{ "commits": { "320357@main": { "author": "Luke Warlow", "avatar": "https://www.gravatar.com/avatar/262b456ff1e93842b93f9694d1e01a9e?d=identicon\u0026s=64", "cl": "320357@main", "clUrl": "https://commits.webkit.org/320357@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323107\n\nReviewed by Tim Nguyen.\n\nThis changes the flag for moveBefore() to be testable to widen the test coverage.\n\n* LayoutTests/fast/custom-elements/connectedMoveCallback-survives-gc.html:\n* LayoutTests/imported/w3c/web-platform-tests/custom-elements/CustomElementRegistry-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/dom/idlharness.window-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/Node-moveBefore.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/child-style-preserve.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/chrome-338071841-crash.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/chrome-433696404-crash.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/continue-css-animation-left.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/continue-css-animation-transform.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/continue-css-transition-left-pseudo.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/continue-css-transition-left.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/continue-css-transition-transform-pseudo.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/continue-css-transition-transform.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/css-animation-commit-styles.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/css-transition-cross-document.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/css-transition-cross-shadow.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/css-transition-to-disconnected-document.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/css-transition-trigger.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/custom-element-move-reactions.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/fieldset-child-blur-event.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/fire-focusin-focusout.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/focus-preserve-render.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/focus-preserve.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/focus-within.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/fullscreen-preserve.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/hover-style-update.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/iframe-document-preserve.window.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/input-moveBefore-crash.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/listed-form-element-reset.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/live-range-updates.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/modal-dialog.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-as-flex-item.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-dir.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-from-light-to-shadow.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-id-map.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-lang.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-name-map.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-nodeiterator.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-option-recalc-style.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-selector-matching.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-shadow-inside.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-shadow-root.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/moveBefore-size-query.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/mutation-observer.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/nonce.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/object-crash-regression.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/pointer-events.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/popover-preserve.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/preserve-render-blocking-script.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/preserve-render-blocking-style.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/relevant-mutations.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/script-move-before.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/select-option-optgroup.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/selection-preserve.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/slotchange-events.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/style-applies.html:\n* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/moveBefore/throws-exception.html:\n* LayoutTests/imported/w3c/web-platform-tests/html/interaction/focus/sequential-focus-navigation-starting-point-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/the-img-element/source-relevant-mutations-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/html/semantics/interactive-elements/the-dialog-element/dialog-open-movebefore-setup.html:\n* LayoutTests/imported/w3c/web-platform-tests/trusted-types/script-enforcement-001-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/trusted-types/script-enforcement-002-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/trusted-types/script-enforcement-003-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/trusted-types/script-enforcement-004-expected.txt:\n* LayoutTests/inspector/dom/moveBefore-protocol.html:\n* LayoutTests/inspector/dom/moveBefore.html:\n* LayoutTests/platform/glib/imported/w3c/web-platform-tests/html/interaction/focus/sequential-focus-navigation-starting-point-expected.txt:\n* LayoutTests/platform/ios/imported/w3c/web-platform-tests/html/interaction/focus/sequential-focus-navigation-starting-point-expected.txt:\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/320357@main", "email": "lwarlow@igalia.com", "hash": "9ced85bbeb58dc471377293bcc0e23f9cf01f697", "subject": "Make MoveBeforeEnabled flag testable" }, "320358@main": { "author": "Yulun Wu", "avatar": "https://www.gravatar.com/avatar/9e34d6632f4d926cdf6fe8dce07f9cb7?d=identicon\u0026s=64", "cl": "320358@main", "clUrl": "https://commits.webkit.org/320358@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318455\nrdar://177958824\n\nReviewed by Said Abou-Hallawa.\n\nPer 264004@main, putPixelBuffer() and getPixelBuffer() are not applicable\nfor LayerBacking. This PR enforces that comment by adding a MESSAGE_CHECK().\n\nThis PR also updates the no-op override to zero-fill its\ndestination instead of leaving it uninitialized to fail gracefully\non release builds while still hitting the assert in debug.\n\n* LayoutTests/ipc/getpixelbuffer-layerbacking-heap-disclosure-expected.txt: Added.\n* LayoutTests/ipc/getpixelbuffer-layerbacking-heap-disclosure.html: Added.\n* Source/WebKit/GPUProcess/graphics/RemoteImageBuffer.cpp:\n(WebKit::RemoteImageBuffer::getPixelBuffer):\n(WebKit::RemoteImageBuffer::putPixelBuffer):\n* Source/WebKit/WebProcess/GPU/graphics/cocoa/ImageBufferShareableMappedIOSurfaceBitmapBackend.cpp:\n(WebKit::ImageBufferShareableMappedIOSurfaceBitmapBackend::getPixelBuffer):\n\nOriginally-landed-as: 305413.1085@safari-7624.5-branch (47dab0040d33). rdar://185367113\nCanonical link: https://commits.webkit.org/320358@main", "email": "yulun_wu@apple.com", "hash": "feef6b15dd31a63cee29678a4d836472ba075a4b", "subject": "putPixelBuffer() and getPixelBuffer() are not applicable for LayerBacking()" }, "320359@main": { "author": "Kimmo Kinnunen", "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64", "cl": "320359@main", "clUrl": "https://commits.webkit.org/320359@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317295\nrdar://175520296\n\nReviewed by Dan Glastonbury.\n\nImageBuffer context state might leak non-thread-safe\ncross-RemoteRenderingBackend instances through GraphicsContext state.\n\nRelease the GraphicsContext when transfering the ImageBuffer to\ndifferent RRB.\n\n* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp:\n(WebKit::RemoteRenderingBackend::moveToSerializedBuffer):\n\nOriginally-landed-as: 305413.1007@safari-7624.5-branch (d5c5da3f748b). rdar://185369313\nCanonical link: https://commits.webkit.org/320359@main", "email": "kkinnunen@apple.com", "hash": "1d12ff79f2e0711ef33e8ddd8ee120706c5f0a26", "subject": "SerializedImageBuffer leaks cross-RemoteRenderingBackend data through GraphicsContext" }, "320360@main": { "author": "Antoine Quint", "avatar": "https://www.gravatar.com/avatar/9b3ef1e754f8d994f21ff67c660cbbe6?d=identicon\u0026s=64", "cl": "320360@main", "clUrl": "https://commits.webkit.org/320360@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317919\nrdar://180233994\n\nReviewed by Chris Dumez.\n\nValues held by AcceleratedEffectValues may be accessed both from the main thread\nand the scrolling thread on macOS.\n\nMeanwhile, the `cachedAcceleratedEffectXXXPath()` family of functions use a process-global\n`static NeverDestroyed\u003cTinyLRUCache\u003c..., WebCore::Path, 4, ...\u003e\u003e` with no synchronization\nand return a `const Path\u0026` directly into a cache slot. TinyLRUCache::get() move-assigns\nslots whose `Path` value wraps `DataRef\u003cPathImpl\u003e`, a concurrent move-assignment\ntears the non-atomic pointer read/swap in `Ref::operator=(Ref\u0026\u0026)` and produces\na stale refcounted pointer that is then deref'd, yielding a use-after-free\nor double-free of `PathImpl`.\n\nWe now guard each cache with a static Lock and return Path by value so the cache\nslot is copied out while the lock is held. `PathImpl` is `ThreadSafeRefCounted`\nso the by-value copy is just an atomic refcount bump. This matches the existing\npattern used by `cachedCGColor()` and `UTIFromMIMEType()` for concurrently-accessed\nstatic `TinyLRUCache` instances.\n\nThis fix was suggested by an LLM during bug analysis, I validated its approach.\n\nTest: webanimations/threaded-animations/offset-path-shape-cache-thread-safety-crash.html\n\n* LayoutTests/webanimations/threaded-animations/offset-path-shape-cache-thread-safety-crash-expected.txt: Added.\n* LayoutTests/webanimations/threaded-animations/offset-path-shape-cache-thread-safety-crash.html: Added.\n* LayoutTests/webanimations/threaded-animations/resources/offset-path-shape-cache-thread-safety-popup.html: Added.\n* Source/WebCore/platform/animation/values/shapes/AcceleratedEffectCircleFunction.cpp:\n(WebCore::cachedAcceleratedEffectCirclePath):\n* Source/WebCore/platform/animation/values/shapes/AcceleratedEffectEllipseFunction.cpp:\n(WebCore::cachedAcceleratedEffectEllipsePath):\n* Source/WebCore/platform/animation/values/shapes/AcceleratedEffectInsetFunction.cpp:\n(WebCore::cachedRoundedInsetPath):\n* Source/WebCore/platform/animation/values/shapes/AcceleratedEffectPathFunction.cpp:\n(WebCore::cachedAcceleratedEffectTransformedByteStreamPath):\n* Source/WebCore/platform/animation/values/shapes/AcceleratedEffectPolygonFunction.cpp:\n(WebCore::cachedAcceleratedEffectPolygonPath):\n\nOriginally-landed-as: 305413.1033@safari-7624.5-branch (e4960726c71e). rdar://185368955\nCanonical link: https://commits.webkit.org/320360@main", "email": "graouts@webkit.org", "hash": "7224709bf0747d1cb8f7d52e65cc7900e91fdb75", "subject": "[threaded-animations] cross-thread UAF in UIProcess via unguarded static TinyLRUCache in AcceleratedEffect polygon path cache" }, "320361@main": { "author": "Ruthvik Konda", "avatar": "https://www.gravatar.com/avatar/bca33cefcce93017251a8fbc1204cdc4?d=identicon\u0026s=64", "cl": "320361@main", "clUrl": "https://commits.webkit.org/320361@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=315794\nrdar://176483048\n\nReviewed by Mike Wyrzykowski.\n\nCommandBuffer::makeInvalidDueToCommit registers an addCompletedHandler block whose body\nbounces cleanup work to the WebGPU work queue via Queue::scheduleWork. The inner lambda\ncaptures a strong Ref\u003cCommandBuffer\u003e. During RemoteGPU teardown, StreamConnectionWorkQueue::dispatch\nsilently drops the lambda when m_shouldQuit is set; the dropped lambda's Ref\u003cCommandBuffer\u003e\nis destroyed on com.Metal.CompletionQueueDispatch. If that is the last ref, ~CommandBuffer\nruns on the Metal thread and (a) non-atomically derefs m_commandEncoder (CommandEncoder is\nRefCountedAndCanMakeWeakPtr), racing the work-queue thread's deref via ObjectHeap::clear()\n-\u003e torn refcount -\u003e UAF; and (b) ~CommandEncoder mutates the unlocked Device::m_commandEncoderMap,\nracing the work-queue thread's concurrent removeCommandEncoder.\n\nAdditionally, every WebGPU addCompletedHandler/addScheduledHandler that calls\nQueue::scheduleWork creates a temporary RefPtr\u003cInstance\u003e via m_instance.get() on the Metal\nthread; if that temp outlives the work-queue's wgpuInstanceRelease deref, ~Instance runs on\nthe Metal thread and destroys whatever Ref\u003cDevice\u003e/Ref\u003cCommandBuffer\u003e Instance owns there.\n\nFix:\n\n1. Anchor each committed CommandBuffer in Instance::m_retainedCommandBufferInstances so the\n Metal-thread block's deref is never the last. The anchor is keyed by a\n WeakObjCPtr\u003cid\u003cMTLCommandBuffer\u003e\u003e and lazily pruned when that pointer goes nil; nil\n implies MTLCommandBuffer dealloc, which only happens after Metal's\n didCompleteWithStartTime: has Block_release()d every completion handler, so the outer\n block's Ref\u003cCommandBuffer\u003e is already gone by the time the anchor is dropped.\n\n2. Drain all retained MTLCommandBuffers (waitUntilCompleted) in wgpuInstanceRelease before\n deref(), so the C-API ref is alive while completion handlers run -\u003e no Metal-thread\n RefPtr\u003cInstance\u003e temporary can be the last -\u003e ~Instance and the anchors are released on\n the work-queue thread.\n\n3. Change the inner lambda to capture ThreadSafeWeakPtr\u003cCommandBuffer\u003e. This is load-bearing,\n not just defense-in-depth: Instance::scheduleWork wraps the inner lambda in an ObjC block\n via makeBlockPtr().get(), and that wrapper is autoreleased on the Metal thread. Its pool\n drains at _dispatch_last_resort_autorelease_pool_pop, which is after waitUntilCompleted\n returns (after _completedCallbacksDone). With a strong inner capture, the autoreleased\n block copy holds a Ref\u003cCommandBuffer\u003e past the anchor's lifetime, and ~CommandBuffer runs\n on the Metal thread when the pool drains. With a weak capture, the autoreleased copy\n holds nothing that destructs cross-thread.\n\nretainCommandBuffer, retainDevice, and waitForCommandBufferCompletions all run on the\nsingle per-Instance StreamConnectionWorkQueue thread (Instance is per-RemoteGPU, not\nper-process), so the m_lock acquire around the retention containers is unnecessary; drop it\nalong with the WTF_GUARDED_BY_LOCK annotations. m_lock continues to guard m_pendingWork for\nthe unused defaultScheduleWork/processEvents fallback.\n\nRegressed in 288538@main.\n\nTests: ipc/webgpu-command-encoder-cross-thread-destruction-race.html\n ipc/webgpu-instance-cross-thread-destruction-race.html\n\n* LayoutTests/ipc/webgpu-command-encoder-cross-thread-destruction-race-expected.txt: Added.\n* LayoutTests/ipc/webgpu-command-encoder-cross-thread-destruction-race.html: Added.\n* LayoutTests/ipc/webgpu-instance-cross-thread-destruction-race-expected.txt: Added.\n* LayoutTests/ipc/webgpu-instance-cross-thread-destruction-race.html: Added.\n* Source/WebGPU/WebGPU/CommandBuffer.mm:\n(WebGPU::CommandBuffer::makeInvalidDueToCommit):\n* Source/WebGPU/WebGPU/Instance.h:\n* Source/WebGPU/WebGPU/Instance.mm:\n(WebGPU::Instance::waitForCommandBufferCompletions):\n(WebGPU::Instance::retainDevice):\n(WebGPU::Instance::retainCommandBuffer):\n(wgpuInstanceRelease):\n\nOriginally-landed-as: 305413.995@safari-7624.5-branch (c1b3074a6202). rdar://185367024\nCanonical link: https://commits.webkit.org/320361@main", "email": "rkonda2@apple.com", "hash": "95c3cfc258782ea42c3f0a8b570e6bb317c9a256", "subject": "[WebGPU] ~CommandBuffer can run on Metal completion thread, racing non-atomic CommandEncoder refcount and Device::m_commandEncoderMap" }, "320362@main": { "author": "Dan Hecht", "avatar": "https://www.gravatar.com/avatar/080f47d912b1b34d0be8293f825d132d?d=identicon\u0026s=64", "cl": "320362@main", "clUrl": "https://commits.webkit.org/320362@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=315674\nrdar://176555185\n\nReviewed by Yijia Huang.\n\n208291@main added an InlineCallFrame check that demotes candidate\nallocations whose origin is a closure-call or varargs inline frame and\nwhose escape site is in a different frame. The check is necessary\nbecause such an allocation, if sunk to the escape site, would have its\nMaterialize* node emitted where the frame's closure-call callee\nslot or varargs argc slot has been reused by intervening code, causing\nsubsequent stack walks to potentially dereference garbage.\n\nHowever, that fix was incomplete in two ways. First, the InlineCallFrame\ncheck ran before the closure rule's worklist (\"rule #2\"), so it only\ninspected the initial candidates. Rule #2 then promoted additional\ndependencies to satisfy the closure invariant (a sink candidate stored\ninto a local allocation, that allocation must also be a sink candidate\"),\nand any such promoted allocation that would have failed the\nInlineCallFrame check slipped through. Second, even for candidates the\ncheck correctly removed, rule #2's worklist re-promoted them in order\nto maintain its invariant, undoing the InlineCallFrame check.\n\nFix this with two complementary changes:\n\n1. Run the closure rule (rule #2) before the InlineCallFrame check, so\n the InlineCallFrame check sees both seeded and rule-#2-promoted\n candidates and is the final determination of which stay sunk.\n\n2. Add an additional closure rule (which was already documented as a\n potential rule #1): remove candidates that depend on the candidates\n that were demoted (due to the InlineCallFrame mismatch). Like the\n original fix, this happens rarely.\n\nAdd an ASSERT in the materialization-placement loop to verify that no\nallocation reaching it would fail the InlineCallFrame check. This\ncatches the bug pattern in debug builds and guards against future\nregressions.\n\nTest: JSTests/stress/object-allocation-sinking-phase-must-only-move-allocations-if-stack-trace-is-still-valid-closure-rules.js\n\n* JSTests/stress/object-allocation-sinking-phase-must-only-move-allocations-if-stack-trace-is-still-valid-closure-rule-promoted-parent.js: Added.\n(makeInner.return.inner):\n(makeInner):\n(clobber):\n(sink):\n(opt):\n* JSTests/stress/object-allocation-sinking-phase-must-only-move-allocations-if-stack-trace-is-still-valid-closure-rules.js: Added.\n(makeInner.return.inner):\n(makeInner):\n(clobber):\n(sink):\n(opt):\n* Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp:\n\nOriginally-landed-as: 305413.973@safari-7624.5-branch (a4e027e916f5). rdar://185368183\nCanonical link: https://commits.webkit.org/320362@main", "email": "dan.hecht@apple.com", "hash": "aa07769ee575e94efee687135493399e29409f20", "subject": "[JSC] Fix Object Allocation Sinking closure rule for allocations within inlined closure-call and varargs frames" }, "320363@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "320363@main", "clUrl": "https://commits.webkit.org/320363@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323245\nrdar://186499141\n\nReviewed by Dan Hecht.\n\nCode::emitEpilogue can clobber macro registers when offset is very\nlarge. Code is having `AllowMacroScratchRegisterUsageIf(jit, isARM64())`.\nSo let's declare this characteristics. Currently, this is fine as all\nwasm return output is pinned to wasm ABI return registers and they do\nnot conflict with macro registers.\n\n* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:\n(JSC::Wasm::OMGIRGenerator::addReturn):\n\nCanonical link: https://commits.webkit.org/320363@main", "email": "ysuzuki@apple.com", "hash": "0f84b27e55297a517da604e7082cf7e8aaa40200", "subject": "[JSC] OMG addReturn patchpoint should say clobber macro registers" }, "320364@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "320364@main", "clUrl": "https://commits.webkit.org/320364@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323204\nrdar://186444744\n\nReviewed by Yijia Huang.\n\nThis patch makes DateInstance non-destructible by adding packed\nbreakdown of date time information instead of having RefPtr\u003cDateInstanceData\u003e.\n\nPlainGregorianDateTime packs a broken-down date into one word (year, month,\nmonthDay, weekDay, hour, minute, second, UTC offset, isDST). monthDay is never\nzero in a real date, so those bits double as the validity tag. That leaves the\nall-zero payload to mean \"never computed\" and a separate stale marker to mean\n\"computed for a time value that has since changed\", which Date#setTime writes.\n\nTo keep Date breakdown computation faster, instead of DateInstanceCache,\nwe have BrokenDownDateCache, which quickly looks up the past breakdown\nresult, so without having RefPtr to DateInstanceData, we can keep\nbreakdown fast.\n\nIn DFG / FTL, we introduce DateGetStorage which extracts\nPlainGregorianDateTime (64bit data), so subsequent accessors (e.g.\ngetFullYear) can take this storage and extract the necessary number.\n\nAlso, when timezone gets changed, we scan the heap and invalidate all\nDateInstance breakdown data. That is the improvement compared to old\nDateInstanceData as we were invalidating them only when this data is\nstill reachable from the cache.\n\nTest: JSTests/stress/date-local-fields-invalidated-across-tz-change.js\n\n* JSTests/stress/date-get-full-year-jit.js:\n* JSTests/stress/date-get-utc-full-year-jit.js:\n* JSTests/stress/date-local-fields-invalidated-across-tz-change.js: Added.\n(expect):\n(set read):\n(check):\n(setTimeout):\n* JSTests/stress/date-set-time.js:\n(setThenRead):\n(i.shouldBe.setThenRead):\n(i.reference.getFullYear):\n(i.reference.getMonth):\n(i.reference.getDate):\n(i.reference.getHours):\n* JSTests/stress/intl-datetimeformat-cache-dst-transition.js:\n(setTimeout):\n* JSTests/stress/intl-datetimeformat-default-formatter-stale-across-tz-change.js:\n(setTimeout):\n* JSTests/stress/intl-datetimeformat-stale-data-across-tz-change.js:\n* JSTests/stress/intl-datetimeformat-stale-data-evicted-across-tz-change.js:\n(setTimeout):\n* Source/JavaScriptCore/CMakeLists.txt:\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/SaferCPPExpectations/MemoryUnsafeCastCheckerExpectations:\n* Source/JavaScriptCore/b3/B3AbstractHeapRepository.h:\n* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:\n(JSC::DFG::AbstractInterpreter\u003cAbstractStateType\u003e::executeEffects):\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::ByteCodeParser::handleIntrinsicCall):\n* Source/JavaScriptCore/dfg/DFGClobberize.h:\n(JSC::DFG::clobberize):\n* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:\n(JSC::DFG::doesGC):\n* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:\n(JSC::DFG::FixupPhase::fixupNode):\n* Source/JavaScriptCore/dfg/DFGNode.h:\n(JSC::DFG::Node::hasUTC):\n(JSC::DFG::Node::isUTC):\n(JSC::DFG::Node::hasHeapPrediction):\n* Source/JavaScriptCore/dfg/DFGNodeType.h:\n* Source/JavaScriptCore/dfg/DFGOperations.cpp:\n(JSC::DFG::JSC_DEFINE_NOEXCEPT_JIT_OPERATION):\n(JSC::DFG::triggerFTLReplacementCompile):\n* Source/JavaScriptCore/dfg/DFGOperations.h:\n* Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:\n* Source/JavaScriptCore/dfg/DFGSafeToExecute.h:\n(JSC::DFG::safeToExecute):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:\n(JSC::DFG::SpeculativeJIT::compile):\n(JSC::DFG::SpeculativeJIT::compileDateGetStorage):\n(JSC::DFG::SpeculativeJIT::compileDateGetInt32OrNaN):\n(JSC::DFG::SpeculativeJIT::compileDateGetMilliseconds):\n(JSC::DFG::SpeculativeJIT::compileDateGetTime):\n(JSC::DFG::SpeculativeJIT::compileDateSet):\n(JSC::DFG::SpeculativeJIT::compileDateGet): Deleted.\n* Source/JavaScriptCore/ftl/FTLCapabilities.cpp:\n(JSC::FTL::canCompile):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileNode):\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n* Source/JavaScriptCore/heap/Heap.cpp:\n(JSC::Heap::Heap):\n* Source/JavaScriptCore/heap/Heap.h:\n* Source/JavaScriptCore/runtime/DateConstructor.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n* Source/JavaScriptCore/runtime/DateConversion.cpp:\n(JSC::formatDateTime):\n* Source/JavaScriptCore/runtime/DateConversion.h:\n* Source/JavaScriptCore/runtime/DateInstance.cpp:\n(JSC::useSharedCacheFor):\n(JSC::DateInstance::calculateGregorianDateTime const):\n(JSC::DateInstance::calculateGregorianDateTimeUTC const):\n* Source/JavaScriptCore/runtime/DateInstance.h:\n* Source/JavaScriptCore/runtime/DateInstanceCache.h: Removed.\n* Source/JavaScriptCore/runtime/DatePrototype.cpp:\n(JSC::formateDateInstance):\n(JSC::BrokenDownDate::BrokenDownDate):\n(JSC::fillStructuresUsingTimeArgs):\n(JSC::fillStructuresUsingDateArgs):\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n(JSC::setNewValueFromTimeArgs):\n(JSC::setNewValueFromDateArgs):\n* Source/JavaScriptCore/runtime/JSDateMath.cpp:\n(JSC::DateCache::gregorianDateTimeToMS):\n(JSC::DateCache::yearMonthDayFromDaysWithCache):\n(JSC::DateCache::computeGregorianDateTime):\n(JSC::DateCache::msToGregorianDateTime):\n(JSC::DateCache::localTimeOffset):\n(JSC::DateCache::clearForTimeZoneChange):\n(JSC::DateCache::cachedDateInstanceData): Deleted.\n* Source/JavaScriptCore/runtime/JSDateMath.h:\n(JSC::DateCache::noteCachedLocalGregorianDateTime):\n(JSC::DateCache::takeMayHaveCachedLocalGregorianDateTime):\n(JSC::DateCache::BrokenDownDateCache::get):\n(JSC::DateCache::BrokenDownDateCache::set):\n(JSC::DateCache::BrokenDownDateCache::reset):\n(JSC::DateCache::BrokenDownDateCache::lookup):\n* Source/JavaScriptCore/runtime/PlainGregorianDateTime.h: Added.\n(JSC::PlainGregorianDateTime::PlainGregorianDateTime):\n(JSC::PlainGregorianDateTime::year const):\n(JSC::PlainGregorianDateTime::month const):\n(JSC::PlainGregorianDateTime::monthDay const):\n(JSC::PlainGregorianDateTime::weekDay const):\n(JSC::PlainGregorianDateTime::hour const):\n(JSC::PlainGregorianDateTime::minute const):\n(JSC::PlainGregorianDateTime::second const):\n(JSC::PlainGregorianDateTime::utcOffsetInMinute const):\n(JSC::PlainGregorianDateTime::isDST const):\n(JSC::PlainGregorianDateTime::operator bool const):\n(JSC::PlainGregorianDateTime::staleMarker):\n(JSC::PlainGregorianDateTime::hasNeverBeenComputed const):\n(JSC::PlainGregorianDateTime::payload const):\n* Source/JavaScriptCore/runtime/TemporalNow.cpp:\n(JSC::systemDateTime):\n* Source/JavaScriptCore/runtime/VM.cpp:\n(JSC::VM::executeEntryScopeServicesOnEntry):\n* Source/JavaScriptCore/runtime/temporal/core/InstantCore.cpp:\n* Source/WebCore/WebCorePrefix.h:\n\nCanonical link: https://commits.webkit.org/320364@main", "email": "ysuzuki@apple.com", "hash": "6124a5f9c43785a89d933967c63a50d8fae79eea", "subject": "[JSC] Make DateInstance non-destructible" }, "320365@main": { "author": "Youenn Fablet", "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64", "cl": "320365@main", "clUrl": "https://commits.webkit.org/320365@main", "description": "rdar://176886407\n\nReviewed by Eric Carlson.\n\nWe were copying size bytes of data while we should only copy length bytes of data, which is an issue if VT is generating non contiguous encoded frames.\n\n* Source/ThirdParty/libwebrtc/Source/webrtc/webkit_sdk/objc/components/video_codec/RTCVideoEncoderH264.mm:\n(-[RTCVideoEncoderH264 frameWasEncoded:flags:sampleBuffer:codecSpecificInfo:width:height:renderTimeMs:timestamp:duration:rotation:isKeyFrameRequired:]):\n* Source/ThirdParty/libwebrtc/Source/webrtc/webkit_sdk/objc/components/video_codec/RTCVideoEncoderH265.mm:\n(-[RTCVideoEncoderH265 frameWasEncoded:flags:sampleBuffer:width:height:renderTimeMs:timestamp:rotation:]):\n\nOriginally-landed-as: 305413.998@safari-7624.5-branch (34598221929f). rdar://185368333\nCanonical link: https://commits.webkit.org/320365@main", "email": "youenn@apple.com", "hash": "141ea152cf214cd8426f0711efc6eac7209bd0ef", "subject": "Out-of-bounds read in -[RTCVideoEncoderH265/H264 frameWasEncoded:] — AppendData uses total CMBlockBuffer size instead of chunk length" }, "320366@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "320366@main", "clUrl": "https://commits.webkit.org/320366@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317570\nrdar://178248992\n\nReviewed by Yijia Huang.\n\nWhen folding ObjectCreate(with-edge-checks), we are not emitting these\nchecks and converting it to NewObject. As a result, we missed the edge\nfilters and the subsequent code may rely on that. This patch correctly\ninserts these checks.\n\nTest: JSTests/stress/object-create-check-insertion.js\n\n* JSTests/stress/object-create-check-insertion.js: Added.\n(bitsToDouble):\n(enforce):\n(getKey):\n(getK2):\n(caller):\n(trainGetKey):\n(trainCaller):\n(trainGetK2):\n(ramp):\n* Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:\n(JSC::DFG::ConstantFoldingPhase::foldConstants):\n\nOriginally-landed-as: 305413.1017@safari-7624.5-branch (ac9e40a7195b). rdar://185368518\nCanonical link: https://commits.webkit.org/320366@main", "email": "ysuzuki@apple.com", "hash": "cd30bb7e410f12481f5330a896e72cd569eb7ee2", "subject": "[JSC] ObjectCreate folding should emit checks" }, "320367@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "320367@main", "clUrl": "https://commits.webkit.org/320367@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317270\nrdar://177909918\n\nReviewed by Per Arne Vollan and Ben Nham.\n\nMake sure we capture `weakThis` in the lambda instead of `this`, then\nconvert to a RefPtr before calling `didfinishLoading()` so that `this`\ncannot be destroyed *while* running `didfinishLoading()`.\n\nTest: http/tests/webshare/shareddatareader-didfinishloading-crash.html\n\n* LayoutTests/http/tests/webshare/shareddatareader-didfinishloading-crash-expected.txt: Added.\n* LayoutTests/http/tests/webshare/shareddatareader-didfinishloading-crash.html: Added.\n* Source/WebCore/page/ShareDataReader.cpp:\n(WebCore::ShareDataReader::start):\n* Source/WebCore/page/ShareDataReader.h:\n\nOriginally-landed-as: 305413.994@safari-7624.5-branch (890fde552386). rdar://185368266\nCanonical link: https://commits.webkit.org/320367@main", "email": "cdumez@apple.com", "hash": "0bcd5c84c365da592ed86a60c03e8e1aa011b51a", "subject": "[WebCore] use-after-free in ShareDataReader::didFinishLoading: cancel() called on freed this after completionHandler destruction" }, "320368@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "320368@main", "clUrl": "https://commits.webkit.org/320368@main", "description": "rdar://174702504\n\nReviewed by Jer Noble.\n\nUserMediaCaptureManagerProxySourceProxy::sourceConfigurationChanged() re-registers\nthe proxy as a VideoFrameObserver of its RealtimeMediaSource via\nremoveVideoFrameObserver()/addVideoFrameObserver() without consulting m_isObservingMedia.\nSince the proxy is registered as a RealtimeMediaSourceObserver unconditionally in its\nconstructor, this callback can fire on a stopped (or never-started) proxy and insert a\nraw VideoFrameObserver* into m_videoFrameObservers while m_isObservingMedia remains\nfalse. The destructor's unobserveMedia() then early-returns without removing the entry.\n\nDisplayCaptureSourceCocoa does not override clone(), so UserMediaCaptureManagerProxy::clone()\nyields two proxies sharing the same RealtimeMediaSource; the surviving clone keeps the\nsource (and its dangling raw key) alive after the first proxy is freed, and the next\nvideoFrameAvailable() virtual-dispatches through freed memory in the GPU process. This\nis reachable from a compromised WebContent process over UserMediaCaptureManagerProxy IPC\nonce the page has been granted getDisplayMedia.\n\nGuard the observer re-registration in sourceConfigurationChanged() on m_isObservingMedia\nso a stopped proxy is never re-inserted into m_videoFrameObservers.\n\n* LayoutTests/ipc/display-capture-source-configuration-change-uaf-expected.txt: Added.\n* LayoutTests/ipc/display-capture-source-configuration-change-uaf.html: Added.