{ "breakdown": { "byResolution": { "DUPLICATE": 1, "FIXED": 7 } }, "commits": { "206001": { "author": "dpino", "avatar": "https://www.gravatar.com/avatar/e8cce88637f1a6e79155e8371e24b2e8?d=identicon\u0026s=64", "cl": "206001", "clUrl": "https://bugs.webkit.org/show_bug.cgi?id=206001", "description": "Status: RESOLVED\nResolution: FIXED\nComponent: CSS\nPriority: P2\nSeverity: Normal\nAssignee: dpino@igalia.com\nReporter: dpino@igalia.com\nLast change: 2026-08-29T13:45:35Z", "email": "dpino@igalia.com", "hash": "206001", "subject": "[GLIB] imported/w3c/web-platform-tests/css/css-values/ch-unit-017.html is failing" }, "321148": { "author": "lmoura", "avatar": "https://www.gravatar.com/avatar/6157f52d61e04c2c63fe7ff668ba69b3?d=identicon\u0026s=64", "cl": "321148", "clUrl": "https://bugs.webkit.org/show_bug.cgi?id=321148", "description": "Status: RESOLVED\nResolution: FIXED\nComponent: Tools / Tests\nPriority: P2\nSeverity: Normal\nAssignee: lmoura@igalia.com\nReporter: lmoura@igalia.com\nLast change: 2026-08-29T21:50:19Z", "email": "lmoura@igalia.com", "hash": "321148", "subject": "[WebDriver][Tools] Some WPT tests depend on a deprecated event_loop fixture from pytest-asyncio" }, "321756": { "author": "jmichaud", "avatar": "https://www.gravatar.com/avatar/36e0433ee725a08f7e1122a6bc584b57?d=identicon\u0026s=64", "cl": "321756", "clUrl": "https://bugs.webkit.org/show_bug.cgi?id=321756", "description": "Status: RESOLVED\nResolution: FIXED\nComponent: Platform\nPriority: P2\nSeverity: Normal\nAssignee: jmichaud@igalia.com\nReporter: justin@justinmichaud.com\nLast change: 2026-08-29T14:51:00Z", "email": "jmichaud@igalia.com", "hash": "321756", "subject": "[non-cocoa][fuzz] Frame cache evicted or unparsed frames dereferenced" }, "322196": { "author": "webkit-unassigned", "avatar": "https://www.gravatar.com/avatar/80334dc799c6463fc3ad56a385ca3ffd?d=identicon\u0026s=64", "cl": "322196", "clUrl": "https://bugs.webkit.org/show_bug.cgi?id=322196", "description": "Status: RESOLVED\nResolution: DUPLICATE\nComponent: CSS\nPriority: P2\nSeverity: Normal\nAssignee: webkit-unassigned@lists.webkit.org\nReporter: sam@webkit.org\nLast change: 2026-08-29T17:02:50Z", "email": "webkit-unassigned@lists.webkit.org", "hash": "322196", "subject": "Remove non-standard Blend node from Style::Calculation tree" }, "322610": { "author": "ahmad.saleem792", "avatar": "https://www.gravatar.com/avatar/3d43be18ce5ee6b92ba9151b63591125?d=identicon\u0026s=64", "cl": "322610", "clUrl": "https://bugs.webkit.org/show_bug.cgi?id=322610", "description": "Status: RESOLVED\nResolution: FIXED\nComponent: SVG\nPriority: P2\nSeverity: Normal\nAssignee: ahmad.saleem792@gmail.com\nReporter: ahmad.saleem792@gmail.com\nLast change: 2026-08-29T15:52:14Z", "email": "ahmad.saleem792@gmail.com", "hash": "322610", "subject": "SVGLengthValue::setValueAsString() copies the string it is handed for every SVG length attribute parsed" }, "322838": { "author": "csaavedra", "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64", "cl": "322838", "clUrl": "https://bugs.webkit.org/show_bug.cgi?id=322838", "description": "Status: RESOLVED\nResolution: FIXED\nComponent: WebKitGTK\nPriority: P2\nSeverity: Normal\nAssignee: csaavedra@igalia.com\nReporter: csaavedra@igalia.com\nLast change: 2026-08-29T14:05:07Z", "email": "csaavedra@igalia.com", "hash": "322838", "subject": "[GLIB] Unskip the IPC colorspace tests on the GLib ports" }, "322889": { "author": "sosuke", "avatar": "https://www.gravatar.com/avatar/cf9d615e1e00176d99cc4a21d33c3bbb?d=identicon\u0026s=64", "cl": "322889", "clUrl": "https://bugs.webkit.org/show_bug.cgi?id=322889", "description": "Status: