940f53ff6e71", "subject": "GPUDevice.createBindGroup fast path is broken for external textures" }, "320310@main": { "author": "Richard Robinson", "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64", "cl": "320310@main", "clUrl": "https://commits.webkit.org/320310@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323184\nrdar://186428639\n\nUnreviewed build fix.\n\n* Source/WTF/wtf/PlatformHave.h:\n* Source/WebKit/UIProcess/WebPageProxy.swift:\n\nCanonical link: https://commits.webkit.org/320310@main", "email": "richard_robinson2@apple.com", "hash": "dfa20f60194fa2955618f934a00859bba2bd29b9", "subject": "Fix the build after 320301@main" }, "320311@main": { "author": "Elliott Williams", "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64", "cl": "320311@main", "clUrl": "https://commits.webkit.org/320311@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321505\nrdar://problem/184611931\n\nReviewed by Adrian Taylor.\n\nRight now, the swift driver does not emit any dependency information to\nNinja, so it only reruns when its sources change, and it can easily go\nstale when modularized headers in the project change. Fix by teaching\nCMake and Ninja to record module dependencies.\n\nSwift's driver produces a JSON object of information about per-object\ndependencies, but it's too fine-grained for CMake, since we invoke an\nentire module's compilation task as a single frontend command. Add logic\nto `swift-wrapper.py` that reads the output file\nmap and merges it into a Make-style depfile.\n\nTo count dependencies on modularized headers, build with\n-track-system-dependencies, which appears to work around\nrdar://177840132.\n\n* Source/WTF/wtf/PlatformCocoa.cmake:\n* Source/cmake/WebKitMacros.cmake:\n* Tools/Scripts/swift/swiftc-wrapper.py:\n(expand_response_file):\n(_escape):\n(_unescape):\n(parse_depfile):\n(dependency_files):\n(write_ninja_depfile):\n(process_args):\n(main):\n(quote_response_file_token):\n* Source/WebCore/PAL/pal/CMakeLists.txt:\n* Source/WebGPU/WebGPU/CMakeLists.txt:\n* Source/WebKit/CMakeLists.txt:\n\nCanonical link: https://commits.webkit.org/320311@main", "email": "emw@apple.com", "hash": "9b57c348308ba59611cfadc2f70b67302a4bf5a8", "subject": "[CMake] Add Swift dependencies on C++ headers" }, "320312@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "320312@main", "clUrl": "https://commits.webkit.org/320312@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322901\nrdar://186160163\n\nReviewed by Chris Dumez.\n\nFormSubmission::boundary() returned String by value, copying the\nunderlying StringImpl (an atomic ref-count churn) on every call. Every\nother string accessor in the class -- contentType(), referrer(),\norigin(), returnValue() -- already returns const String\u0026 with\nLIFETIME_BOUND. Make boundary() consistent by returning a const\nreference, since m_boundary's lifetime is tied to the FormSubmission.\n\n* Source/WebCore/loader/FormSubmission.h:\n\nCanonical link: https://commits.webkit.org/320312@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "1e810fd834af971b12fe1d1099fa7427d2b2271f", "subject": "FormSubmission::boundary() returns String by value, forcing a copy" }, "320313@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "320313@main", "clUrl": "https://commits.webkit.org/320313@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322897\nrdar://186149389\n\nReviewed by Chris Dumez.\n\nThe #undef block at the end of PolicyChecker.cpp did not match the\nmacros defined at the top of the file: it undef'd IS_ALLOWED, which is\nnever defined, while leaving PAGE_ID_WITH_THIS, FRAME_ID_WITH_THIS,\nPOLICYCHECKER_RELEASE_LOG_WITH_THIS, POLICYCHECKER_RELEASE_LOG_FORWARDABLE,\nand POLICYCHECKER_RELEASE_LOG_FORWARDABLE_WITH_THIS defined. These leak\ninto subsequent translation units in the unified build.\n\nRemove the dead #undef and undef all eight macros that are defined.\n\n* Source/WebCore/loader/PolicyChecker.cpp:\n\nCanonical link: https://commits.webkit.org/320313@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "8d2e7896295d7b73aaf7d2450ec35908326fbc55", "subject": "PolicyChecker.cpp has a dead #undef and leaks five macros into the unified build" }, "320314@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "320314@main", "clUrl": "https://commits.webkit.org/320314@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322896\nrdar://186149141\n\nReviewed by Chris Dumez.\n\nDocumentThreadableLoader declared its six one-byte members\n(m_responsesCanBeOpaque, m_sameOriginRequest, m_simpleRequest, m_async,\nm_delayCallbacksForIntegrityCheck, and the enum class : bool\nm_shouldLogError) interleaved with 8-byte-aligned RefPtr/String/\nunique_ptr/optional members. That scattered them across three separate\nslots, each leaving alignment padding, and inflated the object.\n\nMove all six one-byte members to the end of the member list so their\npadding coalesces into a single slot, and reorder the constructor\ninitializer list to match the new declaration order (no -Wreorder). The\ninitialization is unaffected: m_sameOriginRequest still reads m_origin\nand m_delayCallbacksForIntegrityCheck still reads m_options.integrity,\nboth of which remain initialized ahead of the grouped members.\n\nsizeof(DocumentThreadableLoader) shrinks by 16 bytes on all 64-bit\ntargets (4 bytes on 32-bit); no behavior change.\n\n* Source/WebCore/loader/DocumentThreadableLoader.cpp:\n(WebCore::DocumentThreadableLoader::DocumentThreadableLoader):\n* Source/WebCore/loader/DocumentThreadableLoader.h:\n\nCanonical link: https://commits.webkit.org/320314@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "0be71db6a0fd7c8d70790518ec8ba38870e92aca", "subject": "Reduce sizeof(DocumentThreadableLoader) by grouping its one-byte members" }, "320315@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "320315@main", "clUrl": "https://commits.webkit.org/320315@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322903\nrdar://186161100\n\nReviewed by Chris Dumez.\n\ncreatePotentialAccessControlRequest() read options.storedCredentialsPolicy\nafter WTF::move()'ing options into the CachedResourceRequest. This is a\nuse-after-move that happens to work only because storedCredentialsPolicy is\na scalar, so the move leaves the source intact. It would break silently if\nResourceLoaderOptions ever gained a non-trivial move.\n\nCapture the value into a local before the move. No behavior change.\n\n* Source/WebCore/loader/CrossOriginAccessControl.cpp:\n(WebCore::createPotentialAccessControlRequest):\n\nCanonical link: https://commits.webkit.org/320315@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "e89e47239c6d427db0321fd13d487a463124607e", "subject": "Capture storedCredentialsPolicy before moving ResourceLoaderOptions in CrossOriginAccessControl" }, "320316@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "320316@main", "clUrl": "https://commits.webkit.org/320316@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322905\nrdar://186162338\n\nReviewed by Chris Dumez.\n\nNavigationAction's user-provided default constructor doesn't zero-fill\nmembers, and m_type is the only one without an in-class initializer, so\nit is left indeterminate. DocumentLoader default-constructs\nm_triggeringAction and its type() is read (via triggeringAction())\nbefore a real action is assigned, which is undefined behavior.\n\nInitialize m_type to NavigationType::Other, matching the other members.\n\n* Source/WebCore/loader/NavigationAction.h:\n\nCanonical link: https://commits.webkit.org/320316@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "ba64b8f5131672964e445b50b589635a308feedb", "subject": "NavigationAction::m_type is left uninitialized by the default constructor" }, "320317@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "320317@main", "clUrl": "https://commits.webkit.org/320317@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322902\nrdar://186161217\n\nReviewed by Chris Dumez.\n\nWhen a frameset document is copied, LegacyWebArchive::createFromSelection() wraps\nthe frameset in an \u003ciframe\u003e so it can be pasted into a document that has its own\nbody or frameset. The wrapper markup is built with makeString(), which does no\nprintf-style format expansion, but the width and height were written as \"98%%\".\nThe doubled percent is only meaningful to a printf-family formatter; makeString()\ncopies it verbatim, so the generated markup contained the invalid literal\nwidth=\"98%%\" height=\"98%%\" instead of width=\"98%\" height=\"98%\".\n\nUse a single percent so the wrapper iframe is sized correctly.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/CopyHTML.mm\n\n* Source/WebCore/loader/archive/cf/LegacyWebArchive.cpp:\n(WebCore::LegacyWebArchive::createFromSelection): Emit \"98%\" instead of \"98%%\".\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/CopyHTML.mm:\n(TestWebKitAPI::readWebArchiveDataFromPasteboard): Added.\n(TestWebKitAPI::TEST(CopyHTML, FramesetSelectionIframeWrapperUsesSinglePercent)):\nAdded. Copies a frameset, reads the web archive off the pasteboard, and asserts\nthe wrapper main resource uses width=\"98%\"/he%\".\n\nCanonical link: https://commits.webkit.org/320317@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "a70377af0564cae4749383349407e6e2c6be4b1e", "subject": "LegacyWebArchive iframe wrapper for copied framesets emits literal \"98%%\" width/height" }, "320318@main": { "author": "Phinehas Fuachie", "avatar": "https://www.gravatar.com/avatar/900d85de8c325e38975f39115c36bb75?d=identicon\u0026s=64", "cl": "320318@main", "clUrl": "https://commits.webkit.org/320318@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323142\nrdar://148284059\n\nReviewed by Jer Noble.\n\nsports.yahoo.com posts a PAUSE message to its cross-origin s.yimg.com player frame on rotation,\nwhich pauses the \u003cvideo\u003e even while it is in fullscreen.\n\nAdd RequiresUserGestureToPauseInFullscreenAfterOrientationChangeQuirk, denying a programmatic pause\nof a video in standard fullscreen within 500ms of an orientation change. Scoped to the s.yimg.com\nplayer document embedded in yahoo.com.\n\nRecord the orientation change time on Page rather than Document, and look the quirk up on the player\ndocument rather than the main frame document, so both still work when the player runs in its own\nprocess under site isolation.\n\nUse UserGestureIndicator::processingUserGestureForMedia() rather than the Document accessor, which\nreports true for the whole 5 second transient activation window after the fullscreen tap.\n\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::orientationChanged):\n* Source/WebCore/dom/Document.h:\n(WebCore::Document::lastOrientationChangeTime const):\n* Source/WebCore/html/MediaElementSession.cpp:\n(WebCore::MediaElementSession::playbackStateChangePermitted const):\n* Source/WebCore/page/QuirkNames.h:\n* Source/WebCore/page/QuirkTable.cpp:\n* Source/WebCore/page/Quirks.cpp:\n* Source/WebCore/page/Quirks.h:\n\nCanonical link: https://commits.webkit.org/320318@main", "email": "pfuachie2@apple.com", "hash": "e75adef42393a3c8ddbc4ef10757d06a9feec890", "subject": "Rotating device to landscape exits full screen" }, "320319@main": { "author": "Abrar Rahman Protyasha", "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64", "cl": "320319@main", "clUrl": "https://commits.webkit.org/320319@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323157\nrdar://186303933\n\nReviewed by Richard Robinson, Aditya Keerthi, and Wenson Hsieh.\n\ncreateWebMouseEvent read +[NSEvent pressedMouseButtons] to get the\n`buttons` field, but this method may not report the right state during\ngesture recognizer-driven event synthesis/handling, which produces\npointermoves with .buttons == 0, breaking media controls seeking in\nwikimedia.org (which uses Video.js's components).\n\nTo fix this, we stop reading pressedMouseButtons and instead derive\nbuttons from the recognized event type.\n\nTest: AppKitGesturesTests.Basic.pressDragOverRangeInputReportsHeldButton\n\n* Source/WebKit/Shared/mac/WebEventFactory.mm:\n(WebKit::buttonsMaskForMouseButton):\n(WebKit::buttonsForAutomationEvent):\n(WebKit::WebEventFactory::createWebMouseEvent):\n* Tools/TestWebKitAPI/Resources/cocoa/custom-slider.html:\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift:\n\nCanonical link: https://commits.webkit.org/320319@main", "email": "a_protyasha@apple.com", "hash": "33f7944ccaed19ca603e650b1aa639f5206e9277", "subject": "[AppKit Gestures] wikimedia.org: Cannot press-and-drag over media player controls" }, "320320@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "320320@main", "clUrl": "https://commits.webkit.org/320320@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322898\nrdar://186149573\n\nReviewed by Chris Dumez.\n\ndispatchWillSendRequest() already caches Ref frame = m_frame.get(), and\nthe ASSERT and every subsequent call go through that local, but two\ndocumentLoader() lookups still dereferenced the m_frame member directly.\nRoute them through the cached frame for consistency; no behavior change.\n\nAs drive-by, remove `.get()` as well.