\n* Source/WebKit/GPUProcess/webrtc/UserMediaCaptureManagerProxy.cpp:\n(WebKit::UserMediaCaptureManagerProxySourceProxy::sourceConfigurationChanged):\n\nOriginally-landed-as: 305413.1075@safari-7624.5-branch (a06fd51c1706). rdar://185367909\nCanonical link: https://commits.webkit.org/320368@main", "email": "jya@apple.com", "hash": "b7324636a8621b0623e36f72c08544177043c457", "subject": "[CoreIPC][GPUP] UserMediaCaptureManagerProxySourceProxy can leave a dangling VideoFrameObserver* in RealtimeMediaSource" }, "320369@main": { "author": "Brent Fulgham", "avatar": "https://www.gravatar.com/avatar/c6989a65afef0d015b55c65406e37ccc?d=identicon\u0026s=64", "cl": "320369@main", "clUrl": "https://commits.webkit.org/320369@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323136\nrdar://186397129\n\nReviewed by Charlie Wolfe.\n\nWhile investigating some other cookie bugs, I discovered that some ITP bugs had an\nordering dependency that led to flaky behavior. This patch makes a few improvements for\nbetter coverage and to reduce flakiness:\n\n1. Correct ResourceLoadStatisticsStore::resetParametersToDefaultValues so that it clears\n the minimumTimeBetweenDataRecordsRemoval along with other local state. Several tests\n worked around this by explicitly setting this to zero in their preambles, but tests that\n did not know to do this would become flaky if a long-removal test ran before they did.\n2. Renamed two tests to better match the test assertions.\n3. Added three tests cover the Short/7 day, Long/29 day, and Long/30 day windows.\n4. Improves the website-data-removal-checks.js to prevent test results from producing\n similar output for distinct failure modes (e.g., it produced the same string for a\n success case AND a timeout case).\n5. Corrected a bug in website-data-removal-checks.js that used indexedDB.open() to test\n for IndexedDB absence. This was bad because it caused a database to be created, which\n left a dangling connection that could persist for later tests. Instead, it checks\n using indexedDB.databases() which does not have this side-effect.\n\nTests: http/tests/resourceLoadStatistics/operating-dates-all-but-cookies-not-removed-with-user-interaction-29-days-ago.html\n http/tests/resourceLoadStatistics/operating-dates-all-but-cookies-not-removed-with-user-interaction-7-days-ago.html\n http/tests/resourceLoadStatistics/operating-dates-all-but-cookies-removed-short-frequency-with-user-interaction-7-days-ago.html\n http/tests/resourceLoadStatistics/operating-dates-all-but-cookies-removed-with-user-interaction-30-days-ago.html\n\n* LayoutTests/http/tests/resourceLoadStatistics/operating-dates-all-but-cookies-not-removed-with-user-interaction-29-days-ago-expected.txt: Added.\n* LayoutTests/http/tests/resourceLoadStatistics/operating-dates-all-but-cookies-not-removed-with-user-interaction-29-days-ago.html: Added.\n* LayoutTests/http/tests/resourceLoadStatistics/operating-dates-all-but-cookies-not-removed-with-user-interaction-7-days-ago-expected.txt: Renamed from LayoutTests/http/tests/resourceLoadStatistics/operating-dates-all-but-cookies-removed-with-user-interaction-7-days-ago-expected.txt.\n* LayoutTests/http/tests/resourceLoadStatistics/operating-dates-all-but-cookies-not-removed-with-user-interaction-7-days-ago.html: Renamed from LayoutTests/http/tests/resourceLoadStatistics/operating-dates-all-but-cookies-removed-with-user-interaction-7-days-ago.html.\n* LayoutTests/http/tests/resourceLoadStatistics/operating-dates-all-but-cookies-removed-short-frequency-with-user-interaction-7-days-ago-expected.txt: Added.\n* LayoutTests/http/tests/resourceLoadStatistics/operating-dates-all-but-cookies-removed-short-frequency-with-user-interaction-7-days-ago.html: Added.\n* LayoutTests/http/tests/resourceLoadStatistics/operating-dates-all-but-cookies-removed-with-user-interaction-30-days-ago-expected.txt: Added.\n* LayoutTests/http/tests/resourceLoadStatistics/operating-dates-all-but-cookies-removed-with-user-interaction-30-days-ago.html: Added.\n* LayoutTests/http/tests/resourceLoadStatistics/resources/website-data-removal-checks.js: Added.\n(rdcAddOutput):\n(rdcSleep):\n(async rdcPollUntil):\n(rdcLocalStorageNetworkView):\n(rdcLocalStorageWebView):\n(async rdcCheckLocalStorage):\n(async rdcCookieNamesSeenByServer):\n(rdcCookieNamesSeenByWebProcess):\n(async if):\n(const.present.async includes):\n(async rdcCheckCookie):\n(async rdcIDBExists):\n(async rdcCheckIDB):\n(async rdcCreateIDBAndClose):\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/wk2/TestExpectations:\n* Source/WebKit/NetworkProcess/Classifier/ResourceLoadStatisticsStore.cpp:\n(WebKit::ResourceLoadStatisticsStore::resetParametersToDefaultValues):\n\nCanonical link: https://commits.webkit.org/320369@main", "email": "bfulgham@apple.com", "hash": "a01d26f0ddb26298bb95698e42c5ca37eec59235", "subject": "De-flake some ITP test cases" }, "320370@main": { "author": "Tim Nguyen", "avatar": "https://www.gravatar.com/avatar/208c05ac2decdf818a4a08ada568328e?d=identicon\u0026s=64", "cl": "320370@main", "clUrl": "https://commits.webkit.org/320370@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=318657\nrdar://177969354\n\nReviewed by Simon Fraser.\n\nIOSurfacePool keeps two parallel collections that must stay in sync:\nm_cachedSurfaces (HashMap\u003cIntSize, Deque\u003cunique_ptr\u003cIOSurface\u003e\u003e\u003e) and\nm_sizesInPruneOrder (Vector\u003cIntSize\u003e). tryEvictOldestCachedSurface()\nlooked up m_sizesInPruneOrder.first() in m_cachedSurfaces and dereferenced\nthe result without checking against end(). An MTE crashtracer in the GPU\nprocess (RemoteRenderingBackend work queue, reached via ReleaseImageBufferSet\n-\u003e ~ImageBufferIOSurfaceBackend -\u003e addSurface -\u003e evict) shows the lookup\nreturning end() and the subsequent -\u003evalue.takeLast() reading one bucket past\nthe HashTable allocation, faulting on the first byte of the next allocation.\n\nEarly return in the case of the mismatch and clean up only one of the two collections in that case.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/cocoa/IOSurfaceTests.mm\n\n* Source/WebCore/platform/graphics/cg/IOSurfacePool.cpp:\n(WebCore::IOSurfacePool::tryEvictOldestCachedSurface):\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/IOSurfaceTests.mm:\n(TestWebKitAPI::createSurface):\n(TestWebKitAPI::TEST(IOSurfacePoolTest, EvictionWithManyDistinctSizes)):\n(TestWebKitAPI::TEST(IOSurfacePoolTest, ConcurrentAddAndEvict)):\n\nOriginally-landed-as: 305413.1095@safari-7624.5-branch (f6cebae3c564). rdar://185369110\nCanonical link: https://commits.webkit.org/320370@main", "email": "ntim@apple.com", "hash": "b23dfbcbb9cf9ba3a22ad0b7f7a55dd77f00b462", "subject": "IOSurfacePool::tryEvictOldestCachedSurface should not dereference an end() iterator" }, "320371@main": { "author": "Roberto Rodriguez", "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64", "cl": "320371@main", "clUrl": "https://commits.webkit.org/320371@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=316355\nrdar://178074009\n\nReviewed by Kimmo Kinnunen.\n\nAn upstream ANGLE update ( https://chromium.googlesource.com/angle/angle/+/849f71287df00f4984264b900fb88fd780864f50 )\nremoved validation that previously rejected compressed texture uploads when no pixel unpack buffer was bound. Without\nit, a compromised web content process can send a compressed texture upload IPC message (the PBO-offset variant) with a\nchosen address and no pixel unpack buffer bound. The GPU process passes the address to Metal which reads from it into\na texture, giving the attacker arbitrary read access in GPU process.\n\nAdd buffer-binding guards to offset-based overloads in GraphicsContextGLANGLE that cast an IPC-supplied offset to a\npointer. Check GL_PIXEL_UNPACK_BUFFER_BINDING for texture uploads. Return GL_INVALID_OPERATION if no buffer is bound.\n\nAdd API tests in TestGraphicsContextGLCocoa that verify each guarded overload rejects when no buffer is bound.\n\nTest: Tools/TestWebKitAPI/Tests/WebCore/cocoa/TestGraphicsContextGLCocoa.mm\n\n* Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.cpp:\n(WebCore::GraphicsContextGLANGLE::texImage2D):\n(WebCore::GraphicsContextGLANGLE::texSubImage2D):\n(WebCore::GraphicsContextGLANGLE::compressedTexImage2D):\n(WebCore::GraphicsContextGLANGLE::compressedTexSubImage2D):\n(WebCore::GraphicsContextGLANGLE::texImage3D):\n(WebCore::GraphicsContextGLANGLE::texSubImage3D):\n(WebCore::GraphicsContextGLANGLE::compressedTexImage3D):\n(WebCore::GraphicsContextGLANGLE::compressedTexSubImage3D):\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/TestGraphicsContextGLCocoa.mm:\n(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest, ClearBufferIncorrectSizes)):\n(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest, CompressedTexImage2DRejectsOffsetWithNoPBO)):\n(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest, CompressedTexSubImage2DRejectsOffsetWithNoPBO)):\n(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest, CompressedTexImage3DRejectsOffsetWithNoPBO)):\n(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest, CompressedTexSubImage3DRejectsOffsetWithNoPBO)):\n(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest, TexImage2DRejectsOffsetWithNoPBO)):\n(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest, TexSubImage2DRejectsOffsetWithNoPBO)):\n(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest, TexImage3DRejectsOffsetWithNoPBO)):\n(TestWebKitAPI::TEST_F(GraphicsContextGLCocoaTest, TexSubImage3DRejectsOffsetWithNoPBO)):\n\nOriginally-landed-as: 305413.981@safari-7624.5-branch (737f43a06688). rdar://185368753\nCanonical link: https://commits.webkit.org/320371@main", "email": "roberto_rodriguez2@apple.com", "hash": "487e5a08ac6cf4bc87660eaebc2e05e72bf0504b", "subject": "[WebGL] Reject offset-based GL calls when no buffer is bound" }, "320372@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "320372@main", "clUrl": "https://commits.webkit.org/320372@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=314183\nrdar://175852496\n\nReviewed by Anne van Kesteren and Ryosuke Niwa.\n\nThe Trusted Types check in Document::execCommand() was using a case-sensitive\ncomparison (commandName != \"insertHTML\"_s) to decide whether to enforce\nTrustedHTML. Since execCommand command names are case-insensitive per spec,\npassing a differently-cased variant like \"InsertHTML\" or \"inserthtml\" would\nbypass the Trusted Types enforcement entirely.\n\nFix by using equalIgnoringASCIICase() for the comparison.\n\nTest: fast/dom/trusted-types-execCommand-insertHTML-case-insensitive.html\n\n* LayoutTests/fast/dom/trusted-types-execCommand-insertHTML-case-insensitive-expected.txt: Added.\n* LayoutTests/fast/dom/trusted-types-execCommand-insertHTML-case-insensitive.html: Added.\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::execCommand):\n\nOriginally-landed-as: 305413.846@safari-7624-branch (0e4f1956aff4). rdar://184744820\nCanonical link: https://commits.webkit.org/320372@main", "email": "cdumez@apple.com", "hash": "49cbb806d160d35aba07f40706abab4fd25bfffa", "subject": "Trusted Types enforcement in Document.execCommand should be case-insensitive" }, "320373@main": { "author": "Kimmo Kinnunen", "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64", "cl": "320373@main", "clUrl": "https://commits.webkit.org/320373@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=317294\nrdar://176813568\n\nReviewed by Dan Glastonbury.\n\nBefore, changing the type of a vertex attrib would not cause recomputation\nof how many elements can be drawn. The type size affects this, as\nlast attrib of the buffer accesses only the type size amount of data, not\nthe stride amount of data.\n\nExample buffer size == 32:\n- type size == 1, stride == 28 --\u003e buffer fits 2 elements.\n- type size == 16, stride == 28 --\u003e buffer fits 1 element.\n\nFix by recomputing the element count also in case the type changes.\n\n* Source/ThirdParty/ANGLE/src/libANGLE/VertexArray.cpp:\n(gl::VertexArray::bindVertexBufferImpl):\n(gl::VertexArray::bindVertexBuffer):\n(gl::VertexArray::setVertexAttribPointerImpl):\n* Source/ThirdParty/ANGLE/src/tests/gl_tests/VertexAttributeTest.cpp:\n\nOriginally-landed-as: 305413.1006@safari-7624.5-branch (3320c0a36383). rdar://185367119\nCanonical link: https://commits.webkit.org/320373@main", "email": "kkinnunen@apple.com", "hash": "e521d4c83bfe21177f6ff5503f6b0aa6e96ea32f", "subject": "ANGLE: Element limit not updated after format only VertexAttribPointer change" }, "320374@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "320374@main", "clUrl": "https://commits.webkit.org/320374@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323249\nrdar://problem/186501326\n\nReviewed by Dan Hecht.\n\nThis patch makes FTL validation related patchpoints a bit solid, but not\naffect on the actual execution much.\n\n1. AllowMacroScratchRegisterUsage is not necessary for AssertNotEmpty.\n2. Clobber registers in crash op in FTL.\n\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileAssertNotEmpty):\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n\nCanonical link: https://commits.webkit.org/320374@main", "email": "ysuzuki@apple.com", "hash": "fc7bbf6086da9d43b0fc7f8dd49bc41fa4e3ff50", "subject": "[JSC] Make FTL validation patchpoints a bit solid" }, "320375@main": { "author": "Sosuke Suzuki", "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64", "cl": "320375@main", "clUrl": "https://commits.webkit.org/320375@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323254\n\nReviewed by Yusuke Suzuki.\n\nDeleting a property from an object whose Structure is an UncacheableDictionary\nremoves it in place, so the StructureID does not change. JSObject::deleteProperty\nonly bumped the megamorphic cache epoch on the transition path, so a store cache\nentry that was recorded while a prototype shadowed a setter or a read-only\nproperty stays valid after that shadowing property is deleted, and later stores\nadd an own property instead of calling the setter or throwing. Before 320236@main\nsuch chains were never recorded in the store cache, which hid the missing bump.\n\nBump the epoch on both delete paths, matching the in-place add and attribute\nchange paths, which already invalidate without a transition.\n\nTest: JSTests/stress/megamorphic-store-prototype-dictionary-delete.js\n\n* JSTests/stress/megamorphic-store-prototype-dictionary-delete.js: Added.\n(shouldBe):\n(makeShape):\n(makeChain):\n(put):\n(i.put.makeShape.const.P2.set x):\n(i.put.makeShape):\n* Source/JavaScriptCore/runtime/JSObject.cpp:\n(JSC::JSObject::deleteProperty):\n\nCanonical link: https://commits.webkit.org/320375@main", "email": "sosuke@bun.sh", "hash": "41776a35d9581136117d35408f907e6bbc869632", "subject": "[JSC] Deleting a property of a dictionary prototype in place does not invalidate the megamorphic store cache" }, "320376@main": { "author": "Cole Carley", "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64", "cl": "320376@main", "clUrl": "https://commits.webkit.org/320376@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322874\nrdar://186121147\n\nReviewed by Brent Fulgham.\n\nThere are some static members of the Quirks class that act\nas global quirks.\n\nThis patch adds them as named members of the Quirk table.\n\nTests: Tools/TestWebKitAPI/Tests/WebCore/Quirks.cpp\n Tools/TestWebKitAPI/Tests/WebCore/URLMatch.cpp\n\n* LayoutTests/fast/quirks/active-quirks-by-domain-expected.txt:\n* LayoutTests/platform/glib/fast/quirks/active-quirks-by-domain-expected.txt:\n* LayoutTests/platform/ipad/fast/quirks/active-quirks-by-domain-expected.txt:\n* LayoutTests/platform/ios/fast/quirks/active-quirks-by-domain-expected.txt:\n* LayoutTests/platform/mac-sequoia/fast/quirks/active-quirks-by-domain-expected.txt:\n* LayoutTests/platform/mac-tahoe/fast/quirks/active-quirks-by-domain-expected.txt:\n* Source/WebCore/page/QuirkNames.h:\n* Source/WebCore/page/QuirkTable.cpp:\n(WebCore::resolveSiteSpecificQuirks):\n(WebCore::resolveTopURLQuirks):\n* Source/WebCore/page/QuirkTable.h:\n* Source/WebCore/page/Quirks.cpp:\n* Source/WebCore/page/URLMatch.cpp:\n(WebCore::URLMatch::RefinementSet::matchesPathPattern const):\n(WebCore::URLMatch::RefinementSet::matches const):\n* Source/WebCore/page/URLMatch.h:\n(WebCore::URLRefinement::pathIs):\n(WebCore::URLRefinement::queryContains):\n(WebCore::URLMatch::applyRefinement):\n* Tools/TestWebKitAPI/CMakeLists.txt:\n* Tools/TestWebKitAPI/Tests/WebCore/Quirks.cpp:\n(TestWebKitAPI::resolveQuirksForTopURL):\n(TestWebKitAPI::TEST_F(QuirksTest, EmbeddedQuirksResolveFromTheDocumentURL)):\n(TestWebKitAPI::TEST_F(QuirksTest, ShouldTranscodeHeicImagesForURL)):\n(TestWebKitAPI::TEST_F(QuirksTest, IsMicrosoftTeamsRedirectURL)):\n(TestWebKitAPI::TEST_F(QuirksTest, ShouldAllowNavigationToCustomProtocolWithoutUserGesture)):\n(TestWebKitAPI::TEST_F(QuirksTest, NeedsPartitionedCookies)):\n(TestWebKitAPI::TEST_F(QuirksTest, ShouldOmitTouchEventDOMAttributesForDesktopWebsite)):\n* Tools/TestWebKitAPI/Tests/WebCore/URLMatch.cpp:\n(TestWebKitAPI::TEST(URLMatchTest, PathIsMatchesTheWholePath)):\n(TestWebKitAPI::TEST(URLMatchTest, QueryContainsSearchesOnlyTheQuery)):\n(TestWebKitAPI::TEST(URLMatchTest, QueryContainsStacksWithAPathRefinement)):\n\nCanonical link: https://commits.webkit.org/320376@main", "email": "ccarley2@apple.com", "hash": "f2c8fbb52ccbbea8a1a05517a4c8d7df04e18bb7", "subject": "[Quirks] Add global quirks to the quirk table" }, "320377@main": { "author": "Roberto Rodriguez", "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64", "cl": "320377@main", "clUrl": "https://commits.webkit.org/320377@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323197\nrdar://186433086\n\nReviewed by Kimmo Kinnunen\n\nContains upstream commits:\ne8d1a2c13248 Vulkan: Avoid double-syncing framebuffer attachments\n3fef328e7419 Vulkan: Fix CPU-path for copy-texture to cubemaps\nb8bce479666b Translator: Fix block/field name collision in CollectVariables\n679767534e2b Increase timeouts on ANGLE S24 bot\n7051f199d184 GN: Don't bring in perfetto without build\nf0350032f8eb GL: Change FATAL to ERR on state query error.\n2172372f9dfc Remove redundant GetDisplayIfValid() call\nf7241a8f551e GL: Fix inverted assert when setting vertex attribs\n7d77c76cb8a0 scripts: use correct vpython3 for windows\n4bc30f16c887 Roll VK-GL-CTS from 34b25839e80b to 0b04c470ed78 (19 revisions)\nd2a5dc4db8e2 Roll vulkan-deps from 0a277020c757 to 37e841bbd2f9 (10 revisions)\nbe80ce591a48 GL: Use refactored VAO availability function.\na849c249bc68 GL: Check for instancing before querying divisors\nf3a880100cfd Update Thread current context after Context::makeCurrent\n0cec00c68e27 Add test for R10X6G10X6B10X6A10X6 copy\nade73a7333af Only send down display to ANGLE_EGL_SCOPED_CONTEXT_LOCK if used\n019d3430dec1 Encapsulates the ANGLEPlatformDisplayMap and DevicePlatformDisplayMap\nafb1b36d625c IR: validate precisions are applied properly\n7344ac2e08e7 Infra: Disable extra traces on CQ bots via property\n4a846b0ddf96 Trace/Replay: Add \"vk_api_wall_time\" metric\nfb5fc9761271 Roll vulkan-deps from b2accf345f13 to 0a277020c757 (27 revisions)\n7368784df424 Vulkan: Fix incorrect use of VK_EXT_global_priority\n8bbfb03f8fce Fix pixel size of RGBA10X6\n5ddc382124ef CL/Vulkan: Submit empty command if needed\n48c20cc42d7c Vulkan: Never emulate uint8 indices\n6cc4ee605ec0 Fix NaN validation bypasses in range checks\n2834b907c5a4 Vulkan: Categorize extensions that are promoted to Vulkan 1.4\n3e6e4dea881f Vulkan: Prefer KHR over EXT extensions when promoted\n72f53bf9e73b Vulkan: Remove use of VK_EXT_global_priority_query\n991aa52eeece Scripts: Switch run_code_generation.py to vpython3\nae89f62541d0 IR: propagate function call parameters precisions\nbaf9b20c0cf1 IR: apply the precision to constants in transformation steps\n3cff84ba3619 Vulkan: Defer creating read image views to sync/etc\n14eb2b097ba7 Roll SwiftShader from a7c547b55474 to 26e6a4b84daf (2 revisions)\nf19d315f829b CL/VK: Fix fill_images for 1Dbuffer w/ use_pitches\n14307e7ed5f3 [tracing] Support perfetto API in angle\n74a6bb7af551 CL/Vulkan: Process any previous queue serials\nba7a7c9a9605 Assert that EmulateGLFragColorBroadcast does not run on WebGL2\n620adae57b80 IR: Add a new precision enum Unassigned\n56707de41791 CL/Vulkan: Account for zero-sized enqueue\na9476176a10c Trace/Replay: Grab EGL/GL mutexes during capture\nedf12968fa39 Reland \"Replace mFunctions-\u003eclear in clearRenderbuffer\"\n2af6159dfd57 GL: Turn state validation into a run time feature.\n6b3d9dbefbe9 Add new group to SCHEDULER_OWNER\n7b4238a1ad6c Fix uninitialized texture levels during GenerateMipmap\n5cbd3b1344b5 GL/D3D11: Clamp multiview-adjusted attribute divisor\na89f4ffda91a Add gl_PointSize to FragmentShaderLoadUnboundImageUnits\n25b6dd000bd8 Docs: Update initial links and comments\ne6447ec72629 GL: Use ContextStateGL for external contexts\nd33722f31099 GL: Clamp values in ContextStateGLCaps to impl limits\n31c01933e708 Scripts: Switch roll_aosp.sh to vpython3\n25e721127e1c GL: StatemanagerGL owns all VAO states.\n4a745a2ad7ad GL: Fix cases where vertex binding offset was not set to 0\nd6ed7964370c GL: Track default VAO state in ContextStateGL.\n013e8a1af187 Traces: Update documentation for downloading all traces\nc24d9971269a Vulkan: Fix updating RenderPassDesc for FBO clear\n07e4e6f5033e Wayland: Regenerate config for the 1.26.0 roll\n1dfc92bd1818 Avoid std::strong_order in Color equality\n032a3ce2da7f Fix D/S shader framebuffer fetch tests\ne0d53b9dd7e6 Fix STENCIL_INDEX8 internal format map entry\nd5c8131b66e3 GL: Add a function to apply a ContextStateGL\n4c5dd5e9bf6a GL: Compare against current state for depth stencil states\n0e80263dfe75 GL: Clamp BASE/MAX texture levels\nc4b048df641c Trace/Replay: Prevent GL errors when calling MakeCurrent\n49db0a452858 EGL: Prevent ANGLE gl validation errors on replay\n170d2f332e14 GL: Compute dirty bits between two ContextStateGLs\n7e6fd3f63ca3 EGL: Adjust depth/stencil surface format selection\n2a38d62336e6 Roll vulkan-deps from af17ae0ac3a5 to b2accf345f13 (11 revisions)\nde419d3fd06b Roll Chromium from 9ac349c94b98 to aa9b74792a21 (686 revisions)\ne422fa19258e Translator: Fix index-checks vs comma\n91d2d125ec00 Vulkan: Map only remaining buffer size in getIndexRange\n5b683ed30122 Optimize robust init check during GenerateMipmap\n3729f92590c5 GL: Use PixelPack/Unpack structs in ContextStateGL\ne0a1266883cd Vulkan: Remove TextureVk::getImageViews()\n896efc3ca2d9 Tests: Fix dEQP build and runtime for Wayland-only configs\n82a8b2d800c4 Roll vulkan-deps from 9b3fec1aec6c to af17ae0ac3a5 (8 revisions)\n515ed76cdcfe OpenCL: add additional validation to GetProgramInfo\na9d1ca1c0d73 Roll VK-GL-CTS from 3b7cbad78e93 to 34b25839e80b (23 revisions)\n2385c7b4ccb8 Roll Chromium from cbb915d67c46 to 9ac349c94b98 (845 revisions)\n272d37f4cc0c Remove Own* types and rename Source* types to Owner*\n6fa59f82e48d GL: Fix BindBufferRange and BindImage not setting dirty bits\ncd05752a5137 GL: Add printing functions for ContextStateGL\n4d046d6abd31 OpenCL: Update the format conversion query to use type\n661885c1a696 Skip new OcclusionQueriesTest on Win Intel Vulkan\nb8352abce038 ANGLE: Reattach texture layer to FBO after layer count increase\nc5e0c550ffe2 GL: Use a framebuffer with a stencil buffer to querying state\n78a72721cc0f IR: Add new validation TODOs\nd0b4f4d215fa Update context version mismatch message for tests\nb085ab3a85c9 Introduce ResultAccumulator to aggregate results\n6d696207e2fb Expose GL_OES_stencil8\n9ff43a017862 Tests: Limit CQ testing to representative ANGLE traces\ncdb28096ffbe Vulkan: Log driverVersion in Renderer::initFeatures\n72a097d38faf Translator: Disallow arrays of external samplers\nbdac11942d72 Vulkan: Use SourceLayer throughout the backend\n362637f8200a Vulkan: Use SourceLevel throughout the backend\n2e484954bb49 SPIR-V: Remove Row/ColMajor from Workgroup class structs\n92ff3b92c8dd Roll vulkan-deps from 54cbd6cba08d to 9b3fec1aec6c (16 revisions)\nef387bf788d1 Roll Chromium from bdc9fe66be13 to cbb915d67c46 (719 revisions)\n7022bdab0a79 Simplify AddYUVFormat\n0e5d32f40590 Framecapture: Add ClientWaitSync to trace fixture\n5506a28c2af5 Trace/Replay: Fix OOB gContextMap2 Indices\n1b3a0894ee53 D3D11: Fix buffer-overflow during robust texture initialization\n0099562106d4 Roll Chromium from 4a4f76045a90 to bdc9fe66be13 (918 revisions)\n2bd94af5d530 Vulkan: Disable protected memory on Intel GPUs on Android\n14571794da42 D3D11: Fix dynamic vertex buffer reservation\n2a42a3255622 IR: Validate mutually exclusive interpolation decorations\n3e73fcd7f1be Manual roll vulkan-deps from 0d9c229af89c to 54cbd6cba08d (10 revisions)\n2c5c60cd270d Metal: Split render pass on occlusion query offset limit\n22ba45a57477 Remove EmulatePrerotation 90 and 270 for PointSpriteTest\n74121e95f128 GL: Add utilities to query ContextStateGL from the driver.\n5b2152599947 Data race when creating shared context\nd82a885eda34 FrameCapture: Make canProtectDirectly not modify context state.\n1ebd518e9a49 Return effective max level 0 for EGL image siblings\nf16c27656856 Fix bundling scripts\n78211275a028 Expose Chromium Win/ARM64 trybot\nfef82cd9be4e Trace/Replay: Make \"frame_wall_time\" metric optional\n38c5fb8ee606 Trace/Replay: Add syncpoints needed for GL/EGL interactions\n005edcb6b9f3 Reland \"Vulkan: Use SourceImageIndex throughout the backend\"\ncebf94590f28 Vulkan: Fix robust-clear after invalidate of emulated format\nb3ad723d0da2 Suppress flaky xfb test on win/intel/Vulkan\n880d825611b3 Roll Chromium from c46619b18044 to 4a4f76045a90 (763 revisions)\nc09abf1d3a9f Enable Angle Win/NVIDIA experiment.\n90feec9fb72f Fix build with wayland 1.26\naf00fda20ba3 Vulkan: Add config w/o backward compat context\n55c2d4efc4b6 Reduce WebGL max supported version to 3.0\na946b8d38583 Tests: Add captured framecount mode to trace_tests\n4a59050d5954 EGL: Detach image siblings unconditionally on backend failure\n043b7b278c66 Revert \"Vulkan: Use SourceImageIndex throughout the backend\"\n81b8839e11c4 Roll vulkan-deps from 899dab78f857 to 0d9c229af89c (10 revisions)\nf013c634faa0 Roll Chromium from dcaf3ddb3290 to c46619b18044 (819 revisions)\n\nCanonical link: https://commits.webkit.org/320377@main", "email": "roberto_rodriguez2@apple.com", "hash": "a9575c8e967c265b40f17c2a1d3ccc610b5af4a1", "subject": "Update ANGLE to 2026-08-10 (e8d1a2c13248ac6d328a2fb5e35fa6580567ee1c)" }, "320378@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "320378@main", "clUrl": "https://commits.webkit.org/320378@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323248\nrdar://problem/186500258\n\nReviewed by Dan Hecht.\n\nThis is harmless, but this is wrong. Every other IC is declaring them as\nlateReg. So let's do it. It is fine for this cachedPutById since its\nresult is Void, so it does not conflict with the return register, but\nanyway, be consistent with the right approach. Also fixes LateRegister's\nlowering while currently this path is not so much effectively used.\n\nAlso drive-by fix for ValueRep::ColdAny / ValueRep::LateColdAny in\nPatchpoint's admitsStack. It should be listed as the same way to\nB3LowerToAir. Currently this path was not used.\n\n* Source/JavaScriptCore/b3/B3LowerToAir.cpp:\n* Source/JavaScriptCore/b3/B3PatchpointSpecial.cpp:\n(JSC::B3::PatchpointSpecial::admitsStack):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::cachedPutById):\n\nCanonical link: https://commits.webkit.org/320378@main", "email": "ysuzuki@apple.com", "hash": "0c96a8ad401581477c2714cf569ef3385a3ca08c", "subject": "[JSC] Declare m_notCellMask and m_numberTag as ValueRep::lateReg in cachedPutById" }, "320379@main": { "author": "Qianlang Chen", "avatar": "https://www.gravatar.com/avatar/0fd54e904334f604739d0205aa6e2130?d=identicon\u0026s=64", "cl": "320379@main", "clUrl": "https://commits.webkit.org/320379@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323261\n\nUnreviewed test gardening.\n\nThis test is already forced to be run under Site Isolation. There is no\nneed to skip it in mac-wk2 only to un-skip it in mac-site-isolation.\n(It wouldn't hurt to skip either, but no other tests in our SI-inspector\nsuite follow that pattern, and the comment in mac-wk2/TestExpectations\nmakes it confusing why it's still skipped.)\n\n* LayoutTests/platform/mac-site-isolation/TestExpectations:\n* LayoutTests/platform/mac-wk2/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320379@main", "email": "qianlangchen@apple.com", "hash": "45b8b09e7170429f07d0e2ac5ba37724f480c03c", "subject": "[Site Isolation] Web Inspector: Remove the unnecessary skip and pass expectations for storage-get-cookies-cross-origin-iframe.html" }, "320380@main": { "author": "Cole Carley", "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64", "cl": "320380@main", "clUrl": "https://commits.webkit.org/320380@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323259\nrdar://186506661\n\nReviewed by Brent Fulgham.\n\nThis patch removes the dead quirk: Quirk::needsLaxSameSiteCookieQuirk().\n\n* Source/WebCore/page/Quirks.cpp:\n* Source/WebCore/page/Quirks.h:\n\nCanonical link: https://commits.webkit.org/320380@main", "email": "ccarley2@apple.com", "hash": "026b39a0ac7423d6b86f13561bb7cbad59b7bb21", "subject": "Remove dead Quirk needsLaxSameSiteCookieQuirk" }, "320381@main": { "author": "Ruthvik Konda", "avatar": "https://www.gravatar.com/avatar/bca33cefcce93017251a8fbc1204cdc4?d=identicon\u0026s=64", "cl": "320381@main", "clUrl": "https://commits.webkit.org/320381@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323140\nrdar://186400145\n\nReviewed by Dan Glastonbury and Mike Wyrzykowski.\n\nThe WGSL spec[1] states that the discard statement must only be used in a\nfragment shader stage, but we accepted it in vertex and compute entry points,\nand in any function reachable from one. Metal codegen then emitted\ndiscard_fragment() inside a [[kernel]] or [[vertex]] function, which the Metal\ncompiler rejects.\n\nVisibilityValidator already walks the call graph once per entry point to check\nthat built-ins are only called from the stages that allow them, so validating\nthe discard statement there also covers helper functions reached from a\nnon-fragment entry point.\n\n[1]: https://www.w3.org/TR/WGSL/#discard-statement\n\n* LayoutTests/http/tests/webgpu/webgpu/shader/validation/statement/discard-expected.txt:\n* Source/WebGPU/WGSL/VisibilityValidator.cpp:\n(WGSL::VisibilityValidator::visit):\n* Tools/TestWebKitAPI/Tests/WGSL/TypeCheckingTests.mm:\n(TestWGSLAPI::TEST(WGSLTypeCheckingTests, Visibility)):\n\nCanonical link: https://commits.webkit.org/320381@main", "email": "rkonda2@apple.com", "hash": "a097f4c45e4e4334501f614fd9db3b3e7badb047", "subject": "[WGSL] shader,validation,statement,discard:* is failing" }, "320382@main": { "author": "Ryosuke Niwa", "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64", "cl": "320382@main", "clUrl": "https://commits.webkit.org/320382@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323272\n\nUnreviewed. Update safer C++ expectations.\n\n* Source/WebCore/SaferCPPExpectations/UncountedLambdaCapturesCheckerExpectations:\n\nCanonical link: https://commits.webkit.org/320382@main", "email": "rniwa@webkit.org", "hash": "5c4a15052570d98719f8e641cc486c1093e81681", "subject": "Update safer C++ expectations (2026-09-03)" }, "320383@main": { "author": "Sammy Gill", "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64", "cl": "320383@main", "clUrl": "https://commits.webkit.org/320383@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323263\nrdar://problem/186509338\n\nReviewed by Tim Nguyen.\n\nStyle::FitTolerance derives from PrimitiveNumericOrKeyword and had a\nswitchOn in its blending function with two handlers: one taking a\nLengthPercentage, and a catch-all taking auto that hit\nASSERT_NOT_REACHED().\n\nswitchOn hands over the specific type, a Length or a Percentage or a\nCalc, and never the combined LengthPercentage wrapper that holds one of\nthose three. The catch-all takes those as-is, while the LengthPercentage\nhandler can only take them after a conversion, and C++ prefers the\nhandler that needs no conversion. So the catch-all won every time and\nthe blending branch was dead code.