RESOLVED\nResolution: FIXED\nComponent: JavaScriptCore\nPriority: P2\nSeverity: Normal\nAssignee: sosuke@bun.com\nReporter: sosuke@bun.com\nLast change: 2026-08-29T07:56:15Z", "email": "sosuke@bun.com", "hash": "322889", "subject": "[JSC] DFG `StringReplace` constant folding steps into a surrogate pair after an empty match for unicode RegExps" }, "322899": { "author": "ysuzuki", "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64", "cl": "322899", "clUrl": "https://bugs.webkit.org/show_bug.cgi?id=322899", "description": "Status: RESOLVED\nResolution: FIXED\nComponent: JavaScriptCore\nPriority: P2\nSeverity: Normal\nAssignee: ysuzuki@apple.com\nReporter: ysuzuki@apple.com\nLast change: 2026-08-29T19:29:06Z", "email": "ysuzuki@apple.com", "hash": "322899", "subject": "[JSC] incorrect ValueProfile is used in BaselineJIT iterator_next" } }, "date": "2026-08-29", "days": 1, "generatedAt": "2026-08-29T22:05:14Z", "kind": "issues", "markdown": "## Highlights\n- **JavaScript** Fixed a JavaScriptCore regexp optimization bug where `String.prototype.replace` with Unicode regexps could step into a surrogate pair after an empty match, causing incorrect string handling. [bug 322889](https://bugs.webkit.org/show_bug.cgi?id=322889)\n- **JavaScript** Fixed incorrect profiling in BaselineJIT's `iterator_next`, improving correctness of JIT-optimized iteration paths. [bug 322899](https://bugs.webkit.org/show_bug.cgi?id=322899)\n- **Platform** Fixed a non-Cocoa fuzzing issue where evicted or unparsed frame cache entries could be dereferenced, addressing a crash-prone memory safety problem. [bug 321756](https://bugs.webkit.org/show_bug.cgi?id=321756)\n- **SVG** Reduced overhead in SVG length parsing by avoiding repeated string copies in `SVGLengthValue::setValueAsString()`, improving SVG attribute processing efficiency. [bug 322610](https://bugs.webkit.org/show_bug.cgi?id=322610)\n- **CSS** Fixed a failing `ch` unit WPT in css-values coverage, improving standards compliance in CSS value handling. [bug 206001](https://bugs.webkit.org/show_bug.cgi?id=206001)\n\n## By component\n\n### CSS layout\n- Fixed a failing WPT for CSS `ch` unit handling in `css-values/ch-unit-017.html`. [bug 206001](https://bugs.webkit.org/show_bug.cgi?id=206001)\n\n### JavaScriptCore\n- Fixed Unicode regexp constant folding in DFG `StringReplace` so empty matches do not advance into surrogate pairs incorrectly. [bug 322889](https://bugs.webkit.org/show_bug.cgi?id=322889)\n- Fixed BaselineJIT to use the correct `ValueProfile` in `iterator_next`. [bug 322899](https://bugs.webkit.org/show_bug.cgi?id=322899)\n\n### Platform\n- Fixed a fuzz-found bug where frame cache entries that were evicted or never fully parsed could still be dereferenced. [bug 321756](https://bugs.webkit.org/show_bug.cgi?id=321756)\n\n### SVG\n- Fixed repeated string copying in `SVGLengthValue::setValueAsString()` for SVG length attributes. [bug 322610](https://bugs.webkit.org/show_bug.cgi?id=322610)\n\n### Tools / Tests\n- Fixed WebDriver WPT coverage that depended on the deprecated `event_loop` fixture from `pytest-asyncio`. [bug 321148](https://bugs.webkit.org/show_bug.cgi?id=321148)\n\n### WebKitGTK\n- Re-enabled IPC colorspace tests on GLib ports. [bug 322838](https://bugs.webkit.org/show_bug.cgi?id=322838)\n\n## Resolution other than FIXED\n- CSS cleanup to remove a non-standard Blend node from the Style::Calculation tree was closed as a duplicate of existing work. [bug 322196](https://bugs.webkit.org/show_bug.cgi?id=322196)", "repo": "webkit", "repoDisplay": "WebKit", "since": "2026-08-29", "totals": { "components": 6, "contributors": 8, "issues": 8 }, "until": "2026-08-29" }