\n\n* Source/WebCore/loader/ResourceLoadNotifier.cpp:\n(WebCore::ResourceLoadNotifier::dispatchWillSendRequest):\n\nCanonical link: https://commits.webkit.org/320320@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "2507145cc7b12665dad36410b6031fdd1b3490ce", "subject": "ResourceLoadNotifier::dispatchWillSendRequest re-reads m_frame instead of the cached frame local" }, "320321@main": { "author": "Issac Roy", "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64", "cl": "320321@main", "clUrl": "https://commits.webkit.org/320321@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323180\nrdar://186426179\n\nReviewed by Aakash Jain.\n\nExtend results database reporting to API tests, and use the flakiness verdicts that reporting\nmakes possible so a pull request is not blamed for a flaky API test failure.\n\nEvery exit of AnalyzeAPITestsResults ends the build, so reporting happens inside the steps that\nderive each report rather than in a step queued after them, which would never run. The API run\nproperties are prefixed to namespace them from the identically named layout ones.\n\nAnalyzeAPITestsResults blames the change for a test that failed both runs with the change and\npassed on the clean tree. RunAPITests already drops failures the results database records as\npre-existing, but a test recorded as flaky rather than failing survives that filter and fails that\nway routinely, so the pull request is blamed for a failure it did not cause and the author is left\nto rerun the queue until the flake goes the other way.\n\nThe analyzer now asks the database for a flakiness verdict on each of those tests and drops the\nones it recognizes, which turns the build green and names them in the build summary when they are\nthe only new failures. A CleanTree verdict can never come back for an API test: no API step reports\nWithinStepCleanTree, so the database holds no clean-tree row one could match against. A query that\nfails leaves the failure attributed to the change and records the test in\nresults-db_api_flaky_unknown. A verdict outside INCLUDED_FLAKY_VERDICTS is logged as\nwould-have-ignored rather than excused; nothing narrows the set today, so the path exists for a\nqueue that later does.\n\nA BetweenBuilds verdict with no intra-build evidence is recorded in\nresults-db_api_flaky_unsupported and not acted on. A test that fails on some builds and passes on\nothers, never twice within one build, is as consistent with a configuration-dependent failure as\nwith a flake, and the queue would excuse it on every build.\n\nThe report to the database covers the failures the clean-tree run did not explain, before the\nexcused ones are removed from that set. Reporting the narrowed set instead would starve the verdict\nthat earned the excuse: the rows behind it would stop being written the moment it started working,\nand it would age out of the flakiness window.\n\nThe read belongs in the analyzer rather than beside the pre-existing-failure filter in RunAPITests.\nrun-api-tests has no per-test retry, so the only flakiness an API build observes for itself is the\nsymmetric difference between the two runs with the change, which ReRunAPITests reports as\nBetweenStepsDirtyTree. Excusing a failure during the first run would pass the step before the rerun\nthat produces that evidence ever happens.\n\n* Tools/CISupport/ews-build/factories_unittest.py:\n* Tools/CISupport/ews-build/steps.py:\n(RunAPITests): Prefix the run properties, and split the json parse so the per-test results survive\nrather than only the failure names.\n(RunAPITests.parse_and_set_failures):\n(RunAPITests.parse_api_failures_from_string):\n(RunAPITests.api_failures_from_json):\n(RunAPITests.parse_api_test_json):\n(ReRunAPITests.parse_and_set_failures): Report the tests that failed one of the two runs and passed\nthe other.\n(AnalyzeAPITestsResults):\n(AnalyzeAPITestsResults.run): Report the failures attributed to the change before the build is\nfinished, and drop the ones the results database recognizes as flaky.\n(AnalyzeAPITestsResults.flaky_new_failures_using_results_db):\n* Tools/CISupport/ews-build/steps_unittest.py:\n* Tools/Scripts/webkitpy/api_tests/manager.py:\n(Manager.run): Expose the per-test results already collected for the results database upload,\nlimited to the tests that did not pass so a build log is not swamped.\n\nCanonical link: https://commits.webkit.org/320321@main", "email": "issacroy05@gmail.com", "hash": "66615c600f5c30183209d9383444224e91d5d347", "subject": "[EWS] API test results are not reported to the results database" }, "320322@main": { "author": "Karl Dubost", "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64", "cl": "320322@main", "clUrl": "https://commits.webkit.org/320322@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322976\nrdar://186248273\n\nReviewed by Nikolas Zimmermann.\n\nNothing in WPT holds an item out of an SVG list and then changes the content\nattribute, so no branch of \"synchronizing a list interface object\" is covered:\nhttps://w3c.github.io/svgwg/svg2-draft/types.html#TermSynchronizeList\n\nThe two tests cover the four branches of that algorithm across SVGNumberList,\nSVGLengthList, SVGPointList and SVGTransformList, the SVGStringList branch that\nreplaces the list instead, and animVal reporting the base value when nothing is\nanimating.\n\n33 of 54 and 12 of 20 subtests pass. The failures belong to bugs 322973, 322974\nand 322975, so the baselines record them and a fix shows up as a rebaseline.\nFirefox 156 passes both files in full.\n\nThis will be exported to WPT.\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGList-animVal-reflects-base-value-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGList-animVal-reflects-base-value.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGList-reflected-attribute-synchronize-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGList-reflected-attribute-synchronize.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/w3c-import.log:\n\nCanonical link: https://commits.webkit.org/320322@main", "email": "karlcow@apple.com", "hash": "3af009681039cc036433568f4840b580c2e03219", "subject": "WPT: add coverage for synchronizing a list interface object when the reflected attribute changes" }, "320323@main": { "author": "Karl Dubost", "avatar": "https://www.gravatar.com/avatar/0c2b3d380fb637f3dd51eda704634b6f?d=identicon\u0026s=64", "cl": "320323@main", "clUrl": "https://commits.webkit.org/320323@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323065\n\nReviewed by Nikolas Zimmermann.\n\nNothing in WPT checks that an SVG list returns the same object twice for the\nsame index, or that appendItem and friends return the element they just placed.\nThis adds three tests across SVGNumberList, SVGLengthList, SVGPointList,\nSVGTransformList and SVGStringList.\n\nSVG 2 requires this but never says it in one sentence, so the files are\n.tentative while https://github.com/w3c/svgwg/issues/1169 is open.\n\nNine subtests in SVGList-identity-across-attribute-change fail. That is bug\n322973: a held item is dropped when the attribute is re-parsed, on every list\nexcept SVGTransformList. The failures are in the baseline rather than\nTestExpectations, so fixing 322973 will show up as a rebaseline.\n\nThis will be exported to WPT.\n\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGList-getItem-identity.tentative-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGList-getItem-identity.tentative.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGList-identity-across-attribute-change.tentative-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGList-identity-across-attribute-change.tentative.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGList-mutator-return-identity.tentative-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/types/scripted/SVGList-mutator-return-identity.tentative.html: Added.\n\nCanonical link: https://commits.webkit.org/320323@main", "email": "karlcow@apple.com", "hash": "bce61d8f431e8840ff25d826dc2d8ec192360e85", "subject": "WPT: add coverage for per-index getItem identity on the SVG list interfaces" }, "320324@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "320324@main", "clUrl": "https://commits.webkit.org/320324@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323176\nrdar://186420659\n\nReviewed by Frédéric Wang Nélar.\n\nMathMLElement::rowSpan() used std::max(1u, ...), which clobbered\nrowspan=\"0\" up to 1. Per spec, rowspan=\"0\" means the cell spans all\nremaining rows of its row group, and the render layer already handles\nthis via RenderTableCell::calculateRowSpanForRowSpanZero(). HTML table\ncells get this right through clampHTMLNonNegativeIntegerToRange() with a\nminimum of 0; MathML's mtd was not mirroring that behavior.\n\nMirror HTMLTableCellElement::rowSpan() by using\nclampHTMLNonNegativeIntegerToRange() with minRowspan (0), maxRowspan,\nand defaultRowspan, so a rowspan of 0 reaches the render layer intact.\n\n* LayoutTests/TestExpectations: Unskip now progressed test\n* Source/WebCore/mathml/MathMLElement.cpp:\n(WebCore::MathMLElement::rowSpan const):\n\nCanonical link: https://commits.webkit.org/320324@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "cddba712f11ce83043909d167c1cf9124c7e9e8f", "subject": "MathML rowspan=\"0\" is incorrectly clamped to 1" }, "320325@main": { "author": "Anne van Kesteren", "avatar": "https://www.gravatar.com/avatar/09bb44ac3625a121017cd98d0a7dc52c?d=identicon\u0026s=64", "cl": "320325@main", "clUrl": "https://commits.webkit.org/320325@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=37756\nrdar://186253237\n\nReviewed by Alex Christensen.\n\nA target=_blank activation navigates the new frame it creates, not the\nframe the link was activated in. The policy check for it is made in that\nsource frame all the same, and WebKit routed it through machinery that\nassumes any check a frame makes is for a load of its own, in both\nprocesses, so anything the source frame did next destroyed it.\n\nIn the UI process WebFrameProxy keeps one policy listener per frame and\nsetUpPolicyListenerProxy() resolves the previous one with ignore(), so\neach activation cancelled the one before it: N target=_blank clicks in a\nsingle task opened one window, the last. In the web process\nPolicyChecker::stopCheck() answers every outstanding check with\nPolicyAction::Ignore, so a navigation of the source frame in the same\ntask lost the window outright.\n\n319105@main took download attribute checks out of these same two\ncancellations, though that case is not quite this one: activating a\ndownload attribute link is still a navigation of a kind, and one the\nclient can answer Use for, which makes it an ordinary one. What it shares\nwith creating a new frame is that when the check is made no load in this\nframe is waiting on the answer, so nothing the frame does next\ninvalidates it - unlike the check for a redirect in the load an allowed\nactivation starts, whose DocumentLoader is. Both now turn on that rather\nthan on what kind of check it is.\n\nThe single listener in the UI process dates to 193833@main. 240828@main\nmade the web process able to hold several checks at once for this exact\nsymptom, citing WPT tests that timed out because \"only the last one would\nproceed\", but left the UI process alone, so the symptom survived wherever\nthe embedder does not answer policy synchronously. It still shows in\nSafari: imported/w3c/web-platform-tests/html/semantics/links/links-created-by-a-and-area-elements/target_blank_implicit_noopener.html\npasses under WebKitTestRunner and reports 1 of 13 subtests in Safari,\nalways the last.\n\nThe API test holds every new window decision instead of answering it, so\nall five checks are outstanding at once. As 319105@main notes, a delegate\nthat answers immediately never reaches that state, so no layout test can\ncover the UI process half; one that answers after a single run loop hop\nreaches it only as a race, which made the layout test written first pass\n4 times in 10. The web process half needs no held decision - the check is\noutstanding across the reply from the UI process however fast it comes -\nso a layout test covers that one.\n\nCanonical link: https://commits.webkit.org/320325@main", "email": "annevk@annevk.nl", "hash": "799571146940807a81c8ad8a8d5159a1f6b22009", "subject": "A policy check that does not navigate a frame is cancelled by one that does" }, "320326@main": { "author": "Claudio Saavedra", "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64", "cl": "320326@main", "clUrl": "https://commits.webkit.org/320326@main", "description": "Unreviewed gardening.\n\n* Tools/TestWebKitAPI/glib/TestExpectations.json:\n\nCanonical link: https://commits.webkit.org/320326@main", "email": "csaavedra@igalia.com", "hash": "566cdcf45c197e5387c098c6e912410f6b09d8ca", "subject": "[GLIB] Gardening of API tests" }, "320327@main": { "author": "Kimmo Kinnunen", "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64", "cl": "320327@main", "clUrl": "https://commits.webkit.org/320327@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322712\nrdar://185975901\n\nReviewed by Dan Glastonbury.\n\nRemove CanvasBase::copiedImage(), most notably allowing removal of\nOffscreenCanvas::copiedImage().\n\nOnly HTMLCanvasElement needs copiedImage() to provide an WebCore::Image\nto CSSCanvasValue. OffscreenCanvas does not need this.