\n\nPrimitiveNumericOrKeyword already provides a correct generic blending\nimplementation for any LengthPercentageOrKeywordDerived type.\nGridTrackBreadthLength is a similar type that already uses this so we\nbasically just utilize it here as well.\n\nCanonical link: https://commits.webkit.org/320383@main", "email": "sammy.gill@apple.com", "hash": "5155ec6d4d6e051767caa709a4b806227758b24b", "subject": "[Grid Lanes] fit-tolerance does not interpolate between \u003clength-percentage\u003e values" }, "320384@main": { "author": "Claudio Saavedra", "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64", "cl": "320384@main", "clUrl": "https://commits.webkit.org/320384@main", "description": "Unreviewed gardening.\n\nThese tests have been passing consistently for at least 100 runs.\n\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/gtk/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320384@main", "email": "csaavedra@igalia.com", "hash": "7e4ec6cff6e7132c0bbc9f7e97b9e2a47c5d0f13", "subject": "[GLIB] Remove stale flaky expectations" }, "320385@main": { "author": "Chris Dumez", "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64", "cl": "320385@main", "clUrl": "https://commits.webkit.org/320385@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323183\n\nReviewed by David Kilzer.\n\n* Source/JavaScriptCore/inspector/remote/cocoa/RemoteInspectorCocoa.mm:\n(Inspector::RemoteInspector::setupXPCConnectionIfNeeded):\n* Source/JavaScriptCore/inspector/remote/cocoa/RemoteInspectorXPCConnection.mm:\n(Inspector::RemoteInspectorXPCConnection::sendMessage):\n* Source/WTF/wtf/cocoa/Entitlements.mm:\n(WTF::hasEntitlement):\n* Source/WebKit/NetworkProcess/Notifications/Cocoa/WebPushDaemonConnectionCocoa.mm:\n(WebKit::WebPushD::messageDictionaryFromEncoder):\n* Source/WebKit/NetworkProcess/PrivateClickMeasurement/cocoa/PrivateClickMeasurementConnectionCocoa.mm:\n(WebKit::PCM::Connection::dictionaryFromMessage const):\n* Source/WebKit/NetworkProcess/cocoa/LaunchServicesDatabaseObserver.mm:\n(WebKit::LaunchServicesDatabaseObserver::LaunchServicesDatabaseObserver):\n(WebKit::LaunchServicesDatabaseObserver::startObserving):\n* Source/WebKit/Platform/IPC/cocoa/DaemonConnectionCocoa.mm:\n(WebKit::Daemon::ConnectionToMachService\u003cTraits\u003e::initializeConnectionIfNeeded const):\n* Source/WebKit/Platform/cocoa/LayerHostingContext.mm:\n(WebKit::LayerHostingContext::createHostingUpdateCoordinator):\n(WebKit::LayerHostingContext::createHostingHandle):\n* Source/WebKit/Platform/ios/VideoReceiverEndpointMessage.mm:\n(WebKit::VideoReceiverEndpointMessage::encode const):\n(WebKit::VideoReceiverSwapEndpointsMessage::encode const):\n* Source/WebKit/Shared/Cocoa/LaunchLogHook.mm:\n(WebKit::LaunchLogHook::initialize):\n(WebKit::LaunchLogHook::disable):\n\n* Source/WebKit/Shared/Cocoa/XPCEndpoint.mm:\n(WebKit::XPCEndpoint::XPCEndpoint):\n(WebKit::XPCEndpoint::sendEndpointToConnection):\nStop using adoptOSObject() since those files use ARC and it generates\nsafer cpp warnings under ARC.\n\n* Source/WebKit/Shared/Cocoa/XPCEndpointClient.mm:\n(WebKit::XPCEndpointClient::setEndpoint):\n* Source/WebKit/Shared/Daemon/DaemonUtilities.mm:\n(WebKit::startListeningForMachServiceConnections):\n(WebKit::vectorToXPCData):\n(WebKit::encoderToXPCData):\n* Source/WebKit/Shared/EntryPointUtilities/Cocoa/Daemon/PCMDaemonConnectionSet.mm:\n(WebKit::PCM::DaemonConnectionSet::broadcastConsoleMessage):\n* Source/WebKit/Shared/EntryPointUtilities/Cocoa/Daemon/PCMDaemonEntryPoint.mm:\n(WebKit::CompletionHandler\u003cvoid):\n(WebKit::registerScheduledActivityHandler):\n* Source/WebKit/Shared/EntryPointUtilities/Cocoa/XPCService/XPCServiceMain.mm:\n(WebKit::XPCServiceEventHandler):\n(WebKit::XPCServiceMain):\n* Source/WebKit/UIProcess/Authentication/cocoa/AuthenticationChallengeProxyCocoa.mm:\n(WebKit::AuthenticationChallengeProxy::sendClientCertificateCredentialOverXpc):\n* Source/WebKit/UIProcess/Launcher/cocoa/ProcessLauncherCocoa.mm:\n(WebKit::ProcessLauncher::launchProcess):\n(WebKit::ProcessLauncher::finishLaunchingProcess):\n(WebKit::ProcessLauncher::tryFinishLaunchingProcess):\n* Source/WebKit/WebProcess/cocoa/LaunchServicesDatabaseManager.mm:\n(WebKit::LaunchServicesDatabaseManager::didConnect):\n* Source/WebKit/webpushd/WebPushDaemon.mm:\n(WebPushD::WebPushDaemon::connectionEventHandler):\n* Source/WebKit/webpushd/webpushtool/WebPushToolConnection.mm:\n(WebPushTool::Connection::connectToService):\n(WebPushTool::messageDictionaryFromEncoder):\n* Source/WebKit/webpushd/webpushtool/WebPushToolMain.mm:\n(registerDaemonWithLaunchD):\n* Tools/TestWebKitAPI/Helpers/cocoa/DaemonTestUtilities.mm:\n(TestWebKitAPI::convertArrayToXPC):\n(TestWebKitAPI::convertDictionaryToXPC):\n* Tools/TestWebKitAPI/Tests/WebKit/WKPage/cocoa/XPCEndpoint.mm:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/EventAttribution.mm:\n(TestWebKitAPI::attemptConnectionInProcessWithoutEntitlement):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WebPushDaemon.mm:\n(TestWebKitAPI::WebPushXPCConnectionMessageSender::messageDictionaryFromEncoder const):\n(TestWebKitAPI::createAndConfigureConnectionToService):\n(TestWebKitAPI::TEST(WebPushD, BasicCommunication)):\n\nCanonical link: https://commits.webkit.org/320385@main", "email": "cdumez@apple.com", "hash": "a2c1cb7f677ffbcf0b64687e8b75666d74eeab3a", "subject": "[Safer CPP] Drop some suppression macros now that we use adoptOSObject() instead of adoptXPCObject()" }, "320386@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "320386@main", "clUrl": "https://commits.webkit.org/320386@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323271\nrdar://186521110\n\nUnreviewed build fix\n\n320301@main added Shared/RunJavaScriptResult.swift, which extends the C++ alias\nWebKit::RunJavaScriptResult declared in Shared/RunJavaScriptResult.h. The iOS family feeds Swift a\nhand-written WebKit_Internal modulemap listing only the submodules its Swift sources need, and that\nheader has no entry, so the name resolves to the WebKit namespace from SwiftDemoLogoConfirmation.h\nand the module failed to build:\n\n* Source/WebKit/PlatformCocoa.cmake:\n\nCanonical link: https://commits.webkit.org/320386@main", "email": "jya@apple.com", "hash": "ae96e9b10b9d6b89d3dcc34a7fb78547c6917a25", "subject": "[cmake] REGRESSION (320301@main) compilation error on iOS and visionOS" }, "320387@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "320387@main", "clUrl": "https://commits.webkit.org/320387@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323243\nrdar://186495899\n\nReviewed by Chris Dumez.\n\nThe token-signature, token-public-key, and report-attribution path\nconstants were declared as `static const char[]`, while their siblings\n(trigger-attribution and the SKAdNetwork prefix) already use ASCIILiteral\n(_s). Passing the C-string constants to makeValidURL() forced it to take a\n`const char*` and wrap the argument in unsafeSpan(), a runtime scan flagged\nas an unsafe buffer access.\n\nDeclare the three constants as `constexpr auto ... = \"...\"_s` and change\nmakeValidURL() to take an ASCIILiteral, passing it straight to makeString().\nThis drops the unsafeSpan() call and the runtime length computation with no\nbehavior change.\n\n* Source/WebCore/loader/PrivateClickMeasurement.cpp:\n(WebCore::makeValidURL):\n\nCanonical link: https://commits.webkit.org/320387@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "a19c53e12f2d6e87fe835555a6e9cb0cbd77ced0", "subject": "PrivateClickMeasurement path constants should be ASCIILiteral to avoid unsafeSpan" }, "320388@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "320388@main", "clUrl": "https://commits.webkit.org/320388@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323241\nrdar://186492181\n\nReviewed by Chris Dumez.\n\nModernize C-style typedef declarations to C++ alias declarations\n(using) across a handful of loader files. No behavior change.\n\n* Source/WebCore/loader/ResourceLoadStatistics.cpp:\n* Source/WebCore/loader/archive/ArchiveFactory.cpp:\n* Source/WebCore/loader/cache/MemoryCache.h:\n* Source/WebCore/loader/cocoa/DiskCacheMonitorCocoa.h:\n\nCanonical link: https://commits.webkit.org/320388@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "307cb0cb11781086a04156750af05ea560b942fe", "subject": "Replace typedef with using in loader classes" }, "320389@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "320389@main", "clUrl": "https://commits.webkit.org/320389@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323252\nrdar://186503027\n\nReviewed by Chris Dumez.\n\ntokenPublicKeyURL() and tokenSignatureURL() on PrivateClickMeasurement and\nAttributionTriggerData returned `const std::optional\u003cconst URL\u003e`, which\npessimizes copies in two compounding ways:\n\n- The top-level `const` on the by-value return makes the returned prvalue\n const, so callers cannot move-construct from it and are forced to copy the\n URL (and its underlying String).\n- The `const`-qualified element type (`optional\u003cconst URL\u003e`) forces the\n `return makeValidURL(...)` inside these functions to copy rather than move\n the URL out of the `std::optional\u003cURL\u003e` that makeValidURL() returns, and\n makes the optional itself non-move-assignable.\n\nReturn plain `std::optional\u003cURL\u003e` instead. This is a move/RVO win with no\nbehavioral change; all existing call sites consume the result by value or\nvia `if (auto optURL = ...)` and are unaffected.\n\n* Source/WebCore/loader/AttributionTriggerData.cpp:\n(WebCore::PCM::AttributionTriggerData::tokenPublicKeyURL const):\n(WebCore::PCM::AttributionTriggerData::tokenSignatureURL const):\n* Source/WebCore/loader/AttributionTriggerData.h:\n* Source/WebCore/loader/PrivateClickMeasurement.cpp:\n(WebCore::PrivateClickMeasurement::tokenPublicKeyURL):\n(WebCore::PrivateClickMeasurement::tokenPublicKeyURL const):\n(WebCore::PrivateClickMeasurement::tokenSignatureURL):\n(WebCore::PrivateClickMeasurement::tokenSignatureURL const):\n* Source/WebCore/loader/PrivateClickMeasurement.h:\n\nCanonical link: https://commits.webkit.org/320389@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "5b7329cf1b86e72332e68c5069db0b953cfab522", "subject": "PrivateClickMeasurement token URL getters should return std::optional\u003cURL\u003e instead of const std::optional\u003cconst URL\u003e" }, "320390@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "320390@main", "clUrl": "https://commits.webkit.org/320390@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323258\nrdar://186506734\n\nReviewed by Chris Dumez.\n\nTwo pieces of dead code in loadSubframe():\n\n- The page/subframeCount check is an exact duplicate of the check that\n canCreateSubFrame() already performs immediately afterward. Since\n canCreateSubFrame() tests the same predicate (and additionally checks\n frame tree depth), the inline check is fully redundant.\n\n- The \"!subFrame\" operand in the post-load detachment check can never be\n true: subFrame is a local RefPtr proven non-null earlier and never\n reassigned. Detaching the frame from the document does not null the\n local strong reference; only the \"!subFrame-\u003etree().parent()\" operand\n reflects removal.\n\nNo change in behavior.\n\n* Source/WebCore/loader/SubframeLoader.cpp:\n(WebCore::FrameLoader::SubframeLoader::loadSubframe):\n\nCanonical link: https://commits.webkit.org/320390@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "e78ffc906984991f10444d7cd8f564789fd4eadf", "subject": "Remove dead code in FrameLoader::SubframeLoader::loadSubframe()" }, "320391@main": { "author": "Ahmad Saleem", "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64", "cl": "320391@main", "clUrl": "https://commits.webkit.org/320391@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323242\nrdar://186495063\n\nReviewed by Chris Dumez.\n\nparseSingleRule() constructed a 10-element HashSet\u003cString\u003e of the allowed\nrule keys as a function-local, so the set was allocated, hashed, and\ndestroyed once per rule parsed. The set is a read-only constant, so hoist\nit to a NeverDestroyed static that is built once.\n\nNo change in behavior.\n\n* Source/WebCore/loader/SpeculationRules.cpp:\n(WebCore::parseSingleRule):\n\nCanonical link: https://commits.webkit.org/320391@main", "email": "ahmad.saleem792+github@gmail.com", "hash": "d9136f7891344cfe1635fb97cda11d9163fef9cc", "subject": "SpeculationRules::parseSingleRule rebuilds its allowed-keys HashSet on every call" }, "320392@main": { "author": "Richard Robinson", "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64", "cl": "320392@main", "clUrl": "https://commits.webkit.org/320392@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323275\nrdar://186529950\n\nUnreviewed re-land of 318934@main.\n\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n\nCanonical link: https://commits.webkit.org/320392@main", "email": "richard_robinson2@apple.com", "hash": "668e47d3c01a037288ab4bebc88d7ffa12a3d048", "subject": "Re-land [PDF] Use the alternate PDF HUD view by default" }, "320393@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "320393@main", "clUrl": "https://commits.webkit.org/320393@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323269\nrdar://186519182\n\nReviewed by Mark Lam.\n\n1. evaluateExtendedConstExpr was copying Vector\u003cuint8_t\u003e wasm const-expr\n bytes. Stop doing so.\n2. We also clean up evaluateConstantExpression code so that wasm module\n uses JSWebAssemblyInstance::evaluateConstantExpression instead of its\n own (very similar) method.\n\n* Source/JavaScriptCore/wasm/WasmConstExprGenerator.cpp:\n(JSC::Wasm::evaluateExtendedConstExpr):\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp:\n(JSC::JSWebAssemblyInstance::evaluateConstantExpression):\n(JSC::JSWebAssemblyInstance::ensureConstantExpressionValue):\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h:\n* Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp:\n(JSC::WebAssemblyModuleRecord::initializeExports):\n(JSC::WebAssemblyModuleRecord::evaluateConstantExpression):\n(JSC::WebAssemblyModuleRecord::evaluate):\n* Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.h:\n\nCanonical link: https://commits.webkit.org/320393@main", "email": "ysuzuki@apple.com", "hash": "4dbfab2693adfbccc72b683100dbf466e6640792", "subject": "[JSC] Do not copy const-expr byte sequence in wasm" }, "320394@main": { "author": "Mark Lam", "avatar": "https://www.gravatar.com/avatar/87a4219a10aeda88757492c63da746de?d=identicon\u0026s=64", "cl": "320394@main", "clUrl": "https://commits.webkit.org/320394@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323262\nrdar://186508769\n\nReviewed by Yusuke Suzuki.\n\nWe used to be able to dump class layouts in WebKit frameworks:\n% /usr/bin/python3 ./Tools/Scripts/dump-class-layout -b WebKitBuild -c Release JavaScriptCore CodeBlock\n\nNow, we can also dump class layouts in static libraries as well e.g.\n% /usr/bin/python3 ./Tools/Scripts/dump-class-layout -b WebKitBuild -c Release libJavaScriptCoreTools.a Corpse::Snapshot\n\nOr more conveniently, we can do so by specifying the path to the binary file:\n% /usr/bin/python3 ./Tools/Scripts/dump-class-layout WebKitBuild/Release/libJavaScriptCoreTools.a Corpse::Snapshot\n\n./Tools/Scripts/dump-class-layout will now look for target binaries (of various formats) to dump from in this order:\n1. name + \".framework/\" + name\n2. \"lib\" + name + \".a\"\n3. name + \".a\"\n4. \"lib\" + name + \".dylib\"\n5. name + \".dylib\",\n6. name\n\nFirst one found that is a valid file will be consulted for the class layout info to dump.\n\n* Tools/Scripts/dump-class-layout:\n(webkit_build_dir):\n(find_binary):\n(main.or):\n(main):\n* Tools/lldb/lldb_dump_class_layout.py:\n(LLDBDebuggerInstance.__init__):\n(LLDBDebuggerInstance):\n(LLDBDebuggerInstance._archive_member_specs):\n(LLDBDebuggerInstance._modules_to_search):\n(LLDBDebuggerInstance.layout_for_classname):\n\nCanonical link: https://commits.webkit.org/320394@main", "email": "mark.lam@apple.com", "hash": "38ff8b34a54151a1cfafa359c6178b3b353f2bef", "subject": "Enhance Tools/Scripts/dump-class-layout to be able to dump classes in static libraries and other binaries as well." }, "320395@main": { "author": "Kiet Ho", "avatar": "https://www.gravatar.com/avatar/d9058b37006dce1f55f91b8ccc82f9a3?d=identicon\u0026s=64", "cl": "320395@main", "clUrl": "https://commits.webkit.org/320395@main", "description": "rdar://185839711\nhttps://bugs.webkit.org/show_bug.cgi?id=323047\n\nReviewed by Ryosuke Niwa and Simon Fraser.\n\nRecent changes in intersection observer have been shown to cause power\nregressions. This is an attempt to optimize parts that show up in power\ntraces:\n\n1) In IntersectionObserver::updateObservations, we copy the list of targets\n before iterating through it. It seems that copying WeakListHashSet to\n another WeakListHashSet involves adding each element, and power traces\n shows we spend more time expanding the underlying hash table. Replace the\n copy with copyToVectorOf, which reserves capacity before copying, so it\n wouldn't expand capacity during copy.\n2) Also in IntersectionObserver::updateObservations, we check if the target's\n document is fully active before proceeding. This check is expensive as it\n traverses the frame tree. Since it's more likely that targets belong to a\n handful of documents, and documents wouldn't change their fully active\n status during update, add a cache to cache document's fully active status.\n3) In Document::updateRemoteIntersectionObservers, add an assert to check that\n a document only has remote obsevers if the page has remote frames. This is\n always true, as remote observers only exist in a document that is remote\n (not in the same process) with the main frame.\n\nOptimization patch, tested by existing test suite.\n\n* Source/WebCore/page/IntersectionObserver.cpp:\n(WebCore::IntersectionObserver::updateObservations):\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::updateRemoteIntersectionObservers):\n\nCanonical link: https://commits.webkit.org/320395@main", "email": "kiet.ho@apple.com", "hash": "3b068d9c3d5f80474d9e58e311d6310c1e746cda", "subject": "[intersection-observer] Some performance/power optimizations" }, "320396@main": { "author": "itsu-dev", "avatar": "https://www.gravatar.com/avatar/66a96e8616819c12f1006e116ba535a7?d=identicon\u0026s=64", "cl": "320396@main", "clUrl": "https://commits.webkit.org/320396@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323092\n\nReviewed by Yusuke Suzuki.\n\nAccording to [1][2], the `Intl.PluralRules.select` and `Intl.PluralRules.selectRange` methods should support\n`BigInt` values as their arguments, but the current implementation supports only `Number` values.\nThe test262 test suites has also been updated [3][4].\n\n[1]: https://github.com/tc39/ecma402/pull/1026\n[2]: https://tc39.es/ecma402/#sec-intl.pluralrules.prototype.select\n[3]: https://github.com/tc39/test262/pull/4912\n[4]: https://github.com/tc39/test262/pull/4911\n\nTest: JSTests/stress/intl-pluralrules-mathematical-value.js\n\n* JSTests/stress/intl-pluralrules-mathematical-value.js: Added.\n(shouldBe):\n(representations):\n(const.locale.of.locales.const.number.of.numbers.const.representation.of.representations):\n* Source/JavaScriptCore/runtime/IntlPluralRules.cpp:\n(JSC::IntlPluralRules::select const):\n(JSC::IntlPluralRules::selectRange const):\n* Source/JavaScriptCore/runtime/IntlPluralRules.h:\n* Source/JavaScriptCore/runtime/IntlPluralRulesPrototype.cpp:\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n\nCanonical link: https://commits.webkit.org/320396@main", "email": "itsu020402@gmail.com", "hash": "2e5ec08882e660b34004f9b0d7825a579010d7c2", "subject": "[JSC] Support `BigInt` for `Intl.PluralRules.select` and `Intl.PluralRules.selectRange`" }, "320397@main": { "author": "Claudio Saavedra", "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64", "cl": "320397@main", "clUrl": "https://commits.webkit.org/320397@main", "description": "Unreviewed gardening.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/mac/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320397@main", "email": "csaavedra@igalia.com", "hash": "584a97d22e3079b98c9190de737abc02bbcfed7b", "subject": "Make texture-srgb-upload.html expectations match the bots" }, "320398@main": { "author": "Nikolas Zimmermann", "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64", "cl": "320398@main", "clUrl": "https://commits.webkit.org/320398@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322424\n\nReviewed by Simon Fraser.\n\nThe ticket contains a reduction obtained from YouTube Shorts, when dark\nmode + ambient mode is enabled. Around the video a glow effect is\nvisible, which left stale pixels on our ports while the video was\nrunning.\n\nTestcase:\n\n #glow { position: absolute; left: 50%; top: 50%; width: 380px; height: 660px;\n margin: -330px 0 0 -190px; transform: scale(1.8, 1.3);\n filter: blur(40px); pointer-events: none; }\n #glow canvas { position: absolute; width: 100%; height: 100%; }\n\n\u003cdiv id=\"glow\"\u003e\n \u003ccanvas id=\"ca\" width=\"86\" height=\"126\"\u003e\u003c/canvas\u003e\n \u003ccanvas id=\"cb\" width=\"86\" height=\"126\"\u003e\u003c/canvas\u003e\n\u003c/div\u003e\n\nmacOS repaints this particular testcase correctly, because #glow ends up\ncomposited as the canvases are composited and the platform layer applies\nthe blur filter. On GTK/WPE they are not: the canvas backing store size is\n86 * 126px, below the minimum area we impose for acceleration\n(CanvasBase::shouldAccelerate(), queries\nSettings::minimumAccelerated2DContextArea which is 128 * 129 with Skia,\n0 elsewhere). Both canvases are drawn in software, into the enclosing layer.\n\nThe code path our ports take has a bug since 204269@main: we no longer set\nsetHasSoftwareFilters() anywhere. RenderObject::containerForRepaint() only looks\nfor an enclosing filter layer while that flag is set, so it never sees #glow.\nThe repaint is issued against the root layer of the page instead, and\nrepaintUsingContainer() never calls RenderLayer::setFilterBackendNeedsRepaintingInRect().\nThat is the only place that expands the repaint rect by filterOutsets() and was\nmissing for us.\n\nInstead of bringing back the setHasSoftwareFilters() mechanism, mimic\nthe outline counter concept: count the renderers with a pixel moving\nfilter, and maintain the count properly, instead of keeping a flag on all\nthe time as it used to be in the past.\n\nFurthermore a stale-repaint-rect issue had to be fixed: RenderLayer caches its\nrepaint container in m_repaintContainer, together with the repaint rects that\nare expressed relative to that container. Whether a layer is the repaint\ncontainer for its subtree now depends on requiresFullLayerImageForFilters(),\nso removing a pixel moving filter, or turning it into a non-pixel-moving filter,\nleaves every layer in the subtree pointing at a container that is no longer\na repaint container. That hits an assertion in imported/w3c/web-platform-tests/\ncss/filter-effects/animation/filter-interpolation-003.html.\n\nThis fixes the repainting logic in general, whenever software-rendered\nfilters are involved, also on Mac platforms as several new testcases\ndemonstrate.\n\nTests: css3/filters/filter-repaint-blur-before-first-paint.html\n css3/filters/filter-repaint-blur-canvas-partial.html\n css3/filters/filter-repaint-blur-inline.html\n css3/filters/filter-repaint-blur-inner-content-change.html\n css3/filters/filter-repaint-blur-nested-non-pixel-moving-filter.html\n css3/filters/filter-repaint-blur-nested-pixel-moving-filter.html\n\n* LayoutTests/css3/filters/filter-repaint-blur-before-first-paint-expected.txt: Added.\n* LayoutTests/css3/filters/filter-repaint-blur-before-first-paint.html: Added.\n* LayoutTests/css3/filters/filter-repaint-blur-canvas-partial-expected.txt: Added.\n* LayoutTests/css3/filters/filter-repaint-blur-canvas-partial.html: Added.\n* LayoutTests/css3/filters/filter-repaint-blur-inline-expected.txt: Added.\n* LayoutTests/css3/filters/filter-repaint-blur-inline.html: Added.\n* LayoutTests/css3/filters/filter-repaint-blur-inner-content-change-expected.txt: Added.\n* LayoutTests/css3/filters/filter-repaint-blur-inner-content-change.html: Added.\n* LayoutTests/css3/filters/filter-repaint-blur-nested-non-pixel-moving-filter-expected.html: Added.\n* LayoutTests/css3/filters/filter-repaint-blur-nested-non-pixel-moving-filter.html: Added.\n* LayoutTests/css3/filters/filter-repaint-blur-nested-pixel-moving-filter-expected.html: Added.\n* LayoutTests/css3/filters/filter-repaint-blur-nested-pixel-moving-filter.html: Added.\n* LayoutTests/fast/repaint/drop-shadow-change-full-repaint-expected.txt:\nThe first repaint rect dumped was wrong, this fixes it as side-effect.\n* Source/WebCore/rendering/RenderElement.cpp:\n(WebCore::RenderElement::styleWillChange):\n(WebCore::RenderElement::willBeDestroyed):\n* Source/WebCore/rendering/RenderLayer.cpp:\n(WebCore::RenderLayer::removeOnlyThisLayer):\n(WebCore::RenderLayer::shouldPaintWithFilters const):\n(WebCore::RenderLayer::requiresFullLayerImageForFilters const):\n(WebCore::RenderLayer::updateRepaintRectsIncludingDescendants):\n(WebCore::RenderLayer::computeRepaintRectsIncludingDescendants): Deleted, folded into the above.\n(WebCore::RenderLayer::compositingStatusChanged):\n(WebCore::RenderLayer::enclosingPixelMovingFilterLayer const):\n(WebCore::RenderLayer::setFilterBackendNeedsRepaintingInRect):\n(WebCore::RenderLayer::updateFiltersAfterStyleChange):\n(WebCore::RenderLayer::filterOutsets const):\n* Source/WebCore/rendering/RenderLayer.h:\n* Source/WebCore/rendering/RenderLayerFilters.cpp:\n(WebCore::RenderLayerFilters::isIdentity): Deleted.\n* Source/WebCore/rendering/RenderLayerFilters.h:\n* Source/WebCore/rendering/RenderObject.cpp:\n(WebCore::RenderObject::containerForRepaint const):\n(WebCore::RenderObject::repaintUsingContainer const):\n(WebCore::RenderObject::issueRepaint const):\n(WebCore::RenderObject::repaintSlowRepaintObject const):\n* Source/WebCore/rendering/RenderObject.h:\n* Source/WebCore/rendering/RenderView.h:\n* Source/WebCore/rendering/updating/RenderTreeUpdater.cpp:\n(WebCore::repaintAndMarkContainingBlockDirtyBeforeTearDown):\n\nCanonical link: https://commits.webkit.org/320398@main", "email": "nzimmermann@igalia.com", "hash": "4b6b2cdc90927388eb93d81906d4af25e7aa79df", "subject": "Content changing inside an element with a blur filter doesn't properly repaint" }, "320399@main": { "author": "Anne van Kesteren", "avatar": "https://www.gravatar.com/avatar/09bb44ac3625a121017cd98d0a7dc52c?d=identicon\u0026s=64", "cl": "320399@main", "clUrl": "https://commits.webkit.org/320399@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323212\n\nReviewed by Ryosuke Niwa.\n\nPer the DOM standard allow declarative shadow roots needs to survive\ncloning. And per discussion Document.parseHTMLUnsafe() should not have an\nopaque origin. It's already not opaque in other browsers.\n\nCanonical link: https://commits.webkit.org/320399@main", "email": "annevk@annevk.nl", "hash": "3a653d746ba1065cc85bac38902bd129bd3dd0a3", "subject": "Preserve document's declarative shadow root opt-in when cloning" }, "320400@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "320400@main", "clUrl": "https://commits.webkit.org/320400@main", "description": "rdar://173526833\n\nReviewed by Youenn Fablet.\n\nDon't use SharedMemory::unsafeBuffer() on buffer sent from the content process\nto the GPU process.\n\n* Source/WebKit/GPUProcess/media/RemoteImageDecoderAVFProxy.cpp:\n(WebKit::RemoteImageDecoderAVFProxy::createDecoder):\n\nOriginally-landed-as: 305413.1076@safari-7624.5-branch (0786f1938711). rdar://185366779\nCanonical link: https://commits.webkit.org/320400@main", "email": "jya@apple.com", "hash": "8db7ec0be98e048dbc86802e49ad0a71c42cd0ab", "subject": "Race Condition in RemoteImageDecoderAVFProxy" }, "320401@main": { "author": "Abrar Rahman Protyasha", "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64", "cl": "320401@main", "clUrl": "https://commits.webkit.org/320401@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=321323\nrdar://181739903\n\nUnreviewed test gardening.\n\nThis test is now passing after 320156@main, so lets undo the failing\nexpectations.\n\n* LayoutTests/platform/mac-wk2/TestExpectations:\n* LayoutTests/platform/mac/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320401@main", "email": "a_protyasha@apple.com", "hash": "205de14a7b2e52ffd9997bea485cf7cb8c854782", "subject": "REGRESSION(318278@main): http/tests/websocket/tests/hybi/inspector/before-load.html (layout-tests) is a constant text Failure." }, "320402@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "320402@main", "clUrl": "https://commits.webkit.org/320402@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323281\nrdar://186533756\n\nReviewed by Mark Lam.\n\nThis patch avoids atomizing wasm import names twice by having\nFixedVector with Identifier pairs.\n\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp:\n(JSC::JSWebAssemblyInstance::tryCreate):\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.cpp:\n(JSC::JSWebAssemblyModule::importNames):\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.h:\n* Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp:\n(JSC::WebAssemblyModuleRecord::initializeImports):\n\nCanonical link: https://commits.webkit.org/320402@main", "email": "ysuzuki@apple.com", "hash": "a4741842d2bb89f352763c390c55fe12dfa884a3", "subject": "[JSC] Avoid atomizing import names twice" }, "320403@main": { "author": "Alejandro G. Castro", "avatar": "https://www.gravatar.com/avatar/c8c6e17acbdf0549b05d6f7fc2c1c4dc?d=identicon\u0026s=64", "cl": "320403@main", "clUrl": "https://commits.webkit.org/320403@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=172812\n\nReviewed by Carlos Garcia Campos.\n\nImplement checkGPUStatus() for glib ports, the GPUStatusFailure event set\nup by Internals::simulateEventForWebGLContext() sets m_failNextStatusCheck and\nnothing was reading it, that made the context never lost and the tests that wait\nfor the webglcontextlost event failed or timed out.\n\nImplement the simulated failure branch, matching what the Cocoa backend does in\nGraphicsContextGLCocoa.mm. Real GPU reset detection would additionally need\nGL_EXT_robustness, this change makes the testing work.\n\nAlso unlike Cocoa this does not drop the current context afterwards, because\nGraphicsContextGLTextureMapperANGLE tracks context currency itself in\nmakeContextCurrent() and calling EGL_MakeCurrent() behind its back would leave\nthat tracking stale.\n\nUnskip the four tests using this feature:\n\nfast/canvas/webgl/lose-context-on-status-failure.html (was Skip, timed out)\nwebgl/lose-context-after-context-lost.html (was Failure Timeout)\nwebgl/multiple-context-losses.html (was Failure)\nwebgl/max-active-contexts-webglcontextlost-prevent-default.html (was Failure,\nfiled under webkit.org/b/305355, but it uses the same simulation hook)\n\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebCore/platform/graphics/texmap/GraphicsContextGLTextureMapperANGLE.cpp:\n(WebCore::GraphicsContextGLANGLE::checkGPUStatus):\n\nCanonical link: https://commits.webkit.org/320403@main", "email": "alex@igalia.com", "hash": "2094600ec6893832008517925c6b755b4421c7fb", "subject": "[GLIB] Implement GraphicsContextGLANGLE::checkGPUStatus()" }, "320404@main": { "author": "Claudio Saavedra", "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64", "cl": "320404@main", "clUrl": "https://commits.webkit.org/320404@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323219\n\nReviewed by Carlos Garcia Campos.\n\nThe legacy API bot runs the same build as the regular WPE bot and only\npasses --wpe-legacy-api at test time. That leaves the fixture without a\nWPEDisplay, so webkit_web_view_get_wpe_view() returns null: the editor\ntests assert on a valid WPEView before reaching the clipboard, and\nPageClientImpl::requestDOMPasteAccess only emits a\nWebKitClipboardPermissionRequest when a WPEPlatform view exists.\n\nThe legacy API has no clipboard, so there is nothing for these three\nsubtests to check there. Don't register them when it is in use. An\nexpectation cannot express this, as scope keys have no flavor dimension\nand a wpe entry would also mask failures on the WPEPlatform bots\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/glib/TestUIClient.cpp:\n(beforeAll):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/wpe/TestWebViewEditor.cpp:\n(beforeAll):\n\nCanonical link: https://commits.webkit.org/320404@main", "email": "csaavedra@igalia.com", "hash": "8aebb0ac128e5f3e4fa99d3d9818e614357a4618", "subject": "[WPE] Clipboard API tests always fail on the legacy API bot" }, "320405@main": { "author": "Youenn Fablet", "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64", "cl": "320405@main", "clUrl": "https://commits.webkit.org/320405@main", "description": "rdar://185205409\nhttps://bugs.webkit.org/show_bug.cgi?id=323213\n\nReviewed by Jean-Yves Avenard.\n\n311380@main added a LazyLoadVideoObserver to every \u003cvideo\u003e at construction time,\nand gated HTMLVideoElement's accelerated rendering on the observer's m_isIntersectingViewport signal.\n\nThis gets broken when the element is migrated to a new document since the observer would stay bound to the previous document.\nVideo element would then no longer render as they would think they are not visible in view port.\nThis notably applies to frameworks that parse HTML in an inert document.\n\nWe fix this by migrating the observer from the old document to the new document in HTMLVideoElement::didMoveToNewDocument.\n\nTest: fast/mediastream/MediaStream-video-element-cross-document-intersection-observer.html\n\n* LayoutTests/fast/mediastream/MediaStream-video-element-cross-document-intersection-observer-expected.txt: Added.\n* LayoutTests/fast/mediastream/MediaStream-video-element-cross-document-intersection-observer.html: Added.\n* Source/WebCore/html/HTMLVideoElement.cpp:\n(WebCore::HTMLVideoElement::didMoveToNewDocument):\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::isMediaElementIntersectingViewport const):\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\n\nCanonical link: https://commits.webkit.org/320405@main", "email": "youenn@apple.com", "hash": "61b11e2e9afe52d025b99dc454a16912843b4ee9", "subject": "dibsido QR scanner camera preview is not rendering" }, "320406@main": { "author": "Kimmo Kinnunen", "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64", "cl": "320406@main", "clUrl": "https://commits.webkit.org/320406@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323215\nrdar://186456921\n\nReviewed by Sam Weinig.\n\nRename ColorSpace name enum to ColorSpaceName.\nThis makes space for renaming DestinationColorSpace to ColorSpace.\n\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/inspector/InspectorFrontendHost.cpp:\n(WebCore::InspectorFrontendHost::pickColorFromScreen):\n* Source/WebCore/platform/graphics/Color.cpp:\n(WebCore::Color::toResolvedColorComponentsInColorSpace const):\n(WebCore::Color::colorSpaceAndResolvedColorComponents const):\n* Source/WebCore/platform/graphics/Color.h:\n(WebCore::Color::Color):\n(WebCore::Color::setOutOfLineComponents):\n(WebCore::Color::colorSpace const):\n(WebCore::Color::encodedColorSpace):\n(WebCore::Color::decodedColorSpace):\n(WebCore::Color::setColor):\n* Source/WebCore/platform/graphics/ColorConversion.cpp:\n(WebCore::convertAndResolveColorComponents):\n* Source/WebCore/platform/graphics/ColorConversion.h:\n* Source/WebCore/platform/graphics/ColorSerialization.cpp:\n(WebCore::serialization):\n* Source/WebCore/platform/graphics/ColorSerialization.h:\n* Source/WebCore/platform/graphics/ColorSpaceName.cpp: Renamed from Source/WebCore/platform/graphics/ColorSpace.cpp.\n(WebCore::operator\u003c\u003c):\n* Source/WebCore/platform/graphics/ColorSpaceName.h: Renamed from Source/WebCore/platform/graphics/ColorSpace.h.\n(WebCore::colorSpaceFor):\n(WebCore::callWithColorType):\n* Source/WebCore/platform/graphics/cg/ColorCG.cpp:\n(WebCore::Color::createAndLosslesslyConvertToSupportedColorSpace):\n(WebCore::convertToCGCompatibleComponents):\n(WebCore::createCGColorInDestinationStandardRange):\n(WebCore::platformConvertColorComponents):\n* Source/WebCore/platform/graphics/cg/ColorSpaceCG.cpp:\n(WebCore::colorSpaceForCGColorSpace):\n* Source/WebCore/platform/graphics/cg/ColorSpaceCG.h:\n(WebCore::CGColorSpaceMappingOrNullGetter::colorSpaceSingleton):\n(WebCore::cachedCGColorSpaceSingleton):\n(WebCore::cachedNullableCGColorSpaceSingleton):\n(WebCore::CGColorSpaceMapping\u003cColorSpace::SRGB\u003e::colorSpaceSingleton): Deleted.\n(WebCore::CGColorSpaceMapping\u003cColorSpace::A98RGB\u003e::colorSpaceSingleton): Deleted.\n(WebCore::CGColorSpaceMapping\u003cColorSpace::DisplayP3\u003e::colorSpaceSingleton): Deleted.\n(WebCore::CGColorSpaceMapping\u003cColorSpace::ExtendedA98RGB\u003e::colorSpaceSingleton): Deleted.\n(WebCore::CGColorSpaceMapping\u003cColorSpace::ExtendedDisplayP3\u003e::colorSpaceSingleton): Deleted.\n(WebCore::CGColorSpaceMapping\u003cColorSpace::ExtendedRec2020\u003e::colorSpaceSingleton): Deleted.\n(WebCore::CGColorSpaceMapping\u003cColorSpace::ExtendedLinearDisplayP3\u003e::colorSpaceSingleton): Deleted.\n(WebCore::CGColorSpaceMapping\u003cColorSpace::ExtendedLinearSRGB\u003e::colorSpaceSingleton): Deleted.\n(WebCore::CGColorSpaceMapping\u003cColorSpace::ExtendedProPhotoRGB\u003e::colorSpaceSingleton): Deleted.\n(WebCore::CGColorSpaceMapping\u003cColorSpace::ExtendedSRGB\u003e::colorSpaceSingleton): Deleted.\n(WebCore::CGColorSpaceMapping\u003cColorSpace::Rec2020\u003e::colorSpaceSingleton): Deleted.\n(WebCore::CGColorSpaceMapping\u003cColorSpace::LinearDisplayP3\u003e::colorSpaceSingleton): Deleted.\n(WebCore::CGColorSpaceMapping\u003cColorSpace::LinearSRGB\u003e::colorSpaceSingleton): Deleted.\n(WebCore::CGColorSpaceMapping\u003cColorSpace::ProPhotoRGB\u003e::colorSpaceSingleton): Deleted.\n(WebCore::CGColorSpaceMapping\u003cColorSpace::XYZ_D50\u003e::colorSpaceSingleton): Deleted.\n* Source/WebCore/platform/graphics/cg/GradientRendererCG.cpp:\n(WebCore::GradientRendererCG::makeGradient const):\n(WebCore::GradientRendererCG::createGradientBySampling):\n* Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp:\n(WebCore::skColorSpaceForColorSpace):\n* Source/WebKit/Shared/API/c/cg/WKImageCG.cpp:\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Source/WebKit/Shared/cf/CoreIPCCGColorSpace.h:\n* Source/WebKit/Shared/cf/CoreIPCCGColorSpace.mm:\n(WebKit::CoreIPCCGColorSpace::serializableColorSpace):\n(WebKit::CoreIPCCGColorSpace::toCF const):\n* Source/WebKit/Shared/cf/CoreIPCCGColorSpace.serialization.in:\n* Source/WebKit/UIProcess/ios/WKPageHostedPortalView.mm:\n(-[WKPageHostedPortalView applyBackgroundColor:]):\n* Source/WebKit/WebKitPrefix.h:\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/AcceleratedSurface.cpp:\n(WebKit::AcceleratedSurface::clear):\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/AcceleratedSurfacePlayStation.cpp:\n(WebKit::AcceleratedSurface::AcceleratedSurface):\n(WebKit::AcceleratedSurface::backgroundColorDidChange):\n* Source/WebKitLegacy/mac/DOM/DOMRGBColor.mm:\n* Tools/TestWebKitAPI/Tests/WebCore/ColorTests.cpp:\n(TestWebKitAPI::TEST(Color, MoveConstructor)):\n(TestWebKitAPI::TEST(Color, MoveAssignment)):\n(TestWebKitAPI::TEST(Color, ColorWithAlphaMultipliedBy)):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebViewUnderPageBackgroundColor.mm:\n(defaultBackgroundColor):\n* Tools/lldb/lldb_webkit.py:\n(WebCoreColorProvider._to_string_out_of_line):\n\nCanonical link: https://commits.webkit.org/320406@main", "email": "kkinnunen@apple.com", "hash": "d2dcf8f3be4d51699378ba84a0a404233c2ea98a", "subject": "Rename WebCore::ColorSpace to WebCore::ColorSpaceName" }, "320407@main": { "author": "Claudio Saavedra", "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64", "cl": "320407@main", "clUrl": "https://commits.webkit.org/320407@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319694\n\nReviewed by Jonathan Bedard.\n\nConfiguration.compare() treats an unset member as matching any value, so two\nconfigurations that differ only by an optional member compare as equal. For\nexample WPE reports both the default and the wpe-legacy-api flavor for the same\nrevision, and clicking either run aggregates both into the drawer.\n\nThe drawer then fetched the failures with the aggregate configuration and a\nsingle start time. That pinned the flavor to one of the runs while pinning the\ntime to the other, so the query matched nothing and no failures were shown.\n\nQuery with the members that differ between the aggregated runs left unset, and\nwith a time range spanning all of them, so every run is returned and sorted\ninto its own report.\n\nCanonical link: https://commits.webkit.org/320407@main", "email": "csaavedra@igalia.com", "hash": "1c7ffdc4d2928bf5bef66b0744c88bb7b89587c8", "subject": "[resultsdbpy] Fix investigate drawer not loading failures for WPE runs that share a revision with the legacy API" }, "320408@main": { "author": "Claudio Saavedra", "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64", "cl": "320408@main", "clUrl": "https://commits.webkit.org/320408@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=319693\n\nReviewed by Jonathan Bedard.\n\nWhen the failures endpoint returned something other than a JSON array (for\nexample a 404 error object when no run matched the query), Failures.fromEndpoint\nreturned from its response handler without ever resolving or rejecting its\npromise. The investigate drawer left the failure list in its null \"loading\"\nstate, so it showed a spinner indefinitely.\n\nResolve the promise with the (possibly empty) result on a non-array response,\nand in the drawer handle an empty result and a rejected fetch by rendering an\nempty failure list instead of leaving the spinner up.\n\nCanonical link: https://commits.webkit.org/320408@main", "email": "csaavedra@igalia.com", "hash": "25aa5a18fc2f6831a3e18e1a69ab113e602ffaf9", "subject": "[resultsdbpy] Fix endless loading spinner in the investigate drawer when a failures query returns no results" }, "320409@main": { "author": "Issac Roy", "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64", "cl": "320409@main", "clUrl": "https://commits.webkit.org/320409@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323155\nrdar://186409107\n\nReviewed by Aakash Jain.\n\nExtend results database reporting to JSC. The runner retries stress tests\nitself, so flakiness comes from its own retries rather than a re-run pair, and a\ntest it retried that still failed is reported as a failure rather than as\nevidence of flakiness. Every exit of `AnalyzeJSCTestsResults` ends the build, so\nreporting happens inside the steps that produce each result rather than in a\nstep queued after them, which would never run.\n\n`runJSCStressTests` writes only the notable per-test results to\n`jsc_results.json`. `%reportData` carries a row for every test the stress run\nexecuted, which the `uploadResults` path needs and the json file's consumers do\nnot: they read the failures and the flakes. Writing all of it made the file a\n10 MB step log, parsed in the master and persisted as a build property on every\nJSC run and again on the clean-tree retry, to carry two rows.\n\n`AnalyzeJSCTestsResults` blamed the pull request author for pre-existing test\nfailures. It computed the failures it attributes to the change from the raw\n`jsc_stress_test_failures` and `jsc_binary_failures` properties, so a test the\nresults database already recorded as failing was reported as new when it failed\nwith the change and passed on the clean tree. The filtered lists\n`RunJavaScriptCoreTests` writes for exactly this purpose were read nowhere. The\nanalyzer now prefers `jsc_stress_test_failures_filtered` and\n`jsc_binary_failures_filtered`, falling back to the raw properties for a build\nthat is not against the default branch, and filters below the check for no\nfailures at all, which needs the raw lists.\n\n`_check_for_preexisting_failures` no longer stops at the first failure the\ndatabase does not recognize. That short circuit left the filtered lists\nincomplete, which is harmless while nothing reads them and wrong now that the\nanalyzer does. `MAX_FAILURES_TO_CHECK_RESULTS_DB` bounds the queries instead, at\n50 to match API tests. A failure past the cap is treated as new by both the\npre-existing check and the flakiness read.\n\nThree property writes in `RunJavaScriptCoreTests.runCommand` hardcoded a `jsc_`\nprefix while every write around them derives from `self.prefix`.\n`RunJSCTestsWithoutChange` inherits `runCommand`, so a clean-tree run with any\nfailure of its own overwrote the with-change run's filtered lists, and the\nanalyzer would then subtract the clean-tree failures from themselves and report\nnothing at all.\n\n`RunJavaScriptCoreTests` also asks the database for a flakiness verdict on each\nstress test failure it cannot otherwise explain, dropping the ones it recognizes\nfrom the filtered lists so the analyzer never attributes them to the change. It\nacts on the same three verdicts `RunWebKitTests` acts on. Binary test failures\nare left out: nothing reports them to the database, so a verdict for one could\nonly ever come back unknown.\n\nA build whose failures the database explains now ends at the run step, green\nwith a warning, instead of paying a revert, a recompile and two more JSC runs to\nreach the same conclusion. Reaching that branch on a flakiness verdict rather\nthan only on a pre-existing failure is what makes the read worth running there.\n`results_db_ignore_message` moved from `RunWebKitTests` to\n`ResultsDBReportMixin` so both suites word that summary the same way, which\npluralizes JSC's pre-existing-only message and appends \"based on results-db\".\n\nA `BetweenBuilds` verdict with no intra-build evidence is recorded in\n`results-db_jsc_flaky_unsupported` and not acted on. A test that fails on some\nbuilds and passes on others, never twice within one build, is as consistent with\na configuration-dependent failure as with a flake, and the queue would excuse it\non every build. `RunJSCTestsWithoutChange` excuses nothing at all:\n`AnalyzeJSCTestsResults` subtracts the clean-tree run's raw failures, so its\nfiltered lists are read by no one and the queries behind them buy nothing.\n\nA verdict outside `INCLUDED_FLAKY_VERDICTS` is logged as would-have-ignored\nrather than excused; nothing narrows the set today, so the path exists for a\nqueue that later does. The four new `results-db_jsc_` properties are read by\nnothing, and are there for the build page and for measuring the read.\n\n`jsc_results` is set below the failure-threshold return, so a run with more\nfailures than the step reports individually does not put the map back for the\nanalyzer to read. `jsc_flaky_and_passed` starts being set for the first time:\nthe property was read from a `flakyAndPassed` key the runner has never emitted,\nso `send_email_for_flaky_failure` also fires for the first time.\n\nCanonical link: https://commits.webkit.org/320409@main", "email": "issacroy05@gmail.com", "hash": "09e7bd88eb16e6698f416042af509c085382d892", "subject": "[EWS] JSC EWS blames the pull request author for pre-existing flaky test failures" }, "320410@main": { "author": "Issac Roy", "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64", "cl": "320410@main", "clUrl": "https://commits.webkit.org/320410@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323115\nrdar://186374059\n\nReviewed by Aakash Jain.\n\nEWS excuses a failing test when the results database already calls it flaky. A\n`WithinStepCleanTree` row convicts on its own, with no threshold, while a\ndirty-tree verdict demands two pull requests and two authors and a\nbetween-builds verdict three and two. Nothing compared that evidence against the\nchange being judged, so a pull request's own earlier build could excuse its own\nfailure and the test was dropped before it ever ran against a clean tree.\nGTK-WK2-Tests-EWS build 153043 excused a crash recorded by build 153004, the\nsame pull request by the same author; the test then failed 9 of 14 runs on main\nafter it landed, and 0 of 35 before.\n\n`_rows_by_type` buckets the rows by `flaky_type` in one pass and drops those\nthat are not independent evidence: a row goes when its `pr_number` is the pull\nrequest being judged, or when every author it records is one of the change's\nown.\n\nBoth axes are needed: the merge queue records the login of whoever applied the\nlabel rather than the submitter, so the author check alone lets a PR's own row\nthrough. `authors` comes from the `owners` property that `results_db_details`\nalready writes into each row's `details`, so there is no new source of truth. A\nbuild where neither GitHub step ran leaves `owners` holding buildbot's blamelist\nof commit authors rather than GitHub logins; the comparison then matches nothing\nand conviction proceeds as it does today.\n\nA `WithinStepCleanTree` row is exempt from that filtering. It is recorded after\nthe change is reverted and recompiled, so the pull request and authors on it\nname the build that ran rather than a party with a stake in the verdict, and\ndropping it for naming the change under test would discard the one observation\nthat already excludes the change as the cause. Independence there is a matter of\nhow many builds saw it, not who owned them: `_convict` takes a `builds_needed`\ncounted through `evidence.build_urls`, and `BUILDS_FOR_CLEAN_TREE_FLAKE` is 2.\nAll three thresholds default to 0, so the two existing call sites are unchanged.\n\nBelow that threshold the rule logs what it saw and falls through to the\ndirty-tree rule instead of returning, so a test with one clean-tree row and\nenough dirty-tree evidence is still convicted. The two rules read disjoint\nbuckets, so no row counts toward both, and `INCLUDED_FLAKY_VERDICTS` already\ncarries either verdict.\n\n`intra_build_evidence` is now taken from the rows that survived that filtering\nrather than the raw query, since a between-builds verdict whose only\nwithin-build rows came from the change itself is exactly what the warning it\nfeeds exists to report. A clean-tree row the change wrote itself does count as\nwithin-build evidence, so a `BetweenBuilds` verdict recorded alongside one is no\nlonger reported as `results-db_flaky_unsupported`.\n\n`AnalyzeAPITestsResults` reads the database for the same reason and drops a\nfailure on the same verdicts, so it passes the same identity. `APITestsFactory`\nderives from `TestFactory`, whose base adds `ValidateChange`, so `owners` and\n`github.number` reach an API build by the same route as a layout build, and the\nblamelist fallback above applies unchanged.\n\n* Tools/CISupport/ews-build/results_db.py:\n(ResultsDatabase):\n(ResultsDatabase._convict):\n(ResultsDatabase._rows_by_type):\n(ResultsDatabase._rows_by_type.written_by_another_pull_request):\n(ResultsDatabase._rows_by_type.written_by_others):\n(ResultsDatabase._is_intra_build_flake):\n(ResultsDatabase._is_inter_build_flake):\n(ResultsDatabase.flaky_verdicts_for):\n(ResultsDatabase._rows_by_flaky_type): Deleted.\n(ResultsDatabase.flaky_verdicts_for.logger): Deleted.\n* Tools/CISupport/ews-build/steps.py:\n(RunWebKitTests.filter_failures_using_results_db):\n(AnalyzeAPITestsResults.flaky_new_failures_using_results_db):\n* Tools/CISupport/ews-build/steps_unittest.py:\n\nCanonical link: https://commits.webkit.org/320410@main", "email": "issacroy05@gmail.com", "hash": "118e5ea7dccdc5c700252646be5951025c4e5306", "subject": "[EWS] A clean-tree flake conviction can rest on a single observation from the same author" }, "320411@main": { "author": "Rob Buis", "avatar": "https://www.gravatar.com/avatar/74fb5af173895d2a7814b0aed1238a39?d=identicon\u0026s=64", "cl": "320411@main", "clUrl": "https://commits.webkit.org/320411@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323208\n\nReviewed by Tim Nguyen.\n\nParse -webkit-legacy value on continue property. This value\nwill be useful too to properly distinguish between the -webkit-line-clamp\nand line-clamp behaviours.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/continue-valid-expected.txt:\n* Source/WebCore/css/CSSProperties.json:\n* Source/WebCore/css/CSSValueKeywords.in:\n* Source/WebCore/rendering/style/RenderStyleConstants.cpp:\n(WebCore::operator\u003c\u003c):\n* Source/WebCore/rendering/style/RenderStyleConstants.h:\n* Source/WebCore/style/computed/StyleComputedStyleBase.h:\n* Source/WebCore/style/computed/data/StyleNonInheritedRareData.h:\n* Source/WebCore/style/values/primitives/StyleKeyword+Mappings.h:\n\nCanonical link: https://commits.webkit.org/320411@main", "email": "rbuis@igalia.com", "hash": "cbe007bfa510f6e8945aa9510307b4c22cf6c0d2", "subject": "[line-clamp] Parse -webkit-legacy value on continue property" }, "320412@main": { "author": "Issac Roy", "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64", "cl": "320412@main", "clUrl": "https://commits.webkit.org/320412@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323144\nrdar://186403771\n\nReviewed by Aakash Jain.\n\nThe results database helpers grew from a handful of query functions into the\npath that decides whether a pull request gets blamed for a test failure, and\nthey pass that data around as bare dicts. A row's provenance is reached through\n`(row.get('details') or {}).get('authors')` at four call sites, each repeating\nthe same guard against a key the server may omit, and nothing states what a row\nor an upload contains.\n\n`EWSRowDetails`, `EWSRow` and `EWSPayload` name those three shapes. `EWSRow`\nholds a parsed `details`, so the guards collapse into attribute access and the\none place that filters empty author names is `EWSRowDetails.from_json`.\n`report_ews` takes an `EWSPayload` rather than seven keyword arguments, and\n`_query_flaky` returns `EWSRowByTest`, parsing the response into rows once\ninstead of leaving every consumer to walk `entry['results']`.\n\n`EWSPayload` deliberately has no `api_key` field. The payload is logged, and a\nfield would put the live key in every `__repr__` of it; `report_ews` injects the\nkey into the request body alone. The request dump no longer substitutes a\nredacted key either, since the dict it prints never held one.\n\nResults blobs, `configuration` and `commits` stay `dict` below the top level.\nThey are results database JSON whose keys vary by suite and by which\nconfiguration dimensions a queue supplies, so naming fields would be a lie\nrather than a gap. `_parse_results_ews_response` still returns raw dicts for the\nsame reason: it is deliberately the pre-validation shape, converted to `EWSRow`\nimmediately after.\n\n`report_ews`, `_query_flaky` and `flaky_verdicts_for` are `inlineCallbacks`\ngenerators, so they carry `Generator[Any, Any, T]` describing the body rather\nthan the `Deferred` the decorator hands the caller, matching what the tests in\n`steps_unittest.py` already do.\n\n`_is_intra_build_flake` no longer guards against an empty flaky type. The only\nproducer of those keys is `_rows_by_type`, which buckets every row under\n`row.flaky_type or cls.FAILED_ROWS`, so a key is never empty.\n\n* Tools/CISupport/ews-build/results_db.py:\n(EWSRowDetails):\n(EWSRowDetails.from_json):\n(EWSRowDetails.to_json):\n(EWSRow):\n(EWSRow.from_json):\n(EWSPayload):\n(EWSPayload.to_json):\n(ResultsDatabase.report_ews):\n(ResultsDatabase._evidence_in):\n(ResultsDatabase._rows_by_type):\n(ResultsDatabase._rows_by_type.independent_of_this_pull_request):\n(ResultsDatabase._rows_by_type.independent_of_this_changes_authors):\n(ResultsDatabase._is_intra_build_flake):\n(ResultsDatabase._is_inter_build_flake):\n(ResultsDatabase._parse_results_ews_response):\n(ResultsDatabase._query_flaky):\n(ResultsDatabase.flaky_verdicts_for):\n* Tools/CISupport/ews-build/steps.py:\n(ResultsDBReportMixin.results_db_details):\n(ResultsDBReportMixin.report_to_results_db):\n* Tools/CISupport/ews-build/steps_unittest.py:\n(BuildStepMixinAdditions.setup_test_build_step.record_report_ews):\n(TestReportToResultsDB.test_an_unreachable_results_database_does_not_fail_the_step.explode):\n(TestResultsDatabaseFailureHandling._mock_twisted_request):\n(TestResultsDatabaseFailureHandling.report_ews):\n(TestResultsDatabaseFailureHandling.test_report_ews_logs_the_request_without_the_api_key):\n\nCanonical link: https://commits.webkit.org/320412@main", "email": "issacroy05@gmail.com", "hash": "78f48dc7101088e81d3c32ca7d9b88f6d12276b5", "subject": "[EWS] EWS ResultsDB reading and writing should be typed" }, "320413@main": { "author": "Abrar Rahman Protyasha", "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64", "cl": "320413@main", "clUrl": "https://commits.webkit.org/320413@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323295\nrdar://186544840\n\nReviewed by Chris Dumez.\n\nWe introduced this method as part of the refractor in 236664@main, but\ncontinued sending WebPageProxy::HandleContextMenuTranslation messages\ndirectly from WebContextMenuClient. Let's drop the unused method in this\npatch.\n\nNo new tests since this patch does not introduce a behavior change.\n\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::handleContextMenuTranslation): Deleted.\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n\nCanonical link: https://commits.webkit.org/320413@main", "email": "a_protyasha@apple.com", "hash": "e0276b65b7c74133c89ea7e2817e12c9fac728e4", "subject": "WebPage::handleContextMenuTranslation() is an unused method" }, "320414@main": { "author": "Youenn Fablet", "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64", "cl": "320414@main", "clUrl": "https://commits.webkit.org/320414@main", "description": "rdar://186542248\nhttps://bugs.webkit.org/show_bug.cgi?id=323290\n\nReviewed by Anne van Kesteren.\n\nfetch/range/non-matching-range-response.html is using fetch/range/resources/video-with-range.py to serve media requests.\nThis server can in one case answer range requests with a 200 response, but the response body would only contain the bytes specified by the range request.\nThis is inconsistent as a server answering a range request with 200 should ignore the requested range.\n\nCocoa WebKit media engine is making a first request with a byte 0-1 range.\nA 200 response containing only two bytes is served and the media load fails as there is not enough data.\n\nWe fix this by changing the server so that, should it answers a range request with a 200 response, it provides the whole media content as the response body.\n\n* LayoutTests/imported/w3c/web-platform-tests/fetch/range/non-matching-range-response-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/fetch/range/resources/video-with-range.py:\n(main):\n\nCanonical link: https://commits.webkit.org/320414@main", "email": "youenn@apple.com", "hash": "d955a8125a72bbab7e59684882ea03078b0748d9", "subject": "WPT fetch/range/non-matching-range-response.html subtest is failing" }, "320415@main": { "author": "Tyler Wilcock", "avatar": "https://www.gravatar.com/avatar/9545082e6bed96158a9f52dac6e4b869?d=identicon\u0026s=64", "cl": "320415@main", "clUrl": "https://commits.webkit.org/320415@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323222\nrdar://186467868\n\nReviewed by Dominic Mazzoni.\n\nAXCoreObject::hierarchicalLevel() walks a tree item's ancestor chain and adds a\nlevel for each ancestor whose hasExplicitGroupRole() is true, so that\n\n \u003cul role=\"tree\"\u003e\n \u003cli role=\"presentation\"\u003e\n \u003cspan role=\"treeitem\"\u003eUsing Search\u003c/span\u003e\n \u003cul role=\"group\"\u003e\n \u003cli role=\"treeitem\"\u003ePower Search\u003c/li\u003e\n\nexposes AXDisclosureLevel 1 for \"Power Search\". With the isolated tree enabled it\nwas 0 instead.\n\nAn ARIA tree flattens to a list of rows, so the role=\"group\" container itself is\nignored. createIsolatedObjectData() cached AXProperty::HasExplicitGroupRole only\nunder needsAllProperties, which is false for ignored objects, so the property was\nnever stored and AXIsolatedObject::hasExplicitGroupRole() returned the default\nfalse for every group in the chain.\n\nCovered by accessibility/mac/aria-tree-with-presentation-role.html, which now\npasses with --accessibility-isolated-tree and continues to pass without it.\n\n* Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp:\n(WebCore::createIsolatedObjectData):\n\nCanonical link: https://commits.webkit.org/320415@main", "email": "tyler_w@apple.com", "hash": "80d2bac01f0d4e09500a3560531bfa35b12f390f", "subject": "AX: Tree items nested in an authored role=\"group\" report disclosure level 0 with the isolated tree enabled" }, "320416@main": { "author": "Pawel Lampe", "avatar": "https://www.gravatar.com/avatar/3c9bf19417c230eff7ade252118deb7a?d=identicon\u0026s=64", "cl": "320416@main", "clUrl": "https://commits.webkit.org/320416@main", "description": "Canonical link: https://commits.webkit.org/320416@main", "email": "plampe@igalia.com", "hash": "68330ad240227e8f5e043bc40e9fbad40e29e371", "subject": "Unreviewed tests gardening of 2026-09-03." }, "320417@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "320417@main", "clUrl": "https://commits.webkit.org/320417@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323064\nrdar://186327525\n\nReviewed by Antti Koivisto.\n\nIFC integration codepath builds that geometry out of FloatingObject::frameRect(), which is the margin box.\nHowever shape's coordinates are relative to the float's border box.\nAny margin on the float is dropped from the shape's position: the line is constrained as if the\nshape sat at the float's margin box origin.\n\nTests: imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/shape-outside-border-box-with-margin.html\n imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/shape-outside-padding-box-with-margin.html\n imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/shape-outside-content-box-with-margin.html\n imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/shape-outside-border-box-shape-margin-with-margin.html\n imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/shape-outside-border-box-with-margin-right-float.html\n imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/shape-outside-border-box-with-block-start-margin.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/reference/shape-outside-border-box-shape-margin-with-margin-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/reference/shape-outside-border-box-with-block-start-margin-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/reference/shape-outside-border-box-with-margin-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/reference/shape-outside-border-box-with-margin-right-float-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/reference/shape-outside-content-box-with-margin-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/reference/shape-outside-padding-box-with-margin-ref.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/shape-outside-border-box-shape-margin-with-margin-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/shape-outside-border-box-shape-margin-with-margin.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/shape-outside-border-box-with-block-start-margin-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/shape-outside-border-box-with-block-start-margin.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/shape-outside-border-box-with-margin-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/shape-outside-border-box-with-margin-right-float-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/shape-outside-border-box-with-margin-right-float.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/shape-outside-border-box-with-margin.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/shape-outside-content-box-with-margin-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/shape-outside-content-box-with-margin.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/shape-outside-padding-box-with-margin-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-shapes/shape-outside/shape-box/shape-outside-padding-box-with-margin.html: Added.