\n\nReplace WebGLRenderingContextBase texture upload paths to obtain the\nimage data from NativeImages instead. It is pointless to wrap the\nNativeImages into Image instances only to extract the NativeImage\nand the data out. Later on, the NativeImages can be directly used\nto upload the data in some specific cases.\n\n* Source/WebCore/html/CanvasBase.h:\n* Source/WebCore/html/CustomPaintCanvas.cpp:\n(WebCore::CustomPaintCanvas::copiedImage const): Deleted.\n(WebCore::CustomPaintCanvas::clearCopiedImage const): Deleted.\n* Source/WebCore/html/CustomPaintCanvas.h:\n* Source/WebCore/html/HTMLCanvasElement.cpp:\n(WebCore::HTMLCanvasElement::willUpdateContents):\n(WebCore::HTMLCanvasElement::didUpdateSizeProperties):\n(WebCore::HTMLCanvasElement::clearCopiedImage const): Deleted.\n* Source/WebCore/html/HTMLCanvasElement.h:\n* Source/WebCore/html/ImageBitmap.cpp:\n(WebCore::ImageBitmap::createCompletionHandler):\n* Source/WebCore/html/OffscreenCanvas.cpp:\n(WebCore::OffscreenCanvas::didUpdateSizeProperties):\n(WebCore::OffscreenCanvas::transferToImageBitmap):\n(WebCore::OffscreenCanvas::willUpdateContents):\n(WebCore::OffscreenCanvas::copiedImage const): Deleted.\n(WebCore::OffscreenCanvas::clearCopiedImage const): Deleted.\n* Source/WebCore/html/OffscreenCanvas.h:\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:\n(WebCore::CanvasRenderingContext2DBase::createPattern):\n* Source/WebCore/html/canvas/GPUCanvasContextCocoa.mm:\n(WebCore::GPUCanvasContextCocoa::surfaceBufferToImageBuffer):\n* Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp:\n(WebCore::texImageSourceSize):\n(WebCore::nativeImageForTexImageSource):\n(WebCore::WebGLRenderingContextBase::texImageSource):\n(WebCore::WebGLRenderingContextBase::texImageImpl):\n(WebCore::WebGLRenderingContextBase::drawImageIntoBuffer):\n(WebCore::WebGLRenderingContextBase::videoFrameToNativeImage):\n(WebCore::WebGLRenderingContextBase::videoFrameToImage): Deleted.\n* Source/WebCore/html/canvas/WebGLRenderingContextBase.h:\n* Source/WebCore/platform/graphics/GraphicsContextGL.cpp:\n(WebCore::GraphicsContextGL::packImageData):\n(WebCore::GraphicsContextGL::videoFrameToNativeImage):\n(WebCore::GraphicsContextGL::videoFrameToImage): Deleted.\n* Source/WebCore/platform/graphics/GraphicsContextGL.h:\n* Source/WebCore/platform/graphics/GraphicsContextGLImageExtractor.cpp:\n(WebCore::GraphicsContextGLImageExtractor::GraphicsContextGLImageExtractor):\n* Source/WebCore/platform/graphics/GraphicsContextGLImageExtractor.h:\n* Source/WebCore/platform/graphics/cairo/GraphicsContextGLCairo.cpp:\n(WebCore::GraphicsContextGLImageExtractor::extractImage):\n* Source/WebCore/platform/graphics/cg/GraphicsContextGLCG.cpp:\n(WebCore::GraphicsContextGLImageExtractor::extractImage):\n* Source/WebCore/platform/graphics/skia/GraphicsContextGLSkia.cpp:\n(WebCore::GraphicsContextGLImageExtractor::extractImage):\n* Source/WebKit/WebProcess/GPU/graphics/RemoteGraphicsContextGLProxy.cpp:\n(WebKit::RemoteGraphicsContextGLProxy::videoFrameToNativeImage):\n(WebKit::RemoteGraphicsContextGLProxy::videoFrameToImage): Deleted.\n* Source/WebKit/WebProcess/GPU/graphics/RemoteGraphicsContextGLProxy.h:\n\nCanonical link: https://commits.webkit.org/320327@main", "email": "kkinnunen@apple.com", "hash": "715af9163fd6c2b779b66f2b9004c99263e2e068", "subject": "Remove CanvasBase::copiedImage()" }, "320328@main": { "author": "Jamie Murphy", "avatar": "https://www.gravatar.com/avatar/6b42429f4e7db820c9d55e550001567f?d=identicon\u0026s=64", "cl": "320328@main", "clUrl": "https://commits.webkit.org/320328@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321731\n\nReviewed by Timothy Hatcher.\n\nPorts WebProcess WebExtensionAPIRuntime and WebPageRuntime to C++.\nThis adjusts some of the functionality for WebExtensionAPIPort, namely message sending,\nand generally ports most runtime messaging sending functionality to C++.\n\nTest coverage provided by existing Cocoa tests.\n\n* Source/WebKit/CMakeLists.txt:\n* Source/WebKit/DerivedSources-output.xcfilelist:\n* Source/WebKit/DerivedSources.make:\n* Source/WebKit/Shared/Extensions/WebExtensionUtilities.h:\n* Source/WebKit/Shared/Extensions/WebExtensionUtilities.mm:\n(WebKit::toJSRejectedPromise):\n* Source/WebKit/Sources.txt:\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIPortCocoa.mm:\n(WebKit::WebExtensionAPIPort::sender):\n(WebKit::WebExtensionAPIPort::error):\n(WebKit::WebExtensionAPIPort::setError):\n* Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIRuntimeCocoa.mm:\n(WebKit::toWebAPI):\n(WebKit::WebExtensionContextProxy::internalDispatchRuntimeMessageEvent):\n(WebKit::WebExtensionAPIRuntimeBase::reportError): Deleted.\n(WebKit::WebExtensionAPIRuntime::parseConnectOptions): Deleted.\n(WebKit::WebExtensionAPIRuntime::isPropertyAllowed): Deleted.\n(WebKit::WebExtensionAPIRuntime::getURL): Deleted.\n(WebKit::WebExtensionAPIRuntime::getManifest): Deleted.\n(WebKit::WebExtensionAPIRuntime::getVersion): Deleted.\n(WebKit::WebExtensionAPIRuntime::runtimeIdentifier): Deleted.\n(WebKit::WebExtensionAPIRuntime::getPlatformInfo): Deleted.\n(WebKit::WebExtensionAPIRuntime::getBackgroundPage): Deleted.\n(WebKit::WebExtensionAPIRuntime::getFrameId): Deleted.\n(WebKit::WebExtensionAPIRuntime::getDocumentId): Deleted.\n(WebKit::WebExtensionAPIRuntime::setUninstallURL): Deleted.\n(WebKit::WebExtensionAPIRuntime::openOptionsPage): Deleted.\n(WebKit::WebExtensionAPIRuntime::reload): Deleted.\n(WebKit::WebExtensionAPIRuntime::lastError): Deleted.\n(WebKit::WebExtensionAPIRuntime::sendMessage): Deleted.\n(WebKit::WebExtensionAPIRuntime::connect): Deleted.\n(WebKit::WebExtensionAPIRuntime::sendNativeMessage): Deleted.\n(WebKit::WebExtensionAPIRuntime::connectNative): Deleted.\n(WebKit::WebExtensionAPIWebPageRuntime::sendMessage): Deleted.\n(WebKit::WebExtensionAPIWebPageRuntime::connect): Deleted.\n(WebKit::WebExtensionAPIRuntime::onMessage): Deleted.\n(WebKit::WebExtensionAPIRuntime::onConnect): Deleted.\n(WebKit::WebExtensionAPIRuntime::onInstalled): Deleted.\n(WebKit::WebExtensionAPIRuntime::onStartup): Deleted.\n(WebKit::WebExtensionAPIRuntime::onConnectExternal): Deleted.\n(WebKit::WebExtensionAPIRuntime::onMessageExternal): Deleted.\n(WebKit::matches): Deleted.\n(WebKit::WebExtensionContextProxy::dispatchRuntimeMessageEvent): Deleted.\n(WebKit::WebExtensionContextProxy::internalDispatchRuntimeConnectEvent): Deleted.\n(WebKit::WebExtensionContextProxy::dispatchRuntimeConnectEvent): Deleted.\n(WebKit::WebExtensionContextProxy::dispatchRuntimeInstalledEvent): Deleted.\n(WebKit::WebExtensionContextProxy::dispatchRuntimeStartupEvent): Deleted.\n* Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPITabsCocoa.mm:\n(WebKit::WebExtensionAPITabs::connect):\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPIKeys.h:\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPIPort.h:\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPIRuntime.cpp: Copied from Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIRuntimeCocoa.mm.\n(WebKit::makeErrorValue):\n(WebKit::WebExtensionAPIRuntimeBase::reportError):\n(WebKit::WebExtensionAPIRuntime::parseConnectOptions):\n(WebKit::WebExtensionAPIRuntime::isPropertyAllowed):\n(WebKit::WebExtensionAPIRuntime::getManifest):\n(WebKit::WebExtensionAPIRuntime::getURL):\n(WebKit::WebExtensionAPIRuntime::getVersion):\n(WebKit::WebExtensionAPIRuntime::runtimeIdentifier):\n(WebKit::WebExtensionAPIRuntime::getPlatformInfo):\n(WebKit::WebExtensionAPIRuntime::getBackgroundPage):\n(WebKit::WebExtensionAPIRuntime::getFrameId):\n(WebKit::WebExtensionAPIRuntime::getDocumentId):\n(WebKit::WebExtensionAPIRuntime::setUninstallURL):\n(WebKit::WebExtensionAPIRuntime::openOptionsPage):\n(WebKit::WebExtensionAPIRuntime::reload):\n(WebKit::WebExtensionAPIRuntime::lastError):\n(WebKit::WebExtensionAPIRuntime::sendMessage):\n(WebKit::WebExtensionAPIRuntime::connect):\n(WebKit::WebExtensionAPIRuntime::sendNativeMessage):\n(WebKit::WebExtensionAPIRuntime::connectNative):\n(WebKit::WebExtensionAPIWebPageRuntime::sendMessage):\n(WebKit::WebExtensionAPIWebPageRuntime::connect):\n(WebKit::WebExtensionAPIRuntime::onMessage):\n(WebKit::WebExtensionAPIRuntime::onConnect):\n(WebKit::WebExtensionAPIRuntime::onInstalled):\n(WebKit::WebExtensionAPIRuntime::onStartup):\n(WebKit::WebExtensionAPIRuntime::onConnectExternal):\n(WebKit::WebExtensionAPIRuntime::onMessageExternal):\n(WebKit::WebExtensionContextProxy::matchesTarget):\n(WebKit::WebExtensionContextProxy::dispatchRuntimeMessageEvent):\n(WebKit::WebExtensionContextProxy::internalDispatchRuntimeConnectEvent):\n(WebKit::WebExtensionContextProxy::dispatchRuntimeConnectEvent):\n(WebKit::toWebAPI):\n(WebKit::WebExtensionContextProxy::dispatchRuntimeInstalledEvent):\n(WebKit::WebExtensionContextProxy::dispatchRuntimeStartupEvent):\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPIRuntime.h:\n* Source/WebKit/WebProcess/Extensions/Bindings/JSWebExtensionWrapper.cpp:\n(WebKit::toJSValueRef):\n* Source/WebKit/WebProcess/Extensions/Bindings/JSWebExtensionWrapper.h:\n* Source/WebKit/WebProcess/Extensions/Bindings/Scripts/CodeGeneratorExtensions.pm:\n(_generateImplementationFile):\n(_installAutomaticExceptions):\n(_platformType):\n(_platformTypeConstructor):\n(_platformTypeVariableDeclaration):\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIPort.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIRuntime.idl:\n* Source/WebKit/WebProcess/Extensions/Interfaces/WebExtensionAPIWebPageRuntime.idl:\n* Source/WebKit/WebProcess/Extensions/WebExtensionContextProxy.h:\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPIEvent.h:\n* Source/WebKit/WebProcess/Extensions/API/WebExtensionAPINamespace.h:\n* Source/WebKit/Platform/cocoa/CocoaHelpers.h:\n* Source/WebKit/Platform/cocoa/CocoaHelpers.mm:\n(WebKit::callAfterRandomDelay): Deleted.\n* Source/WebKit/Shared/Extensions/WebExtensionUtilities.cpp:\n(WebKit::callAfterRandomDelay):\n\nCanonical link: https://commits.webkit.org/320328@main", "email": "jmurphy@igalia.com", "hash": "a008139f445d37c9609c0929e5fd72615d89d2c4", "subject": "Port WebExtensionAPIRuntime to C++" }, "320329@main": { "author": "Adrian Taylor", "avatar": "https://www.gravatar.com/avatar/d2acb8ad2e2670ff74ae0d65fb27014c?d=identicon\u0026s=64", "cl": "320329@main", "clUrl": "https://commits.webkit.org/320329@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323110\n\nReviewed by Zak Ridouh.\n\nThis is the third in a series of four commits which aim to prove that any\norigin flowing from a Web Contents Process to a privileged process MUST go\nthrough some validation procedure before it's used. The next commit after\nthis one actually switches on that validation. This one is still an\ninfrastructural no-op.\n\ngenerate-message-receiver.py now refuses to generate a receiver if a message\nfrom a web content process into the UI process carries a bare\nWebCore::SecurityOriginData, ClientOrigin, RegistrableDomain, Site or\nSecurityOrigin. The parameter must be declared IPC::Untrusted\u003cT\u003e, at which\npoint the decoder produces the wrapper and the handler's signature has to\naccept it, so the value cannot be used without either validating it or\nexplicitly declining to.\n\nEvery one of the 37 affected UI-process parameters is wrapped here, and every\nhandler calls unsafeExtractWithoutValidation(NeedsReview). That is deliberate:\nthis commit changes no behavior at all, so the mechanism can be reviewed\nseparately from the argument about what each origin should be checked against.\nThe validation policy arrives in the next commit and the bypasses are burnt down\nin the one after.\n\nNotes on the design:\n\n- The wrapping is written out in the .messages.in files rather than applied\n invisibly by the generator. Either would guarantee coverage, but the IDL is\n where a reviewer looks to see what a privileged process is being told, so it is\n worth the 37 lines of noise to have it visible there.\n\n- Only WebContent -\u003e UI is gated, and only origins. Networking and GPU follow in\n later commits, each of which needs its own notion of process authority, and URLs\n follow after that.\n\n- Senders are untouched. The generated message class still takes and encodes a T;\n only the Arguments tuple, and therefore the receiver's signature, changes. The\n wire format is identical, so this is not a serialization change.\n\nThe EXTRACT_WITH_MESSAGE_CHECK family is defined here, rather than in the\ncommit that chooses the validators, so that the mechanism is reviewed once and\nthe next commit is only about which procedure applies where. Each is defined in\nthe translation unit that uses it, over that file's own MESSAGE_CHECK: a single\nshared definition is not possible because the argument order varies -\nWebPageProxy takes the process first, other receivers take the assertion first\n- and they are #undef'd at the end of each file because unified sources would\notherwise collide.\n\nEvery value here is extracted with UnvalidatedReason::NeedsReview, so this\ncommit changes no behaviour: it only makes the types state what must not be\ntrusted. The next commit resolves every one of those, and a later commit\ndeletes NeedsReview so that the compiler enforces that none were missed.\n\nDrive-by: adds TestWithMultipleDispatchedFrom to the TESTS list in\nScripts/webkit/tests/Makefile. It was added with checked-in expectations but never\nlisted, so regenerating them silently deleted its entries.\n\n* Source/WebKit/CMakeLists.txt:\n* Source/WebKit/DerivedSources-input.xcfilelist:\n* Source/WebKit/DerivedSources.make:\n* Source/WebKit/Scripts/generate-message-receiver.py:\n(main):\n* Source/WebKit/Scripts/webkit/messages.py:\n(function_parameter_type):\n(function_parameter_requires_suppress_forward_decl):\n(arguments_constructor_name):\n(message_to_struct_declaration):\n(forward_declarations_and_headers):\n(class_template_headers):\n* Source/WebKit/Scripts/webkit/model.py:\n(MessageReceiver.enforce_opaque_ipc_types_usage):\n(MessageReceiver):\n(MessageReceiver.enforce_untrusted_origin_usage):\n* Source/WebKit/Scripts/webkit/tests/Makefile:\n* Source/WebKit/Scripts/webkit/tests/MessageArgumentDescriptions.cpp:\n(IPC::jsValueForArguments):\n(IPC::messageArgumentDescriptions):\n* Source/WebKit/Scripts/webkit/tests/MessageNames.cpp:\n* Source/WebKit/Scripts/webkit/tests/MessageNames.h:\n* Source/WebKit/Scripts/webkit/tests/TestWithDispatchedFromAndTo.messages.in:\n* Source/WebKit/Scripts/webkit/tests/TestWithDispatchedFromAndToMessageReceiver.cpp:\n(WebKit::TestWithDispatchedFromAndTo::didReceiveMessage):\n(IPC::jsValueForDecodedMessage\u003cMessageName::TestWithDispatchedFromAndTo_UntrustedOrigin\u003e):\n* Source/WebKit/Scripts/webkit/tests/TestWithDispatchedFromAndToMessages.h:\n(Messages::TestWithDispatchedFromAndTo::UntrustedOrigin::name):\n(Messages::TestWithDispatchedFromAndTo::UntrustedOrigin::UntrustedOrigin):\n(Messages::TestWithDispatchedFromAndTo::UntrustedOrigin::encode):\n* Source/WebKit/Scripts/webkit/tests/TestWithUntrackedUntrustedOrigin.messages.in: Copied from Source/WebKit/Scripts/webkit/tests/TestWithDispatchedFromAndTo.messages.in.\n* Source/WebKit/Scripts/webkit/untrusted_origins.py: Added.\n(_strip_const_and_whitespace):\n(_split_template_parameters):\n(_split_container):\n(unwrap_untrusted):\n(unwrap_if_untrusted):\n(conveys_untrusted_value):\n(_process_names):\n(is_privileged_receiver):\n(TestUntrustedOrigins):\n(TestUntrustedOrigins.test_direct_untrusted_types):\n(TestUntrustedOrigins.test_non_untrusted_types):\n(TestUntrustedOrigins.test_containers):\n(TestUntrustedOrigins.test_unknown_containers_are_not_traversed):\n(TestUntrustedOrigins.test_wrapper_is_transparent_to_detection):\n(TestUntrustedOrigins.test_unwrap_untrusted):\n(TestUntrustedOrigins.test_unwrap_if_untrusted):\n(TestUntrustedOrigins.test_bad_formatting):\n(TestUntrustedOrigins.test_split_template_parameters):\n(TestUntrustedOrigins.test_validation_procedures_are_confined):\n(TestUntrustedOrigins.test_unknown_containers_are_traversed):\n* Source/WebKit/UIProcess/Automation/WebAutomationSession.cpp:\n(WebKit::WebAutomationSession::scriptRealmCreated):\n* Source/WebKit/UIProcess/Automation/WebAutomationSession.h:\n* Source/WebKit/UIProcess/Automation/WebAutomationSession.messages.in:\n* Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.cpp:\n(Inspector::ProxyingPageAgent::frameNavigated):\n* Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.h:\n* Source/WebKit/UIProcess/Inspector/Agents/ProxyingPageAgent.messages.in:\n* Source/WebKit/UIProcess/ProvisionalPageProxy.cpp:\n(WebKit::ProvisionalPageProxy::didCommitLoadForFrame):\n* Source/WebKit/UIProcess/ProvisionalPageProxy.h:\n* Source/WebKit/UIProcess/SpeechRecognitionServer.cpp:\n(WebKit::SpeechRecognitionServer::start):\n* Source/WebKit/UIProcess/SpeechRecognitionServer.h:\n* Source/WebKit/UIProcess/SpeechRecognitionServer.messages.in:\n* Source/WebKit/UIProcess/WebAuthentication/Cocoa/WebAuthenticatorCoordinatorProxy.mm:\n* Source/WebKit/UIProcess/WebAuthentication/WebAuthenticatorCoordinatorProxy.cpp:\n(WebKit::WebAuthenticatorCoordinatorProxy::getAssertion):\n(WebKit::WebAuthenticatorCoordinatorProxy::isUserVerifyingPlatformAuthenticatorAvailable):\n(WebKit::WebAuthenticatorCoordinatorProxy::isConditionalMediationAvailable):\n* Source/WebKit/UIProcess/WebAuthentication/WebAuthenticatorCoordinatorProxy.h:\n* Source/WebKit/UIProcess/WebAuthentication/WebAuthenticatorCoordinatorProxy.messages.in:\n* Source/WebKit/UIProcess/WebFrameProxy.cpp:\n(WebKit::WebFrameProxy::commitProvisionalFrame):\n(WebKit::WebFrameProxy::setAppBadge):\n(WebKit::WebFrameProxy::didChangeCSPOriginsThatUpgradeInsecureNavigations):\n* Source/WebKit/UIProcess/WebFrameProxy.h:\n* Source/WebKit/UIProcess/WebFrameProxy.messages.in:\n* Source/WebKit/UIProcess/WebGeolocationManagerProxy.cpp:\n(WebKit::WebGeolocationManagerProxy::startUpdating):\n(WebKit::WebGeolocationManagerProxy::stopUpdating):\n(WebKit::WebGeolocationManagerProxy::setEnableHighAccuracy):\n* Source/WebKit/UIProcess/WebGeolocationManagerProxy.h:\n* Source/WebKit/UIProcess/WebGeolocationManagerProxy.messages.in:\n* Source/WebKit/UIProcess/WebLockRegistryProxy.cpp:\n(WebKit::WebLockRegistryProxy::requestLock):\n(WebKit::WebLockRegistryProxy::releaseLock):\n(WebKit::WebLockRegistryProxy::abortLockRequest):\n(WebKit::WebLockRegistryProxy::snapshot):\n(WebKit::WebLockRegistryProxy::clientIsGoingAway):\n* Source/WebKit/UIProcess/WebLockRegistryProxy.h:\n* Source/WebKit/UIProcess/WebLockRegistryProxy.messages.in:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::commitProvisionalPage):\n(WebKit::WebPageProxy::didCommitLoadForFrame):\n(WebKit::WebPageProxy::requestUserMediaPermissionForFrame):\n(WebKit::WebPageProxy::enumerateMediaDevicesForFrame):\n(WebKit::WebPageProxy::validateCaptureStateUpdate):\n(WebKit::WebPageProxy::requestMediaKeySystemPermissionForFrame):\n(WebKit::WebPageProxy::beginSystemPreview):\n(WebKit::WebPageProxy::postMessageToRemote):\n(WebKit::WebPageProxy::dispatchCrossOriginBeforeUnloadCheckForFrame):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.messages.in:\n* Source/WebKit/UIProcess/WebPermissionControllerProxy.cpp:\n(WebKit::WebPermissionControllerProxy::query):\n* Source/WebKit/UIProcess/WebPermissionControllerProxy.h:\n* Source/WebKit/UIProcess/WebPermissionControllerProxy.messages.in:\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::didCollectPrewarmInformation):\n(WebKit::WebProcessProxy::didCompleteAutofill):\n(WebKit::WebProcessProxy::didObserveFirstPartyUserGesture):\n(WebKit::WebProcessProxy::setAppBadgeFromWorker):\n* Source/WebKit/UIProcess/WebProcessProxy.h:\n* Source/WebKit/UIProcess/WebProcessProxy.messages.in:\n* Source/WebKit/UIProcess/XR/PlatformXRSystem.cpp:\n(WebKit::PlatformXRSystem::requestPermissionOnSessionFeatures):\n* Source/WebKit/UIProcess/XR/PlatformXRSystem.h:\n* Source/WebKit/UIProcess/XR/PlatformXRSystem.messages.in:\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* LayoutTests/ipc/coreipc.js:\n(export.ArgumentSerializer):\n* LayoutTests/ipc/serialized-type-info.html:\n* Source/WebKit/Scripts/webkit/opaque_ipc_types.py:\n* Tools/TestWebKitAPI/Resources/cocoa/coreipc.js:\n(ArgumentSerializer):\n\nCanonical link: https://commits.webkit.org/320329@main", "email": "adrian_taylor@apple.com", "hash": "43379f45ae41cedf2b1046e66a818dd85bbfe1f2", "subject": "[IPC] Require origins reaching the UI process to be declared IPC::Untrusted" }, "320330@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "320330@main", "clUrl": "https://commits.webkit.org/320330@main", "description": "Reviewed by Pascoe.\n\nGive me committer status.\n\n* metadata/contributors.json:\n\nCanonical link: https://commits.webkit.org/320330@main", "email": "chi187@gmail.com", "hash": "12cdd8571cd67f3530a07eb834a0f916adc0037c", "subject": "Give Sergey Rubanov committer status" }, "320331@main": { "author": "Sammy Gill", "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64", "cl": "320331@main", "clUrl": "https://commits.webkit.org/320331@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323179\nrdar://186373617\n\nReviewed by Chris Dumez.\n\nOn bankofamerica.com's wire transfer page the \"Continue Transfer\" button stays\ndisabled because the 2FA step-up modal never appears. The site's\nsparta-stepup-loader-util.js creates the step-up widget's container element from a\nwindow.onload handler, so when the load event is not dispatched the container is missing\nand sparta-widget-loader-util.js throws on document.getElementById(params.containerId).style.\n\nFrameLoader::checkCompleted() checked its completion conditions, set m_isComplete,\nand only then called setReadyState(Complete), which dispatches readystatechange\nsynchronously which can as a result start new loads. In some cases, like\nin bankofamerica.com and the test case, we may end up incrementing the load\nevent delay count. This can then result in us bailing out early in\ncheckCallImplicitClose(). Later on we will enter checkCompleted again but\nbail out really early since we set m_isComplete.\n\nHere we slightly modify the logic so that we check the completion\nconditions (e.g. document-\u003eisDelayingLoadEvent()) after the call to setReadyState()\nbefore setting m_isComplete in case anything changed as a result of\nsetReadyState(). Both checks now share one lambda so the two condition lists cannot\ndrift apart. An outstanding subresource request is deliberately left out of the second\ncheck, since it never gated the load event before this change.\n\nAuthor script running from readystatechange can also re-enter checkCompleted() and\ncomplete the frame before we get back here. In that case the rest of the function has\nalready run, so we return early on m_isComplete rather than dispatching the load event\nfrom inside the readystatechange dispatch and running the tail a second time.\n\nTests: imported/w3c/web-platform-tests/html/dom/documents/resource-metadata-management/load-event-after-readystatechange-starts-load.html\n\n* Source/WebCore/loader/FrameLoader.cpp:\n(WebCore::FrameLoader::checkCompleted): Set m_isComplete after setReadyState(Complete)\nrather than before it, and re-check the completion conditions once the readystatechange\nhandlers have run.\n* LayoutTests/imported/w3c/web-platform-tests/html/dom/documents/resource-metadata-management/load-event-after-readystatechange-starts-load.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/html/dom/documents/resource-metadata-management/load-event-after-readystatechange-starts-load-expected.txt: Added.\nStarts an async script from a readystatechange handler and checks that the window load\nevent is still dispatched rather than being dropped. Whether that new load delays the\nload event is not interoperable, so the test asserts no ordering between the two.\n\nCanonical link: https://commits.webkit.org/320331@main", "email": "sammy.gill@apple.com", "hash": "a4d8f6d0f464caa32a3970a23e2f9dd5475e8b21", "subject": "bankofamerica.com: cannot complete a wire transfer because the window load event is never dispatched" }, "320332@main": { "author": "Claudio Saavedra", "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64", "cl": "320332@main", "clUrl": "https://commits.webkit.org/320332@main", "description": "Unreviewed gardening.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/gtk/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320332@main", "email": "csaavedra@igalia.com", "hash": "619847a8af4c81ae906534c0a86e6bb85890aaa2", "subject": "[GLIB] Gardening of passing tests" }, "320333@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "320333@main", "clUrl": "https://commits.webkit.org/320333@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323207\nrdar://186449124\n\nReviewed by Keith Miller.\n\nTo make performance measurement in JSC shell more aligned to WebContent\nprocess, we call setCurrentThreadIsUserInteractive(-1) to adjust the\nmain thread's QoS.\n\n* Source/JavaScriptCore/jsc.cpp:\n(jscmain):\n\nCanonical link: https://commits.webkit.org/320333@main", "email": "ysuzuki@apple.com", "hash": "c05b265132e42cfd6b406a32ab06a3ae3f89dff6", "subject": "[JSC] Align JSC shell's main thread QoS to WebContent process' one" }, "320334@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "320334@main", "clUrl": "https://commits.webkit.org/320334@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323185\nrdar://186429768\n\nReviewed by Frédéric Wang Nélar.\n\nThis patch aligns WebKit with Gecko / Firefox and Blink / Chromium.\n\nPer MathML Core [1], \"the layout algorithm of the \u003cannotation-xml\u003e and\n\u003cannotation\u003e element is the same as the mtext element\", and annotation-xml may\ncontain arbitrary non-MathML markup (SVG, HTML, content MathML).\n\nIn Core mode MathMLAnnotationElement::childShouldCreateRenderer() delegated to\nMathMLElement::childShouldCreateRenderer(), which only permits MathML children\n(is\u003cMathMLElement\u003e(child)), so annotation text and non-MathML content got no\nrenderer and rendered blank. Route them through\nStyledElement::childShouldCreateRenderer() instead, matching the non-core\nannotation-xml branch.