\n* Source/WebCore/layout/integration/LayoutIntegrationFormattingContextLayout.cpp:\n(WebCore::LayoutIntegration::populateIFCWithNewlyPlacedFloats):\n* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:\n(WebCore::LayoutIntegration::LineLayout::preparePlacedFloats):\n\nCanonical link: https://commits.webkit.org/320417@main", "email": "zalan@apple.com", "hash": "aa065033bd3172ec763b8f31cd9b677af24b21fa", "subject": "`shape-outside` renders incorrectly when the float has margins" }, "320418@main": { "author": "Claudio Saavedra", "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64", "cl": "320418@main", "clUrl": "https://commits.webkit.org/320418@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323205\n\nReviewed by Carlos Garcia Campos.\n\n320287@main retuned this test's fuzzy tolerance for CoreGraphics, lowering\nthe pixel budget from upstream WPT's 256 to 198. On GTK the bevel clip and\nthe reference clip-path rasterize with different anti-aliasing paths in\nSkia's GPU backend, leaving an outline of about 240 pixels along the\ndiamond with a peak difference of 53, so the test fails on pixel count.\n\nRestore the upstream pixel budget and give the per-pixel bound the same\nheadroom sibling tests in this directory use.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-bevel-overflow.html:\n\nCanonical link: https://commits.webkit.org/320418@main", "email": "csaavedra@igalia.com", "hash": "936393de769a2dc2ecd9c3b1771b37f785797212", "subject": "[GTK] imported/w3c/web-platform-tests/css/css-borders/corner-shape/corner-shape-bevel-overflow.html is an image failure" }, "320419@main": { "author": "Zak Ridouh", "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64", "cl": "320419@main", "clUrl": "https://commits.webkit.org/320419@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=308061\nrdar://170558786\n\nReviewed by David Kilzer.\n\nAdd ASSERT_WITH_SECURITY_IMPLICATION(isInWebProcess()) to\nCloneDeserializer::deserialize() to ensure deserialization of\nSerializedScriptValue only happens in the WebContent process.\n\n* Source/WebCore/bindings/js/SerializedScriptValue.cpp:\n(WebCore::CloneDeserializer::deserialize):\n* Tools/TestWebKitAPI/Tests/WebCore/SerializedScriptValue.cpp:\n(TestWebKitAPI::TEST(WebCore, SerializedScriptValueDeserializeInWebProcess)):\n(TestWebKitAPI::TEST(WebCoreDeathTest, SerializedScriptValueDeserializeInNetworkProcess)):\n\nCanonical link: https://commits.webkit.org/320419@main", "email": "zakr@apple.com", "hash": "69afdfb845abf70ee69e6ed23d2e0c1105efb9f2", "subject": "CloneDeserializer should assert it is only used in the WebContent process" }, "320420@main": { "author": "Antti Koivisto", "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64", "cl": "320420@main", "clUrl": "https://commits.webkit.org/320420@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323198\nrdar://186467515\n\nReviewed by Alan Baradlay.\n\nView transition code likes to throw away the style resolver where (in RuleFeatureSet via\nScopeRuleSets) the attribute names mentioned in attr() functions were registered during style\nbuilding. We ended up forgetting the attributes and style invalidation stopped working correctly.\n\nStyle sheet mutations hit the same bug without throwing away the resolver, as collectFeatures()\nrebuilds RuleFeatureSet from the style sheets.\n\nFix by moving the map to Style::Scope. This cleans up code in general as RuleFeatureSet no longer\nneeds to be mutable.\n\nTests: imported/w3c/web-platform-tests/css/css-values/attr-invalidation-after-stylesheet-change.html\n imported/w3c/web-platform-tests/css/css-values/attr-invalidation-after-view-transition.html\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/attr-invalidation-after-stylesheet-change-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/attr-invalidation-after-stylesheet-change.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/attr-invalidation-after-view-transition-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-values/attr-invalidation-after-view-transition.html: Added.\n* Source/WebCore/style/AttributeChangeInvalidation.cpp:\n(WebCore::Style::AttributeChangeInvalidation::invalidateStyle):\n* Source/WebCore/style/RuleFeature.cpp:\n(WebCore::Style::RuleFeatureSet::add):\n(WebCore::Style::RuleFeatureSet::clear):\n(WebCore::Style::RuleFeatureSet::registerSubstitutionAttribute): Deleted.\n* Source/WebCore/style/RuleFeature.h:\n* Source/WebCore/style/StyleResolver.cpp:\n(WebCore::Style::Resolver::setGlobalStateAfterApplyingProperties):\n* Source/WebCore/style/StyleScope.cpp:\n(WebCore::Style::Scope::registerSubstitutionAttribute):\n* Source/WebCore/style/StyleScope.h:\n(WebCore::Style::Scope::substitutionAttribute const):\n* Source/WebCore/style/StyleScopeRuleSets.h:\n(WebCore::Style::ScopeRuleSets::mutableFeatures): Deleted.\n\nCanonical link: https://commits.webkit.org/320420@main", "email": "antti@apple.com", "hash": "aeb822d74e8b49ed54c57069f08e44afdb43b999", "subject": "[css-values-5] attr() stops invalidating on attribute change after a view transition" }, "320421@main": { "author": "Wenson Hsieh", "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64", "cl": "320421@main", "clUrl": "https://commits.webkit.org/320421@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323270\nrdar://186510338\n\nReviewed by Abrar Rahman Protyasha and Aditya Keerthi.\n\nOn some google.com subdomains, checkboxes and radio buttons are implemented in such a way where:\n\n- The actual `input` elements are hidden (`opacity: 0;`).\n- What (visually) looks like the checkbox or radio button is actually a plain SVG icon, hidden\n from the accessibility tree.\n\nAs a result, these elements are effectively hidden from the agent because the accessible elements\nare fully transparent, and the non-accessible elements are filtered out as noise.\n\nTo fix this, augment the extraction heuristic to detect when transparent form controls are overlaid\nover or under with sibling elements of the same size (similar to how we detect transparent controls\nwith visible labels in the DOM), and surface them anyways.\n\nTest: TextExtractionTests.ExtractTransparentCheckboxOverVisualProxy\n\n* Source/WebCore/page/text-extraction/TextExtraction.cpp:\n(WebCore::TextExtraction::paintsVisibleContent):\n(WebCore::TextExtraction::visualProxyForTransparentControl):\n(WebCore::TextExtraction::extractItemData):\n(WebCore::TextExtraction::extractRecursive):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:\n(TestWebKitAPI::ExtractTransparentCheckboxOverVisualProxy)):\n\nCanonical link: https://commits.webkit.org/320421@main", "email": "wenson_hsieh@apple.com", "hash": "4cc311091515165d384c55e063c66346d17fb4a6", "subject": "[Text Extraction] Some checkboxes on google.com are invisible to Safari MCP" }, "320422@main": { "author": "Carlos Garcia Campos", "avatar": "https://www.gravatar.com/avatar/8393f7e76d83c8a147cb852d8fb1a959?d=identicon\u0026s=64", "cl": "320422@main", "clUrl": "https://commits.webkit.org/320422@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323313\n\nReviewed by Adrian Perez de Castro.\n\nThis is because SkSurface::readPixels already takes into account the\nsurface origin to return the pixels y-flipped and then in the UI process\nwe end up flipping again. It's easier and more efficient to never y-flip\nfor SHM buffer and then only flip in the UI process for GBM mapped\nbuffers.\n\n* Source/WebKit/UIProcess/gtk/AcceleratedBackingStore.cpp:\n(WebKit::AcceleratedBackingStore::Buffer::paint const):\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/AcceleratedSurface.cpp:\n(WebKit::AcceleratedSurface::shouldPaintMirrored const):\n* Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/AcceleratedSurface.h:\n\nCanonical link: https://commits.webkit.org/320422@main", "email": "cgarcia@igalia.com", "hash": "87cb5697e63503e5334cb324ebeb333cc2af006c", "subject": "[GTK3] Skia compositor: contents are y-flipped when using SHM or GBM mapped buffers" }, "320423@main": { "author": "Zak Ridouh", "avatar": "https://www.gravatar.com/avatar/d9b65ef530b9cbbfc6dff1ca158faace?d=identicon\u0026s=64", "cl": "320423@main", "clUrl": "https://commits.webkit.org/320423@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322654\nrdar://185926481\n\nReviewed by David Kilzer.\n\nThe cocoa preset sets CCACHE_CONFIGPATH to Tools/ccache/ccache-webkit.conf, a\nfile that has never existed. It was added in 311103@main alongside a config\nthat did not land with it.\n\nCCACHE_CONFIGPATH replaces the per-user configuration rather than layering on\ntop of it, so a missing file falls back to ccache's built-in defaults instead\nof ~/Library/Preferences/ccache/ccache.conf. That drops max_size to 5 GiB. A\nWebKit build does not fit in 5 GiB, so the cache evicts about as fast as it\nfills -- on one affected machine, 15355 cleanups and a 10.88% hit rate over\n219047 lookups.\n\nDrop the setting so each developer's own ccache configuration applies.\nCCACHE_BASEDIR is left in place; it is valid and keeps hits portable across\ncheckouts.\n\n* CMakePresets.json:\n\nCanonical link: https://commits.webkit.org/320423@main", "email": "zakr@apple.com", "hash": "d41f8e83afcdedf5c3c02dd5e8856aa5ab8d61b7", "subject": "[CMake] Speed up warm builds by removing CCACHE_CONFIGPATH, which points at a file that was never added" }, "320424@main": { "author": "Tyler Wilcock", "avatar": "https://www.gravatar.com/avatar/9545082e6bed96158a9f52dac6e4b869?d=identicon\u0026s=64", "cl": "320424@main", "clUrl": "https://commits.webkit.org/320424@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323089\nrdar://186342070\n\nReviewed by Dominic Mazzoni.\n\naria-keyshortcuts values name keys using the platform-neutral UI Events\nKeyboardEvent key values, so a correctly-authored shortcut is written\n\"Meta+Shift+M\" or \"Alt+Shift+M\". We exposed those strings through\nAXKeyShortcutsValue untouched, and VoiceOver speaks the attribute verbatim,\nso it announced \"Meta Shift M\" for keys that Apple keyboards label Command\nand Option. No Mac keyboard has a key named Meta, so the announcement named\na key the user could not find.\n\nAdd AXCoreObject::keyShortcutsPlatformString(), which rewrites Meta to\nCommand and Alt to Option, and use it from the Mac and iOS wrappers.\n\n* LayoutTests/accessibility/aria-keyshortcuts-platform-modifier-names-expected.txt: Added.\n* LayoutTests/accessibility/aria-keyshortcuts-platform-modifier-names.html: Added.\n* Source/WebCore/accessibility/AXCoreObject.h:\n* Source/WebCore/accessibility/cocoa/AXCoreObjectCocoa.mm:\n(WebCore::platformNameForShortcutKey):\n(WebCore::AXCoreObject::keyShortcutsPlatformString const):\n* Source/WebCore/accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:\n(-[WebAccessibilityObjectWrapper accessibilityKeyboardShortcuts]):\n* Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm:\n(handleKeyShortcutsAttribute):\n\nCanonical link: https://commits.webkit.org/320424@main", "email": "tyler_w@apple.com", "hash": "4588e2f827d5f26549d89869f9865030fc3f660f", "subject": "VoiceOver announces aria-keyshortcuts Meta/Alt literally instead of Command/Option on macOS" }, "320425@main": { "author": "Jean-Yves Avenard", "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64", "cl": "320425@main", "clUrl": "https://commits.webkit.org/320425@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323206\nrdar://183164198\n\nReviewed by Jer Noble.\n\nSetting the duration became asynchronous once the MediaSourcePrivate was made\nto run in its own WorkQueue, so the UI process used the initial duration (NaN)\nto calculate the range and that set canSeek = NO for AVKit.\nFrom that point the calculated seekable range was stale and stayed empty.\n\nIf the UI process got the updated duration on time, then seekable range was\nupdated properly and canSeek was set to YES ; the controls showed.\n\nThe main point of failure was that the PlaybackSessionModelMediaElement\nlistened to the HTMLMediaElement's progressEvent update its seekable range\nand notify the UI process with the new range.\n\nSince moving the MediaPlayerPrivateMediaSourceAVFObjC to the web content process,\nwe do not fire the progress event anymore and so seekableRangesChanged was\nnever called and the cached seekable range in the UI process stayed stale.\n\nWe stop relying on the progress event, instead we add a new seekableRangesFromMediaSourceChanged()\ncallback where the MediaPlayerPrivate can notify the seekable range has changed\nand which in turns notifies the PlaybackSessionModelMediaElement via seekableRangesChanged().\n\nAdded API test and manually verified on device.\n\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::mediaPlayerSeekableTimeRangesChanged):\n(WebCore::HTMLMediaElement::addClient):\n(WebCore::HTMLMediaElement::seekableRangesChanged):\n* Source/WebCore/html/HTMLMediaElement.h:\n(WebCore::HTMLMediaElementClient::seekableRangesChanged):\n* Source/WebCore/platform/cocoa/PlaybackSessionModelMediaElement.h:\n* Source/WebCore/platform/cocoa/PlaybackSessionModelMediaElement.mm:\n(WebCore::PlaybackSessionModelMediaElement::setMediaElement):\n(WebCore::PlaybackSessionModelMediaElement::updateForEventName):\n(WebCore::PlaybackSessionModelMediaElement::addClient):\n(WebCore::PlaybackSessionModelMediaElement::seekableRangesChanged):\n(WebCore::PlaybackSessionModelMediaElement::updateSeekableRanges):\n* Source/WebCore/platform/graphics/MediaPlayerPrivate.h:\n(WebCore::MediaPlayerPrivateInterface::seekableRangesFromMediaSourceChanged):\n* Source/WebCore/platform/graphics/MediaSourcePrivate.cpp:\n(WebCore::MediaSourcePrivate::durationChanged):\n(WebCore::MediaSourcePrivate::bufferedChanged):\n(WebCore::MediaSourcePrivate::notifySeekableRangesChanged):\n(WebCore::MediaSourcePrivate::setLiveSeekableRange):\n(WebCore::MediaSourcePrivate::clearLiveSeekableRange):\n* Source/WebCore/platform/graphics/MediaSourcePrivate.h:\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:\n(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::seekableRangesFromMediaSourceChanged):\n* Source/WebCore/platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.cpp:\n(WebCore::MediaPlayerPrivateGStreamerMSE::seekableRangesFromMediaSourceChanged):\n* Source/WebCore/platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.h:\n* Source/WebCore/platform/mock/mediasource/MockMediaPlayerMediaSource.cpp:\n(WebCore::MockMediaPlayerMediaSource::seekableRangesFromMediaSourceChanged):\n* Source/WebCore/platform/mock/mediasource/MockMediaPlayerMediaSource.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewPrivateForTesting.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKWebViewTesting.mm:\n(-[WKWebView _maximumSeekableTime]):\n* Source/WebKit/UIProcess/Cocoa/PlaybackSessionManagerProxy.h:\n* Source/WebKit/UIProcess/Cocoa/PlaybackSessionManagerProxy.mm:\n(WebKit::PlaybackSessionManagerProxy::seekableRanges):\n* Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp:\n(WebKit::MediaPlayerPrivateRemote::updateCachedState):\n\nCanonical link: https://commits.webkit.org/320425@main", "email": "jya@apple.com", "hash": "7067ca63e9135059e8f2acd3f6e791a1c2e576c6", "subject": "[visionOS] Enter Exit Spatial Browsing switching videos leads to Greyed Out Playback UI" }, "320426@main": { "author": "Tyler Wilcock", "avatar": "https://www.gravatar.com/avatar/9545082e6bed96158a9f52dac6e4b869?d=identicon\u0026s=64", "cl": "320426@main", "clUrl": "https://commits.webkit.org/320426@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323274\nrdar://186529088\n\nReviewed by Chris Fleizach.\n\n\u003cul\u003e\u003cli id=\"item\"\u003eitem 1\u003c/li\u003e\u003c/ul\u003e\n\nThe text marker range covering that list item stringifies as \"\\u2022 item 1\" on the\nmain thread but as \"\\u2022item 1\" with the isolated tree enabled.\n\nAccessibilityRenderObject::textRuns() drops runs for generated content by asking\nshouldExcludeTextRunsForPseudoElement() about renderText-\u003eparent()'s pseudo type, and\nPseudoElementType::Marker is one of the types it excludes. That only inspects the\nimmediate parent, though, and a marker that needs renderers for its content does not\nparent them directly. RenderTreeBuilder::List::buildMarkerContentRenderers instead wraps them\nin an anonymous inline-block built with createAnonymousStyleWithDisplay, and that\nanonymous style carries no pseudo type. So the ::marker case never fires and the\nmarker's text becomes text runs of its own.\n\nWalk out of the element-less generated content in textRuns() and return no runs when a\nRenderListMarker is found.\n\nThis also fixes accessibility/mac/text-marker-range-selection-in-list-items.html.\n\n* LayoutTests/accessibility/isolated-tree/listmarker-suffix-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/listmarker-suffix.html: Added.\n* LayoutTests/accessibility/isolated-tree/mac/text-marker-range-selection-in-list-items-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/mac/text-marker-range-selection-in-list-items.html: Added.\n* Source/WebCore/accessibility/AccessibilityRenderObject.cpp:\n(WebCore::AccessibilityRenderObject::textRuns):\n\nCanonical link: https://commits.webkit.org/320426@main", "email": "tyler_w@apple.com", "hash": "5d59ee3a751171e60e7b4d09360241f202f86d02", "subject": "AX: In isolated tree mode, AXStringForTextMarkerRange drops the space after a bulleted list marker" }, "320427@main": { "author": "Mike Wyrzykowski", "avatar": "https://www.gravatar.com/avatar/4b1bc9e238714f95e22d5d2454c07066?d=identicon\u0026s=64", "cl": "320427@main", "clUrl": "https://commits.webkit.org/320427@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323225\nrdar://186470526\n\nReviewed by Dan Glastonbury.\n\nIn order to import video using the accelerated CVMetalTextureCache path,\nwe must ensure the video is already in the GPU process.\n\nTest: fast/webgpu/external-texture-from-webm-video-element.html\n\n* Source/WebCore/Modules/WebGPU/GPUDevice.cpp:\n(WebCore::GPUDevice::importExternalTexture):\n* Source/WebCore/Modules/WebGPU/GPUExternalTextureDescriptor.h:\n(WebCore::GPUExternalTextureDescriptor::mediaIdentifierForSource):\n(WebCore::GPUExternalTextureDescriptor::mediaIdentifier const):\n* Source/WebCore/platform/graphics/MediaPlayer.cpp:\n(WebCore::MediaPlayer::isHostedInGPUProcess const):\n* Source/WebCore/platform/graphics/MediaPlayer.h:\n\n* LayoutTests/fast/webgpu/external-texture-from-webm-video-element-expected.txt: Added.\n* LayoutTests/fast/webgpu/external-texture-from-webm-video-element.html: Added.\n\nCanonical link: https://commits.webkit.org/320427@main", "email": "mwyrzykowski@apple.com", "hash": "b3d7d6cdd798bcc0900041524247ee71706e6d05", "subject": "webgpu.github.io/webgpu-samples/?sample=videoUploading does not play Lake with videoSource = videoElement" }, "320428@main": { "author": "Alexey Proskuryakov", "avatar": "https://www.gravatar.com/avatar/c66a0fa7958ae738ab34d596994091a4?d=identicon\u0026s=64", "cl": "320428@main", "clUrl": "https://commits.webkit.org/320428@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=320504\nrdar://183468933\n\nReviewed by BJ Burg.\n\nWebDriver allows running commands in a browsing context that has not\ndone any loads yet, and WebAutomationSession::createBrowsingContext()\nexplicitly supports this. Such a context displays the initial empty\ndocument, which FrameLoader::init() creates with an empty URL rather\nthan \"about:blank\". WebCore papers over this for script:\nDocument::urlForBindings() substitutes aboutBlankURL() when the\ndocument URL is empty, which is why document.URL evaluates to\n\"about:blank\" in a blank window.\n\nPageLoadState::activeURL() has no such substitution, so the UI process\nsees an empty (and therefore invalid) URL for the same state. Three\nWebAutomationSession callers were not prepared for that.\ndeleteAllCookies() and addSingleCookie() both ASSERT(activeURL\n.isValid()), which terminates the UI process in debug builds when a\ncookie command is sent to a window that has never navigated.\nbuildBrowsingContextForPage() reports the empty URL string, so Get\nCurrent URL answers \"\" instead of \"about:blank\" for a newly opened\nwindow or tab.\n\nAdd a file-local activeOrInitialURL() helper that returns\naboutBlankURL() when PageLoadState::activeURL() is empty, and use it at\nthose three call sites. Checking for an empty URL rather than an\ninvalid one keeps the substitution limited to the initial empty\ndocument: a URL that is non-empty but failed to parse is still reported\nto the client verbatim.\n\nWebDriver surfaces URLs from other sources too - WebFrameProxy::url(),\nFrameInfoData::request, and WebPageProxy::currentURL() - and those have\nthe same empty-URL problem for the initial empty document. All of them\nare on WebDriver BiDi code paths (browsingContext.getTree, the\nbrowsingContext.context{Created,Destroyed} and navigation events)\nwhose tests are currently skipped or timing out for unrelated reasons,\nso fixing them is left for a follow-up.\n\nCovered by existing WPT tests, which now pass:\nclassic/delete_all_cookies/delete.py::test_null_response_value (was\ncrashing the UI process), classic/new_window/new_window.py::\ntest_opens_about_blank_in_new_window, and classic/new_window/new_tab.py::\ntest_opens_about_blank_in_new_tab.\n\n* Source/WebKit/UIProcess/Automation/WebAutomationSession.cpp:\n(WebKit::activeOrInitialURL): Added. Substitutes about:blank for an\nempty PageLoadState::activeURL(), matching Document::urlForBindings().\n(WebKit::WebAutomationSession::buildBrowsingContextForPage): Report\nabout:blank instead of the empty string for a context that has not\nnavigated.\n(WebKit::WebAutomationSession::addSingleCookie): Use the helper instead\nof asserting the active URL is valid.\n(WebKit::WebAutomationSession::deleteAllCookies): Ditto.\n\nCanonical link: https://commits.webkit.org/320428@main", "email": "ap@apple.com", "hash": "b5e89ab438e8916077a57d5a085f9a8ed86a9c35", "subject": "WebDriver doesn't have the correct URL in blank windows, causing assertion failure on some tests" }, "320429@main": { "author": "Kimmo Kinnunen", "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64", "cl": "320429@main", "clUrl": "https://commits.webkit.org/320429@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323202\nrdar://186439811\n\nReviewed by Mike Wyrzykowski.\n\nMake\n context-\u003edrawNativeImage(image,..., {InterpolationQuality::High});\nwork similarly to\n context-\u003edrawImageBuffer(buffer,..., {InterpolationQuality::High});\n\n* Source/WebCore/html/CustomPaintImage.cpp:\n(WebCore::CustomPaintImage::draw):\n* Source/WebCore/platform/graphics/CrossfadeGeneratedImage.cpp:\n(WebCore::CrossfadeGeneratedImage::draw):\n* Source/WebCore/platform/graphics/GraphicsContext.cpp:\n(WebCore::GraphicsContext::drawImage):\n(WebCore::GraphicsContext::drawTiledImage):\n(WebCore::GraphicsContext::drawImageBuffer):\n(WebCore::GraphicsContext::drawConsumingImageBuffer):\n* Source/WebCore/platform/graphics/GraphicsContext.h:\n(WebCore::GraphicsContext::imageInterpolationQualityForOptions const):\n* Source/WebCore/platform/graphics/cairo/CairoOperationRecorder.cpp:\n(WebCore::Cairo::OperationRecorder::drawNativeImage):\n* Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp:\n(WebCore::GraphicsContextCairo::drawNativeImage):\n(WebCore::GraphicsContextCairo::drawPattern):\n* Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp:\n(WebCore::GraphicsContextCG::drawNativeImage):\n(WebCore::GraphicsContextCG::drawPattern):\n* Source/WebCore/platform/graphics/cg/PDFDocumentImage.cpp:\n(WebCore::PDFDocumentImage::drawPDFDocument):\n* Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp:\n(WebCore::GraphicsContextSkia::drawNativeImage):\n(WebCore::GraphicsContextSkia::drawPattern):\n* Source/WebCore/rendering/svg/RenderSVGResourceMasker.cpp:\n(WebCore::RenderSVGResourceMasker::drawContentIntoContext):\n* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResourceMasker.cpp:\n(WebCore::LegacyRenderSVGResourceMasker::drawContentIntoContext):\n* Source/WebCore/svg/graphics/SVGImage.cpp:\n(WebCore::SVGImage::draw):\n\nCanonical link: https://commits.webkit.org/320429@main", "email": "kkinnunen@apple.com", "hash": "fe2dede2ab9d52022cc6dc47c3a67aacb50a4522", "subject": "GraphicsContext::drawNativeImage does not support InterpolationQuality option" }, "320430@main": { "author": "Elijah Sawyers", "avatar": "https://www.gravatar.com/avatar/4ebf94dc3e9f26bbcabb35f183712595?d=identicon\u0026s=64", "cl": "320430@main", "clUrl": "https://commits.webkit.org/320430@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=315367\nrdar://177727052\n\nReviewed by Timothy Hatcher and Kiara Rose.\n\nThis patch makes a Safari Web Extension's webRequest events fire for the initial main-frame\nnavigation of a tab or window created with browser.tabs.create or browser.windows.create.\n\nhasPermissionToSendWebRequestEvent required the extension to have host access to the tab's\ncommitted document URL. A newly created tab whose main-frame navigation has not committed yet\nhas no committed URL, so the check failed and every webRequest event for the initial load was\ndropped. Reloading or navigating from the address bar worked because the tab already had a\ncommitted URL by then.\n\nThe committed document is only the relevant page for subresource and subframe loads. For a\ntop-level navigation the request is the document itself, and it is already covered by the\nper-request host permission checks, so this patch skips the committed-document check for\nmain-frame navigations.\n\nThe test harness reports a tab's URL as its web view's URL, which during a navigation is the\nprovisional destination rather than the empty committed URL a new tab has, so it could not\nreproduce this on its own. TestWebExtensionTab gains an overrideURL so a test can report a\ndocument URL the extension cannot access.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIWebRequest.mm\n* Source/WebKit/UIProcess/Extensions/Cocoa/WebExtensionContextCocoa.mm:\n(WebKit::WebExtensionContext::hasPermissionToSendWebRequestEvent):\n* Tools/TestWebKitAPI/Helpers/cocoa/WebExtensionUtilities.h:\n* Tools/TestWebKitAPI/Helpers/cocoa/WebExtensionUtilities.mm:\n(-[TestWebExtensionTab urlForWebExtensionContext:]):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKWebExtensionAPIWebRequest.mm:\n(TestWebKitAPI::TEST(WKWebExtensionAPIWebRequest, WebRequestFiresForTabsCreate)):\n(TestWebKitAPI::TEST(WKWebExtensionAPIWebRequest, WebRequestFiresForWindowsCreate)):\n\nCanonical link: https://commits.webkit.org/320430@main", "email": "esawyers@apple.com", "hash": "7acdcf23cf0c0b6631a83a3a32911122766fe9a4", "subject": "webRequest events not firing with tabs.create" }, "320431@main": { "author": "Sam Weinig", "avatar": "https://www.gravatar.com/avatar/354b409240f9fb3357f498c547423d96?d=identicon\u0026s=64", "cl": "320431@main", "clUrl": "https://commits.webkit.org/320431@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323224\n\nReviewed by Antti Koivisto.\n\nPart 2 of https://bugs.webkit.org/show_bug.cgi?id=319263\n\nFontDescription and Style::ComputedStyleBase reference a font's \"specified size\",\nbut the value they currently associate with that is actually the CSS concept of a\ncomputed style size than a specified one.\n\nRather than using the \"computed\" prefix on Style::ComputedStyleBase, which would\nbe redundant, the bare name \"fontSize\" is used instead.\n\n* Source/WebCore/css/CSSProperties.json:\n* Source/WebCore/dom/Document.cpp:\n* Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp:\n* Source/WebCore/html/canvas/OffscreenCanvasRenderingContext2D.cpp:\n* Source/WebCore/page/DebugPageOverlays.cpp:\n* Source/WebCore/platform/graphics/FontCascadeDescription.cpp:\n* Source/WebCore/platform/graphics/FontCascadeDescription.h:\n* Source/WebCore/platform/graphics/ca/FrameProcessIndicators.cpp:\n* Source/WebCore/platform/graphics/ca/PlatformCALayer.mm:\n* Source/WebCore/platform/graphics/coretext/FontCascadeCoreText.cpp:\n* Source/WebCore/platform/mock/MockRealtimeVideoSource.cpp:\n* Source/WebCore/platform/win/cairo/DragImageWinCairo.cpp:\n* Source/WebCore/rendering/RenderBlockFlow.cpp:\n* Source/WebCore/rendering/RenderLayerBacking.cpp:\n* Source/WebCore/rendering/TextAutoSizing.cpp:\n* Source/WebCore/rendering/mac/RenderThemeMac.mm:\n* Source/WebCore/rendering/style/AutosizeStatus.cpp:\n* Source/WebCore/rendering/style/AutosizeStatus.h:\n* Source/WebCore/rendering/svg/RenderSVGInlineText.cpp:\n* Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp:\n* Source/WebCore/style/StyleAdjuster.cpp:\n* Source/WebCore/style/StyleBuilderCustom.h:\n* Source/WebCore/style/StyleBuilderState.cpp:\n* Source/WebCore/style/StyleBuilderStateInlines.h:\n* Source/WebCore/style/StyleFontSizeFunctions.cpp:\n* Source/WebCore/style/StyleFontSizeFunctions.h:\n* Source/WebCore/style/StyleInterpolationWrappers.h:\n* Source/WebCore/style/StyleResolveForDocument.cpp:\n* Source/WebCore/style/StyleResolveForFont.cpp:\n* Source/WebCore/style/StyleResolver.cpp:\n* Source/WebCore/style/computed/StyleComputedStyleProperties+GettersCustomInlines.h:\n* Source/WebCore/style/computed/StyleComputedStyleProperties+SettersCustomInlines.h:\n* Source/WebCore/style/values/inline/StyleLineHeight.cpp:\n* Source/WebCore/style/values/inline/StyleLineHeight.h:\n* Source/WebCore/style/values/primitives/StyleLengthResolution.cpp:\n\nCanonical link: https://commits.webkit.org/320431@main", "email": "sam@webkit.org", "hash": "294be00ae9b1bac3bea4e5dec163c24cf36973e6", "subject": "Replace references to a font's \"specifiedSize\" with \"computedSize\"" }, "320432@main": { "author": "Kimmo Kinnunen", "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64", "cl": "320432@main", "clUrl": "https://commits.webkit.org/320432@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322825\nrdar://186063938\n\nReviewed by Dan Glastonbury.\n\nObtain the CanvasRenderingContext image as NativeImage to prevent\nunneccessary draw to ImageBuffer.\n\n* Source/WebCore/inspector/InspectorCanvas.cpp:\n(WebCore::InspectorCanvas::getContentAsDataURL):\n\nCanonical link: https://commits.webkit.org/320432@main", "email": "kkinnunen@apple.com", "hash": "f5c1025dd51a6d2e0a35c976142eb792c770de26", "subject": "Use NativeImage in InspectorCanvas::getContentAsDataURL" }, "320433@main": { "author": "Elliott Williams", "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64", "cl": "320433@main", "clUrl": "https://commits.webkit.org/320433@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323194\nrdar://problem/186432709\n\nReviewed by Richard Robinson.\n\nThis matches what Xcode produces and what run-webkit-tests expects.\nTestWTF and TestWebKitAPI test executables are built, and the latter\ncontains tests for JavaScriptCore, WebCore, and WebKitLegacy.\n\n* Tools/TestWebKitAPI/CMakeLists.txt:\n* Tools/TestWebKitAPI/PlatformCocoa.cmake:\n\nCanonical link: https://commits.webkit.org/320433@main", "email": "emw@apple.com", "hash": "32342a3fda171b2ca917a285eb7c51d02a46de10", "subject": "[CMake] Merge Cocoa port's API test executables into TestWebKitAPI" }, "320434@main": { "author": "Sihui Liu", "avatar": "https://www.gravatar.com/avatar/fea095a2fb34b599fa6e7d581666903b?d=identicon\u0026s=64", "cl": "320434@main", "clUrl": "https://commits.webkit.org/320434@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323149\nrdar://186407140\n\nReviewed by Per Arne Vollan.\n\nWhen SiteIsolationSharedProcessEnabled is on, BrowsingContextGroup::addPage() only creates RemotePageProxys for pages\njoining per-site FrameProcesses in m_processMap, not for m_sharedProcess. A page that joins a group which already has a\nshared process (e.g. a same-site window.open() popup) never gets registered there, so a later WebPage::LoadRequest to a\nsite already hosted in the shared process targets a PageIdentifier with no registered receiver, and\nWebProcess::filterUnhandledMessage() silently drops it, hanging the page. Fixed addPage() to create a RemotePageProxy in\nthe shared process when a page joins.\n\nAlso, since RemotePageDrawingAreaProxy keys its message receiver by (page, process) rather than by site, only one\nRemotePageProxy can be created per (page, process); the existing code loops over every m_sharedProcessSites entry per\npage and creates duplicates, which would lead to crashes in MessageReceiverMap::addMessageReceiver. Fixed this by\nensuring to create one RemotePageProxy per (page, process). For RemotePageProxy in shared process, we use an arbitrary\nsite as a placeholder since RemotePageProxy::site() is meaningless under shared process mode (as multiple sites will be\nput in the same process and share the same remote page).