\n\n[1] https://w3c.github.io/mathml-core/#semantics-and-presentation\n\n* LayoutTests/TestExpectations: Unskip passing test\n* Source/WebCore/mathml/MathMLAnnotationElement.cpp:\n(WebCore::MathMLAnnotationElement::childShouldCreateRenderer const):\n\n\u003e Rebaselines:\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/html/syntax/parsing/html-integration-point-expected.txt:\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/html/webappapis/dynamic-markup-insertion/the-innerhtml-property/annotation-xml-fragment-parsing-expected.txt:\n\nCanonical link: https://commits.webkit.org/320334@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "81ff30d194362ef7ec042d47ee0b9e6d73432f36", "subject": "[MathML Core] Non-MathML children of \u003cannotation\u003e and \u003cannotation-xml\u003e are not rendered" }, "320335@main": { "author": "Adrian Taylor", "avatar": "https://www.gravatar.com/avatar/d2acb8ad2e2670ff74ae0d65fb27014c?d=identicon\u0026s=64", "cl": "320335@main", "clUrl": "https://commits.webkit.org/320335@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323119\n\nReviewed by Zak Ridouh.\n\nFirstPartyAuthority::checkUntrusted derived the registrable domain before the\nguard that throws it away. Deriving one from an origin calls\nPublicSuffixStore::topPrivatelyControlledDomain(), which takes a global lock,\nlooks the host up in a 128-entry cache with random eviction, isolatedCopy()s\nthe result, and on a miss consults the platform public suffix list.\ncheckUntrustedDomain() then returns immediately whenever site isolation is off\n- every shipping configuration today - so that work was wasted on every\norigin-bearing message that reaches a validated receiver.\n\ncheckUntrustedDomain() now takes the domain as a NOESCAPE function and calls it\nonly once it has decided the question is worth asking. The overloads that\nalready hold a domain hand it back by const reference, so nothing is copied for\nthem either.\n\nNo behaviour change: the same values reach the same checks with the same\nanswers.\n\n* Source/WebKit/UIProcess/FirstPartyAuthority.h:\n(WebKit::FirstPartyAuthority::checkUntrusted const):\n(WebKit::FirstPartyAuthority::checkUntrustedDomain const):\n\nCanonical link: https://commits.webkit.org/320335@main", "email": "adrian_taylor@apple.com", "hash": "ee629dabaf61cdac72bad52e589b79c1de128b16", "subject": "[IPC] Do not derive a registrable domain that FirstPartyAuthority will discard" }, "320336@main": { "author": "Elijah Sawyers", "avatar": "https://www.gravatar.com/avatar/4ebf94dc3e9f26bbcabb35f183712595?d=identicon\u0026s=64", "cl": "320336@main", "clUrl": "https://commits.webkit.org/320336@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=313971\nrdar://176177851\n\nReviewed by Timothy Hatcher.\n\nThis patch makes a Safari Web Extension fire webRequest.onBeforeRequest followed by\nwebRequest.onErrorOccurred when a load is blocked by the extension's own declarativeNetRequest rule,\nmatching Chrome and Firefox. Previously no webRequest event fired for such a load.\n\ndNR block rules are compiled to a content rule list and enforced by the content-extension engine in\nthe WebProcess, before the load reaches the NetworkProcess where webRequest events are generated, so\na blocked load never produced any webRequest event.\n\nThis patch adds a contentRuleListDidBlockLoad hook, fired at the content-blocker enforcement sites,\nwhich forwards the info to the UIProcess. From there, it is routed to the extension whose own rule\nlist blocked the load. That extension's uses the existing webRequest dispatch to fire onBeforeRequest\nand then onErrorOccurred. The events are observe-only, dNR still blocks the load.\n\nThe webRequest onErrorOccurred handler previously reported a hardcoded \"net::ERR_ABORTED\" string. It\nnow reports the error's real localized description, so a blocked load reports \"The URL was blocked\nby a content blocker\" and no net:: error strings remain.\n\nIt's worth noting the extension that I used locally to test this:\n\n https://jeurissen.co/webext-demos/webrequest-for-dnr-blocked\n\nThis extension registers the webRequest event observers and then immediately creates a tab for a dNR-\nblocked webpage with browser.tabs.create, which for some reason is not firing the expected events.\nReloading the blocked webpages or navigating to them from the address bar does fire the events. This\nbug/behavior is not related to my change and occurs for any webRequest, even if the webpage is not\nblocked by dNR. I have filed rdar://186381292 to look into this.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIWebRequest.mm\n\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/contentextensions/ContentRuleListBlockedLoadInfo.h: Added.\n* Source/WebCore/loader/ResourceLoader.cpp:\n(WebCore::ResourceLoader::willSendRequestInternal):\n* Source/WebCore/loader/cache/CachedResourceLoader.cpp:\n(WebCore::blockingContentRuleListIdentifiers):\n(WebCore::CachedResourceLoader::requestResource):\n* Source/WebCore/page/ChromeClient.h:\n(WebCore::ChromeClient::contentRuleListDidBlockLoad):\n* Source/WebKit/Shared/Extensions/WebExtensionContentRuleListBlockedLoadInfo.h: Added.\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionContextCocoa.mm:\n(WebKit::WebExtensionContext::resourceLoadWasBlockedByDeclarativeNetRequest):\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionControllerCocoa.mm:\n(WebKit::WebExtensionController::resourceLoadWasBlockedByContentRuleList):\n* Source/WebKit/UIProcess/Extensions/WebExtensionContext.h:\n* Source/WebKit/UIProcess/Extensions/WebExtensionController.h:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::contentRuleListDidBlockLoad):\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/WebPageProxy.messages.in:\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIWebRequestCocoa.mm:\n(WebKit::WebExtensionContextProxy::resourceLoadDidBlockBeforeRequest):\n(WebKit::WebExtensionContextProxy::resourceLoadDidCompleteWithError):\n* Source/WebKit/WebProcess/Extensions/WebExtensionContextProxy.h:\n* Source/WebKit/WebProcess/Extensions/WebExtensionContextProxy.messages.in:\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:\n(WebKit::toResourceLoadInfoType):\n(WebKit::parentFrameIDForBlockedLoad):\n(WebKit::WebChromeClient::contentRuleListDidBlockLoad):\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIWebRequest.mm:\n(TestWebKitAPI::TEST(WKWebExtensionAPIWebRequest, WebRequestFiresForDeclarativeNetRequestBlockedLoad)):\n\nCanonical link: https://commits.webkit.org/320336@main", "email": "esawyers@apple.com", "hash": "162e02396fa26f8dc844bb5d5df12cefabdceca4", "subject": "Fire webRequest events for declarativeNetRequest-blocked loads" }, "320337@main": { "author": "Mark Lam", "avatar": "https://www.gravatar.com/avatar/87a4219a10aeda88757492c63da746de?d=identicon\u0026s=64", "cl": "320337@main", "clUrl": "https://commits.webkit.org/320337@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323167\nrdar://186413086\n\nReviewed by Marcus Plutowski and Dan Hecht.\n\nNow introducing and using a SuiteTracer RAII class to track testLibJSCTools' test suite\nrun times. We will use this to make sure test suites don't take too long to run. To dumpi\nrun times, run testLibJSCTools with the --verbose option.\n\nThe intermittent hang is due to spurious wakes from waits in testProcess() and its utility\nfunction, reapedChildPid(). These functions were not previously accounting for the spurious\nwakes. This is now fixed.\n\nNo new tests because this change is for enhancing and fixing an existing test.\n\n* Source/JavaScriptCore/corpse/tests/CorpseAddressTest.cpp:\n(JSCToolsTest::testAddress):\n* Source/JavaScriptCore/corpse/tests/CorpseByteParserTest.cpp:\n(JSCToolsTest::testByteParser):\n* Source/JavaScriptCore/corpse/tests/CorpseExportsTrieTest.cpp:\n(JSCToolsTest::testExportsTrie):\n(JSCToolsTest::fuzzExportsTrie):\n* Source/JavaScriptCore/corpse/tests/CorpseProcessTest.cpp:\n(JSCToolsTest::reapedChildPid):\n(JSCToolsTest::testProcess):\n* Source/JavaScriptCore/corpse/tests/CorpseRegionTest.cpp:\n(JSCToolsTest::testRegion):\n* Source/JavaScriptCore/corpse/tests/CorpseSnapshotTest.cpp:\n(JSCToolsTest::testSnapshot):\n* Source/JavaScriptCore/corpse/tests/CorpseSymbolTest.cpp:\n(JSCToolsTest::testSymbol):\n* Source/JavaScriptCore/corpse/tests/CorpseThreadTest.cpp:\n(JSCToolsTest::testThreads):\n* Source/JavaScriptCore/corpse/tests/LibJSCToolsTestUtilities.cpp:\n(JSCToolsTest::SuiteTracer::SuiteTracer):\n(JSCToolsTest::SuiteTracer::~SuiteTracer):\n(JSCToolsTest::totalSuiteTime):\n(JSCToolsTest::beginSuite): Deleted.\n* Source/JavaScriptCore/corpse/tests/LibJSCToolsTestUtilities.h:\n(JSCToolsTest::SuiteTracer::shouldRun const):\n* Source/JavaScriptCore/corpse/tests/testLibJSCTools.cpp:\n(main):\n\nCanonical link: https://commits.webkit.org/320337@main", "email": "mark.lam@apple.com", "hash": "afbe314b93fc84ded1e57c21a32d955cd6197931", "subject": "Enhance testLibJSCTools to track test suite run time, and fix an intermittent hang." }, "320338@main": { "author": "Cole Carley", "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64", "cl": "320338@main", "clUrl": "https://commits.webkit.org/320338@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323025\nrdar://186290524\n\nReviewed by Brent Fulgham.\n\nThere are many compile flags in the Quirks table, which makes it\ndifficult to read and reason about. Instead of having many compile\nflags, we make the availability of the behavior or quirk data\nreturned from a function or on the Quirk. This significantly cleans\nup the table and more closely models what we'll see when we switch\nto defining quirks in a data file.\n\nQuirks that are unavailable for the current platform are still compiled\nout of the binary to reduce code bloat by pruning the table at compile\ntime.\n\n* Source/WebCore/page/QuirkNames.h:\n* Source/WebCore/page/QuirkTable.cpp:\n(WebCore::SiteSpecificQuirks::listsEveryQuirkOnce):\n(WebCore::SiteSpecificQuirks::computeUnavailableQuirks):\n(WebCore::Quirk::apply const):\n(WebCore::resolveSiteSpecificQuirks):\n(WebCore::SiteSpecificQuirks::shouldEmit):\n(WebCore::SiteSpecificQuirks::emittedQuirkCount):\n(WebCore::SiteSpecificQuirks::emittedQuirkIndices):\n(WebCore::SiteSpecificQuirks::maskedQuirk):\n(WebCore::SiteSpecificQuirks::prunedTable):\n(WebCore::SiteSpecificQuirks::everyEmittedQuirkIsUsable):\n* Source/WebCore/page/QuirkTable.h:\n(WebCore::QuirkBehaviors::exclude):\n\nCanonical link: https://commits.webkit.org/320338@main", "email": "ccarley2@apple.com", "hash": "785247e3f1d650d27c2fc9653e0881307fdae98e", "subject": "[Quirks] Reduce compile flags in Quirks table" }, "320339@main": { "author": "Adrian Taylor", "avatar": "https://www.gravatar.com/avatar/d2acb8ad2e2670ff74ae0d65fb27014c?d=identicon\u0026s=64", "cl": "320339@main", "clUrl": "https://commits.webkit.org/320339@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323220\nrdar://186466509\n\nReviewed by Claudio Saavedra.\n\nWindows build was failing with:\nSource/WebKit/WebKit_SwiftRebuildTrigger.swift -\u003e\nSource/WebKit/WebKit_SwiftRebuildTrigger.swift\ndue to backslash vs slash comparisons.\n\nCanonical link: https://commits.webkit.org/320339@main", "email": "adrian_taylor@apple.com", "hash": "6eb84d9263d323778eaea1ab3fe87e784a183706", "subject": "Fix Windows build intermittency" }, "320340@main": { "author": "Antti Koivisto", "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64", "cl": "320340@main", "clUrl": "https://commits.webkit.org/320340@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323201\nrdar://186439114\n\nReviewed by Alan Baradlay.\n\nPer\n\nhttps://github.com/w3c/csswg-drafts/issues/12315\n\nsomething like\n\n@function --f(--arg \u003ccolor\u003e) {\n result: if(\n style(--arg: red): 1;\n else: 2;\n );\n}\n--f(#f00) // red color\n\nshould return '1'.\n\nThe current implementation based on the spec text registers the parameters for result resolution as untyped.\n\nRegister them with the declared type instead. A body declaration assigning to the parameter name is then\ncomputed against the type too, and style() compares computed values instead of token streams.\n\nA parameter registration carries the type but is not an author registration, so a var() fallback for one\nis no longer held to its syntax. Otherwise an invalid argument makes var(--arg, fallback) invalid instead\nof using the fallback.\n\nAlso fix inheritance of the properties from calling context in nested function calls. LocalPropertyRegistry\nchains to the enclosing frame, so a typed name keeps its type when a function is called from a function\nbody. Finding a registration and deciding which frame owns a name are separate now: get() chains,\ndeclares() does not. applyCustomPropertyFromCallingContext uses declares(), since a name owned by an outer\nframe is inherited from the calling context rather than resolved to its initial value.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/functions/function-parameter-types.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/random-in-custom-function.tentative-expected.txt:\n* Source/WebCore/style/StyleBuilder.cpp:\n(WebCore::Style::Builder::applyCustomPropertyFromCallingContext):\n* Source/WebCore/style/StyleLocalPropertyRegistry.cpp:\n(WebCore::Style::LocalPropertyRegistry::get const):\n(WebCore::Style::LocalPropertyRegistry::declares const):\n* Source/WebCore/style/StyleLocalPropertyRegistry.h:\n(WebCore::Style::LocalPropertyRegistry::LocalPropertyRegistry):\n* Source/WebCore/style/StyleSubstitutionResolver.cpp:\n(WebCore::Style::SubstitutionResolver::substituteNamedValueOrFallback):\n(WebCore::Style::SubstitutionResolver::resolveAndRegisterDashedFunctionArguments):\n(WebCore::Style::SubstitutionResolver::substituteDashedFunction):\n\nCanonical link: https://commits.webkit.org/320340@main", "email": "antti@apple.com", "hash": "c32254dca34ad0f86962bcb81d101e368a6b1647", "subject": "[css-mixins-1] A typed function parameter should keep its type" }, "320341@main": { "author": "Abrar Rahman Protyasha", "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64", "cl": "320341@main", "clUrl": "https://commits.webkit.org/320341@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323127\nrdar://185381317\n\nReviewed by Richard Robinson.