\n\nThis patch also consolidated the pre-existing \"this process is the main frame process so don't need a remote page\" check\ninto createRemotePageIfNeeded() functions, so new call sites won't omit the check by mistake.\n\nTests: SiteIsolation.OpenerProcessSharing\n SiteIsolation.OpenerProcessSharingWithSharedProcess\n Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm\n\n* Source/WebKit/UIProcess/BrowsingContextGroup.cpp:\n(WebKit::BrowsingContextGroup::addPage):\n(WebKit::BrowsingContextGroup::addFrameProcessAndInjectPageContextIf):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TestWebKitAPI::TEST(SiteIsolation, OpenerProcessSharing)):\n(TestWebKitAPI::TEST(SiteIsolation, OpenerProcessSharingWithSharedProcess)):\n\nCanonical link: https://commits.webkit.org/320434@main", "email": "sihui_liu@apple.com", "hash": "b8e586fe8c3068f916f90de3e2ccd5e305af81fe", "subject": "[Site Isolation] New pages added to BrowsingContextGroup are not registered with shared process" }, "320435@main": { "author": "Kimmo Kinnunen", "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64", "cl": "320435@main", "clUrl": "https://commits.webkit.org/320435@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323315\nrdar://186561899\n\nReviewed by Sam Weinig and Mike Wyrzykowski.\n\nDestinationColorSpace started as a color space for ImageBuffers,\nwritable surfaces. Today, it is used for VideoFrames, PixelBufferFormat,\nNativeImage instances as a general purpose wrapper around\nPlatformColorSpace. It is not a \"destination color space\" for these\nobjects, since they are in arbitrary, possibly non-writable colors\nspace.\n\nRename WebCore::DestinationColorSpace to WebCore::ColorSpace to avoid\nfurther mixups.\n\n* LayoutTests/ipc/coreipc.js:\n* Source/JavaScriptCore/runtime/StructuredCloneTags.h:\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/Modules/WebGPU/GPUCompositorIntegration.cpp:\n(WebCore::GPUCompositorIntegration::recreateRenderBuffers const):\n* Source/WebCore/Modules/WebGPU/GPUCompositorIntegration.h:\n* Source/WebCore/Modules/WebGPU/GPUQueue.cpp:\n(WebCore::getImageBytesFromImageBuffer):\n* Source/WebCore/Modules/WebGPU/Implementation/WebGPUCompositorIntegrationImpl.cpp:\n(WebCore::WebGPU::CompositorIntegrationImpl::recreateRenderBuffers):\n* Source/WebCore/Modules/WebGPU/Implementation/WebGPUCompositorIntegrationImpl.h:\n* Source/WebCore/Modules/WebGPU/InternalAPI/WebGPUCompositorIntegration.h:\n* Source/WebCore/Modules/async-clipboard/ClipboardItemBindingsDataSource.cpp:\n(WebCore::ClipboardItemBindingsDataSource::ClipboardItemTypeLoader::sanitizeDataIfNeeded):\n* Source/WebCore/Modules/mediastream/ImageCapture.cpp:\n(WebCore::createImageBitmap):\n* Source/WebCore/Modules/model-element/ModelPlayer.cpp:\n(WebCore::ModelPlayer::snapshotCurrentFrame):\n* Source/WebCore/Modules/model-element/ModelPlayer.h:\n* Source/WebCore/Modules/system-preview/ARKitBadgeSystemImage.mm:\n(WebCore::ARKitBadgeSystemImage::draw const):\n* Source/WebCore/Modules/webcodecs/WebCodecsVideoFrame.cpp:\n(WebCore::WebCodecsVideoFrame::create):\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/WebCorePrefix.h:\n* Source/WebCore/accessibility/AccessibilityObject.cpp:\n(WebCore::AccessibilityObject::imageData const):\n* Source/WebCore/bindings/js/SerializedScriptValue.cpp:\n(WebCore::CloneSerializer::write):\n(WebCore::CloneDeserializer::read):\n(WebCore::CloneDeserializer::readImageBitmap):\n* Source/WebCore/dom/ViewTransition.cpp:\n* Source/WebCore/html/CanvasBase.cpp:\n(WebCore::CanvasBase::createTransparentBlackImageBuffer const):\n(WebCore::CanvasBase::copyNativeImage const):\n(WebCore::CanvasBase::createImageForNoiseInjection const):\n* Source/WebCore/html/HTMLCanvasElement.cpp:\n(WebCore::HTMLCanvasElement::toVideoFrame):\n* Source/WebCore/html/HTMLVideoElement.cpp:\n(WebCore::HTMLVideoElement::colorSpace const):\n(WebCore::HTMLVideoElement::createBufferForPainting const):\n* Source/WebCore/html/HTMLVideoElement.h:\n* Source/WebCore/html/ImageBitmap.cpp:\n(WebCore::ImageBitmap::create):\n(WebCore::ImageBitmap::createImageBuffer):\n(WebCore::ImageBitmap::createBlankImageBuffer):\n(WebCore::ImageBitmap::createCompletionHandler):\n* Source/WebCore/html/ImageBitmap.h:\n* Source/WebCore/html/ImageData.cpp:\n(WebCore::ImageData::byteArrayPixelBuffer const):\n(WebCore::ImageData::float16ArrayPixelBuffer const):\n* Source/WebCore/html/canvas/CanvasLayerContextSwitcher.cpp:\n(WebCore::CanvasLayerContextSwitcher::~CanvasLayerContextSwitcher):\n* Source/WebCore/html/canvas/CanvasRenderingContext.cpp:\n(WebCore::CanvasRenderingContext::colorSpace const):\n* Source/WebCore/html/canvas/CanvasRenderingContext.h:\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.cpp:\n(WebCore::CanvasRenderingContext2DBase::cacheImageDataIfPossible):\n(WebCore::CanvasRenderingContext2DBase::getImageData const):\n(WebCore::CanvasRenderingContext2DBase::colorSpace const):\n* Source/WebCore/html/canvas/CanvasRenderingContext2DBase.h:\n* Source/WebCore/html/canvas/GPUCanvasContextCocoa.h:\n* Source/WebCore/html/canvas/GPUCanvasContextCocoa.mm:\n(WebCore::toWebCoreColorSpace):\n(WebCore::GPUCanvasContextCocoa::colorSpace const):\n* Source/WebCore/html/canvas/ImageBitmapRenderingContext.cpp:\n(WebCore::ImageBitmapRenderingContext::transferToImageBuffer):\n(WebCore::ImageBitmapRenderingContext::surfaceBufferToImageBuffer):\n* Source/WebCore/html/canvas/PredefinedColorSpace.cpp:\n(WebCore::toColorSpace):\n(WebCore::toExtendedColorSpace):\n(WebCore::toPredefinedColorSpace):\n(WebCore::toDestinationColorSpace): Deleted.\n(WebCore::toExtendedDestinationColorSpace): Deleted.\n* Source/WebCore/html/canvas/PredefinedColorSpace.h:\n* Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp:\n(WebCore::WebGLRenderingContextBase::initializeContextState):\n(WebCore::createImageBufferForWebGLContextReads):\n(WebCore::WebGLRenderingContextBase::surfaceBufferToNativeImage):\n(WebCore::WebGLRenderingContextBase::drawingBufferToPixelBuffer):\n(WebCore::WebGLRenderingContextBase::setDrawingBufferColorSpace):\n(WebCore::WebGLRenderingContextBase::drawImageIntoBuffer):\n(WebCore::WebGLRenderingContextBase::videoFrameToNativeImage):\n(WebCore::WebGLRenderingContextBase::LRUImageBufferCache::imageBuffer):\n* Source/WebCore/html/canvas/WebGLRenderingContextBase.h:\n* Source/WebCore/html/shadow/MediaControlTextTrackContainerElement.cpp:\n(WebCore::MediaControlTextTrackContainerElement::createTextTrackRepresentationImage):\n* Source/WebCore/inspector/InspectorCanvas.cpp:\n(WebCore::InspectorCanvas::indexForData):\n* Source/WebCore/inspector/agents/InspectorLayerTreeAgent.cpp:\n(WebCore::InspectorLayerTreeAgent::requestContent):\n* Source/WebCore/inspector/agents/InspectorPageAgent.cpp:\n(WebCore::InspectorPageAgent::snapshotNode):\n(WebCore::InspectorPageAgent::snapshotRect):\n* Source/WebCore/inspector/agents/page/PageTimelineAgent.cpp:\n(WebCore::PageTimelineAgent::captureScreenshot):\n* Source/WebCore/page/Chrome.cpp:\n(WebCore::Chrome::createImageBuffer const):\n* Source/WebCore/page/Chrome.h:\n* Source/WebCore/page/ChromeClient.h:\n(WebCore::ChromeClient::createImageBuffer const):\n* Source/WebCore/page/ContextMenuController.cpp:\n(WebCore::prepareContextForQRCode):\n* Source/WebCore/page/ElementTargetingController.cpp:\n(WebCore::ElementTargetingController::snapshotIgnoringVisibilityAdjustment):\n* Source/WebCore/page/FrameConsoleClient.cpp:\n(WebCore::FrameConsoleClient::screenshot):\n* Source/WebCore/page/FrameSnapshotting.h:\n* Source/WebCore/page/PageColorSampler.cpp:\n(WebCore::sampleColor):\n(WebCore::PageColorSampler::colorsAreSimilar):\n(WebCore::PageColorSampler::predominantColor):\n* Source/WebCore/page/TextIndicator.cpp:\n(WebCore::snapshotOptionsForTextIndicatorOptions):\n(WebCore::takeSnapshots):\n* Source/WebCore/platform/DragImage.cpp:\n(WebCore::createDragImageForNode):\n(WebCore::createDragImageForSelection):\n(WebCore::createDragImageForRange):\n(WebCore::createDragImageForImage):\n* Source/WebCore/platform/GraphicsClient.h:\n* Source/WebCore/platform/PlatformScreen.h:\n* Source/WebCore/platform/ScreenProperties.h:\n* Source/WebCore/platform/graphics/BifurcatedGraphicsContext.cpp:\n(WebCore::BifurcatedGraphicsContext::colorSpace const):\n* Source/WebCore/platform/graphics/BifurcatedGraphicsContext.h:\n* Source/WebCore/platform/graphics/BitmapImage.h:\n* Source/WebCore/platform/graphics/BitmapImageDescriptor.cpp:\n(WebCore::BitmapImageDescriptor::colorSpace const):\n* Source/WebCore/platform/graphics/BitmapImageDescriptor.h:\n* Source/WebCore/platform/graphics/BitmapImageSource.cpp:\n(WebCore::BitmapImageSource::preTransformedNativeImageAtIndex):\n* Source/WebCore/platform/graphics/BitmapImageSource.h:\n* Source/WebCore/platform/graphics/CachedSubimage.cpp:\n(WebCore::CachedSubimage::create):\n(WebCore::CachedSubimage::createPixelated):\n* Source/WebCore/platform/graphics/Color.cpp:\n(WebCore::Color::toResolvedColorComponentsInColorSpace const):\n* Source/WebCore/platform/graphics/Color.h:\n* Source/WebCore/platform/graphics/ColorConversion.cpp:\n(WebCore::convertAndResolveColorComponents):\n* Source/WebCore/platform/graphics/ColorConversion.h:\n* Source/WebCore/platform/graphics/ColorSpace.cpp: Renamed from Source/WebCore/platform/graphics/DestinationColorSpace.cpp.\n(WebCore::knownColorSpace):\n(WebCore::ColorSpace::SRGB):\n(WebCore::ColorSpace::LinearSRGB):\n(WebCore::ColorSpace::DisplayP3):\n(WebCore::ColorSpace::ExtendedDisplayP3):\n(WebCore::ColorSpace::LinearDisplayP3):\n(WebCore::ColorSpace::ExtendedLinearDisplayP3):\n(WebCore::ColorSpace::ExtendedSRGB):\n(WebCore::ColorSpace::ExtendedLinearSRGB):\n(WebCore::ColorSpace::ExtendedRec2020):\n(WebCore::operator==):\n(WebCore::ColorSpace::asRGB const):\n(WebCore::ColorSpace::asExtended const):\n(WebCore::ColorSpace::supportsOutput const):\n(WebCore::ColorSpace::usesRGBColorModel const):\n(WebCore::ColorSpace::usesExtendedRange const):\n(WebCore::ColorSpace::usesITUR_2100TF const):\n(WebCore::operator\u003c\u003c):\n* Source/WebCore/platform/graphics/ColorSpace.h: Renamed from Source/WebCore/platform/graphics/DestinationColorSpace.h.\n(WebCore::ColorSpace::ColorSpace):\n(WebCore::ColorSpace::platformColorSpace const):\n(WebCore::ColorSpace::serializableColorSpace const):\n* Source/WebCore/platform/graphics/ContentsFormat.cpp:\n(WebCore::contentsFormatExtendedColorSpace):\n* Source/WebCore/platform/graphics/ContentsFormat.h:\n* Source/WebCore/platform/graphics/GainMap.h:\n* Source/WebCore/platform/graphics/Gradient.h:\n* Source/WebCore/platform/graphics/GraphicsContext.cpp:\n(WebCore::GraphicsContext::createImageBuffer const):\n(WebCore::GraphicsContext::createScaledImageBuffer const):\n(WebCore::GraphicsContext::createAlignedImageBuffer const):\n* Source/WebCore/platform/graphics/GraphicsContext.h:\n(WebCore::GraphicsContext::colorSpace const):\n(WebCore::GraphicsContext::createImageBuffer):\n(WebCore::GraphicsContext::createScaledImageBuffer):\n* Source/WebCore/platform/graphics/GraphicsContextGL.cpp:\n(WebCore::GraphicsContextGL::setDrawingBufferColorSpace):\n(WebCore::GraphicsContextGL::videoFrameToNativeImage):\n* Source/WebCore/platform/graphics/GraphicsContextGL.h:\n* Source/WebCore/platform/graphics/GraphicsContextSwitcher.cpp:\n(WebCore::GraphicsContextSwitcher::create):\n* Source/WebCore/platform/graphics/GraphicsContextSwitcher.h:\n* Source/WebCore/platform/graphics/Image.cpp:\n(WebCore::Image::nativeImage):\n(WebCore::Image::colorSpace):\n* Source/WebCore/platform/graphics/Image.h:\n* Source/WebCore/platform/graphics/ImageBuffer.cpp:\n(WebCore::ImageBuffer::create):\n(WebCore::ImageBuffer::transformToColorSpace):\n* Source/WebCore/platform/graphics/ImageBuffer.h:\n(WebCore::ImageBuffer::create):\n(WebCore::ImageBuffer::colorSpace const):\n* Source/WebCore/platform/graphics/ImageBufferAllocator.cpp:\n(WebCore::ImageBufferAllocator::createImageBuffer const):\n* Source/WebCore/platform/graphics/ImageBufferAllocator.h:\n* Source/WebCore/platform/graphics/ImageBufferBackend.h:\n(WebCore::ImageBufferBackend::transformToColorSpace):\n* Source/WebCore/platform/graphics/ImageBufferBackendParameters.h:\n* Source/WebCore/platform/graphics/ImageBufferContextSwitcher.cpp:\n(WebCore::ImageBufferContextSwitcher::ImageBufferContextSwitcher):\n(WebCore::ImageBufferContextSwitcher::endClipAndDrawSourceImage):\n(WebCore::ImageBufferContextSwitcher::endDrawSourceImage):\n* Source/WebCore/platform/graphics/ImageBufferContextSwitcher.h:\n* Source/WebCore/platform/graphics/ImageBufferDisplayListBackend.cpp:\n(WebCore::ImageBufferDisplayListBackend::create):\n(WebCore::ImageBufferDisplayListBackend::copyNativeImage):\n(WebCore::ImageBufferDisplayListBackend::sinkIntoPDFDocument):\n* Source/WebCore/platform/graphics/ImageBufferDisplayListBackend.h:\n* Source/WebCore/platform/graphics/ImageSource.h:\n* Source/WebCore/platform/graphics/ImageUtilities.cpp:\n(WebCore::encodeData):\n* Source/WebCore/platform/graphics/MediaPlayer.cpp:\n(WebCore::MediaPlayer::colorSpace):\n* Source/WebCore/platform/graphics/MediaPlayer.h:\n* Source/WebCore/platform/graphics/MediaPlayerPrivate.h:\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.h:\n* Source/WebCore/platform/graphics/NativeImage.cpp:\n(WebCore::NativeImage::rotatedImage):\n* Source/WebCore/platform/graphics/NativeImage.h:\n* Source/WebCore/platform/graphics/NativeImageSource.h:\n* Source/WebCore/platform/graphics/PixelBufferConversion.cpp:\n* Source/WebCore/platform/graphics/PixelBufferFormat.h:\n* Source/WebCore/platform/graphics/ShadowBlur.cpp:\n(WebCore::ShadowBlur::drawRectShadowWithoutTiling):\n(WebCore::ShadowBlur::drawInsetShadowWithoutTiling):\n(WebCore::ShadowBlur::drawRectShadowWithTiling):\n(WebCore::ShadowBlur::drawInsetShadowWithTiling):\n(WebCore::ShadowBlur::blurShadowBuffer):\n(WebCore::ShadowBlur::drawShadowLayer):\n* Source/WebCore/platform/graphics/ShareableBitmap.cpp:\n(WebCore::ShareableBitmapConfiguration::ShareableBitmapConfiguration):\n(WebCore::ShareableBitmapConfiguration::calculateSizeInBytes):\n(WebCore::ShareableBitmap::createFromImageDraw):\n* Source/WebCore/platform/graphics/ShareableBitmap.h:\n(WebCore::ShareableBitmapConfiguration::colorSpace const):\n(WebCore::ShareableBitmap::colorSpace const):\n* Source/WebCore/platform/graphics/SourceImage.cpp:\n(WebCore::SourceImage::imageBuffer const):\n* Source/WebCore/platform/graphics/TransparencyLayerContextSwitcher.cpp:\n(WebCore::TransparencyLayerContextSwitcher::endDrawSourceImage):\n* Source/WebCore/platform/graphics/TransparencyLayerContextSwitcher.h:\n* Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.cpp:\n(WebCore::GraphicsContextGLANGLE::readPixelsForPaintResults):\n* Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:\n(WebCore::MediaPlayerPrivateAVFoundationObjC::colorSpace):\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:\n(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::colorSpace):\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.h:\n* Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:\n(WebCore::MediaPlayerPrivateMediaStreamAVFObjC::colorSpace):\n* Source/WebCore/platform/graphics/cairo/ImageBufferCairoBackend.cpp:\n(WebCore::ImageBufferCairoBackend::transformToColorSpace):\n* Source/WebCore/platform/graphics/cairo/ImageBufferCairoBackend.h:\n* Source/WebCore/platform/graphics/cairo/NativeImageCairo.cpp:\n(WebCore::NativeImage::colorSpace const):\n* Source/WebCore/platform/graphics/cairo/ShareableBitmapCairo.cpp:\n(WebCore::ShareableBitmapConfiguration::validateColorSpace):\n(WebCore::ShareableBitmapConfiguration::calculateBitsPerComponent):\n(WebCore::ShareableBitmapConfiguration::calculateBytesPerPixel):\n(WebCore::ShareableBitmapConfiguration::calculateBytesPerRow):\n* Source/WebCore/platform/graphics/cg/ColorCG.cpp:\n(WTF::RetainPtr\u003cCGColorRef\u003e\u003e::createValueForKey):\n(WebCore::createCGColorInDestinationStandardRange):\n(WebCore::cachedCGColorInDestinationStandardRange):\n(WebCore::platformConvertColorComponents):\n* Source/WebCore/platform/graphics/cg/GradientCG.cpp:\n(WebCore::nonLinearColorSpace):\n(WebCore::Gradient::paint):\n(WebCore::nonLinearDestinationColorSpace): Deleted.\n* Source/WebCore/platform/graphics/cg/GradientRendererCG.cpp:\n(WebCore::GradientRendererCG::GradientRendererCG):\n(WebCore::GradientRendererCG::createGradientBySampling):\n* Source/WebCore/platform/graphics/cg/GradientRendererCG.h:\n(WebCore::GradientRendererCG::GradientRendererCG):\n(WebCore::GradientRendererCG::colorSpace const):\n(WebCore::GradientRendererCG::createGradientBySampling):\n* Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp:\n(WebCore::setCGFillColor):\n(WebCore::GraphicsContextCG::colorSpace const):\n* Source/WebCore/platform/graphics/cg/GraphicsContextCG.h:\n* Source/WebCore/platform/graphics/cg/IOSurfacePool.cpp:\n(WebCore::surfaceMatchesParameters):\n(WebCore::IOSurfacePool::takeSurface):\n* Source/WebCore/platform/graphics/cg/IOSurfacePool.h:\n* Source/WebCore/platform/graphics/cg/ImageDecoderCG.cpp:\n(WebCore::ImageDecoderCG::frameGainMapAtIndex):\n* Source/WebCore/platform/graphics/cg/ImageUtilitiesCG.cpp:\n(WebCore::createBitmapsFromNativeImage):\n(WebCore::createNativeImageFromSVGImage):\n(WebCore::createBitmapsFromSVGImage):\n(WebCore::decodeImageWithSize):\n* Source/WebCore/platform/graphics/cg/NativeImageCG.cpp:\n(WebCore::NativeImage::colorSpace const):\n* Source/WebCore/platform/graphics/cg/ShareableBitmapCG.mm:\n(WebCore::ShareableBitmapConfiguration::validateColorSpace):\n(WebCore::ShareableBitmapConfiguration::calculateBitsPerComponent):\n(WebCore::ShareableBitmapConfiguration::calculateBytesPerPixel):\n(WebCore::ShareableBitmapConfiguration::calculateBytesPerRow):\n* Source/WebCore/platform/graphics/cocoa/GraphicsContextCocoa.mm:\n(WebCore::GraphicsContext::drawMultiRepresentationHEIC):\n* Source/WebCore/platform/graphics/cocoa/GraphicsContextGLCocoa.h:\n* Source/WebCore/platform/graphics/cocoa/GraphicsContextGLCocoa.mm:\n(WebCore::GraphicsContextGLCocoa::GraphicsContextGLCocoa):\n(WebCore::GraphicsContextGLCocoa::setDrawingBufferColorSpace):\n* Source/WebCore/platform/graphics/cocoa/IOSurface.h:\n* Source/WebCore/platform/graphics/cocoa/IOSurface.mm:\n(WebCore::IOSurface::create):\n(WebCore::IOSurface::createFromSurface):\n(WebCore::IOSurface::createFromImage):\n(WebCore::IOSurface::IOSurface):\n(WebCore::IOSurface::colorSpace):\n(WebCore::IOSurface::ensureColorSpace):\n(WebCore::IOSurface::surfaceColorSpace const):\n* Source/WebCore/platform/graphics/cocoa/MediaPlayerPrivateWebM.h:\n* Source/WebCore/platform/graphics/cocoa/MediaPlayerPrivateWebM.mm:\n(WebCore::MediaPlayerPrivateWebM::colorSpace):\n* Source/WebCore/platform/graphics/cocoa/ShareableGainMap.cpp:\n(WebCore::ShareableGainMap::create):\n(WebCore::ShareableGainMap::ShareableGainMap):\n* Source/WebCore/platform/graphics/cocoa/ShareableGainMap.h:\n* Source/WebCore/platform/graphics/coreimage/FEDropShadowCoreImageApplier.mm:\n(WebCore::FEDropShadowCoreImageApplier::apply const):\n* Source/WebCore/platform/graphics/coreimage/FEFloodCoreImageApplier.mm:\n(WebCore::FEFloodCoreImageApplier::apply const):\n* Source/WebCore/platform/graphics/coreimage/FilterImageCoreImage.mm:\n(WebCore::FilterImage::filterResultImageBuffer):\n* Source/WebCore/platform/graphics/displaylists/DisplayListRecorder.cpp:\n(WebCore::DisplayList::Recorder::Recorder):\n* Source/WebCore/platform/graphics/displaylists/DisplayListRecorder.h:\n(WebCore::DisplayList::Recorder::Recorder):\n* Source/WebCore/platform/graphics/displaylists/DisplayListRecorderImpl.cpp:\n(WebCore::DisplayList::RecorderImpl::RecorderImpl):\n* Source/WebCore/platform/graphics/displaylists/DisplayListRecorderImpl.h:\n(WebCore::DisplayList::RecorderImpl::RecorderImpl):\n* Source/WebCore/platform/graphics/egl/BitmapTexture.cpp:\n(WebCore::BitmapTexture::updateContents):\n* Source/WebCore/platform/graphics/filters/FEBlend.cpp:\n(WebCore::FEBlend::create):\n(WebCore::FEBlend::FEBlend):\n* Source/WebCore/platform/graphics/filters/FEBlend.h:\n* Source/WebCore/platform/graphics/filters/FEColorMatrix.cpp:\n(WebCore::FEColorMatrix::create):\n(WebCore::FEColorMatrix::FEColorMatrix):\n* Source/WebCore/platform/graphics/filters/FEColorMatrix.h:\n* Source/WebCore/platform/graphics/filters/FEComponentTransfer.cpp:\n(WebCore::FEComponentTransfer::create):\n(WebCore::FEComponentTransfer::FEComponentTransfer):\n* Source/WebCore/platform/graphics/filters/FEComponentTransfer.h:\n* Source/WebCore/platform/graphics/filters/FEComposite.cpp:\n(WebCore::FEComposite::create):\n(WebCore::FEComposite::FEComposite):\n* Source/WebCore/platform/graphics/filters/FEComposite.h:\n* Source/WebCore/platform/graphics/filters/FEConvolveMatrix.cpp:\n(WebCore::FEConvolveMatrix::create):\n(WebCore::FEConvolveMatrix::FEConvolveMatrix):\n* Source/WebCore/platform/graphics/filters/FEConvolveMatrix.h:\n* Source/WebCore/platform/graphics/filters/FEDiffuseLighting.cpp:\n(WebCore::FEDiffuseLighting::create):\n(WebCore::FEDiffuseLighting::FEDiffuseLighting):\n* Source/WebCore/platform/graphics/filters/FEDiffuseLighting.h:\n* Source/WebCore/platform/graphics/filters/FEDisplacementMap.cpp:\n(WebCore::FEDisplacementMap::create):\n(WebCore::FEDisplacementMap::FEDisplacementMap):\n(WebCore::FEDisplacementMap::resultColorSpace const):\n* Source/WebCore/platform/graphics/filters/FEDisplacementMap.h:\n* Source/WebCore/platform/graphics/filters/FEDropShadow.cpp:\n(WebCore::FEDropShadow::create):\n(WebCore::FEDropShadow::FEDropShadow):\n* Source/WebCore/platform/graphics/filters/FEDropShadow.h:\n* Source/WebCore/platform/graphics/filters/FEFlood.cpp:\n(WebCore::FEFlood::create):\n(WebCore::FEFlood::FEFlood):\n* Source/WebCore/platform/graphics/filters/FEFlood.h:\n* Source/WebCore/platform/graphics/filters/FEGaussianBlur.cpp:\n(WebCore::FEGaussianBlur::create):\n(WebCore::FEGaussianBlur::FEGaussianBlur):\n* Source/WebCore/platform/graphics/filters/FEGaussianBlur.h:\n* Source/WebCore/platform/graphics/filters/FEImage.h:\n* Source/WebCore/platform/graphics/filters/FELighting.cpp:\n(WebCore::FELighting::FELighting):\n* Source/WebCore/platform/graphics/filters/FELighting.h:\n* Source/WebCore/platform/graphics/filters/FEMerge.cpp:\n(WebCore::FEMerge::create):\n(WebCore::FEMerge::FEMerge):\n* Source/WebCore/platform/graphics/filters/FEMerge.h:\n* Source/WebCore/platform/graphics/filters/FEMorphology.cpp:\n(WebCore::FEMorphology::create):\n(WebCore::FEMorphology::FEMorphology):\n* Source/WebCore/platform/graphics/filters/FEMorphology.h:\n* Source/WebCore/platform/graphics/filters/FEOffset.cpp:\n(WebCore::FEOffset::create):\n(WebCore::FEOffset::FEOffset):\n* Source/WebCore/platform/graphics/filters/FEOffset.h:\n* Source/WebCore/platform/graphics/filters/FESpecularLighting.cpp:\n(WebCore::FESpecularLighting::create):\n(WebCore::FESpecularLighting::FESpecularLighting):\n* Source/WebCore/platform/graphics/filters/FESpecularLighting.h:\n* Source/WebCore/platform/graphics/filters/FETile.cpp:\n(WebCore::FETile::create):\n(WebCore::FETile::FETile):\n* Source/WebCore/platform/graphics/filters/FETile.h:\n* Source/WebCore/platform/graphics/filters/FETurbulence.cpp:\n(WebCore::FETurbulence::create):\n(WebCore::FETurbulence::FETurbulence):\n* Source/WebCore/platform/graphics/filters/FETurbulence.h:\n* Source/WebCore/platform/graphics/filters/Filter.cpp:\n(WebCore::Filter::apply):\n* Source/WebCore/platform/graphics/filters/FilterEffect.cpp:\n(WebCore::FilterEffect::FilterEffect):\n* Source/WebCore/platform/graphics/filters/FilterEffect.h:\n(WebCore::FilterEffect::setOperatingColorSpace):\n(WebCore::FilterEffect::resultColorSpace const):\n* Source/WebCore/platform/graphics/filters/FilterImage.cpp:\n(WebCore::FilterImage::create):\n(WebCore::FilterImage::FilterImage):\n(WebCore::getConvertedPixelBuffer):\n(WebCore::FilterImage::requiresPixelBufferColorSpaceConversion const):\n(WebCore::FilterImage::getPixelBuffer):\n(WebCore::FilterImage::transformToColorSpace):\n* Source/WebCore/platform/graphics/filters/FilterImage.h:\n* Source/WebCore/platform/graphics/filters/SourceAlpha.cpp:\n(WebCore::SourceAlpha::create):\n(WebCore::SourceAlpha::SourceAlpha):\n* Source/WebCore/platform/graphics/filters/SourceAlpha.h:\n* Source/WebCore/platform/graphics/filters/SourceGraphic.cpp:\n(WebCore::SourceGraphic::create):\n(WebCore::SourceGraphic::SourceGraphic):\n* Source/WebCore/platform/graphics/filters/SourceGraphic.h:\n* Source/WebCore/platform/graphics/filters/software/FELightingSoftwareApplier.h:\n* Source/WebCore/platform/graphics/filters/software/FETileSoftwareApplier.cpp:\n(WebCore::FETileSoftwareApplier::apply const):\n* Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:\n(WebCore::MediaPlayerPrivateGStreamer::colorSpace):\n* Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:\n* Source/WebCore/platform/graphics/holepunch/MediaPlayerPrivateHolePunch.h:\n* Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp:\n(WebCore::GraphicsContextSkia::GraphicsContextSkia):\n(WebCore::GraphicsContextSkia::colorSpace const):\n* Source/WebCore/platform/graphics/skia/GraphicsContextSkia.h:\n* Source/WebCore/platform/graphics/skia/NativeImageSkia.cpp:\n(WebCore::NativeImage::colorSpace const):\n* Source/WebCore/platform/graphics/skia/ShareableBitmapSkia.cpp:\n(WebCore::ShareableBitmapConfiguration::validateColorSpace):\n(WebCore::ShareableBitmapConfiguration::calculateBitsPerComponent):\n(WebCore::ShareableBitmapConfiguration::calculateBytesPerPixel):\n(WebCore::ShareableBitmapConfiguration::calculateBytesPerRow):\n* Source/WebCore/platform/graphics/skia/SkiaSerializedImageBuffer.h:\n* Source/WebCore/platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:\n(WebCore::MediaPlayerPrivateMediaFoundation::colorSpace):\n* Source/WebCore/platform/graphics/win/MediaPlayerPrivateMediaFoundation.h:\n* Source/WebCore/platform/gtk/PlatformScreenGtk.cpp:\n(WebCore::screenColorSpace):\n* Source/WebCore/platform/image-decoders/jpegxl/JPEGXLImageDecoder.cpp:\n(WebCore::JPEGXLImageDecoder::maybePerformColorSpaceConversion):\n* Source/WebCore/platform/ios/DragImageIOS.mm:\n(WebCore::createDragImageFromImage):\n* Source/WebCore/platform/ios/PlatformScreenIOS.mm:\n(WebCore::screenColorSpace):\n* Source/WebCore/platform/mac/DataDetectorHighlight.mm:\n(WebCore::DataDetectorHighlight::paintContents):\n* Source/WebCore/platform/mac/PlatformScreenMac.mm:\n(WebCore::collectScreenPropertiesExceptForHDRState):\n(WebCore::screenColorSpace):\n* Source/WebCore/platform/mac/ScrollbarThemeMac.mm:\n(WebCore::ScrollbarThemeMac::paint):\n* Source/WebCore/platform/mediastream/gstreamer/MockRealtimeVideoSourceGStreamer.cpp:\n(WebCore::MockRealtimeVideoSourceGStreamer::updateSampleBuffer):\n* Source/WebCore/platform/mock/MockRealtimeVideoSource.cpp:\n(WebCore::MockRealtimeVideoSource::imageBufferInternal):\n* Source/WebCore/platform/mock/mediasource/MockMediaPlayerMediaSource.cpp:\n(WebCore::MockMediaPlayerMediaSource::colorSpace):\n* Source/WebCore/platform/mock/mediasource/MockMediaPlayerMediaSource.h:\n* Source/WebCore/platform/playstation/PlatformScreenPlayStation.cpp:\n(WebCore::screenColorSpace):\n* Source/WebCore/platform/win/PlatformScreenWin.cpp:\n(WebCore::screenColorSpace):\n* Source/WebCore/platform/wpe/PlatformScreenWPE.cpp:\n(WebCore::screenColorSpace):\n* Source/WebCore/platform/xr/PlatformXR.h:\n* Source/WebCore/rendering/RenderLayerFilters.cpp:\n(WebCore::RenderLayerFilters::beginFilterEffect):\n(WebCore::RenderLayerFilters::applyFilterEffect):\n* Source/WebCore/rendering/shapes/LayoutShape.cpp:\n(WebCore::LayoutShape::createRasterShape):\n* Source/WebCore/rendering/svg/RenderSVGResourceMasker.cpp:\n(WebCore::createImageBuffer):\n(WebCore::RenderSVGResourceMasker::applyMask):\n* Source/WebCore/rendering/svg/RenderSVGResourcePattern.cpp:\n(WebCore::RenderSVGResourcePattern::createTileImage const):\n* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResourceClipper.cpp:\n(WebCore::LegacyRenderSVGResourceClipper::applyClippingToContext):\n* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResourceFilter.cpp:\n(WebCore::LegacyRenderSVGResourceFilter::applyResource):\n(WebCore::LegacyRenderSVGResourceFilter::postApplyResource):\n* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResourceMasker.cpp:\n(WebCore::LegacyRenderSVGResourceMasker::applyResource):\n(WebCore::LegacyRenderSVGResourceMasker::drawContentIntoMaskImage):\n* Source/WebCore/rendering/svg/legacy/LegacyRenderSVGResourceMasker.h:\n* Source/WebCore/style/values/images/kinds/StyleFilterImage.cpp:\n(WebCore::Style::FilterImage::image const):\n* Source/WebCore/svg/graphics/SVGImage.cpp:\n(WebCore::SVGImage::nativeImage):\n* Source/WebCore/svg/graphics/SVGImage.h:\n* Source/WebCore/svg/graphics/filters/SVGFilterRenderer.cpp:\n(WebCore::buildFilterEffectGraph):\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::snapshotNode):\n(WebCore::Internals::getEffectiveRenderingModeOfNewlyCreatedAcceleratedImageBuffer):\n* Source/WebCore/testing/ServiceWorkerInternals.cpp:\n(WebCore::ServiceWorkerInternals::effectiveRenderingModeOfNewlyCreatedAcceleratedCanvasBuffer):\n* Source/WebCore/workers/WorkerConsoleClient.cpp:\n(WebCore::WorkerConsoleClient::screenshot):\n* Source/WebKit/GPUProcess/graphics/ImageBufferShareableAllocator.cpp:\n(WebKit::ImageBufferShareableAllocator::createImageBuffer const):\n* Source/WebKit/GPUProcess/graphics/ImageBufferShareableAllocator.h:\n* Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGL.cpp:\n(WebKit::RemoteGraphicsContextGL::setDrawingBufferColorSpace):\n* Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGL.h:\n* Source/WebKit/GPUProcess/graphics/RemoteGraphicsContextGL.messages.in:\n* Source/WebKit/GPUProcess/graphics/RemoteImageBuffer.cpp:\n(WebKit::RemoteImageBuffer::transformToColorSpace):\n* Source/WebKit/GPUProcess/graphics/RemoteImageBuffer.h:\n* Source/WebKit/GPUProcess/graphics/RemoteImageBuffer.messages.in:\n* Source/WebKit/GPUProcess/graphics/RemoteImageBufferSet.cpp:\n(WebKit::RemoteImageBufferSet::ensureBufferForDisplay):\n* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp:\n(WebKit::allocateImageBufferInternal):\n(WebKit::RemoteRenderingBackend::allocateImageBuffer):\n(WebKit::RemoteRenderingBackend::createImageBuffer):\n(WebKit::RemoteRenderingBackend::nativeImageBitmap):\n* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.h:\n* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.messages.in:\n* Source/WebKit/GPUProcess/graphics/RemoteSnapshot.cpp:\n(WebKit::RemoteSnapshot::drawToPDF):\n(WebKit::RemoteSnapshot::drawToBitmap):\n* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteCompositorIntegration.cpp:\n(WebKit::RemoteCompositorIntegration::recreateRenderBuffers):\n* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteCompositorIntegration.h:\n* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteCompositorIntegration.messages.in:\n* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteGPU.cpp:\n(WebKit::RemoteGPU::createRenderBuffers):\n* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteXRProjectionLayer.h:\n* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteXRSubImage.h:\n* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteXRView.h:\n* Source/WebKit/GPUProcess/media/RemoteImageDecoderAVFProxy.h:\n* Source/WebKit/GPUProcess/media/RemoteMediaPlayerProxy.h:\n* Source/WebKit/GPUProcess/media/RemoteMediaPlayerProxy.messages.in:\n* Source/WebKit/GPUProcess/media/RemoteVideoFrameObjectHeap.cpp:\n(WebKit::RemoteVideoFrameObjectHeap::convertFrameBuffer):\n* Source/WebKit/GPUProcess/media/RemoteVideoFrameObjectHeap.h:\n* Source/WebKit/GPUProcess/media/RemoteVideoFrameObjectHeap.messages.in:\n* Source/WebKit/GPUProcess/media/cocoa/RemoteMediaPlayerProxyCocoa.mm:\n(WebKit::RemoteMediaPlayerProxy::nativeImageForCurrentTime):\n(WebKit::RemoteMediaPlayerProxy::colorSpace):\n* Source/WebKit/Scripts/webkit/messages.py:\n(types_that_cannot_be_forward_declared):\n* Source/WebKit/Shared/API/c/WKImage.cpp:\n(WKImageCreate):\n* Source/WebKit/Shared/API/c/cairo/WKImageCairo.cpp:\n(WKImageCreateFromCairoSurface):\n* Source/WebKit/Shared/API/c/cg/WKImageCG.cpp:\n(WKImageCreateFromCGImage):\n* Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStore.h:\n(WebKit::RemoteLayerBackingStore::colorSpace