\n\nWKWebView.magnification reports the live scale during an ongoing gesture\nand otherwise falls back to the page scale factor. However, at the end\nof a gesture, we clear the active gesture type synchronously, while the\ncommitted transient zoom is not written to the page scale factor until\nsendCommitTransientZoom() runs (asynchronously) after the gesture\nanimation is complete (and CATransaction.completionBlock runs). In this\nperiod, we report the scale from before the gesture started, which is\nwrong.\n\nWe account for the committed-but-not-reflected phase by plumbing a\ncommittedTransientZoomScale value, set in commitTransientZoom(), which\nwe promptly unset in sendCommitTransientZoom() when the page scale\nfactor is actually written.\n\nTest: TestWebKitAPI.WKWebViewMagnification\n\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivateForTesting.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewTesting.mm:\n(-[WKWebView _minMagnification]):\n(-[WKWebView _maxMagnification]):\n* Source/WebKit/UIProcess/DrawingAreaProxy.h:\n(WebKit::DrawingAreaProxy::committedTransientZoomScale const):\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeDrawingAreaProxyMac.h:\n* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeDrawingAreaProxyMac.mm:\n(WebKit::RemoteLayerTreeDrawingAreaProxyMac::commitTransientZoom):\n(WebKit::RemoteLayerTreeDrawingAreaProxyMac::sendCommitTransientZoom):\n* Source/WebKit/UIProcess/ViewGestureController.cpp:\n(WebKit::ViewGestureController::prepareMagnificationGesture):\n(WebKit::ViewGestureController::magnification const):\n* Tools/TestWebKitAPI/Configurations/Base.xcconfig:\n* Tools/TestWebKitAPI/PlatformCocoa.cmake:\n* Tools/TestWebKitAPI/SourcesMac.txt:\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/mac/WKWebViewMagnification.mm: Added.\n(TestWebKitAPI::magnify):\n(TestWebKitAPI::magnifyPastMaximum):\n(TestWebKitAPI::lowestMagnificationReportedAfterGesture):\n(TestWebKitAPI::webViewWithMagnificationAllowed):\n(TestWebKitAPI::runAccurateAtGestureEndTest):\n(TestWebKitAPI::TEST(WKWebViewMagnification, AccurateAtGestureEnd)):\n(TestWebKitAPI::TEST(WKWebViewMagnification, AccurateAtGestureEndPDF)):\n Separate PDF case since the plugin handles its own scale, and also\n has separate magnification limits from regular web content.\n\nCanonical link: https://commits.webkit.org/320341@main", "email": "a_protyasha@apple.com", "hash": "d732d3bb86897cc43697d418eb589d29081ed549", "subject": "WKWebView.magnification reports the pre-gesture scale while a committed transient zoom animates" }, "320342@main": { "author": "Basuke Suzuki", "avatar": "https://www.gravatar.com/avatar/5192a1151c7575317affb7a4633f8d63?d=identicon\u0026s=64", "cl": "320342@main", "clUrl": "https://commits.webkit.org/320342@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323229\nrdar://181302060\n\nReviewed by Ben Nham and Alex Christensen.\n\nremoveNetworkWebsiteData() constructs its CompletionHandler on the NetworkProcess main run loop, but\ninvokes it from the reply block of -[UsageFeed performNetworkDomainsActionWithOptions:reply:], which\nSymptom delivers on a libdispatch worker thread. The construction-thread assertion then fires:\n\n ASSERTION FAILED: threadLikeAssertion.isCurrent()\n\nThe off-main call dates to bug 227045 (2021) and the construction-thread assertion to bug 246271\n(2022), but Release+ASAN builds compiled the check as a no-op until bug 309216 promoted\nassertIsCurrent from ASSERT_UNUSED to ASSERT_WITH_SECURITY_IMPLICATION. WebKitTestRunner now asserts\nin the network process during startup, which blocks WebGL fuzzing. The path is iOS-only because it\nis guarded by ENABLE(APP_PRIVACY_REPORT), so macOS compiles the synchronous #else stub instead.\n\nHop back to the main run loop before invoking the handler, the same pattern already used by\nNetworkDataTaskCocoa::setH2PingCallback.\n\nAlso fix the case where performNetworkDomainsActionWithOptions: cannot make the request: the reply\nblock is then dropped without being invoked, so the CompletionHandler was destroyed uncalled,\nhanging the website data removal and tripping the \"Completion handler should always be called\"\nassertion. Wrapping it in a CompletionHandlerWithFinalizer makes it called exactly once either way.\n\nNo new tests (the affected path needs the Symptom framework on an iOS device; see the FIXME about\nrdar://81420753 above it).\n\n* Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm:\n(WebKit::NetworkSessionCocoa::removeNetworkWebsiteData):\n\nCanonical link: https://commits.webkit.org/320342@main", "email": "basuke@apple.com", "hash": "bb4fbe652ab8d2237260f5bde8558830e187e830", "subject": "[iOS] NetworkSessionCocoa::removeNetworkWebsiteData calls its CompletionHandler off the main run loop" }, "320343@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "320343@main", "clUrl": "https://commits.webkit.org/320343@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322468\nrdar://185754041\n\nReviewed by Jessica Cheung.\n\nHighlightRegistry::initializeMapLike() populated the maplike backing map by\nwalking m_map, a HashMap\u003cAtomString, Ref\u003cHighlight\u003e\u003e, handing entries to the\nbacking JSMap in bucket order rather than the insertion order WebIDL maplike\nrequires. The class already tracks registration order in m_highlightNames, which\nhighlightsFromPoint() uses for this very reason; iterate that instead.\n\nHighlightRegistry-iteration.html misses this because forwardSetToMapLike() calls\nsetFromMapLike() before getAndInitializeBackingMap(): the first\nCSS.highlights.set() initializes the backing map while m_map holds one entry, and\nlater set() calls find it present and skip initializeMapLike() entirely. Hash\norder only surfaces when the backing map is rebuilt with two or more entries\nalready registered. Since DOMCSSNamespace.idl declares highlights without\n[SameObject] or [CachedAttribute], the wrapper holding that backing map is only\nweakly held while the registry lives on the Document, so collecting it makes the\nnext CSS.highlights access replay m_map in capacity-dependent order. A second JS\nworld reaches the same rebuild, since each world gets its own wrapper.\n\nThe test registers 32 highlights, drops the wrapper, forces a collection, and\nchecks keys() order. It first asserts an expando on the original wrapper is gone,\nso it fails loudly rather than vacuously if nothing was reclaimed.\n\nTest: highlight/highlight-registry-iteration-order-after-gc.html\n\n* LayoutTests/highlight/highlight-registry-iteration-order-after-gc-expected.txt: Added.\n* LayoutTests/highlight/highlight-registry-iteration-order-after-gc.html: Added.\n* Source/WebCore/Modules/highlight/HighlightRegistry.cpp:\n(WebCore::HighlightRegistry::initializeMapLike):\n\nCanonical link: https://commits.webkit.org/320343@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "a30b2a9cbf922ee355d8aacfeb3d2a9be4e6d098", "subject": "CSS.highlights iterates in hash order instead of registration order after its wrapper is garbage collected" }, "320345@main": { "author": "Phinehas Fuachie", "avatar": "https://www.gravatar.com/avatar/900d85de8c325e38975f39115c36bb75?d=identicon\u0026s=64", "cl": "320345@main", "clUrl": "https://commits.webkit.org/320345@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323189\nrdar://186384656\n\nReviewed by Jean-Yves Avenard.\n\nEnabling captions inline, entering fullscreen, then going back inline and playing a different video\nleft a frozen caption frame on screen in fullscreen showing the earlier video's text, and it\nreappeared every subsequent time that video was put into fullscreen.\n\nCaptionMirror scrapes YouTube's in-page caption windows into a hidden text track that the system\ndisplays in fullscreen. Its cues are created with an effectively infinite end time, so they only go\naway when something removes them, and the only thing that removed them was a MutationObserver bound\nto the single .ytp-caption-window-container node found at setup. Nothing re-attached that observer\nwhen YouTube replaced the container, and the wait observer disconnected permanently after its first\nsuccess, so the cues stopped being updated and stayed active forever. Entering fullscreen then\nflipped the track to 'showing' without re-syncing, displaying whichever stale cue was added last.\n\nRe-resolve the container before every sync and re-attach the observer when it has changed, drop the\ncues when the media resource changes, and re-sync before making the mirror track visible.\n\n* Source/WebCore/Modules/modern-media-controls/media/YouTubeCaptionQuirk.js:\n(CaptionMirror):\n(CaptionMirror.prototype.invalidate):\n(CaptionMirror.prototype._handleCaptionStateChanged):\n(CaptionMirror.prototype._handleResourceChanged):\n(CaptionMirror.prototype._updateCues):\n(CaptionMirror.prototype._removeAllCues):\n(CaptionMirror.prototype._syncCues):\n(CaptionMirror.prototype._attachCaptionWindowObserver):\n(CaptionMirror.prototype._detachCaptionObserver):\n(CaptionMirror.prototype._attachCaptionObserver):\n(CaptionMirror.prototype._handlePresentationModeChanged):\n\nCanonical link: https://commits.webkit.org/320345@main", "email": "pfuachie2@apple.com", "hash": "8d0af7a74aebae5d49c28a6a1f8251e744f995ee", "subject": "YouTube captions freeze on the previous video's text in fullscreen" }, "320346@main": { "author": "Sammy Gill", "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64", "cl": "320346@main", "clUrl": "https://commits.webkit.org/320346@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322865\nrdar://problem/186113237\n\nReviewed by Alan Baradlay.\n\nGridLanesLayout kept the two outputs of a placement pass, m_itemOffsets and\nm_gridContentSize, as member variables and exposed them through offsetForGridItem() and\ngridContentSize(). That forced RenderGrid to hold a reference to the whole placement\nobject for the rest of layout just to read those two values, which is why\nGridLanesLayoutRef was threaded through eight RenderGrid methods.\n\nIntroduce a GridLanesResult class which owns those two values and return it by value from\nperformGridLanesPlacement(). This makes the output of a Grid Lanes type of layout much more\ndefined. Callers do not need to figure out what they need in order to have a proper layout\nand that responsibility is pushed onto GridLanesLayout to define that output properly.\n\n* Source/WebCore/rendering/GridLanesLayout.cpp:\n(WebCore::GridLanesLayout::placeGridLanesItems): Builds the result from each item's\nplacement, absorbing the offset bookkeeping from updateItemOffset().\n(WebCore::GridLanesLayout::insertIntoGridAndLayoutItem): Reports the item's placement\nrather than writing it into an out-param.\n(WebCore::GridLanesLayout::updateRunningPositions): Ditto.\n(WebCore::GridLanesResult::stackingAxisOffsetForGridItem): Moved from\nGridLanesLayout::offsetForGridItem().\n(WebCore::GridLanesLayout::updateItemOffset): Deleted, folded into placeGridLanesItems().\n* Source/WebCore/rendering/GridLanesLayout.h:\n* Source/WebCore/rendering/GridTrackSizingAlgorithm.cpp:\n(WebCore::GridTrackSizingAlgorithm::computeTrackBasedSize): Comment now names the result\nthat callers actually read the placed size from.\n* Source/WebCore/rendering/RenderGrid.cpp:\n* Source/WebCore/rendering/RenderGrid.h:\n\nCanonical link: https://commits.webkit.org/320346@main", "email": "sammy.gill@apple.com", "hash": "f7478a24f9c59b29f4befcf9cc147feff3bef3f3", "subject": "[Grid Lanes][Cleanup] Return a GridLanesResult from placement." }, "320347@main": { "author": "Fady Farag", "avatar": "https://www.gravatar.com/avatar/0ac5127c69f90d0c57054173ae4c3108?d=identicon\u0026s=64", "cl": "320347@main", "clUrl": "https://commits.webkit.org/320347@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323161\nrdar://186410747\n\nReviewed by Dan Glastonbury and Chris Dumez.\n\nThis makes `TrackingAndRenderingClient` ref-countable since nothing enforces\nthat the client stays alive across its virtual functions.\n\nNo new tests, no behavior change.\n\n* Source/WebCore/platform/xr/PlatformXR.h:\n* Source/WebCore/testing/WebFakeXRDevice.cpp:\n(WebCore::SimulatedXRDevice::setVisibilityState):\n(WebCore::SimulatedXRDevice::simulateShutdownCompleted):\n(WebCore::SimulatedXRDevice::initializeTrackingAndRendering):\n* Source/WebKit/Shared/XR/XRDeviceProxy.cpp:\n(WebKit::XRDeviceProxy::sessionDidEnd):\n(WebKit::XRDeviceProxy::updateSessionVisibilityState):\n(WebKit::XRDeviceProxy::sessionDidInitializeRendering):\n(WebKit::XRDeviceProxy::initializeTrackingAndRendering):\n\nCanonical link: https://commits.webkit.org/320347@main", "email": "com.webkit.iidmsa@gmail.com", "hash": "d3e5e156482fdbdd56bbb62c9f47f20291265818", "subject": "Harden `PlatformXR::Device` by making `TrackingAndRenderingClient` ref-countable" }, "320348@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "320348@main", "clUrl": "https://commits.webkit.org/320348@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323102\n\nReviewed by Yusuke Suzuki.