const):\n* Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTreePropertyApplier.mm:\n(WebKit::RemoteLayerTreePropertyApplier::applyPropertiesToLayer):\n* Source/WebKit/Shared/RemoteLayerTree/RemoteLayerWithInProcessRenderingBackingStore.mm:\n(WebKit::allocateBufferInternal):\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Source/WebKit/Shared/WebImage.cpp:\n(WebKit::WebImage::create):\n* Source/WebKit/Shared/WebImage.h:\n* Source/WebKit/Shared/WebPageCreationParameters.h:\n* Source/WebKit/Shared/WebPageCreationParameters.serialization.in:\n* Source/WebKit/Shared/graphics/RemoteImageBufferSetConfiguration.h:\n* Source/WebKit/Shared/graphics/RemoteImageBufferSetConfiguration.serialization.in:\n* Source/WebKit/UIProcess/API/ios/WKWebViewIOS.mm:\n(-[WKWebView _takeViewSnapshot]):\n(-[WKWebView _snapshotRectAfterScreenUpdates:rectInViewCoordinates:intoImageOfWidth:completionHandler:]):\n* Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm:\n(WebKit::WebPageProxy::colorSpace const):\n* Source/WebKit/UIProcess/PageClient.h:\n* Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeHost.mm:\n* Source/WebKit/UIProcess/WebPageProxy.h:\n* Source/WebKit/UIProcess/XR/ios/PlatformXRARKit.mm:\n(WebKit::makeMachSendRight):\n* Source/WebKit/UIProcess/XR/xros/PlatformXRCompositor.mm:\n(makeMachSendRight):\n* Source/WebKit/UIProcess/ios/PageClientImplIOS.h:\n* Source/WebKit/UIProcess/ios/PageClientImplIOS.mm:\n(WebKit::PageClientImpl::colorSpace):\n* Source/WebKit/UIProcess/mac/PageClientImplMac.h:\n* Source/WebKit/UIProcess/mac/PageClientImplMac.mm:\n(WebKit::PageClientImpl::colorSpace):\n* Source/WebKit/UIProcess/mac/WebPageProxyMac.mm:\n* Source/WebKit/UIProcess/mac/WebViewImpl.h:\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::colorSpace):\n* Source/WebKit/WebKitPrefix.h:\n* Source/WebKit/WebProcess/GPU/ShapeDetection/RemoteBarcodeDetectorProxy.cpp:\n(WebKit::ShapeDetection::RemoteBarcodeDetectorProxy::detect):\n* Source/WebKit/WebProcess/GPU/ShapeDetection/RemoteFaceDetectorProxy.cpp:\n(WebKit::ShapeDetection::RemoteFaceDetectorProxy::detect):\n* Source/WebKit/WebProcess/GPU/ShapeDetection/RemoteTextDetectorProxy.cpp:\n(WebKit::ShapeDetection::RemoteTextDetectorProxy::detect):\n* Source/WebKit/WebProcess/GPU/graphics/RemoteDisplayListRecorderProxy.cpp:\n(WebKit::RemoteDisplayListRecorderProxy::RemoteDisplayListRecorderProxy):\n* Source/WebKit/WebProcess/GPU/graphics/RemoteGraphicsContextGLProxy.cpp:\n(WebKit::RemoteGraphicsContextGLProxy::setDrawingBufferColorSpace):\n* Source/WebKit/WebProcess/GPU/graphics/RemoteGraphicsContextGLProxy.h:\n* Source/WebKit/WebProcess/GPU/graphics/RemoteGraphicsContextProxy.cpp:\n(WebKit::RemoteGraphicsContextProxy::RemoteGraphicsContextProxy):\n(WebKit::RemoteGraphicsContextProxy::recordResourceUse):\n(WebKit::RemoteGraphicsContextProxy::createImageBuffer const):\n(WebKit::RemoteGraphicsContextProxy::createAlignedImageBuffer const):\n* Source/WebKit/WebProcess/GPU/graphics/RemoteGraphicsContextProxy.h:\n* Source/WebKit/WebProcess/GPU/graphics/RemoteImageBufferProxy.cpp:\n(WebKit::RemoteImageBufferProxy::transformToColorSpace):\n* Source/WebKit/WebProcess/GPU/graphics/RemoteImageBufferProxy.h:\n* Source/WebKit/WebProcess/GPU/graphics/RemoteNativeImageProxy.cpp:\n(WebKit::placeholderPlatformImage):\n(WebKit::RemoteNativeImageProxy::colorSpace const):\n* Source/WebKit/WebProcess/GPU/graphics/RemoteNativeImageProxy.h:\n* Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.cpp:\n(WebKit::RemoteRenderingBackendProxy::createImageBuffer):\n* Source/WebKit/WebProcess/GPU/graphics/RemoteRenderingBackendProxy.h:\n* Source/WebKit/WebProcess/GPU/graphics/RemoteResourceCacheProxy.cpp:\n(WebKit::createShareableBitmapForNativeImage):\n(WebKit::RemoteResourceCacheProxy::recordNativeImageUse):\n* Source/WebKit/WebProcess/GPU/graphics/RemoteResourceCacheProxy.h:\n* Source/WebKit/WebProcess/GPU/graphics/RemoteSnapshotRecorderProxy.cpp:\n(WebKit::RemoteSnapshotRecorderProxy::RemoteSnapshotRecorderProxy):\n* Source/WebKit/WebProcess/GPU/graphics/WebGPU/RemoteCompositorIntegrationProxy.cpp:\n(WebKit::WebGPU::RemoteCompositorIntegrationProxy::recreateRenderBuffers):\n* Source/WebKit/WebProcess/GPU/graphics/WebGPU/RemoteCompositorIntegrationProxy.h:\n* Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.cpp:\n(WebKit::MediaPlayerPrivateRemote::colorSpace):\n* Source/WebKit/WebProcess/GPU/media/MediaPlayerPrivateRemote.h:\n* Source/WebKit/WebProcess/GPU/media/RemoteImageDecoderAVF.cpp:\n* Source/WebKit/WebProcess/GPU/media/cocoa/MediaPlayerPrivateRemoteCocoa.mm:\n(WebKit::MediaPlayerPrivateRemote::colorSpace):\n* Source/WebKit/WebProcess/GPU/webrtc/RemoteVideoFrameObjectHeapProxyProcessor.cpp:\n(WebKit::RemoteVideoFrameObjectHeapProxyProcessor::getNativeImage):\n* Source/WebKit/WebProcess/InjectedBundle/API/c/WKBundlePageOverlay.cpp:\n* Source/WebKit/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp:\n(WebKit::imageForRect):\n* Source/WebKit/WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp:\n(WebKit::InjectedBundleRangeHandle::renderedImage):\n* Source/WebKit/WebProcess/InjectedBundle/InjectedBundleHitTestResult.cpp:\n(WebKit::InjectedBundleHitTestResult::image const):\n* Source/WebKit/WebProcess/Model/WebModelPlayer.h:\n* Source/WebKit/WebProcess/Model/WebModelPlayer.mm:\n(WebKit::WebModelPlayer::snapshotCurrentFrame):\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/AsyncPDFRenderer.mm:\n(WebKit::renderPDFPagePreview):\n(WebKit::renderPDFTileToImage):\n(WebKit::renderPDFTileToDynamicContentScalingDisplayList):\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/UnifiedPDFPlugin.mm:\n(WebKit::UnifiedPDFPlugin::textIndicatorForPageRect):\n* Source/WebKit/WebProcess/WebCoreSupport/ShareableBitmapUtilities.cpp:\n(WebKit::createShareableBitmap):\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:\n(WebKit::WebChromeClient::createImageBuffer const):\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.h:\n* Source/WebKit/WebProcess/WebCoreSupport/WebWorkerClient.cpp:\n(WebKit::GPUProcessWebWorkerClient::createImageBuffer const):\n(WebKit::WebWorkerClient::createImageBuffer const):\n* Source/WebKit/WebProcess/WebCoreSupport/WebWorkerClient.h:\n* Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm:\n(WebKit::WebPage::drawToPDF):\n(WebKit::WebPage::drawRectToImage):\n(WebKit::WebPage::drawPagesToPDFImpl):\n* Source/WebKit/WebProcess/WebPage/DrawingArea.h:\n(WebKit::DrawingArea::displayColorSpace const):\n(WebKit::DrawingArea::setColorSpace):\n* Source/WebKit/WebProcess/WebPage/DrawingArea.messages.in:\n* Source/WebKit/WebProcess/WebPage/IPCTestingAPI.cpp:\n(WebKit::IPCTestingAPI::JSIPC::serializedSRGBColorSpace):\n* Source/WebKit/WebProcess/WebPage/RemoteLayerTree/PlatformCALayerRemote.h:\n* Source/WebKit/WebProcess/WebPage/RemoteLayerTree/PlatformCALayerRemote.mm:\n(WebKit::PlatformCALayerRemote::displayColorSpace const):\n* Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeContext.h:\n* Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeContext.mm:\n(WebKit::RemoteLayerTreeContext::displayColorSpace const):\n* Source/WebKit/WebProcess/WebPage/WebFrame.cpp:\n(WebKit::WebFrame::createSelectionSnapshot const):\n(WebKit::shareableBitmapFromImageBuffer):\n(WebKit::shareableBitmapFromImageData):\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::shareableBitmapForNodeIncludingOffscreen):\n(WebKit::snapshotColorSpace):\n(WebKit::WebPage::loadAndDecodeImage):\n(WebKit::WebPage::updateAttachmentIcon):\n* Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm:\n(WebKit::WebPage::drawToPDFiOS):\n* Source/WebKit/WebProcess/WebPage/mac/RemoteLayerTreeDrawingAreaMac.h:\n* Source/WebKit/WebProcess/WebPage/mac/RemoteLayerTreeDrawingAreaMac.mm:\n(WebKit::RemoteLayerTreeDrawingAreaMac::setColorSpace):\n(WebKit::RemoteLayerTreeDrawingAreaMac::displayColorSpace const):\n* Source/WebKit/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h:\n* Source/WebKit/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:\n(WebKit::TiledCoreAnimationDrawingArea::setColorSpace):\n(WebKit::TiledCoreAnimationDrawingArea::displayColorSpace const):\n* Source/WebKit/WebProcess/WebPage/wc/DrawingAreaWC.cpp:\n(WebKit::DrawingAreaWC::createImageBuffer):\n* Source/WebKitLegacy/mac/WebCoreSupport/WebContextMenuClient.mm:\n(WebContextMenuClient::imageForCurrentSharingServicePickerItem):\n* Tools/DumpRenderTree/ios/PixelDumpSupportIOS.mm:\n(createBitmapContextFromWebView):\n* Tools/Scripts/generate-gpup-webgl:\n* Tools/TestWebKitAPI/Helpers/GraphicsTestUtilities.cpp:\n(TestWebKitAPI::imageBufferPixelAt):\n(TestWebKitAPI::imagePixelIs):\n* Tools/TestWebKitAPI/Tests/IPC/IPCSerialization.mm:\n(TEST(IPCSerialization, Basic)):\n* Tools/TestWebKitAPI/Tests/WebCore/DisplayListRecorderTests.cpp:\n(TestWebKitAPI::createReferenceTarget):\n(TestWebKitAPI::createTestImageBuffer):\n* Tools/TestWebKitAPI/Tests/WebCore/ImageBufferTests.cpp:\n(TestWebKitAPI::createPixelBufferTestPattern):\n(TestWebKitAPI::TEST(ImageBufferTests, ImageBufferSubTypeCreateCreatesSubtypes)):\n(TestWebKitAPI::TEST(ImageBufferTests, ImageBufferSubPixelDrawing)):\n(TestWebKitAPI::TEST(ImageBufferTests, DISABLED_DrawImageBufferDoesNotReferenceExtraMemory)):\n(TestWebKitAPI::TEST_P):\n(TestWebKitAPI::TEST(ImageBufferTests, GetPixelBufferAllZeros)):\n* Tools/TestWebKitAPI/Tests/WebCore/NativeImageTests.cpp:\n(TestWebKitAPI::AnyPixelBufferFormatTest::createPixelBuffer const):\n(TestWebKitAPI::AnyPixelBufferFormatTest::createTestPatternPixelBuffer const):\n(TestWebKitAPI::TEST_P):\n* Tools/TestWebKitAPI/Tests/WebCore/PixelBufferConversionTests.cpp:\n(TestWebKitAPI::TEST(PixelBufferConversionTests, convertImagePixels)):\n(TestWebKitAPI::TEST(PixelBufferConversionTests, convertImagePixels2)):\n(TestWebKitAPI::convertFloat16s):\n(TestWebKitAPI::TEST(PixelBufferConversionTests, convertImagePixelsFloat16Identical)):\n(TestWebKitAPI::TEST(PixelBufferConversionTests, convertImagePixelsFloat16AlphaOnly)):\n(TestWebKitAPI::TEST(PixelBufferConversionTests, convertImagePixelsFloat16ColorSpaceConversion)):\n(TestWebKitAPI::TEST(PixelBufferConversionTests, convertImagePixelsFloat16ToAndFromByte)):\n(TestWebKitAPI::TEST(PixelBufferConversionTests, convertImagePixelsFloat16PaddedRows)):\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/BifurcatedGraphicsContextTestsCG.cpp:\n(TestWebKitAPI::TEST(BifurcatedGraphicsContextTests, Basic)):\n(TestWebKitAPI::TEST(BifurcatedGraphicsContextTests, DrawTiledGradientImage)):\n(TestWebKitAPI::TEST(BifurcatedGraphicsContextTests, DrawGradientImage)):\n(TestWebKitAPI::TEST(BifurcatedGraphicsContextTests, Borders)):\n(TestWebKitAPI::TEST(BifurcatedGraphicsContextTests, TransformedClip)):\n(TestWebKitAPI::TEST(BifurcatedGraphicsContextTests, ApplyDeviceScaleFactor)):\n(TestWebKitAPI::TEST(BifurcatedGraphicsContextTests, ClipToImageBuffer)):\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/GraphicsContextCGTests.mm:\n(TestWebKitAPI::greenImage):\n(TestWebKitAPI::TEST(GraphicsContextTests, DrawNativeImageDoesNotLeakCompositeOperator)):\n(TestWebKitAPI::TEST(GraphicsContextTests, FillRoundedRectPreservesActiveBlendMode)):\n(TestWebKitAPI::TEST(GraphicsContextTests, FillRectWithBlendModePreservesActiveBlendMode)):\n(TestWebKitAPI::TEST(GraphicsContextTests, StrokeRectPreservesStrokeThickness)):\n(TestWebKitAPI::TEST(GraphicsContextTests, StrokeRectDoesNotDesynchroniseLineWidth)):\n(TestWebKitAPI::TEST(GraphicsContextTests, CGBitmapRenderingModeIsUnaccelerated)):\n(TestWebKitAPI::TEST(GraphicsContextTests, IOSurfaceRenderingModeIsAccelerated)):\n(TestWebKitAPI::TEST(GraphicsContextTests, DrawsReportHasDrawn)):\n(TestWebKitAPI::TEST(GraphicsContextTests, OutOfGamutSRGBNotDrawn)):\n* Tools/TestWebKitAPI/Tests/WebCore/cocoa/IOSurfaceTests.mm:\n(TestWebKitAPI::TEST(IOSurfaceTest, IsInUse)):\n(TestWebKitAPI::TEST(IOSurfaceTest, CreatePlatformContext)):\n(TestWebKitAPI::TEST(IOSurfaceTest, createFromUntrustedUncompressedWebKitSendRightSRGB)):\n(TestWebKitAPI::TEST(IOSurfaceTest, createFromUntrustedUncompressedWebKitSendRightRGBA16F)):\n(TestWebKitAPI::TEST(IOSurfaceTest, createFromUntrustedUncompressedWebKitSendRightYUV422)):\n(TestWebKitAPI::TEST(IOSurfaceTest, IOSurfaceNames)):\n(TestWebKitAPI::TEST(IOSurfacePoolTest, IOSurfacePoolNames)):\n(TestWebKitAPI::createSurface):\n\nCanonical link: https://commits.webkit.org/320435@main", "email": "kkinnunen@apple.com", "hash": "7ab124eb02518a622a79a6a7c9476bd7d7c1e538", "subject": "Rename WebCore::DestinationColorSpace to WebCore::ColorSpace" }, "320436@main": { "author": "Suraj Thanugundla", "avatar": "https://www.gravatar.com/avatar/5f5ab8a9e6d06403d932003de0835ada?d=identicon\u0026s=64", "cl": "320436@main", "clUrl": "https://commits.webkit.org/320436@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323162\n\nReviewed by Sam Weinig and Tim Nguyen.\n\nIn [1], CSSWG resolved that overflow-clip-margin also applies to\nscrollable boxes and can take negative length values. Change the\nCSS property definition, parser function and style value to allow\nall length values. Layout and rendering code does not use the\nproperty yet, so no changes needed there.\n\n[1] https://github.com/w3c/csswg-drafts/issues/10745\n\nAdded new test cases in existing tests.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-clip-margin-computed-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-clip-margin-computed.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-clip-margin-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-overflow/parsing/overflow-clip-margin.html:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-typed-om/the-stylepropertymap/properties/overflow-clip-margin-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-typed-om/the-stylepropertymap/properties/overflow-clip-margin.html:\n* Source/WebCore/css/CSSProperties.json:\n* Source/WebCore/css/parser/CSSPropertyParserConsumer+Overflow.cpp:\n(WebCore::CSSPropertyParserHelpers::consumeOverflowClipMargin):\n* Source/WebCore/style/values/overflow/StyleOverflowClipMargin.h:\n\nCanonical link: https://commits.webkit.org/320436@main", "email": "contact@surajt.com", "hash": "a93220eaa0257c948ad45e5d83e774f85cc44e1e", "subject": "Allow negative length values for overflow-clip-margin property" }, "320437@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "320437@main", "clUrl": "https://commits.webkit.org/320437@main", "description": "Reviewed by Yusuke Suzuki.\n\nImport two already-merged WPT test fixes.\n\nAwait TestSandwich so testharness does not finish while JSPI is still\nsuspended, and drop the [ Pass Failure ] flake line.\n\nMatch ESM worker tests to the worker-helper {value, checks} message\nshape. worker-import now expects PASS. worker.tentative still FAILs\nbecause the worker errors before the message assert.\n\nUpstream: https://github.com/web-platform-tests/wpt/pull/62092\nUpstream: https://github.com/web-platform-tests/wpt/pull/62118\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/jspi/js-promise-integration.any.js:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/webapi/esm-integration/worker-import.tentative.html:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/webapi/esm-integration/worker-import.tentative-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/wasm/webapi/esm-integration/worker.tentative.html:\n\nCanonical link: https://commits.webkit.org/320437@main", "email": "chi187@gmail.com", "hash": "62e2c330811c5874a195504cd1455b1612385295", "subject": "[WPT] Import JSPI TestSandwich await and ESM worker message-shape fixes" }, "320438@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "320438@main", "clUrl": "https://commits.webkit.org/320438@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322528\n\nReviewed by Yusuke Suzuki.\n\nBBQ and OMG bounds-check against Table length and load the cached\nwrapper. A miss still calls operationGetWasmTableElement to\nmaterialize a lazy wrapper or return null.\n\n* Source/JavaScriptCore/b3/B3AbstractHeapRepository.h:\n* Source/JavaScriptCore/wasm/WasmBBQJIT64.cpp:\n* Source/JavaScriptCore/wasm/WasmOMGIRGenerator.cpp:\n* Source/JavaScriptCore/wasm/WasmTable.h:\n* JSTests/wasm/stress/table-get-funcref.js: Added.\n\nCanonical link: https://commits.webkit.org/320438@main", "email": "chi187@gmail.com", "hash": "6a359a00ccf8475c9eb9efc9bcae0dfa9daaad65", "subject": "[JSC][Wasm] Inline table.get for funcref" }, "320439@main": { "author": "Dominic Mazzoni", "avatar": "https://www.gravatar.com/avatar/f76643c44a7ee3be45148e66d97ed8e4?d=identicon\u0026s=64", "cl": "320439@main", "clUrl": "https://commits.webkit.org/320439@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323250\nrdar://186501509\n\nReviewed by Tyler Wilcock.\n\nThis test was failing due to https://bugs.webkit.org/show_bug.cgi?id=323182\n(AX: isolated tree can serve old page's content after navigation). With that fixed,\nwe can now make it reliable, so we can cover shared-process site isolation accessibility.\n\n* LayoutTests/http/wpt/site-isolation/accessibility/two-iframes-shared-process.sub.html:\n* LayoutTests/platform/mac/TestExpectations:\n\nCanonical link: https://commits.webkit.org/320439@main", "email": "dm_mazzoni@apple.com", "hash": "4310df9751500279df8894813ff087bb593a71fe", "subject": "AX: http/wpt/site-isolation/accessibility/two-iframes-shared-process.sub.html is flaky" }, "320440@main": { "author": "Brent Fulgham", "avatar": "https://www.gravatar.com/avatar/c6989a65afef0d015b55c65406e37ccc?d=identicon\u0026s=64", "cl": "320440@main", "clUrl": "https://commits.webkit.org/320440@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323158\nrdar://186410147\n\nReviewed by BJ Burg.\n\nWebDriver's implementation of deleteAllCookies discards its completion handler and returns\nsuccess before the network process has actually deleted and saved the cookies. Since the\ndelete process is asynchronous, we create a race condition that can lead to downstream test\nfailures, implying bugs in WebKit that are not present in real Safari.\n\nFixing this will avoid bugs in one cookie-based WPT from poisoning other steps.\n\nThis patch corrects that problem, and make the command match the behavior of the other\ncookie features.\n\nTested with a new API test.\n\n* Source/WebKit/UIProcess/Automation/Automation.json:\n* Source/WebKit/UIProcess/Automation/WebAutomationSession.cpp:\n(WebKit::WebAutomationSession::deleteAllCookies):\n* Source/WebKit/UIProcess/Automation/WebAutomationSession.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WKHTTPCookieStore.mm:\n(TEST(WKHTTPCookieStore, AutomationDeleteAllCookiesWaitsForDeletion)):\n\nCanonical link: https://commits.webkit.org/320440@main", "email": "bfulgham@apple.com", "hash": "99bcbf16626d2c7ca9707ef1d499fa02327f441b", "subject": "[WebDriver] deleteAllCookies implementation ignores completion handler and always returns success" }, "320441@main": { "author": "Sergey Rubanov", "avatar": "https://www.gravatar.com/avatar/d04164fa4e06ce85533085f24c766e17?d=identicon\u0026s=64", "cl": "320441@main", "clUrl": "https://commits.webkit.org/320441@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323211\n\nReviewed by Yusuke Suzuki.\n\nWasmAddress already folds ZExt32/SExt32 into ARM64 UXTW/SXTW via\nindexArg. This also absorbs a pointer-width Shl into the index scale\nso a load can be LDR Xt, [Xn, Wm, UXTW #scale]. A 32-bit Shl inside\nZExt32 is left unscaled because wrapping that shift is not the same\nas shifting after the extend.\n\n* Source/JavaScriptCore/b3/B3LowerToAir.cpp:\n* Source/JavaScriptCore/b3/testb3.h:\n* Source/JavaScriptCore/b3/testb3_1.cpp:\n* Source/JavaScriptCore/b3/testb3_7.cpp:\n\nCanonical link: https://commits.webkit.org/320441@main", "email": "chi187@gmail.com", "hash": "761d9032a43cb57a16f71df3343b9d8cbd208746", "subject": "[JSC] Fold Shl into ARM64 WasmAddress index form" }, "320442@main": { "author": "Phinehas Fuachie", "avatar": "https://www.gravatar.com/avatar/900d85de8c325e38975f39115c36bb75?d=identicon\u0026s=64", "cl": "320442@main", "clUrl": "https://commits.webkit.org/320442@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323251\nrdar://186502346\n\nReviewed by Jer Noble.\n\nProjected video renders whenever the container declares a projection kind, and x-webkit-projection\ncould only force the renderer on, so a page had no way to have the video presented as-is.\n\nResolve x-webkit-projection=\"none\" to no projection. All other values are unchanged, and the\nexisting webkitprojectionchanged event handles setting or removing it during playback.\n\n* Source/WebCore/Modules/modern-media-controls/media/spatial-video-support.js:\n(SpatialVideoSupport.prototype._resolveProjection):\n\nCanonical link: https://commits.webkit.org/320442@main", "email": "pfuachie2@apple.com", "hash": "32a2a7043e8be11c4559cee2d2b7b0fc3406f773", "subject": "A page cannot opt out of the spatial video renderer (experimental)" }, "320443@main": { "author": "Tyler Wilcock", "avatar": "https://www.gravatar.com/avatar/9545082e6bed96158a9f52dac6e4b869?d=identicon\u0026s=64", "cl": "320443@main", "clUrl": "https://commits.webkit.org/320443@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323328\nrdar://186571569\n\nReviewed by Dominic Mazzoni.\n\nAXIndexForTextMarker on the accessibility thread is AXTextMarker::offsetFromRoot,\nwhich begins by anchoring the marker to real text with toTextRunMarker(). That\nfunction only ever searches forward, so a marker on an object with no text of its\nown and no text after it *an empty text field that ends the document, for\nexample) has nothing to anchor to, and offsetFromRoot returned 0 rather than the\nindex of the position.\n\nWhen forward anchoring finds nothing, anchor backwards instead, to the end of the\nlast run before the marker, as every character in the document precedes such a\nposition, so that run's end is its index.\n\nFixes accessibility/isolated-tree/offset-from-root-outside-text-run.html in isolated tree mode.\n\n* LayoutTests/accessibility/isolated-tree/offset-from-root-outside-text-run-expected.txt: Added.\n* LayoutTests/accessibility/isolated-tree/offset-from-root-outside-text-run.html: Added.\n* Source/WebCore/accessibility/AXTextMarker.cpp:\n(WebCore::AXTextMarker::offsetFromRoot const):\n\nCanonical link: https://commits.webkit.org/320443@main", "email": "tyler_w@apple.com", "hash": "4a276aa3fda7e8737df19898b289d8c9671ebd82", "subject": "AX: In isolated tree mode, AXIndexForTextMarker returns 0 for a text marker in an empty text field at the end of the document" }, "320444@main": { "author": "Abrar Rahman Protyasha", "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64", "cl": "320444@main", "clUrl": "https://commits.webkit.org/320444@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323297\nrdar://186527750\n\nReviewed by Wenson Hsieh.\n\nWhen we build up the context menu items in UnifiedPDFPlugin, we too\neagerly skipped the text selection items if a document did not allow\ncopying. However, the copying permission really only affected the \"Copy\"\nand \"Copy Link\" items, and not the other menu items such as \"Look Up ...\"\nand \"Search with ...\".\n\nAs such, this patch relaxes that restriction and only consults\n-[PDFDocument allowsCopying] before producing the context menu items\nwhich involve copying.\n\nTo facilitate testing, we refactor UnifiedPDFPlugin::createContextMenu()\nto accept a root view point and an input source, rather than a full\nfledged context menu event. This allows both the event handling path and\nthe test hook to obtain a context menu, using which the latter generates\na set of titles observed in the PDF's context menu.\n\nTest: pdf/mac/selection-context-menu-items-with-copying-disabled.html\n\n* LayoutTests/pdf/mac/selection-context-menu-items-with-copying-disabled-expected.txt: Added.\n* LayoutTests/pdf/mac/selection-context-menu-items-with-copying-disabled.html: Added.\n* LayoutTests/pdf/resources/copying-disabled.pdf: Added.\n* LayoutTests/platform/ios/TestExpectations:\n* LayoutTests/platform/visionos/TestExpectations:\n* Source/WebCore/plugins/PluginViewBase.h:\n(WebCore::PluginViewBase::pdfContextMenuItemTitlesForTesting const):\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::pdfContextMenuItemTitlesForTesting const):\n* Source/WebCore/testing/Internals.h:\n* Source/WebCore/testing/Internals.idl:\n* Source/WebKit/WebProcess/Plugins/PDF/PDFPluginBase.h:\n(WebKit::PDFPluginBase::contextMenuItemTitlesForTesting const):\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/UnifiedPDFPlugin.h:\n* Source/WebKit/WebProcess/Plugins/PDF/UnifiedPDF/UnifiedPDFPlugin.mm:\n(WebKit::UnifiedPDFPlugin::handleContextMenuEvent):\n(WebKit::UnifiedPDFPlugin::createContextMenu const):\n(WebKit::UnifiedPDFPlugin::contextMenuItemTitlesForTesting const):\n(WebKit::UnifiedPDFPlugin::selectionContextMenuItems const):\n* Source/WebKit/WebProcess/Plugins/PluginView.cpp:\n(WebKit::PluginView::pdfContextMenuItemTitlesForTesting const):\n* Source/WebKit/WebProcess/Plugins/PluginView.h:\n\nCanonical link: https://commits.webkit.org/320444@main", "email": "a_protyasha@apple.com", "hash": "55e028f27e25c8fb74a3a3836b737fb4b3627524", "subject": "[macOS] Text selection options missing from context menu in PDFs with copying disabled" }, "320445@main": { "author": "Taher Ali", "avatar": "https://www.gravatar.com/avatar/e104800647d8c98b8c9dbe736b5e1751?d=identicon\u0026s=64", "cl": "320445@main", "clUrl": "https://commits.webkit.org/320445@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323237\nrdar://186489079\n\nReviewed by Tim Nguyen.\n\nparam(--color, currentcolor) crosses into the SVG image as an unresolved token, so it\nresolves against the image's own color rather than the linking element's.\n\nWe still need to figure out the interaction here: whether a parameter resolves at the\nlinking element or at use time inside the image.\n\n* LayoutTests/TestExpectations:\n* LayoutTests/imported/w3c/web-platform-tests/svg/styling/css-linked-parameters/link-parameters-currentcolor.tentative-expected.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/svg/styling/css-linked-parameters/link-parameters-currentcolor.tentative.html: Added.\n\nCanonical link: https://commits.webkit.org/320445@main", "email": "taher_ali@apple.com", "hash": "3fc4ee5e22e7b0a9809c3f244c64d65855d22653", "subject": "[css-link-params] Add a tentative test for currentcolor as a parameter value" }, "320446@main": { "author": "Ian Gower", "avatar": "https://www.gravatar.com/avatar/cc2e677bc728b92e5463660d8b8d9ed8?d=identicon\u0026s=64", "cl": "320446@main", "clUrl": "https://commits.webkit.org/320446@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323339\nrdar://186580796\n\nReviewed by Tim Nguyen.\n\n* metadata/contributors.json:\n\nCanonical link: https://commits.webkit.org/320446@main", "email": "i_gower@apple.com", "hash": "99be793b8e4860953f303ea64493dff3d857c564", "subject": "Give Ian Gower committer status" }, "320447@main": { "author": "Alan Baradlay", "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64", "cl": "320447@main", "clUrl": "https://commits.webkit.org/320447@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323151\nrdar://problem/186407352\n\nReviewed by Antti Koivisto.\n\nPreparation for making an inside marker an inline content: an anonymous inline box holding the marker's renderers.\nThere is no RenderListMarker in that setup (only an anon RenderInline), so every question that is asked of the renderer on trunk by reaching for RenderListMarker has to be answerable without one.\n\nNo change in behavior.\n\n* Source/WebCore/rendering/RenderListItem.cpp:\n(WebCore::RenderListItem::updateMarkerContent):\n(WebCore::RenderListItem::updateValueAndMarkerContent):\n(WebCore::RenderListItem::markerText const):\n(WebCore::RenderListItem::updateListMarkerNumbers):\n(WebCore::RenderListItem::paintObject):\n* Source/WebCore/rendering/RenderListItem.h:\n* Source/WebCore/rendering/RenderListMarker.cpp:\n(WebCore::counterStyleFor):\n(WebCore::RenderListMarker::counterStyle const):\n(WebCore::listMarkerIsDisclosure):\n(WebCore::listMarkerSynthesizesGlyph):\n(WebCore::listMarkerTextContent):\n(WebCore::setListMarkerInlineMargins):\n(WebCore::RenderListMarker::updateContent):\n(WebCore::RenderListMarker::updateInlineMargins):\n(WebCore::RenderListMarker::isDisclosureMarker const):\n* Source/WebCore/rendering/RenderListMarker.h:\n* Source/WebCore/rendering/updating/RenderTreeBuilder.cpp:\n(WebCore::RenderTreeBuilder::addListItemNeedingMarkerUpdate):\n(WebCore::RenderTreeBuilder::updateListMarkerContents):\n(WebCore::RenderTreeBuilder::attachToRenderElementInternal):\n(WebCore::RenderTreeBuilder::detachFromRenderElement):\n(WebCore::RenderTreeBuilder::addListMarkerNeedingContentUpdate): Deleted.\n* Source/WebCore/rendering/updating/RenderTreeBuilder.h:\n* Source/WebCore/rendering/updating/RenderTreeBuilderList.cpp:\n(WebCore::RenderTreeBuilder::List::updateItemMarker):\n* Source/WebCore/accessibility/AccessibilityObject.cpp:\n(WebCore::lineStartListMarkerText):\n(WebCore::AccessibilityObject::listMarkerTextForNodeAndPosition):\n* Source/WebCore/accessibility/AccessibilityObject.h:\n\nCanonical link: https://commits.webkit.org/320447@main", "email": "zalan@apple.com", "hash": "f15a2f2705c4d3c658bdc35936b8834eaf4da056", "subject": "[list-marker] RenderListItem should answer for its marker instead of its callers consulting RenderListMarker" }, "320448@main": { "author": "Wenson Hsieh", "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64", "cl": "320448@main", "clUrl": "https://commits.webkit.org/320448@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323334\nrdar://186578624\n\nReviewed by Abrar Rahman Protyasha.\n\nExpand the heuristic added in 319761@main, so that it covers the case where a transparent one-time\ncode entry field intersects with elements representing a single one-time code digit.\n\nTest: TextExtractionTests.ExtractTransparentOneTimeCodeFieldOverVisualProxies\n\n* Source/WebCore/page/text-extraction/TextExtraction.cpp:\n(WebCore::TextExtraction::visualProxyForTransparentControl):\n(WebCore::TextExtraction::extractItemData):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/TextExtractionTests.mm:\n(TestWebKitAPI::(TextExtractionTests, ExtractTransparentOneTimeCodeFieldOverVisualProxies)):\n\nCanonical link: https://commits.webkit.org/320448@main", "email": "wenson_hsieh@apple.com", "hash": "9b9378751a28539b551b05949a4176e42c5f5a61", "subject": "[Text Extraction] battle.net: one-time code fields are skipped in text extraction results" }, "320449@main": { "author": "Elliott Williams", "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64", "cl": "320449@main", "clUrl": "https://commits.webkit.org/320449@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323195\nrdar://186280311\n\nReviewed by Richard Robinson.\n\nAdds about 2k test cases (per --list-tests).\n\nAlso, make a drive-by fix for ScopedLambda.cpp: Compile it with\n-fno-elide-constructors to make the test meaningful. Matches what we do\nin Xcode.\n\n* Tools/TestWebKitAPI/CMakeLists.txt:\n* Tools/TestWebKitAPI/PlatformCocoa.cmake:\n\nCanonical link: https://commits.webkit.org/320449@main", "email": "emw@apple.com", "hash": "f50c6572e5e0e52b5c48f69b3170bb943c653e39", "subject": "[TestWebKitAPI] Add missing Cocoa test sources to CMakeLists.txt" }, "320450@main": { "author": "Issac Roy", "avatar": "https://www.gravatar.com/avatar/dad994528f617bf59fe005077d0fa8f3?d=identicon\u0026s=64", "cl": "320450@main", "clUrl": "https://commits.webkit.org/320450@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323312\n\u003crdar://problem/186558747\u003e\n\nReviewed by Aakash Jain.\n\n`RunJavaScriptCoreTests.filter_failures_using_results_db` asks\n`ResultsDatabase.flaky_verdicts_for` for a verdict without passing `authors` or\n`pr_number`, so the JSC queues never drop evidence recorded by the change under\njudgement. A conviction there can rest entirely on rows an earlier build of the\nsame pull request wrote, which waves through a change that flakes only because\nof itself. The layout-test and API call sites already pass both arguments; JSC\nwas the only one that did not.