\n\nHeap::m_topGCOwnedDataScope is a debug-only, unsynchronized field that says\nwhether a GCOwnedDataScope is live on the mutator's stack, and\nHeap::clearConcurrentRetainedDataIfPossible asserts it is null before dropping\nthe old StringImpls it keeps alive for such scopes. Compiler and GC threads are\ncovered by separate checks there. But JIT::emit_compareImpl and\nLOLJIT::emitCompareImpl read a single-character string constant through\nJSString::tryGetValue(), which returns a GCOwnedDataScope, so the JITWorker\nthread writes the field too. If the IncrementalSweeper timer fires while the\nJIT thread is inside that scope, the assertion aborts even though the\nongoing-compilation check would have kept the strings alive.\n\nRead the constant through tryGetValueImpl() and StringImpl::at(0), as the DFG\nalready does, and assert in setTopGCOwnedDataScopeIfNeeded and\nclearTopGCOwnedDataScopeIfNeeded that they never run on a compiler thread.\nGC threads still construct such scopes, since\nErrorInstance::reconcileWeakReferencesAtGCEnd materializes stack traces into\nstrings on the collector thread, so the field keeps ignoring them.\n\nThis assertion fired in an ASan build in Bun's CI. Release builds are not\naffected.\n\n* Source/JavaScriptCore/heap/GCOwnedDataScope.cpp:\n(JSC::setTopGCOwnedDataScopeIfNeeded):\n(JSC::clearTopGCOwnedDataScopeIfNeeded):\n* Source/JavaScriptCore/jit/JITArithmetic.cpp:\n(JSC::JIT::emit_compareImpl):\n* Source/JavaScriptCore/lol/LOLJIT.cpp:\n(JSC::LOL::LOLJIT::emitCompareImpl):\n\nCanonical link: https://commits.webkit.org/320348@main", "email": "sosuke@bun.sh", "hash": "1edc620316f57c3c4539f58d5c9e00f33fcc29f6", "subject": "[JSC] Baseline JIT should not construct `GCOwnedDataScope` on the compiler thread" }, "320349@main": { "author": "Cameron McCormack", "avatar": "https://www.gravatar.com/avatar/b2bb1b369be938a743e50f595bfa0798?d=identicon\u0026s=64", "cl": "320349@main", "clUrl": "https://commits.webkit.org/320349@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323124\nrdar://problem/186387817\n\nReviewed by Dan Glastonbury.\n\nBased on current results.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n* LayoutTests/platform/mac/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320349@main", "email": "heycam@apple.com", "hash": "ba5ac22ab518d55e58b393d63425af5146dc02e6", "subject": "Update expectations for some WebGL tests" }, "320350@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "320350@main", "clUrl": "https://commits.webkit.org/320350@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323238\nrdar://186489725\n\nReviewed by Yijia Huang.\n\nFix obviously wrong B3 value emission. But right now it is not used yet,\nso no issues in practice.\n\n* Source/JavaScriptCore/ftl/FTLOutput.cpp:\n(JSC::FTL::Output::load):\n\nCanonical link: https://commits.webkit.org/320350@main", "email": "ysuzuki@apple.com", "hash": "60d939f1f90c5942d2219834e4de4b33a31e4505", "subject": "[JSC] Fix wrong instruction emission for Output::load" }, "320351@main": { "author": "Dominic Mazzoni", "avatar": "https://www.gravatar.com/avatar/f76643c44a7ee3be45148e66d97ed8e4?d=identicon\u0026s=64", "cl": "320351@main", "clUrl": "https://commits.webkit.org/320351@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323182\nrdar://186427494\n\nReviewed by Tyler Wilcock.\n\nIn-between queueForDestruction and applyPendingChangesOrTearDown, if\naccessibilityRootObjectWrapper got called it applied pending changes\nand cleared m_hasPendingChanges, which prevented it from being torn\ndown.\n\nThe stale tree then kept the bug alive on its own: because\nm_isolatedTree only clears when the tree dies, and because a\nnon-null tree short-circuits the off-main-thread fast path, the\nmain-thread path that would have built a replacement tree was\nnever reached again.\n\nThe fix is to check m_queuedForDestruction first, so teardown does not\ndepend on a flag any other thread can consume.\n\nTest: accessibility/mac/client/isolated-tree-after-navigation.html\n\n* LayoutTests/accessibility/mac/client/isolated-tree-after-navigation-expected.txt: Added.\n* LayoutTests/accessibility/mac/client/isolated-tree-after-navigation.html: Added.\n* LayoutTests/accessibility/mac/client/resources/isolated-tree-after-navigation-second.html: Added.\n* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp:\n(WebCore::AXIsolatedTree::applyPendingChangesOrTearDown):\n\nCanonical link: https://commits.webkit.org/320351@main", "email": "dm_mazzoni@apple.com", "hash": "733ef2764b021031b2789c7664379615f1f479a4", "subject": "AX: isolated tree can serve old page's content after navigation" }, "320352@main": { "author": "Jetzel Espinal", "avatar": "https://www.gravatar.com/avatar/2edd78d5d9f2f2e2e695465277634921?d=identicon\u0026s=64", "cl": "320352@main", "clUrl": "https://commits.webkit.org/320352@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323246\nrdar://186499314\n\nUnreviewed test gardening.\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320352@main", "email": "jespinal23@apple.com", "hash": "5c930251cfe83beef639ba376ce3d7e667cf268b", "subject": "NEW TEST(318871@main): [macOS Debug x86_64] accessibility/isolated-tree/canvas-fallback-content-2.html is a constant TIMEOUT." }, "320353@main": { "author": "Mark Lam", "avatar": "https://www.gravatar.com/avatar/87a4219a10aeda88757492c63da746de?d=identicon\u0026s=64", "cl": "320353@main", "clUrl": "https://commits.webkit.org/320353@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323232\nrdar://186484113\n\nReviewed by Dan Hecht.\n\nCorpseSymbolTest was previously looking up the symbol for `malloc`. ASAN builds overrides `malloc`\nwith its own implementation, which causes the test to fail. We now change CorpseSymbolTest to look\nup `tolower` from the standard C library instead.\n\nA test in CorpseSnapshotTest was doing 100 interactions of creating Snapshots and requesting their\nthreads list. This was done to see if the operations leak any mach ports. As a result, this test\nwas taking on the order of 1.1 seconds to run for a Release / Debug build, and ~9 seconds for an\nASAN build.\n\nCorpseSnapshotTest is now fixed to run that test exactly once and confirm that there's no increase\nin mach ports allocated. CorpseSnapshotTest now takes 60-90 ms to run.\n\nNo new tests because this is a test fix.\n\n* Source/JavaScriptCore/corpse/tests/CorpseSnapshotTest.cpp:\n(JSCToolsTest::testSnapshot):\n* Source/JavaScriptCore/corpse/tests/CorpseSymbolTest.cpp:\n(JSCToolsTest::testSymbol):\n\nCanonical link: https://commits.webkit.org/320353@main", "email": "mark.lam@apple.com", "hash": "951d88a0fe8bffd6a1d0e80c42a019a28c416720", "subject": "Fix testLibJSCTools's CorpseSnapshotTest and CorpseSymbolTest to run better for ASAN builds." }, "320354@main": { "author": "Elliott Williams", "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64", "cl": "320354@main", "clUrl": "https://commits.webkit.org/320354@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323196\nrdar://problem/186432858\n\nReviewed by Richard Robinson.\n\nThis macro is used for ObjC-based tests in the cocoa/ tree, but this\ntest is C++ code in cf/. The macro isn't defined, so it was ending up in\nresults as a literally-named \"RETAIN_PTR_TEST_NAME\". Fix it to match its\nsiblings.\n\n* Tools/TestWebKitAPI/Tests/WTF/cf/RetainPtr.cpp:\n(TestWebKitAPI::TEST(RetainPtr, RetainPtrTypeCF)):\n(TestWebKitAPI::TEST(RETAIN_PTR_TEST_NAME, RetainPtrType)): Deleted.\n* Tools/Scripts/webkitpy/api_tests/allowlist.txt:\n\nCanonical link: https://commits.webkit.org/320354@main", "email": "emw@apple.com", "hash": "82db7a45d91f421fcb552b2a9054cd01b015673b", "subject": "[TestWebKitAPI] Fix use of RETAIN_PTR_TEST_NAME outside of RetainPtr.mm" }, "320355@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "320355@main", "clUrl": "https://commits.webkit.org/320355@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321994\nrdar://185173794\n\nReviewed by Megan Gardner.\n\nThis patch aligns WebKit with Gecko / Firefox and Blink / Chromium.\n\nHighlightRange caches the resolved Positions that painting uses, but the dirty\nbit driving their recomputation lives on Range, so it is shared by every\nHighlight wrapping that Range while collectHighlightRangesFromRegister() only\nvisits Highlights already in the registry before resetting it.\n\nWith two Highlights over one Range and only the first registered, the next\nrendering update resolves positions for the registered one and clears the shared\nflag, leaving the other HighlightRange with null positions. Registering it later\nonly repaints, so the collect loop skips it permanently,\nRenderHighlight::setRenderRange() bails on the null positions, and the highlight\nnever paints.\n\nTrack the dirtiness per HighlightRange so a newly created one always resolves its\npositions on the next rendering update, and mark a Highlight's ranges as needing\na position update when it is registered so one that went stale while unregistered\nis repositioned instead of painting at its old offsets.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/painting/custom-highlight-painting-two-highlights-same-range-001-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/painting/custom-highlight-painting-two-highlights-same-range-001-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/painting/custom-highlight-painting-two-highlights-same-range-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/painting/custom-highlight-painting-two-highlights-same-range-002-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/painting/custom-highlight-painting-two-highlights-same-range-002-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-highlight-api/painting/custom-highlight-painting-two-highlights-same-range-002.html: Added.\n* Source/WebCore/Modules/highlight/Highlight.cpp:\n(WebCore::Highlight::setAllRangesNeedPositionUpdate):\n* Source/WebCore/Modules/highlight/Highlight.h:\n(WebCore::HighlightRange::needsPositionUpdate const):\n(WebCore::HighlightRange::setNeedsPositionUpdate):\n(WebCore::HighlightRange::didUpdatePositions):\n* Source/WebCore/Modules/highlight/HighlightRegistry.cpp:\n(WebCore::HighlightRegistry::setFromMapLike):\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::collectHighlightRangesFromRegister):\n(WebCore::Document::updateHighlightPositions):\n\nCanonical link: https://commits.webkit.org/320355@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "dcb25ff14a12a2975d67b3de8d90bd9d42162407", "subject": "Second CSS Highlight sharing a Range with an already-registered Highlight never paints" }, "320356@main": { "author": "Kai Tamkun", "avatar": "https://www.gravatar.com/avatar/dff073cba21885df4d9f73ed3cc493c2?d=identicon\u0026s=64", "cl": "320356@main", "clUrl": "https://commits.webkit.org/320356@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323126\nrdar://186389303\n\nReviewed by Yusuke Suzuki.\n\nThis patch enables the new inlining planner by default.\nThis will let us start searching for more optimal parameters.\n\nNo tests because there is no observable behavior difference.\n\n* Source/JavaScriptCore/runtime/OptionsList.h:\n\nCanonical link: https://commits.webkit.org/320356@main", "email": "k_tamkun@apple.com", "hash": "5bcd90bdee7964d8b14f39497e994d98cc2b5952", "subject": "[JSC] Enable global inlining planner" } }, "date": "2026-09-02", "days": 1, "generatedAt": "2026-09-02T22:06:13Z", "markdown": "## Highlights\n\n- **V8** JSC turned on the global inlining planner, a notable optimizer shift that should improve cross-function compile decisions and real-world JS throughput. [commit 320356@main](https://commits.webkit.org/320356@main)\n- **Security** WebKit tightened IPC trust boundaries by requiring origins that reach the UI process to be explicitly marked untrusted. [commit 320329@main](https://commits.webkit.org/320329@main)\n- **Privacy** Several ITP and Storage Access IPC messages now get explicit validation, reducing attack surface around tracking and storage controls. [commit 320282@main](https://commits.webkit.org/320282@main)\n- **DevTools** Site-isolated Web Inspector got a meaningful quality bump, fixing broken DOM logging, inert debugger targets, double-reported stylesheets, and native symbolic breakpoints. [commit 320280@main](https://commits.webkit.org/320280@main) [commit 320286@main](https://commits.webkit.org/320286@main) [commit 320275@main](https://commits.webkit.org/320275@main) [commit 320291@main](https://commits.webkit.org/320291@main)\n- **Web Platform** CSS Highlights got two correctness fixes, restoring registration-order iteration and making shared-Range highlights paint properly. [commit 320343@main](https://commits.webkit.org/320343@main) [commit 320355@main](https://commits.webkit.org/320355@main)\n- **Rendering** Corner-shape rendering was fixed for intersecting inner corners, closing a visible CSS rendering bug. [commit 320287@main](https://commits.webkit.org/320287@main)\n- **Media** A fullscreen caption bug on YouTube was fixed, preventing subtitles from getting stuck on the previous video's text. [commit 320345@main](https://commits.webkit.org/320345@main)\n- **GPU** WebGPU fixed a broken fast path for external textures in `GPUDevice.createBindGroup`, an important correctness fix for texture-heavy apps. [commit 320309@main](https://commits.webkit.org/320309@main)\n- **Networking** Navigation and loading got sharper around policy checks, URL parsing, cookies, and extension blocking signals, with several user-visible correctness fixes. [commit 320292@main](https://commits.webkit.org/320292@main) [commit 320325@main](https://commits.webkit.org/320325@main) [commit 320304@main](https://commits.webkit.org/320304@main) [commit 320336@main](https://commits.webkit.org/320336@main)\n\n## What landed by area\n\n### JavaScriptCore\n\n- **V8** JSC fixed wrong instruction emission for `Output::load`, a straight correctness fix in codegen. [commit 320350@main](https://commits.webkit.org/320350@main)\n- **V8** Baseline JIT no longer constructs `GCOwnedDataScope` on the compiler thread, tightening threading discipline in the compiler pipeline. [commit 320348@main](https://commits.webkit.org/320348@main)\n- **V8** JSC shell main-thread QoS now matches the WebContent process, making tooling behavior closer to production scheduling. [commit 320333@main](https://commits.webkit.org/320333@main)\n- **V8** DFG OSR entry expected values are now stored as a byte stream, a low-level runtime and memory-layout improvement. [commit 320303@main](https://commits.webkit.org/320303@main)\n- **V8** Cleanup continued after `JSValueRegs` removal. [commit 320294@main](https://commits.webkit.org/320294@main)\n- **Perf** DFG and FTL now scan `toLowerCase` and `toUpperCase` strings inline, targeting hot string-transform paths. [commit 320293@main](https://commits.webkit.org/320293@main)\n- **V8** `Object.freeze` now bumps the megamorphic IC epoch, fixing stale inline cache behavior after object shape stabilization. [commit 320276@main](https://commits.webkit.org/320276@main)\n- **Build** `testLibJSCTools` runtime tracking landed along with a hang fix, improving JSC test signal. [commit 320337@main](https://commits.webkit.org/320337@main)\n- **Build** ASAN handling for `CorpseSnapshotTest` and `CorpseSymbolTest` was improved so they run more reliably. [commit 320353@main](https://commits.webkit.org/320353@main)\n\n### CSS, Rendering, and Layout\n\n- **Web Platform** css-mixins typed function parameters now preserve their type instead of degrading incorrectly. [commit 320340@main](https://commits.webkit.org/320340@main)\n- **Rendering** Grid lane placement now returns a `GridLanesResult`, a cleanup that should simplify follow-up layout logic. [commit 320346@main](https://commits.webkit.org/320346@main)\n- **Rendering** GraphicsLayerCA no longer forces a full-layer repaint just to update debug indicators on ordinary property changes. [commit 320296@main](https://commits.webkit.org/320296@main)\n- **Rendering** `CanvasBase::copiedImage()` was removed, trimming old canvas plumbing. [commit 320327@main](https://commits.webkit.org/320327@main)\n- **Web Platform** MathML `rowspan=\"0\"` is no longer incorrectly clamped to 1. [commit 320324@main](https://commits.webkit.org/320324@main)\n- **Web Platform** Non-MathML children inside `\u003cannotation\u003e` and `\u003cannotation-xml\u003e` now render correctly in MathML Core. [commit 320334@main](https://commits.webkit.org/320334@main)\n\n### Accessibility\n\n- **A11y** The isolated accessibility tree no longer serves content from the previous page after navigation, a nasty stale-state bug. [commit 320351@main](https://commits.webkit.org/320351@main)\n- **A11y** New layout tests landed for `AXPressDidSucceed`, `AXTitleChanged`, and `AXAutocorrectionOccurred` notifications. [commit 320306@main](https://commits.webkit.org/320306@main)\n- **A11y** In isolated tree mode, `AXStringForTextMarkerRange` no longer inserts an extra newline for `\u003cbr\u003e`. [commit 320305@main](https://commits.webkit.org/320305@main)\n- **A11y** VoiceOver now respects list content inside elements referenced by `aria-describedby`. [commit 320290@main](https://commits.webkit.org/320290@main)\n- **Build** A constant timeout on `canvas-fallback-content-2.html` was marked with a new test expectation for macOS Debug x86_64. [commit 320352@main](https://commits.webkit.org/320352@main)\n\n### Networking, Loading, and Storage\n\n- **Networking** `bankofamerica.com` can complete a wire transfer again after fixing a missing `window` load event dispatch. [commit 320331@main](https://commits.webkit.org/320331@main)\n- **Networking** Policy checks that do not navigate a frame are no longer cancelled by ones that do. [commit 320325@main](https://commits.webkit.org/320325@main)\n- **Networking** URL parsing and decoding work on the navigation path was reduced to avoid redundant overhead. [commit 320292@main](https://commits.webkit.org/320292@main)\n- **Networking** `SetRawCookie` no longer rejects legitimate cookie writes from third-party iframes after the earlier regression. [commit 320304@main](https://commits.webkit.org/320304@main)\n- **Networking** `webRequest` events now fire for loads blocked by `declarativeNetRequest`, improving extension observability. [commit 320336@main](https://commits.webkit.org/320336@main)\n- **Privacy** `FirstPartyAuthority` IPC no longer derives a registrable domain that will just be discarded. [commit 320335@main](https://commits.webkit.org/320335@main)\n- **Networking** `ResourceLoadNotifier::dispatchWillSendRequest` now uses its cached frame local instead of re-reading `m_frame`. [commit 320320@main](https://commits.webkit.org/320320@main)\n- **Networking** `NavigationAction::m_type` is now initialized by the default constructor instead of carrying garbage state. [commit 320316@main](https://commits.webkit.org/320316@main)\n- **Networking** `CrossOriginAccessControl` now captures `storedCredentialsPolicy` before moving `ResourceLoaderOptions`, fixing a subtle lifetime bug. [commit 320315@main](https://commits.webkit.org/320315@main)\n- **Perf** `DocumentThreadableLoader` got smaller by packing one-byte members together. [commit 320314@main](https://commits.webkit.org/320314@main)\n- **Refactor** `PolicyChecker.cpp` dropped a dead `#undef` and stopped leaking five macros into unified builds. [commit 320313@main](https://commits.webkit.org/320313@main)\n- **Perf** `FormSubmission::boundary()` no longer returns `String` by value, avoiding an unnecessary copy. [commit 320312@main](https://commits.webkit.org/320312@main)\n- **Privacy** LocalStorage now logs when its database file gets deleted, useful for chasing persistence failures. [commit 320279@main](https://commits.webkit.org/320279@main)\n- **Networking** A unit test was added for [bug 322485](https://bugs.webkit.org/show_bug.cgi?id=322485), strengthening coverage for an earlier networking issue. [commit 320277@main](https://commits.webkit.org/320277@main)\n\n### Site Isolation and Web Inspector\n\n- **Security** BrowsingContextGroup no longer tries to use crashed processes under Site Isolation. [commit 320297@main](https://commits.webkit.org/320297@main)\n- **Refactor** Site Isolation removed the `UpdateRemoteIntersectionObservers` IPC, trimming cross-process plumbing. [commit 320300@main](https://commits.webkit.org/320300@main)\n- **DevTools** With frame targets enabled, `console.log` of DOM elements now resolves node ids against the correct target. [commit 320280@main](https://commits.webkit.org/320280@main)\n- **DevTools** Inspector debugger tests were fixed to stop using the inert page target. [commit 320286@main](https://commits.webkit.org/320286@main)\n- **DevTools** CSS stylesheets are no longer double-reported when frame targets are enabled. [commit 320275@main](https://commits.webkit.org/320275@main)\n- **DevTools** Symbolic breakpoints on native functions can now pause the frame target correctly. [commit 320291@main](https://commits.webkit.org/320291@main)\n- **Media** AirPlay target pickers now work inside site-isolated frames on macOS. [commit 320289@main](https://commits.webkit.org/320289@main)\n\n### WebKit API, Extensions, and Platform UI\n\n- **Mobile** On iOS, `NetworkSessionCocoa::removeNetworkWebsiteData` now calls its completion handler on the main run loop. [commit 320342@main](https://commits.webkit.org/320342@main)\n- **UI** `WKWebView.magnification` now reports the live scale correctly while a committed transient zoom animation is running. [commit 320341@main](https://commits.webkit.org/320341@main)\n- **UI** Wikimedia media player controls can now be press-dragged correctly with AppKit gestures. [commit 320319@main](https://commits.webkit.org/320319@main)\n- **Mobile** Rotating a device to landscape no longer kicks video out of fullscreen. [commit 320318@main](https://commits.webkit.org/320318@main)\n- **Refactor** `WebExtensionAPIRuntime` was ported to C++, a significant internal modernization step for extensions. [commit 320328@main](https://commits.webkit.org/320328@main)\n- **Build** Swift can now depend on C++ headers in the CMake build, smoothing mixed-language API work. [commit 320311@main](https://commits.webkit.org/320311@main)\n- **Build** `[NewCodable]` support for calling `WebPageProxy.runJavaScriptInMainFrame` from Swift was re-landed. [commit 320301@main](https://commits.webkit.org/320301@main)\n- **Build** LegacyWebArchive no longer emits literal `98%%` width and height values in copied frameset wrappers. [commit 320317@main](https://commits.webkit.org/320317@main)\n\n### GPU, Media, and XR\n\n- **Security** `PlatformXR::Device` was hardened by making `TrackingAndRenderingClient` ref-countable. [commit 320347@main](https://commits.webkit.org/320347@main)\n- **Media** Fullscreen YouTube captions no longer freeze on the previous video's text. [commit 320345@main](https://commits.webkit.org/320345@main)\n- **GPU** Some WebGL test expectations were updated. [commit 320349@main](https://commits.webkit.org/320349@main)\n\n### Build, Tooling, and Safer C++\n\n- **Build** Windows build intermittency was fixed. [commit 320339@main](https://commits.webkit.org/320339@main)\n- **Build** Quirks table compile flags were reduced. [commit 320338@main](https://commits.webkit.org/320338@main)\n- **Build** EWS API test results are now reported to the results database. [commit 320321@main](https://commits.webkit.org/320321@main)\n- **Build** Apple platform port names were cleaned up in `webkitdirs`. [commit 320283@main](https://commits.webkit.org/320283@main)\n- **Build** The build was fixed after [commit 320301@main](https://commits.webkit.org/320301@main). [commit 320310@main](https://commits.webkit.org/320310@main)\n- **Build** A regression that broke the CMake build by missing `RunJavaScriptResult.swift` was fixed. [commit 320284@main](https://commits.webkit.org/320284@main)\n- **Refactor** Generated bindings dropped `SUPPRESS_UNCOUNTED_LOCAL` for `vm` locals. [commit 320308@main](https://commits.webkit.org/320308@main)\n- **Refactor** False positives around `dispatch_*_create()` no longer need `SUPPRESS_RETAINPTR_CTOR_ADOPT`. [commit 320307@main](https://commits.webkit.org/320307@main)\n- **Refactor** More Safer C++ suppression macros were removed now that static analyzer support improved. [commit 320299@main](https://commits.webkit.org/320299@main)\n- **Refactor** Another batch of Safer C++ suppression macros was removed after the upstream LLVM fix landed. [commit 320298@main](https://commits.webkit.org/320298@main)\n- **Build** GLib test gardening continued for both passing tests and API tests. [commit 320332@main](https://commits.webkit.org/320332@main) [commit 320326@main](https://commits.webkit.org/320326@main)\n- **Build** WPE arm64 test expectations were adjusted where intermittent crashes time out instead on bot hardware. [commit 320295@main](https://commits.webkit.org/320295@main)\n- **Build** Tahoe DEBUG arm64 encrypted-media tests were marked as constant crashes in imported WPT expectations. [commit 320285@main](https://commits.webkit.org/320285@main)\n- **Build** An iOS WebAuthenticationPanel timeout was gardened as a flaky test regression. [commit 320278@main](https://commits.webkit.org/320278@main)\n- **Build** TestWebKitAPI fixed use of `RETAIN_PTR_TEST_NAME` outside `RetainPtr.mm`. [commit 320354@main](https://commits.webkit.org/320354@main)\n\n### Specs and Tests\n\n- **Web Platform** WPT now covers per-index `getItem` identity on SVG list interfaces. [commit 320323@main](https://commits.webkit.org/320323@main)\n- **Web Platform** WPT now covers synchronizing SVG list interface objects when reflected attributes change. [commit 320322@main](https://commits.webkit.org/320322@main)\n- **Privacy** A regression in `PrivateClickMeasurement.SKAdNetwork` tests was fixed. [commit 320302@main](https://commits.webkit.org/320302@main)\n\n## Reverts \u0026 Reapplies\n\n- **Build** Re-landed Swift callable support for `WebPageProxy.runJavaScriptInMainFrame` after earlier issues. [commit 320301@main](https://commits.webkit.org/320301@main)", "repo": "webkit", "repoDisplay": "WebKit", "rollGroups": [ { "name": "Unreviewed", "count": 3 } ], "since": "2026-09-02", "totals": { "commits": 82, "features": 79, "rolls": 3 }, "until": "2026-09-02" }