\n\nForward the change's identity from the same two properties the other two read,\nso `_rows_by_type` drops a row whose `pr_number` is the pull request under test\nor whose every recorded author is one of the change's own.\n\n* Tools/CISupport/ews-build/steps.py:\n(RunJavaScriptCoreTests.filter_failures_using_results_db):\n* Tools/CISupport/ews-build/steps_unittest.py:\n\nCanonical link: https://commits.webkit.org/320450@main", "email": "issacroy05@gmail.com", "hash": "5a427de213e37450d207aa032ab7968adcc59c58", "subject": "[EWS] JSC EWS can excuse a test failure on flakiness recorded by the pull request under test" }, "320451@main": { "author": "Tyler Wilcock", "avatar": "https://www.gravatar.com/avatar/9545082e6bed96158a9f52dac6e4b869?d=identicon\u0026s=64", "cl": "320451@main", "clUrl": "https://commits.webkit.org/320451@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323325\nrdar://186569084\n\nReviewed by Dominic Mazzoni.\n\nDelete these two unused functions.\n\n* Source/WebCore/accessibility/AXCoreObject.cpp:\n(WebCore::AXCoreObject::nextUnignoredSibling const): Deleted.\n(WebCore::AXCoreObject::isTableCellInSameColGroup): Deleted.\n* Source/WebCore/accessibility/AXCoreObject.h:\n\nCanonical link: https://commits.webkit.org/320451@main", "email": "tyler_w@apple.com", "hash": "dae912f3bdeb2512511a46901a4172c9d0e6e2b8", "subject": "AX: isTableCellInSameColGroup and nextUnignoredSibling are unused functions" }, "320452@main": { "author": "Jessica Lee", "avatar": "https://www.gravatar.com/avatar/fc717c99321d09f31fb9187418a8ffc5?d=identicon\u0026s=64", "cl": "320452@main", "clUrl": "https://commits.webkit.org/320452@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323266\nrdar://186513989\n\nReviewed by Sihui Liu and Per Arne Vollan.\n\nThese are no longer necessary.\n\nNo new tests needed.\n\n* Source/WebKit/Shared/ios/WebParentalControlsURLFilter.mm:\n(WebKit::WebParentalControlsURLFilter::ensureWebContentFilter):\n(WebKit::WebParentalControlsURLFilter::isURLAllowedImpl):\n(WebKit::WebParentalControlsURLFilter::allowURL):\n(WebKit::WebParentalControlsURLFilter::requestPermissionForURL):\n\nCanonical link: https://commits.webkit.org/320452@main", "email": "jlee53@apple.com", "hash": "8c21d7727b4793b2d5e539bb815e3107055c892a", "subject": "Remove extraneous get()'s from WebParentalControlsURLFilter.mm" }, "320453@main": { "author": "Yusuke Suzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "320453@main", "clUrl": "https://commits.webkit.org/320453@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323289\nrdar://186541346\n\nReviewed by Keith Miller.\n\nComplex wasm binaries include significant amount of constant\nexpressions. For example, Dart-flute-todomvc-wasm's binary includes\n4000~ constant expression, thus making it fast is critical for\nperformance.\n\nThis patch accelerates constant expression by splitting validator and interpreter.\nValidator can run without any actual values and interpreter does not\nneed to have costly validation. Also since constant expressions are only\nincluding straight forward wasm instructions, interpreter is just\nreading and running the wasm instructions and even there is no control\nflow instructions.\n\nNow ConstExprGenerator is only validating the constant expressions.\nRemoving Value representation and removing m_mode as it is now\nValidation only. Instead, we have ConstExprInterpreter which runs\nconstant expressions by reading the already validated wasm instruction span.\n\nTests: JSTests/wasm/gc/extended-const-expr-replay-simd.js\n JSTests/wasm/gc/extended-const-expr-replay.js\n\n* JSTests/wasm/gc/extended-const-expr-replay-simd.js: Added.\n* JSTests/wasm/gc/extended-const-expr-replay.js: Added.\n(check):\n* Source/JavaScriptCore/wasm/WasmConstExprGenerator.cpp:\n(JSC::Wasm::ConstExprInterpreter::ConstExprInterpreter):\n(JSC::Wasm::ConstExprInterpreter::run):\n(JSC::Wasm::ConstExprInterpreter::ConstExprValue::isInvalid const):\n(JSC::Wasm::ConstExprInterpreter::ConstExprValue::getValue const):\n(JSC::Wasm::ConstExprInterpreter::ConstExprValue::getVector const):\n(JSC::Wasm::ConstExprInterpreter::ConstExprValue::type const):\n(JSC::Wasm::ConstExprInterpreter::ConstExprValue::operator+ const):\n(JSC::Wasm::ConstExprInterpreter::ConstExprValue::operator- const):\n(JSC::Wasm::ConstExprInterpreter::ConstExprValue::operator* const):\n(JSC::Wasm::ConstExprInterpreter::failedToAllocate const):\n(JSC::Wasm::ConstExprInterpreter::loadGlobal):\n(JSC::Wasm::ConstExprInterpreter::refFunc):\n(JSC::Wasm::ConstExprInterpreter::refI31):\n(JSC::Wasm::ConstExprInterpreter::anyConvertExtern):\n(JSC::Wasm::ConstExprInterpreter::trackAllocation):\n(JSC::Wasm::ConstExprInterpreter::createNewArray):\n(JSC::Wasm::ConstExprInterpreter::createNewDefaultArray):\n(JSC::Wasm::ConstExprInterpreter::createNewStruct):\n(JSC::Wasm::ConstExprGenerator::fail const):\n(JSC::Wasm::ConstExprGenerator::ConstExprGenerator):\n(JSC::Wasm::ConstExprGenerator::addConstant):\n(JSC::Wasm::ConstExprGenerator::getGlobal):\n(JSC::Wasm::ConstExprGenerator::addRefI31):\n(JSC::Wasm::ConstExprGenerator::addArrayNew):\n(JSC::Wasm::ConstExprGenerator::addArrayNewDefault):\n(JSC::Wasm::ConstExprGenerator::addArrayNewFixed):\n(JSC::Wasm::ConstExprGenerator::addStructNewDefault):\n(JSC::Wasm::ConstExprGenerator::addStructNew):\n(JSC::Wasm::ConstExprGenerator::addAnyConvertExtern):\n(JSC::Wasm::ConstExprGenerator::addExternConvertAny):\n(JSC::Wasm::ConstExprGenerator::addI32Add):\n(JSC::Wasm::ConstExprGenerator::addI64Add):\n(JSC::Wasm::ConstExprGenerator::addI32Sub):\n(JSC::Wasm::ConstExprGenerator::addI64Sub):\n(JSC::Wasm::ConstExprGenerator::addI32Mul):\n(JSC::Wasm::ConstExprGenerator::addI64Mul):\n(JSC::Wasm::ConstExprGenerator::addRefFunc):\n(JSC::Wasm::ConstExprGenerator::endBlock):\n(JSC::Wasm::ConstExprGenerator::addSIMDConstant):\n(JSC::Wasm::parseExtendedConstExpr):\n(JSC::Wasm::evaluateExtendedConstExpr):\n(JSC::Wasm::ConstExprGenerator::ConstExprValue::ConstExprValue): Deleted.\n(JSC::Wasm::ConstExprGenerator::ConstExprValue::isInvalid): Deleted.\n(JSC::Wasm::ConstExprGenerator::ConstExprValue::getValue): Deleted.\n(JSC::Wasm::ConstExprGenerator::ConstExprValue::getVector): Deleted.\n(JSC::Wasm::ConstExprGenerator::ConstExprValue::type): Deleted.\n(JSC::Wasm::ConstExprGenerator::ConstExprValue::operator+): Deleted.\n(JSC::Wasm::ConstExprGenerator::ConstExprValue::operator-): Deleted.\n(JSC::Wasm::ConstExprGenerator::ConstExprValue::operator*): Deleted.\n(JSC::Wasm::ConstExprGenerator::result const): Deleted.\n(JSC::Wasm::ConstExprGenerator::createNewArray): Deleted.\n(JSC::Wasm::ConstExprGenerator::createNewStruct): Deleted.\n* Source/JavaScriptCore/wasm/WasmConstExprGenerator.h:\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp:\n(JSC::JSWebAssemblyInstance::evaluateConstantExpression):\n(JSC::JSWebAssemblyInstance::ensureConstantExpressionValue):\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h:\n* Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp:\n(JSC::WebAssemblyModuleRecord::initializeExports):\n(JSC::WebAssemblyModuleRecord::evaluateConstantExpression):\n(JSC::WebAssemblyModuleRecord::evaluate):\n* Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.h:\n\nCanonical link: https://commits.webkit.org/320453@main", "email": "ysuzuki@apple.com", "hash": "23b9690343a3b05b81f169079c1a84d91c9eb08a", "subject": "[JSC] Split validation and evaluation of wasm constant expression" }, "320454@main": { "author": "Brady Eidson", "avatar": "https://www.gravatar.com/avatar/31bed81d6d8ef517f93b30add03f5651?d=identicon\u0026s=64", "cl": "320454@main", "clUrl": "https://commits.webkit.org/320454@main", "description": "rdar://186477845\nhttps://bugs.webkit.org/show_bug.cgi?id=323347\n\nReviewed by Charlie Wolfe.\n\nPreviously, the test acknowledged a difference in SI vs non-SI behavior.\n318742@main fixed that and removed the difference.\n\nUpdate the test!\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/EnhancedSecurity.mm:\n(TestWebKitAPI::TEST(EnhancedSecurity, EnhancedSecurityNavigationStaysEnabledAfterSubFrameNavigationRequestDisablesCrossOrigin)):\n(TestWebKitAPI::TEST(EnhancedSecurity, EnhancedSecurityNavigationStaysDisabledAfterSubFrameNavigationRequestEnabledCrossOrigin)):\n\nCanonical link: https://commits.webkit.org/320454@main", "email": "beidson@apple.com", "hash": "89be83697e9bb2499759a6062ea94b7003b447db", "subject": "Update test expectations for two EnhancedSecurity API tests" }, "320455@main": { "author": "Aakash Jain", "avatar": "https://www.gravatar.com/avatar/e82e0cafeeac3a35b7e74206ebe4c536?d=identicon\u0026s=64", "cl": "320455@main", "clUrl": "https://commits.webkit.org/320455@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=322031\nrdar://185225128\n\nReviewed by Sam Sneddon.\n\nBuilt product archives, results directories and status reporting are all keyed on the change_id\nbuild property. When it was unset, GenerateS3URL passed None straight through to generateS3URL,\nwhich interpolated it into the object key, so a build uploaded its archive to 'None.zip' and\nreported success. Nothing in the producing build compares the key it wrote against the change it\nbuilt, so the only thing which noticed was a later build downloading a key it computed\nindependently, and it failed with a 404 that named no cause.\n\nConfigureBuild now fails when a pull request build has no change_id, stopping the build before it\npublishes an archive that no other queue can identify. generateS3URL refuses a missing revision too.\n\nConfigureBuild had no unit test coverage, so tests for it are added here.\n\n* Tools/CISupport/Shared/generate_s3_url.py:\n* Tools/CISupport/Shared/steps_unittest.py:\n* Tools/CISupport/ews-build/steps.py:\n* Tools/CISupport/ews-build/steps_unittest.py: Added unit-tests.\n\nCanonical link: https://commits.webkit.org/320455@main", "email": "aakash_jain@apple.com", "hash": "d77fbd56c1428ed2f1919b400ea9aa0486a1d812", "subject": "[ews] Fail the build early when change_id is missing" }, "320457@main": { "author": "Jeffrey Xu", "avatar": "https://www.gravatar.com/avatar/102604c66589181d1a1247ea63f49964?d=identicon\u0026s=64", "cl": "320457@main", "clUrl": "https://commits.webkit.org/320457@main", "description": "rdar://186509924\n\nReviewed by Alex Christensen.\n\nMultiple cookies are separated with a semicolon and space rather than a comma, like other headers.\nThis discrepancy was noticed by substituting HTTP/2 and HTTP/3 into a set of existing API tests that currently use HTTP/1.1, and noticing that WKHTTPCookieStore.CookiesSetBeforeLoad failed on the new protocols, so I duplicated that test into the HTTP2Server.mm file.\n\n* Tools/TestWebKitAPI/Helpers/cocoa/NetworkConnection.mm:\n(TestWebKitAPI::Connection::receiveHTTPMessagingRequest const):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/HTTP2Server.mm:\n(TestWebKitAPI::TEST(HTTP2Server, MultipleCookiesSetBeforeLoad)):\n\nCanonical link: https://commits.webkit.org/320457@main", "email": "jeffrey_xu2@apple.com", "hash": "7b6b37f2db60eb7cedc45f099883b8e5b870f6b4", "subject": "Fix cookie list splitting in the test HTTP/2 server." }, "320458@main": { "author": "Elliott Williams", "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64", "cl": "320458@main", "clUrl": "https://commits.webkit.org/320458@main", "description": "Unreviewed. I haven't been reviewing my auto-requested xcconfig PRs for\na long time, it's too high volume.\n\n* .github/CODEOWNERS:\n\nCanonical link: https://commits.webkit.org/320458@main", "email": "emw@apple.com", "hash": "b437008587b836064b61c8533fa9fe3d54b2240e", "subject": "Update emw-apple CODEOWNERS" }, "320459@main": { "author": "Elliott Williams", "avatar": "https://www.gravatar.com/avatar/4086acbe078d65242df929cb51298130?d=identicon\u0026s=64", "cl": "320459@main", "clUrl": "https://commits.webkit.org/320459@main", "description": "https://bugs.webkit.org/show_bug.cgi?id=323346\nrdar://186588312\n\nReviewed by Zak Ridouh.\n\nSilence deprecation warnings in API tests, matching what the Xcode build\ndoes. It's intentional that API tests cover deprecated API.\n\n* Tools/TestWebKitAPI/CMakeLists.txt:\n\nCanonical link: https://commits.webkit.org/320459@main", "email": "emw@apple.com", "hash": "d1856daa41f760dbe3409b9f5908b0db5277c783", "subject": "[CMake] TestWebKitAPI fails to build due to injected bundle API deprecations" } }, "date": "2026-09-03", "days": 1, "generatedAt": "2026-09-03T22:06:40Z", "markdown": "## Highlights\n- **Security** Fixed multiple memory-safety bugs across ShareDataReader, threaded animations, WebGPU command submission, CoreIPC media capture, and RTC encoders, cutting off several concrete UAF and out-of-bounds paths. [commit 320367@main](https://commits.webkit.org/320367@main) [commit 320360@main](https://commits.webkit.org/320360@main) [commit 320361@main](https://commits.webkit.org/320361@main) [commit 320368@main](https://commits.webkit.org/320368@main) [commit 320365@main](https://commits.webkit.org/320365@main)\n- **Rendering** WebKit landed a dense batch of rendering fixes spanning blur repaint, shape-outside geometry, list marker ownership, font sizing semantics, and CSS invalidation after view transitions. [commit 320398@main](https://commits.webkit.org/320398@main) [commit 320417@main](https://commits.webkit.org/320417@main) [commit 320447@main](https://commits.webkit.org/320447@main) [commit 320431@main](https://commits.webkit.org/320431@main) [commit 320420@main](https://commits.webkit.org/320420@main)\n- **JSC** JavaScriptCore got a broad wasm and optimizer push with constant-expression cleanup, ARM64 address-form folding, funcref table.get inlining, cache invalidation fixes, and several FTL/OMG correctness hardenings. [commit 320453@main](https://commits.webkit.org/320453@main) [commit 320441@main](https://commits.webkit.org/320441@main) [commit 320438@main](https://commits.webkit.org/320438@main) [commit 320375@main](https://commits.webkit.org/320375@main) [commit 320374@main](https://commits.webkit.org/320374@main)\n- **UI** PDF and media UX moved forward with the alternate PDF HUD re-landed by default, restored PDF context-menu selection options, and fixes for broken spatial video playback transitions on visionOS. [commit 320392@main](https://commits.webkit.org/320392@main) [commit 320444@main](https://commits.webkit.org/320444@main) [commit 320425@main](https://commits.webkit.org/320425@main)\n- **A11y** Accessibility work was unusually substantial, fixing isolated-tree text marker math, list-marker spacing, tree disclosure levels, and VoiceOver's wrong spoken names for Meta and Alt on macOS. [commit 320443@main](https://commits.webkit.org/320443@main) [commit 320426@main](https://commits.webkit.org/320426@main) [commit 320415@main](https://commits.webkit.org/320415@main) [commit 320424@main](https://commits.webkit.org/320424@main)\n- **Web Platform** Several spec-alignment fixes landed across declarative shadow roots, overflow-clip-margin, continue/line-clamp parsing, Grid Lanes interpolation, Trusted Types enforcement, and MoveBefore testability. [commit 320399@main](https://commits.webkit.org/320399@main) [commit 320436@main](https://commits.webkit.org/320436@main) [commit 320411@main](https://commits.webkit.org/320411@main) [commit 320383@main](https://commits.webkit.org/320383@main) [commit 320372@main](https://commits.webkit.org/320372@main) [commit 320357@main](https://commits.webkit.org/320357@main)\n- **GPU** Graphics and GPU plumbing saw real fixes, including WebGL validation, ANGLE vertex attrib state repair, serialized image buffer isolation cleanup, and GTK Skia compositor y-flip fixes. [commit 320371@main](https://commits.webkit.org/320371@main) [commit 320373@main](https://commits.webkit.org/320373@main) [commit 320359@main](https://commits.webkit.org/320359@main) [commit 320422@main](https://commits.webkit.org/320422@main)\n- **Perf** Targeted performance work landed in IntersectionObserver, SpeculationRules parsing, and JSC atomization and wasm byte handling, shaving overhead from hot paths instead of chasing benchmarks. [commit 320395@main](https://commits.webkit.org/320395@main) [commit 320391@main](https://commits.webkit.org/320391@main) [commit 320402@main](https://commits.webkit.org/320402@main) [commit 320393@main](https://commits.webkit.org/320393@main)\n- **Build** The CMake and EWS stack got a cleanup pass that should make local and bot iteration less annoying, including merged API test executables, missing Cocoa test sources, warm-build speedups, and earlier failure on missing change_id. [commit 320433@main](https://commits.webkit.org/320433@main) [commit 320449@main](https://commits.webkit.org/320449@main) [commit 320423@main](https://commits.webkit.org/320423@main) [commit 320455@main](https://commits.webkit.org/320455@main)\n\n## What landed by area\n\n### JavaScriptCore and Wasm\n- **V8** JSC split wasm constant-expression validation from evaluation, making the pipeline easier to reason about and optimize. [commit 320453@main](https://commits.webkit.org/320453@main)\n- **Perf** JSC folds shift-left into ARM64 WasmAddress index forms to generate tighter wasm address calculations. [commit 320441@main](https://commits.webkit.org/320441@main)\n- **Perf** JSC now inlines funcref table.get in wasm fast paths. [commit 320438@main](https://commits.webkit.org/320438@main)\n- **Perf** JSC avoids atomizing import names twice during module handling. [commit 320402@main](https://commits.webkit.org/320402@main)\n- **Perf** JSC stops copying wasm constant-expression byte sequences unnecessarily. [commit 320393@main](https://commits.webkit.org/320393@main)\n- **Web Platform** Intl.PluralRules.select and selectRange now accept BigInt in JSC. [commit 320396@main](https://commits.webkit.org/320396@main)\n- **V8** cachedPutById now marks m_notCellMask and m_numberTag as lateReg, improving register allocation constraints in JIT codegen. [commit 320378@main](https://commits.webkit.org/320378@main)\n- **Security** JSC fixed megamorphic store cache invalidation when deleting a property from a dictionary prototype in place. [commit 320375@main](https://commits.webkit.org/320375@main)\n- **V8** FTL validation patchpoints were hardened to be less fragile. [commit 320374@main](https://commits.webkit.org/320374@main)\n- **V8** ObjectCreate folding now emits the checks it needs instead of assuming too much. [commit 320366@main](https://commits.webkit.org/320366@main)\n- **Refactor** DateInstance was made non-destructible in JSC. [commit 320364@main](https://commits.webkit.org/320364@main)\n- **V8** OMG addReturn patchpoints now declare macro-register clobbers correctly. [commit 320363@main](https://commits.webkit.org/320363@main)\n- **V8** Object Allocation Sinking was fixed for allocations inside inlined closure-call and varargs frames. [commit 320362@main](https://commits.webkit.org/320362@main)\n- **Web Platform** WebKit imported upstream JSPI TestSandwich await and ESM worker message-shape WPT fixes. [commit 320437@main](https://commits.webkit.org/320437@main)\n\n### Rendering and CSS\n- **Rendering** overflow-clip-margin now accepts negative length values per spec expectations. [commit 320436@main](https://commits.webkit.org/320436@main)\n- **Rendering** Font code now consistently uses computedSize instead of specifiedSize references. [commit 320431@main](https://commits.webkit.org/320431@main)\n- **Rendering** CSS attr() invalidation was fixed so attribute changes still propagate after a view transition. [commit 320420@main](https://commits.webkit.org/320420@main)\n- **Rendering** shape-outside geometry is corrected when the float has margins. [commit 320417@main](https://commits.webkit.org/320417@main)\n- **Web Platform** continue now parses the -webkit-legacy value for line-clamp compatibility. [commit 320411@main](https://commits.webkit.org/320411@main)\n- **Rendering** Blur-filtered content now repaints when interior content changes. [commit 320398@main](https://commits.webkit.org/320398@main)\n- **Perf** SpeculationRules::parseSingleRule no longer rebuilds its allowed-keys HashSet every call. [commit 320391@main](https://commits.webkit.org/320391@main)\n- **Rendering** Grid Lanes fit-tolerance now interpolates correctly between length-percentage values. [commit 320383@main](https://commits.webkit.org/320383@main)\n- **Refactor** Quirk handling gained global quirks in the quirk table. [commit 320376@main](https://commits.webkit.org/320376@main)\n- **Refactor** A dead SameSite cookie quirk was removed. [commit 320380@main](https://commits.webkit.org/320380@main)\n- **Rendering** RenderListItem now answers for its marker directly instead of making callers consult RenderListMarker. [commit 320447@main](https://commits.webkit.org/320447@main)\n\n### Graphics, GPU, WebGL, and WebGPU\n- **DevTools** InspectorCanvas now uses NativeImage when exporting content as a data URL. [commit 320432@main](https://commits.webkit.org/320432@main)\n- **Rendering** GraphicsContext::drawNativeImage gained InterpolationQuality support. [commit 320429@main](https://commits.webkit.org/320429@main)\n- **GPU** WebGPU video uploading now plays the Lake sample correctly when videoSource is a video element. [commit 320427@main](https://commits.webkit.org/320427@main)\n- **Refactor** DestinationColorSpace was renamed to ColorSpace as part of graphics type cleanup. [commit 320435@main](https://commits.webkit.org/320435@main)\n- **Refactor** That rename was refined again, with ColorSpace renamed to ColorSpaceName. [commit 320406@main](https://commits.webkit.org/320406@main)\n- **GPU** GraphicsContextGLANGLE now implements checkGPUStatus on GLib platforms. [commit 320403@main](https://commits.webkit.org/320403@main)\n- **GPU** WebGL texture-srgb-upload expectations were aligned with actual bot behavior. [commit 320397@main](https://commits.webkit.org/320397@main)\n- **Security** WebGL now rejects offset-based GL calls when no buffer is bound. [commit 320371@main](https://commits.webkit.org/320371@main)\n- **GPU** ANGLE now updates element limits after format-only VertexAttribPointer changes. [commit 320373@main](https://commits.webkit.org/320373@main)\n- **Security** WebGPU command buffer teardown was fixed to avoid races on Metal completion threads. [commit 320361@main](https://commits.webkit.org/320361@main)\n- **Security** SerializedImageBuffer was fixed to stop leaking cross-RemoteRenderingBackend data through GraphicsContext. [commit 320359@main](https://commits.webkit.org/320359@main)\n- **Rendering** putPixelBuffer() and getPixelBuffer() are now correctly rejected for LayerBacking. [commit 320358@main](https://commits.webkit.org/320358@main)\n- **GPU** WGSL validation test failures for discard statements were fixed up. [commit 320381@main](https://commits.webkit.org/320381@main)\n- **Rendering** GTK3's Skia compositor no longer y-flips content with SHM or GBM mapped buffers. [commit 320422@main](https://commits.webkit.org/320422@main)\n\n### Networking, Loading, Storage, and Site Isolation\n- **Networking** The test HTTP/2 server now splits cookie lists correctly. [commit 320457@main](https://commits.webkit.org/320457@main)\n- **Networking** A fetch range-response WPT failure on non-matching ranges was fixed. [commit 320414@main](https://commits.webkit.org/320414@main)\n- **Networking** webRequest events now fire correctly for tabs.create. [commit 320430@main](https://commits.webkit.org/320430@main)\n- **Security** CloneDeserializer now asserts it is only used in the WebContent process. [commit 320419@main](https://commits.webkit.org/320419@main)\n- **Security** ShareDataReader was fixed for a use-after-free where cancel() could run on a freed object after completion handler destruction. [commit 320367@main](https://commits.webkit.org/320367@main)\n- **Privacy** ITP test cases were de-flaked to stabilize privacy coverage. [commit 320369@main](https://commits.webkit.org/320369@main)\n- **Privacy** PrivateClickMeasurement token URL getters now return sane std::optional\u003cURL\u003e types. [commit 320389@main](https://commits.webkit.org/320389@main)\n- **Privacy** PrivateClickMeasurement path constants now use ASCIILiteral to avoid unsafeSpan usage. [commit 320387@main](https://commits.webkit.org/320387@main)\n- **Refactor** Dead code in SubframeLoader::loadSubframe() was removed. [commit 320390@main](https://commits.webkit.org/320390@main)\n- **Refactor** Loader classes replaced typedef with using. [commit 320388@main](https://commits.webkit.org/320388@main)\n- **Security** New pages added to a BrowsingContextGroup are now registered with the shared process under Site Isolation. [commit 320434@main](https://commits.webkit.org/320434@main)\n- **DevTools** A stale Site Isolation Web Inspector skip and pass expectation for cross-origin iframe cookie storage was removed. [commit 320379@main](https://commits.webkit.org/320379@main)\n\n### Accessibility, Text Extraction, and Editing\n- **A11y** Text extraction now picks up one-time code fields that battle.net was losing. [commit 320448@main](https://commits.webkit.org/320448@main)\n- **UI** On macOS, PDF context menus again show text-selection options even when copying is disabled. [commit 320444@main](https://commits.webkit.org/320444@main)\n- **A11y** AXIndexForTextMarker now returns the correct end-of-document position for empty text fields in isolated tree mode. [commit 320443@main](https://commits.webkit.org/320443@main)\n- **A11y** AXStringForTextMarkerRange now preserves the space after bulleted list markers in isolated tree mode. [commit 320426@main](https://commits.webkit.org/320426@main)\n- **A11y** VoiceOver now announces aria-keyshortcuts Meta and Alt as Command and Option on macOS. [commit 320424@main](https://commits.webkit.org/320424@main)\n- **A11y** Text extraction now exposes some google.com checkboxes that Safari MCP was missing. [commit 320421@main](https://commits.webkit.org/320421@main)\n- **A11y** Nested tree items inside authored role=\"group\" now report a proper disclosure level with the isolated tree enabled. [commit 320415@main](https://commits.webkit.org/320415@main)\n- **A11y** Unused AX helpers isTableCellInSameColGroup and nextUnignoredSibling were removed. [commit 320451@main](https://commits.webkit.org/320451@main)\n- **A11y** A flaky site-isolation accessibility WPT involving two iframes in a shared process was addressed. [commit 320439@main](https://commits.webkit.org/320439@main)\n\n### Media, Video, PDF, and Realtime\n- **Media** Pages can no longer opt out of the experimental spatial video renderer. [commit 320442@main](https://commits.webkit.org/320442@main)\n- **Mobile** visionOS video playback no longer greys out after entering and exiting Spatial Browsing. [commit 320425@main](https://commits.webkit.org/320425@main)\n- **Media** QR scanner camera preview rendering was fixed for dibsido. [commit 320405@main](https://commits.webkit.org/320405@main)\n- **Security** RemoteImageDecoderAVFProxy had a race condition fixed. [commit 320400@main](https://commits.webkit.org/320400@main)\n- **UI** The alternate PDF HUD view was re-landed as the default. [commit 320392@main](https://commits.webkit.org/320392@main)\n- **Security** UserMediaCaptureManagerProxySourceProxy no longer leaves a dangling VideoFrameObserver* in RealtimeMediaSource. [commit 320368@main](https://commits.webkit.org/320368@main)\n- **Security** RTC H.265 and H.264 frameWasEncoded handling was fixed for an out-of-bounds read caused by using total block-buffer size instead of chunk length. [commit 320365@main](https://commits.webkit.org/320365@main)\n- **Security** IOSurfacePool eviction no longer dereferences an end() iterator. [commit 320370@main](https://commits.webkit.org/320370@main)\n\n### DOM, APIs, and Web Platform\n- **Web Platform** currentcolor now has a tentative css-link-params test as a parameter value. [commit 320445@main](https://commits.webkit.org/320445@main)\n- **Web Platform** deleteAllCookies in WebDriver now honors completion handler results instead of always returning success. [commit 320440@main](https://commits.webkit.org/320440@main)\n- **Web Platform** WebDriver blank windows now report the correct URL instead of tripping assertions in tests. [commit 320428@main](https://commits.webkit.org/320428@main)\n- **Web Platform** Declarative shadow root opt-in is now preserved when cloning documents. [commit 320399@main](https://commits.webkit.org/320399@main)\n- **Security** Document.execCommand Trusted Types enforcement is now case-insensitive. [commit 320372@main](https://commits.webkit.org/320372@main)\n- **Web Platform** MoveBeforeEnabled was made testable. [commit 320357@main](https://commits.webkit.org/320357@main)\n\n### Build, EWS, Testing, and Tooling\n- **Build** TestWebKitAPI deprecation fallout on CMake builds was fixed. [commit 320459@main](https://commits.webkit.org/320459@main)\n- **Refactor** CODEOWNERS was updated for emw-apple. [commit 320458@main](https://commits.webkit.org/320458@main)\n- **Build** EWS now fails fast when change_id is missing. [commit 320455@main](https://commits.webkit.org/320455@main)\n- **Security** EnhancedSecurity API test expectations were updated. [commit 320454@main](https://commits.webkit.org/320454@main)\n- **Build** Missing Cocoa API test sources were added to CMakeLists.txt. [commit 320449@main](https://commits.webkit.org/320449@main)\n- **Build** Cocoa port API test executables were merged into TestWebKitAPI. [commit 320433@main](https://commits.webkit.org/320433@main)\n- **Build** Warm CMake builds should be faster after removing a dead CCACHE_CONFIGPATH reference. [commit 320423@main](https://commits.webkit.org/320423@main)\n- **Build** cmake build breakage on iOS and visionOS introduced by [bug 323271](https://bugs.webkit.org/show_bug.cgi?id=323271) was fixed. [commit 320386@main](https://commits.webkit.org/320386@main)\n- **Build** Safer C++ suppressions were trimmed now that adoptOSObject() replaces adoptXPCObject(). [commit 320385@main](https://commits.webkit.org/320385@main)\n- **Build** Safer C++ expectations were refreshed. [commit 320382@main](https://commits.webkit.org/320382@main)\n- **DevTools** dump-class-layout can now inspect classes from static libraries and other binaries. [commit 320394@main](https://commits.webkit.org/320394@main)\n- **Build** EWS ResultsDB read and write paths are now typed. [commit 320412@main](https://commits.webkit.org/320412@main)\n- **Build** EWS clean-tree flake conviction can now rely on a single same-author observation. [commit 320410@main](https://commits.webkit.org/320410@main)\n- **Build** JSC EWS no longer blames the pull request author for pre-existing flaky tests. [commit 320409@main](https://commits.webkit.org/320409@main)\n- **DevTools** resultsdbpy fixed an endless spinner when an investigate-drawer failures query returns nothing. [commit 320408@main](https://commits.webkit.org/320408@main)\n- **DevTools** resultsdbpy now loads failures for WPE runs that share a revision with the legacy API. [commit 320407@main](https://commits.webkit.org/320407@main)\n- **Build** WPE clipboard API tests were fixed on the legacy API bot. [commit 320404@main](https://commits.webkit.org/320404@main)\n- **DevTools** A websocket inspector layout-test regression from [bug 321323](https://bugs.webkit.org/show_bug.cgi?id=321323) was fixed. [commit 320401@main](https://commits.webkit.org/320401@main)\n- **Build** GLib stale flaky expectations were removed. [commit 320384@main](https://commits.webkit.org/320384@main)\n- **Build** Unreviewed tests gardening landed for the day. [commit 320416@main](https://commits.webkit.org/320416@main)\n\n## Reverts \u0026 Reapplies\n- **UI** Re-landed the alternate PDF HUD view by default after earlier rollback or instability. [commit 320392@main](https://commits.webkit.org/320392@main)", "repo": "webkit", "repoDisplay": "WebKit", "rollGroups": [ { "name": "Unreviewed", "count": 1 } ], "since": "2026-09-03", "totals": { "commits": 103, "features": 102, "rolls": 1 }, "until": "2026-09-03" }